ZyXEL Communications MAX-206M1R

Appendix A WiMAX Security

User’s Guide

260

Authentication

The WiMAX Modem supports EAP-TTLS authentication.

EAP-TTLS (Tunneled Transport Layer Service)

EAP-TTLS is an extension of the EAP-TLS authentication that uses certificates for

only the server-side authentications to establish a secure connection (with EAP-

TLS digital certifications are needed by both the server and the wireless clients for

mutual authentication). Client authentication is then done by sending username

and password through the secure connection, thus client identity is protected. For

client authentication, EAP-TTLS supports EAP methods and legacy authentication

methods such as PAP, CHAP, MS-CHAP and MS-CHAP v2.

Contents

Main MAX-206M1R Series Page About This User's Guide Intended Audience Related Documentation Note: It is recommended you use the web configurator to configure the WiMAX Modem. Users Guide Feedback Document Conventions Warnings and Notes Warnings tell you about things that could harm you or your WiMAX Modem. Syntax Conventions Icons Used in Figures Table 1 Common Icons Safety Warnings For your safety, be sure to read and follow all warning notices and instructions. Page Contents Overview Page Table of Contents Part I: Introduction and Wizards........................................................... 29 Part III: Advanced Screens.................................................................... 63 Page Part IV: Voice Screens......................................................................... 109 Part V: Tools & Status Screens........................................................... 145 Part VI: Troubleshooting and Specifications .................................... 227 Part VII: Appendices and Index .......................................................... 255 Page List of Figures Page Page Page Page Page List of Tables Page Page Page Page Page CHAPTER 1 Getting Started 1.1 About Your WiMAX Modem 1.1.1 WiMAX Internet Access Figure 1 Mobile Station and Base Station Page 1.2 WiMAX Modem Hardware 1.2.1 LEDs Chapter 1 Getting Started Users Guide 35 Table 2 The WiMAX Modem LED STATE DESCRIPTION 1.3 Good Habits for Managing the Device CHAPTER 2 Introducing the Web Configurator 2.1 Overview 2.1.1 Accessing the Web Configurator Page Page 2.1.2 The Reset Button 2.1.2.1 Using The Reset Button 2.2 The Main Screen Chapter 2 Introducing the Web Configurator The following table describes the labels in this screen. Table 4 Main Table 3 Main > Icons (continued) ICON DESCRIPTION Chapter 2 Introducing the Web Configurator Users Guide 43 Table 4 Main (continued) Page CHAPTER 3 Internet Connection Wizard Figure 6 Select a Mode 3.1 Overview 3.1.1 Welcome to the ZyXEL Setup Wizard 3.1.2 System Information Figure 7 Internet Connection Wizard > System Information Table 5 Internet Connection Wizard > System Information 3.1.3 Authentication Settings Figure 8 Internet Connection Wizard > Authentication Settings Screen Table 6 Internet Connection Wizard > Authentication Settings Screen Chapter 3 Internet Connection Wizard Table 6 Internet Connection Wizard > Authentication Settings Screen (continued) 3.1.4 IP Address Figure 9 Internet Connection Wizard > IP Address Table 7 Internet Connection Wizard > IP Address Page CHAPTER 4 VoIP Connection Wizard Figure 11 Select a Mode 4.1 Overview 4.2 Welcome to the ZyXEL Setup Wizard 4.2.1 First Voice Account Settings Figure 12 VoIP Connection > First Voice Account Settings Table 8 VoIP Connection > First Voice Account Settings Figure 13 VoIP Connection > SIP Registration Test Table 8 VoIP Connection > First Voice Account Settings (continued) Page Page Page CHAPTER 5 The Setup Screens 5.1 Overview 5.1.1 What You Can Do in This Chapter 5.1.2 What You Need to Know 5.2 Set IP Address 5.3 DHCP Client 5.4 Time Setting Figure 18 SETUP > Time Setting Table 10 SETUP > Set IP Address (continued) Table 11 SETUP > Time Setting 5.4.1 Pre-Defined NTP Time Servers List Table 11 SETUP > Time Setting (continued) 5.4.2 Resetting the Time Table 12 Pre-defined NTP Time Servers Page Page CHAPTER 6 The LAN Configuration Screens 6.1 Overview 6.1.1 What You Can Do in This Chapter 6.1.2 What You Need to Know 6.2 DHCP Setup Chapter 6 The LAN Configuration Screens Users Guide 67 The following table describes the labels in this screen. Table 13 ADVANCED > LAN Configuration > DHCP Setup 6.3 Static DHCP 6.4 IP Static Route Table 15 Advanced> LAN Configuration > IP Static Route Table 16 Advanced> LAN Configuration > IP Static Route 6.4.1 IP Static Route Setup Figure 22 Advanced> LAN Configuration > IP Static Route Setup Table 17 Management > Static Route > IP Static Route > Edit 6.5 Other Settings Figure 23 ADVANCED > LAN Configuration > Advanced Table 17 Management > Static Route > IP Static Route > Edit (continued) Table 18 ADVANCED > LAN Configuration > Other Settings 6.6 Technical Reference 6.6.1 IP Address and Subnet Mask Table 18 ADVANCED > LAN Configuration > Other Settings (continued) 6.6.2 DHCP Setup 6.6.3 LAN TCP/IP 6.6.4 DNS Server Address 6.6.5 RIP Setup 6.6.6 Multicast Page CHAPTER 7 The WAN Configuration Screens 7.1 Overview 7.1.1 What You Can Do in This Chapter 7.1.2 What You Need to Know Figure 24 WiMax: Mobile Station Figure 25 WiMAX: Multiple Mobile Stations Authentication Figure 26 Using an AAA Server 7.2 Internet Connection Table 19 ADVANCED > WAN Configuration > Internet Connection > ISP Parameters for Internet Access Chapter 7 The WAN Configuration Screens Users Guide 81 7.3 WiMAX Configuration Page 7.3.1 Frequency Ranges Figure 29 Frequency Ranges 7.3.2 Configuring Frequency Settings Note: It may take several minutes for the WiMAX Modem to find a connection. 7.3.3 Using the WiMAX Frequency Screen Table 22 DL Frequency Example Settings 7.4 Antenna Selection 7.5 Advanced Chapter 7 The WAN Configuration Screens Table 24 ADVANCED > WAN Configuration > Advanced CHAPTER 8 The NAT Configuration Screens Figure 33 ADVANCED > NAT Configuration > General 8.1 Overview 8.1.1 What You Can Do in This Chapter 8.3 Port Forwarding Table 25 ADVANCED > NAT Configuration > General Figure 34 Multiple Servers Behind NAT Example 8.3.1 Port Forwarding Options Figure 35 ADVANCED > NAT Configuration > Port Forwarding Chapter 8 The NAT Configuration Screens The following table describes the icons in this screen. Table 26 Advanced> VPN Transport > Customer Interface ICON DESCRIPTION Table 27 ADVANCED > NAT Configuration > Port Forwarding 8.3.2 Port Forwarding Rule Setup Figure 36 ADVANCED > NAT Configuration > Port Forwarding > Rule Setup Table 28 ADVANCED > NAT Configuration > Port Forwarding > Rule Setup 8.4 Trigger Port Figure 37 ADVANCED > NAT Configuration > Trigger Port Table 29 ADVANCED > NAT Configuration > Trigger Port Chapter 8 The NAT Configuration Screens Users Guide 95 8.4.1 Trigger Port Forwarding Example Figure 38 Trigger Port Forwarding Example Table 29 ADVANCED > NAT Configuration > Trigger Port (continued) 8.5 ALG Figure 39 ADVANCED > NAT Configuration > ALG Table 30 ADVANCED > NAT Configuration > ALG Page CHAPTER 9 The System Configuration 9.1 Overview 9.1.1 What You Can Do in This Chapter 9.1.2 What You Need to Know Domain Name DNS Server Address Assignment 9.2 General Figure 40 ADVANCED > System Configuration > General Table 31 ADVANCED > System Configuration > General 9.3 Dynamic DNS Note: If you have a private WAN IP address, then you cannot use Dynamic DNS. Table 31 ADVANCED > System Configuration > General (continued) Figure 41 ADVANCED > System Configuration > Dynamic DNS Table 32 ADVANCED > System Configuration > Dynamic DNS 9.4 Firmware Table 32 ADVANCED > System Configuration > Dynamic DNS (continued) 9.4.1 The Firmware Upload Process 9.5 Configuration Figure 43 ADVANCED > System Configuration > Configuration Table 34 ADVANCED > System Configuration > Configuration Note: Do not turn off the device while configuration file upload is in progress. 9.5.1 The Restore Configuration Process 9.6 Restart Page Page Page CHAPTER 10 The Service Configuration 10.1 Overview 10.1.1 What You Can Do in This Chapter 10.1.2 What You Need to Know SIP Identities SIP Number SIP Service Domain SIP Register Server RTP 10.2 SIP Settings Figure 45 VOICE > Service Configuration > SIP Setting Table 36 VOICE > Service Configuration > SIP Setting 10.2.1 Advanced SIP Settings 10.2.1.1 STUN 1 NAT A 10.2.1.4 MWI (Message Waiting Indication) 10.2.1.5 Advanced SIP Settings Options Figure 47 VOICE > Service Configuration > SIP Settings > Advanced Table 37 VOICE > Service Configuration > SIP Settings > Advanced Page Page 10.2.1.6 Custom Tones (IVR) Table 38 Custom Tones Details 10.3 QoS Figure 48 VOICE > Service Configuration > QoS Table 39 VOICE > Service Configuration > QoS 10.4 Technical Reference 10.4.1 SIP Call Progression Table 39 VOICE > Service Configuration > QoS Table 40 SIP Call Progression 10.4.2 SIP Client Server 10.4.3 SIP User Agent AB Figure 49 SIP User Agent 10.4.4 SIP Proxy Server 10.4.5 SIP Redirect Server 10.4.6 NAT and SIP 10.4.7 DiffServ 10.4.8 DSCP and Per-Hop Behavior Figure 52 DiffServ: Differentiated Service Field (2-bit) Page CHAPTER 11 The Phone Screens 11.1 Overview 11.1.1 What You Can Do in This Chapter 11.1.2 What You Need to Know 11.2 Analog Phone 11.2.1 Advanced Analog Phone Setup Figure 54 VOICE > Phone > Analog Phone > Advanced Table 41 VOICE > Phone > Analog Phone Chapter 11 The Phone Screens 11.3 Common Click VOICE > Phone > Common to activate and deactivate immediate dialing. Figure 55 VOICE > Phone > Common Table 42 VOICE > Phone > Analog Phone > Advanced 11.4 Region Figure 56 VOICE > Phone > Region Table 43 VOICE > Phone > Common Table 44 VOICE > Phone > Region 11.5 Technical Reference 11.5.1 The Flash Key 11.5.2 Europe Type Supplementary Phone Services Table 45 European Type Flash Key Commands Page 11.5.3 USA Type Supplementary Services Table 46 USA Type Flash Key Commands Page Page CHAPTER 12 The Phone Book Screens 12.1 Overview 12.1.1 What You Can Do in This Chapter 12.1.2 What You Need to Know 12.2 Incoming Call Policy Figure 57 VOICE > Phone Book > Incoming Call Policy Table 47 VOICE > Phone Book > Incoming Call Policy Chapter 12 The Phone Book Screens Users Guide 141 Table 47 VOICE > Phone Book > Incoming Call Policy 12.3 Speed Dial Figure 58 VOICE > Phone Book > Speed Dial Table 48 Advanced> LAN Configuration > IP Static Route Chapter 12 The Phone Book Screens Users Guide 143 Table 49 VOICE > Phone Book > Speed Dial Page PART V Page CHAPTER 13 The Certificates Screens 13.1 Overview 13.1.1 What You Can Do in This Chapter 13.1.2 What You Need to Know 13.2 My Certificates Figure 59 TOOLS > Certificates > My Certificates Table 50 TOOLS > Certificates > My Certificates Table 51 TOOLS > Certificates > My Certificates Table 51 TOOLS > Certificates > My Certificates (continued) Page Page Page Page 13.2.2 My Certificate Edit Figure 61 TOOLS > Certificates > My Certificates > Edit Page Page 13.2.3 My Certificate Import Figure 62 TOOLS > Certificates > My Certificates > Import Table 54 TOOLS > Certificates > My Certificates > Import 13.3 Trusted CAs Figure 63 TOOLS > Certificates > Trusted CAs Table 55 TOOLS > Certificates > Trusted CAs Table 56 TOOLS > Certificates > Trusted CAs Table 56 TOOLS > Certificates > Trusted CAs (continued) 13.3.1 Trusted CA Edit Figure 64 TOOLS > Certificates > Trusted CAs > Edit Table 57 TOOLS > Certificates > Trusted CAs > Edit Page Table 57 TOOLS > Certificates > Trusted CAs > Edit (continued) 13.3.2 Trusted CA Import 13.4 Technical Reference 13.4.1 Certificate Authorities 13.4.1.1 Advantages of Certificates 13.4.1.2 Self-signed Certificates 13.4.1.3 Factory Default Certificate 13.4.1.4 Certificate File Formats 13.4.2 Verifying a Certificate 13.4.2.1 Checking the Fingerprint of a Certificate on Your Computer Figure 66 Remote Host Certificates Figure 67 Certificate Details Page CHAPTER 14 The Firewall Screens 14.1 Overview 14.1.1 What You Can Do in This Chapter 14.1.2 What You Need to Know 14.2 Firewall Setting 14.2.1 Firewall Rule Directions Figure 68 Firewall Rule Directions 14.2.2 Triangle Route Figure 69 Ideal Firewall Setup Chapter 14 The Firewall Screens 14.2.3 Firewall Setting Options Click TOOLS > Firewall > Firewall Setting to configure the basic settings for your firewall. Figure 70 TOOLS > Firewall > Firewall Setting The following table describes the labels in this screen. Table 59 TOOLS > Firewall > Firewall Setting 14.3 Services Figure 71 TOOLS > Firewall > Service Setting Table 60 TOOLS > Firewall > Service Setting 14.4 Technical Reference 14.4.1 Stateful Inspection Firewall. Table 60 TOOLS > Firewall > Service Setting (continued) 14.4.2 Guidelines For Enhancing Security With Your Firewall 14.4.3 The Triangle Route Problem Figure 72 Triangle Route Problem 14.4.3.1 Solving the Triangle Route Problem Page Page CHAPTER 15 Content Filter 15.1 Overview 15.1.1 What You Can Do in This Chapter Page Chapter 15 Content Filter Users Guide 181 The following table describes the labels in this screen. Table 61 TOOLS > Content Filter > Filter 15.3 Schedule Figure 75 TOOLS > Content Filter > Schedule Table 62 TOOLS > Content Filter > Schedule CHAPTER 16 The Remote Management 16.1 Overview 16.1.1 What You Can Do in This Chapter Table 63 Remote Management 16.1.2 What You Need to Know Remote Management Limitations Remote Management and NAT System Timeout SNMP 16.2 WWW Figure 76 TOOLS > Remote Management > WWW Table 64 TOOLS > Remote Management > WWW 16.3 Telnet Figure 77 TOOLS > Remote Management > Telnet Figure 78 TOOLS > Remote Management > FTP 16.4 FTP Table 65 TOOLS > Remote Management > Telnet 16.5 SNMP Figure 79 SNMP Management Model Table 66 TOOLS > Remote Management > FTP 16.5.1 SNMP Traps Table 67 SNMP Traps 16.5.2 SNMP Options Figure 80 TOOLS > Remote Management > SNMP Table 68 TOOLS > Remote Management > SNMP 16.6 DNS Figure 81 TOOLS > Remote Management > DNS Table 68 TOOLS > Remote Management > SNMP (continued) Table 69 TOOLS > Remote Management > DNS Chapter 16 The Remote Management Screens 16.7 Security Figure 82 TOOLS > Remote Management > Security Table 70 TOOLS > Remote Management > Security 16.8 TR0-69 Figure 83 TR-069 Example Figure 84 TOOLS > Remote Management > TR069 Table 71 TOOLS > Remote Management > TR069 Note: This must be provided by the ACS administrator. Note: If this feature is not enabled then the WiMAX Modem cannot be managed remotely. Note: This must be provided by the ACS administrator. Note: You must separate the day information from the hour information with a T. Table 71 TOOLS > Remote Management > TR069 CHAPTER 17 QoS 17.1 Overview 17.2 General Figure 85 QoS > General 17.3 Class Setup Figure 86 QoS > Class Setup Table 73 QoS Class Setup 17.3.1 Class Configuration Figure 87 QoS > Class Setup > Class Configuration Table 74 QoS Class Setup Chapter 17 QoS Table 74 QoS Class Setup (continued) CHAPTER 18 The Logs Screens 18.1 Overview 18.1.1 What You Can Do in This Chapter 18.1.2 What You Need to Know Table 75 Syslog Logs Table 76 RFC-2408 ISAKMP Payload Types LOG DISPLAY PAYLOAD TYPE 18.2 View Logs Figure 88 TOOLS > Logs > View Logs Table 77 TOOLS > Logs > View Logs Table 77 TOOLS > Logs > View Logs (continued) Page Table 78 TOOLS > Logs > Log Settings Chapter 18 The Logs Screens Users Guide 205 18.4 Log Message Descriptions The following tables provide descriptions of example log messages. Table 78 TOOLS > Logs > Log Settings Table 79 System Error Logs Table 81 Access Control Logs Table 80 System Maintenance Logs (continued) Chapter 18 The Logs Screens Users Guide 207 Table 82 TCP Reset Logs Table 83 Packet Filter Logs F Table 84 ICMP Logs Table 85 PPP Logs Table 86 UPnP Logs Chapter 18 The Logs Screens Table 87 Content Filtering Logs Table 88 Attack Logs Table 89 Remote Management Logs Table 88 Attack Logs (continued) Chapter 18 The Logs Screens Users Guide 211 Table 90 ICMP Notes TYPE CODE DESCRIPTION Table 89 Remote Management Logs Table 91 SIP Logs Table 92 RTP Logs Table 90 ICMP Notes (continued) TYPE CODE DESCRIPTION Table 93 FSM Logs: Caller Side Table 94 FSM Logs: Callee Side Table 95 Lifeline Logs Page CHAPTER 19 The Status Screen Figure 90 Status 19.1 Overview 19.2 Status Screen Table 96 Status Page Page 19.2.1 Packet Statistics Figure 91 Packet Statistics The following table describes the fields in this screen. Table 97 Packet Statistics 19.2.2 WiMAX Site Information Figure 92 WiMAX Site Information Table 98 WiMAX Site Information 19.2.3 DHCP Table Figure 93 DHCP Table Table 99 DHCP Table 19.2.4 VoIP Statistics Figure 94 VoIP Statistics Table 100 VoIP Statistics 19.2.5 WiMAX Profile Note: Not all WiMAX Modem models have all the fields shown here. Figure 95 WiMAX Profile Table 101 The WiMAX Profile Screen Table 101 The WiMAX Profile Screen (continued) Page Page CHAPTER 20 Troubleshooting 20.1 Power, Hardware Connections, and LEDs The WiMAX Modem does not turn on. None of the LEDs turn on. One of the LEDs does not behave as expected. 20.2 WiMAX Modem Access and Login I forgot the IP address for the WiMAX Modem. I forgot the password. I cannot see or access the Login screen in the web configurator. I can see the Login screen, but I cannot log in to the WiMAX Modem. I cannot Telnet to the WiMAX Modem. 20.3 Internet Access I cannot access the Internet. The Internet connection is slow or intermittent. The Internet connection disconnects. The telephone port wont work or the telephone lacks a dial tone. 20.4 Phone Calls and VoIP I can access the Internet, but cannot make VoIP calls. Problems With Multiple SIP Accounts 20.5 Reset the WiMAX Modem to Its Factory Defaults Page Page Users Guide 237 CHAPTER 21 Product Specifications Table 102 Environmental and Hardware Specifications Table 103 Radio Specifications Table 102 Environmental and Hardware Specifications (continued) Table 104 Firmware Specifications Table 104 Firmware Specifications (continued) Table 105 Standards Supported Table 104 Firmware Specifications (continued) Table 105 Standards Supported (continued) Page Table 107 Star (*) and Pound (#) Code Support Table 108 Environmental and Hardware Specifications Table 109 Radio Specifications Table 108 Environmental and Hardware Specifications (continued) Table 110 Firmware Specifications Table 111 Standards Supported Table 110 Firmware Specifications (continued) Table 111 Standards Supported (continued) Table 112 Voice Features Table 113 Star (*) and Pound (#) Code Support Table 112 Voice Features Page 21.1 Wall-Mounting 21.1.1 The Wall-Mounting Kit 12 3 21.1.2 Instructions Page Page Page PART VII Page APPENDIX A WiMAX Security User Authentication and Data Encryption PKMv2 RADIUS Types of RADIUS Messages Diameter Security Association CCMP Page APPENDIX B Setting Up Your Computers IP Address Page Page Figure 100 Windows XP: Internet Protocol (TCP/IP) Properties Click OK to close the Local Area Connection Properties window.Verifying Settings Page Page Page Figure 107 Windows Vista: Internet Protocol Version 4 (TCP/IPv4) Properties Click OK to close the Local Area Connection Properties window.Verifying Settings Page Page Page Page Page Figure 116 Mac OS X 10.5: Network Preferences > Ethernet Page Figure 118 Mac OS X 10.5: Network Utility Linux: Ubuntu 8 (GNOME) Note: Make sure you are logged in as the root administrator. Page Page Figure 123 Ubuntu 8: Network Settings > Properties Figure 124 Ubuntu 8: Network Settings > DNS Page Page Page Page Page Page Page Page APPENDIX C Pop-up Windows, JavaScripts and Java Permissions Internet Explorer Pop-up Blockers Disable Pop-up Blockers Figure 134 Pop-up Blocker Enable Pop-up Blockers with Exceptions Page Page Figure 138 Internet Options: Security Page Page Page Page Page APPENDIX D IP Addresses and Subnetting Introduction to IP Addresses Structure Figure 144 Network Number and Host ID Subnet Masks Table 114 IP Address Network Number and Host ID Example Network Size Table 115 Subnet Masks Table 116 Maximum Host Numbers Notation Subnetting Table 117 Alternative Subnet Mask Notation Figure 145 Subnetting Example: Before Subnetting Figure 146 Subnetting Example: After Subnetting Example: Four Subnets Table 118 Subnet 1 Table 119 Subnet 2 Table 120 Subnet 3 Table 121 Subnet 4 Example: Eight Subnets Subnet Planning Table 121 Subnet 4 (continued) Table 122 Eight Subnets Table 123 24-bit Network Number Subnet Planning Configuring IP Addresses Table 124 16-bit Network Number Subnet Planning Private IP Addresses IP Address Conflicts Conflicting Computer IP Addresses Example Figure 147 Conflicting Computer IP Addresses Example Conflicting Router IP Addresses Example Figure 148 Conflicting Computer IP Addresses Example Conflicting Computer and Router IP Addresses Example Page APPENDIX E Importing Certificates Page Page Page Page Page Page Installing a Stand-Alone Certificate File in Internet Explorer Removing a Certificate in Internet Explorer Page Page Page Page Installing a Stand-Alone Certificate File in Firefox Page Page Page Page Page Page Page Page Page Page Page Page Page Installing a Stand-Alone Certificate File in Konqueror Page Removing a Certificate in Konqueror Page Page APPENDIX F SIP Passthrough Page APPENDIX G Common Services Table 125 Commonly Used Services Appendix G Common Services NAME PROTOCOL PORT(S) DESCRIPTION Appendix G Common Services NAME PROTOCOL PORT(S) DESCRIPTION Users Guide 347 Page APPENDIX H Legal Information Copyright Disclaimers Trademarks ! Notices Viewing Certifications ZyXEL Limited Warranty Note Registration APPENDIX I Customer Support Required Information Corporate Headquarters (Worldwide) China - ZyXEL Communications (Beijing) Corp. China - ZyXEL Communications (Shanghai) Corp. Costa Rica Czech Republic Denmark Finland France Germany Hungary India Japan Kazakhstan Malaysia North America Norway Poland Russia Singapore Spain Sweden Taiw an Thailand Turkey Ukraine United Kingdom Page Index A B C D E F G H I J K O P Q R S T U V W