Manuals / ZyXEL Communications / Computer Equipment / Network Router

ZyXEL Communications HS100/HS100W Certificate Client, Certificate Server, Dynamic Key, Deployment

Models: HS100/HS100W

1 357

Download 357 pages 54.31 Kb

Page 346

HomeSafe User’s Guide

Comparison of EAP Authentication Types

	EAP-MD5	EAP-TLS	EAP-TTLS	PEAP

Certificate – Client	No	Yes	Optional	Optional

Certificate – Server	No	Yes	Yes	Yes

Dynamic Key	No	Yes	Yes	Yes
Exchange

Credential Security	None	Strong	Strong	Strong

Deployment	Easy	Hard	Moderate	Moderate
Difficulty
Wireless Security	Poor	Best	Good	Good

Client Identity	No	No	Yes	Yes
Protection

H-2	Types of EAP Authentication

Image 346

ZyXEL Communications HS100/HS100W manual Certificate Client, Certificate Server, Dynamic Key, Exchange Credential Security

Contents

HS-100 / HS-100W Version 10/2005Disclaimer Copyright 2004 by ZyXEL Communications CorporationTrademarks Certifications Information for Canadian Users ZyXEL Limited Warranty Online RegistrationCustomer Support Table of Contents III 11-1 Viii 27.1 Page List of Figures Xiv List of Figures 10-1 Xvi List of Figures Xvii Xviii List of Figures List of Tables List of Tables 20-3 Xxii List of Tables User’s Guide Feedback Related Documentation¾ ZyXEL Glossary and Web Site Graphics Icons Key Syntax ConventionsDslam HomeSafe User’s Guide Preface Xxv Part Page Non-Physical Features HomeSafe FeaturesPhysical Features Getting to Know Your HomeSafe802.11b Wireless LAN Standard HS-100W only Content FilteringBrute-Force Password Guessing Protection FirewallCall Scheduling Packet FilteringUniversal Plug and Play UPnP PPPoENetwork Address Translation NAT Dhcp Dynamic Host Configuration ProtocolUpgrade HomeSafe Firmware via LAN Traffic RedirectApplications for the HomeSafe Secure Broadband Internet Access via Cable or DSL ModemWireless Association List HS-100W only HomeSafe Parental Control GatewayWireless LAN Application Wireless LAN Application ExampleWeb Configurator Overview Introducing the Web ConfiguratorAccessing the HomeSafe Web Configurator Set up your wireless LAN using the second wizard screen System Administrator Password SetupWlan Setup Following table describes the fields in this screenAccess screen Wlan Setup Basic SecurityEssid WEP Wlan Setup Extended SecurityFollowing table describes the labels in this screen AsciiInternet Configuration Setup Refer to the chapter on wireless LAN for more informationInternet Configuration Setup ISP Parameters Internet Access SetupInternet Access Static IP Address Setup DhcpInternet Configuration Setup Complete Parental Control WizardParental Control Time Setup Wizard Parental Control Wizard10 Wizard Parental Control Time Setup Parental Control Create or Edit a ProfileParental Control Profile Information 11 Wizard Create or Edit a ProfileParental Control User Group 12 Wizard Parental Control Profile InformationParental Control Time Allowance Administrator can decide each group’sAccess rights 13 Wizard Parental Control User GroupParental Control Application Blocking 15 Wizard Parental Control Application Blocking Parental Control Account SummaryAllowance screen Parental Control Register for Content Filter 16 Wizard Parental Control SummaryContent Filtering with an External Server Checking Content Filtering ActivationIf you click Register Later you will proceed to Figure Content Filter Service ActivationFollowing screen appears after you click Activate in Figure Accessing the Internet via the HomeSafe Gateway Content Filter Setup Complete25 Password Screen HomeSafe Main Menu Resetting the HomeSafeProcedure To Use The Reset Button Navigation Panel17 Screens Summary Link TAB FunctionRemote Mgmt Telnet MaintenanceFirewall FTPPage Connection Wizard Overview Connection Wizard General Setup and System NameChapter Connection Wizard Domain NameConnection Wizard General Setup Connection Wizard ScreenConnection Wizard Wireless LAN Setup Basic Security Connection Wizard Wireless LAN Setup Extend Security EthernetPPPoE Encapsulation Connection Wizard Ethernet EncapsulationConnection Wizard PPPoE Encapsulation Pptp Encapsulation Connection Wizard Pptp EncapsulationWAN IP Address Assignment Private IP Address RangesDNS Server Address Assignment IP Address and Subnet MaskWAN MAC Address Connection Wizard WAN Setup ISPBasic Setup Complete Connection Wizard Finish10 Connection Wizard Problems HomeSafe User’s Guide Connection Wizard System, LAN, Wlan and WAN System Overview Configuring General SetupChapter System Screens Click System to open the General screenDynamic DNS Configuring Dynamic DNSDynDNS Wildcard System Ddns Configuring Password Configuring Time SettingSystem Time Setting Daylight Savings Chapter LAN Screens Dhcp SetupLAN Overview Any IP MulticastHow Any IP Works Any IP Example ApplicationConfiguring IP Click LAN to open the IP screenLAN TCP/IP Configuring Static Dhcp LAN Static DhcpConfiguring IP Alias LAN IP AliasLAN IP Alias Ibss Wireless Configuration and RoamingWireless LAN Overview 2 BSSBasic Service set 3 ESSWireless LAN Basics 1 RTS/CTSConfiguring Wireless Fragmentation ThresholdConfiguring Roaming RTS/CTSRequirements for Roaming Roaming ExampleAll APs on the same subnet Wireless stations must have the same Essid toAllow roaming Page Chapter Wireless Security Wireless Security OverviewWPA-PSK WPASecurity Parameters Summary AuthenticationWireless Security Relational Matrix WEP OverviewWEP Authentication Steps Preamble TypeConfiguring WEP Encryption Encryption fieldIntroduction to WPA User AuthenticationEncryption WPA-PSK Application Example WPA-PSK application looks as followsUsing a Radius server, the reauthentication Configuring WPA-PSK AuthenticationIf wireless station authentication is done Timer on the Radius server has priorityWireless Client WPA Supplicants WPA with Radius Application ExampleConfiguring WPA Authentication WPA with Radius Application ExampleWlan Wireless WPA 802.1x OverviewDynamic WEP Key Exchange Configuring 802.1x and Dynamic WEP Key ExchangeEAP-MD5 cannot be used with Dynamic WEP Key Exchange Configuring 802.1x and Static WEP Key Exchange 10 Wlan Wireless 802.1x and Static WEP Wlan Wireless 802.1x and Static WEPWlan Wireless 802.1x and Static WEP Configuring ResetMAC Filter Wlan MAC Address Filter Following table describes the labels in this menuMAC 10 Wlan Local User Database Configuring Local User DatabaseIntroduction to Local User Database Active Select this option to activate the user profileIntroduction to Radius Configuring Radius EAP Authentication Overview15 Wlan Radius 11 Wlan RadiusHomeSafe User’s Guide Page WAN Overview Configuring RouteChapter WAN Screens TCP/IP Priority MetricEthernet Encapsulation Configuring WAN ISPScreen shown next is for Ethernet encapsulation PPPoE Encapsulation WAN ISP PPPoE Encapsulation WAN ISP Pptp Encapsulation Configuring WAN IP WAN IP Address AssignmentServer WAN IPSelected Use Fixed IP Address Choose Both, None, In Only or Out OnlyChoose RIP-1 , RIP-2B or RIP-2M Configuring WAN MACRIP-1 Traffic Redirect WAN Setup Traffic RedirectConfiguring Traffic Redirect WAN Traffic RedirectWAN Traffic Redirect SUA/NAT and Static Route Page NAT Definitions Chapter Network Address Translation NAT ScreensNAT Overview What NAT DoesHow NAT Works NAT ApplicationNAT Mapping Types Following table summarizes these typesSUA Single User Account Versus NAT Using NATSUA Server NAT Mapping TypesServices and Port Numbers Port Forwarding Services and Port NumbersDefault Server IP Address Services Port NumberConfiguring SUA Server Configuring Servers Behind SUA ExampleConfiguring Address Mapping SUA/NAT SetupAddress Mapping One-to-One and Server mapping typesTrigger Port Forwarding Configuring Address MappingMany-to-One and Server mapping types Two Points To Remember About Trigger Ports Configuring Trigger Port ForwardingTrigger Port Forwarding Example Following is an example of trigger port forwardingOnly one LAN computer can use a trigger port range at a time Page Static Route Overview Configuring IP Static RouteChapter Static Route Screens Click Static Route to open the screen as shown nextConfiguring Route Entry Static Route EditNAT Screens 10-3 UPnP, Parental Control and Firewall Universal Plug and Play Overview How Do I Know If Im Using UPnP?Chapter UPnP UPnP and ZyXELInstalling UPnP in Windows Example Configuring UPnPClick UPnP to display the screen shown next Follow the steps below to install UPnP in Windows Me Installing UPnP in Windows MeInstalling UPnP in Windows XP Follow the steps below to install UPnP in Windows XPUsing UPnP in Windows XP Example Auto-discover Your UPnP-enabled Network DeviceInternet Connection Properties Web Configurator Easy Access Connections Select My Network Places under Other PlacesUPnP 11-7 Page Chapter Parental Control Parental Control LoginsInitial Configuration Parental Control OverviewParental Administrator log Parental Control ApplicationConfiguring Parental Control HomeSafe Parental Control Wireless Gateway ApplicationParental Control Web site displays a registration successful For content filtering to be activated. See CheckingContent filtering activation Web page. It may take up to another ten minutesReset Click Reset to start configuring this screen again Content Filtering with an External ServerParental Control Group Edit Filter Parental Control Group Edit Configuration Parental Control Filter Parental Control 12-9 12-10 Parental Control Parental Control 12-11 Blocking URL Checking section for How to set how much of the URLSee the Customizing Keyword HomeSafe checksCustomizing Keyword Blocking URL Checking Parental Control EditServices Service DescriptionRCMDTCP512 RLOGINTCP513PPTPTUNNELGRE0 REALAUDIOTCP7070Parental Control Edit If you want to allow twenty-four hour Access, you should select the unrestrictedUser access will be denied after the End Check boxParental Control Bypass List Weekdays or Weekend boxesParental Control 12-19 Page Introduction Chapter FirewallGuidelines For Enhancing Security With Your Firewall Firewall Settings Screen Firewall SettingsNo Log Firewall, NAT and Remote ManagementLAN-to-WAN rules Log All log all LAN to WAN packetsServices WAN-to-LAN rulesFirewall Service Click Clear All to empty the Blocked Service Remote Management Page Remote Management Overview Only LAN only Neither DisableChapter Remote Management Screens Remote Management LimitationsSystem Timeout Configuring WWWRemote Management and NAT Configuring Telnet Telnet Configuration on a TCP/IP NetworkConfiguring FTP Remote Management TelnetSnmp Remote Management FTPSnmp is only available if TCP/IP is configured Snmp Management ModelSnmp Traps Configuring SnmpSupported MIBs Snmp TrapsRemote Management Snmp Configuring DNS Remote Management DNSConfiguring Security IcmpRemote Management Screens 14-11 Page HomeSafe User’s Guide VPN Screens 14-1 Logs and Maintenance Chapter Centralized Logs View LogLog Settings Settings, see sectionLog Settings Weekly When Log is FullDaily HourlyMaintenance Overview Chapter MaintenanceStatus Screen Maintenance System Statistics System StatisticsMaintenance Dhcp Table Dhcp Table ScreenAny IP Table Association ListMaintenance Firmware Upload 16.6 F/W Upload ScreenConfiguration Screen Upload WarningRestore Configuration Backup ConfigurationMaintenance Restore Configuration Back to Factory Defaults 11 Configuration Restore Successful14 Factory Defaults Restart ScreenSMT General Configuration Page Chapter Introducing the SMT SMT IntroductionOperation Keystroke Description Main Menu CommandsNavigating the SMT Interface Enter? or ChangeMe System Management Terminal Interface SummaryMain Menu Summary Menu Title DescriptionChanging the System Password Menu 23 System PasswordProcedure To Configure Menu Chapter Menu 1 General SetupGeneral Setup Field Description ExampleProcedure to Configure Dynamic DNS Select Yes to configure Menu 1.1 Configure Dynamic DNSDynamicDNS YesUser Specified IP Address field Introduction to WAN Chapter Menu 2 WAN SetupWAN Setup From the main menu, enter 2 to open menuPage Protocol Dependent Ethernet Setup Chapter Menu 3 LAN SetupLAN Setup 20.3 TCP/IP Ethernet Setup and DhcpMenu 3.2 TCP/IP and Dhcp Ethernet Setup Menu 3.2 Dhcp Ethernet Setup FieldsRIP-1 Menu 3.2 LAN TCP/IP Setup FieldsBoth RIP-1,RIP-2B or RIP-2MIP Alias Setup Physical Network & Partitioned Logical NetworksBoth, In Only, Out Only or None Wireless LAN SetupField Description Example Essid RTS DisableCH06 2437MHz AutoConfiguring MAC Address Filter MixedConfiguring Roaming on the HomeSafe Menu 3.5.1 Wlan MAC Address Filter10 Menu 3.5.2 Roaming Configuration Menu 3.5.2 Roaming ConfigurationPage Menu 4 Internet Access Setup Ethernet Chapter Internet AccessIntroduction to Internet Access Setup Ethernet EncapsulationConfiguring the Pptp Client New Fields in Menu 4 Pptp Screen Configuring the PPPoE ClientDefault New Fields in Menu 4 PPPoE screen21-4 Internet Access Introduction to Remote Node Setup Chapter Remote Node ConfigurationRemote Node Profile Setup Press Enter to go to Menu 11.3 Remote Node Network EthernetAlias Layer OptionsOutgoing Authentication Protocol Nailed-Up ConnectionFields in Menu 11.1 PPPoE Encapsulation Specific CHAP/PAPRemote Node Network Layer Options Edit IPMenu 11.1 Remote Node Profile for Pptp Encapsulation DynamicMany-to-One and Server Remote Node FilterSUA Only RIP-1/RIP-2B/RIP-2M or NoneTraffic Redirect Setup Menu 11.5 Remote Node Filter Ethernet Encapsulation22-8 Remote Node Configuration Chapter Static Route Setup IP Static Route Setup23-2 Static Route Setup Chapter Dial-in User Setup Dial-in User SetupPage Menu 4 Applying NAT for Internet Access Applying NATApplying NAT in Menus 4 NAT SetupFull Feature NATFollowing table explains the fields in this menu Address Mapping SetsSUA Address Mapping Set Menu 15.1.255 is read-only SUA Address Mapping RulesUser-Defined Address Mapping Sets Ordering Your RulesEdit Menu 15.1.1 First SetField Desription Example Select Rule itemFollow these steps to configure a server behind NAT Configuring a Server behind NATOne-to-One,Many-to-One and Server types Following are some examples of NAT configuration Example 1 Internet Access OnlyGeneral NAT Examples Example 3 Multiple Public IP Addresses With Inside Servers Example 2 Internet Access with an Inside ServerDynamic Inside Global Address is assigned by the ISP Address Translation field in menu 4 or menu 11.3 Enter 1 to configure the Address Mapping SetsFollowing figures show how to configure the first rule Then enter 15 from the main menuEnter 2 in Menu 15 NAT Setup Example 4 NAT Unfriendly Application Programs Example 3 Menu20 Example 4 Menu 15.1.1 Address Mapping Rules Menu 15.3 Trigger Port Setup Page Remote Management and the Firewall Access MethodsChapter Enabling the Firewall Enabling the FirewallSMT Advanced Management Introduction to Filters Chapter Filter ConfigurationFilter Structure of the HomeSafe Execute Configuring a Filter Set Abbreviations Used in the Filter Rules Summary MenuRule Abbreviations Used Configuring a Filter RuleConfiguring a TCP/IP Filter Rule Abbreviation DescriptionLess TCP/IP Filter RuleField Description Options EqualFollowing figure illustrates the logic flow of an IP filter Configuring a Generic Filter Rule Executing an IP FilterGeneric Filter Rule Menu Fields Example Filter HomeSafe User’s Guide Generic Filter Rule Menu Fields10 Example Filter Menu Filter Types and NAT Applying LAN Filters Firewall Versus FiltersApplying a Filter Applying Remote Node Filters14 Filtering Remote Node Traffic Page Chapter Snmp Configuration About SnmpFollowing table describes the Snmp configuration parameters Snmp ConfigurationSupported MIBs Ports and Permanent Virtual Circuits Snmp TrapsPort PVC Permanent Virtual Circuit Page Chapter System Security System PasswordConfiguring External Radius Server System Security29.1.3 Enter 4 to display Menu 23.4 System Security IEEE802.1xNo Access Allowed Menu 23.4 System Security IEEE802.1xMode PSKGroup Data Privacy field Management Protocol is selectedSystem Information and Diagnosis System StatusMenu 24.1 System Maintenance Status System Maintenance Status Menu FieldsSystem Information Menu 1 General SetupSystem Information To get to the System InformationConsole Port Speed Menu 24.3.2 System Maintenance Syslog and AccountingLog and Trace Syslog LoggingSystem Information and Diagnosis 30-5 Diagnostic Call-Triggering PacketSystem Maintenance Menu Diagnostic WAN Dhcp30-8 System Information and Diagnosis Filename Conventions Chapter Firmware and Configuration File MaintenanceFilename Conventions File Type Internal Name External Name DescriptionExample of FTP Commands from the Command Line Backup ConfigurationUsing the FTP Command from the Command Line Follow the instructions as shown in the next screenCommand Description Backup Configuration Using TftpGeneral Commands for GUI-based FTP Clients GUI-based FTP ClientsRestore Using FTP Restore ConfigurationTftp Command Example Following is an example Tftp commandUploading Firmware and Configuration Files Restore Using FTP Session ExampleYou see the following screen when you telnet into menu Configuration File UploadFirmware File Upload FTP Session Example of Firmware File Upload FTP File Upload Command from the DOS Prompt ExampleTftp File Upload Tftp Upload Command Example Command Syntax Chapter System MaintenanceCommand Interpreter Mode Command UsageCall Control Support Budget ManagementCall History Call History FieldsTime and Date Setting Fields Time and Date SettingNTP RFC-1305 the default, is similar to Time RFC-868 Resetting the Time Daylight Saving fieldPage Chapter Remote Management Remote ManagementLAN Only Chapter Call Scheduling Introduction to Call SchedulingMenu 26.1 Schedule Set Setup OnceApplying Schedule Sets to a Remote Node PPPoE Appendices and Index Page Problem Corrective Action TroubleshootingAppendix a Control Group Edit screen Benefits of PPPoE Appendix B PPPoEPPPoE in Action Traditional Dial-up ScenarioDiagram B-2 The HomeSafeas a PPPoE Client HomeSafeas a PPPoE ClientAppendix C What is PPTP?Diagram C-1 Transport PPP frames over Ethernet Pptp and the HomeSafePptp Protocol Overview Diagram C-2 Pptp Protocol OverviewDiagram C-3 Example Message Exchange between PC and an ANT Control & PPP connectionsPptp Page Appendix D Log Descriptions Chart 1 System Error LogsChart 2 System Maintenance Logs LOG Message DescriptionChart 4 Content Filtering Logs Chart 3 UPnP LogsID content Chart 5 Icmp Type and Code Explanations Type Code DescriptionLog Commands Configuring What You Want the HomeSafe to LogDisplaying Logs Page Windows 95/98/Me Appendix E Setting up Your Computer’s IP AddressIf you need TCP/IP If you need Client for Microsoft Networks Checking/Modifying Your Computer’s IP Address Windows 2000/NT/XP Click Advanced to go to the Advanced TCP/IP HomeSafe User’s Guide Turn on your HomeSafeand restart your computer if prompted Select Ethernet built-in from the Connect via list Macintosh OS 8/9Close the TCP/IP Control Panel Check your TCP/IP properties in the Network window Macintosh OSSelect Built-in Ethernet from the Show list Page Ad-hoc Wireless LAN Configuration Appendix F Wireless LAN and IeeeBenefits of a Wireless LAN IeeeInfrastructure Wireless LAN Configuration Diagram F-1 Peer-to-Peer Communication in an Ad-hoc NetworkDiagram F-2 ESS Provides Campus-Wide Coverage Page Security Flaws with Ieee Appendix G Wireless LAN With IeeeDeployment Issues with Ieee Advantages of the IeeeDiagram G-1 Sequences for EAP MD5-Challenge Authentication EAP-MD5 Message-Digest Algorithm Appendix H Types of EAP AuthenticationEAP-TTLS Tunneled Transport Layer Service EAP-TLS Transport Layer SecurityCertificate Server Difficulty Wireless SecurityCertificate Client Dynamic KeyAppendix Antenna Selection and Positioning Recommendation Antenna CharacteristicsTypes of Antennas For Wlan Positioning Antennas Chart 6 Brute-Force Password Guessing Protection Commands Appendix J Brute-Force Password Guessing ProtectionExample Page Triangle Route Solutions Ideal SetupTriangle Route Problem Appendix K Triangle RouteDiagram K-4 Gateways on the WAN Side How To Configure Triangle RouteDiagram K-3 IP Alias Gateways on the WAN SideAppendix L Index BSSIbss See NAT See Ttls Wlan