ShareTech LB-1105 User Manual

LB-1105 User Manual
LB-1105 User Manual
Copyright Notice
Copyright Incorporated 2000-2008. All rights reserved.
Disclaimer
Incorporated shall not be liable for technical or editorial errors or omissions contained herein; nor for incidental or consequential damages resulting from furnishing this material, or the performance or use of this product. Incorporated reserves the right to change the product specification without notice. Information in this document may change without notice.
Trademarks
Microsoft, Windows 95, 98, ME, 2000, NT, and XP are registered trademarks of the Microsoft Corporation. All other brand and product names mentioned herein may be registered trademarks of their respective owners.
Customers should ensure that their use of this product does not infringe upon any patent rights. Trademarks mentioned in this publication are sued for identification purposes only and are properties of their respective companies.
LB-1105 User Manual
Table of Contents
Introduction ......................................................................................................................5
Features ............................................................................................................................5
Minimum Requirements...................................................................................................6
Hardware ..........................................................................................................................6
Installation........................................................................................................................6
Configuring the Clients....................................................................................................7
Status ................................................................................................................................8
System Profile ..........................................................................................................8
PPTP Server Tunnels ............................................................................................9
PPTP Client Tunnels ..............................................................................................9
Online Users.............................................................................................................9
L2TP Server Tunnels .............................................................................................9
IPSec Tunnels........................................................................................................10
DHCP IP Assignment...........................................................................................10
DDNS........................................................................................................................10
Network Setup................................................................................................................11
WAN Interface........................................................................................................11
Virtual Server..........................................................................................................12
Software DMZ ........................................................................................................12
Multi-DMZ................................................................................................................13
LAN Interface..........................................................................................................13
Destination Route..................................................................................................14
DDNS........................................................................................................................14
Alias IP .....................................................................................................................15
Wireless..........................................................................................................................15
WDS...............................................................
...........................................................15
Settings ....................................................................................................................16
Security ....................................................................................................................18
MAC Filter................................................................................................................19
Firewall...........................................................................................................................20
Special Rules..........................................................................................................20
Service Management ...........................................................................................21
MAC Filter................................................................................................................22
Access Rules..........................................................................................................23
Traffic Control ...............................................................................................................24
Service Management ...........................................................................................24
Link Bandwidth.......................................................................................................24
IP Management......................................................................................................25
VPN................................................................................................................................26
LB-1105 User Manual
Users.........................................................................................................................26
PPTP Client ............................................................................................................26
PPTP.........................................................................................................................28
L2TP .........................................................................................................................28
IPSec ........................................................................................................................29
Access Control ...............................................................................................................30
RADIUS....................................................................................................................30
Local Account.........................................................................................................31
Authentication Setting ..........................................................................................32
Log .................................................................................................................................33
View Log ..................................................................................................................33
Log Setting ..............................................................................................................33
System Service...............................................................................................................34
Version .....................................................................................................................34
UPNP........................................................................................................................35
Time ..........................................................................................................................35
Restore.....................................................................................................................37
Diagnostic................................................................................................................37
Centralized Control ...............................................................................................38
Backup .....................................................................................................................38
Administrator...........................................................................................................39
MISC ..............................................................................................................................40
Reboot......................................................................................................................40
Logout.......................................................................................................................40
LB-1105 User Manual
Introduction
The Wireless Guard features zero configuration connectivity, which means that as an administrator you do not need to reconfigure every computer’s TCP/IP information, which attempts to connect to your network. However, given the simplicity of connecting, other access control methods needed to be designed. The Wireless Guard solves this solution by requiring all users to authenticate themselves before they are allowed to use the Internet. Authentication is simple and easy, all users need to attempt to connect to some web site, and the Wireless Guard will automatically redirect them to an authentication page, where they enter their username and password. If the administrator should so choose, the Wireless Guard will also verify if the MAC address of the computer attempting to connect with a specific username and password is valid, denying access if not. Once the user has authenticated himself with the Wireless Guard, he will be redirected to his originally intended website, if it is a legal URL, and his computer is now free to use other services such as email and instant messaging. The last of which is of course at the discretion of the network administrator as the Wireless Guard can be configured to block services with its firewall capabilities.
Features
z Zero configuration connectivity z Simple and powerful access control system z Supports up to 128bit-WEP encryption z Supports IPSec and PPTP pass through z Configurable as a DHCP server z Port Filtering, MAC address filtering z Universal Plug and Play z Remote administration z PPTP VPN tunneling for wireless clients z Software DMZ z Port forwarding z NAT firewall
LB-1105 User Manual
Minimum Requirements
One PC equipped with:
o TCP/IP Protocol o A web browser o An Ethernet adapter with a UTP CAT 5 network cable OR A
wireless Ethernet adapter supporting 802.11n.
Internet access via cable modem or DSL modem with an Ethernet connection.
Hardware
The Wireless Guard has 6 LEDs on the front panel, 4 of which are network connection LEDs which correspond to network connections made by connecting cables to the LAN interfaces (Green) of the device. They are paired to show connectivity and whether the link is a 10 megabit or 100 megabit connection. One LED corresponds to the connection to the WAN interface (Green), and whether its link is 10 megabit or 100 megabit respectively. One LED for power (Blue).
Installation
Installation of the Wireless Guard is simple:
1. Plug in the network cable from the WAN interface of the Wireless Guard to
your DSL modem or cable modem.
2. Plug in a network cable from your computer to one of the four LAN interfaces
on the Wireless Guard OR configure your computer’s wireless interface to
use the Wireless Guard which has a default SSID of “AP001”. You do not
need to change your computer’s TCP/IP settings in either case.
3. Plug in the power to your Wireless Guard.
4. The Wireless Guard comes with default DHCP server enabled for range
(192.168.1.2- 192.168.1.254), Set the networking TCP/IP properties of the
system connected to Wireless Guard to get IP automatically from the DHCP
server. The Wireless Guard will assign a IP address to the connected PC.
5. Open a web browser. Change the URL shown at the top to use port 9953 by
typing http://192.168.1.1:9953
6. Once you have hit enter, the Wireless Guard will prompt you to enter a
username and password. The default username and password to log into the
administrative user interface is admin and admin.
LB-1105 User Manual
7. Once you login you will see the administrative interface to configure.
8. Click on Network Setup>Click on WAN Interface.
9. Select the radio button corresponding to your type of network connection.
10. Enter the pertinent information.
DSL providers generally use PPPoE connections, in which case you
have a username and password.
Cable modem providers generally use DHCP connections, in which
case you do not need to provide anymore information to connect.
DSL and cable modem providers sometimes provide static IP services
as well as other type of installations. This will require the Fixed IP
setting and you will need to provide the IP, net mask, and gateway for
the Wireless Guard.
11. When you are done, you can logout or just attempt to connect to the Internet.
You must always authenticate yourself using the web interface before other
services will be available to you.
Configuring the Clients
Clients using the Wireless Guard as a gateway do not need any special configuration unless you are planning to use them as virtual servers. If you are planning on making a virtual server out of one of the computers in your local area network (LAN), you will need to know how to change the IP, net mask, and gateway of your client computer, or at least know how to get that information to update your Wireless Guard should your IP, net mask, and gateway of your virtual server should ever change.
LB-1105 User Manual
Status
The status pages of the Wireless Guard Web-based User Interface allow the administrator to quickly gather information about the workings of the Wireless Guard, what users are using the Wireless Guard, and other important at-a-glance information.
System Profile
This page shows the administrator basic network information about how the Wireless Guard is configured.
LB-1105 User Manual
PPTP Server Tunnels
This page shows all the PPTP VPN tunnels connected to Wireless Guard. The Wireless Guard supports PPTP VPN tunneling to both clients in its LAN and WAN.
PPTP Client Tunnels
This page shows all the PPTP Client tunnels connected to UTM6000i. If everything is configured correctly, you should see a green bar under Tunnel Status which indicates an established tunnel.
Online Users
This page shows what users are connected through the Wireless Guard, their username, login time, what service they are currently using, their MAC and IP address, the remote server they are connected to, and how much of the bandwidth they are using. Users that are highlighted have been configured by the administrator to use MAC binding and their connections will not be timed out.
L2TP Server Tunnels
This page shows what L2TP VPN tunnels are connected to the Wireless Guard.
LB-1105 User Manual
10
IPSec Tunnels
This Page shows the status information of IPSec Tunnels. As you can see, the tunnels on the list could be enabled or disabled, removed or edited. Just click on the option buttons to perform those actions.
DHCP IP Assignment
This page shows what IP addresses have been assigned by the Wireless Guard and to which MAC addresses they have been assigned.
DDNS
Under this page, the administrator can setup a DDNS service. This is very useful if you want to use the WG100n as your gateway but the IP you get from your ISP is not static. This page allows you to set the DDNS update and data refresh rate on a minute and second base.
LB-1105 User Manual
Network Setup
Under these pages, the administrator could configure the network interfaces.
WAN Interface
This page allows the administrator to configure the WAN interface. Just pick the desired mode to get WAN’s IP and enter the pertinent information for that option. Click on “Update” to finalize the configuration.
LB-1105 User Manual
Virtual Server
This page allows the administrator to forward ports to computers with virtual IPs in the LAN. This is used for creating virtual servers in your LAN and will work with DHCP assigned IPs, however we recommend that you use a static virtual IP for dedicated virtual servers. Using this page the administrator can forward a range of ports or a single port to a computer in the LAN.
Software DMZ
This page allows the administrator to add computers into the software DMZ. The Wireless Guard is designed such that the software DMZ supports only IP addresses that are in the subnet of the WAN interface. If you wish to put servers into your LAN using a virtual IP, please see the section on One to One NAT. Computers in the software DMZ cannot connect to the Wireless Guard administration page.
LB-1105 User Manual
13
Multi-DMZ
This function allows the administrator to map real IP addresses to virtual IP addresses in the LAN of the device. This is a one to one correspondence, meaning one virtual IP address maps to one virtual IP address. Users on the Internet can connect to the real IP address to connect to these computers’ services, such as a web server or email server. LAN users can use the virtual IP or the corresponding real IP address to access the server.
The IPs of the machines Multi-DMZ must be in the same subnet of the WAN IP
LAN Interface
This page allows the administrator to configure the LAN interface and DHCP server. Enter pertinent information for all the fields and click “Update” to finalize the configuration. Administrator could enable or disable the DHCP server, assign fixed IP for a specific MAC address and control the PnP mechanism.
LB-1105 User Manual
14
Destination Route
This function allows the administrator to route packets through a user­defined route. This is convenient when you have more than one subnet under the machine. Enter the destination IP and the gateway IP for that destination machine and the packets will be routed correctly
DDNS
The DDNS function allows you to, virtually, bind a DNS to any dynamic IP. To do this, you must employee the server of some DDNS servers. Under this page, the administrator can fill in the Designated Name DDNS Server
User NamePasswordIP Address and Domain Name in the page, or click the Status> DDNS to inquire, delete, or modify. The username and
password must be acquired from any of the DDNS server on the menu by applying for their service.
LB-1105 User Manual
Alias IP
Alias IP function allows the administrator to set more than one IP for the LAN interface. In effect, the machine can have more than one LAN subnet. Use the following picture as an example; you can see that an Alias IP of
172.16.2.254/24 has been set for this machine. This allows any pc within the IP range of 172.16.2.1/24~172.16.2.253/24 to connect to this machine and also enjoy all the services this machine provides.
Wireless
WDS
The basic principle of WDS is to send the data to a Wired Network by using the wireless connection. The virtual network is composed by wireless network, so it is called WDS. WDS is usually one to one, but WDS can also bring one to many and the target can be a Wireless Network card or a wired system. WDS should at least have two AP with the same functions. Under this page, the administrator can Disable or Enable WDS and fill in pertinent MAC address to the field. Hit the “Update" button to finalize the configuration.
LB-1105 User Manual
16
Settings
This page allows the administrator to configure the basic settings of the wireless interface. Choose to enable or disable to interface and then enter the pertinent information for each field. Click on “Update” to finalize the configuration.
ESSID: The service set identifier (SSID) or network name. It is case sensitive,
must not exceed 32characters and may be any keyboard character. You shall have selected the same SSID for all the APs that will be communicating with mobile wireless stations
Broadcast SSID: Default value is “Visible” so that wireless client can see SSID
in site surveys. If “Invisible” is selected, Wireless client will not see SSID in site surveys. Wireless client have to manually enter SSID to access wireless network.
AP Operational Mode: Support wireless interface mode 802.11b, 802.11g,
802.11n and mixed mode 802.11b/g, 802.11g/n, 802.11b/g/n.
LB-1105 User Manual
17
Channel: Select the appropriate channel from the list provided to correspond
with your network settings. You shall assign a different channel for each AP to avoid signal interference. If “Auto” is selected, it will auto scan all channel and auto select one to use.
Channel Width: This field only available when 802.11n mode is selected. When
in 802.11n mode. You can select channel width 20MHz, 20/40MHz, or 40MHz.
Extension Channel Offset: This field only available when 802.11n mode is
selected and channel width is 40MHz only. You can select channel offset to PLUS or MINUS.
Preamble Type: The default value is “Short”. It defines the length of the CRC
(Cyclic Redundancy Check) block for communication between the Access Point and roaming wireless adapters.
Beacon Interval: The default value is “100”. It used to synchronize a wireless
network from Access Point.
Fragmentation Threshold: The default value is “2346”.It used to divide 802.11
frames into smaller pieces.
RTS Threshold: The default value is “2347”. It used to minimize collisions
among wireless stations.
DTIM Interval: The default value is “3”. DTIM(Delivery Traffic Indication Message)
is a countdown informing clients of next messages.
Client Isolation: This field allows you to prevent wireless client from
communicating with each other.
Protection Mode: .This function used to improve the 802.11g performance in
802.11 mixed environments.
Frame Burst: This setting can speed up data transmissions if you have a small
network and all of your clients support Frame Burst.
WMM: .This field WMM(Wi-Fi Multimedia) is used to support higher audio/video
priority for media streaming.
WMM No-Acknowledgement: No-Acknowledgement refers to the acknowledge
policy used at the MAC level. Enabling no-acknowledgement can result in more efficient throughput but higher error rates in a noisy Radio Frequency (RF) environment.
LB-1105 User Manual
Security
This page allows the administrator to configure the security settings of the wireless interface.
WPA
WPA (Wi-Fi Protected Access) applies IEEE802.1x and Extensible Authentication Protocol (EAP) to authenticate wireless clients using an external RADIUS database. WPA improves data encryption by using Temporal Key Integrity Protocol (TKIP), Advanced Encryption Standard (AES). TKIP uses 128-bit keys that are dynamically generated and distributed by the authentication server.
WEP
WEP(Wired Equivalent Privacy) encrypts data frames before transmitting over the wireless network.
802.1x Authentication
Support wireless authentication with remote RADIUS server. Now only support with encryption WEP, WPA.
LB-1105 User Manual
19
MAC Filter
Filter traffic from wireless according by wireless MAC address. Now support
White List or Black List
LB-1105 User Manual
Firewall
Special Rules
This page allows the administrator to refine existing rules to exclude or include specific machines, for finer control over the firewall. Administrators can use the functionality of this page to deny access to certain services/ports for specific segments of their network while allowing access to the rest. Conversely, administrators can also use the functionality of this page to limit access to a specific machine or machines. Just select the Action to be “Deny” or “Allow” and then enter pertinent Source and Destination IP range and then click on “Add” to see the new rule being added to the “Network Access Rule List.” To delete a rule on that list, just check the corresponding “Delete” box on the list and then click “Delete” at the bottom of the page. Multiple rules can be deleted at the same time.
LB-1105 User Manual
Service Management
This page allows the administrator to add new port filtering rules or remove existing rules on the Wireless Guard, as well as enable or disable the firewall entirely. There are two default rules for the firewall that cannot be deleted, ICMP and other services. ICMP allows ping, and other services opens the port filtering firewall entirely. To add more services to the firewall select it from the common service menu, or enter it manually using the user-defined service. Then click Add to see the new rule being added on the “Service List” near the bottom. To delete a rule on the Service List, just check the corresponding “Delete” box and then click on “Update” to delete the selected rule. More than one rule can be deleted at the same time.
LB-1105 User Manual
22
MAC Filter
Filter traffic from LAN to WAN according by Ethernet MAC address.
Provide MAC filter function to enable/disable.
Provide each MAC filter item to enable/disable.
To allow or deny traffic when packets match Ethernet MAC address.
Provide Add/Update/Delete function.
LB-1105 User Manual
Access Rules
This page allows the administrator to enable or disable existing port filtering rules on the Wireless Guard. To allow the packets of a specific service, simply check the box next to the service/port listed and click update at the bottom. To disallow packets of any service, uncheck the box next to the service/port listed and click update.
LB-1105 User Manual
Traffic Control
The Traffic control feature is a unique and special service. It allows the administrator to control and use the bandwidth as per the needs.
Service Management
The Traffic control service management screen allows the administrator to set upper and lower bandwidth limit for each service and protocol. These rules can be selected from the “Common Services” drop-down menu or defined by the administrator. After selecting a rule or defining one, set the priority and bandwidth and then click “Add” to add the rule.
Link Bandwidth
This Option allows to Enable or Disable the traffic control feature. The bandwidth of up- and down- links of the WAN provided by the ISP have to be specified as shown:
LB-1105 User Manual
25
IP Management
This function allows the administrator to set traffic limit on a specific IP address. Select the specific service to set the limit on, enter the IP address and its range, set the priority and then finally set the traffic limit for both upload link(LAN to WAN) and download link(WAN to LAN). Click on Update to finalize the configuration.
LB-1105 User Manual
VPN
The Wireless Guard features a built-in PPTP VPN server, allowing clients in both the LAN and WAN to build PPTP tunnels to the Wireless Guard.
Users
This page allows the administrator to add or remove PPTP/L2TP VPN users. To add a new user, just enter the username, password and verify it, then select the connection type and the click “Update” to add the user to the “Users List” at the bottom. To delete a user from the list, check the corresponding “Delete” box of the user on the “Users List” and then click “Update” again to delete it.
PPTP Client
PPTP client supports LAN to LAN data transfer. That is, when connected with a PPTP server, the pc under PPTP client’s LAN could access the machines under the PPTP server’s LAN over a PPTP tunnel. To configure this function, please follow these steps:
Step1. Please go to the VPN -> PPTP Client page. Under this page, you could configure a PPTP tunnel.
Status decides whether or not the system will automatically attempt to establish this PPTP tunnel. Save and Connect means that automatic attempt at the end of the configuration while Save and Connect Later means the opposite. Using the picture below as an example you would see that the Status is Save and Connect.
LB-1105 User Manual
27
Tunnel Name is pretty self-explanatory. It is just the name of this tunnel. In our example, it is Test.
Interface allows you to specify which interface to use for establishing this PPTP tunnel. The usual choice is WAN1.
Server IP is the IP of the PPTP server. In this example, the PPTP server IP is
192.168.123.251.
Account is the user name of the PPTP account on the PPTP server. It is “test” in our example.
Password is the password of the PPTP account on the PPTP server. It is also “test” in this case.
MTU option allows you to set a range between 1400 and 1492. In this case, 1452, the default value, is used.
Remote Subnet is the LAN of the PPTP server. In this case, it is 12.16.1.0/24. Once you are done, click on Update to finalize the setting.
LB-1105 User Manual
PPTP
This page allows the administrator to configure the PPTP VPN function of the box. Choose to enable or disable this mechanism, specify the IP addresses allowed to access through PPTP for “PPTP Remote IP” and choose the desired options for the PPTP settings and then click on “Update” to finalize the configuration.
L2TP
This page allows the administrator to setup the L2TP VPN function of the machine. Choose to enable or disable this mechanism. If enabled, you need to specified the IP’s allowed for access through L2TP. Select the desired setting for L2TP setting and then click on “Update” to finalize the configuration.
LB-1105 User Manual
29
IPSec
This is a powerful and secure setting allows the administrator to secure the IP and upper layer protocols. This ensures a secure authentication, integrity and confidentiality of the network communication. The Wireless Guard supports the tunnel mode IPSec where the IP datagram is fully encapsulated by a new IP datagram using the IPSec protocol. Steps to using this feature:
First enable the IPSec option as shown below
Next specify the name of tunnel, pre-shared key, IP address of the remote VPN gateway as shown below
LB-1105 User Manual
30
Access Control
This function allows the administrator to control user’s access to the Internet through Wireless Guard. When the authentication mechanism is enabled, the user’s browser will be redirected to an authentication page where they will have to enter a valid account name and password to get access to the Internet. Once authenticated, the user will get access to the internet instantly and a small window will pop up to show the user the remaining credit.
RADIUS
The radius feature is an optional setting for those who want to use an external Radius server as their authentication system in place of the authentication system provided by the device. Radius setup:
This page allows the administrator to setup the RADIUS server for CHAP or PAP authentication methods by selecting the Enable check-box. There are primary and secondary Radius Server options. Enter the pertinent information for each fields and then click on “Update” to finalize the settings.
The NAS (Network Access Server)-Identifier attribute is used during AAA process between the RADIUS server and client. Please note that some RADIUS requires this attribute and some does not. If this attribute is required, then you must input the correct NAS identifier. If this attribute is not required by the RADIUS server, then please input
Default for this field.
NOTE: The request to secondary RADIUS server is sent only when
the Primary RADIUS server is down. The Radius configuration is tested to work fine with Free RADIUS a high-performance and highly configurable RADIUS server.
LB-1105 User Manual
31
Local Account
This page allows the administrator to create an user account and also has option to bind the accounts to MAC addresses of the user. Just enter the username, password, access time allowed (credit, the amount of internet access time this user has), and the binding MAC if there is one, and then click on “Add” to add the user account. To delete an user, check the corresponding “Delete” box on the Account List and then click on “Delete” at the bottom.
LB-1105 User Manual
32
Authentication Setting
This page allows the administrator to choose Authentication Type. Users have to be authenticated to get access to the Internet.
Options:
Disable: choose this option to turn off the authentication mechanism. The
users will not have to be authenticated to get Internet access.
Local Account: When this option is enabled, the user will have to enter
valid account name and password stored on the Wireless Guard.
Radius: When this option is enabled, the users are authenticated through a
RADIUS server connected to the Wireless Guard.
LB-1105 User Manual
Log
View Log
This page displays the log of the Wireless Guard.
Log Setting
This page allows the administrator to configure the logging function of the WG100n. To enable this mechanism, choose the enable it, set the log schedule and choose the log matching criteria and the click “Update” to finalize the setting.
LB-1105 User Manual
34
System Service
Version
Under this page, the administrator could view the version number of the machine and also upgrade the machine using a .dat file from the local machine. To upgrade, first click on “Browse” to see a menu of working directory on the local machine pop up. Open the file to upgrade and then click “Update” to upgrade the machine.
LB-1105 User Manual
35
The above message will appear on the screen during the upgrade. Please follow the instruction to ensure a successful upgrade.
UPNP
This page allows the administrator to enable or disable the UPNP functionality of the Wireless Guard.
Time
Under this page, the administrator could set the time zone for the machine. Just select the pertinent time zone and time server, if there is one, from the drop down menu and then click “Update” to finalize the settings.
LB-1105 User Manual
36
LB-1105 User Manual
Restore
This page allows the administrator to restore settings from a backup file to the Wireless Guard. Click on “Browse” and a menu of working directory on the local machine will pop up. Open the file to restore and then click on “Restore” to restore the machine. The “Restore Default” button allows the administrator to restore the machine to default setting.
Diagnostic
Under this page, the administrator could use some web diagnostic tools to diagnose the machine. First, choose the network diagnose tools, put in the IP or Domain Name, then click on the Update button to see the result.
LB-1105 User Manual
38
Centralized Control
CMS is called Centralized Management System. This system allows the administrator to centralize and remotely control any Firewall or VPN products such as WG100n and VPN series, etc. However, before a WG or any product can be managed by a CMS , the administrator must use this page to do some configuration. The administrator must enable this function, enter the CMS’s IP and the Target ID. For example, if the administrator enters Target1 for this particular machine, then this ID will show up the CMS it points to. That is, the administrator will be able to see a machine called
Target1 on the CMS.
Backup
This page allows the administrator to backup the machine’s settings and save those settings into a file to save on his local computer. To back up, select “Yes” for “Backup Now” option and then click on “Update” for an instant back up. To schedule periodical back up, enable the “Backup Schedule” and the set the time interval between each backup and click “Update” to finalize it.
LB-1105 User Manual
39
Administrator
This page allows the administrator to change information about the administrator account, as well as open the Wireless Guard for remote administration. Just enter the new information and check the desired options then click on “Update” to make to change.
LB-1105 User Manual
40
MISC
Reboot
This function allows the administrator to reboot the box from the User Interface.
Logout
This function allows the administrator to logout the box from the User Interface.
Loading...