Manuals / ZyXEL Communications / Computer Equipment / Network Card

ZyXEL Communications G-1000 manual 6.6.2 WPA2 with RADIUS Application Example

Models: G-1000

1 192

Download 192 pages 21.42 Kb

Page 60

Image 60

6.6.2 WPA(2) with RADIUS Application Example

G-1000 User’s Guide

Figure 18 WPA(2) - PSK Authentication

6.6.2 WPA(2) with RADIUS Application Example

You need the IP address, port number (default is 1812) and shared secret of a RADIUS server. A WPA(2) application example with an external RADIUS server looks as follows. "A" is the RADIUS server. "DS" is the distribution system (wired link to the LAN).

1The AP passes the wireless client’s authentication request to the RADIUS server.

2The RADIUS server then checks the user's identification against its database and grants or denies network access accordingly.

3The RADIUS server distributes a Pairwise Master Key (PMK) key to the AP that then sets up a key hierarchy and management system, using the pair-wise key to dynamically generate unique data encryption keys to encrypt every data packet that is wirelessly transmitted between the AP and the wireless clients

60	Chapter 6 Wireless LAN

Page 60

Image 60

ZyXEL Communications G-1000 manual 6.6.2 WPA2 with RADIUS Application Example

Contents

802.11g Wireless Access Point G-1000User’s Guide Copyright DisclaimerTrademarks Federal Communications Commission FCC Interference Statement Information for Canadian UsersCertifications Safety Warnings ZyXEL Limited Warranty Customer Support Product model and serial number Warranty InformationBrief description of the problem and the steps you took to solve it Date that you received your deviceG-1000 User’s Guide Customer SupportG-1000 User’s Guide Customer SupportTable of Contents Safety WarningsZyXEL Limited Warranty CopyrightG-1000 User’s Guide Wireless LAN Remote Management ScreensChapter ChapterMaintenance General SetupChapter ChapterSystem Password Appendix B List of Figures Figure 6 The MAIN MENU Screen of the Web ConfiguratorG-1000 User’s Guide Figure 37 System Status Show Statistics Figure 80 Menu 24 System Maintenance G-1000 User’s Guide List of Tables G-1000 User’s GuideTable 37 Restore Configuration Table 80 Subnet G-1000 User’s Guide Preface About This Users GuideRelated Documentation User Guide Feedback Syntax ConventionsGraphics Icons Key 1.2 G-1000 Features 1.2.1 Physical Features1.2.1.3 Reset Button Getting to Know Your G-10001.2.2 Firmware Features 1.2.2.2 Wi-Fi Protected Access1.2.2.3 802.11b Wireless LAN Standard 1.2.1.4 G-1000 LED1.2.2.4 802.11g Wireless LAN Standard 1.2.2.7 Brute-Force Password Guessing Protection1.2.2.8 Wireless LAN MAC Address Filtering 1.2.2.5 STP Spanning Tree Protocol / RSTP Rapid STP1.2.2.15 Wireless Association List 1.3 Applications for the G-10001.2.2.10 IEEE 802.1x Network Security 1.2.2.11 SNMP1.3.1 Internet Access Application 1.3.2 Corporation Network ApplicationG-1000 User’s Guide Chapter 1 Getting to Know Your G-1000Hardware Installation and Initial Setup 2.1 Front Panel of the G-1000CH A P T E R 2.2 Top Panel and Connections of the G-1000 Chapter 2 Hardware Installation and Initial SetupG-1000 User’s Guide Table 3 Front Panel LED Description COLOR2.2.2 Power Port 2.2.3 The RESET Button2.2.1 One 10/100M Ethernet Port 2.4 Additional Installation Requirements 2.5 Configuring Your G-10002.3 Hardware Mounting Options 2.2.4 AntennasIntroducing the Web Configurator 3.1 Accessing the G-1000 Web ConfiguratorCH A P T E R 3.2 Resetting the G-1000 3.2.1 Procedure To Use The Reset Button3.3 Navigating the G-1000 Web Configurator 3.2.2 Method of Restoring Factory-DefaultsClick LOGOUT at any time to exit the web configurator Wizard Setup 4.1 Wizard Setup Overview4.1.1 Channel 4.1.2 ESS ID4.2 Wizard Setup General Setup 4.3 Wizard Setup Wireless LANFigure 7 Wizard 1 General Setup Table 5 Wizard 1 General SetupNote This field is only available when you have an external wireless card inserted in the G-1000Figure 8 Wizard 2 Wireless LAN Setup Table 6 Wizard 2 Wireless LAN Setup4.4 Wizard Setup IP Address 4.4.1 IP Address Assignment4.4.2 IP Address and Subnet Mask by the DHCP server to access the G-1000 again the new IP address if you want to access the web configuratorNote You must know the IP address assigned to the G-1000 Note If you changed the G-1000s IP address, you must use4.5 Basic Setup Complete Click Finish to proceed to complete the Wizard setupBack Finish Click Back to return to the previous screen5.2 Configuring General Setup System Screens5.1 System Overview Figure 11 System General Setup5.3 Configuring Password Figure 12 PasswordTable 10 Password 5.4 Configuring Time Setting Figure 13 Time SettingTable 11 Time Setting G-1000 User’s GuideTable 11 Time Setting G-1000 User’s GuideChapter 5 System Screens LABELWireless LAN 6.2 Wireless Security Overview6.2.2 Authentication 6.1 Introduction6.2.3 Restricted Access 6.2.5 Configuring Wireless LAN on the G-10006.2.4 Hide G-1000 Identity 6.3 Configuring the Wireless Screen 6.3.1 WEP EncryptionNote If you are configuring the G-1000 from a computer connected to the wireless LAN and you change the G-1000’s ESSID or WEPsettings, you will lose your wireless connection when you press Apply to confirm. You must then change the wireless settings of yourTable 13 Wireless Chapter 6 Wireless LANG-1000 User’s Guide LABEL6.4 Configuring Roaming 6.4.1 Requirements for Roaming 6.5 MAC Filter Note All APs on the same subnet and the wireless stations musthave the same ESSID to allow roaming Chapter 6 Wireless LAN G-1000 User’s GuideFigure 17 MAC Address Filter Table 15 MAC Address Filter6.6 Introduction to WPA 6.6.1 WPA2-PSK Application Example6.6.2 WPA2 with RADIUS Application Example 6.7 Configuring IEEE 802.1x and WPA 6.6.3 Wireless Client WPA Supplicants6.7.1 Authentication Required Note If wireless station authentication is done using a RADIUS server, the reauthentication timer on the RADIUS server hasFigure 21 Wireless LAN 802.1x/WPA for 802.1x Protocol Table 17 Wireless LAN 802.1x/WPA for 802.1x Protocol6.7.2 Authentication Required WPA Table 17 Wireless LAN 802.1x/WPA for 802.1x ProtocolChapter 6 Wireless LAN G-1000 User’s Guide6.7.3 Authentication Required WPA-PSK 6.7.4 Authentication Required WPA2 Figure 23 Wireless LAN 802.1x/WPA for WPA-PSK ProtocolTable 19 Wireless LAN 802.1x/WPA for WPA-PSK Protocol Chapter 6 Wireless LAN6.7.5 Authentication Required WPA2-PSK 6.8 Configuring RADIUS Chapter 6 Wireless LAN G-1000 User’s GuideFigure 26 RADIUS Screen Table 22 RADIUS ScreenIP Screen 7.1 TCP/IP Parameters7.1.1 IP Address and Subnet Mask 7.1.2 WAN IP Address Assignment7.2 Configuring IP by the DHCP server to access the G-1000 againnew IP address if you want to access the web configurator Figure 27 IP SetupRemote Management Screens 8.1 Remote Management Overview8.1.1 Remote Management Limitations CH A P T E R8.2 Configuring WWW 8.1.3 System Timeout8.1.2 Remote Management and NAT 8.3 Configuring Telnet 8.4 Configuring TELNET8.5 Configuring FTP 8.6 SNMP Note SNMP is only available if TCP/IP is configuredGet - Allows the manager to retrieve an object variable from the agent 8.6.1 Supported MIBs 8.6.2 SNMP TrapsG-1000 User’s Guide Table 28 SNMP Traps8.6.4 Configuring SNMP 8.6.3 SNMP Interface IndexSNMP Configuration enet0G-1000 User’s Guide Table 30 Remote Management SNMPChapter 8 Remote Management Screens LABELG-1000 User’s Guide Chapter 8 Remote Management Screens9.1 Configuring View Log Log ScreensCH A P T E R 9.2 Configuring Log Settings Figure 34 View LogTable 31 View Log Figure 35 Log Settings Table 32 Log SettingsG-1000 User’s Guide Chapter 9 Log ScreensTable 32 Log Settings G-1000 User’s GuideChapter 9 Log Screens LABELMaintenance 10.1 Maintenance Overview10.2 System Status Screen CH A P T E R10.3 Association List 10.2.1 System Statistics10.4 F/W Upload Screen Chapter 10 MaintenanceG-1000 User’s Guide Figure 38 Association ListNote Do not turn off the G-1000 while firmware upload is in progress Figure 39 Firmware UploadFigure 40 Firmware Upload In Process 10.5 Configuration Screen Figure 42 Firmware Upload ErrorFigure 41 Network Temporarily Disconnected 10.5.1 Backup Configuration 10.5.2 Restore ConfigurationFigure 43 Configuration Figure 44 Configuration Upload Successful Figure 45 Network Temporarily Disconnected10.5.3 Back to Factory Defaults 10.6 Restart Screen11.1 Connect to your G-1000 Using Telnet 11.2 Changing the System PasswordIntroducing the SMT CH A P T E R11.3 G-1000 SMT Menus Overview Figure 50 Menu 23.1 System Security Change Password11.4 Navigating the SMT Interface Table 39 Main Menu CommandsG-1000 User’s Guide Table 38 SMT Menus Overview continued Chapter 11 Introducing the SMTTable 39 Main Menu Commands G-1000 User’s GuideFigure 51 G-1000 SMT Main Menu Table 40 Main Menu SummaryGeneral Setup CH A P T E RTable 41 Menu 1 General Setup Chapter 12 General SetupG-1000 User’s Guide FIELDLAN Setup 13.1 LAN Setup13.2 TCP/IP Ethernet Setup CH A P T E R13.3 Wireless LAN Setup Figure 54 Menu 3.2 TCP/IP SetupG-1000 User’s Guide Figure 55 Menu 3.5 Wireless LAN Setup Table 43 Menu 3.5 Wireless LAN SetupChapter 13 LAN Setup FIELD13.3.1 Configuring MAC Address Filter Table 43 Menu 3.5 Wireless LAN SetupChapter 13 LAN Setup Configuration2 Enter 5 to display Menu 3.5 - Wireless LAN Setup Figure 56 Menu 3.5 Wireless LAN SetupChapter 13 LAN Setup ENTER. Menu 3.5.1 - WLAN MAC Address Filter displays as shown next13.3.2 Configuring Roaming 2 Enter 5 to display Menu 3.5 - Wireless LAN SetupFigure 58 Menu 3.5 Wireless LAN Setup Chapter 13 LAN SetupFigure 59 WLAN Roaming Configuration Table 45 Menu 3.5.4 Bridge Link ConfigurationChapter 13 LAN Setup G-1000 User’s GuideChapter 13 LAN Setup G-1000 User’s GuideDial-in User Setup CH A P T E RChapter 14 Dial-in User Setup G-1000 User’s GuideFigure 61 Menu 14.1- Edit Dial-in User Table 46 Menu 14.1- Edit Dial-in UserSNMP Configuration Figure 62 Menu 22 SNMP ConfigurationTable 47 Menu 22 SNMP Configuration Chapter 15 SNMP ConfigurationChapter 15 SNMP Configuration G-1000 User’s Guide16.1 System Password 16.2 Configuring External RADIUS ServerSystem Security CH A P T E RG-1000 User’s Guide Figure 65 Menu 23.2 System Security RADIUS Server Table 48 Menu 23.2 System Security RADIUS ServerChapter 16 System Security FIELD16.3 2 Enter 4 to display Menu 23.4 - System Security - IEEE802.1xRequired or No Access Allowed G-1000 User’s Guide Figure 67 Menu 23.4 System Security IEEE802.1xTable 49 Menu 23.4 System Security IEEE802.1x Chapter 16 System Securityconfigure Data Privacy for Broadcast/Multicast packets field When you configure Key Management Protocol to WPA, the AuthenticationG-1000 User’s Guide Table 49 Menu 23.4 System Security IEEE802.1xG-1000 User’s Guide Chapter 16 System SecuritySystem Information and Diagnosis 17.1 System StatusCH A P T E R 17.2 System Information 1 Enter 24 to display Menu 24 - System MaintenanceFigure 69 Menu 24.1 System Maintenance Status Table 50 Menu 24.1 System Maintenance Status17.2.1 System Information Table 51 Menu 24.2.1 System Maintenance InformationMenu 1 - General Setup G-1000 User’s Guide17.3 Diagnostic 17.2.2 Console Port SpeedFollow the procedure next to get to display this menu G-1000 User’s Guide Chapter 17 System Information and DiagnosisFirmware and Configuration File Maintenance 18.1 Filename ConventionsCH A P T E R 18.2 Backup Configuration 18.2.1 Backup Configuration Using FTP18.2.2 Using the FTP command from the DOS Prompt 18.2.3 Backup Configuration Using TFTP Figure 75 FTP Session Example18.2.4 Example TFTP Command 18.2.5 Backup Via Console Port1 Display menu 24.5 and enter “y” at the following screen System Maintenance and Information 19.1 Command Interpreter ModeCH A P T E R 19.2 Time and Date Setting Figure 80 Menu 24 System MaintenanceFigure 81 Valid CI Commands Figure 82 Menu 24.10 System Maintenance Time and Date Setting Table 56 System Maintenance Time and Date SettingChapter 19 System Maintenance and Information G-1000 User’s Guide19.3 Remote Management Setup 19.3.4 Remote Management Setup19.3.1 Telnet 19.3.2 FTP19.3.5 Remote Management Limitations Chapter 19 System Maintenance and InformationLAN only , WAN only , All or Disable . The default is LAN only G-1000 User’s Guide19.5 System Timeout 19.4 Remote Management and NATTroubleshooting Problems Starting Up the G-1000Problems with the Ethernet Interface Appendix AProblems with the Password Problems with TelnetProblems with the WLAN Interface Table 61 Troubleshooting the PasswordSpecifications Appendix BHardware FirmwareSpecifications G-1000 User’s Guide Table 65 Firmware continuedBrute-Force Password Guessing Protection Appendix CExample Brute-Force Password Guessing Protection G-1000 User’s GuideAppendix D Setting up Your Computer’s IP Address Windows 95/98/MeInstalling Components Configuring Verifying Settings Windows 2000/NT/XPSetting up Your Computer’s IP Address 3 Right-click Local Area Connection and then click PropertiesG-1000 User’s Guide Figure 88 Windows XP Start MenuPage In the IP Settings tab, in IP addresses, click Add Macintosh OS 8/9 Verifying Settings1 Click Start, All Programs, Accessories and then Command Prompt 8 Click OK to close the Internet Protocol TCP/IP Properties windowSetting up Your Computer’s IP Address 2 Select Ethernet built-in from the Connect via listG-1000 User’s Guide Figure 94 Macintosh OS 8/9 Apple MenuMacintosh OS Verifying Settings5 Close the TCP/IP Control Panel Select Built-in Ethernet from the Show listVerifying Settings Setting up Your Computer’s IP Address G-1000 User’s GuideCase A The G-1000 is using the same LAN and WAN IP addresses Appendix EIP Address Assignment Conflicts Case D Two or more subscribers have the same IP address G-1000 User’s Guide Figure 99 IP Address Conflicts Case BFigure 100 IP Address Conflicts Case C IP Address Assignment ConflictsIn this case, the subscribers are not able to access the Internet G-1000 User’s GuideFigure 101 IP Address Conflicts Case D IP Address Assignment ConflictsG-1000 User’s Guide IP Address Assignment ConflictsWireless LANs Wireless LAN TopologiesAd-hoc Wireless LAN Configuration Appendix FPage Channel RTS/CTSWireless LANs G-1000 User’s Guide Figure 104 Infrastructure WLANFragmentation Threshold Figure 105 RTS/CTSIEEE 802.11g Wireless LAN Preamble TypeIEEE RADIUSTypes of RADIUS Messages Types of Authentication EAP-MD5 Message-Digest AlgorithmEAP-TTLS Tunneled Transport Layer Service EAP-TLS Transport Layer SecurityPEAP Protected EAP LEAPWPA2 EncryptionUser Authentication Security Parameters SummaryTable 69 Wireless Security Relational Matrix continued Wireless LANsAUTHENTICATION ENABLE IEEEWireless LANs G-1000 User’s GuideAppendix G IP SubnettingIP Addressing IP ClassesSubnet Masks SubnettingExample Two Subnets SUBNET MASK IP ADDRESSSUBNET MASK “1” BITS LAST OCTET BIT VALUETable 75 Subnet Table 76 SubnetExample Four Subnets Table 77 SubnetTable 78 Subnet Table 79 SubnetExample Eight Subnets Subnetting With Class A and Class B Networks G-1000 User’s Guide IP SubnettingCommand Interpreter Command SyntaxCommand Usage Appendix HCommand Interpreter G-1000 User’s GuideAppendix Log DescriptionsTable 84 System Maintenance Logs G-1000 User’s GuideLog Commands Configuring What You Want the G-1000 to LogG-1000 User’s Guide Table 85 ICMP Notes continued Table 86 Sys logLog Command Example Displaying LogsTable 87 Log Categories and Available Settings G-1000 User’s GuideG-1000 User’s Guide Log DescriptionsAntenna Characteristics Appendix JAntenna Selection and Positioning Recommendation Types of Antennas For WLANConnector Type Positioning AntennasPower Adaptor Specifications Appendix KPower Adaptor Specifications G-1000 User’s GuidePower Adaptor Specifications G-1000 User’s Guide Table 93 AUSTRALIA AND NEW ZEALAND PLUG STANDARDSNumerics IndexZyAIR G-3000 User’s Guide ZyAIR G-3000 User’s Guide FTP 72, 75, 134 RestrictionsZyAIR G-3000 User’s Guide ZyAIR G-3000 User’s Guide ZyAIR G-3000 User’s Guide