ZyXEL Communications IES-6000 Authentication Server RADIUS, Authenticator Authorized, Supplicant

Page 70

Authentication

IES-5000/5005/6000 Support Notes

Authentication

Server (RADIUS)

X IES-5000(SLC/ALC)

(Authenticator) Authorized

Unauthorized

Station/

Application server

SHDSL/ADSL

SHDSL/ADSL

modem Port x

Port y

modem

PC 1

(Supplicant)

Setting up 802.1x

PC 2

(Supplicant)

To set up an 802.1x infrastructure, we need to configure the authenticator, RADIUS and supplicants. In this example, we will use Microsoft 802.1x client as the supplicant and ZyXEL Vantage 50 as the RADIUS server. The following sections describe the procedures.

1.Authenticator Setup: IES-5000

1.1 RADIUS settings:

Enable 802.1x Authentication and specify the RADIUS server IP address, UDP port and shared Secret on the IES-5000. Make sure you enter the same UDP port and shared secret as the RADIUS server. Then save the settings to make them take effect.

TGE1> sys sw dot1x enable

TGE1> sys sw dot1x set radius server 192.168.1.3

TGE1> sys sw dot1x set radius port 1812

TGE1> sys sw dot1x set radius sec 12345678

TGE1> config save

69

All contents copyright (c) 2008 ZyXEL Communications Corporation.

Image 70

Contents IES-5000/5005/6000 Integrated Ethernet SwitchSupport Notes IES-5000/5005/6000 Support Notes INDEXApplication Notes Triple play Application with VLC Line CardTriple Play Triple Play scenario topology IES-5000M Main Chassis Hardware connectionsP-870H-51 MSC1000GFirmware versions IES-5000Configure the P-870H-51 How to set the P-870H-51 to factory-default?Configure the IES-5000 1. System login2. Configure the VLC1348G-51 a. Click Port VDSL Sub-step 1 Open VLAN setup page Sub-step 2 Join VLAN 100 to VDSL port Sub-step 3 Join VLAN 500 to VDSL port All contents copyright c 2008 ZyXEL Communications Corporation 3. Configure the MSC1000G a. Click VLAN VLAN d. Check the final VLAN setup status of the MSC1000G a. Login 4. Use ACL rule to replace the VID / Priority for the PPPoE packetsb. ACL-rule profile CLI syntax 1 Create ACL profiles 5. Use MVR to configure the IPTV setting on MSC1000G a. Login 6. Configure the IGMP-Proxy and Static Query VLAN a. Login d. Check the Query VLAN status 7. Save configuration for the IPDSLAM 2. If setting is successful, result is as belowConfigure the ES-2024A 2. Configure VLANs 2. VLAN 500 for VoIP 3. VLAN 700 for IPTV 4. Check final status of the VLAN settings Don’t forget to click Apply to save the settings c. Set the default PVID for the relative ports in this scenario1. Click Advance Application VLAN, then choose the VLAN Port Setting 2.Set port 1 / 5 / 7’s PVID as 100 / 500 / 700 as below1. Click Basic Setting Port Setup to call the page below 2. Click Apply at bottom to save the settingse. Save all the settings for the ES-2024A Triple play Application with ALC/SLC Line Card Setting up Multiple PVCsIES-5000 SLC-1248G or ALC-1248G 1. IES-5000 Settings 2. Prestige 660R-61P791 Settings 3. ES-2024 settings 3.1 VALNAll contents copyright c 2008 ZyXEL Communications Corporation 3.2 PVID setup Set the PVIDs on port 1 and 2 to 10 and 20 respectivelyAll contents copyright c 2008 ZyXEL Communications Corporation P‐660H‐61 IES-5000/5005/6000 Support Notes VDSL2 to ADSL2+ FallbackIES‐5000 Slot VLC1348G‐51 ADSL2+ CPEConfigure the P-660H-61 1. Telnet into the P-660H-61b. Type a name in the System Name field 2. General Setupa. Enter 1 in the Main Menu to open Menu 1 - General Setup c. Select No in the Route IP field d. Select Yes in the Bridge fielda. Enter 11 in the Main Menu to open Menu 11 - Remote Node Setup 3. Remote Node Setupb. Enter 1 to configure the remote node of MyISP ISP, SUA e. Select RFC 1483 in the Encapsulation field c. Menu 11.1 - Remote Node Profile appearsf. Select LLC-based in the Multiplexing field j. Menu 11.6 - Remote Node ATM Layer Options appears l. Press ENTER to confirm your changesConfigure the VLC1348G-51 1. LoginAll contents copyright c 2008 ZyXEL Communications Corporation a. Click Port VDSL 2. VDSL Port Setupc. Select Enable e. Click Apply3. PVC Setup 4. Config save a. Click Config Save on the navigation paneld. Select port e. Type 8 in VPI and 35 in VCI c. Click Diagnostic Loopback5. Check status a. Click Statistics Port Statistics f. Click the Test button to perform an OAM F5 loopback test on portAll contents copyright c 2008 ZyXEL Communications Corporation IES-5000/5005/6000 Support Notes Impulse Noise Protection INP What is UPBO? IES-5000/5005/6000 Support Notes Upstream Power Back-Off UPBOPSD f PSD f FEXT-dominated environment Modes of UPBONon-FEXT dominated environment Do not apply UPBO 1. Protection of the long loopMethods of UPBO 4. Spectral mask compatibility with other services3. Improved performance of short loops IES-5000/5005/6000 Support Notes 802.1ag CFM What is CFM?MEP--Maintenance End point MD--Maintenance DomainMA--Maintenance Association CFM TermsMIP--Maintenance Intermediate Point WEB GUI Introduction 1. CFM MD Screen2. CFM MA Screen 3. CFM MEP Screen 4. Loopback Diagnosis Disable CFM MSC1000Gswtichcfm disable Create a MD CLI Command IntroductionEnable CFM Create a MEP MSC1000G switch cfmmep setAll contents copyright c 2008 ZyXEL Communications Corporation Internet Setting up different DSL port speeds to different subscribersConfiguring and applying the profiles to subscriber ports IES-5000 ALC-1248G2. Prestige 660R-61 2.2 Menu 4 Internet Access Setup 2.1 Menu 1 General Setup2.3 Menu11.1 Remote Node Profile 2.4 Menu11.6 Remote Node ATM Layer Options IES-5000/5005/6000 Support Notes Configuring 802.1Q VLAN Setting up a VLAN1.2 PVID settings 1.1 VLAN settings802.1x Application TGE1 switch port pvid up1 TGE1 switch port pvid up2Setting up Authentication Server RADIUSAuthenticator Authorized 1. Authenticator Setup IES-50002.1 RADIUS server setup 2. RADIUS Setup Vantage2.2 Create a User Account 3. Supplicant Setup Windows XP All contents copyright c 2008 ZyXEL Communications Corporation Syslog Server Application 4. Prestige 660R-61 SettingsPlease refer to the procedures described in the previous application 1. Installing and Running Kiwi’s Syslog Server Setting up a Syslog serverNetwork 2. IES-5000 settings IES-5000/5005/6000 Support Notes Ring Topology Application Setting up a Ring Environment1. IES-5000 settings 1.1 Activating Spanning Tree protocol on Ethernet Portsports 1 and 2. The following shows the CLI commands CI command 2. Setup IES-2000 2.1 Activating Spanning Tree protocol2.2 Activating Spanning Tree protocol on Ethernet ports TGE1 sys sw rstp enable TGE1 sys sw rstp port enableClick Uplink2 to configure this port Select Rapid Spanning Tree Protocol to enable it on the portAll contents copyright c 2008 ZyXEL Communications Corporation 3. ES-4024 Settings 3.1 Activating Spanning Tree protocol 4. Status Results Ethernet Port IGMP Snooping/IGMP Filtering ApplicationIGMP Router1. IES-5000 settings 1.1 Activating IGMP Snooping Setting up IGMP snooping/IGMP filtering1.2 Setting up IGMP Filtering Setting up MAC Filter/Port Security Limiting Internet access to users on specific DSL ports1. IES-5000 settings 1.1 Configuring MAC filter 1.2 Configuring Port Security DHCP Relay Option 82 ApplicationNetwork DHCP Server Setting up DHCP Relay OptionADSL/SHDSL CPE DHCP Client 2. CPE settings 3. IP Commander settingsAll contents copyright c 2008 ZyXEL Communications Corporation Enter a name and description for the new rule All contents copyright c 2008 ZyXEL Communications Corporation Select DHCP Option in the Keywords field All contents copyright c 2008 ZyXEL Communications Corporation In the next wizard screen, click Next to continue All contents copyright c 2008 ZyXEL Communications Corporation Click Finish to complete the wizard setup Packet Filtering After the configuration, your computer should obtain an IP address of 192.168.1.201 from the DHCP server once the computer is connected to the networkNetwork Client Setting up Packet Filtering1. IES-5000 settings ALC-1248G/SLC 1248G Client7- 4 accept-all 7- 5 accept-all 7- 6 accept-all 7- 7 accept-all 7-42 accept-all 7-43 accept-all 7-44 accept-all 7-45 accept-all 7-46 accept-all 7-47 accept-all 7-48 accept-all TGE1