Home » ZyXEL Manuals » Networking » ZyXEL P-2608HWL-D1 » Manual Viewer

ZyXEL P-2608HWL-D1 User Guide - Page 121

Encryption

Get ZyXEL P-2608HWL-D1 PDF manuals and user guides

Add to My Manuals
Save this manual to your list of manuals

Page 121 highlights

P-2608HWL-Dx Series User's Guide For wireless networks, you can store the user names and passwords for each user in a RADIUS server. This is a server used in businesses more than in homes. If you do not have a RADIUS server, you cannot set up user names and passwords for your users. Unauthorized wireless devices can still see the information that is sent in the wireless network, even if they cannot use the wireless network. Furthermore, there are ways for unauthorized wireless users to get a valid user name and password. Then, they can use that user name and password to use the wireless network. 9.2.4 Encryption Wireless networks can use encryption to protect the information that is sent in the wireless network. Encryption is like a secret code. If you do not know the secret code, you cannot understand the message. The types of encryption you can choose depend on the type of authentication. (See section 9.2.3 on page 120 for information about this.) Table 34 Types of Encryption for Each Type of Authentication Weakest Strongest No Authentication No Security Static WEP WPA-PSK WPA2-PSK RADIUS Server WPA WPA2 For example, if the wireless network has a RADIUS server, you can choose WPA or WPA2. If users do not log in to the wireless network, you can choose no encryption, Static WEP, WPA-PSK, or WPA2-PSK. Usually, you should set up the strongest encryption that every device in the wireless network supports. For example, suppose you have a wireless network with the ZyXEL Device and you do not have a RADIUS server. Therefore, there is no authentication. Suppose the wireless network has two devices. Device A only supports WEP, and device B supports WEP and WPA. Therefore, you should set up Static WEP in the wireless network. Note: It is recommended that wireless networks use WPA-PSK, WPA, or stronger encryption. The other types of encryption are better than none at all, but it is still possible for unauthorized wireless devices to figure out the original information pretty quickly. When you select WPA2 or WPA2-PSK in your ZyXEL Device, you can also select an option (WPA compatible) to support WPA as well. In this case, if some of the devices support WPA and some support WPA2, you should set up WPA2-PSK or WPA2 (depending on the type of wireless network login) and select the WPA compatible option in the ZyXEL Device. Chapter 9 Wireless LAN 121

Section	Page
P-2608HWL-Dx Series	1
Copyright	3
Certifications	4
Safety Warnings	6
ZyXEL Limited Warranty	8
Customer Support	9
Table of Contents	11
List of Figures	25
List of Tables	33
Preface	39
Getting To Know the ZyXEL Device	41
1.1 Overview	41
1.1.1 VoIP Features	41
1.1.2 DSL Router	42
1.2 LEDs (Lights)	42
Introducing the Web Configurator	45
2.1 Web Configurator Overview	45
2.1.1 Accessing the Web Configurator	45
2.1.2 The RESET Button	48
2.1.2.1 Using The Reset Button	48
2.2 Web Configurator Main Screen	48
2.2.1 Title Bar	49
2.2.2 Navigation Panel	49
2.2.3 Status Bar	52
Internet and Wireless Setup Wizard	53
3.1 Introduction	53
3.2 Internet Access Wizard Setup	53
3.2.1 Manual Configuration	55
3.3 Wireless Connection Wizard Setup	60
3.3.1 Automatically assign a WPA key	63
3.3.2 Manually Assign a WPA key	63
3.3.3 Manually Assign a WEP key	63
VoIP Wizard And Example	67
4.1 Introduction	67
4.2 VoIP Wizard Setup	67
Bandwidth Management Wizard	73
5.1 Introduction	73
5.2 Predefined Media Bandwidth Management Services	73
5.3 Bandwidth Management Wizard Setup	74
Status Screens	79
6.1 Status Screen	79
6.2 Any IP Table	82
6.3 WLAN Status	83
6.4 Packet Statistics	83
6.5 VoIP Statistics	85
WAN Setup	89
7.1 WAN Overview	89
7.1.1 Encapsulation	89
7.1.1.1 ENET ENCAP	89
7.1.1.2 PPP over Ethernet	89
7.1.1.3 PPPoA	90
7.1.1.4 RFC 1483	90
7.1.2 Multiplexing	90
7.1.2.1 VC-based Multiplexing	90
7.1.2.2 LLC-based Multiplexing	90
7.1.3 VPI and VCI	90
7.1.4 IP Address Assignment	91
7.1.4.1 IP Assignment with PPPoA or PPPoE Encapsulation	91
7.1.4.2 IP Assignment with RFC 1483 Encapsulation	91
7.1.4.3 IP Assignment with ENET ENCAP Encapsulation	91
7.1.5 Nailed-Up Connection (PPP)	91
7.1.6 NAT	91
7.2 Metric	92
7.3 Traffic Shaping	92
7.3.1 ATM Traffic Classes	93
7.3.1.1 Constant Bit Rate (CBR)	93
7.3.1.2 Variable Bit Rate (VBR)	93
7.3.1.3 Unspecified Bit Rate (UBR)	94
7.4 Zero Configuration Internet Access	94
7.5 Internet Access Setup	94
7.5.1 Advanced Internet Access Setup	97
7.6 WAN More Connections	98
7.6.1 WAN More Connections Modify Screen	99
7.7 Traffic Redirect	102
7.8 WAN Backup Setup	103
LAN Setup	105
8.1 LAN Overview	105
8.1.1 LANs, WANs and the ZyXEL Device	105
8.1.2 DHCP Setup	106
8.1.2.1 IP Pool Setup	106
8.1.3 DNS Server Address	106
8.1.4 DNS Server Address Assignment	107
8.2 LAN TCP/IP	107
8.2.1 IP Address and Subnet Mask	107
8.2.1.1 Private IP Addresses	108
8.2.2 RIP Setup	108
8.2.3 Multicast	109
8.2.4 Any IP	109
8.2.4.1 How Any IP Works	110
8.3 Configuring LAN IP	111
8.3.1 Configuring Advanced LAN Setup	111
8.4 DHCP Setup	113
8.5 LAN Client List	114
8.6 LAN IP Alias	115
Wireless LAN	119
9.1 Wireless Network Overview	119
9.2 Wireless Security Overview	120
9.2.1 SSID	120
9.2.2 MAC Address Filter	120
9.2.3 User Authentication	120
9.2.4 Encryption	121
9.2.5 One-Touch Intelligent Security Technology (OTIST)	122
9.3 Wireless Performance Overview	122
9.3.1 Quality of Service (QoS)	122
9.4 Additional Wireless Terms	122
9.5 General Wireless LAN Screen	123
9.5.1 No Security	124
9.5.2 WEP Encryption Screen	125
9.5.3 WPA(2)-PSK	126
9.5.4 WPA(2) Authentication Screen	128
9.5.5 Wireless LAN Advanced Setup	129
9.6 OTIST Screen	130
9.6.1 Notes on OTIST	133
9.7 MAC Filter	134
9.8 QoS Screen	135
9.8.1 Application Priority Configuration	136
Network Address Translation (NAT) Screens	139
10.1 NAT Overview	139
10.1.1 NAT Definitions	139
10.1.2 What NAT Does	140
10.1.3 How NAT Works	140
10.1.4 NAT Application	141
10.1.5 NAT Mapping Types	141
10.2 SUA (Single User Account) Versus NAT	142
10.3 NAT General Setup	142
10.4 Port Forwarding	143
10.4.1 Default Server IP Address	144
10.4.2 Port Forwarding: Services and Port Numbers	144
10.4.3 Configuring Servers Behind Port Forwarding (Example)	144
10.5 Configuring Port Forwarding	145
10.5.1 Port Forwarding Rule Edit	146
10.6 Address Mapping	147
10.6.1 Address Mapping Rule Edit	148
10.6.2 SIP ALG	149
SIP	151
11.1 SIP Overview	151
11.1.1 Introduction to VoIP	151
11.1.2 Introduction to SIP	151
11.1.3 SIP Identities	151
11.1.3.1 SIP Number	151
11.1.3.2 SIP Service Domain	152
11.1.4 SIP Call Progression	152
11.1.5 SIP Client Server	152
11.1.5.1 SIP User Agent	153
11.1.5.2 SIP Proxy Server	153
11.1.5.3 SIP Redirect Server	154
11.1.5.4 SIP Register Server	154
11.1.6 RTP	154
11.1.7 NAT and SIP	155
11.1.7.1 SIP ALG	155
11.1.7.2 Use NAT	155
11.1.7.3 STUN	155
11.1.7.4 Outbound Proxy	156
11.1.8 Voice Coding	156
11.1.9 PSTN Call Setup Signaling	156
11.1.10 MWI (Message Waiting Indication)	157
11.1.11 Custom Tones (IVR)	157
11.1.11.1 Recording Custom Tones	157
11.1.11.2 Listening to Custom Tones	157
11.1.11.3 Deleting Custom Tones	157
11.1.12 Quality of Service (QoS)	158
11.1.12.1 Type Of Service (ToS)	158
11.1.12.2 DiffServ	158
11.1.12.3 DSCP and Per-Hop Behavior	158
11.1.12.4 VLAN	159
11.2 SIP Screens	159
11.2.1 SIP Settings Screen	159
11.2.2 Advanced SIP Setup Screen	161
11.2.3 SIP QoS Screen	165
Phone	167
12.1 Phone Overview	167
12.1.1 Voice Activity Detection/Silence Suppression/Comfort Noise	167
12.1.2 Echo Cancellation	167
12.1.3 Supplementary Phone Services Overview	167
12.1.3.1 The Flash Key	168
12.1.3.2 Europe Type Supplementary Phone Services	168
12.1.3.3 USA Type Supplementary Services	170
12.2 Phone Screens	171
12.2.1 Analog Phone Screen	171
12.2.2 Advanced Analog Phone Setup Screen	172
12.2.3 Common Phone Settings Screen	174
12.2.4 Phone Region Screen	174
Phone Book	177
13.1 Phone Book Overview	177
13.2 Speed Dial Screen	177
13.3 Incoming Call Policy Screen	179
13.4 Group Ring Screen	181
PSTN Line	185
14.1 PSTN Line Overview	185
14.2 PSTN Line Screen	185
Firewalls	187
15.1 Firewall Overview	187
15.2 Types of Firewalls	187
15.2.1 Packet Filtering Firewalls	187
15.2.2 Application-level Firewalls	188
15.2.3 Stateful Inspection Firewalls	188
15.3 Introduction to ZyXEL’s Firewall	188
15.3.1 Denial of Service Attacks	189
15.4 Denial of Service	189
15.4.1 Basics	189
15.4.2 Types of DoS Attacks	190
15.4.2.1 ICMP Vulnerability	192
15.4.2.2 Illegal Commands (NetBIOS and SMTP)	192
15.4.2.3 Traceroute	193
15.5 Stateful Inspection	193
15.5.1 Stateful Inspection Process	194
15.5.2 Stateful Inspection on Your ZyXEL Device	194
15.5.3 TCP Security	195
15.5.4 UDP/ICMP Security	195
15.5.5 Upper Layer Protocols	196
15.6 Guidelines for Enhancing Security with Your Firewall	196
15.6.1 Security In General	196
15.7 Packet Filtering Vs Firewall	197
15.7.1 Packet Filtering:	197
15.7.1.1 When To Use Filtering	198
15.7.2 Firewall	198
15.7.2.1 When To Use The Firewall	198
Firewall Configuration	199
16.1 Access Methods	199
16.2 Firewall Policies Overview	199
16.3 Rule Logic Overview	200
16.3.1 Rule Checklist	200
16.3.2 Security Ramifications	200
16.3.3 Key Fields For Configuring Rules	201
16.3.3.1 Action	201
16.3.3.2 Service	201
16.3.3.3 Source Address	201
16.3.3.4 Destination Address	201
16.4 Connection Direction	201
16.4.1 LAN to WAN Rules	202
16.4.2 Alerts	202
16.5 General Firewall Policy	202
16.6 Firewall Rules Summary	203
16.6.1 Configuring Firewall Rules	205
16.6.2 Customized Services	208
16.6.3 Configuring A Customized Service	209
16.7 Example Firewall Rule	209
16.8 DoS Thresholds	213
16.8.1 Threshold Values	213
16.8.2 Half-Open Sessions	214
16.8.2.1 TCP Maximum Incomplete and Blocking Time	214
16.8.3 Configuring Firewall Thresholds	215
Content Filtering	217
17.1 Content Filtering Overview	217
17.2 Configuring Keyword Blocking	217
17.3 Configuring the Schedule	218
17.4 Configuring Trusted Computers	219
IPSec VPN	221
18.1 IPSec VPN Overview	221
18.1.1 IKE SA Overview	222
18.1.1.1 IP Addresses of the ZyXEL Device and Remote IPSec Router	222
18.1.1.2 IKE SA Proposal	223
18.1.1.3 Diffie-Hellman (DH) Key Exchange	223
18.1.1.4 Authentication	224
18.1.1.5 Extended Authentication	225
18.1.2 Additional Topics for IKE SA	226
18.1.2.1 Negotiation Mode	226
18.1.2.2 VPN, NAT and NAT Traversal	226
18.1.3 IPSec SA Overview	227
18.1.3.1 Local Network and Remote Network	228
18.1.3.2 Active Protocol	228
18.1.3.3 Encapsulation	228
18.1.3.4 IPSec SA Proposal and Perfect Forward Secrecy	229
18.1.4 Additional Topics for IPSec SA	229
18.1.4.1 IPSec SA using Manual Keys	229
18.2 VPN Setup Screen	230
18.3 Editing VPN Policies	232
18.4 Configuring Advanced IKE Settings	237
18.5 Configuring Manual Key	240
18.6 Viewing SA Monitor	243
18.7 Configuring Global Setting	245
18.8 Telecommuter VPN/IPSec Examples	245
18.8.1 Telecommuters Sharing One VPN Rule Example	245
18.8.2 Telecommuters Using Unique VPN Rules Example	246
18.9 VPN and Remote Management	248
Certificates	249
19.1 Certificates Overview	249
19.1.1 Advantages of Certificates	250
19.2 Self-signed Certificates	250
19.3 Configuration Summary	250
19.4 My Certificates	251
19.5 My Certificate Import	253
19.5.1 Certificate File Formats	253
19.6 My Certificate Create	254
19.7 My Certificate Details	256
19.8 Trusted CAs	259
19.9 Trusted CA Import	261
19.10 Trusted CA Details	262
19.11 Trusted Remote Hosts	264
19.12 Verifying a Trusted Remote Host’s Certificate	266
19.12.1 Trusted Remote Host Certificate Fingerprints	266
19.13 Trusted Remote Hosts Import	267
19.14 Trusted Remote Host Certificate Details	267
19.15 Directory Servers	270
19.16 Directory Server Add or Edit	271
Static Route	273
20.1 Static Route	273
20.2 Configuring Static Route	273
20.2.1 Static Route Edit	274
Bandwidth Management	277
21.1 Bandwidth Management Overview	277
21.2 Application-based Bandwidth Management	277
21.3 Subnet-based Bandwidth Management	277
21.4 Application and Subnet-based Bandwidth Management	278
21.5 Scheduler	278
21.5.1 Priority-based Scheduler	278
21.5.2 Fairness-based Scheduler	279
21.6 Maximize Bandwidth Usage	279
21.6.1 Reserving Bandwidth for Non-Bandwidth Class Traffic	279
21.6.2 Maximize Bandwidth Usage Example	280
21.6.2.1 Priority-based Allotment of Unused & Unbudgeted Bandwidth	280
21.6.2.2 Fairness-based Allotment of Unused & Unbudgeted Bandwidth	281
21.6.3 Bandwidth Management Priorities	281
21.7 Over Allotment of Bandwidth	282
21.8 Configuring Summary	282
21.9 Bandwidth Management Rule Setup	283
21.9.1 Rule Configuration	285
21.10 Bandwidth Monitor	287
Dynamic DNS Setup	289
22.1 Dynamic DNS Overview	289
22.1.1 DYNDNS Wildcard	289
22.2 Configuring Dynamic DNS	289
Remote Management Configuration	293
23.1 Remote Management Overview	293
23.1.1 Remote Management Limitations	293
23.1.2 Remote Management and NAT	294
23.1.3 System Timeout	294
23.2 Introduction to HTTPS	294
23.3 WWW	295
23.4 Telnet	296
23.5 Configuring Telnet	297
23.6 Configuring FTP	298
23.7 SNMP	299
23.7.1 Supported MIBs	300
23.7.2 SNMP Traps	300
23.7.3 Configuring SNMP	300
23.8 Configuring DNS	302
23.9 Configuring ICMP	302
23.10 TR-069	304
Universal Plug-and-Play (UPnP)	307
24.1 Introducing Universal Plug and Play	307
24.1.1 How do I know if I'm using UPnP?	307
24.1.2 NAT Traversal	307
24.1.3 Cautions with UPnP	308
24.2 UPnP and ZyXEL	308
24.2.1 Configuring UPnP	308
24.3 Installing UPnP in Windows Example	309
24.4 Using UPnP in Windows XP Example	312
System	319
25.1 General Setup and System Name	319
25.1.1 General Setup	319
25.2 Time Setting	321
Logs	325
26.1 Logs Overview	325
26.1.1 Alerts and Logs	325
26.2 Viewing the Logs	325
26.3 Configuring Log Settings	326
26.4 SMTP Error Messages	329
26.4.1 Example E-mail Log	329
Tools	331
27.1 Introduction	331
27.2 Filename Conventions	331
27.3 File Maintenance Over WAN	332
27.4 Firmware Upgrade Screen	332
27.5 Backup and Restore	334
27.5.1 Backup Configuration	335
27.5.2 Restore Configuration	335
27.5.3 Reset to Factory Defaults	336
27.6 Restart	337
27.7 Using FTP or TFTP to Back Up Configuration	337
27.7.1 Using the FTP Commands to Back Up Configuration	337
27.7.2 FTP Command Configuration Backup Example	338
27.7.3 Configuration Backup Using GUI-based FTP Clients	338
27.7.4 Backup Configuration Using TFTP	339
27.7.5 TFTP Command Configuration Backup Example	339
27.7.6 Configuration Backup Using GUI-based TFTP Clients	340
27.8 Using FTP or TFTP to Restore Configuration	340
27.8.1 Restore Using FTP Session Example	341
27.9 FTP and TFTP Firmware and Configuration File Uploads	341
27.9.1 FTP File Upload Command from the DOS Prompt Example	341
27.9.2 FTP Session Example of Firmware File Upload	342
27.9.3 TFTP File Upload	342
27.9.4 TFTP Upload Command Example	343
Diagnostic	345
28.1 General Diagnostic	345
28.2 DSL Line Diagnostic	345
Troubleshooting	349
29.1 Problems Starting Up the ZyXEL Device	349
29.2 Problems with the LAN	349
29.3 Problems with the WAN	350
29.4 Problems Accessing the ZyXEL Device	351
29.4.1 Pop-up Windows, JavaScripts and Java Permissions	351
29.4.1.1 Internet Explorer Pop-up Blockers	352
29.4.1.2 JavaScripts	355
29.4.1.3 Java Permissions	357
29.5 Telephone Problems	359
Product Specifications	361
Setting up Your Computer’s IP Address	367
IP Addresses and Subnetting	379
Common Services	387
Importing Certificates	389
Triangle Route	399
Log Descriptions	403
Internal SPTGEN	415
Index	441
A	441
B	441
C	441
D	442
E	443
F	443
G	444
H	444
I	444
J	445
K	445
L	445
M	446
N	446
O	446
P	446
Q	447
R	447
S	448
T	449
U	449
V	449
W	450

Match case Limit results 1 per page

P-2608HWL-Dx Series User’s Guide

Chapter 9 Wireless LAN

121

For wireless networks, you can store the user names and passwords for each user in a RADIUS

server. This is a server used in businesses more than in homes. If you do not have a RADIUS

server, you cannot set up user names and passwords for your users.

Unauthorized wireless devices can still see the information that is sent in the wireless network,

even if they cannot use the wireless network. Furthermore, there are ways for unauthorized

wireless users to get a valid user name and password. Then, they can use that user name and

password to use the wireless network.

9.2.4

Encryption

Wireless networks can use encryption to protect the information that is sent in the wireless

network. Encryption is like a secret code. If you do not know the secret code, you cannot

understand the message.

The types of encryption you can choose depend on the type of authentication. (See

section

9.2.3 on page 120

for information about this.)

For example, if the wireless network has a RADIUS server, you can choose

WPA

WPA2

If users do not log in to the wireless network, you can choose no encryption,

Static WEP

WPA-PSK

, or

WPA2-PSK

Usually, you should set up the strongest encryption that every device in the wireless network

supports. For example, suppose you have a wireless network with the ZyXEL Device and you

do not have a RADIUS server. Therefore, there is no authentication. Suppose the wireless

network has two devices. Device A only supports WEP, and device B supports WEP and

WPA. Therefore, you should set up

Static WEP

in the wireless network.

Note:

It is recommended that wireless networks use

WPA-PSK

WPA

, or stronger

encryption. The other types of encryption are better than none at all, but it is still

possible for unauthorized wireless devices to figure out the original information

pretty quickly.

When you select

WPA2

WPA2-PSK

in your ZyXEL Device, you can also select an option

(

WPA compatible

) to support WPA as well. In this case, if some of the devices support WPA

and some support WPA2, you should set up

WPA2-PSK

WPA2

(depending on the type of

wireless network login) and select the

WPA compatible

option in the ZyXEL Device.

Table 34

Types of Encryption for Each Type of Authentication

No Authentication

RADIUS Server

Weakest

No Security

WPA

Static WEP

WPA-PSK

Strongest

WPA2-PSK

WPA2