The D-Link DSA-3200 Airspot™ Wireless G Public/Private Gateway is an all-in-one
product specially designed to manage and control a Hot Spot environment. The
DSA-3200 integrates access control features and wireless network access into a
single system to fulfill the basic needs of most Hot Spot venues. The DSA-3200
supports 802.11b and 802.11g wireless transmission modes simultaneously offe ring
convenience, efficiency, and a friendly end-user experience from your Hot Spot.
Quick Installation, On-line Immediately
Installation and setup of the DSA-3200 can easily be accomplished without changing
the existing network architecture. Within a short time of making all of the necessary
physical connections, setup of access security mechanisms can be completed throu gh
the Web-based Interface. With the DSA-3200 at the head of a network, Public LAN
and WLAN users must authenticate prior to being granted access to the Internet.
These users can be assigned a specific bandwidth priority and/or Firewall profile to
preserve access rights and privileges between pre-defined user groups.
Friendly Management and Applicati on Interfaces
The DSA-3200 is not only easy to install, but also has a friendly management web
interface. The full web-based management interface allows one to operate and
maintain the system using a Java enabled web browser. Users that connect to your
Hot Spot Network will automatically be redirected to the login page the first time they
try to surf the web after connecting to the Public LAN or WLAN Interface of the
DSA-3200.
Integrate an Existing User Password Database
Often time organizations or businesses will already own and operate a specific
credential database system to centralize and manage their user passwords and user
4
DSA-3200 Wireless Service Gateway User Manual
permissions on the Network. One of the more prevalent Protocols used to authenticate
users is the RADIUS Protocol. With a built-in RADIUS Client the DSA-3200 can
support both Local and RADIUS authentication mechanisms simultaneously, allowing
one to easily incorporate an existing user password database into the Airspot™ Hot
Spot System. The DSA-3200 also provides a built-in user database, allowing dynamic
account creation/deletion to coexist with the more static RADIUS database.
1.2 Things to Consider
1.2.1 Audience
This manual is intended for system or network administrators possessing basic
networking knowledge to complete step by step instructions in this manual in order to
use the DSA-3200 to centralize Network access and management. This manual
attempts to explain in detail the wealth of functions the DSA-3200 supports, however
there may be situations and circumstances not considered during the authoring of this
document. Technical Support may only assist with the configuration of the DSA-3200
through the Web-UI or SSH, and may not troubleshoot or repair ill configured external
systems or Networks.
1.2.2 Document Convention
Whenever an important piece of information such as a recommendation or warning
needs to be presented, said information is displayed in a box in italics similar to the
recommendation below . Th ese re commendation s will for the most p art be use d to help
in increasing the security and usability of your Hot Spot.
Warning: To Increase security, you should immediately change the Administrator’s
password.
5
DSA-3200 Wireless Service Gateway User Manual
2 Product Description
2.1 Package Contents
• DSA-3200 Wireless G Public/Private Gateway
• CD-ROM (Administrator’s Manual and Quick Installation Guide)
• Ethernet cable (CAT-5 UTP Crossover)
• Ethernet Cable (CAT-5 UTP Straight-through) (2)
• 2 dBi Detachable R-SMA D-Link Antenna (2)
• 5V DC, 3A Power adapter
• Null modem console cable
• Wall-mount Kit
• Rubber Feet (4)
Note: Using a power supply with a different voltage rating than the one included
with the DSA-3200 will cause irreparable electrical damage and void the warranty
for this product
2.2 System Requirements
• Computer running Microsoft Windows, Macintosh OS, or a UNIX ba sed OS
• An installed Ethernet adapter configured to communicate usin g TCP/IP.
• Internet Explorer 6.0 or Netscape Navigator 7.0 or above, with JavaScript
enabled.
6
DSA-3200 Wireless Service Gateway User Manual
2.3 Panel Function Descriptions
Device LED Indicators
Power LED –
Solid glow when
the DSA-3200 is
powered on.
Status LED –
Solid glow when
device is ready. Will
flash during device
restart or reconfigure.
WAN LE D –
A valid Ethernet Link will
produce a solid glow. The
LED will blink with activity.
Public WLAN LED –
Will flash to indicate
proper RF operation
and blink with activity.
Private LAN LEDs –
A valid Ethernet Link
will produce a solid
glow. The LEDs will
blink with activity.
Public LAN LEDs –
A valid Ethernet Link
will produce a solid
glow. The LEDs will
blink with activity.
Power LED: Will illuminate when the Power Supply is connected to the DSA-3200 and an
appropriate AC power outlet (110VAC). If the LED does not illuminate when the device is plugged
in, try a known good power outlet. If the LED still does not light with a known good outl et, please
contact Technical Support for assistance.
Status LED: A solid light indicates a functional, ready state of operation. This LED will blink
during a device restart or reconfigure, then illuminate solid to indicate proper o peration. If this
LED continuously flashes or does not illuminate when the device is powered on, please contact
Technical Support for assistance.
Public WLAN LED: This indicator will flash to indicate proper RF operation of the internal AP.
The LED will blink rapidly with activity.
WAN LED: A solid light indicates a valid Ethernet Link to the WAN modem/switch. LEDs will blink
to indicate WAN activity. No light indicates a no-link state (no cable or bad cable).
Private/Public LAN LEDs: A solid light indicates a valid Ethernet Link to a hub/switch or PC.
LEDs will blink to indicate activity. No light indicates a no-link state (no cable or bad cable).
7
DSA-3200 Wireless Service Gateway User Manual
pter
g
Device Physical Connections
COM Port -
System debugging
menu via Terminal
Emulation Software
(9600,8,n,1,n)
Public LAN Ports –
Connect to Hub or Switch (non-L3)
and/or 802.11 APs to offer wired or
wireless Network service that will
require a user to authenticate prior
to
aining Network access.
Private LAN Ports –
Connect to the trusted
LAN, or that network which
will not require a user to
authenticate prior to gaining
Network access.
WANPort -
Connect directly to
an Ethernet Cable
or DSL modem or
to an existing LAN
infrastructure.
Reset button –
Restore the factory
default configuration.
Press once to reboot,
press and hold for 15
seconds to reset.
Receptor for
5V DC Power
Ada
Serial COM Port: This port serves two distinct purposes:
1. Connect to a DSA-3100P to auto-generate temporary User accounts and print detailed receipts to
be given to customers. Receipts include pricing and Wi-Fi Network information (SSID, WEP, etc.)
2. Use the included Null modem cable to connect to a PC with a serial COM port in order
troubleshoot, debug, change admin password, or to restore the factory default settings without
using the Web-based UI. Configure Terminal Emulation software (Hyperterminal) as follows: 9600,
8, N, 1, No flow control.
WAN Port: Connect s to a netwo rk not manag ed by the DSA-3200 via an Ethern et port
on most Cable or xDSL modems, or a Switch or Hub in an existing Ethernet Network.
Public LAN Ports (1 and 2): The Public LAN ports connect to the managed network
that will require user authentication prior to granting Network Access. This Network
may consist of Hubs and/or Switches (non-L3) as well as 802.11 Access Points.
Private LAN Ports (1 and 2): The Private LAN port is used to connect to the trusted
Ethernet network that will not require authentication prior to access.
Reset Button: Push and release to restart, push and hold for 15s to reset defaults.
DC Power Socket: Connect the power supply to a wall outlet before connecting here.
8
DSA-3200 Wireless Service Gateway User Manual
3 Managing the D-Link DSA-3200
3.1 Getting Started
This guide will provide information and instruction for administrators of the DSA-3200
Wireless G Public/Private Gateway. This manual corresponds with the version of
firmware shipped with the DSA-3200 (v 1.00). From time to time D-Link may release
new firmware to add new features or improve on existing ones. These firmware
upgrades can be found on the Technical Support Website http://support.dlink.com/
The Support Website also has plenty of great documentation in the way of FAQs and
updated manuals, etc. Please take a moment to visit support.dlink.com prior to
contacting Technical Support.
.
3.2 System Concept
The DSA-3200 has the ability to allow or deny access to Network resources
based on various types of credentials (IP address, MAC address, or
username/password). From a single Broadband Internet connection, the DSA-3200
creates 3 separate networks using NAT, each with its own DHCP server. The WLAN
RF interface is an 802.11b/g network that can be configured to either authenticate
users or use WPA for enhanced wireless security. The Public LAN interface can be
configured to authenticate users so it may serve as a secondary Public access
network. The third Private LAN interface does not authenticate users and is intended
to service the back office or an existing office network.
Authentication of users is accomplished through any Java enabled Web browser. After
a user connects to one of the Public Access networks and attempts to browse the
Internet, they will be redirected to a customizable login page hosted on the DSA-3200
without or without SSL encryption. A Walled Garden may be defined to allow users that
have not authenticated to access those URLs specified in the Free Surf Zone. Once
users authenticate successfully via the Internal Database or an external RADIUS
server, the Web browser will once again be redirected to a specified URL. At this point
9
DSA-3200 Wireless Service Gateway User Manual
the user may freely browse the Internet until the account expires or their connection
remains idle longer than allowed. Limits may be impo sed on how l ong a n accou nt may
be or the length of time a connection remains idle before it is terminated or even the
maximum bandwidth available to the authenticated user.
The DSA-3200 manages all network data that passes through it. Users under the
managed network must authenticate in order to access any network resources. User
authentication is processed via the DSA-3200 Web server with or without SSL
encrypted links. When a user is prompted to login, the DSA-3200 will check the user
database to confirm the user’s access rights. In addition to the internal User database
for local and On-demand users, the DSA-3200 may query any external RADIUS
Server to authenticate and authorize user credentials. If the user fails to successfully
authenticate, the DSA-3200 will refuse access and continue to prompt for user log in. If
the Administrator so chooses, a list of URLs may be provided for free access to users
that have not yet authenticated. Once the user authenticates successfully, the
DSA-3200 will grant limited access based on the group membership of the user and
redirect the web-browser to the administrator defined URL.
The DSA-3200 can be configured to terminate user access if a user request s to log out
or remains idle longer than the configured idle time. Limits can be placed on user
session length as well as maximum bandwidth available to specific user g rou ps.
The system is responsible for user authentication, authorization and management.
The user account information is stored in the local database, or a specified external
databases server. The user authentication is processed via the SSL encrypted web
interface. This interface is compatible to most desktop devices and the palm
computers.
3.3 Begin Installation
Please follow the Quick Installation Guide included with the DSA-3200 to
physically connect the device to the appropriate networks. The QIG also provides
instructions to configure the Network interfaces of the DSA-3200 using the Setup
10
DSA-3200 Wireless Service Gateway User Manual
Wizard. Following completion of the Setup Wizard, configurations pertaining to User
Authentication mechanisms, access privileges, and system management will need to
be made for a fully operational Hot Spot.
Once the Setup Wizard is complete, the DSA-3200 will restart. Depending on what
configurations were made, it may be necessary to login to the Web-UI again. From a
PC connected to the Private LAN interface, open a Web-browser and enter
https://192.168.0.40
(the default Private LAN IP) into the address bar and hit enter.
The Administrator login page should load. Enter the appropriate credentials (default
username is admin password is admin) and click Enter.
.
11
DSA-3200 Wireless Service Gateway User Manual
4 Web Management Interface
This section gives a complete description of the Web Management Interface of the
DSA-3200 on a page-by-page basis. The following table shows all configuration pages
where each column represents each of the Navigation Tabs and the configuration
pages available in each section.
Section Home Advanced Tools Status
Web-UI
Configuration
Page
Wizard
Authentication
Policies
System Group Virtual Server Interface
WAN Black List Pass Through Current Users
On-demand
Public LAN
User
Wireless LAN Roaming
Private LAN Additional Proxy
Port and IP
Redirect
Monitor IP List Traffic History
Free Surfing
Area
DDNS
Change
Password
System
Firmware
Restart
Device Info
Notify
12
DSA-3200 Wireless Service Gateway User Manual
4.1 Home
The Home Tab consists of System and Network Specific configurations. All Interface
information such as IP configuration, DHCP Server configuration, and per port
Authentication features can be accessed through the Home Tab. The Home section
provides the following interface configuration pages to further set up your Airspot
system: Wizard, System, WAN, Public Network, Wireless, and Private Network.
Please refer to each section for more information.
13
DSA-3200 Wireless Service Gateway User Manual
4.1.1 Wizard
The Wizard will guide through the Interface setup of the DSA-3200. All that is
needed is to follow the procedures and instructions as presented by the Wizard, step
by step, filling in all required values. Upon completion, restart the DSA-3200 to activate
any new settings.
Please refer to the Quick Installation Guide for detailed information about running the
Setup Wizard.
14
DSA-3200 Wireless Service Gateway User Manual
4.1.2 System
The System Information page allows configuration of items related to system
management/maintenance. Any changes on this page will also require an entry for
System Name as well as Succeed Page before they can be applied.
System Name: The Host Name of the DSA-3200, the default value is “DSA-3200.”
This field will be used to identify the device through SNMP.
Admin Detail: The text in this box will be displayed when the WAN connection is lost
and unauthenticated users attempt to browse the Internet. Contact information for help
desk/technical representatives should be entered here so customers may inform the
appropriate personnel in the event of failed WAN connectivity.
15
DSA-3200 Wireless Service Gateway User Manual
Succeed Page: Any URL may be entered in this field. Once a user logs in successfully
he or she will be linked to this Succeed page URL automatically. The succeed page is
typically set to the URL of a company website such as http://www.dlink.com
.
Remote Manage IP: The DSA-3200 is able to be configured remotely through the
WAN interface via HTTP, HTTPS, or SSH protocols. Access may be granted to a
single IP address, a single IP Network, or any IP (0.0.0.0/32).
SNMP: The DSA-3200 supports SNMP v2 read-only data access. A Trap Host IP
address and an SNMP community name must be specified for the DSA-3200 to be
successfully managed through SNMP.
Dos Protection for User: The DSA-3200 protects users (when enabled) against
various types of Denial of Service attacks including:
• NMAP FIN/URG/PSH
• Xmas Tree
• SYN/RST
• Ping of Death
• Null Scan
• SYN/FIN
User Logon SSL: When enabled users will be redirected to an HTTPS (SSL
encrypted) log in page, otherwise a standard HTTP login page will be used.
System Time: The DSA-3200 has an NTP client to automatically synchronize the
system time over the Internet from an NTP Server.
16
DSA-3200 Wireless Service Gateway User Manual
Enable NTP: Specify the IP address or domain name of an NTP server here.
Time Zone: Select the appropriate Time Zone of your current location from the
drop down selection box (Universal T ime is Greenwich Mean T i me, GMT).
Set Device Date and Time: Manually configure the DSA-3200 system time.
4.1.3 WAN Configuration
The DSA-3200 supports 3 WAN types: Static IP Address, Dynamic IP Address,
and PPPoE.
Static IP Address: Manually specify the IP address of the WAN Port. This
information will come from your ISP. IP address, Subnet Mask, Default
Gateway, and Primary DNS Server fields must be completed to apply the
settings.
17
DSA-3200 Wireless Service Gateway User Manual
Dynamic IP Address: Use this configuration in situations in which a dynamic IP
address is provided by the ISP (most Cable Internet connections are dynamic).
Renew: Click to refresh the IP address setting, in order to obtain a different IP
address.
PPPoE: Use this configuration in situations where WAN connectivity is enabled
through a PPPoE connection. Account Username and Password are required to
successfully connect. Please verify user credentials for correctness if you are
having difficulty connecting to your ISP.
Dial on Demand: When the Dial on Demand function is enabled under PPPoE,
the system will automatically disconnect the session after an idle time has been
reached equal to the value specified here. This feature is intended for subscription
plans that charge per unit time as opposed to charging for upstream and
downstream connection speeds.
18
DSA-3200 Wireless Service Gateway User Manual
4.1.4 Public LAN Configuration
The DSA-3200 provides a public access network that is tied to the Public LAN
ports on the rear of the device. The Public LAN can be configured to authenticate
users as well as serve DHCP to DHCP enabled clients.
IP PNP: This feature enables those clients that already have Static IP information
configured (IP address, Subnet Mask, Default Gateway, and DNS address) to join the
Public Access Network without having to reconfigure their TCP/IP information. In order
for this feature to function the user must have a default gateway and DNS address
configured.
User Authentication: Enable or Disable user authentication to suit your Hot Spot
Needs. Enabled will redirect all Public LAN users to a login page on their first
web-browsing attempt. Disabled will not require authentication prior to access.
19
DSA-3200 Wireless Service Gateway User Manual
IP Address: Enter the desired IP address for the Public LAN inte rface.
Subnet Mask: Enter the appropriate Subnet Mask for this network.
Related Setup for DHCP Server of Public LAN:
The DHCP Server is optional and may be disabled or enabled at any time.
Disable DHCP Server: The DSA-3200 will not dynamically configure DHCP
clients on the Public LAN.
Enable DHCP Server: The DSA-3200 will dynamically configure DHCP clients
on the Public LAN. The appropriate information is needed for the DHCP server to
function properly. To configure, enter: DHCP Scope Start IP Address; End IP
Address; Primary DNS Server; Secondary DNS Server; Domain Name; WINS
Server; Lease Time; and Reserved IP Address List.
20
DSA-3200 Wireless Service Gateway User Manual
As an option, the DSA-3200 provides a Reserved IP Address List for DHCP clients.
This allows the reservation of specified DHCP Scope IP addresses for specified MAC
addresses. Click the Reserved IP Address List hyperlink to configure.
The Reserved IP Address List provides 40 entries. Enter the desired Reserved IP
Address, client MAC address, and a short description (optional) for each reservation.
After the information is completely entered, click “Apply” to complete the setup.
21
DSA-3200 Wireless Service Gateway User Manual
4.1.5 Public WLAN Configuration
The internal 802.11g Access Point serves as a secondary Public Access network.
The configurations for the Wireless interface will consist of IP and DHCP selections as
well as SSID, Channel, Transmission Mode, SSID Broadcast, and Layer 2 Client
Isolation.
22
DSA-3200 Wireless Service Gateway User Manual
SSID: The SSID is the unique name shared among all devices in a wireless network.
The SSID must be the same for all devices in the wireless network. It is case sensitive
and must not exceed 32 characters (any keyboard character is allowed).
Sync to Ticket: Checking this box will enter the SSID of the internal AP in the
On-Demand User receipt SSID field.
Auto Channel Selection: The system will automatically select the appropriate
channel based on relative noise and interference on available channels when enabled.
Channel: Select the appropriate channel from the list to correspond with your network
settings, between 1 and 11 (North America). Channels 1, 6, and 11 tend to have the
least amount of overlap in the spectrum.
Transmission Mode: There are 3 Wireless modes available: 802.11b (2.4GHz,
11Mbps), 802.11g (2.4GHz, 54Mbps) and Mix mode (b and g)
SSID Broadcast: If enabled, the SSID will be broadcast in most every 802.11 frame.
Disabling this feature removes the SSID from most but not all 802.11 frames to add
privacy to your wireless network. When disabled clients trying to join the Network must
supply the SSID, as it most likely will not show up in normal Site Survey scans.
Layer 2 Client Isolation: Enabling this feature prevents wireless clients connected to
the Internal AP from communicating with one another. This is to ensure the privacy
and safety of all guests who use the wireless public access network.
Security: The Security screen is where Wired Equivalent Privacy can be enabled and
configured if so desired. Click the Security Hyperlink.
23
DSA-3200 Wireless Service Gateway User Manual
WEP Key: Choose to enable or disable WEP on the internal AP. If enabled, any
user attempting to communicate on the wireless network must have the
corresponding WEP key configured on their WLAN adapter.
WEP Key Encryption: Choose between a 64-bit (10 HEX or 5 ASCII) or 128-bit (26
HEX or 13 ASCII) WEP key.
Mode: Choose the key format of preference, either HEX (0-9, a-f) or ASCII (any
ASCII character).
The Advanced menu allows fine-tuning of the RF characteristics for the internal AP.
In most cases the default settings offer the best performance.
24
DSA-3200 Wireless Service Gateway User Manual
Authentication Type: The default value of Auto allows the AP to auto-detect for
Shared Key or Open System Authentication types. Shared Key requires both the AP
and Client to share a common WEP key (usually Key 1) before the Client can join the
Network. Open Key allows any Client to associate with the AP, however if WEP is
enabled the client will not be able to communicate unless the correct WEP Key is
supplied.
Transmission Rates: The default value of Auto allows data rates to range from 1 to
54Mbps. The rate of data transmission should be set depending on the speed of your
wireless network. You can select from a range of transmission speeds, or you can
keep the default setting of Auto to have the Access Point automatically select the
fastest possible data rate with an Auto-Fallback feature. Auto-Fallback will negotiate
the best possible connection speed between the Access Point and a wireless client.
CTS Protection Mode: The default setting is Disabled. When set to Auto, a
protection mechanism will ensure that your Wireless-B devices will connect to the
Access Point when Wireless-G devices are present. Keep in mind that the
performance of your Wireless-G Network may decrease as a whole to accommodate
the slower legacy client.
Basic Rates: The default value is Default. Depending on the wireless mode you have
selected, a basic set of supported data rates will be selected. The default setting will
ensure maximum compatibility with all devices. You may also choose to enable all
data rates by selecting ALL. For compatibility with former Wireless-B devices, select
1-2Mbps.
Beacon Interval: This value indicates the frequency interval of the 802.11 Beacon
Frame. The default value is 100 milliseconds. You may enter a value between 20 and
1000 milliseconds. A beacon is a packet broadcast by the Access Point to synchr onize
the wireless network.
25
DSA-3200 Wireless Service Gateway User Manual
RTS Threshold: This value should remain at its default setting of 2346.Should you
encounter inconsistent data flow, only minor reductions are recommended.
Fragmentation Threshold: This value specifies the maximum size for a packet
before data is fragmented into multiple packets. It should remain at its default setting
of 2346. A smaller setting means smaller packets, which will create more packets for
each transmission. Only minor reductions of this value are recommended.
DTIM Interval: The default value is 3. This value, between 1 and 255 milliseconds,
indicates the interval of the Delivery Traffic Indication Message (DTIM). A DTIM field is
a countdown field informing clients of the next window for listening to broadcast and
multicast messages. When the Access Point has buffered broadcast or multicast
messages for associated clients, it sends the next DTIM with a DTIM Interval value.
Access Point Clients hear the beacons to be informed they will receive broadcast and
multicast messages.
IP PNP: Enable this feature to allow Clients configured with Static IP Addresses to be
Dynamically routed to the Internet. Client reconfiguration is not necessary with this
feature enabled, as long as the Client has Static values for IP Address, Subnet Mask,
Default Gateway, and DNS Server Address they will be able to login to the Network
and Browse the Internet without changing their IP information.
User Authentication: You can choose to Enable or Disable user authentication for the
Wireless Interface.
IP Address: Enter the desired IP address for the Wireless Interface. This will be the
default gateway for the Wireless Network.
26
DSA-3200 Wireless Service Gateway User Manual
Subnet Mask: Enter your desired Subnet Mask to determine the size of the Network
the Interface may communicate with.
Related Setup for DHCP Server of Public Wireless LAN:
The DHCP Server is optional and may be disabled or enabled at any time.
Disable DHCP Server: The DSA-3200 will not dynamically configure DHCP
clients on the Public Wireless LAN.
Enable DHCP Server: The DSA-3200 will dynamically configure DHCP clients
on the Public Wireless LAN. The appropriate information is needed for the DHCP
server to function properly. To configure, enter: DHCP Scope Start IP Address;
End IP Address; Primary DNS Server; Secondary DNS Server; Domain Name;
WINS Server; Lease Time; and Reserve d IP Address List.
27
DSA-3200 Wireless Service Gateway User Manual
As an option, the DSA-3200 provides a Reserved IP Address List for DHCP clients.
This allows the reservation of specified DHCP Scope IP addresses for specified MAC
addresses. Click the Reserved IP Address List hyperlink to configure.
The Reserved IP Address List provides 40 entries. Enter the desired Reserved IP
Address, client MAC address, and a short description (optional) for each reservation.
After the information is completely entered, click “Apply” to complete the setup.
28
DSA-3200 Wireless Service Gateway User Manual
4.1.6 Private LAN Configuration
The DSA-3200 provides a private trusted network that is tied to the Private LAN
ports on the rear of the device. The Private LAN does not require user authentication
prior to access. The Private LAN may be configured to serve DHCP to DHCP enabled
clients.
IP Address: Enter the desired IP address for the Private LAN Interface. This will be
the default gateway for the Private Network.
Subnet Mask: Enter your desired Subnet Mask to determine the size of the Network
the Interface may communicate with.
29
Loading...
+ 83 hidden pages
You need points to download manuals.
1 point = 1 manual.
You can buy points or you can get point for every manual you upload.