Online Help
Overview
System Configuration
System Information
WAN1 Configuration
WAN2 & Failover
LAN Port Roles
Controlled Configuration
Uncontrolled Configuration
User Authentication
Authentication Configuration
Authentication Server Configuration
Local User Setting
POP3 Configuration
RADIUS Configuration
LDAP Configuration
NT Domain Configuration
On-demand User Server Configuration
Black List Configuration
Policy Configuration
Additional Configuration
Upload Login Success Page
Upload Certificate
AP Management
AP List
Manual Configuration
Template Settings
Network Configuration
Network Address Translation
Privilege List
Monitor IP List
Walled Garden List
Proxy Server Properties
Dynamic DNS
IP Mobility
VPN Termination
Utilities
Change Password
Backup/Restore Settings
Firmware Upgrade
Restart
Status
System Status
Interface Status
Current Users
Traffic History
Traffic History
On-demand User Log
Roaming Out Traffic History
Roaming In Traffic History
The administration system allows you to set various networking parameters, enable and customize network services, manage user accounts and monitor user status. Administration functions are separated into 6 categories: System Configuration, User Authentication, AP Management, Network Configuration, Utilities, and Status. They are described briefly below.
System Configuration:
This section relates to system configuration. It includes Configuration Wizard, System Information, WAN Configuration, Port Roles, Controlled Configuration, Uncontrolled Configuration.
User Authentication:
This section relates to user authentication, authorizations and accounting. It includes Authentication Configuration, Black List Configuration, Policy Configuration, and Additional Configuration.
AP Management:
This section is used to manage the APs. Besides showing the various attributes of APs, there are different functions provided for various configurations.
Network Configuration:
This section is used to set all the internet settings.
Utilities:
This section provides functions for modifying user's password, file of Backup/Restore system, Firmware upgrade, and Restart service.
Status:
Provides information for System Status, Interface Status, Current Users, Traffic History and set up Notification Configuration.
System Information
WAN1 Configuration
WAN2 & Failover
LAN Port Roles
Controlled Configuration
Uncontrolled Configuration
System Information
System Name: The name of this system.
Home Page: User will be directed to this webpage after successful login.
Access History IP: The IP address of external billing system. Only device with this IP address may directly access system's billing records (in text format).
Remote Management IP: The IP address or subnet of remote management PC. Only PC within this IP range may access system's web management interface.
SNMP: Configure IP address and Community ID of external SNMP management device. This system supports SNMP v.3.
User Logon SSL: Enable Secured Socket Layer (SSL) Web Login (HTTPS) or disable it (HTTP).
Time: Configure system time manually or use up to 5 external NTP (Network Time Protocol) servers for time synchronization.
System supports four different WAN connection types:
Static IP Address: Configure WAN Port settings manually. If you don't have this information, please contact your network provider.
Dynamic IP Address: Configure WAN Port settings automatically using external DHCP Server.
PPPoE Client: Common ADSL connection type. Enter user name and password of your PPPoE account. When Dial on Demand is enabled, you can set the maximum idle timer before system disconnecting from the Internet.
PPTP: Point to Point Tunneling Protocol is a service that applies to ADSL connections in Europe and Israel only.
If there is a WAN2 route available, WAN2 could be set as WAN1's backup link once the fail of internet connection through WAN1 is detected.
System supports two different WAN connection types:
Static IP Address: Configure WAN Port settings manually. If you don't have this information, please contact your network provider.
Dynamic IP Address: Configure WAN Port settings automatically using external DHCP Server.
Let WAN2 be configured as the redundant link once WAN1 failed condition rises.
Warning of Internet Disconnection: By putting at least one external URL address for system to check the internet connection possible availability continuously.
WAN Failover: To trigger WAN2 port start to serve system's WAN traffic when WAN1 fail was detected. A possible fallback of WAN traffic from WAN2 to WAN1 (if WAN1's internet connection is resumed again) could be selected.
LAN Port Roles
In this page, administrators can choose which LAN(s) to be Controlled port(s) by checking the box.
Operation Mode: The system supports NAT mode and Router Mode.
IP Address: IP Address of Controlled Port(s).
Subnet Mask: Subnet Mask of Controlled Port(s).
DHCP Server Configuration: When enabled, the system acts as DHCP Server issuing network configuration information to clients connecting to Controlled Port. When DHCP Relay is checked, system will relay DHCP information from external DHCP Server to downstream clients.
Reserved IP Address List: Reserves up to 40 IP addresses from predefined DHCP Scope and prevents systems from issuing these IP address to downstream users.
Operation Mode: The system supports NAT mode and Router Mode.
IP Address: IP Address of Uncontrolled Port(s).
Subnet Mask: Subnet Mask of Uncontrolled Port(s).
DHCP Server Configuration: When enabled, the system acts as DHCP Server issuing network configuration information to clients connecting to Uncontrolled Port. When DHCP Relay is checked, system will relay DHCP information from external DHCP Server to downstream clients.
Reserved IP Address List: Reserves up to 40 IP addresses from predefined DHCP Scope and prevents systems from issuing these IP address to downstream users.
Authentication Configuration
Local User Setting
POP3 Configuration
RADIUS Configuration
LDAP Configuration
NT Domain Configuration
On-demand User Server Configuration
Black List Configuration
Policy Configuration
Additional Configuration
Upload Login Success Page
Upload Certificate
The system supports up to three internal or external user database plus On-demand User. User database can be one of the followings: RADIUS, LDAP, POP3, NT Domain Server, or Local database. The system supports 802.1x authentication for downstream clients.
Authentication Server Configuration
The system may authenticate users based on external authentication servers and/or local user database. System will support up to three (3) servers and/or local database simultaneously. Each user group is distinguished by postfix in username.
Server Name: The name of the server. It is used for administrator to identify the server easily. Ex: HQ-RADIUS.
Server Status: Administrators may enable or disable authentication of this server anytime.
Postfix: The postfix to identify all users resided in this authentication server.
Black List:
You may choose one of the five black lists defined in Black List section. User account listed on Black List may not access the network.
Authentication Method: Select types of this authentication server. When either POP3, RADIUS, LDAP or NT Domain is selected, the option to "Enable VPN Termination" check box is brought up. If "Local User" for Authentication Method is selected, you shall go ahead to "Local User Setting" page, then click the "Edit Local User List" button to edit individual user resided in Local User database. From each user's profile, you can select to enable or disable the VPN connection feature for this particular user.
Policy Name: Select one of the eight network access policies defined. Each policy consists of Firewall Profile, Specific Route Profile, Schedule Profile, and Bandwidth. All users from this authentication server will be bound by this policy. When RADIUS as Authentication Method was selected, the Policy Mapping to the RADIUS Class Attribute could be configured as many as 8 policies supported, to match up 8 pre-defined classes set in RADIUS Server.
Enable VPN Termination: Check to enable the VPN tunneling between client's device and the controller automatically to secure the transmissions for user under Windows XP SP1, SP2 and Windows 2000. Once the box is checked, it will be activated and applied to all users been authenticated by the selected authentication server.
Edit Local User List:
To view, add, delete, upload a list of users from a file and backup user accounts from this device. Press Refresh button to refresh the information status of users list. VPN connection for individual local user must be checked to enable for each user account.
RADIUS Roaming Out:
When enabled, local user may login to other connected external RADIUS clients (i.e. Wi-Fi AP or Gateway). This system will act as RADIUS Server for that specific external RADIUS client.
802.1x Authentication: When enabled, please click to edit "RADIUS Client List".
RADIUS Client List: Configure RADIUS clients and secret key. Local user may login to any of the listed RADIUS clients (i.e.Wi-Fi AP or Gateway) as long as the RADIUS clients are configured accordingly.
This system may authenticate users using their POP3 e-mail accounts. You may configure both primary and secondary POP3 server for fault tolerance.
Server IP: POP3 Server IP address.
Port: POP3 Server authentication port.
SSL Setting: Enable or disable Secured Socket Layer connection.
This system may authenticate users using external RADIUS server. You may configure both primary and secondary RADIUS server for fault tolerance.
RADIUS Client List: Configure RADIUS clients and secret key. Local user may login to any of the listed RADIUS clients (i.e.Wi-Fi AP or Gateway) as long as the RADIUS clients are configured accordingly.
Trans Full Name: When this option is checked, both the user name and postfix will be transferred to the RADIUS server for authentication. If the box is unchecked, only the user name will be transferred to RADIUS server for authentication.
NASID: NAS identifier for this system as a RADIUS client.
Server IP: RADIUS server IP address.
Authentication Port: RADIUS server authentication port.
Accounting Port: RADIUS server accounting port.
Secret Key: Secret Key for authentication.
Accounting Service: Enable or disable Accounting Service.
Authentication Protocol: Define authentication transmission protocol. Configurations must match remote RADIUS configurations. PAP (Password Authentication Protocol) transmit password in plain text without encryption. CHAP (Challenge Handshake Authentication Protocol) is a more secured authentication protocol using hash encryption.
This system may authenticate users using external LDAP Server. You may configure both primary and secondary LDAP server for fault tolerance.
Server IP: LDAP Server IP address.
Port: LDAP Server authentication port.
Base DN: The Distinguished Name for the navigation path of LDAP account.
Account Attribute: Attribute of LDAP accounts.
This system may authenticate users using external NT Domain Server.
Server IP:
Domain Server IP address
Transparent Login: Enable this option for transparent user login to NT Domain (login once only)
On-demand User Server Configuration
Server Status: Shows on-demand user service status (enabled or disabled).
Postfix: Postfix used by on-demand user, has maximum length of 40 bytes.
Receipt Header 1 & 2: Header text printed on the receipt.
Receipt Footer: Footer text printed on receipt.
Monetary Unit: Select or define the monetary unit used.
Policy Name: The policy which will be applied to on-demand users.
WLAN ESSID: ESSID printed on receipt for customers who use wireless network service to connect to the Internet.
Wireless Key: Secret key used to connect to the wireless network.
Remark: Remark text.
Billing Notice Interval: Checking interval for running-out volume type for on-demand account.
Users List: Currently available user list.
Billing Configuration: Setup different billing plans.
Create On-demand User: On-demand user creation page.
Billing Report: Summary report for on-demand account usage.
Plan: The ID of a specific billing configuration.
Status: Enabled or not
Type: Quota type (time or data volume).
Expired info: A period of time in which the account must be activated after it is created.
Valid Duration: Account life time after it is activated.
Price: Account price.
System supports up to 5 Black Lists. Each Black List contains up to 40 user accounts. These user accounts may not access network.
System supports up to 8 policies plus 1 "Global" policy. Global policy is the system's universal policy including "Firewall" and "Specific Route" rules constrained all network users unless the network user is already regulated and followed the control rules of the other policies.
These 8 policies, each policy consists of four different network related access profiles:
Firewall Profile: Define up to 10 firewall rules (destination, protocol, MAC etc.).
Specific Route Profile: Define up to 10 static routes.
Schedule Profile: Define allowed access hours.
Total Bandwidth: Define maximum bandwidth allowed of the total bandwidth shared by the users within the same policy.
Individual Maximum Bandwidth: Define maximum bandwidth allowed for individual user; the individual maximum bandwidth can not exceed the value of Total Bandwidth.
Individual Request Bandwidth: Define the guaranteed minimum bandwidth for individual user; the minimum bandwidth can not exceed the setting value of Total Bandwidth and Individual Maximum Bandwidth.
Once a policy is configured (Policy 1, Policy 2, ..., Policy 8), with the combinations of "Firewall", "Specific Route", "Schedule", "Total Bandwidth", "Individual Maximum Bandwidth" and "Individual Request Bandwidth" profiles, administrator may assign one policy to one user group according to selected Authentication method. Different user groups may share the same policy.
User Control:
- Idle Timer: Define user idle time-out value.
- Multiple Login: Enable or disable multiple logins on a single user account. This function is not valid for On-demand Account and RADIUS Account.
- Friendly Logout: Warns users of logout when they close the login success popup webpage. If it is disabled and users close the login success popup webpage, users must enter URL 1.1.1.1 on their browsers or wait for idle timer to expire before account logout.
Roaming Out Timer:
- Session Timeout: Maximum session timeout.
- Idle Timeout: Maximum idle timeout.
- Interim Update: constant records update time interval.
Upload Files: The system allows great customization on end-user interface. Administrators may upload device certificate, customized login, and logout webpages.
Credit Reminder: To remind customers that their accounts are about to expire. Administrators may set different threshold of accounts based on volume (up to 30min) or time (up to 10MB).
POP3 Message: The system will send automatic POP3 e-mail message if users have not login but have active e-mail system on. Administrators can customize this e-mail notification message.
Enhanced User Authentication: Enter the MAC address of the network devices. When enabled, only those devices within the MAC addresses list may access the network.
The system supports login success page customization. Administrator may use the default page, the template page, an external page, or upload an html-coded file with an image file. The image files may not exceed 512K.
The system supports external certificate issued by public or private authority. Simply point the browser to the location of certificate file and upload.
AP List
Manual Configuration
Template Settings
AP Type:
Type of the AP.
AP Name: Mnemonic name of the specific AP.
Status: This section shows the status of the corresponding Mnemonic. It can be shown as "Unknown," "Upgrading," "Online," "Offline," and "Lost."
LAN MAC: The LAN's Media Access Control address.
WLAN MAC: The wireless LAN's Media Access Control address.
Report Time: The time when this summary was last updated.
SSID: Service Set Identifier.
System Status: Shows AP Name, AP Type, LAN MAC, Wireless LAN MAC, Report Time, SSID, Number of Associated Clients, and Remark.
LAN Status: Shows LAN Interface including IP Address, Subnet Mask, and Gateway.
Wireless Status: Shows SSID, Beacon Interval, RTS Threshold, DTIM Interval, Transmission Mode, Transmission Rate, Preamble Type, Security, WEP Keys, and Wireless Distribution System
Access Control Status: Shows Status and Mode.
Associated Client Status: Shows Client List, Number, MAC, Mode, Rate, Quality, RSSI, and Power Saving.
Interface: Specify the interface in which APs were connected and IP address pool to be assigned to the discovered the access points.
IP Address Range: The IP address range to be explored by the system for auto discovery.
ID: The required login ID for this AP.
Password: The required password for this AP.
The "Discovered AP List" shows any identifiable AP found during network exploring. By clicking "Add" button to register this particular AP to "AP List" for future management. When "Auto-Discovery" is enabled, this system will periodically discover the connected AP. If "Auto-Add AP" is enabled, this system will automatically add the discovered AP into "AP List".
AP Type: Type of the AP.
AP Name: Mnemonic name of the specific AP.
Admin Password: Password required for this AP.
AP IP: IP address for this AP.
AP MAC: This AP's Media Access Control address.
Remark: Some extra information to be filled in for this AP if desired.
Template: The template which will be applied to the added AP.
Template Edit
Here is the section that administrators can configure template name, template source, and template remark.
Template Name: The name shown for this particular template will change according to what is given by administrators.
Template Source: Select an existing AP and click Apply to save its settings as the template settings.
Template ID: Click the ID link for the detailed settings configuration.
This system supports the following types of AP: WAP-4033 WAP-4060
Each AP has different template settings.
Properties: To set on SSID, SSID Broadcast, channel, transmission mode, transmission rate, CTS protection, fragment threshold, RTS threshold, Beacon Interval, Preamble Type, IAPP, Block Relay, TX Power Level.
Properties: To set on SSID Broadcast, SSID Isolation, channel, Wireless mode, transmission rate.
WAP-4033
The template provides the configuration areas including:
General: To set subnet mask and default gateway.
Wireless: Here provides two major areas:
Security: There are 5 types of "Disable", "WEP", "WPA", "WPA2", and "WPA2 Mixed". As the type selected, the integration with "802.1x Authentication" is also available.
MAC Address List: If the "Status" set as "Enabled, " only those clients whose MAC addresses are listed in "MAC Address List" can access this AP.
WAP-4060
The template provides the configuration areas including:
General: To set subnet mask and default gateway, DNS, Country or Domain, description, SYSLOG, Rouge AP Detection.
Wireless: Here provides four major areas:
Parameters: Disassociated Timeout, fragment threshold, CTS/RTS threshold, Beacon Interval, Preamble Type, TX Power Level.
802.11b: Protection Type, Short Slot Time, Protection Mode, Protection Rate.
Options: Wireless Separation, Worldwide Mode (802.11d), XR (eXtended Range), WMM Support (Wi-Fi Multimedia).
Access Control: To set Status of access controlling with "MAC Address List".
MAC Address List: If the "Status" set as "Enabled, " only those clients whose MAC addresses are listed in "MAC Address List" can access this AP.
This page includes a function to upload desired firmware and shows the already uploaded firmware's name, checksum, AP type, version, and size. Administrators are also given the option to download or delete the firmware.
File Name: Name of the file to be uploaded.
Upload: Can be clicked to upload the file.
Firmware List: Shows the already uploaded firmware.
Checksum: The automatically detected security identification of the firmware.
AP Type: The AP type of the firmware.
Version: The version of the AP firmware.
Size: File size of the firmware.
Download: Can be clicked to save the current firmware.
Delete: Can be clicked to delete the current firmware.
Administrators can upgrade APs in this page.
Upgraded Time: Shows when the AP was last upgraded. DMZ (Demilitarized Zone):
Map up to 40 IP addresses (LAN) to external IP addresses (WAN).
New Version: Version of the firmware to upgrade the AP.
Privilege List
Monitor IP List
Walled Garden List
Proxy Server Properties
Dynamic DNS
IP Mobility
VPN Termination
Public Accessible Server: Define up to 40 Virtual Servers on LAN to be accessed by devices on external networks (WAN).
Port and IP Redirect: Provide up to 40 sets of direct IP address and Port mapping.
Privilege IP Address List: The IP addresses listed here can access internet directly without going through the login page.
Privilege MAC Address List: The MAC addresses listed here can access internet directly without going through the login page.
Change Password
Backup/Restore Settings
Firmware Upgrade
Restart
The system provides three different types of management accounts, each assigned with different access privileges.
Admin: Admin account may access all web management interfaces.
Manager: Manager account may modify all user authentication options, including user group management.
Operator: Operator account may only create On-demand User Account from the administrative webpage. When login with Operator account, user will be direct to On-demand User Account page immediately with no access to other management webpage. This account is intended for store clerk when the system is deployed at Hotspot or corporate meeting rooms.
**All accounts and passwords have default value. Please consult your user guide for default password.**
Backup: Press Backup button to backup current system settings.
Restore: To restore system settings using previous backup file, press Browse button to locate the backup file and press Restore button.
Reset: Press Reset button to restore system to factory default configurations.
To upgrade system firmware, press Browse button to locate the new firmware. Press Apply button to start upload and apply new firmware. System will restart after successful firmware upgrade.
** Firmware upgrade may take up to 5 minutes, please wait for confirmation page**
Press Restart button to restart the system. Please wait for countdown timer to finish before accessing the system management webpage again.
System Status
Interface Status
Current Users
Traffic History
Traffic History
On-demand User Log
Roaming Out Traffic History
Roaming In Traffic History
This page displays all important system, network, and user account configurations. It also shows the WAN connection status and system time.
This page displays the following information about WAN, Controlled, and Uncontrolled.
Current network interface status:
Enabled or disabled.
MAC address: MAC address of each network interface.
IP Address: IP address of each network interface.
Subnet Mask: Subnet Mask of each network interface.
WIN Server: WIN Server of each network interface.
DHCP Server Information: DHCP Server information of each network interface includes status, IP scope and lease time.
Operating Mode: NAT or Router Mode.
DHCP Server IP: DHCP Server IP is the same as its Network Interface IP address
Controlled Configuration: Configuration for ports that need to be authenticated and need to be included in remote management IP range in order to access the management.
Uncontrolled Configuration: Configuration for ports that need not to be authenticated and need not to be included in remote management IP range to access the management.
A list of all online users currently login on the system, including their user names, IP address, device MAC address, packet count, byte count, and idle time.
Administrator may terminate any user session by pressing Logout button next to individual user account.
Administrator may view traffic history and On-demand User Log of up to 3 days. All records are sorted by date and listed accordingly.
** These records are stored on volatile memory and will be lost if the system is turnoff **
Sorted by time, the traffic history provides all login and logout activity of specific date. Other information includes User Name, IP address, MAC address, In-bound Packet Count, Out-bound Packet Count, In-bound Byte Count, and Out-bound Byte Count.
On-demand User Log includes all On-demand user history.
Date: The date and time of record.
System Name: The system name defined at "System Information" page.
Type: Record type: Authentication Accept / Reject, Account Expire / Redeem etc.
Name: On-demand Account Name.
IP/MAC: IP and MAC address of login device.
Pkts In / Bytes In / Pkts Out / Bytes Out: In-bound and outbound Packet/Byte count.
Expiretime: Time of account expiration (for accounts based on time limit, not data rate).
Validtime: Time when account is valid. When valid time is reached, account is disabled regardless of actual account usage.
Remark: Any remark added by administrator at On-Demand User Group configuration.
This log shows the Roaming-Out Traffic User History when system is used with III Roaming in Taiwan.
Date: Record time/date.
Type: Record type: Authentication Accept / Reject, Account Expire / Redeem etc.
Name: Roaming-Out user name.
NASID: System ID of remote RADIUS.
NASIP: Remote RADIUS IP Address.
NASPort: Remote RADIUS Port.
UserMAC: User MAC address.
SessionID: Session ID, usually the time stamp.
SessionTime: Session length in seconds.
Bytes In/Out: Byte count for inbound and outbound traffic.
Pkts In/Out: Packet count for inbound and outbound traffic.
Message: System response. Common messages are reject, accept, idle time out, session time out, etc.
This log shows the Roaming-In Traffic User History when system is used with III Roaming in Taiwan.
Date: Record time/date.
Type: Record type: Authentication Accept / Reject, Account Expire / Redeem etc.
Name: Roaming-Out user name.
NASID: System ID, usually MAC address of WAN port on this system.
NASIP: RADIUS IP Address of this system.
NASPort: RADIUS Port of this system.
UserMAC: User MAC address.
UserIP: User IP address.
SessionID: Session ID, usually the time stamp.
SessionTime: Session length in seconds.
Bytes In/Out: Byte count for inbound and outbound traffic.
Pkts In/Out: Packet count for inbound and outbound traffic.
Message: System response. Common messages are reject, accept, idle time out, session time out, etc.
The system will send Monitor IP Report, Traffic History, On-demand User Log, and AP Status Reports automatically to at most 3 valid email accounts and external Syslog Server separately. Administrator can configure the sending interval of each notification email followed by sending a testing mail once set. SMTP Server and a valid email account may be required to send notification email. An external Syslog Server's configuration is required for receiving Traffic History and On-Demand User Logs.