Manuals / ZyXEL Communications / Computer Equipment / Network Router

ZyXEL Communications HS100/HS100W Diagram G-1 Sequences for EAP MD5-Challenge Authentication

Models: HS100/HS100W

1 357

Download 357 pages 54.31 Kb

Page 344

HomeSafe User’s Guide

Client computer access authorized.

Client computer access not authorized.

Diagram G-1 Sequences for EAP MD5–Challenge Authentication

	Wireless LAN with IEEE 802.1x
G-2

Image 344

ZyXEL Communications HS100/HS100W manual Diagram G-1 Sequences for EAP MD5-Challenge Authentication

Contents

HS-100 / HS-100W Version 10/2005Trademarks Copyright 2004 by ZyXEL Communications CorporationDisclaimer Certifications Information for Canadian Users ZyXEL Limited Warranty Online RegistrationCustomer Support Table of Contents III 11-1 Viii 27.1 Page List of Figures Xiv List of Figures 10-1 Xvi List of Figures Xvii Xviii List of Figures List of Tables List of Tables 20-3 Xxii List of Tables ¾ ZyXEL Glossary and Web Site Related DocumentationUser’s Guide Feedback Dslam Syntax ConventionsGraphics Icons Key HomeSafe User’s Guide Preface Xxv Part Page HomeSafe Features Physical FeaturesNon-Physical Features Getting to Know Your HomeSafeContent Filtering Brute-Force Password Guessing Protection802.11b Wireless LAN Standard HS-100W only FirewallPacket Filtering Universal Plug and Play UPnPCall Scheduling PPPoEDhcp Dynamic Host Configuration Protocol Upgrade HomeSafe Firmware via LANNetwork Address Translation NAT Traffic RedirectSecure Broadband Internet Access via Cable or DSL Modem Wireless Association List HS-100W onlyApplications for the HomeSafe HomeSafe Parental Control GatewayWireless LAN Application Wireless LAN Application ExampleAccessing the HomeSafe Web Configurator Introducing the Web ConfiguratorWeb Configurator Overview System Administrator Password Setup Wlan SetupSet up your wireless LAN using the second wizard screen Following table describes the fields in this screenEssid Wlan Setup Basic SecurityAccess screen Wlan Setup Extended Security Following table describes the labels in this screenWEP AsciiInternet Configuration Setup Refer to the chapter on wireless LAN for more informationInternet Configuration Setup ISP Parameters Internet Access SetupInternet Access Static IP Address Setup DhcpInternet Configuration Setup Complete Parental Control WizardParental Control Time Setup Wizard Parental Control Wizard10 Wizard Parental Control Time Setup Parental Control Create or Edit a ProfileParental Control Profile Information 11 Wizard Create or Edit a ProfileParental Control User Group 12 Wizard Parental Control Profile InformationAdministrator can decide each group’s Access rightsParental Control Time Allowance 13 Wizard Parental Control User GroupParental Control Application Blocking Allowance screen Parental Control Account Summary15 Wizard Parental Control Application Blocking Parental Control Register for Content Filter 16 Wizard Parental Control SummaryContent Filtering with an External Server Checking Content Filtering ActivationFollowing screen appears after you click Activate in Figure Content Filter Service ActivationIf you click Register Later you will proceed to Figure Accessing the Internet via the HomeSafe Gateway Content Filter Setup Complete25 Password Screen Resetting the HomeSafe Procedure To Use The Reset ButtonHomeSafe Main Menu Navigation Panel17 Screens Summary Link TAB FunctionMaintenance FirewallRemote Mgmt Telnet FTPPage Connection Wizard General Setup and System Name Chapter Connection WizardConnection Wizard Overview Domain NameConnection Wizard General Setup Connection Wizard ScreenConnection Wizard Wireless LAN Setup Basic Security Connection Wizard Wireless LAN Setup Extend Security EthernetPPPoE Encapsulation Connection Wizard Ethernet EncapsulationConnection Wizard PPPoE Encapsulation Pptp Encapsulation Connection Wizard Pptp EncapsulationWAN IP Address Assignment Private IP Address RangesWAN MAC Address IP Address and Subnet MaskDNS Server Address Assignment Connection Wizard WAN Setup ISPBasic Setup Complete Connection Wizard Finish10 Connection Wizard Problems HomeSafe User’s Guide Connection Wizard System, LAN, Wlan and WAN Configuring General Setup Chapter System ScreensSystem Overview Click System to open the General screenDynDNS Wildcard Configuring Dynamic DNSDynamic DNS System Ddns Configuring Password Configuring Time SettingSystem Time Setting Daylight Savings LAN Overview Dhcp SetupChapter LAN Screens Any IP MulticastHow Any IP Works Any IP Example ApplicationConfiguring IP Click LAN to open the IP screenLAN TCP/IP Configuring Static Dhcp LAN Static DhcpConfiguring IP Alias LAN IP AliasLAN IP Alias Wireless Configuration and Roaming Wireless LAN OverviewIbss 2 BSSBasic Service set 3 ESSWireless LAN Basics 1 RTS/CTSConfiguring Wireless Fragmentation ThresholdConfiguring Roaming RTS/CTSRequirements for Roaming Roaming ExampleAllow roaming Wireless stations must have the same Essid toAll APs on the same subnet Page Chapter Wireless Security Wireless Security OverviewWPA-PSK WPAAuthentication Wireless Security Relational MatrixSecurity Parameters Summary WEP OverviewWEP Authentication Steps Preamble TypeConfiguring WEP Encryption Encryption fieldEncryption User AuthenticationIntroduction to WPA WPA-PSK Application Example WPA-PSK application looks as followsConfiguring WPA-PSK Authentication If wireless station authentication is doneUsing a Radius server, the reauthentication Timer on the Radius server has priorityWireless Client WPA Supplicants WPA with Radius Application ExampleConfiguring WPA Authentication WPA with Radius Application ExampleWlan Wireless WPA 802.1x OverviewEAP-MD5 cannot be used with Dynamic WEP Key Exchange Configuring 802.1x and Dynamic WEP Key ExchangeDynamic WEP Key Exchange Configuring 802.1x and Static WEP Key Exchange 10 Wlan Wireless 802.1x and Static WEP Wlan Wireless 802.1x and Static WEPWlan Wireless 802.1x and Static WEP Configuring ResetMAC Filter MAC Following table describes the labels in this menuWlan MAC Address Filter Configuring Local User Database Introduction to Local User Database10 Wlan Local User Database Active Select this option to activate the user profileIntroduction to Radius Configuring Radius EAP Authentication Overview15 Wlan Radius 11 Wlan RadiusHomeSafe User’s Guide Page Configuring Route Chapter WAN ScreensWAN Overview TCP/IP Priority MetricScreen shown next is for Ethernet encapsulation Configuring WAN ISPEthernet Encapsulation PPPoE Encapsulation WAN ISP PPPoE Encapsulation WAN ISP Pptp Encapsulation Configuring WAN IP WAN IP Address AssignmentWAN IP Selected Use Fixed IP AddressServer Choose Both, None, In Only or Out OnlyRIP-1 Configuring WAN MACChoose RIP-1 , RIP-2B or RIP-2M Traffic Redirect WAN Setup Traffic RedirectConfiguring Traffic Redirect WAN Traffic RedirectWAN Traffic Redirect SUA/NAT and Static Route Page Chapter Network Address Translation NAT Screens NAT OverviewNAT Definitions What NAT DoesHow NAT Works NAT ApplicationNAT Mapping Types Following table summarizes these typesUsing NAT SUA ServerSUA Single User Account Versus NAT NAT Mapping TypesPort Forwarding Services and Port Numbers Default Server IP AddressServices and Port Numbers Services Port NumberConfiguring SUA Server Configuring Servers Behind SUA ExampleConfiguring Address Mapping SUA/NAT SetupAddress Mapping One-to-One and Server mapping typesMany-to-One and Server mapping types Configuring Address MappingTrigger Port Forwarding Configuring Trigger Port Forwarding Trigger Port Forwarding ExampleTwo Points To Remember About Trigger Ports Following is an example of trigger port forwardingOnly one LAN computer can use a trigger port range at a time Page Configuring IP Static Route Chapter Static Route ScreensStatic Route Overview Click Static Route to open the screen as shown nextConfiguring Route Entry Static Route EditNAT Screens 10-3 UPnP, Parental Control and Firewall How Do I Know If Im Using UPnP? Chapter UPnPUniversal Plug and Play Overview UPnP and ZyXELClick UPnP to display the screen shown next Configuring UPnPInstalling UPnP in Windows Example Installing UPnP in Windows Me Installing UPnP in Windows XPFollow the steps below to install UPnP in Windows Me Follow the steps below to install UPnP in Windows XPUsing UPnP in Windows XP Example Auto-discover Your UPnP-enabled Network DeviceInternet Connection Properties Web Configurator Easy Access Connections Select My Network Places under Other PlacesUPnP 11-7 Page Parental Control Logins Initial ConfigurationChapter Parental Control Parental Control OverviewParental Administrator log Parental Control ApplicationConfiguring Parental Control HomeSafe Parental Control Wireless Gateway ApplicationParental Control For content filtering to be activated. See Checking Content filtering activationWeb site displays a registration successful Web page. It may take up to another ten minutesParental Control Group Edit Filter Content Filtering with an External ServerReset Click Reset to start configuring this screen again Parental Control Group Edit Configuration Parental Control Filter Parental Control 12-9 12-10 Parental Control Parental Control 12-11 How to set how much of the URL See the Customizing KeywordBlocking URL Checking section for HomeSafe checksCustomizing Keyword Blocking URL Checking Parental Control EditServices Service DescriptionRLOGINTCP513 PPTPTUNNELGRE0RCMDTCP512 REALAUDIOTCP7070Parental Control Edit Access, you should select the unrestricted User access will be denied after the EndIf you want to allow twenty-four hour Check boxParental Control Bypass List Weekdays or Weekend boxesParental Control 12-19 Page Guidelines For Enhancing Security With Your Firewall Chapter FirewallIntroduction Firewall Settings Screen Firewall SettingsFirewall, NAT and Remote Management LAN-to-WAN rulesNo Log Log All log all LAN to WAN packetsServices WAN-to-LAN rulesFirewall Service Click Clear All to empty the Blocked Service Remote Management Page Only LAN only Neither Disable Chapter Remote Management ScreensRemote Management Overview Remote Management LimitationsRemote Management and NAT Configuring WWWSystem Timeout Configuring Telnet Telnet Configuration on a TCP/IP NetworkConfiguring FTP Remote Management TelnetSnmp Remote Management FTPSnmp is only available if TCP/IP is configured Snmp Management ModelConfiguring Snmp Supported MIBsSnmp Traps Snmp TrapsRemote Management Snmp Configuring DNS Remote Management DNSConfiguring Security IcmpRemote Management Screens 14-11 Page HomeSafe User’s Guide VPN Screens 14-1 Logs and Maintenance Chapter Centralized Logs View LogLog Settings Settings, see sectionLog Settings When Log is Full DailyWeekly HourlyStatus Screen Chapter MaintenanceMaintenance Overview Maintenance System Statistics System StatisticsMaintenance Dhcp Table Dhcp Table ScreenAny IP Table Association ListMaintenance Firmware Upload 16.6 F/W Upload ScreenConfiguration Screen Upload WarningMaintenance Restore Configuration Backup ConfigurationRestore Configuration Back to Factory Defaults 11 Configuration Restore Successful14 Factory Defaults Restart ScreenSMT General Configuration Page Chapter Introducing the SMT SMT IntroductionMain Menu Commands Navigating the SMT InterfaceOperation Keystroke Description EnterSystem Management Terminal Interface Summary Main Menu Summary? or ChangeMe Menu Title DescriptionChanging the System Password Menu 23 System PasswordChapter Menu 1 General Setup General SetupProcedure To Configure Menu Field Description ExampleProcedure to Configure Dynamic DNS Select Yes to configure Menu 1.1 Configure Dynamic DNSUser YesDynamicDNS Specified IP Address field Chapter Menu 2 WAN Setup WAN SetupIntroduction to WAN From the main menu, enter 2 to open menuPage Chapter Menu 3 LAN Setup LAN SetupProtocol Dependent Ethernet Setup 20.3 TCP/IP Ethernet Setup and DhcpMenu 3.2 TCP/IP and Dhcp Ethernet Setup Menu 3.2 Dhcp Ethernet Setup FieldsMenu 3.2 LAN TCP/IP Setup Fields BothRIP-1 RIP-1,RIP-2B or RIP-2MIP Alias Setup Physical Network & Partitioned Logical NetworksField Description Example Essid Wireless LAN SetupBoth, In Only, Out Only or None Disable CH06 2437MHzRTS AutoConfiguring MAC Address Filter MixedConfiguring Roaming on the HomeSafe Menu 3.5.1 Wlan MAC Address Filter10 Menu 3.5.2 Roaming Configuration Menu 3.5.2 Roaming ConfigurationPage Chapter Internet Access Introduction to Internet Access SetupMenu 4 Internet Access Setup Ethernet Ethernet EncapsulationConfiguring the Pptp Client Configuring the PPPoE Client DefaultNew Fields in Menu 4 Pptp Screen New Fields in Menu 4 PPPoE screen21-4 Internet Access Remote Node Profile Setup Chapter Remote Node ConfigurationIntroduction to Remote Node Setup Ethernet AliasPress Enter to go to Menu 11.3 Remote Node Network Layer OptionsOutgoing Authentication Protocol Nailed-Up ConnectionFields in Menu 11.1 PPPoE Encapsulation Specific CHAP/PAPEdit IP Menu 11.1 Remote Node Profile for Pptp EncapsulationRemote Node Network Layer Options DynamicRemote Node Filter SUA OnlyMany-to-One and Server RIP-1/RIP-2B/RIP-2M or NoneTraffic Redirect Setup Menu 11.5 Remote Node Filter Ethernet Encapsulation22-8 Remote Node Configuration Chapter Static Route Setup IP Static Route Setup23-2 Static Route Setup Chapter Dial-in User Setup Dial-in User SetupPage Menu 4 Applying NAT for Internet Access Applying NATNAT Setup Full FeatureApplying NAT in Menus 4 NATAddress Mapping Sets SUA Address Mapping SetFollowing table explains the fields in this menu Menu 15.1.255 is read-only SUA Address Mapping RulesUser-Defined Address Mapping Sets Ordering Your RulesMenu 15.1.1 First Set Field Desription ExampleEdit Select Rule itemOne-to-One,Many-to-One and Server types Configuring a Server behind NATFollow these steps to configure a server behind NAT General NAT Examples Example 1 Internet Access OnlyFollowing are some examples of NAT configuration Dynamic Inside Global Address is assigned by the ISP Example 2 Internet Access with an Inside ServerExample 3 Multiple Public IP Addresses With Inside Servers Enter 1 to configure the Address Mapping Sets Following figures show how to configure the first ruleAddress Translation field in menu 4 or menu 11.3 Then enter 15 from the main menuEnter 2 in Menu 15 NAT Setup Example 4 NAT Unfriendly Application Programs Example 3 Menu20 Example 4 Menu 15.1.1 Address Mapping Rules Menu 15.3 Trigger Port Setup Page Access Methods Chapter Enabling the FirewallRemote Management and the Firewall Enabling the FirewallSMT Advanced Management Filter Structure of the HomeSafe Chapter Filter ConfigurationIntroduction to Filters Execute Configuring a Filter Set Abbreviations Used in the Filter Rules Summary MenuConfiguring a Filter Rule Configuring a TCP/IP Filter RuleRule Abbreviations Used Abbreviation DescriptionTCP/IP Filter Rule Field Description OptionsLess EqualFollowing figure illustrates the logic flow of an IP filter Configuring a Generic Filter Rule Executing an IP FilterGeneric Filter Rule Menu Fields Example Filter HomeSafe User’s Guide Generic Filter Rule Menu Fields10 Example Filter Menu Filter Types and NAT Firewall Versus Filters Applying a FilterApplying LAN Filters Applying Remote Node Filters14 Filtering Remote Node Traffic Page Chapter Snmp Configuration About SnmpSupported MIBs Snmp ConfigurationFollowing table describes the Snmp configuration parameters Port PVC Permanent Virtual Circuit Snmp TrapsPorts and Permanent Virtual Circuits Page System Password Configuring External Radius ServerChapter System Security System Security29.1.3 Enter 4 to display Menu 23.4 System Security IEEE802.1xNo Access Allowed Menu 23.4 System Security IEEE802.1xPSK Group Data Privacy fieldMode Management Protocol is selectedSystem Information and Diagnosis System StatusMenu 24.1 System Maintenance Status System Maintenance Status Menu FieldsMenu 1 General Setup System InformationSystem Information To get to the System InformationMenu 24.3.2 System Maintenance Syslog and Accounting Log and TraceConsole Port Speed Syslog LoggingSystem Information and Diagnosis 30-5 Diagnostic Call-Triggering PacketSystem Maintenance Menu Diagnostic WAN Dhcp30-8 System Information and Diagnosis Chapter Firmware and Configuration File Maintenance Filename ConventionsFilename Conventions File Type Internal Name External Name DescriptionBackup Configuration Using the FTP Command from the Command LineExample of FTP Commands from the Command Line Follow the instructions as shown in the next screenBackup Configuration Using Tftp General Commands for GUI-based FTP ClientsCommand Description GUI-based FTP ClientsRestore Configuration Tftp Command ExampleRestore Using FTP Following is an example Tftp commandUploading Firmware and Configuration Files Restore Using FTP Session ExampleFirmware File Upload Configuration File UploadYou see the following screen when you telnet into menu Tftp File Upload FTP File Upload Command from the DOS Prompt ExampleFTP Session Example of Firmware File Upload Tftp Upload Command Example Chapter System Maintenance Command Interpreter ModeCommand Syntax Command UsageCall Control Support Budget ManagementCall History Call History FieldsNTP RFC-1305 the default, is similar to Time RFC-868 Time and Date SettingTime and Date Setting Fields Resetting the Time Daylight Saving fieldPage Chapter Remote Management Remote ManagementLAN Only Chapter Call Scheduling Introduction to Call SchedulingMenu 26.1 Schedule Set Setup OnceApplying Schedule Sets to a Remote Node PPPoE Appendices and Index Page Appendix a TroubleshootingProblem Corrective Action Control Group Edit screen Appendix B PPPoE PPPoE in ActionBenefits of PPPoE Traditional Dial-up ScenarioDiagram B-2 The HomeSafeas a PPPoE Client HomeSafeas a PPPoE ClientWhat is PPTP? Diagram C-1 Transport PPP frames over EthernetAppendix C Pptp and the HomeSafeDiagram C-2 Pptp Protocol Overview Diagram C-3 Example Message Exchange between PC and an ANTPptp Protocol Overview Control & PPP connectionsPptp Page Chart 1 System Error Logs Chart 2 System Maintenance LogsAppendix D Log Descriptions LOG Message DescriptionID content Chart 3 UPnP LogsChart 4 Content Filtering Logs Chart 5 Icmp Type and Code Explanations Type Code DescriptionLog Commands Configuring What You Want the HomeSafe to LogDisplaying Logs Page If you need TCP/IP Appendix E Setting up Your Computer’s IP AddressWindows 95/98/Me If you need Client for Microsoft Networks Checking/Modifying Your Computer’s IP Address Windows 2000/NT/XP Click Advanced to go to the Advanced TCP/IP HomeSafe User’s Guide Turn on your HomeSafeand restart your computer if prompted Close the TCP/IP Control Panel Macintosh OS 8/9Select Ethernet built-in from the Connect via list Select Built-in Ethernet from the Show list Macintosh OSCheck your TCP/IP properties in the Network window Page Appendix F Wireless LAN and Ieee Benefits of a Wireless LANAd-hoc Wireless LAN Configuration IeeeInfrastructure Wireless LAN Configuration Diagram F-1 Peer-to-Peer Communication in an Ad-hoc NetworkDiagram F-2 ESS Provides Campus-Wide Coverage Page Appendix G Wireless LAN With Ieee Deployment Issues with IeeeSecurity Flaws with Ieee Advantages of the IeeeDiagram G-1 Sequences for EAP MD5-Challenge Authentication Appendix H Types of EAP Authentication EAP-TTLS Tunneled Transport Layer ServiceEAP-MD5 Message-Digest Algorithm EAP-TLS Transport Layer SecurityDifficulty Wireless Security Certificate ClientCertificate Server Dynamic KeyTypes of Antennas For Wlan Antenna CharacteristicsAppendix Antenna Selection and Positioning Recommendation Positioning Antennas Example Appendix J Brute-Force Password Guessing ProtectionChart 6 Brute-Force Password Guessing Protection Commands Page Ideal Setup Triangle Route ProblemTriangle Route Solutions Appendix K Triangle RouteHow To Configure Triangle Route Diagram K-3 IP AliasDiagram K-4 Gateways on the WAN Side Gateways on the WAN SideAppendix L Index BSSIbss See NAT See Ttls Wlan