Zyxel NXC5500 [352/469] Note you should include write commands in your scripts if you do not use the write command the changes will be lost when the nxc restarts you could use multiple write commands...

The nxc does not stop or start the system processes when you apply configuration files or run shell scripts although you may temporarily lose access to network resources 21

Hardware installation and connection 22

Rack mounted installation 22

Rack mounted installation procedure 22

Front panel 23

Nxc2500 23

Nxc5500 23

Console port nxc5500 only 24

Default ethernet settings 24

Ethernet ports 24

Chapter 2 hardware installation and connection 25

Connect a usb storage device to a usb port on the nxc to archive the nxc system logs or save the nxc operating system core dump to it 25

Db 9 signal db 9 pin wire color rj45 pin 25

Front panel leds 25

Led color status description 25

Nxc series user s guide 25

Nxc2500 25

Nxc5500 25

Table 6 rj 45 to db 9 console cable color codes 25

Table 7 front panel leds nxc2500 25

Table 8 front panel leds nxc5500 25

The following table describes the leds 25

This section describes the front panel leds 25

Usb 2 ports 25

115200 bps 26

Chapter 2 hardware installation and connection 26

Connect this port to your computer using an rs 232 cable if you want to configure the nxc using the command line interface cli via the console port 26

Console port nxc2500 only 26

Figure 6 rear panel nxc2500 26

Figure 7 rear panel nxc5500 26

For local management you can use a computer with terminal emulation software configured to the following parameters 26

Led color status description 26

No flow control 26

No parity 8 data bits 1 stop bit 26

Nxc series user s guide 26

Rear panel 26

Table 8 front panel leds nxc5500 continued 26

The nxc2500 rear panel contains a console port a power switch and a connector for the power receptacle 26

The nxc5500 rear panel contains a power switch a connector for the power receptacle and a fan module 26

Vt100 terminal emulation 26

Access 28

Overview 28

The web configurator 28

The main screen 29

Title bar 30

Chapter 3 the web configurator 31

Click about to display basic information about the nxc 31

Click site map to see an overview of links to the web configurator screens click a screen s link to go to that screen 31

Figure 10 about 31

Label description 31

Nxc series user s guide 31

Site map 31

Table 10 about 31

Table 9 title bar web configurator icons continued 31

The following table describes labels that can appear in this screen 31

Object reference 32

Chapter 3 the web configurator 33

Console 33

Figure 13 console 33

Label description 33

Note to view the functions in the web configurator user interface that correspond directly to specific nxc cli commands use the cli messages window see cli messages on page 36 in tandem with this one 33

Nxc series user s guide 33

Table 11 object references continued 33

The console allows you to use cli commands from directly within the web configurator rather than having to use a separate terminal program in addition to logging in directly to the nxc s cli you can also log into other devices on the network through this console it uses ssh to establish a connection 33

Cli messages 36

Chapter 3 the web configurator 37

Dashboard 37

Figure 15 navigation panel 37

Folder or link tab function 37

For details on the dashboard s features see chapter 4 on page 46 37

Monitor menu 37

Navigation panel 37

Nxc series user s guide 37

Table 13 monitor menu screens summary 37

The dashboard displays general device information system status system resource usage licensed service status and interface status in widgets that you can re arrange to suit your needs 37

The monitor menu screens display status and statistics information 37

Use the menu items on the navigation panel to open screens to configure nxc features click the arrow in the middle of the right edge of the navigation panel to hide the navigation panel menus or drag it to resize them the following sections introduce the nxc s navigation panel menus and their screens 37

Chapter 3 the web configurator 38

Configuration menu 38

Folder or link tab function 38

Nxc series user s guide 38

Table 13 monitor menu screens summary continued 38

Table 14 configuration menu screens summary 38

Use the configuration menu screens to configure the nxc s features 38

Chapter 3 the web configurator 39

Folder or link tab function 39

Nxc series user s guide 39

Table 14 configuration menu screens summary continued 39

Chapter 3 the web configurator 40

Figure 16 warning message 40

Folder or link tab function 40

Maintenance menu 40

Nxc series user s guide 40

Table 14 configuration menu screens summary continued 40

Table 15 maintenance menu screens summary 40

Use the maintenance menu screens to manage configuration and firmware files run diagnostics and reboot or shut down the nxc 40

Warning messages 40

Warning messages such as those resulting from misconfiguration display in a popup window 40

Manipulating table display 41

Tables and lists 41

Chapter 3 the web configurator 43

Here are descriptions for the most common table icons 43

Label description 43

Nxc series user s guide 43

Table 16 common table icons 43

Table 17 common table icons 43

The tables have icons for working with table entries a sample is shown next you can often use the shift or ctrl key to select multiple entries to remove activate or deactivate 43

Use the icons and fields at the bottom of the table to navigate to different pages of entries and control how many entries display at a time 43

Working with table entries 43

Chapter 3 the web configurator 44

Figure 17 working with lists 44

Label description 44

Nxc series user s guide 44

Table 17 common table icons continued 44

When a list of available entries displays next to a list of selected entries you can often just double click an entry to move it from one list to the other in some lists you can also use the shift or ctrl key to select multiple entries and then use the arrow button to move them to the other list 44

Working with lists 44

Technical reference 45

Dashboard 46

Overview 46

What you can do in this chapter 46

Dashboard 47

Chapter 4 dashboard 48

Label description 48

Nxc series user s guide 48

Table 18 dashboard 48

The following table describes the labels in this screen 48

Chapter 4 dashboard 49

Label description 49

Nxc series user s guide 49

Table 18 dashboard continued 49

Chapter 4 dashboard 50

Label description 50

Nxc series user s guide 50

Table 18 dashboard continued 50

Chapter 4 dashboard 51

Cpu usage 51

Label description 51

Nxc series user s guide 51

Table 18 dashboard continued 51

The following table describes the labels in this screen 51

Use this screen to look at a chart of the nxc s recent cpu usage to access this screen click show cpu usage in the dashboard 51

Memory usage 52

Session usage 52

Dhcp table 53

Chapter 4 dashboard 54

Dhcp table 54

Label description 54

Number of login users 54

Nxc series user s guide 54

The following table describes the labels in this screen 54

Use this screen to look at a list of the users currently logged into the nxc to access this screen click the dashboard s number of login users icon 54

Chapter 4 dashboard 55

Label description 55

Number of login users 55

Nxc series user s guide 55

The following table describes the labels in this screen 55

Monitor 56

Overview 56

What you can do in this chapter 56

Port statistics 57

What you need to know 57

Chapter 5 monitor 58

Label description 58

Nxc series user s guide 58

Port statistics and then the switch to graphic view button 58

Port statistics continued 58

Port statistics graph 58

Chapter 5 monitor 59

Interface status 59

Interface status to access this screen 59

Label description 59

Nxc series user s guide 59

Switch to graphic view 59

The following table describes the labels in this screen 59

Chapter 5 monitor 60

Each field is described in the following table 60

Interface status 60

Label description 60

Nxc series user s guide 60

Chapter 5 monitor 61

Interface status continued 61

Label description 61

Nxc series user s guide 61

Chapter 5 monitor 62

Interface status continued 62

Label description 62

Lan ip with heaviest traffic and how much traffic has been sent to and from each one 62

Most used protocols or service ports and the amount of traffic on each one 62

Most visited web sites and the number of times each one was visited this count may not be accurate in some cases because the nxc counts http get packets 62

Nxc series user s guide 62

Traffic statistics 62

Traffic statistics to display this screen this screen provides basic information about the different kinds of data traffic moving through the nxc for example 62

You use the traffic statistics screen to tell the nxc when to start and when to stop collecting information for these reports you cannot schedule data collection you have to start and stop it manually in the traffic statistics screen 62

Chapter 5 monitor 63

Label description 63

Nxc series user s guide 63

There is a limit on the number of records shown in the report see table 28 on page 64 for more information the following table describes the labels in this screen 63

Traffic statistics 63

Chapter 5 monitor 64

Label description 64

Nxc series user s guide 64

Table 28 maximum values for reports 64

The following table displays the maximum number of records shown in the report the byte count limit and the hit count limit 64

Traffic statistics continued 64

Session monitor 65

Chapter 5 monitor 66

Label description 66

Nxc series user s guide 66

Session monitor 66

The following table describes the labels in this screen 66

Ip mac binding monitor 67

Login users 67

Chapter 5 monitor 68

Label description 68

Login users 68

Nxc series user s guide 68

The following table describes the labels in this screen 68

Chapter 5 monitor 69

Dynamic guest 69

Label description 69

Note if you delete a valid user account which is in use the nxc ends the user session 69

Nxc series user s guide 69

The following table describes the labels in this screen 69

Chapter 5 monitor 70

Label description 70

Nxc series user s guide 70

The following table describes the labels in this screen 70

Usb storage 70

Usb storage to display this screen 70

Ap list 71

Chapter 5 monitor 71

Label description 71

Nxc series user s guide 71

The following table describes the labels in this screen 71

Ap list continued 72

Ap list icons 72

Chapter 5 monitor 72

Label description 72

Nxc series user s guide 72

Station count of ap 72

The following table describes the icons in this screen 72

Use this screen to look at configuration information port status and station statistics for the connected ap to access this screen select an entry and click the more information button in the ap list screen 72

Ap information 73

Chapter 5 monitor 73

Label description 73

Nxc series user s guide 73

The following table describes the labels in this screen 73

Ap information continued 74

Chapter 5 monitor 74

Config ap 74

Label description 74

Nxc series user s guide 74

Use this screen to change the group and radio vlan and port settings of the connected ap to access this screen select an entry and click the config ap button in the ap list screen 74

Chapter 5 monitor 76

Config ap 76

Label description 76

Note ensure you restart the managed ap after you change its operating mode 76

Note the root ap and repeater ap s in a zymesh must use the same country code and ap radio profile settings in order to communicate with each other 76

Note to prevent bidge loops do not set both radios on a managed ap to repeater ap mode 76

Nxc series user s guide 76

The following table describes the labels in this screen 76

Chapter 5 monitor 77

Config ap continued 77

Label description 77

Nxc series user s guide 77

Chapter 5 monitor 78

Config ap continued 78

Label description 78

Nxc series user s guide 78

Radio list 78

The following table describes the labels in this screen 78

Ap mode radio information 79

Ap mode radio information 81

Chapter 5 monitor 81

Label description 81

Nxc series user s guide 81

The following table describes the labels in this screen 81

Zymesh link info 81

Zymesh link info to access this screen 81

Chapter 5 monitor 82

Label description 82

Nxc series user s guide 82

Station list 82

Station list to access this screen 82

The following table describes the labels in this screen 82

Zymesh link info 82

Ap management screen in order to detect other wireless devices in its vicinity 83

Chapter 5 monitor 83

Detected device 83

Detected device to access this screen 83

Label description 83

Nxc series user s guide 83

Station list 83

The following table describes the labels in this screen 83

Chapter 5 monitor 84

Detected device 84

Events that generate an alert as well as a log message display in red regular logs display in black click a column s heading cell to sort the table entries by that column s criteria click the heading cell again to reverse the sort order 84

For individual log descriptions see appendix a on page 385 84

For the maximum number of log messages in the nxc see the datasheet 84

Label description 84

Log messages are stored in two separate logs one for regular log messages and one for debugging messages in the regular log you can look at all the log messages by selecting all logs or you can select a specific category of log messages for example user you can also look at the debugging log by selecting debug log all debugging messages have the same priority 84

Log the log is displayed in the following screen 84

Note when a log reaches the maximum number of log messages new log messages automatically overwrite existing log messages starting with the oldest existing log message first 84

Nxc series user s guide 84

The following table describes the labels in this screen 84

View log 84

Chapter 5 monitor 85

Label description 85

Nxc series user s guide 85

The following table describes the labels in this screen 85

View log 85

Chapter 5 monitor 86

Label description 86

Nxc series user s guide 86

The web configurator saves the filter settings if you leave the view log screen and return to it later 86

View ap log 86

View ap log to access this screen 86

View log continued 86

Chapter 5 monitor 87

Label description 87

Note this criterion only appears when you show filter 87

Nxc series user s guide 87

The following table describes the labels in this screen 87

View ap log 87

Chapter 5 monitor 88

Label description 88

Note this criterion only appears when you show filter 88

Nxc series user s guide 88

View ap log 88

Overview 89

Registration 89

What you can do in this chapter 89

What you need to know 89

Maximum number of zymesh root aps 90

Registration 90

Service 90

Chapter 6 registration 91

Label description 91

Nxc series user s guide 91

Service 91

The following table describes the labels in this screen 91

Overview 92

What you can do in this chapter 92

What you need to know 92

Wireless 92

Controller 93

Ap management 94

Ap management to access this screen 94

Chapter 7 wireless 94

Controller screen you set the registration type to always accept then as soon as you remove an ap from this list it reconnects 94

Each field is described in the following table 94

Label description 94

Note dcs is not supported on the radio which is working in repeater ap mode 94

Note you should have enabled dcs in the applied ap radio profile berfore the aps can use dcs 94

Nxc series user s guide 94

Ap management continued 95

Chapter 7 wireless 95

Label description 95

Nxc series user s guide 95

Edit ap list 96

Chapter 7 wireless 97

Each field is described in the following table 97

Edit ap list 97

Label description 97

Note ensure you restart the managed ap after you change its operating mode 97

Note the root ap and repeater ap s in a zymesh must use the same country code and ap radio profile settings in order to communicate with each other 97

Note to prevent bidge loops do not set both radios on a managed ap to repeater ap mode 97

Nxc series user s guide 97

Chapter 7 wireless 98

Edit ap list continued 98

Edit ap list screen 98

Label description 98

Nxc series user s guide 98

Port setting edit 98

Use this screen to enable or disable a port on the managed ap and configure the port s pvid 98

Vlan add edit 99

Chapter 7 wireless 100

Each field is described in the following table 100

Edit vlan 100

Label description 100

Nxc series user s guide 100

Ap policy 101

Ap policy to access this screen 101

Chapter 7 wireless 101

Each field is described in the following table 101

Label description 101

Nxc series user s guide 101

Ap group 102

Ap group to access this screen 102

Ap policy continued 102

Chapter 7 wireless 102

Each field is described in the following table 102

Label description 102

Note dcs is not supported on the radio which is working in repeater ap mode 102

Note you cannot remove a group with which an ap is associated 102

Note you should have enabled dcs in the applied ap radio profile berfore the aps can use dcs 102

Nxc series user s guide 102

Ap group continued 103

Chapter 7 wireless 103

Label description 103

Nxc series user s guide 103

Add edit ap group 104

Add edit 105

Chapter 7 wireless 105

Each field is described in the following table 105

Label description 105

Note ensure you restart the managed ap after you change its operating mode 105

Note reducing the output power also reduces the nxc s effective broadcast radius 105

Note to prevent bidge loops do not set both radios on a managed ap to repeater ap mode 105

Note you can select root ap in an ap group only when the zymesh license is activated 105

Nxc series user s guide 105

Add edit continued 106

Chapter 7 wireless 106

Label description 106

Note load balancing is not supported on the radio which is working in root ap or repeater ap mode 106

Nxc series user s guide 106

Add edit continued 107

Chapter 7 wireless 107

Label description 107

Mon mode 107

Mon mode to access this screen 107

Note if you enable this function you should ensure that there are multiple aps within the broadcast radius that can accept any rejected or kicked wireless clients otherwise a wireless client attempting to connect to an overloaded ap will be kicked continuously and never be allowed to connect 107

Nxc series user s guide 107

Use this screen to assign aps either to the rogue ap list or the friendly ap list a rogue ap is a wireless access point operating in a network s coverage area that is not under the control of the network administrator and which can potentially open up holes in a network s security 107

Chapter 7 wireless 108

Each field is described in the following table 108

Label description 108

Mon mode 108

Nxc series user s guide 108

Add edit rogue friendly 109

Add edit rogue friendly ap list 109

Add edit rogue friendly list 109

Chapter 7 wireless 109

Each field is described in the following table 109

Label description 109

Mon mode continued 109

Mon mode table to display this screen 109

Nxc series user s guide 109

Auto healing 110

Auto healing to access this screen 110

Chapter 7 wireless 110

Each field is described in the following table 110

Label description 110

Nxc series user s guide 110

Dynamic channel selection 111

Technical reference 111

Load balancing 112

Disassociating and delaying connections 113

Interface overview 114

Interfaces 114

What you can do in this chapter 114

What you need to know 114

Ethernet summary 115

Chapter 8 interfaces 116

Each field is described in the following table 116

Edit ethernet 116

Ethernet 116

Label description 116

Note if you create ip address objects based on an interface s ip address subnet or gateway the nxc automatically updates every rule or setting that uses the object whenever the interface s ip address settings change for example if you change lan s ip address the nxc automatically updates the corresponding interface based lan subnet address object 116

Nxc series user s guide 116

This screen lets you configure ip address assignment and interface parameters to access this screen select an interface and click its edit icon in the ethernet screen 116

Chapter 8 interfaces 118

Label description 118

Nxc series user s guide 118

This screen s fields are described in the table below 118

Chapter 8 interfaces 119

Edit continued 119

Label description 119

Note make sure you also enable this option in the dhcpv6 server to make rapid commit work 119

Nxc series user s guide 119

Chapter 8 interfaces 120

Edit continued 120

Label description 120

Nxc series user s guide 120

Chapter 8 interfaces 121

Edit continued 121

Label description 121

Nxc series user s guide 121

Chapter 8 interfaces 122

Edit continued 122

Label description 122

Nxc series user s guide 122

Add dhcpv6 request options 123

Object references 123

Add dhcpv6 request options 124

Add edit dhcp extended options 124

Add edit extended options 124

Chapter 8 interfaces 124

Edit select dhcp server in the dhcp setting section and then click add or edit in the extended options table 124

Label description 124

Nxc series user s guide 124

The following table describes labels that can appear in this screen 124

Add edit extended options 125

Chapter 8 interfaces 125

Label description 125

Nxc series user s guide 125

Option name code description 125

Table 62 dhcp extended options 125

The following table lists the available dhcp extended options defined in rfcs on the nxc see rfcs for more information 125

Note by default the nxc acts a bridge device this means all interfaces ge1 g6 are grouped together into a single vid vlan0 also note that vlan0 cannot be removed and the vid cannot be changed 126

Vlan interfaces 126

Vlan summary 127

Chapter 8 interfaces 128

Each field is explained in the following table 128

Label description 128

Nxc series user s guide 128

Add edit vlan 129

Add edit 131

Chapter 8 interfaces 131

Each field is explained in the following table 131

Label description 131

Nxc series user s guide 131

Add edit continued 132

Chapter 8 interfaces 132

Label description 132

Note make sure you also enable this option in the dhcpv6 server to make rapid commit work 132

Nxc series user s guide 132

Add edit continued 133

Chapter 8 interfaces 133

Label description 133

Nxc series user s guide 133

Add edit continued 134

Chapter 8 interfaces 134

Label description 134

Nxc series user s guide 134

Interface parameters 135

Ip address assignment 135

Technical reference 135

Dhcp settings 136

Overview 138

Policy and static routes 138

What you can do in this chapter 138

What you need to know 138

Diffserv 139

Dscp marking and per hop behavior 139

Policy route 139

Chapter 9 policy and static routes 140

Ippr follows the existing packet filtering facility of ras in style and in implementation 140

Label description 140

Nxc series user s guide 140

Policy route 140

The following table describes the labels in this screen 140

Add edit policy route 141

Chapter 9 policy and static routes 141

Label description 141

Nxc series user s guide 141

Policy route continued 141

Routing to open the policy route screen then click the add or edit icon to open the policy route edit screen use this screen to configure or edit a policy route 141

Add edit 142

Chapter 9 policy and static routes 142

Label description 142

Nxc series user s guide 142

The following table describes the labels in this screen 142

Add edit continued 143

Chapter 9 policy and static routes 143

Label description 143

Nxc series user s guide 143

Add edit continued 144

Chapter 9 policy and static routes 144

Label description 144

Nxc series user s guide 144

Static route 144

Static route to open the static route screen this screen displays the configured static routes 144

The following table describes the labels in this screen 144

Add edit 145

Chapter 9 policy and static routes 145

Label description 145

Nxc series user s guide 145

Select a static route index number and click add or edit the screen shown next appears use this screen to configure the required information for a static route 145

Static route setting 145

Technical reference 145

The following section contains additional technical information about the features described in this chapter 145

The following table describes the labels in this screen 145

Assured forwarding af behavior is defined in rfc 2597 the af behavior group defines four af classes inside each class packets are given a high medium or low drop precedence the drop precedence determines the probability that routers in the network will drop packets when congestion occurs if congestion occurs between classes the traffic in the higher class smaller numbered class is generally given priority combining the classes and drop precedence produces the following twelve dscp encodings from af11 through af43 the decimal equivalent is listed in brackets 146

Assured forwarding af phb for diffserv 146

Chapter 9 policy and static routes 146

Class 1 class 2 class 3 class 4 146

Nat and snat 146

Nat network address translation nat rfc 1631 is the translation of the ip address in a packet in one network to a different ip address in another network use snat source nat to change the source ip address in one network to a different ip address in another network 146

Nxc series user s guide 146

Priority wmm ac 802 d priority dscp hex value 146

Table 71 assured forwarding af behavior group 146

Table 72 wmm to diffserv conversion on the nxc 146

The wmm acs as implemented on the nxc have the following functions 146

Video all wireless traffic to the ssid is tagged as video data this is recommended for activities like video conferencing 146

Voice all wireless traffic to the ssid is tagged as voice data this is recommended if an ssid is used for activities like placing and receiving voip phone calls 146

Wi fi multimedia wmm provides basic quality of service qos features to wireless networks the four categories of qos described by wmm are voice vo video vi best effort be and background bk these categories known as a access categories ac are mapped to 802 d priority values which can then be mapped to their corresponding dscp hex values 146

Overview 148

What you can do in this chapter 148

What you need to know 148

Add edit zone 149

Chapter 10 zones 149

Label description 149

Nxc series user s guide 149

The following table describes the labels in this screen 149

This screen allows you to add or edit a zone to access this screen go to the zone screen and click the add icon or an edit icon 149

Add edit 150

Chapter 10 zones 150

Label description 150

Nxc series user s guide 150

The following table describes the labels in this screen 150

Nat summary 151

Overview 151

What you can do in this chapter 151

Add edit nat 152

Chapter 11 nat 152

Label description 152

Nxc series user s guide 152

The following table describes the labels in this screen 152

This screen lets you create new nat rules and edit existing ones to open this window open the nat summary screen then click on an add icon or edit icon to open the following screen 152

Add edit 153

Chapter 11 nat 153

Label description 153

Nxc series user s guide 153

The following table describes the labels in this screen 153

Add edit continued 154

Chapter 11 nat 154

Label description 154

Nxc series user s guide 154

Add edit continued 155

Chapter 11 nat 155

Label description 155

Nxc series user s guide 155

Nat loopback 156

Technical reference 156

Xxx lan smtp com 156

Xxx lan smtp com 1 156

Before you begin 158

Overview 158

What you can do in this chapter 158

What you need to know 158

Technical reference 159

Ip mac binding 160

Overview 160

What you can do in this chapter 160

What you need to know 160

Chapter 13 ip mac binding 161

Interfaces used with ip mac binding 161

Ip mac address bindings are grouped by interface you can use ip mac binding with ethernet and vlan interfaces you can also enable or disable ip mac binding and logging in an interface s configuration screen 161

Ip mac binding summary 161

Ip mac binding to open the ip mac binding summary screen this screen lists the total number of ip to mac address bindings for devices connected to each supported interface 161

Label description 161

Nxc series user s guide 161

Summary 161

The following table describes the labels in this screen 161

Chapter 13 ip mac binding 162

Edit ip mac binding 162

Edit to open this screen use this screen to configure an interface s ip to mac address binding settings 162

Label description 162

Nxc series user s guide 162

The following table describes the labels in this screen 162

Add edit 163

Add edit static dhcp rule 163

Chapter 13 ip mac binding 163

Edit continued 163

Edit to open this screen click the add or edit icon to open the following screen use this screen to configure an interface s ip to mac address binding settings 163

Exempt list to open the ip mac binding exempt list screen use this screen to configure ranges of ip addresses to which the nxc does not apply ip mac binding 163

Ip mac binding exempt list 163

Label description 163

Nxc series user s guide 163

The following table describes the labels in this screen 163

Chapter 13 ip mac binding 164

Exempt list 164

Label description 164

Nxc series user s guide 164

The following table describes the labels in this screen 164

Captive portal 165

Overview 165

Captive portal type 166

Option portal type user defined portal pages where to configure 166

Table 82 captive portal options 166

What you can do in this chapter 166

Captive portal 167

Note you can configure the look and feel of the captive portal web page on the login page screen see section 14 on page 173 for details 167

Captive portal 168

Chapter 14 captive portal 168

Label description 168

Note it is recommended to have the external web server on the same subnet as the login users 168

Nxc series user s guide 168

The following table describes the labels in this screen 168

Captive portal continued 169

Chapter 14 captive portal 169

Label description 169

Note if the authentication with qr code option is selected make sure you also have the nxc use the local user database to authenticate clients 169

Note the authenticator must be able to access the ip address of the specified vlan interface 169

Nxc series user s guide 169

Add exceptional services 170

Captive portal continued 170

Chapter 14 captive portal 170

Label description 170

Note if you want 802 x to work properly you must set bootp_client and dns as exceptional services 170

Nxc series user s guide 170

This screen allows you to manage exceptions to captive portal interception click the add button in the exceptional services table on the captive portal screen to access this screen 170

Add exceptional services 171

Auth policy add edit 171

Chapter 14 captive portal 171

Label description 171

Nxc series user s guide 171

The following table describes the labels in this screen 171

This screen allows you to add authentication policies to captive portal interception click the add or edit button for an existing policy in the authentication policy summary table on the captive portal screen to access this screen 171

Auth policy add edit 172

Chapter 14 captive portal 172

Label description 172

Nxc series user s guide 172

Login page 173

Chapter 14 captive portal 174

Label description 174

Login page 174

Nxc series user s guide 174

The following table describes the labels in this screen 174

Chapter 14 captive portal 175

Custom login and access pages 175

Label description 175

Login page 175

Nxc series user s guide 175

The following identify the parts you can customize in the login and access pages 175

Background 177

Color of all text 177

External or uploaded web portal details 177

Last line of text 177

Logo title 177

Message color 177

Note message 177

Chapter 14 captive portal 181

Nxc series user s guide 181

Parameter description login welcome session logout error 181

Table 88 http parameters for external url 181

Overview 182

What you can do in this chapter 182

A dedicated rtls ssid is recommended 183

At least three aps managed by the nxc the more aps the better since it increases the amount of information the ekahau rtls controller has for calculating the location of the tags 183

Before you begin 183

Chapter 15 rtls 183

Configuring rtls 183

Ekahau rtls controller in blink mode with tzsp updater enabled 183

Firewall rules to allow rtls traffic if the nxc firewall is enabled or the ekahau rtls controller is behind a firewall 183

For example if the ekahau rtls controller is behind a firewall open ports 8550 8553 and 8569 to allow traffic the aps send to reach the ekahau rtls controller 183

Ip addresses for the ekahau wi fi tags 183

Nxc series user s guide 183

Port number type description 183

Rtls to open this screen use this screen to turn rtls real time location system on or off and specify the ip address and server port of the ekahau rtls controller 183

Table 89 rtls traffic port numbers 183

The following table lists default port numbers and types of packets rtls uses 183

You need 183

Chapter 15 rtls 184

Label description 184

Nxc series user s guide 184

The following table describes the labels in this screen 184

Firewall 185

Overview 185

What you can do in this chapter 185

What you need to know 185

Asymmetrical routes 186

Firewall rule criteria 186

Global firewall rules 186

Session limits 186

To nxc rules 186

User specific firewall rules 186

Firewall 187

Chapter 16 firewall 188

Firewall continued 188

Label description 188

Note allowing asymmetrical routes may let traffic from the wan go directly to the lan without passing through the nxc 188

Nxc series user s guide 188

Add edit 189

Add edit firewall screen 189

Chapter 16 firewall 189

Firewall continued 189

In the firewall screen click the edit or add icon to display this screen 189

Label description 189

Nxc series user s guide 189

The following table describes the labels in this screen 189

Add edit continued 190

Chapter 16 firewall 190

Label description 190

Note if you specified a source ip address group instead of any in the field below the user s ip address should be within the ip address range 190

Nxc series user s guide 190

Chapter 16 firewall 191

Label description 191

Nxc series user s guide 191

Session control 191

Session control to display the firewall session control screen use this screen to limit the number of concurrent nat firewall sessions a client can use you can apply a default limit for all users and individual limits for specific users addresses or both the individual limit takes priority if you apply both 191

The following table describes the labels in this screen 191

Add edit 192

Add edit session limit 192

Chapter 16 firewall 192

Label description 192

Nxc series user s guide 192

Session control continued 192

Session limit and the add or edit icon to display the firewall session limit edit screen use this screen to configure rules that define a session limit for specific users or addresses 192

Add edit 193

Chapter 16 firewall 193

Label description 193

Note if you specified an ip address or address group instead of any in the field below the user s ip address should be within the ip address range 193

Nxc series user s guide 193

The following table describes the labels in this screen 193

Overview 194

User group 194

What you can do in this chapter 194

What you need to know 194

Dynamic guest accounts 195

Ext group user accounts 195

Ext server accounts 195

Ext user accounts 195

Note if the nxc tries to authenticate an ext user using the local database the attempt always fails 195

Note the default admin account is always authenticated locally regardless of the authentication method setting 195

Mac address accounts 196

Note you cannot put access users and admin users in the same user group 196

Note you cannot put the default admin account into any user group 196

User awareness 196

User groups 196

User role priority 196

Chapter 17 user group 197

Label description 197

Nxc series user s guide 197

The following table describes the labels in this screen 197

User group 197

User summary 197

Add edit a user 198

Add edit user 198

Alphanumeric a z 0 9 there is no unicode support 198

Chapter 17 user group 198

Dashes 198

Enter a user name from 1 to 31 characters 198

Here are the reserved user names 198

Nxc series user s guide 198

Rules for user names 198

The first character must be alphabetical a z a z an underscore _ or a dash other limitations on user names are 198

The user add edit screen allows you to create a new user account or edit an existing one 198

The user name can only contain the following characters 198

To access this screen go to the user screen and click add or edit 198

User names are case sensitive if you enter a user bob but use bob when connecting via cifs or ftp it will use the account settings used for bob not bob 198

User names have to be different than user group names 198

_ underscores 198

Add edit a user 199

Chapter 17 user group 199

Label description 199

Nxc series user s guide 199

The following table describes the labels in this screen 199

Add edit group 200

Group summary 200

Add edit group 201

Chapter 17 user group 201

Label description 201

Nxc series user s guide 201

Setting 201

The following table describes the labels in this screen 201

This screen controls default settings login settings lockout settings and other user settings for the nxc you can also use this screen to specify when users must log in to the nxc before it routes traffic for them 201

Chapter 17 user group 203

Label description 203

Nxc series user s guide 203

Setting 203

The following table describes the labels in this screen 203

Chapter 17 user group 204

Label description 204

Nxc series user s guide 204

Setting continued 204

Chapter 17 user group 205

Edit user authentication timeout settings 205

Label description 205

Nxc series user s guide 205

Setting continued 205

Setting screen and click one of the default authentication timeout settings section s edit icons 205

The following table describes the labels in this screen 205

This screen allows you to set the default authentication timeout settings for the selected type of user account these default authentication timeout settings also control the settings for any existing user accounts that are set to use the default settings you can still manually configure any user account s authentication timeout settings 205

Access users cannot use the web configurator to browse the configuration of the nxc instead after access users log into the nxc the following user aware login screen appears 206

Add edit dynamic guest group 206

Chapter 17 user group 206

Edit user authentication timeout settings continued 206

Label description 206

Nxc series user s guide 206

Setting screen and click either the add icon or an edit icon in the dynamic guest group section 206

The following table describes the labels in this screen 206

User aware login example 206

Chapter 17 user group 207

Figure 115 user aware login 207

Guest manager login example 207

Label description 207

Nxc series user s guide 207

Table 104 user aware login 207

The following table describes the labels in this screen 207

To create dynamic guest accounts enter the guest manager account information in the web configurator login screen after you log in successfully the following guest manager screen appears 207

After you click apply to create dynamic guest accounts the following guest account list screen appears 208

Chapter 17 user group 208

Figure 116 guest manager login 208

Guest account list 208

Label description 208

Nxc series user s guide 208

Table 105 guest manager login 208

The following table describes the labels in this screen 208

Chapter 17 user group 209

Figure 117 guest account list 209

Label description 209

Nxc series user s guide 209

Table 106 guest account list 209

The following figure shows the dynamic guest account printout example 209

The following table describes the labels in this screen 209

Dynamic guest note 210

Mac address 210

Add edit 211

Add edit mac address 211

Chapter 17 user group 211

Label description 211

Mac address continued 211

Nxc series user s guide 211

The following table describes the labels in this screen 211

Use the mac address add edit screen to map a wireless client s mac address or oui to a mac role mac address user account 211

Ap profile 212

Overview 212

What you can do in this chapter 212

What you need to know 212

Ieee 802 x 213

Note you can have a maximum of 32 radio profiles on the nxc 213

Wpa and wpa2 213

Add edit radio profile 214

Chapter 18 ap profile 214

Label description 214

Nxc series user s guide 214

The following table describes the labels in this screen 214

This screen allows you to create a new radio profile or edit an existing one to access this screen click the add button or select a radio profile from the list and click the edit button 214

Add edit radio profile 216

Chapter 18 ap profile 216

Label description 216

Note if you change the country code later channel selection is set to manual automatically 216

Nxc series user s guide 216

The following table describes the labels in this screen 216

Add edit radio profile continued 217

Chapter 18 ap profile 217

Label description 217

Nxc series user s guide 217

Add edit radio profile continued 218

Chapter 18 ap profile 218

Label description 218

Nxc series user s guide 218

Add edit radio profile continued 219

Chapter 18 ap profile 219

Label description 219

Note you can have a maximum of 32 ssid profiles on the nxc 219

Nxc series user s guide 219

Ssid list 219

The ssid screens allow you to configure three different types of profiles for your networked aps an ssid list which can assign specific ssid configurations to your aps a security list which can assign specific encryption methods to the aps when allowing wireless clients to connect to them and a mac filter list which can limit connections to an ap based on wireless clients mac addresses 219

This screen allows you to create and manage ssid configurations that can be used by the aps an ssid or service set identifier is basically the name of the wireless network to which a wireless client can connect the ssid appears as readable text to any device capable of scanning for wireless frequencies such as the wifi adapter in a laptop and is displayed as the wireless network name when a person makes a connection to it 219

Add edit ssid profile 220

Chapter 18 ap profile 220

Label description 220

Nxc series user s guide 220

Ssid list 220

The following table describes the labels in this screen 220

This screen allows you to create a new ssid profile or edit an existing one to access this screen click the add button or select an ssid profile from the list and click the edit button 220

Add edit ssid profile 221

Chapter 18 ap profile 221

Label description 221

Note it is highly recommended that you create security profiles for all of your ssids to enhance your network security 221

Nxc series user s guide 221

The following table describes the labels in this screen 221

Add edit ssid profile continued 222

Chapter 18 ap profile 222

Label description 222

Nxc series user s guide 222

Add edit ssid profile continued 223

Chapter 18 ap profile 223

Label description 223

Note if you associate a layer 2 isolation profile with the ssid this option will be selected automatically and cannot be configured 223

Note you can have a maximum of 32 security profiles on the nxc 223

Nxc series user s guide 223

Security list 223

The following table describes the labels in this screen 223

This screen allows you to manage wireless security configurations that can be used by your ssids wireless security is implemented strictly between the ap broadcasting the ssid and the stations that are connected to it 223

Add edit security profile 224

Note this screen s options change based on the security mode selected only the default screen is displayed here 224

Add edit security profile 225

Chapter 18 ap profile 225

Label description 225

Nxc series user s guide 225

The following table describes the labels in this screen 225

Add edit security profile 226

Chapter 18 ap profile 226

Label description 226

Nxc series user s guide 226

Add edit mac filter profile 227

Add edit security profile 227

Chapter 18 ap profile 227

Label description 227

Mac filter list 227

Note you can have a maximum of 32 mac filtering profiles on the nxc 227

Nxc series user s guide 227

The following table describes the labels in this screen 227

This screen allows you to create a new mac filtering profile or edit an existing one to access this screen click the add button or select a mac filtering profile from the list and click the edit button 227

Add edit mac filter profile 228

Chapter 18 ap profile 228

If a device s mac addresses is not listed in a layer 2 isolation profile it is blocked from communicating with other devices in an ssid on which layer 2 isolation is enabled 228

Label description 228

Layer 2 isolation list 228

Note you can have a maximum of 32 layer 2 isolation profiles on the nxc 228

Nxc series user s guide 228

The following table describes the labels in this screen 228

Add edit layer 2 isolation profile 229

Note you need to know the mac address of each device that you want to allow to be accessed by other devices in the ssid to which the layer 2 isolation profile is applied 229

Add edit layer 2 isolation profile 230

Chapter 18 ap profile 230

Label description 230

Nxc series user s guide 230

The following table describes the labels in this screen 230

Mon profile 231

Overview 231

What you can do in this chapter 231

What you need to know 231

Add edit mon profile 232

Chapter 19 mon profile 232

Label description 232

Mon profile 232

Nxc series user s guide 232

The following table describes the labels in this screen 232

This screen allows you to create a new monitor mode profile or edit an existing one to access this screen click the add button or select and existing monitor mode profile and click the edit button 232

Add edit mon profile 233

Chapter 19 mon profile 233

Label description 233

Nxc series user s guide 233

The following table describes the labels in this screen 233

Add edit mon profile continued 234

Chapter 19 mon profile 234

Figure 133 rogue ap example 234

In the example above a corporate network s security is compromised by a rogue ap rg set up by an employee at his workstation in order to allow him to connect his notebook computer wirelessly 234

Label description 234

Nxc series user s guide 234

Rogue aps 234

Rogue aps are wireless access points operating in a network s coverage area that are not under the control of the network s administrators and can open up holes in a network s security attackers can take advantage of a rogue ap s weaker or non existent security to gain access to the network or set up their own rogue aps in order to capture information from wireless clients if a scan reveals a rogue ap you can use commercially available software to physically locate it 234

Technical reference 234

The following section contains additional technical information about the features described in this chapter 234

Friendly aps 235

Overview 236

Zymesh profile 236

Note a zymesh wds link with more hops has lower throughput 237

Note when the wireless connection between the root ap and the repeater is up in order to prevent bridge loops the repeater would not be able to transmit data through its ethernet port s the repeater then could only receive power from a poe device if you use poe to provide power to the managed ap via an 8 ping etherent cable 237

What you can do in this chapter 237

Zymesh profile 237

Add edit zymesh profile 238

Add edit zymesh profile 239

Chapter 20 zymesh profile 239

Label description 239

Note the zymesh ssid is hidden in the outgoing beacon frame so a wireless device cannot obtain the ssid through scanning using a site survey tool 239

Nxc series user s guide 239

The following table describes the labels in this screen 239

Address summary 240

Addresses 240

Overview 240

What you can do in this chapter 240

What you need to know 240

Add edit 241

Add edit address 241

Address summary 241

Chapter 21 addresses 241

Label description 241

Nxc series user s guide 241

The add edit address screen allows you to create a new address or edit an existing one to access this screen go to the address screen and click either the add icon or an edit icon 241

The following table describes the labels in this screen 241

Add edit 242

Address group 242

Address group click a column s heading cell to sort the table entries by that column s criteria click the heading cell again to reverse the sort order 242

Address group summary 242

Chapter 21 addresses 242

Label description 242

Note the nxc automatically updates address objects that are based on an interface s ip address subnet or gateway if the interface s ip address settings change for example if you change ge1 s ip address the nxc automatically updates the corresponding interface based lan subnet address object 242

Nxc series user s guide 242

The following table describes the labels in this screen 242

Add edit 243

Add edit address group rule 243

Address group 243

Chapter 21 addresses 243

Label description 243

Nxc series user s guide 243

The add edit address group rule screen allows you to create a new address group or edit an existing one to access this screen go to the address group screen and click either the add icon or an edit icon 243

The following table describes the labels in this screen 243

Add edit continued 244

Chapter 21 addresses 244

Label description 244

Nxc series user s guide 244

Overview 245

Services 245

What you can do in this chapter 245

What you need to know 245

Service objects and service groups 246

Service summary 246

Add edit 247

Add edit service rule 247

Chapter 22 services 247

Label description 247

Nxc series user s guide 247

Service 247

The add edit service rule screen allows you to create a new service or edit an existing one to access this screen go to the service screen and click either the add icon or an edit icon 247

The following table describes the labels in this screen 247

Add edit service group rule 248

Service group summary 248

Add edit 249

Chapter 22 services 249

Label description 249

Nxc series user s guide 249

The following table describes the labels in this screen 249

Overview 250

Schedule summary 250

Schedules 250

What you can do in this chapter 250

What you need to know 250

Chapter 23 schedules 251

Label description 251

Nxc series user s guide 251

Schedule 251

The following table describes the labels in this screen 251

Add edit one time 252

Add edit schedule one time rule 252

Chapter 23 schedules 252

Label description 252

Nxc series user s guide 252

The add edit schedule one time rule screen allows you to define a one time schedule or edit an existing one to access this screen go to the schedule screen and click either the add icon or an edit icon in the one time section 252

The following table describes the labels in this screen 252

Add edit recurring 253

Add edit schedule recurring rule 253

Chapter 23 schedules 253

Label description 253

Nxc series user s guide 253

The add edit schedule recurring rule screen allows you to define a recurring schedule or edit an existing one to access this screen go to the schedule screen and click either the add icon or an edit icon in the recurring section 253

The year month and day columns are not used in recurring schedules and are disabled in this screen the following table describes the remaining labels in this screen 253

Aaa server 254

Overview 254

What you can do in this chapter 254

What you need to know 254

Aaa servers supported by the nxc 255

Authentication capability list 255

Chapter 24 aaa server 255

Figure 148 radius server network example 255

If it matches the user is allowed access otherwise access is blocked 255

Internal authentication method external radius 255

Local user database 255

Nxc series user s guide 255

Radius remote authentication dial in user service authentication is a popular protocol used to authenticate users by means of an external server instead of or in addition to an internal device user database that is limited to the memory capacity of the device in essence radius authentication allows you to validate a large number of users from a central location 255

Radius server 255

Table 134 authentication capability list 255

The following lists the types of authentication server the nxc supports 255

The nxc uses the built in local user database to authenticate administrative users logging into the nxc s web configurator or network access users logging into the network through the nxc 255

This list displays the nxc s authentication capabilities 255

Directory structure 256

Distinguished name dn 256

Note because the nxc has an internal authentication database you can create local login accounts on it without needing to rely on an external authentication server the built in authentication server supports peap eap tls eap ttls 256

Active directory ldap 257

Base dn 257

Bind dn 257

Note both the active directory and ldap screens while on separate tabs are identical in configuration this section applies to both equally 257

Add edit active directory ldap server 258

Note the active directory and ldap server setup screens are almost identical so the features for both screens are described in this section 258

O zyxel c u 258

Add edit 260

Chapter 24 aaa server 260

Label description 260

Nxc series user s guide 260

O zyxel c u 260

The following table describes the labels in these screens 260

Add edit 261

Chapter 24 aaa server 261

Cn zyadmi 261

Label description 261

Note this is only for active directory 261

Nxc series user s guide 261

Zyadmi 261

Add edit radius 262

Radius 262

Add edit 263

Chapter 24 aaa server 263

Label description 263

Nxc series user s guide 263

The following table describes the labels in this screen 263

Add edit continued 264

Chapter 24 aaa server 264

Label description 264

Nxc series user s guide 264

Add edit continued 265

Chapter 24 aaa server 265

Label description 265

Nxc series user s guide 265

Authentication method 266

Before you begin 266

Overview 266

What you can do in this chapter 266

Add authentication method 267

Chapter 25 authentication method 268

Click ok to save the settings or click cancel to discard all changes and return to the previous screen 268

Label description 268

Nxc series user s guide 268

The following table describes the labels in this screen 268

Certificates 269

Overview 269

What you can do in this chapter 269

What you need to know 269

Advantages of certificates 270

Certificate file formats 270

Factory default certificate 270

Self signed certificates 270

Note be careful not to convert a binary file to text during the transfer process it is easy for this to occur since many programs use text files by default 271

Verifying a certificate 271

Chapter 26 certificates 272

Label description 272

My certificates 272

My certificates to open this screen this is the nxc s summary list of certificates and certification requests 272

Nxc series user s guide 272

The following table describes the labels in this screen 272

Chapter 26 certificates 273

Label description 273

My certificates continued 273

Nxc series user s guide 273

Add my certificates 274

Chapter 26 certificates 275

Label description 275

Nxc series user s guide 275

The following table describes the labels in this screen 275

Add continued 276

Chapter 26 certificates 276

If you configured the my certificate create screen to have the nxc enroll a certificate and the certificate enrollment is not successful you see a screen with a return button that takes you back to the my certificate create screen click return and check your information in the my certificate create screen make sure that the certification authority information is correct and that your internet connection is working properly if you want the nxc to enroll a certificate online 276

Label description 276

Nxc series user s guide 276

Edit my certificates 277

Chapter 26 certificates 278

Label description 278

Nxc series user s guide 278

The following table describes the labels in this screen 278

Chapter 26 certificates 279

Import certificates 279

Import to open the my certificate import screen follow the instructions in this screen to save an existing certificate to the nxc 279

Label description 279

Note you can import a certificate that matches a corresponding certification request that was generated by the nxc you can also import a certificate in pkcs 12 format including the certificate s public and private keys 279

Nxc series user s guide 279

The certificate you import replaces the corresponding request in the my certificates screen 279

You must remove any spaces in the certificate s filename before you can import it 279

Chapter 26 certificates 280

Import 280

Label description 280

Nxc series user s guide 280

The following table describes the labels in this screen 280

Trusted certificates 280

Trusted certificates to open the trusted certificates screen this screen displays a summary list of certificates that you have set the nxc to accept as trusted the nxc also accepts any valid certificate signed by a certificate on this list as being trustworthy thus you do not need to import any certificate that is signed by one of these certificates 280

Chapter 26 certificates 281

Label description 281

Nxc series user s guide 281

The following table describes the labels in this screen 281

Trusted certificates 281

Edit trusted certificates 282

Chapter 26 certificates 283

Label description 283

Nxc series user s guide 283

The following table describes the labels in this screen 283

Chapter 26 certificates 284

Edit continued 284

Import to open the trusted certificates import screen follow the instructions in this screen to save a trusted certificate to the nxc 284

Import trusted certificates 284

Label description 284

Note you must remove any spaces from the certificate s filename before you can import the certificate 284

Nxc series user s guide 284

Technical reference 285

Dhcpv6 286

Dhcpv6 request 286

Overview 286

What you can do in this chapter 286

Add edit 287

Add edit dhcpv6 request object 287

Chapter 27 dhcpv6 287

Label description 287

Nxc series user s guide 287

Request continued 287

The following table describes the labels in this screen 287

The request add edit screen allows you to create a new request object or edit an existing one to access this screen go to the request screen and click either the add icon or an edit icon 287

Overview 288

System 288

What you can do in this chapter 288

Host name 289

Note only connect one usb device it must allow writing it cannot be read only and use the fat16 fat32 ext2 or ext3 file system 289

Usb storage 289

Chapter 28 system 290

Date and time 290

For effective scheduling and logging the nxc system time must be accurate the nxc s real time chip rtc keeps track of the time and date there is also a software mechanism to set the time manually or get the current time and date from an external server 290

Label description 290

Nxc series user s guide 290

The following table describes the labels in this screen 290

Usb storage 290

Chapter 28 system 291

Date time 291

Date time the screen displays as shown you can manually set the nxc s time and date or have the nxc get the date and time from a time server 291

Label description 291

Nxc series user s guide 291

The following table describes the labels in this screen 291

Chapter 28 system 292

Date time continued 292

Label description 292

Nxc series user s guide 292

Pre defined ntp time servers list 293

Time server synchronization 293

Console speed 294

Dns overview 294

Configuring the dns screen 295

Dns server address assignment 295

Chapter 28 system 296

Label description 296

Nxc series user s guide 296

The following table describes the labels in this screen 296

A ptr pointer record is also called a reverse record or a reverse lookup record it is a mapping of an ip address to a domain name 297

Adding an address ptr record 297

Address record 297

An address record contains the mapping of a fully qualified domain name fqdn to an ip address an fqdn consists of a host and domain name for example www zyxel com is a fully qualified domain name where www is the host zyxel is the second level domain and com is the top level domain mail myzyxel com tw is also a fqdn where mail is the host myzyxel is the third level domain com is the second level domain and tw is the top level domain 297

Chapter 28 system 297

Click the add icon in the address ptr record table to add an address ptr record 297

Dns continued 297

Label description 297

Nxc series user s guide 297

Ptr record 297

The nxc allows you to configure address records about the nxc itself or another device this way you can keep a record of dns names and addresses that people on your network may use frequently if the nxc receives a dns query for an fqdn for which the nxc has an address record the nxc can send the ip address in a dns response without having to query a dns name server 297

Add domain zone forwarder 298

Domain zone forwarder 298

A mx mail exchange record indicates which host is responsible for the mail for a particular domain that is controls where mail is sent for that domain if you do not configure proper mx records for your domain or other domain external e mail from other mail servers will not be able to be delivered to your mail server and vice versa each host or domain can have only one mx record that is one domain is mapping to one host 299

Add domain zone forwarder 299

Chapter 28 system 299

Label description 299

Mx record 299

Note if all interfaces are static then this field is hidden 299

Nxc series user s guide 299

The following table describes the labels in this screen 299

0 add service control 300

Add mx record 300

Service access limitations 301

System timeout 301

Www overview 301

Note if you disable http in the www screen then the nxc blocks all http connection attempts 302

Configuring www service control 303

Note admin service control deals with management access to the web configurator user service control deals with user access to the nxc 303

Chapter 28 system 304

Label description 304

Nxc series user s guide 304

Service control 304

The following table describes the labels in this screen 304

Add edit 305

Chapter 28 system 305

Click add or edit in the service control table in a www ssh telnet ftp or snmp screen to add a service control rule 305

Label description 305

Nxc series user s guide 305

Service control continued 305

Service control rules 305

Add edit 306

Chapter 28 system 306

Figure 179 security alert dialog box internet explorer 306

Https example 306

If you haven t changed the default https port on the nxc then in your browser enter https nxc ip address as the web site address where nxc ip address is the ip address or domain name of the nxc you wish to access 306

Internet explorer warning messages 306

Label description 306

Nxc series user s guide 306

The following table describes the labels in this screen 306

When you attempt to access the nxc https server a windows dialog box pops up asking if you trust the server certificate click view certificate if you want to verify that the certificate is from the nxc 306

You see the following security alert screen in internet explorer select yes to proceed to the web configurator login screen if you select no then web configurator access is blocked 306

Avoiding browser warning messages 307

Enrolling and importing ssl client certificates 307

Login screen 307

Installing the ca s certificate 308

Installing a personal certificate 309

Using a certificate when accessing the nxc 311

How ssh works 313

Configuring ssh 314

Note it is recommended that you disable telnet and ftp when you configure ssh for secure connections 314

Requirements for using ssh 314

Ssh implementation on the nxc 314

A window displays prompting you to store the host key in you computer click yes to continue 315

Chapter 28 system 315

Configure the ssh client to accept connection using ssh version 1 315

Example 1 microsoft windows 315

Examples of secure telnet using ssh 315

Label description 315

Launch the ssh client and specify the connection information ip address port number for the nxc 315

Nxc series user s guide 315

Ssh continued 315

This section describes how to access the nxc using the secure shell client program 315

This section shows two examples using a command interface and a graphical interface ssh client program to remotely access the nxc the configuration and connection steps are similar for most ssh client programs refer to your ssh client program user s guide 315

Example 2 linux 316

Chapter 28 system 317

Label description 317

Nxc series user s guide 317

Telnet 317

Telnet to configure your nxc for remote telnet access use this screen to specify from which zones telnet can be used to manage the nxc you can also specify from which ip addresses the access can come 317

The following table describes the labels in this screen 317

Chapter 28 system 318

Ftp tab the screen appears as shown use this screen to specify from which zones ftp can be used to access the nxc you can also specify from which ip addresses the access can come 318

Label description 318

Nxc series user s guide 318

Telnet continued 318

The following table describes the labels in this screen 318

You can upload and download the nxc s firmware and configuration files using ftp to use this feature your computer must have an ftp client see chapter 30 on page 343 for more information about firmware and configuration files 318

Chapter 28 system 319

Ftp continued 319

Label description 319

Nxc series user s guide 319

Chapter 28 system 321

Nxc series user s guide 321

Object label object id description 321

Snmp traps 321

Supported mibs 321

Table 165 snmp traps 321

The nxc supports mib ii that is defined in rfc 1213 and rfc 1215 the nxc also supports private mibs zywall mib and zyxel zywall zld common mib to collect information about cpu and memory usage the focus of the mibs is to let administrators collect statistical data and monitor status and performance you can download the nxc s mibs from www zyxel com 321

The nxc will send traps to the snmp manager when any one of the following events occurs 321

Trap used by the agent to inform the manager of some events 321

Configuring snmp 322

Chapter 28 system 323

Label description 323

Nxc series user s guide 323

Snmp continued 323

Adding or editing an snmpv3 user profile 324

Auth server tab the screen appears as shown use this screen to enable the authentication server feature of the nxc and specify the radius client s ip address 324

Authentication server 324

Chapter 28 system 324

Label description 324

Nxc series user s guide 324

Snmp screen s add button or select a snmpv3 user profile from the list and click the edit button 324

The following table describes the labels in this screen 324

Auth server 325

Chapter 28 system 325

Label description 325

Nxc series user s guide 325

The following table describes the labels in this screen 325

Add edit 326

Add edit trusted radius client 326

Auth server to display the auth server screen click the add icon or an edit icon to display the following screen use this screen to create a new entry or edit an existing one 326

Chapter 28 system 326

Label description 326

Language 326

Language to open this screen use this screen to select a display language for the nxc s web configurator screens 326

Nxc series user s guide 326

The following table describes the labels in this screen 326

Chapter 28 system 327

Ipv6 to open the following screen use this screen to enable ipv6 support on the nxc 327

Label description 327

Language 327

Nxc series user s guide 327

The following table describes the labels in this screen 327

Email daily report 328

Log and report 328

Overview 328

What you can do in this chapter 328

Chapter 29 log and report 329

Email daily report 329

Label description 329

Nxc series user s guide 329

The following table describes the labels in this screen 329

Chapter 29 log and report 330

Email daily report continued 330

For alerts the log settings tab controls which events generate alerts and where alerts are e mailed 330

Label description 330

Log settings 330

Nxc series user s guide 330

The log settings summary screen provides a summary of all the settings you can use the log settings edit screen to maintain the detailed settings such as log categories e mail addresses server names etc for any log alternatively if you want to edit what events is included in each log you can also use the log category settings screen to edit this information for all logs at the same time 330

The log settings tab also controls what information is saved in each log for the system log you can also specify which log messages are e mailed where they are e mailed and how often they are e mailed 330

The nxc provides a system log and supports e mail profiles and remote syslog servers the system log is available on the view log tab the e mail profiles are used to mail log messages to the specified destinations and the other four logs are stored on specified syslog servers 330

These screens control log messages and alerts a log message stores the information for viewing for example in the view log tab or regular e mailing later and an alert is e mailed immediately usually alerts are used for events that require more serious attention such as system errors and attacks 330

Chapter 29 log and report 331

Label description 331

Log settings 331

Log settings summary 331

Nxc series user s guide 331

The following table describes the labels in this screen 331

Chapter 29 log and report 332

Label description 332

Log settings continued 332

Nxc series user s guide 332

Edit system log settings 333

Chapter 29 log and report 334

Edit system log 334

Label description 334

Nxc series user s guide 334

The following table describes the labels in this screen 334

Chapter 29 log and report 335

Edit system log continued 335

Edit usb storage log settings 335

Label description 335

Nxc series user s guide 335

The edit log on usb storage setting screen controls the detailed settings for saving logs to a connected usb storage device go to the log settings summary screen and click the usb storage edit icon 335

Chapter 29 log and report 336

Edit usb storage 336

Label description 336

Nxc series user s guide 336

The following table describes the labels in this screen 336

Chapter 29 log and report 337

Edit remote server log settings 337

Edit usb storage continued 337

Label description 337

Nxc series user s guide 337

This screen controls the settings for each log in the remote server syslog go to the log settings summary screen and click a remote server edit icon 337

Chapter 29 log and report 339

Edit remote server 339

Label description 339

Log category settings 339

Nxc series user s guide 339

The following table describes the labels in this screen 339

This screen allows you to view and to edit what information is included in the system log usb storage e mail profiles and remote servers at the same time it does not let you change other log settings for example where and how often log information is e mailed or remote server names to access this screen go to the log settings summary screen and click the log category settings button 339

Chapter 29 log and report 341

Label description 341

Log category settings 341

Nxc series user s guide 341

The following table describes the fields in this screen 341

Chapter 29 log and report 342

Label description 342

Log category settings continued 342

Nxc series user s guide 342

File manager 343

Overview 343

What you can do in this chapter 343

What you need to know 343

Comments in configuration files or shell scripts 344

Note exit or must follow sub commands if it is to make the nxc exit sub command mode 344

Configuration file 345

Errors in configuration files or shell scripts 345

Configuration file flow at restart 346

Do not turn off the nxc while configuration file upload is in progress 346

Chapter 30 file manager 347

Configuration file 347

Label description 347

Nxc series user s guide 347

The following table describes the labels in this screen 347

Chapter 30 file manager 348

Configuration file continued 348

Label description 348

Nxc series user s guide 348

Firmware package 349

Note the web configurator is the recommended method for uploading firmware you only need to use the command line interface if you need to recover the firmware see the cli reference guide for how to determine if you need to recover the firmware and how to recover it 349

The firmware update can take up to five minutes do not turn off or reset the nxc while the firmware update is in progress 349

Chapter 30 file manager 350

Firmware package 350

Label description 350

Nxc series user s guide 350

The following table describes the labels in this screen 350

Note the nxc automatically reboots after a successful firmware update 351

Shell script 351

Chapter 30 file manager 352

Each field is described in the following table 352

Label description 352

Note you should include write commands in your scripts if you do not use the write command the changes will be lost when the nxc restarts you could use multiple write commands in a long script 352

Nxc series user s guide 352

Shell script 352

Shell script to open this screen use the shell script screen to store name download upload and run shell script files you can store multiple shell script files on the nxc at the same time 352

Chapter 30 file manager 353

Label description 353

Nxc series user s guide 353

Shell script continued 353

Diagnostics 354

Overview 354

What you can do in this chapter 354

Chapter 31 diagnostics 355

Collect on ap to open the diagnostic screen 355

Collect on controller 355

Diagnostics ap configuration 355

Label description 355

Nxc series user s guide 355

The following table describes the labels in this screen 355

This screen provides an easy way for you to generate a file containing the selected managed ap s configuration and diagnostic information you may need to generate this file and send it to customer support during troubleshooting 355

Chapter 31 diagnostics 356

Collect on ap 356

Label description 356

Nxc series user s guide 356

The following table describes the labels in this screen 356

Chapter 31 diagnostics 357

Collect on ap 357

Diagnostics files 357

Files to open the diagnostic files screen this screen lists the files of diagnostic information the nxc has collected and stored on the nxc or a connected usb storage device you may need to send these files to customer support for troubleshooting 357

Label description 357

Nxc series user s guide 357

The following table describes the labels in this screen 357

Capture 358

Chapter 31 diagnostics 358

Label description 358

Note new capture files overwrite existing files of the same name change the file suffix field s setting to avoid this 358

Nxc series user s guide 358

Packet capture 358

Packet capture to open the packet capture screen 358

The following table describes the labels in this screen 358

Use this screen to capture network traffic going through the nxc s interfaces studying these packet captures may help you identify network problems 358

Chapter 31 diagnostics 359

Label description 359

Note if you have existing capture files and have not selected the continuously capture and overwrite old ones option you may need to set this size larger or delete existing capture files 359

Note the nxc reserves some usb storage space as a buffer 359

Note the nxcl reserves some onboard storage space as a buffer 359

Nxc series user s guide 359

Packet capture continued 359

Chapter 31 diagnostics 360

Files to open the packet capture files screen this screen lists the files of packet captures stored on the nxc or a connected usb storage device you can download the files to your computer where you can study them using a packet analyzer also known as a network or protocol analyzer such as wireshark 360

Label description 360

Nxc series user s guide 360

Packet capture continued 360

Packet capture files 360

The following table describes the labels in this screen 360

Core dump 361

Example of viewing a packet capture file 361

Core dump files 362

Chapter 31 diagnostics 363

Label description 363

Nxc series user s guide 363

System log 363

System log to open the system log files screen this screen lists the files of system logs stored on a connected usb storage device the files are in comma separated value csv format you can download them to your computer and open them in a tool like microsoft s excel 363

The following table describes the labels in this screen 363

Capture 364

Chapter 31 diagnostics 364

Label description 364

Note new capture files overwrite existing files of the same name change the file prefix field s setting to avoid this 364

Nxc series user s guide 364

The following table describes the labels in this screen 364

Use this screen to capture wireless network traffic going through the ap interfaces connected to your nxc studying these frame captures may help you identify network problems 364

Wireless frame capture 364

Wireless frame capture to display this screen 364

Capture continued 365

Chapter 31 diagnostics 365

Files to open this screen this screen lists the files of wireless frame captures the nxc has performed you can download the files to your computer where you can study them using a packet analyzer also known as a network or protocol analyzer such as wireshark 365

Label description 365

Note if you have existing capture files you may need to set this size larger or delete existing capture files 365

Nxc series user s guide 365

Wireless frame capture files 365

Chapter 31 diagnostics 366

Label description 366

Nxc series user s guide 366

The following table describes the labels in this screen 366

Overview 367

Packet flow explore 367

The routing status screen 367

What you can do in this chapter 367

Chapter 32 packet flow explore 369

Label description 369

Nxc series user s guide 369

Routing status 369

Routing status main route 369

The following table describes the labels in this screen 369

Chapter 32 packet flow explore 370

Label description 370

Note once a packet matches the criteria of an snat rule the nxc takes the corresponding action and does not perform any further flow checking 370

Nxc series user s guide 370

Routing status continued 370

Snat status 370

The order of the snat flow may vary depending on whether you 370

The snat status screen 370

Use policy routes to control 1 1 nat by using the policy control virtual server rules activate command 370

Chapter 32 packet flow explore 372

Label description 372

Nxc series user s guide 372

Snat status 372

Snat status default snat 372

The following table describes the labels in this screen 372

Chapter 32 packet flow explore 373

Label description 373

Nxc series user s guide 373

Snat status continued 373

Overview 374

Reboot 374

What you need to know 374

Overview 375

Shutdown 375

What you need to know 375

General 376

Overview 376

Troubleshooting 376

Hackers have accessed my wep encrypted wireless lan 377

I can t enter the interface name i want 377

I cannot access the internet 377

My rules and settings that apply to a particular interface no longer work 377

The nxc is not applying the custom policy route i configured 377

The wireless security is not following the re authentication timer setting i specified 377

I cannot get the radius server to authenticate the nxc s default admin account 378

I changed the lan ip address and can no longer access the internet 378

The nxc fails to authenticate the ext user user accounts i configured 378

The nxc is not applying an interface s configured ingress bandwidth limit 378

The nxc keeps resetting the connection 378

The nxc routes and applies snat for traffic from some interfaces but not from others 378

I cannot add the admin users to a user group with access users 379

I cannot add the default admin account to a user group 379

I cannot get a certificate to import into the nxc 379

The schedule i configured is not being applied at the configured times 379

I can only see newer logs older logs are missing 380

I cannot access the nxc from a computer connected to the internet 380

I uploaded a logo to display on the upper left corner of the web configurator login screen and access page but it does not display properly 380

I uploaded a logo to use as the screen or window background but it does not display properly 380

Note be careful not to convert a binary file to text during the transfer process it is easy for this to occur since many programs use text files by default 380

Note exit or must follow sub commands if it is to make the nxc exit sub command mode 380

The commands in my configuration file or shell script are not working properly 380

The nxc s traffic throughput rate decreased after i started collecting traffic statistics 380

I cannot get the firmware uploaded using the commands 381

My earlier packet capture files are missing 381

My packet capture captured less than i wanted or failed 381

Wireless 381

Wireless clients cannot connect to an ap 381

A wireless client cannot be authenticated through the captive portal 382

The ap status is registered as offline even though it is on 382

Ap list screen there is no load balancing indicator associated with any aps assigned to the load balancing task 383

Note this procedure removes the current configuration 383

Resetting the nxc 383

The nxc sends wireless clients the default logout page instead of a login page 383

Wireless clients are not being load balanced among my aps 383

Getting more troubleshooting help 384

Log descriptions 385

Ppendi 385

Appendix a log descriptions 401

Code description 401

Log message description 401

Nxc series user s guide 401

Register ftp alg extra port d failed 401

Register ftp alg signal port d failed 401

Table 202 nat logs continued 401

Table 203 certificate path verification failure reason codes 401

Ap reboot mac 02x 02x 02x 02x 02x 02x name s model s 408

Ap ssid stop mac 02x 02x 02x 02x 02x 02x radio d ssid s stop 408

Appendix a log descriptions 408

Log message description 408

Nxc series user s guide 408

Send retransmit configuration to ap mac 02x 02x 02x 02x 02x 02x name s retry count d model s 408

Start send configuration to ap mac 02x 02x 02x 02x 02x 02x name s model s 408

Start send updating configuration to ap mac 02x 02x 02x 02x 02x 02x name s model s 408

Sucess send configuration to ap mac 02x 02x 02x 02x 02x 02x name s model s 408

Sucess send updating configuration to ap mac 02x 02x 02x 02x 02x 02x name s model s 408

Table 212 capwap server logs 408

Upgrade ap firmware mac 02x 02x 02x 02x 02x 02x name s model s 408

Common services 412

Ppendi 412

Appendix b common services 413

Name protocol port s description 413

Nxc series user s guide 413

Table 219 commonly used services continued 413

Appendix b common services 414

Name protocol port s description 414

Nxc series user s guide 414

Table 219 commonly used services continued 414

Importing certificates 415

Ppendi 415

Internet explorer 416

Installing a stand alone certificate file in internet explorer 420

Removing a certificate in internet explorer 421

Firefox 423

Installing a stand alone certificate file in firefox 424

Removing a certificate in firefox 426

Ppendi 428

Wireless lans 428

Channel 430

Note enabling the rts threshold causes redundant network overhead that could negatively affect the throughput performance instead of providing a remedy 431

Rts cts 431

Fragmentation threshold 432

Ieee 802 1g wireless lan 432

Note the wireless devices must use the same preamble mode in order to communicate 432

Preamble type 432

Wireless security overview 432

Ieee 802 x 433

Note you must enable the same wireless security settings on the nxc and on all wireless clients that you want to associate with it 433

Radius 433

Types of eap authentication 434

Types of radius messages 434

Dynamic wep key exchange 435

Eap md5 message digest algorithm 5 435

Eap tls transport layer security 435

Eap ttls tunneled transport layer service 435

Peap protected eap 435

Appendix d wireless lans 436

Both wpa and wpa2 improve data encryption by using temporal key integrity protocol tkip message integrity check mic and ieee 802 x wpa and wpa2 use advanced encryption standard aes in the counter mode with cipher block chaining message authentication code protocol ccmp to offer stronger encryption than tkip 436

Eap md5 eap tls eap ttls peap leap 436

Encryption 436

For added security certificate based authentications eap tls eap ttls and peap use dynamic keys for data encryption they are often deployed in corporate environments but for public deployment a simple user name and password pair is more practical the following table is a comparison of the features of authentication types 436

If both an ap and the wireless clients support wpa2 and you have an external radius server use wpa2 for stronger data encryption if you don t have an external radius server you should use wpa2 psk wpa2 pre shared key that only requires a single identical password entered into each access point wireless gateway and wireless client as long as the passwords match a wireless client will be granted access to a wlan 436

If the ap or the wireless clients do not support wpa2 just use wpa or wpa psk depending on whether you have an external radius server or not 436

If this feature is enabled it is not necessary to configure a default encryption key in the wireless security configuration screen you may still configure and store keys but they will not be used while dynamic wep is enabled 436

Key differences between wpa or wpa2 and wep are improved data encryption and user authentication 436

Note eap md5 cannot be used with dynamic wep key exchange 436

Nxc series user s guide 436

Select wep only when the ap and or wireless clients do not support wpa or wpa2 wep is less secure than wpa or wpa2 436

Table 222 comparison of eap authentication types 436

Tkip uses 128 bit keys that are dynamically generated and distributed by the authentication server aes advanced encryption standard is a block cipher that uses a 256 bit mathematical algorithm 436

Wi fi protected access wpa is a subset of the ieee 802 1i standard wpa2 ieee 802 1i is a wireless security standard that defines stronger encryption authentication and key management than wpa 436

Wpa and wpa2 436

User authentication 437

Wireless client wpa supplicants 437

Wpa 2 psk application example 438

Wpa 2 with radius application example 438

Appendix d wireless lans 439

Authentication method key management protocol 439

Encryption method 439

Enter manual key ieee 802 x 439

Figure 236 wpa 2 psk authentication 439

Nxc series user s guide 439

Refer to this table to see what other security parameters you should configure for each authentication method or key management protocol type mac address filters are not dependent on how you configure these security features 439

Security parameters summary 439

Table 223 wireless security relational matrix 439

The ap and wireless clients use the tkip or aes encryption process the pmk and information exchanged in a handshake to create temporal encryption keys they use these keys to encrypt data exchanged between them 439

Ppendi 440

Global address 441

Loopback address 441

Multicast address 441

Unspecified address 441

Eui 64 442

Interface id 442

Stateless autoconfiguration 442

Subnet masking 442

Dhcp relay agent 443

Dhcpv6 443

Identity association 443

Rebind 443

Renew rebind 443

Renew to s1 443

Icmpv6 444

Ipv6 cache 444

Neighbor discovery protocol ndp 444

Prefix delegation 444

Mld messages 445

Multicast listener discovery 445

Example enabling dhcpv6 on windows xp 446

Example enabling ipv6 on windows xp 2003 vista 446

Example enabling ipv6 on windows 7 447

Customer support 449

Ppendi 449

Austria 450

Belarus 450

Europe 450

Malaysia 450

Pakistan 450

Philipines 450

Singapore 450

Taiwan 450

Thailand 450

Vietnam 450

Belgium 451

Bulgaria 451

Denmark 451

Estonia 451

Finland 451

France 451

Germany 451

Hungary 451

Latvia 451

Lithuania 452

Netherlands 452

Norway 452

Poland 452

Romania 452

Russia 452

Slovakia 452

Sweden 452

Switzerland 452

Argentina 453

Ecuador 453

Latin america 453

Middle east 453

North america 453

Turkey 453

Ukraine 453

Africa 454

Australia 454

Oceania 454

South africa 454

Legal information 455

Ppendi 455

Appendix g legal information 456

Ce emc statement class a products only nxc5500 for example 456

European union 456

Industry canada ices statement 456

List of national codes 456

Nxc series user s guide 456

Safety warnings 456

Appendix g legal information 457

Environment statement 457

Erp energy related products class b products only nxc2500 for example 457

Nxc series user s guide 457

Weee directive 457

Environmental product declaration 458

Appendix g legal information 459

Nxc series user s guide 459

Open source licenses 459

Registration 459

Viewing certifications 459

Zyxel limited warranty 459

台灣 459

Zyxel NXC5500 [352/469] Note you should include write commands in your scripts if you do not use the write command the changes will be lost when the nxc restarts you could use multiple write commands...

Содержание

Похожие устройства