Compex Systems WPE72NX Users Manual

© Copyright 2009 Compex Systems Pte Ltd

All Rights Reserved
This document contains information, which is protected by copyright. Reproduction,
adaptation or translation without prior permission is prohibited, except as allowed under the
copyright laws.

Trademark Information

Compex® is a registered trademark of Compex, Inc. Microsoft Windows and the Windows logo
are the trademarks of Microsoft Corp. NetWare is the registered tra demark of Novell Inc. WMM
and WPA are the registered trademarks of Wi-Fi Alliance. All other brand and product names
are trademarks or registered trademarks of their respective owners.
Notice: Copyrights © 2009 by Compex, Inc. All rights reserved. Reproduction, adaptation, or
translation without prior permission of Compex, Inc. is prohibited, except as allowed under the
copyright laws.

Disclaimer

Compex, Inc. provides this manual without warranty of any kind, expressed or implied, including
but not limited to the implied warranties of m erchantabili ty and fitness for a parti cular purpose .
Compex, Inc. may make improvements and/or cha nges to the product and/or specifications
of the product described in this manual, without pri or noti ce. Compex, I nc will not be li able for
any technical inaccuracies or typographical errors found in this guide. Changes are periodically
made to the information contained herein and will be incorporate d into later versions of the
manual. The information contained is subject to change without prior notice.

FCC NOTICE

This device has been tested and found to c omply with the limits for a Class B digital device ,
pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable protection
against harmful interference in a residential installation. This device generates uses and can
radiate radio frequency energy and, if not installed and used in accordance with the
instructions, may cause harmful interference to radio communications. However, there is no
guarantee that interference will not occur in a particular installation. If this device does cause
harmful interference to radio or television reception, the user is encouraged to try to correct the
interference by one or more of the following measures:

• Reorient or relocate the receiving antenna.

• Connect the computer to an outlet on a ci rcuit different from that to which the receiver is

connected.

• Increase the separation between the computer and receiver.

• Consult the dealer or an experienced radio/TV technician for help.

Caution: Any changes or modifications not expressly approved by the grantee of this device
could void the user's authority to operate th e equipment.

FCC Compliance Statement: This device complies with Part 15 of the FCC Rules. Operation is
subject to the following two conditions:
This device may not cause harmful interference, and
This device must accept any interference received, including interference that may cause
undesired operation.

RF Exposure warning
The equipment complies with FCC/IC RF exposure limits set forth for an uncontrolled
environment. The equipment must be instal led to provided a separation distance of at least
20cm from all persons and must not be co-located or oper ating in conjuncti on with any other
antenna or transmitter.

ICES 003 Statement
This Class B digital apparatus complies with Canadian I CES-003.

This device complies with RSS-Gen of the IC Rules. Opera tion is subject to the following two
conditions: (1) this device may not cause harmful interference , and (2) this device must accept
any interference received, including interference that may cause undesired operation.

Under Industry Canada regulations, this radio transmitter may only operate using an Integral
Antenna and maximum 2 dBi gain approved for the transmitter by Industry Canada. To reduce
potential radio interference to other users, the antenna type and its gain should be so chosen
that the equivalent isotropically radiated power (e.i.r.p.) is not more than that necessary for
successful communication.

Declaration of Conformity

Compex, Inc. declares the following:
Product Name: Wireless Access Point with PoE
Model No.: WPE72NX conforms to the following Product Standards:
This device complies with the Electromagnetic Compati bility Directive (89/336/EEC) issued by
the Commission of the European Communi ty. Compli ance with thi s directiv e implies conformi ty
to the following European Norms (in brackets are th e equivalent international standards .)

Electromagnetic Interference (Conduction and Radiation)
Electromagnetic Immunity
Low Voltage Directive:

Therefore, this product is in conformity with the following regional standards: FCC Class B:
following the provisions of FCC Part 15B, FCC Part 15.247, FCC Part 15.407 and KDB848637.
CE Mark: following the provisions of the EC directiv e.

Compex, Inc. also declares that:
The wireless card in this product complies with the R&TTE Directive (1999/5/EC) issued by the
Commission of the European C ommunity. Compliance with this directive impl ies conformity to
the following:

: EN 55024 (IEC61000-4-2, 3, 4, 5, 6, 8, 11)

EN 60 950: 1992+A1: 1993+A2: 1993+A3: 1995+A4: 1996+A11: 1997.

: EN 55022 (CISPR 22)

EMC Standards: FCC: 47 CFR Part 15, Subpart B, 47 CFR Part 15, Subpart C (Section 15.247),

47 CFR Part E (Section 15.407) and KDB848637; CE: EN 300 328, EN 301 893, EN 301 489-17.
Therefore, this product is in conformity with the following regional standards: FCC Class B:
following the provisions of FCC Part 15 directive, CE Mark: following the provisions of the EC
directive.

Manual Version:1.0.1c (May 2011)
This manual is written based on Firmware version 2.26

Table of Contents

Overview the Product..................................................................................................7

Introduction..................................................................................................................7

Features and Benefits................................................................................................................8

Operation Modes and Connection Examples............................................................................9

Panel Views and Description.....................................................................................13

Install the Hardware..................................................................................................14

Hardware Setup.......................................................................................................................14

Using power adapter to power up the device..........................................................................14

Using PoE+ to power up the device........................................................................................16

Access the Web Interface...........................................................................................22

Access with uConfig...............................................................................................................22

Access with Web Browser.......................................................................................................25

Navigation...................................................................................................................27

Main Menu Bar.......................................................................................................................27

How to save changes...............................................................................................................27

Basic Network Tab.....................................................................................................28

Network Mode: Bridging and Routing ...................................................................................28

LAN Setup..............................................................................................................................28

Basic Wireless Tab......................................................................................................31

Basic Wireless Settings...........................................................................................................31

Station Parameters Settings.....................................................................................................35

Wireless Security ....................................................................................................................37

V irtual Access Point (VAP).....................................................................................................42

Advance Wireless Tab................................................................................................43

Advanced Network Tab.............................................................................................43

Spanning Tree Setup...............................................................................................................44

NAT Setup...............................................................................................................................45

Firewall Setup.........................................................................................................................47

Services Tab................................................................................................................49

Ping Watchdog........................................................................................................................50

Auto-Reboot............................................................................................................................50

SNMP Setup............................................................................................................................51

NTP Setup...............................................................................................................................51

Web HTTP Security................................................................................................................51

T elnet Access Setup ................................................................................................................52

SSH Access Setup ...................................................................................................................52

System Log Setup ...................................................................................................................52

System Tab..................................................................................................................53

Firmware Upgrade ..................................................................................................................53

Host Name ..............................................................................................................................54

Administrative and Read-only Account..................................................................................54

Configuration Management ....................................................................................................55

Device Maintenance................................................................................................................55

Status Page..................................................................................................................56

Clients Connection Status in AP Status Info...........................................................................58

Station Connection Info..........................................................................................................59

More Status.............................................................................................................................61

VLAN Tab...................................................................................................................62

VLAN Switch .........................................................................................................................62

VLAN Management................................................................................................................63

Appendix I - Network................................................................................................64

Appendix II – Wireless with Router Mode..............................................................67

Appendix III- Services...............................................................................................72

Appendix IV- VLAN Setup examples.......................................................................74

A) T agged Wireless VLAN to Tagged Ethernet VLAN Setup................................................74

B) Untagged Wireless VLAN to Tagged Ethernet VLAN setup.............................................75

C) T agge d VLAN Pass-Through.............................................................................................75

Overview the Product

Introduction

The high-performance Wireless Network Access Point (AP) is designed for
enterprise and public access applications. Embedded with the Atheros chipset, it
boasts network robustness, stability and wider network coverage. Based on

802.11n (Draft 2.0), the access point supports high-speed data transmission of up
to 300Mbps.

The access point is capable of operating in different modes, which makes it
suitable for a wide variety of wireless applications, including long-distance
deployments.

Designed with two externals reverse SMA connectors offering excellent electrical
performance and compatible with reverse SMA antennas, the access point can
be used for a wide variety of wireless applications and allows you to position the
wireless antenna in a better signal-broadcasting location for improved wireless
coverage and signal strength or simply in a more convenient location. FCC
REQUIREMENTS: THIS DEVICE IS RESTRICTED TO INDO OR USE ONLY

To protect your security and privacy, the access point is armed with many
enhanced and latest wireless security features such as IEEE 802.11i standards,
MAC Address Filtering, IEEE 802.1x Authentication and 64/128-bit WEP (Wired
Equivalent Privacy) to ensure privacy for the heterogeneous mix of users within the
same wireless network.

Features and Benefits

Virtual AP (Multiple SSID)

Virtual AP implements mSSID (Multi-SSID) This allows a single wireless card to be set up with
multiple virtual AP connections with different SSIDs or BSSID (Basic Service Set Identifier) and
security modes.

Highly Secured Wireless Network

The access point supports the highest available wireless security standard: IEEE802.11i compliant.
The access point also supports IEEE 802.1x for secure and centralized user-based authentication.
Wireless clients are thus required to authenticate through highly secure methods like EAP-TTLS
and EAP-PEAP, in order to obtain access to the network.

uConfig Utility

The exclusive uConfig utility allows users to access the user-friendly Web configuration interface
of the access point without having to change the TCP/IP setup of the workstation.

HTTPS

The access point supports HTTPS (SSL) in addition to the standard HTTP.
HTTPS (SSL) features additional authentication and encryption for secure
communication.

Telnet

Telnet allows a computer to remotely connect to the access point CLI
(Command Line Interface) for control and monitoring.

SSH

SSH (Secure Shell Host) establishes a secure host connection to the access
point CLI for control and monitoring.

Operation Modes and Connection Examples

Access Point Mode

The Access Point Mode is the default mode of the device. It enables the
bridging of wireless clients to wired network infrastructure.

The illustration below shows a typical resources sharing application example
using this device. The wireless users are able to access the file server
connected to the switch, through the access point in Access Point Mode.

Station Mode

In Station mode the device acts as a wireless client.
When connected to an access point, it creates a network link between the
Ethernet network connected at this client device, and the wireless Ethernet
network connected at the access point.

In this example the workgroup PCs on the ethernet network connected to the
Station device can access the printer across the wireless connection to the
access point where the printer is connected.

Router Mode

In Router Mode, the device also operates as a router.
Either the wireless or Ethernet can be setup as WAN connection to a broadband
modem. Wireless as WAN is known as Station + Router mode (or Wireless Routing Client
mode) and Ethernet as WAN is known as AP + Router mode (or Gateway mode).
Device supports several types of broadband connections Static IP, Dynamic IP and
PPPoE. For setup details refer to the respective section.
The illustration below shows the Ethernet port is setu p as the WAN port and the wireless
connection as the LAN.

Station + Router connection example
Wireless is use to connect to the broadband.
Ethernet is the local network (LAN)
sharing the broadband connection.

AP + Router connection example
Ethernet is use to connect to the broadband.
Wireless is the local network (LAN)
sharing the broadband connection.

Broadband Internet Access Type:

Static IP Address

Use Static IP Address you have subscribed a fixed IP or range IP addresses from
your ISP.

Dynamic IP Address

With Dynamic IP Address the device automatically request IP address from
modem or ISP.

PPP over Ethernet (PPPoE)

When using ADSL services provided by your ISP support PPPoE connection.

Panel V iews and Description

Features Status and Indications

1 Diagnostic LED

2 Signal Strength

level Indicator

3 Ethernet Port LED

4 Power LED

5 Reset Button

Flashing duing power-up. Off device is ready..

(low) (higher low) (lower high) (high)

LED10 LED20 LED30 LED40

Steady ON: Connection is established.

OFF: No network connection

Static Light: Power is being supplied to the device.
Off: Power is not being supplied to the device.

• To reboot, press once.

• To reset password,

seconds before releasing it.

• To restore the factory default settings, press and hold

the button for 8 seconds before releasing it

press and hold the button for 5

6 Ethernet Port

10/100Mbps Ethernet port
PoE input : 5V – 24V DC

7

DC Jack

Range : 5V- 24V DC

8

Antenna

External SMA Anten na

Install the Hardware

Hardware Setup

• CAT5/5e Networking Cable.

• At least 1 computer installed with a web browser and a wired or wireless

network interface adapter.

• All network nodes installed with TC P/IP and proper ly configured IP address
parameters.

Using power adapter to power up the device

SStteepp 11::

Insert one end of the Ethernet cable to the Ethernet port on your access
point, and the other end of the cable to your PC’s Ethernet network
adapter.

SStteepp 22::

Attach the power adapter to the main electrical supply, and
connect the power plug into the socket of the access point.

SStteepp 33::

Turn ON the power supply and power ON your PC. Notice
that the LEDs: Power and Port have lighted up. This
indicates that connection has been established
successfully between your access point and your PC.

Using PoE+ to power up the device

The access point is fully compatible with PoE+. This accessory supplies operational
power to the wireless AP via the Ethernet cable connection.

Users who have already purchased PoE+ and who wish to use it to supply power
to the access point may follow the installation procedures show n below:

SStteepp 11::

Use an RJ45 Ethernet cable to connect one end of the cable to the
LAN OUT port of PoE+ and the other end to Ethernet port of the
access point.

SStteepp 22::

Next, connect the RJ45 Ethernet cable attached to PoE+ to your
PC’s Ethernet network adapter.

Once you have finished configuring your access point, you can
connect the PoE+’s RJ45 Ethernet cable to your network device,
such as to a switch or hub.

SStteepp 33::

Connect the power adapter supplied with PoE+ to the main
electrical supply and the power plug into the socket of the injector.

Note:

The voltage and current supplied to the power adapter and the
PoE+ power adapter are different. Do not interchange the power
adapters.

SStteepp 44::

Turn on your power supply. Notice that the Power LED has lighted
up. This indicates that the access point is receiving power through
PoE+. Notice also that the corresponding port LEDs have lighted up.
This indicates that connection between your access point and your
PC has been established.

Configure the IP Address

After setting up the hardware you need to assign an IP address to your PC so that
it is in the same subnet as the access point.

For Window s 95/98/98SE/ME/NT

SStteepp 11::

From your desktop, right-click the Network Neighborhood icon and select Properties.

SStteepp 22::

Select the network adapter that you are using, then righ t-click and select Properties.

SStteepp 33::

Highlight TCP/IP and click on
the Properties button.

SStteepp 44::

Select the Specify an IP
address radio button.

Set the IP address to

192.168.168.X and subnet
mask to 255.255.255.0, where
X can be any number from 2
to 254.

SStteepp 55::

To verify that the IP address
has been correctly assigned
to your PC, go to the Start
menu, select Run, and enter
the command: winipcfg.

Select the Ethernet adapter
from the drop-down list and
click OK.

PC is now setup with a proper IP address to communicate wi th the access point.

For Window s XP/2000

SStteepp 11::

Go to your desktop, right-click on the My Network Places icon and select Properties.

SStteepp 22::

Right-click the network adapter
icon and select Properties.

SStteepp 33::

Highlight Internet Protocol

(TCP/IP) and click on the
Properties button.

SStteepp 44::

Select the Use the following IP
address radio button.

Set the IP address to

192.168.168.X and subnet mask
to 255.255.255.0, where X can
be any number from 2 to 254.

SStteepp 55::

Click on the OK button to close all windows.

SStteepp 66::

To verify that the IP address has been correctly assigned to your PC, go to the Start menu,
Accessories, select Command Prompt, and type the command: ipconfig/all

PC is now setup with a proper IP address to communicate wi th the access point.

Access the Web Interface

Access with uConfig

The UConfig utility provides direct access to the web interface.

SStteepp 11::

Click uuCCoonnffiigg icon to launch the utility then click YYeess button.

SStteepp 22::

Select the access point from the products list and click on the OOppeenn WWeebb button. To
retrieve and display the latest device(s ) in the list, click on the RR

h button.

eeffrreessh

SStteepp 33::

Do not exit the uConfig program while accessing the web-based interface as this will
disconnect you from the device. Click on the OOKK button.

SStteepp 44::

At the login prompt, enter the User Name and Password.
The default are :
User Name : admin
Password : password

SStteepp 55::

It then opens the device home page. The Status page.

Access with Web Browser

SStteepp 11::

Launch your Web browser, e.g. Internet Explorer, FireFox, Netscape, etc.
If using MS IE, under the TToooollss tab, select IInntteerrnneett OOppttiioonnss.

SStteepp 22::

Open the CCoonnnneeccttiioonnss tab and in the LLAANN SSeettttiinnggss section disable all the option boxes. Click
on the OOKK button to update the changes.

SStteepp 33::

At the AAddddrreessss bar type in http://192.168.168.1 and press EEnntteerr on your keyboard.

SStteepp 44::

At the login prompt, enter the User Name and Password.
The default are :
User Name : admin
Password : password

It then opens the device home page. The Status page.

Navigation

Main Menu Bar

Status : Page displays current status of the device and the statistical

information.

Basic Wireless :

covering basic wireless settings which define operating mode, associating
details and data security options.

Basic Network :

network services (i.e. DHCP Server).

Advanced Wireless : Page settings for advanced wireless features.

Advanced Network page settings for more details of these features.

Services :

Ping Watchdog, Auto-Reboot, SNMP, NTP, Telnet, SSH, System Log).

System :

account management, device customization and configuration backup.

Activation Keys : Optional special add-on functions you can purchased separately to activate

in device.

Page contains controls for system maintenance routines, administrator

Page contains the controls for a wireless network configuration, while

Page covers the configuration of network operating mode, IP settings and

Page covers the configuration of system management services (i.e.

How to save changes.

After made changes from each respective setup page, click this button,
Next the prompt below appear. You are asked to confirm if you want to save the change
permanently to device flash.

Click Save will write all configuration changes to flash.
Click Discard will discard all changes made.
If not sure what changes were made earlier, recommend to discard and reconfigure again.

Basic Network Tab

Click BASIC NETWORK from the menu bar to open the page as show below.

Network Mode: Bridging and Routing

Network Mode:

Select between Bridge (default) and Router mode.

LAN Setup

LAN Mode:

Static: (default) lets you enter a specific IP address for the device.
Default IP address is 192.168.168.1
DHCP Client: when set let device learn the IP address automatically from the network.

Netmask:

Let you set the class for the IP address set.

Default class C and value is 255.255.255.0

Gateway: (optional)

Enter the gateway IP address of the network the device is connected.

Primary DNS IP: (optional)

Enter the primary DNS IP address nearest to the gateway router.

Secondary DNS IP: (optional)

Enter the secondary DNS IP address nearest to the gateway router.

DHCP Mode:

None: function disabled
DHCP Server: Check to enable. Device act IP address distribution server automatically issue
IP address and other network information to the DHCP Client request them.
DHCP Relay: check to enable. Enter the IP address of the remote DHCP server where the
DHCP Client request will be relayed to.

DHCP Start IP Address:

Enter the starting IP address to be issue.

DHCP End IP Address:

Enter the last IP address the server will issue.

Netmask:

Let you set the IP class for the IP address range set for the start and end address.
* Note:- if device is also the router then IP class must be same as device IP class.

DHCP Lease Time: (default is 3600 seconds or 1hour)

Enter the new lease time in seconds.

DHCP Server Relay IP:

Enter the IP address of the remote DHCP server where the DHCP Client request will be
relay to get the IP address.

DHCP Gateway Relay IP:

Enter the IP address of the remote gateway where the DHCP Client request will be relay to
get the gateway IP address.

Enable DNS Proxy:

Check to enable function. Device router operation will act as proxy to resolve all DNS
requests.

DHCP Reservations

Click Add to enter for each device the IP address and MAC address.
All DHCP active lease devices are displayed in the Status tab page from the More Status
selection.

Domain Name Server Entry

The Primary and Secondary DNS IP addresses entry is for device operation to resolve domain
name to reach certain servers like internet time server and other services that use domain name.
* Note:- Ensure device gateway IP is also set that to allow device to access to internet.

Primary DNS IP: (optional)

Enter the primary DNS IP address nearest to the gateway router.

Secondary DNS IP: (optional)

Enter the secondary DNS IP address nearest to the gateway router.

Bandwidth Control between Ethernet and Wireless

An entry of value “0” means no bandwidth flow limit between the 2 interfaces.
An entry of “2000” means 2000Kbit or 2Mbit limit traffic flow between the 2 interfaces.
Default is “0”

Basic Wir eless Tab

Under the tab, there is the selection of 4 radios.

Fig 2.1 Basic Wireless Tab

Currently device support only one 802..11n radio card. Select RADIO 1 to configure.
Basic Wireless Tab contains all the wireless setup, which is necessary for the operator to setup the
wireless part of the link.

Enable the radio

Fig 2.2 Enable Radio Checkbox

Tick/Untick the checkbox to enable/disable the radio.

Basic Wireless Settings

All the basic wireless settings can be configured in this page. Operators can change the
ESSID, regulatory country code, wireless profile, channel spectrum width, frequency of
interest, data rates, transmit power and rate aggressiveness.

Wireless Mode

There are 5 modes available.

Access Point

This mode can be connected to Station mode, and then forwards all the traffic to the
network devices connected to the Ethernet devices of the Station.

Station:

This is a client mode that can be connected to the Access Point mode. It is used to bridge
the wireless connection to an Access Point. It forwards all the traffic to/from the network
devices to the Ethernet interface. This mode translates all the packets that pass through
device to its own MAC address, thus resulting in a lack of transparency.

Access Point Parameters Settings

Fig 2.3 Basic Wireless Settings (Access Point/ Access Point WDS)

Local AP-ESSID

This is the Service Set Identifier used to identify the operator’s wireless LAN. It should be
specified while operating in Access Point or Access Point WDS mode.
All the client devices within its range will receive broadcast messages from the access point
advertising this SSID.

Hide SSID:

Once checked, this will disable advertising the SSID of the access point in broadcast
messages to wireless stations. This option is only available in Access Point, Access Point
WDS and Repeater WDS mode only.

Country Code

Different countries have different power levels and also frequency selections. To ensure
device operation follows regulatory compliance rules, the operator should make sure that
correct country code where device will be used, is selected. The channel list, output power
limits, IEEE 802.11 and Channel Spectrum Width modes will be tuned according to the
regulations of the selected country. Station setting must match AP country code setting.

No Country Set:

Option when checked, only the frequency range are avai lable.
11n 2.4GHz is 2412-2462MHz, 11n 5GHz is 5180-5240MHz and 5745-5825MHz.

Wireless Profile:
NA is 11n 5GHz band and represents a mixed of 802.11n and 802.11a mode.

NG

is 11n 2.4GHz band and represents a mixed of 802.11n, 802.11g and 802.11b mode.

Channel Spectrum Width

20M represents the data transmitted at a bandwidth of 20MHz. 20/40MHz represents the
data transmitted at either 20MHz or 40MHz. In very noisy environment it automatically
falls back to 20MHz to be more resilient to the interference. In situation when auto fall
back did not happened, manually changing channel spectrum width to 20MHz will to
help reduce interference on the link and improve performance.

* Note: 40MHz bandwidth is non-standard for 802.11n/g mode operation. If you
experience unstable performance change Channel Spectrum Width to 20M.

Channel – Frequency

This is frequency selection you can set for device to operate on. The frequency range
available including 2412-2462MHz, 5180-5240MHz and 5745-5825MHz. Selecting one of

these frequencies for operation may affect and delay of 2 minutes or more (possibly up to 10

minutes in some situations) for device to attempt to establish a connection.
Auto: When checked, during startup, device automatically select the least interfering channels
(or frequency) for the operation.

Data Rate

Data Rates consist of both the legacy rates and the MCS (Modulation Coding Scheme –
Only for 802.11n) rates.

6 – 54Mbps are Legacy Rates
MCS0 to MCS7 are 802.11n rates, which uses only 1 stream.
MCS8 to MCS15

Auto: The data rate selected will follow an advanced rate algorithm that takes into condition the
amount of errors at the data rate and fine tune to the best data rate it can use.

are 802.11n rates, which uses 2 streams.

Transmit Power

The maximum transmit power displayed is determined by the country code and the

maximum transmit power of the miniPCI that is being used.

*Note on changing channels:

When the operator changes the channels and if this new frequency have higher
power output permitted by regulation, the power previously selected low power
level will remains unchanged. You need to readjust the power level to in order to take
advantage higher output power available for the channel
.

Rate Aggressiveness

Allows user to reduce or increase transmit rate while still remain in Fully Auto Algorithm.
There are 2 scenarios that Rate Aggressiveness is useful. Environment might be noisy at
times. Lower the throughput will ensure better stability. Rate Aggressiveness allows device
to reduce the transmit rate, so range or power can be higher.
Choose a range of value from -3, -2, -1
Environment might be free of interference. But the fully auto algorithm might give low
throughput. Increase Rate Aggressiveness will increase transmit rate in this case to get
higher throughput. Choose a range of value from +3, +2, +1.

Station Parameters Settings

Fig 2.4 Basic Wireless Settings (Station/Station WDS)

This options below are only available in Station, Station WDS and Repeater WDS modes
unless otherwise stated.

Wireless Mode: Station

Remote AP-ESSID

This is the Service Set Identifier used by station to seek and connect to the access point
of same the SSID identifier.

Site Survey
Site Survey will search for the available wireless networks in range on all the supported
channels and will allow you to select one for association. In case the selected network
uses encryption, you’ll need to set security parameters in wireless security section. Click
Scan to re-scan the Access Points in range. Select the Access Point from the list and click
Close this window. Site Survey channel scan list can be modified using the Channel Scan
List control.

Remote AP – Lock to MAC

Enter the MAC address of the remote access point the device is connected to. This option
will make device only connect to this access point. This is important when connection is
Point-to-Point operation.

Remote AP - Preferred MAC

Enter the preferred MAC address of the access point you want device to connect when it
first startup. Up to max of 4 MAC addresses can be entered. Priority is from top to bottom.
In the event all preferred MAC addresses are not available, device will then pick the
matching SSID access point with the strongest signal.

Country Code

Different countries have different power levels and also frequency selections. To ensure
device operation follows regulatory compliance rules, the operator should make sure that
correct country code where device will be used, is selected. The channel list, output power
limits, IEEE 802.11 and Channel Spectrum Width modes will be tuned according to the
regulations of the selected country. Station setting must match AP country code setting.

No Country Set:

Option when checked, only the frequency range are avai lable.
11n 2.4GHz is 2412-2462MHz, 11n 5GHz is 5180-5240MHz and 5745-5825MHz.

Wireless Profile:

NA is 11n 5GHz band and represents a mixed of 802.11n and 802.11a mode.

NG

is 11n 2.4GHz band and represents a mixed of 802.11n, 802.11g and 802.11b mode.

**

Station setting must match AP Wireless Profile setting.

Channel Spectrum Width

20M represents the data transmitted at a bandwidth of 20MHz. 20/40MHz represents the

data transmitted at either 20MHz or 40MHz. In very noisy environment it automatically
fall back to 20MHz to be more resilient to the interference. In situation when auto fall
back did not happened, manually changing channel spectrum width to 20MHz will to
help reduce interference on the link and improve performance.

* Note: 40MHz bandwidth is non-standard for 802.11n/g mode operation. If you
experience unstable performance change Channel Spectrum Width to 20M.

** Station setting must match AP Channel Spectrum Width setting.

Maximum : checking this box will result in maximum Tx output power overriding regulation.
Obey Regulatory Power : checking this box will obey Tx output regulatory power by country.

Channel Scan List

Not Channel scan set

Wireless Security

All the wireless security settings are set under this section.
The operation of the Keys is the same for ALL the Wireless modes.

WPA or WPA2 Authentication

Fig 2.7 WPA (Access Point/Access Point WDS/Repeater WDS)

WPA PS K

PSK (Default) – WPA or WPA2 with Pre-shared Key method.
Cipher Type

TKIP - Temporal Key Integrity Protocol which uses RC4 encryption algorithm.
AES - Advanced Encryption Standard (AES) algorithm.
AUTO (Default) – Automatically select between both algorithms.

Preshared Key

This option is available when WPA or WPA2, with PSK selected.
The pre-shared key is an alpha-numeric password between 8 and 63 characters long.

*** Important:

802.11n network using WPA authentication should use AES cipher type for
connection. Only AES allows highest transmission speed and throughput
operation.
Using TKIP cipher type device will limit maximum transmission speed of up to
54Mbps only.

WPA + EAP

Fig 2.8 WPA + EAP

EAP – WPA or WPA2 with EAP (Extensible Authentication Protocol)
Firmware supported options for clients are: EAP-TTLS and EAP-PEAP

Cipher Type

TKIP - Temporal Key Integrity Protocol which uses RC4 encryption algorithm.
AES - Advanced Encryption Standard (AES) algorithm.
AUTO (Default) – Automatically select between both algorithms.

Primary Radius Server IP

Enter the Primary Radius Server IP address.

Secondary Radius Server IP

Enter the Secondary Radius Server IP address.

Authentication Port

Enter the Authentication Port number of the Radius Server. Default is 1812.

Accounting Port

Enter the Accounting Port number of the Radius Server. Default is 1813.

Radius Secret Key

Enter the Secret Key of the Radius Server. The device use this to authenticate itself with
Radius Server.

WPA EAP-TTLS and WPA EAP-PEAP

Fig 2.8 WPA ( Station /Station WDS/Repeater WDS)

This apply to the following modes only, when WPA or WPA2, with EAP is selected.

Station, Station WDS, Repeater WDS mode.

Identity

Identification credential used by the wpa-supplicant for EAP authentication.

User Name:

Identification credential used by the wpa-supplicant for EAP tunneled authentication in
unencrypted form.

User Password:

Password credential used by the wpa-supplicant for EAP authentication

IEEE802.1x Settings

The operation of the Keys is the same for ALL the modes.

** Note: Operating with IEEE802.1x security will limit AP to maximum wireless link speed
of 54Mbps only.

Fig. 2.8 IEEE802.1X (Access Point/Access Point WDS/ Repeater WDS)

This option apply to the following modes only, when WPA EAP or IEEE802.1x .

Access Point, Access Point WDS, Repeater WDS modes.

Primary Radius Server IP

Enter the Primary Radius Server IP that Access Point will use to query server.

Secondary Radius Server IP

Enter the Secondary Radius Server IP that Access Point will use to query the server.

Authentication Port

Enter the Radius Server Authentication Port number to use. Default is 1812.

Accounting Port

Enter Radius server Accounting Port to use. Default is 1813.

Radius Secret Key

Enter Radius server Secret Key that Access Point to use to authenticate itself with radius
server.

IEEE802.1x Key Rotation

Enter time in seconds. Time before activate key rotation in authentication

process for higher security.

IEEE802.1x Key Length

This is the key length of the initial seed key. Select 64 or 128bit.

WEP

Fig 2.6 WEP

The operation of the Keys is the same for ALL the modes.

** Note: Operating with WEP security will limit AP to maximum wireless link speed of

54Mbps only.

Authentication Type:

Open Authentication – (Default) No authentication. Recommend to use this standard option

over shared authentication.

Shared Authentication – May not be compatible with all Access Point. Not recommended.

Key Type:

HEX or ASCII option specifies the character format for the WEP key if WEP security
method is used.

Current Key:

Specify the Index of the WEP Key used. 4 different WEP keys can be configured at the
same time, but only one is used.

WEP Key:

WEP encryption key for the wireless traffic encryption and decryption should be
specified if WEP security method is used.

WEP Key Length:

64-bit (selected by default) or 128-bit WEP Key length should be selected if WEP security
method is used. The 128-bit option will provide higher level of security.
For 64-bit – specify WEP key as 5 HEX (0-9, A-F or a-f) pairs (e.g. 00112233AA) or
5 ASCII characters.
For

128-bit – specify WEP key as 13 HEX (0-9, A-F or a-f) pairs

(e.g. 00112233445566778899AABBCC) or 13 ASCII characters.

Virtual Access Point (VAP)

Virtual AP (VAP) implements mSSID (Multi-SSID) whereby a single wireless card can be setup
with up to 3 virtual SSID of BSSID connections. Each VAP can be set with different security
authentication mode.

Fig 2.11 Virtual AP (Only Available in Access Point/ Access Point WDS Mode)

All VAPs are created from the same radio they all share the same wireless channel, country code,
channel spectrum width and transmit power.

* Note: Security options like IEEE802.1x and WPA-EAP uses radius server for
authentication and accounting. You may not use different secret key for each VAP.

Or you should configure only for one SSID with radius authentication.

Advance Wir eless Tab

Not Advance Wireless Setup

Advanced Network Tab

Click Advanced Network tab from menu to open the page below.

*Note: This tab will not open when in device is in Bridge node.
To open page, first enabled Router mode in Basic Network

Figure 1

Spanning Tree Setup

Spanning Tree Protocol: Default is disabled. Check on box to enable.

Root Priority: Default value is 32768. Smaller value has higher priority.
Root Hello Time: Default time is 2 seconds.

Root Forward Delay: Default is 15 seconds
Root Maximum Age: Default is 20 seconds

Changing to lower time can caused high overheads to the network.

NAT Setup

NAT: Enabled when in Router mode. Disabled when in Bridge mode.

DMZ: Default is disabled. Check on box to enable.

DMZ IP Address: Input IP address of the local PC to receive the DMZ packets.
Port Forwarding: Default is disabled. Check on box to enable.
For configuration refer to Appendix section.

Adding an entry from Known Server

Add entry from this box and select an application the list.
Server T ype: click to select the application you want to add.
Private IP Address: Enter the local IP of the PC running the application
Public IP Address: If the application to for any people on the internet to access then
select the default, All.
If only specific IP, select Single and enter the IP address.
If only specific range of IP, select Range and enter IP address range.

Adding an entry from Custom Server

Entry from Custom Server box lets you enter the other port number service for an
application and new applications.
Custom Server also lets you enter a different public and private port service

Server Type: Enter a brief name for the application. This info helps you track the
application for that port number you set.

Protocol: Select TCP or UDP the application use.
Public Port: select Single or Range of ports application use.
From: if single port, enter this box only. If port range, enter starting port number here.
To: if single port, leave blank. if port range enter, enter last port number here.
Private IP Address: Enter the local IP of the PC running the app lication
Private Port From: If single port, enter same public port number or new port number.

If port range, enter only the starting port number.

Public IP Address: If the application is to access by any people on the internet, then
select the default, All.
If only specific IP, select Single and enter the IP address.
If only specific range of IP, select Range and enter IP address range.

IP Forwarding: Default is disabled. Check on box to enable.

For configuration refer to Appendix section.
Private IP: enter the local IP address to receive forward packet by the public IP
Public IP: enter the public IP address when access will forward all packet to the local IP

Click Add to add to list.

Routing Information Protocol: Default is disabled. Check on box to enable .
For configuration refer to Appendix section.

Router Info Protocol version: select RIPv1 or RIPv2

Firewall Setup

Firewall Setup: Default is disabled. Check on box to ena ble .

For configuration refer to Appendix section.

Comment: enter a brief name for the service.
Policy: select Accept or Deny for the apply rule
IP Type: select ICMP, TCP, and UDP packet type to check
Source IP/Mask: enter the source IP address and Netmask

Is the source IP of the packet (specified within the packet header), usually it is
the IP of the host system which sends the packets;
Src Port: enter the source port number in rule check
Is the source port of the TCP/UDP packet (specified within the packet header), usually it
is the port of the host system application which sends the packets.
Destination IP/Mask: enter the destination IP and Netmask
Is the Destination IP of the packet (specified within the packet header),
usually it is the IP of the system which the packet is addressed to;
Des Port: enter the destination port in rule check
Is the destination port of the TCP/UDP packet (specified within the packet
header), usually it is the port of the host system application which the packet is
addressed to
.
Click Apply to the rule or Cancel to clear the rule set.

Outbound Filtering Setup

Filtering Setup: Default is disabled. Check on box to enable.

For configuration refer to Appendix section.

DNS Redirection: Default is enabled. Check on box to disable. When enabled, router device will
act as DNS proxy. PC connected to this router device to set their TCPIP DNS IP to router’s IP
address. PC can still setup a valid DNS IP to skip the DNS proxy handling.

Dynamic DNS Setup: Default is disabled. Check on box to enable.
Dynamic DNS let router’s WAN dynamic IP address linked and
automatically updated to domain server hosting the service each time the
IP address is changed. These ensured users on the internet can always get
access to the hosting service behind the router.
For configuration refer to Appendix section.

DNS Relay Setup: Default is disabled. Check on box to enable.

These are the primary and secondary DNS IPs device proxy service use to
resolve the domain name on behalf of the client PCs.

Primary DNS IP Address: Enter the primary DNS IP address
Secondary DNS IP Address: Enter the secondary DNS IP address

UPNP: Default is disabled. Check on box to enabled.

When enabled, client PC running Microsoft UPnP services can automatically open certain
specific port required by the PC application in the router.
For security reason this service should not be open.
Recommend to setup manually open all port service through Port Forwardin g service.

Services Tab

Click Services tab from menu to open the page below.

Services section provides varieties of useful and enhanced functions to help assist device
operations.

Ping W atchdog

Enable Ping Watchdog: Default is disabled. Check on box to enable.

IP Address T o Ping: Target IP address do ping test monitor.

Ping Interval: Default is 5 seconds (minimum). This is Ping test duration.
Startup Delay: Default is 60 seconds(minimum).

One time delay after device startup.

Failed Count To Reboot: Default is 5. This is the number of ping failure count before

device kick in the reboot process.

Auto-Reboot

Auto-Reboot Mode: Default is disabled. Select By Hour or By Time check.

This mode lets you preset a timer to automatically force a reboot.
Timer can in fixed number of hours or at a specified time of day.

By Hour: Enter the number of hours device need to run before kick start reboot process.
By Time: Enter the specific time of day in hh:mm (24-hour format) to kick start reboots

process.

SNMP Setup

Enable SNMP: Default is disabled. Check on box to enable.
Read Only Password: Password to query device.
Engine ID: Default is 800007e5BD00002704D000007c
Enable SNMP Trap: Default is disabled. Check on box to enable.
Trap Destination IP: Enter the IP to send the info when trap is triggered.
Community: Enter the SNMP community string.

NTP Setup

Enable NTP Client: Default is disabled. Check on box to enable.
Select Your Time Zone: Select from list the country you reside.

Custom Time Server: Default is “time.nist.gov“ Enter preferred time server domain or IP
Known Time Server: You can also select one from this list as your new time server.

Web HTTP Security

Web Server Mode: Default is HTTP. Option is HTTP and HTTPs
HTTP(s) Port: Default is 80 for HTTP and 413 for HTTPs.

Enter a new preferred port number.

T elnet Access Setup

Enable Telnet Server: Default is enabled. Remove check on box to disable.

Server Port: Default is 23. Enter new preferred port number.

SSH Access Setup

Enable SSH Server: Default is disabled. Check on box to enable.

Server Port: Default is 22. Enter new preferred port number.

System Log Setup

Enable System Logging: Default is disabled. Check on box to enable.
Logging IP /Domain Name: Enter destination IP address of device to receive log.
Logging Port: Default is 514. Enter the new preferred port number.

System Tab

The System Page contains Administrative options. This page enables administrator to customize,
reboot the device, set it to factory defaults, upload a new firmware, backup or update the
configuration and configure administrator’s credentials.

Firmware Upgrade

Use this section to find out current software version and update the device with the new firmware.
The device firmware update is compatible with all configuration settings. System configurations
are preserved while the device is updated with a new firmware version.

Firmware version: displays the version of the current firmware of the device system.

Upgrade: button opens the Firmware Upload window if activated.

Current Firmware: displays the version of the device firmware which is currently operating.

Firmware File: activate Browse button to navigate to and select the new firmware file. The full

path to the new firmware file location can be specified there. New firmware file is
transferred to the system after Upload button is activated.

Close this window – button cancels the new firmware upload process if activated.

Upgrade button should be activated in order to proceed with firmware upgrade routine (new

firmware image should be uploaded into the system first). Please be patient, as the firmware
upgrade routine can take 3-7 minutes. The based device will be un-accessible until the firmware
upgrade routine is completed.

Do not switch off, do not reboot and do not disconnect the device from the
power supply during the firmware upgrade process as these actions will
damage the device!

It is highly recommended to backup the system configuration and the Support Info file before
uploading the new configuration.
Close this window – button closes the firmware upgrade window if activated.
This action will not cancel the firmware upgrade process.

Host Name

Host Name is the system wide device identifier. It is reported by SNMP Agent to authorized
management stations. Host Name will be represented in popular Router Operating Systems
registration screens and discovery tools.

Host Name: specifies the system identity.
Change button saves the Host Name if activated.

Administrative and Read-only Account

In this section you can modify the administrator password to protect your device from
unauthorized configuration. The default administrator’s password should be changed on the very
first system setup:

Administrator Username: specifies the name of the system user.
Current Password: administrator is required to enter a current password. It is required for

Password or Administrator Username change routine.

Default administrator login credentials:

• User Name: admin

• Password: password

New Password: new password used for administrator authentication should be specified.
Verify Password: new password should be re-entered to verify its accuracy.
Click Change button to save the changes.

Enable Read-Only Account

Read-Only Username
Password: new password used for read-only administrator authentication should be specified.

Configuration Management

Backup Configuration: click Download button to export the current configuration to a file.
Upload Configuration: click Browse button to navigate to and select the new configuration file

or specify the full path to the configuration file location.
Activating the Upload button will transfer new configuration file to the system.
New configuration will be effective after the Apply button is activated and system reboot cycle is
completed. Previous system configuration is deleted after Apply button is activated. It is highly
recommended to backup the system configuration before uploading the new configuration.
Use only configuration backups of the same type device - configuration backed up from
PowerStation2 suits only PowerStation2, but not LiteStation2 or LiteStation5! Behavior may be
unpredictable when mixing configurations from different type devices.

Device Maintenance

The controls in this section are dedicated for the device maintenance routines: rebooting, resetting,
generating of the support information report.

Reboot: activate Reboot control in order to initiate full reboot cycle of the device. Reboot effect

is the same as the hardware reboot which is similar to the power off - power on cycle. The system
configuration is not modified after the reboot cycle completes. Any non-applied changes will be
lost.

Reset to Defaults: activate Reset to Defaults control in order to initiate reset the device to factory

defaults routine. Reset routine initiates system Reboot process (similar to the power off - power on
cycle). The running system configuration will be deleted and the default system configuration (all
the system settings with no exception) will be set.

After the Reset to Defaults routine is completed, the device system will return to the default IP
configuration (192.168.168.1/255.255.255.0) and will start operating in Station-Bridge mode. It is
highly recommended to backup the system configuration before the Reset to Defaults is initiated.

Status Page

The Status Page displays a summary of link status information, current values of basic
configuration settings (depending on operating mode), network settings and traffic statistics of all
the interfaces.

Status Reporting

Main

Uptime: displays device up time since boot up. The time is expressed in days, hours, minutes

and seconds.

Host Name: displays the assigned device host name (ID).

System Time: display device current date and time. Accurate system date and time is retrieved

from the internet services using NTP (Network Time Protocol) if device is setup
and connected to internet. Otherwise, the date and time update from device own
inaccurate autonomous clock.

Version Firmware Version: displays current firmware version in operation.
Loader Version: displays current loader version of the device.

LAN Setting

LAN MAC: displays the MAC address of the device LAN (Ethernet) interface.
LAN Mode: displays the mode used, either static or DHCP client.
LAN IP Address: displays the current IP address of the LAN (Ethernet) interface.
LAN Gateway IP Address: displays the IP address of the gateway used in LAN.
LAN Pri. DNS IP: displays the Primary DNS IP address of the LAN setting.
LAN Sec. DNS IP: displays the Secondary DNS IP address of the LAN setting.

WAN Setting

WAN MAC: displays the MAC address of the device WAN interface.
WAN Mode: displays the mode used, either DHCP, PPPoE or Static IP.
WAN IP Address: displays the current IP address of the WAN interface.
WAN Gateway IP Address: displays the IP address of the gateway used in WAN.
WAN Pri. DNS IP: displays the Primary DNS IP address of the WAN setting.
WAN Sec. DNS IP: displays the Secondary DNS IP address of the WAN setting.

Radio

Wireless Mode: displays the current operating mode of the device.
Local AP SSID: displays the current SSID (Service Set Identifier) of device when operates in

access point mode.

Frequency: displays current operating frequency running in device.
WLAN MAC: displays the MAC address or BSSID of the current active WLAN card running in

device.

WLAN Local/Remote AP MAC: displays the MAC address of the WLAN card connected to it.
WLAN Security: display the current active security mode.

Clients Connection Status in AP Status Info

All clients connected to AP can be view from AP Status page.
Below is an example of a client connection status info.

Click to refresh client connection statistics and status page

Signals strength at the left and right port of radio card can be view with more accurately while
adjusting the antenna to get a more balanced reception.

Station Connection Info

Status Info

Click to refresh client connection statistics and status page.

WLAN Connected Status:

MAC Address: displays the MAC address of the current active WLAN card.

Signal Strength: displays the received wireless signal level of opposite connected device.

TX Rate and RX Rate: displays the current 802.11 data transmission (TX) and data reception

(RX) rate while operating in Station mode. Typically, the higher the signal, the higher the
data rate and consequently the higher the data throughput.

Channel Width: HT20 indicates established connection is 20MHz channel width
HT40+ indicates established connection is 40MHz channel width

WLAN Local AP Statistics:

Bytes transmitted/received value represents the total amount of data (in bytes) transmitted
and received during the connection;

WLAN Local AP Errors: section displays the counters of 802.11 specific errors which were
registered on wireless interface:

Rx invalid NWID value represents the number of packets received with a different NWID or
ESSID - packets which were destined for another access point. It can help to detect
configuration problems or identify the adjacent wireless network existence on the same
frequency.

Rx Invalid Crypt value represents the number of transmitted and received packets which were
encrypted with the wrong encryption key and failed the decryption routines. It can be used to
detect invalid wireless security settings and encryption break attempts.

Rx Invalid Frag value represents the number of packets missed during transmission and reception.
These packets were dropped due to re-assembling failure as some link layer fragments of the
packet were lost.

Tx Excessive Retries value represents the number of packets which failed to be delivered to the
destination. Undelivered packet are retransmitted a number of times before an error occurs.

Missed beacons value represents the number beacons (management packets sent at regular
intervals by the Access Point) which were missed by the client. This can indicate that the
wireless client is out of range.

Other errors value represents the total number of transmitted and received packets that were lost
or discarded for other reasons.

More Status

In More Status option contains some useful tools and additional status pages.

Ping Utility – a ping tool to test the connectivity between devices.

ARP Table

display a list of MAC addresses of the connected devices

Bridge Table display a list the devices connect to the bridge interface

DHCP Active Lease Table

display a list of IPs addresses leased to all computers.

VLAN Tab

This setup lets you create virtual local network connection through the device Ethernet only and
over wireless connections.
By default VLAN mode is disabled and checked on No Vlan

VLAN Switch

To setup VLAN network check on Vlan Switch

To add a Tag VLAN ID for Ethernet port, type in the ID number select Tag and click Add
To add a Tag VLAN ID for MAIN wireless SSID, type in the ID number select Tag and click Add
To add a Tag VLAN ID for VAP1 wireless SSID, type in the ID number select Tag and click Add
To add a Tag VLAN ID for VAP2 wireless SSID, type in the ID number select Tag and click Add
To add a Tag VLAN ID for VAP3 wireless SSID, type in the ID number select Tag and click Add

*** Warnin g: Adding a Tag VLAN ID to device interface port can cause lost of connection to
device web manager if the PC ethernet port or wireless connection do not have a
Tag VLAN ID or do not have the same Tag VLAN ID setup in device.
If this happened, use the device Reset button to clear the config and reconfigure.
Refer Reset button operations section.

Similarly, to add an untag VLAN ID enter the ID number and select Untag and click Add

Refer to Appendix V for VLAN setup examples.

VLAN Management

Vlan management lets you control and limit onl y clients connection of same tag vlan ID grou p be
open AP device web page.

* Note:­ Vlan Management works only in tag vlan pass-through mode. i.e. Vlan Switch is disabled.
When Vlan Switch is enabled or configured, Vlan Management function stops operation.

Example:
Assuming there are 2 VLAN ID groups, 2001 and 2002 setup in AP device.
One entry in Vlan Management has Vlan ID 2001 with masquerade IP address 192.168.168.20
Another entry in Vlan Management has Vlan ID 2002 with masquerade IP address 192.168.168.10
You can only select one of the 2 entries to be the active Vlan ID and IP address.
If Vlan ID 2001 group is selected, then only computers in that Vlan ID group can open the AP
device web page using the IP address, http://192.168.168.20
To change to other ID group say, Vlan ID 2002, mark the radio button under Management IP, then
click Apply and Saved.

If there is no entry in Vlan Management, there is no restriction. All computers can open the AP
device web page by the default IP address setup in Basic Network page.

Appendix I - Network

This section provides more detailed explanation on the network operation modes in general.

The Network Page allows the administrator to setup bridge or routing functionality.
Device can operate in bridge or router mode. The IP configuration as described below is required
for device management purposes. IP addresses can either be retrieved from a DHCP server or
configured manually. Use the Network menu to configure the IP settings.

Network Mode Selections
Network Mode:

The mode depends on the network topology requirements:

Bridge operating mode is selected by default as it is widely used by the subscriber stations,
while connecting to Access Point or using WDS. In this mode the device will act as a
transparent bridge and will operate in Layer 2. There will be no network segmentation while
broadcast domain will be the same. Bridge mode will not block any broadcast or multicast traffic.
Additional Firewall settings can be configured for Layer 2 packet filtering and access control in
Bridge mode.

Router operating mode can be configured in order to operate in Layer 3 to perform routing and
enable network segmentation – wireless clients will be on different IP subnet.
Router mode will block broadcasts while it is not transparent.

Device supports Multicast packet pass-through in Router mode. Router can act as DHCP server
and use Network Address Translation (Masquerading) feature which is widely used by the Access
Points. NAT will act as the firewall between LAN and WLAN networks. Additional Firewall
settings can be configured for Layer 3 packet filtering and access control in Router mode.

Specify the operating network mode for the device.

Bridge Mode

Bridge Mode Network Settings

In bridge mode the device forwards all the network management and data packets from one
network interface to the other without any intelligent routing. For simple applications this provides
efficient and fully transparent network solution. WLAN (wireless) and LAN (Ethernet) interfaces
belong to the same network segment which has the same IP address space. WLAN and LAN
interfaces form the virtual bridge interface while acting as the bridge ports. The bridge has
assigned IP settings for management purposes:

Bridge IP Address:
The device can be set for static IP or can be set to obtain an IP address from the DHCP
server it is connected to. One of the IP assignment modes must be selected:

DHCP : choose this option to assign the dynamic IP address, Gateway and DNS address by the
local DHCP server.
STATIC : choose this option to assign the static IP settings for the bridge interface.
IP Address: enter the IP address of the device while Static Bridge IP Address mode is selected.
This IP will be used for the device management purposes.
IP Address and Netmask settings should consist with the address space of the network segment
where device resides. If the device IP settings and administrator PC (which is connected to the
device in wired or wireless way) IP settings will use different address space, the device will
become unreachable.

Netmask: This is a value which when expanded into binary provides a mapping to define which
portions of IP address groups can be classified as host devices and network devices.
Netmask defines the address space of the network segment where device
resides. 255.255.255.0 (or /24) Netmask is commonly used among many C Class IP networks.

Gateway IP: Typically, this is the IP address of the host router which provides the point of
connection to the internet. This can be a DSL modem, Cable modem, or a WISP gateway router.
Device will direct the packets of data to the gateway if the destination host is not within the local
network. Gateway IP address should be from same address space (on same network segment) as
the device.
Primary/Secondary DNS IP:
The Domain Name System (DNS) is an internet "phone book" which translates domain
names to IP addresses. These fields identify the server IP addresses of where the device
looks for the translation source.

Primary DNS server IP address should be specified for the device management purposes.
Secondary DNS server IP address is optional. It is used as the fail-over in case the primary DNS
server will become unresponsive.

Spanning T r ee Protocol:

Multiple interconnected bridges create larger networks using the IEEE 802.1d Spanning Tree
Protocol (STP), which is used for finding the shortest path within network and to eliminate loops
from the topology.
If the STP is turned on, the Bridge device will communicate with other network devices by
sending and receiving Bridge Protocol Data Units (BPDU). STP should be turned off
(selected by default) when the device is the only bridge on the LAN or when there are no
loops in the topology as there is no sense for the bridge to participate in the Spanning Tree
Protocol in this case.

Bridge mode Firewall Configuration Settings

Firewall functionality on bridge interface can be enabled using the "Enable Firewall" option.

Bridge Firewall rules can be configured, enabled or disabled while using Firewall configuration
window which is opened with the "Configure" button.
Firewall entries can be specified by using the following criteria:
Interface the interface (WLAN or LAN) where filtering of the
incoming/passing-through packets is processed;
IP Type sets which particular L3 protocol type (ICMP, TCP, and UDP) should be filtered;
Source IP/mask is the source IP of the packet (specified within the packet header), usually it is the
IP of the host system which sends the packets;
Source Port is the source port of the TCP/UDP packet (specified within the packet header), usually
it is the port of the host system application which sends the packets;
Destination IP/mask is the destination IP of the packet (specified within the packet header),
usually it is the IP of the system which the packet is addressed to;
Destination Port is the destination port of the TCP/UDP packet (specified within the packet
header), usually it is the port of the host system application which the packet is
addressed to.
Comments is the informal field for the comment of the particular firewall entry. Few words
about the particular firewall entry purpose are saved there usually.
On flag enables or disables the effect of the particular firewall entry. All the added
firewall entries are saved in system configuration file, however only the enabled firewall
entries will be active during the system operation.

New Firewall entries can be saved by activating Apply button or discarded by activating Cancel
button in the Firewall configuration window.
All the active firewall entries are stored in the FIREWALL chain of the ebtables filter table, while
the device is operating in Bridge mode.
Click Apply Setting and Save Changes button to save the changes made in the Network page.

Appendix II – Wireless with Router Mode

This section provides more details on wireless with router function.

The role of the LAN and WLAN interface will change accordingly to the Wireless Mode while
the device is operating in Router mode:

• Wireless interface and all the wireless clients connected are consi dered as the internal
LAN and the Ethernet interface is dedicated for the co nnection to the external network
while the device is operating in AP/AP WDS wireless mode;

• Wireless interface and all the wireless clients connected i s considered as the external
network and the all the network devices on LAN side as well as the Ethern et interface
itself is considered as the internal network while the device is operating in Station/Station
WDS mode.

Wireless/wired clients are routed from the internal network to the external one by default.
Network Address Translation (NAT) functionality works the same way.

AP-Router mode Network Settings

IP Address: This IP addresses represents the LAN or WLAN interface which is connected to the

internal network according to the wireless operation mode described above. IP will be used for
routing in internal network (it will be the Gateway IP for all the devices connected on the internal
network). IP address also will be used for the management purpose of the device.

WLAN IP Address: This IP addresses represents the LAN or WLAN interface which is connected
to the external network according to the wireless operation mode described above. This is the IP
address can be used for the routing and the device management purposes. The external network
interface can be set for static IP or can be set to obtain an IP address from the DHCP server which
should reside in the external network. One of the IP assignment modes must be selected for the
external network interface:
DHCP – choose this option to obtain the IP address, Gateway and DNS address
dynamically from the external DHCP server.
PPPoE – choose this option to obtain the IP address, Gateway and DNS address dynamically
from the external PPPoE server.
Static – choose this option to assign the static IP settings for the external interface.
IP Address and Netmask settings should consist with the address space of the network
segment where the device resides. If the device IP settings and administrator PC
(which is connected to the device through wired or wireless) IP settings will use
different address space, the device will become unreachable.

Netmask: This is used to define the device IP classification for the chosen IP address range.

255.255.255.0 is a typical netmask value for Class C networks, which support IP address range

192.0.0.x to 223.255.255.x. Class C network Netmask uses 24 bits to identify the network
(alternative notation "/24") and 8 bits to identity the host.

Gateway IP: This is the IP address of the host router which resides on the external network and

provides the point of connection to the next hop towards the internet. This can be a DSL modem,
Cable modem, or a WISP gateway router. The device will direct all the packets to the gateway if
the destination host is not within the local network.
Gateway IP address should be from the same address space (on the same network segment) as the
device's external network int e rfac e (Wireless interface in th e Station ca se and th e LAN i n te rfa ce in
the AP case).

Primary/Secondary DNS IP: The Domain Name System (DNS) is an internet "phone book"
which translates domain names to IP addresses. These fields identify the server IP addresses where
the DNS requests are forwarded by the device.
Primary DNS server IP is mandatory. It is used by the DNS Proxy and for the device management
purpose.
Secondary DNS server IP address is optional. It is used as the fail-over in case the primary DNS
server will become unresponsive.

Enable NAT: Network Address Translation (NAT) enables packets to be sent from the wired

network (LAN) to the wireless interface IP address and then sub-routed to other client devices
residing on it's local network while the device is operating in AP/AP WDS wireless mode and in
the contrariwise direction in "Station/Station WDS" mode.
NAT is implemented using the masquerade type firewall rules. NAT firewall entries are stored in
the iptables nat table, while the device is operating in Router mode. Please refer to the iptables
tutorial for detailed description of the NAT functionality in Router mode.
Static routes should be specified in order the packets should pass-through the based device if the
NAT is disabled in while operating in Router net wo rk mode.

Enable DHCP Server: Dynamic Host Configuration Protocol (DHCP) Server assigns IP

addresses to clients which will associate to the wireless interface while the device is operating in
AP/AP WDS wireless mode and assigns IP addresses to clients which will connect to the LAN
interface while the device is operating in Station/Station WDS mode.

Range Start/End: This range determines the IP addresses given out by the DHCP server to client

devices on the internal network which use dynamic IP configuration.
Lease Time: The IP addresses given out by the DHCP server will only be valid for the duration
specified by the lease time. Increasing the time ensure client operation without interrupt, but could
introduce potential conflicts. Lowering the lease time will avoid potential address conflicts, but
might cause more slight interruptions to the client while it will acquire new IP addresses from the
DHCP server.

Port Forwarding Settings

Port Forwarding: Port forwarding allows specific ports of the hosts residing in the internal

network to be forwarded to the external network. This is useful for number of applications
such as FTP servers, gaming, etc. where different host systems need to be seen using a single
common IP address/port. Port Forwarding rules can be set in Port Forwarding window, which
is opened by enabling the Port Forwarding option and activating the Configure button.
Port Forwarding entries can be specified by using the following criteria:

Private IP is the IP of the host which is connected to the internal network and needs to be

accessible from the external network;
Private Port is the TCP/UDP port of the application running on the host which is connected to
the internal network. The specified port will be accessible from the external network;
Type is the L3 protocol (IP) type which needs to be forwarded from the internal network.
Public Port is the TCP/UDP port of the based device which will accept and forward the
connections from the external network to the host connected to the internal network.
Comments is the informal field for the comment of the particular port forwarding entry.
Few words about the particular port forwarding entry purpose are saved there usually.
Enabled flag enables or disables the effect of the particular port forwarding entry.
All the added firewall entries are saved in system configuration file, however only
the enabled port forwarding entries will be active during the system operation.

New entries in port forwarding can be saved by activating Save button or discarded by activating
Cancel button in the Port Forwarding configuration window.

DNS Proxy: The DNS Proxy forwards the Domain Name System requests from the hosts which
reside in the internal network to the DNS server while device is in operating in Router mode.
Valid Primary DNS Server IP needs to be specified for DNS Proxy functionality. Internal
network interface IP of the device should be specified as the DNS server in the host
configuration in order DNS Proxy should be able to get the DNS requests and translate
domain names to IP addresses afterwards.

Bridge mode Firewall Configuration Settings

Firewall functionality on any router interface can be enabled using the "Enable Firewall" option.

Router Firewall rules can be configured, enabled or disabled while using Firewall
configuration window which is opened with the "Configure" button.
Firewall entries can be specified by using the following criteria:
Interface the interface (WLAN, LAN or PPP) where filtering of the incoming/passing-through
packets is processed;

IP Type sets which particular L3 protocol type (ICMP, TCP, UDP, P2P) should be filtered;
Source IP/mask is the source IP of the packet (specified within the packet header), usually it is

the IP of the host system which sends the packets;
Source Port is the source port of the TCP/UDP packet (specified within the packet header),
usually it is the port of the host system application which sends the packets;
Destination IP/mask is the destination IP of the packet (specified within the packet header),
usually it is the IP of the system which the packet is addressed to;
Destination Port is the destination port of the TCP/UDP packet (specified within the packet
header), usually it is the port of the host system application which the packet
is addressed to.
Comments is the informal field for the comment of the particular firewall entry. Few words
about the particular firewall entry purpose are saved there usually.
On flag enables or disables the effect of the particular firewall entry. All the added firewall
entries are saved in system configuration file, however only the enabled firewall entries
will be active during device operation.
New entries in Firewall can be saved by activating Apply Setting and Save Changes button or
discarded by activating Cancel button in the Firewall configuration window.
All the active firewall entries are stored in the FIREWALL chain of the iptables filter table, while
the device is operating in Router mode.

PPPoE: Point-to-Point Protocol over Ethernet (PPPoE) is a virtual private and secure connection
between two systems which enables encapsulated data transport. It is commonly used as the
medium for subscribers to connect to Internet Service Providers.
Select the IP Address option PPPoE to configure a PPPoE tunnel in order to connect to an ISP.
Only the external network interface can be configured as PPPoE client as all the traffic will
be sent via this tunnel. The IP address, Default gateway IP and DNS server IP address will be
obtained from the PPPoE server after PPPoE connection is established. Broadcast address is
used for the PPPoE server discovery and tunnel establishment.
Valid authorization credentials are required for the PPPoE connection:
PPPoE Username – username to connect to the server (must match the configured on the
PPPoE server);
Password – password to connect to the server (must match the configured on the PPPoE
server);
PPPoE MTU/MRU – the size (in bytes) of the Maximum Transmission Unit (MTU)
and Maximum Receive Unit (MRU) used for the data encapsulation
while transferring it through the PPP tunnel;

Enable DMZ: The Demilitarized zone (DMZ) can be enabled and used as a place where services
can be placed such as Web Servers, Proxy Servers, and E-mail Servers such that these
services can still serve the local network and are at the same time isolated from it for
additional security. DMZ is commonly used with the NAT functionality as an alternative for
the Port Forwarding while makes all the ports of the host network device be visible from the
external network side.

DMZ Management Port: Web Management Port for the based device (TCP/IP port 80 by default)
will be used for the host device if DMZ Management Port option is enabled. In this case
device will respond to the requests from the external network as if it was the host which is
specified with DMZ IP. It is recommended to leave Management Port disabled while the
based device will become inaccessible from the external network if enabled.

DMZ IP: connected to the internal network host, specified with the DMZ IP address will be
accessible from the external network.
With a multicast design, applications can send one copy of each packet and address it to the
group of computers that want to receive it. This technique addresses packets to a group of
receivers rather than to a single receiver. It depends on the network to forward the packets to
the hosts which need to receive them. Common Routers isolate all the broadcast (thus
multicast) traffic between the internal and external networks, however provides the multicast
traffic pass-through functionality.
Click Change button to save the changes made in the Network page.

Appendix III- Services

This section provides more details on the system management services.

Ping W atchDog

The ping watchdog sets the device to continuously ping a user defined IP address (it can be the
internet gateway for example). If it is unable to ping under the user defined constraints, the device
will automatically reboot. This option creates a kind of "fail-proof" mechanism.
Ping Watchdog is dedicated for continuous monitoring of the particular connection to remote host
using the Ping tool. The Ping works by sending ICMP “echo request” packets to the target host
and listening for ICMP “echo response” replies. If the defined number of replies is not received,
the tool reboots the device.

Enable Ping Watchdog: control will enable Ping Watchdog Tool.
IP Addr ess T o Ping: enter the target host IP address to monitor.
Ping Interval: specify time interval (in seconds) between to send the ICMP “echo requests”.
Startup Delay: specify initial time delay (in seconds) from device startup or reboot to start

sending first ICMP “echo requests”. Minimum value is 60 seconds.
Failure Count To Reboot: specify the number of ICMP “echo response” replies. If the specified
number of ICMP “echo response” packets is not received continuously, the Ping Watchdog Tool
will reboot the device.

SNMP Agent

Simple Network Monitor Protocol (SNMP) is used in network management systems to monitor
network-attached devices for conditions that warrant administrative attention. Device contains an
SNMP agent which allows it to communicate to SNMP manage applications for network
provisioning.
SNMP Agent provides an interface for device monitoring using the Simple Network Management
Protocol (an application layer protocol that facilitates the exchange of management information
between network devices). SNMP Agent allows network administrators to monitor network
performance, find and solve network problems. For the purpose of equipment identification, it is
always a good idea to configure SNMP agents with contact and location information:

Enable SNMP Agent: con trol will enable SNMP Agent.
SNMP Community: specify SNMP community string. It is required to authenticate access to

MIB objects and functions as embedded password. The device supports a Read-only community
string that gives read access to authorized management stations to all the objects in the MIB
except the community strings, but does not allow write access for device that supports SNMP v1.

Contact: specify the identity or contact in case an emergency situation arise.

Location: specify the physical location of the device.

NTP Client, Web, Telnet, SSH Server

NTP Client: The Network Time Protocol (NTP) is a protocol for synchronizing the clocks of

computer systems over packet-switched, variable-latency data networks. It can be used to set the
device system time. System Time is reported next to the every System Log entry while registering
system events if Log option is enabled.

Web Server: the f ollow in g the device Web Server parameters can be set there:
Use Secure Connection (HTTPS): If checked Web server will use secure HTTPS mode. HTTP

mode is selected by default.

Secure Server Port: Web Server TCP/IP port setting while using HTTPS mode.
Server Port: Web Server TCP/IP port setting while using HTTP mode.

Telnet Server: the following the device Telnet Server parameters can be set there:
Enable Telnet Server: Enables Telnet access to the device.
Server Port: Telnet service TCP/IP port setting.

SSH Server: the following the device SSH Server parameters can be set there:
Enable SSH Server: Enables SSH access to the device.
Server Port: SSH service TCP/IP port setting.

System Log

Enable Log : option enables the registration routine of the system log messages.

Enable Remote Log enables the syslog remote sending function while System log messages are
sent to a remote server specified by the Remote Log IP Address and Remote Log Port.

Remote Log IP Address is the host IP address where syslog messages should be sent. Remote
host should be configured properly to receive syslog protocol messages.
Remote Log Port is the TCP/IP port of the host syslog messages should be sent. "514" is the
default port for the commonly used system message logging utilities
.

Every logged message contains at least a System T ime and a Host Name. Usually a
particular service name which generates the system event is specifies also within the
message. Messages from different services have different context and different level
of the details. Usually error, warning or informational system services messages are
reported. The more detailed system messages are reported, the greater volume of log
messages will be generated.

Appendix IV- VLAN Setup examples

A) Tagged Wireless VLAN to Tagged Ethernet VLAN Setup

B) Untagged Wireless VLAN to Tagged Ethernet VLAN setup

C) Tagged VLAN Pass-Through

AP and Station link No VLAN Setup
Required