Allied Telesis AT-WR4500 guide

AT-WR4500 Series - IEEE 802.11abgh Outdoor Wireless Routers			139
RouterOS v3 Configuration and User Guide

Name	VendorID	Value	RFC where it is defined
Called-Station-Id		30	RFC2865
Calling-Station-Id		31	RFC2865
CHAP-Challenge		60	RFC2866
CHAP-Password		3	RFC2865
Class		25	RFC2865
Filter-Id		11	RFC2865
Framed-IP-Address		8	RFC2865
Framed-IP-Netmask		9	RFC2865
Framed-Pool		88	RFC2869
Framed-Protocol		7	RFC2865
Framed-Route		22	RFC2865
Idle-Timeout		28	RFC2865
Mikrotik-Advertise-Interval	14988	13
Mikrotik-Advertise-URL	14988	12
Mikrotik-Group	14988	3
Mikrotik-Host-IP	14988	10
Mikrotik-Mark-Id	14988	11
Mikrotik-Rate-Limit	14988	8
Mikrotik-Realm	14988	9
Mikrotik-Recv-Limit	14988	1
Mikrotik-Recv-Limit-Gigawords	14988	14
Mikrotik-Wireless-Enc-Algo	14988	6
Mikrotik-Wireless-Enc-Key	14988	7
Mikrotik-Wireless-Forward	14988	4
Mikrotik-Wireless-Skip-Dot1x	14988	5
Mikrotik-Xmit-Limit	14988	2
Mikrotik-Xmit-Limit-Gigawords	14988	15
MS-CHAP-Challenge	311	11	RFC2548
MS-CHAP-Domain	311	10	RFC2548
MS-CHAP-Response	311	1	RFC2548
MS-CHAP2-Response	311	25	RFC2548

Image 139

Allied Telesis AT-WR4500 manual Name VendorID Value RFC where it is defined

Contents

PN 613-000813 Rev. B AT-WR4500 Series RouterOS v3 Configuration and User Guide AT-WR4500 Series Ieee 802.11abgh Outdoor Wireless Routers Limitation of Liability and Damages Contents IP Addresses and ARP Routes, Equal Cost Multipath Routing, Policy Routing 121 117118 120 166 Hot Spot Service 222163 164 12.1.2 General Settings 10.3.7 Command Description10.3.8 Service Port Possible Error Messages Figures How This Guide is organized Purpose of This GuideDocument Conventions Tell Us What You Think Sales or Corporate Information Management Software UpdatesAllied Telesis FTP server ftp//ftp.alliedtelesis.com Introduction Admin@AT-WR4541g /system license print software-id NCL8-3TT FeaturesSoftware License Downloading WinBox loader Accessing theWR4500 throughWinBoxUsing WinBox Logging in the AT-WR4500 Router Password can be changed with the /password command Accessing the CLIAT-WR4500 Login admin Password Aaaaaaaaaaa Ttttttt Aaaaaaa Aaaaa Tttt Command Action General Information System Backup Import Command Export Command General Information Configuration ResetSpecifications SoftwareVersion Management Property Description System UpgradeTo upgrade chosen packages Step-by-Step Adding Package Source Submenu level /system upgrade upgrade-package-source192.168.25.8 Admin Software Package Management Uninstallation Installation UpgradeCommand name /system package uninstall Name Version Command name /system package downgradeAdmin@AT-WR4562 system package print Flags X disabled Downgrading Unscheduling Suppose we need to test ipv6 package featuresCommand name /system package unschedule Disabling and Enabling Name Version Scheduled Admin@AT-WR4562 system package unschedule security Downloading 16 % To upgrade selected packagesSoftware Package List Download Package name Contents Prerequisites Additional License Package name Contents Prerequisites Additional License Traffic Monitoring General Interface SettingsCommand name /interface monitor-traffic Interface Status Additional Resources Ethernet Interface ConfigurationEthernet Interfaces RelatedTopics ARP Command name /interface ethernet monitorMonitoring the Interface Status Type RX-RATE TX-RATE MTU Troubleshooting Wireless InterfacesDefault-cable-setting standard standard Ack-timeout Range 5GHz 5GHz-turbo 2.4GHz-G Quick Setup GuideIP Addresses and ARP Log Management 35km 298 Wireless Interface ConfigurationSubmenu level /interface wireless 30km 249 AT-WR4500 Series Ieee 802.11abgh Outdoor Wireless Routers Page AT-WR4500 Series Ieee 802.11abgh Outdoor Wireless Routers This example shows how configure a wireless client Signal-to-noise 73dB tx-ccq 79% rx-ccq 46% p-throughput Nstreme SettingsTo see current interface settings Submenu level /interface wireless nstreme Submenu level /interface wireless nstreme-dual Nstreme2 Group Settings Example Then add nstreme2 interface with exact-size framing Submenu level /interface wireless registration-tableAdmin@AT-WR4562 interface wireless nstreme-dual RegistrationTable No -38dBm.. Mbps Admin@AT-WR4562 interface wireless registration-table# Interface RADIO-NAME MAC-ADDRESS Wlan1 000C42185C3D Connect List Access ListSubmenu level /interface wireless connect-list Submenu level /interface wireless access-list Submenu level /interface wireless info Info commandPage AT-WR4500 Series Ieee 802.11abgh Outdoor Wireless Routers Example Virtual Access Point Interface Submenu level /interface wireless wds WDS Interface Configuration Align Submenu level /interface wireless align Admin@AT-WR4562 interface wireless align Command name /interface wireless align monitorAlign Monitor Frequency Monitor ManualTransmit PowerTableAproximately shows how loaded are the wireless channels Submenu level /interface wireless manual-tx-power-table Address Ssid Band Freq SIG RADIO-NAME AB R Command name /interface wireless scan interfacenameNetwork Scan Scan the 5GHz band Security Profiles Submenu level /interface wireless security-profilesPage Sniffer Submenu level /interface wireless snifferSubmenu level /interface wireless sniffer sniff Wireless Sniffer Sniffs packets Snooper Submenu level /interface wireless snooperFreq SIGNAL@RATE SRC DST Type Sniffer Packets Band Freq USE Station and AccessPointApplication Examples Snoop 802.11b network 54Mbps 10.1.0.1/24 10.1.0.0 10.1.0.255 Admin@AccessPoint ip address WDS Station Configure the station and add an IP address 10.1.0.2 to itCheck whether you can ping the Access Point from Station On WDS Access Point Set wds-default-bridge to bridge1 Virtual Access Point Test 4ghz-g Virtual-test 4ghz-g Nstreme network example Nstreme Monitor the link Dual NstremeSsid nstreme Admin@DualNS-1 interface wireless nstreme-dual Configure DualNS-1 Admin@DualNS-2 interface wireless nstreme-dual Now complete the configuration for DualNS-1 WEP security example WEP SecurityPage Admin@WEPStation1 interface wireless Configure WEPStation1 WPA Security Admin@WEPStationX interface wireless Admin@WPAStation interface wireless Test the link between Access point and the clientAdmin@WPAAP interface wireless security-profiles Admin@WPAStation interface wireless security-profiles Vlan Interfaces Vlan Setup Vlan example on AT-WR4500 Routers Application ExampleName MTU ARP 10.20.0.0 10.20.0.255 Pc1 10.10.10.0 10.10.10.255 Test Admin@AT-WR4562 ip addressBridge Interfaces 10.0.0.0 10.0.0.255 Ether1 IP Addresses and ARP EoIP Bridge Interface SetupInterface bridge add name=MyBridge disabled=no Add ether1 and ether2 to MyBridge interface Submenu level /interface bridge port Port Settings Bridge Port Monitoring Command name /interface bridge monitorCommand name /interface bridge port monitor Bridge Monitoring To monitor a bridge port Command name /interface bridge hostBridge Host Monitoring Bridge Firewall General Description Property Description Page Submenu level /interface bridge nat Bridge Packet FilterBridge NAT Submenu level /interface bridge filter Submenu level /interface bridge broute Bridge Brouting Facility Troubleshooting Submenu level /ip address Configuring Interfaces Dhcp and DNSIP Addresses and ARP IP Addressing 2.1/24 2.0 2.255 Ether2 Address Resolution Protocol10.10.10.0 10.10.10.255 Ether2 Admin@AT-WR4562 ip address Submenu level /ip arp Address MAC-ADDRESS Proxy-ARP featureAddress MAC-ADDRESS Interface Proxy ARP Router setup is as follows Consider the following configurationUnnumbered Interfaces RIP Routing Information Protocol General Setup Interfaces Admin@AT-WR4562 routing ripSubmenu level /routing rip interface Submenu level /routing rip network NetworksNeighbors Routes 10.0.0.174 10.0.0.255 Ether1 0.0.0 Ether1 Admin@AT-WR4562To view the list of the routes Ether1 1500 Ether2 Regular routing table is Admin@AT-WR4562 routing rip set redistribute-connected=yes10.0.0.0/24 Admin@AT-WR4562 routing rip network 0.0.0 Ether1 Admin@AT-WR4562 routing rip Ospf Alliedware+ Router ConfigurationRouting table of the Alliedware+ router is General Setup Ospf Areas Admin@AT-WR4562 routing ospfSubmenu level /routing ospf area Network Area Backbone 0.0 None Local10 10.5 Admin@WiFi routing ospf areaSubmenu level /routing ospf network Name AREA-ID Submenu level /routing ospf interface Virtual LinksSubmenu level /routing ospf virtual-link NEIGHBOR-ID Virtual link should be configured on both routers10.0.0.201 Admin@AT-WR4562 routing ospf virtual-link Submenu level /routing ospf neighbor Ospf Backup Ospf backup without using a tunnel Name Type RX-RATE Rate MTU AuthenticationDefine new Ospf area named local10 with area-id Add connected networks with area local10 in ospf network Add the needed IP addresses Name AREA-ID Stub DEFAULT-COST AuthenticationAdd the same area as in main router Add connected networks with area local10 DST-ADDRESS Gateway Distance Interface Admin@OSPFMAIN ip route printAdd connected networks with the same area Connect, S static, r rip, o ospf, b bgp Dead-interval=40s Routing tables with Revised Link Cost On OSPFpeer2 Functioning of the Backup Routes, Equal Cost Multipath Routing, Policy Routing NAT Submenu level /ip route rule Policy Rules Static Equal Cost Multi-Path Routing example Static Equal Cost Multi-Path routing Standard Policy-Based Routing with Failover Standard Policy-Based Routing with Failover DST-ADDRESS Prefsrc Gateway 192.168.0.0 192.168.0.255 Local1 Packages required dhcp License required Level1 Dhcp Client and ServerFinally, add a Dhcp server Check whether you have obtained a lease Submenu level /ip dhcp-client Dhcp Client Setup To add a Dhcp client on ether1 interface Dhcp Server SetupSubmenu level /ip dhcp-server Property Description Store Leases on Disk Submenu level /ip dhcp-server configName Interface Relay Submenu level /ip dhcp-server lease Dhcp NetworksDhcp Server Leases Submenu level /ip dhcp-server network Command Description Submenu level /ip dhcp-server option Dhcp AlertDhcp Option Submenu level /ip dhcp-server alert Name Code Value Dhcp RelayUse this option in Dhcp server network list Submenu level /ip dhcp-relay Questions Command name /ip dhcp-server setupRelay Ether1 10.0.0.1 Admin@AT-WR4562 ip dhcp-relay Questions & Answers # Address Gateway DNS-SERVER WINS-SERVER Dynamic Addressing, using DHCP-RelayIP addresses of DHCP-Server Name Interface Relay ADDRESS-POOL LEASE-TIME ADD-ARP DHCP-1 IP Address assignment, using FreeRADIUS ServerConfigure respective networks Create Dhcp Servers Clients.conf file Configure Radius Client on RouterOSSetup Dhcp Server Create an address pool Configure Dhcp networks IP and Routing DNS Client and Cache Cache Monitoring 5Static DNS EntriesStatic DNS Entries Name Address Command name /ip dns cache flush6Flushing DNS cache Flush clears internal DNS cache Radius client Radius Client Setup Submenu level /radius incoming Service CALLED-ID Domain AddressPpp,hotspot 10.0.0.3 Admin@AT-WR4562 radius ConnectionTerminating from Radius Supported Radius Attributes Suggested Radius ServersXTRadius does not currently support MS-CHAP Page Page Page Name VendorID Value Name VendorID Value RFC where it is defined AT-WR4500 Series Ieee 802.11abgh Outdoor Wireless Routers Submenu level /ppp profile PPP User AAALocal PPP User Profiles L2TP InterfacePage Submenu level /ppp secret Local PPP User Database Monitoring Active PPP Users Command name /ppp active printName Service CALLER-ID Password Profile Name Service CALLER-ID Address Uptime Encoding Submenu level /ppp aaa To enable Radius AAARouter User AAA PPP User Remote AAA Submenu level /user group Router User GroupsExclamation sign ! just before policy item name means not Only one, it cannot be removed Admin@rb13 user groupAdmin@AT-WR4562 user print Flags X disabled Router Users Router User Remote AAA Command name /user active printWhen Name Address Monitoring Active Router Users Generating key on a linux machine To enable Radius AAA, enter the following commandSSH keys Submenu level /user ssh-keys Specific Properties EoIPIP Addresses and ARP Bridge Interfaces EoIP Setup Name User MTU CLIENT-ADDRESS Uptime ENC Admin@OurGW interface pptp-server server set enable=yesAdmin@Remote interface pptp-client EoIP Application Example Interface Bridge Priority PATH-COST Same for the Remote Related Documents Quick Setup GuideInterface Bonding General Information Summary Property Description 10.1.0.0 10.1.0.255 Isp1 Application ExamplesIsp1 Ether 1500 Isp2 1.1/24 1.0 1.255 Isp2 For Office2through ISP2 EoIP tunnel configuration For Office1 through ISP1For Office2 through ISP1 For Office1through ISP2 For Office2 IPIPTunnel Interfaces10.1.0.0 10.1.0.255 Isp1 3.1/24 3.0 3.255 Bonding1 Add an IP address to created ipip1 interface Ipip Setup Name MTU LOCAL-ADDRESS Configuration of the R2 is shown below Configuration on L2TP client router Add a L2TP client Enable the L2TP serverL2TP Interface IP Addresses and ARP AAA Configuration EoIP IP Security 2 L2TP Client SetupSubmenu level /interface l2tp-client Monitoring L2TP Client Command name /interface l2tp-client monitorExample of an established connection Submenu level /interface l2tp-server server 4 L2TP Server SetupTo enable L2TP server 5 L2TP Server Users ENC To add a static entry for ex1 userInterface l2tp-server add user=ex1 Name User MTU CLIENT-ADDRESS Uptime Router-to-Router Secure Tunnel Example 6 L2TP Application ExamplesThen the user should be added in the L2TP server list Add a L2TP client to the RemoteOffice router Admin@HomeOffice interface l2tp-server server Admin@HomeOffice ppp secret print detail Flags X disabled Connecting a Remote Client via L2TPTunnelTest the L2TP tunnel connection Admin@RemoteOffice interface l2tp-server server Server must be enabledAdmin@RemoteOffice ppp secret FromLaptop Admin@RemoteOffice interface l2tp-server ToInternet 1500 L2TP Setup for WindowsAdmin@RemoteOffice interface ethernet PPPoE Now add a pppoe server Add a user with username mike and passwordIp pool add name=pppoe-pool ranges=10.1.1.62-10.1.1.72 Submenu level /interface pppoe-client PPPoE Client Setup To monitor the pppoe-out1connection PPPoE Server Setup Access ConcentratorCommand name /interface pppoe-client monitor Monitoring PPPoE Client Admin@AT-WR4562 interface pppoe-server server To view the currently connected users PPPoE UsersPPPoE Server User Interfaces Submenu level /interface pppoe-server First of all, the wireless interface should be configured PPPoE in a multipoint wireless 802.11g networkAdmin@PPPoE-Server interface wireless Finally, we can set up PPPoE clients We should add PPPoE server to the wireless interface Pptp Admin@MT interface pppoe-server serverMy Windows XP client cannot connect to the PPPoE server Configuration on Pptp client router Add the Pptp client Enable the Pptp serverIP Addresses and ARP PPP User AAA EoIP Submenu level /interface pptp-client Pptp Client Setup Submenu level /interface pptp-server server Pptp Server SetupCommand name /interface pptp-client monitor Monitoring Pptp Client Submenu level /interface pptp-server To enable Pptp serverPptp Users PPTPTunnel Interfaces Interface pptp-server add user=ex1 Pptp Application Examples1460 10.0.0.202 6m32s None Pptp-in1 Ex1 Add a Pptp client to the RemoteOffice router Admin@HomeOffice interface pptp-server add user=exPptp-in1 Admin@HomeOffice interface pptp-server Admin@RemoteOffice interface pptp-client Test the Pptp tunnel connection Connecting a Remote Client via Pptp Tunnel FromLaptop Admin@RemoteOffice interface pptp-server Connecting a Remote Client via and Encrypted Pptp Tunnel IP Security Pptp Setup for WindowsIP Addresses and ARP Firewall and QoS Description Diffie-Hellman Group Modulus Reference Policy SettingsSubmenu level /ip ipsec policy Page Submenu level /ip ipsec peer Flags X disabled, D dynamic, I inactivePeers To view the policy statistics, do the following Submenu level /ip ipsec remote-peers Remote Peer StatisticsLocal-addressread-only IP address local Isakmp SA address Submenu level /ip ipsec installed-sa Installed SAsTo see currently estabilished SAs Command name /ip ipsec installed-sa flush Flushing Installed SATableSample printout looks as follows For Router1 To flush all the SAs installedTunnel mode example using AH with manual keying RouterOS Router to RouterOS Router Add accept and masquerading rules in SRC-NAT IPsec Between two Masquerading RouterOS Routers For Router2 Mangle Packet Flow FilterFirewall Filter Submenu level /ip firewall filterPage Property Description Page Page Block IP addreses called bogons Filter ApplicationsProtect your RouterOS router Protecting the Customers Network Allow only needed icmp codes in icmp chain MangleCreate tcp chain and deny some tcp ports in it Deny udp ports in udp chain Submenu level /ip firewall mangle MangleFilter Packet Flow Page Page Page Peer-to-PeerTraffic Marking Admin@AT-WR4562 /ip firewall mangle add chain=forward \Mark by MAC address Mangle Filter Packet FlowPacket Flow Change MSS Packet Flow Diagram Submenu level /ip firewall connection ConnectionTracking Submenu level /ip firewall connection tracking ConnectionTimeouts Submenu level /ip firewall service-port Service Ports General Firewall Information Submenu level /ip firewall nat NAT 2 NAT Address-list parameter Page Page Example of one to one mapping NAT ApplicationsExample of Source NAT Masquerading Example of Destination NAT HotSpot Gateway Hot Spot Service HotSpot example network Page Page Command name /ip hotspot setup Question&Answer-Based Setup Hs-local Local HS-real Default Admin@AT-WR4562 ip hotspot HotSpot Interface SetupName Interface Submenu level /ip hotspot profile HotSpot Server Profiles0s same as received HotSpot Cookies HotSpot User ProfilesHotSpot Users Description # User Domain MAC-ADDRESS HTTP-levelWalled GardenTo get the list of valid cookies Submenu level /ip hotspot walled-garden Submenu level /ip hotspot ip-binding IP-level Walled GardenOne-to-one NAT static address bindings Submenu level /ip hotspot walled-garden ip Service Port Command DescriptionActive Host List Chain=hotspot action=jump jump-target=pre-hotspot Ftp Admin@AT-WR4562 ip hotspot service-portCustomizing HotSpot Firewall Section To set the FTP protocol uses both 20 and 21 TCP port Https proxy is listening on the 64875 port Packets from the authorized clients through the hs-authchain Chain=hs-input action=jump jump-target=pre-hs-input Reject all packets to the clients with Icmp reject message Serving Servlet Pages Customizing HotSpot Http Servlet Pages Href=$link-loginlogin/a Page Hey, your username is john $elif username == dizzy Add the following line To this line Or alternatively add this line To thisBefore this one Possible Error Messages MAC-ADDRESS Address TO-ADDRESS Server Name Interface ADDRESS-POOL Profile IDLE-TIMEOUTHotSpot How-tos Then we can use that certificate for hotspot HotSpot User AAA MAC-ADDRESS Address TO-ADDRESS Server IDLE-TIMEOUT10.11.12.3 Hs-local Page Submenu level /ip hotspot user Submenu level /ip hotspot active HotSpot Active UsersServer Name Address Profile Uptime To get the list of active users 10.0.0.144 4m17s 55m43s Admin@AT-WR4562 ip hotspot activeUser Address Uptime Vrrp Routers Vrrp Property Description Submenu level /ip vrrp address Flags X disabled, a activeVirtual IP addresses Simple example of Vrrp fail over Now this address should appear in /ip address list Hardware Watchdog Management SystemWatchdogSubmenu level /system watchdog Admin@AT-WR4562 system watchdog Admin@AT-WR4562 system watchdog set auto-send-supout=yes \Automatic-supout yes Auto-send-supout yes Topics General SettingsLog Management Submenu level /system logging Submenu level /log ActionsLog Messages Submenu level /system logging action Timemessage Snmp ServiceTo view the local logs To monitor the system log Traffic Flow General ConfigurationRelated Documents Traffic-Flow Example Admin@AT-WR4562 ip traffic-flowAdmin@AT-WR4562 ip traffic-flow target Traffic-FlowTarget Network Load Statistics Matrix Host Information Network load profile by time General Options GraphingTo store information on system drive every hour Interface Graphing Health GraphingSimple Queue Graphing ALLOW-ADDRESS 192.168.0.0/24 Yes Admin@AT-WR4562 tool graphing resourceResource Graphing Submenu level /tool graphing resource