IMPORTANT!
READ CAREFULLY BEFORE USE.
KEEP THIS GUIDE FOR FUTURE REFERENCE.
This is a User’s Guide for a system managing a series of products. Not all products support all features.
Menushots and graphics in this book may differ slightly from what you see due to differences in release
versions or your computer operating system. Every effort has been made to ensure that the information
in this manual is accurate.
Related Documentation
•Quick Start Guide
The Quick Start Guide shows how to connect the managed device, such as the Nebula AP, switch or
security gateway.
•More Information
Go to support.zyxel.com to find other information on the NCC
.
NCC User’s Guide
2
Table of Contents
Table of Contents
Table of Contents.................................................................................................................................3
Part I: User’s Guide............................................................................................ 6
AP ........................................................................................................................................................31
6.3 Create Site .................................................................................................................................... 123
7.1 Getting More Troubleshooting Help ........................................................................................... 137
Appendix A Customer Support ..................................................................................................... 138
Appendix B Legal Information ....................................................................................................... 144
NCC User’s Guide
5
PART I
User’s Guide
6
1.1 NCC Overview
The Zyxel Nebula Control Center (NCC) is a cloud-based network management system that allows you
to remotely manage and monitor Zyxel Nebula APs, Ethernet switches and security gateways. Being a
SaaS (Software as a Service) solution, it provides access to the licensed software and applications on a
subscription basis over the Internet.
Each Nebula managed device needs to have a management license. To extend the license before it
expires, contact your vendor for further information. At the time of writing, the supported Nebula
devices are NAP102, NAP203, NAP303, NAP353, NSW100-28P, NSW200-28P and NSG100.
Feature support includes:
• System accounts with different privilege levels
• Site Administrator: manage one site
• Organization Administrator: manage one or multiple organizations
• Multi-tenant management
• Inventory and license management
• Alerts to view events, such as when a device goes down
• Graphically monitoring individual devices
• Securely managing Nebula devices by using the Network Configuration Protocol (NETCONF) over TLS
CHAPTER 1
Introduction
1.1.1 Relationship between Organizations, Sites and Accounts
In the NCC, a site is a group of devices and an organization is a group of sites. To use the NCC to
manage your Nebula devices, each device should be assigned to a site and the site must belong to an
organization.
• A site can have multiple Nebula devices, but can only belong to one organization.
• A site can be managed by more than one site/organization administrator.
• An organization can contain multiple sites and can be managed by more than one organization
administrator.
• A myZyXEL.com account can be an organization administrator and/or site administrator in the NCC
(see Section 6.8 on page 130).
• An organization administrator can manage more than one organization. The organization
administrator that manages multiple organizations can see a MSP portal page (see MSP Portal on
page 11).
• A site administrator can manage more than one site.
NCC User’s Guide
7
Chapter 1 Introduction
Site A
Site B
In the following example, Nebula managed devices, such as the NAP102 or the NSW100-28P, are
deployed in two separate networks (Site A and Site B). With the NCC organization administrator
account, you can remotely manage and monitor all devices even when they are located at different
places.
Figure 1 NCC Example Network Topology
NCC User’s Guide
8
Chapter 1 Introduction
1.2 Getting Started
You can perform network management by the NCC using an Internet browser. Browsers supported are:
• Firefox 36.0.1 or later
• Chrome 41.0 or later
• IE 10 or later
1.2.1 Create MyZyXEL.com Account
First, use myZyXEL.com to create an account in order to log into NCC and manage Nebula devices over
networks.
1Open your web browser and go to https://portal.myzyxel.com.
2Sign in with your email and password. Click Not a Member Yet if you don't have a myZyXEL.com account
and create an account.
1.2.2 Connect Nebula Managed Devices
Connect your Nebula managed devices (such as the NAP102 or the NSW100-28P) to your local network.
Your local network must have Internet access. See the corresponding Quick Start Guides for hardware
connections.
1.2.3 Access the NCC Portal
Go to the NCC portal website.
1Type http://nebula.zyxel.com in a supported web browser. Log into the NCC with your myZyXEL.com
account.
NCC User’s Guide
9
Chapter 1 Introduction
2If this is the first time you have logged into NCC, you need to create your organization and site(s),
register Nebula devices and associate them with a site. See Chapter 6 on page 119 for detailed
information.
1.3 NCC Portal Overview
The NCC portal screen is divided into these parts:
NCC User’s Guide
10
Figure 2 NCC Overview
A
B
C
Chapter 1 Introduction
•A - Title Bar
•B - Navigation Panel
• C - Main Screen
1.3.1 Title Bar
Select the organization and site you want to manage. If you create multiple organizations, select MSP
Portal from the Organization drop-down list box to view your organization summary.
Figure 3 NCC Title Bar
MSP Portal
The MSP (Managed Services Provider) Portal option is available only for an organization administrator
account which manages more than one organization. Click the organization entry you want to
manage and go to its SITE WIDE > Dashboard screen.
NCC User’s Guide
11
Chapter 1 Introduction
Figure 4 NCC MSP Portal
The following table describes the labels in this screen.
Table 1 NCC MSP Portal
LABELDESCRIPTION
StatusThis shows whether the organization is online (green), has generated alerts (yellow), goes
off-line (red) or has been off-line for at least six days (gray).
OrganizationThis shows the descriptive name of the organization.
License StatusThis shows whether the license is valid (ok), will expire soon or has expired. It shows Warning
if the license should be renewed within one month.
License expirationThis shows the date when the license will expire, or N/A when there is no Nebula device in
SiteThis shows the number of sites belonging to this organization.
DeviceThis shows the number of Nebula devices in this organization which are online (green), have
NAPThis shows the number of Nebula APs connecting to the sites in this organization.
NSWThis shows the number of Nebula switches connecting to the sites in this organization.
NSGThis shows the number of Nebula security gateways connecting to the sites in this
the organization.
generated alerts (yellow), go off-line (red) or have been off-line for at least six days (gray).
organization.
Login Account
Click your login account at the top right hand corner of the screen to display a menu, where you can
click a link to view your account profile settings, login history, active sessions or log out of the NCC portal.
Figure 5 NCC Login Account
Alert
Click the alert icon to view log messages for the selected organization and site. You can click the
message record to go to the Dashboard or Event Log page.
NCC User’s Guide
12
Figure 6 NCC Alert
1.3.2 Navigation Panel
Use the NCC menu items to configure network management for each site, organization and/or Nebula
device.
Table 2 NCC Menu Summary
LEVEL 1LEVEL2/LEVEL3FUNCTION
SITE-WIDEUse these menus to view information on all Nebula managed devices that
Monitor
DashboardUse this menu to view device connection status and traffic summary.
Summary
Report
Map & Floor
Plan
TopologyUse this menu to view the site’s network topology.
Configure
General Setting Use this menu to change the general settings for the site, such as the site
Alert SettingUse this menu to set which alerts are created and emailed. You can also
Add DeviceUse this menu to register a device and add it to the site.
APUse these menus to monitor and configure the managed AP(s) by the
Monitor
Access PointUse this menu to view the list of APs added to the site.
Client Use this menu to view Wi-Fi clients which are connecting to the APs in the
Event LogUse this menu to view all events on the AP. An event is a log of something
Summary
Report
Configure
SSIDsUse this menu to enable and configure basic settings for SSID profiles.
AuthenticationUse this menu to configure Wi-Fi security, L2 isolation, intra-BSS and walled
Captive PortalUse this menu to configure captive portal settings for SSID profiles.
Radio SettingUse this menu to configure global radio settings for all APs in the site.
Load
Balancing
Chapter 1 Introduction
are deployed in the selected site.
Use this menu to view network statistics for a site, such as bandwidth
usage, power usage, top devices, top clients and/or top SSIDs.
Use this menu to locate devices on the world map and even on a floor
plan.
name, device login password and firmware upgrade schedule.
set the email address(es) to which an alert is sent.
NCC.
The settings are applied when a Nebula AP is registered and attached to
the selected site.
site.
that has happened to a managed device.
Use this menu to view network statistics specific to APs in the site.
garden settings for SSID profiles.
Use this menu to configure load balancing settings for all APs in the site.
NCC User’s Guide
13
Chapter 1 Introduction
Table 2 NCC Menu Summary (continued)
LEVEL 1LEVEL2/LEVEL3FUNCTION
SWITCHUse these menus to monitor and configure the managed switch(es) by
the NCC.
The settings are applied when a Nebula switch is registered and attached
to the selected site.
Monitor
SwitchUse this menu to view the list of switches added to the site.
ClientUse this menu to view detailed information about the clients which are
connecting to the switches in the site.
Event LogUse this menu to view all events on the switch. An event is a log of
Summary
Report
Configure
Switch PortsUse this menu to view the switch port statistics and configure switch
IP filteringUse this menu to configure the access control list in order to control
RADIUS PolicyUse this menu to configure port authentication.
PoE ScheduleUse this menu to set the schedule for switches in distributing power to
Switch
Configuration
something that has happened to a managed device.
Use this menu to view network statistics specific to switches in the site.
settings for the ports.
access to the switches.
powered devices.
Use this menu to configure global switch settings, such as (R)STP, QoS,
IGMP snooping, port mirroring, authentication servers, voice VLAN and
DHCP white list.
NCC User’s Guide
14
Chapter 1 Introduction
Table 2 NCC Menu Summary (continued)
LEVEL 1LEVEL2/LEVEL3FUNCTION
GatewayUse these menus to monitor and configure the managed security
gateway(s) by the NCC.
The settings are applied when a Nebula gateway is registered and
attached to the selected site.
Monitor
Security
Gateway
Client Use this menu to view the connection status and detailed information
Event LogUse this menu to view all events on the gateway. An event is a log of
VPN
Connection
Summary
Report
Configure
Interfaces
Addressing
FirewallUse this menu to configure firewall rules for outbound traffic, application
Site-to-Site VPN Use this menu to configure VPN rules.
L2TP over IPSec
client
Captive PortalUse this menu to configure captive portal settings for each gateway
Network
Access
Method
Traffic ShapingUse this menu to configure the maximum bandwidth and load balancing.
Security
Filtering
My
Authentication
Server
Use this menu to view the detailed information about a security gateway
in the selected site.
about a client in the selected site.
something that has happened to a managed device.
Use this menu to view status of the site-to-site VPN connections.
Use this menu to view network statistics specific to the gateway in the site.
Use this menu to configure network mode, port grouping, interface
address, static route and DDNS settings on the gateway.
patrol, schedule profiles and port forwarding rules for inbound traffic.
Use this menu to enable and configure L2TP VPN settings.
interface.
Use this menu to enable or disable web authentication on an interface.
Use this menu to enable or disable Intrusion Detection and Prevention
(IDP) on the security gateway.
Use this menu to configure external AD (Active Directory) server or RADIUS
server that the security gateway can use in authenticating users.
NCC User’s Guide
15
Chapter 1 Introduction
Table 2 NCC Menu Summary (continued)
LEVEL 1LEVEL2/LEVEL3FUNCTION
ORGANIZATIONOverviewUse this menu to view a list of sites belonging to the selected organization
and detailed information about the devices connected to the sites.
Create
Organization
Create SiteUse this menu to create a new site.
InventoryUse this menu to view the summary of devices which have been
License
Management
Change LogUse this menu to view log messages about configuration changes in this
SettingUse this menu to configure the security and notification settings.
AdministratorUse this menu to view, remove or create a new administrator account for
Cloud
Authentication
HELPOnline DocUse this menu to view the documentation for the NCC and Nebula
Support RequestUse this menu to view or submit a new eITS ticket.
Security Policy
Information
Use this menu to create a new organization.
registered and assigned to the sites in the selected organization.
Use this menu to view and manage your licenses.
organization.
this organization.
Use this menu to create or remove user accounts which are allowed
access to the Nebula devices via different authentication methods, such
as the MAC-based authentication, captive portal or the IEEE 802.1x
authentication method.
devices.
Use this menu to view information required for firewall rules to allow
management traffic between the NCC and Nebula devices, such as the
port number and protocol type.
NCC User’s Guide
16
PART II
Technical Reference
17
2.1 Monitor Menus
Use the Monitor menus to check the dashboard, summary report, map and floor plan, network topology
and client list of the Nebula devices for the selected site.
2.1.1 Dashboard
If a site is created and selected, the Dashboard is always the first menu you see when you log into the
NCC. You can also click SITE-WIDE > Monitor > Dashboard to access this screen. It shows:
• AP: how many Nebula APs are assigned and connected, and what percentage of the APs become
overloaded, that is, the number of online APs that exceed the maximum client device number (in AP > Configure > Load Balancing) by total number of online APs in the site,
• AP Client: how many Wi-Fi clients are currently connecting to the managed AP(s),
• Switch: how many Nebula switches are assigned and connected, and what percentage of the
switches become overloaded, that is, the number of online Nebula switches that exceed 70% of their
upstream bandwidth by total number of online Nebula switches in the site,
• PoE Power: the total PoE power budget on the switch and the current amount of power consumed by
the powered devices,
• Gateway: how many Nebula security gateways are assigned and connected, and what percentage
of the gateway’s processing capability is currently being used if the CPU goes over 93% usage,
• Connection: the number of devices that are experiencing slow connection speeds,
• Traffic Summary: the Internet usage and top ten applications in the past 24 hours,
• Top Clients: the top three clients with the highest percentage of bandwidth usage in the past week.
CHAPTER 2
Site-Wide
NCC User’s Guide
18
Chapter 2 Site-Wide
Figure 7 SITE-WIDE > Monitor > Dashboard
2.1.2 Summary Report
This screen displays network statistics for the selected site, such as bandwidth usage, power usage, top
devices, top clients and/or top SSIDs.
Click SITE-WIDE > Monitor > Summary Report to access this screen.
NCC User’s Guide
19
Chapter 2 Site-Wide
Figure 8 SITE-Wide > Monitor > Summary Report
NCC User’s Guide
20
Chapter 2 Site-Wide
The following table describes the labels in this screen.
Table 3 SITE-Wide > Monitor > Summary Report
LABELDESCRIPTION
Select to view the report for the past day, week or month. Alternatively, select Select
range... to specify a time period the report will span. You can also select the number of
results you want to view in a table.
Email reportClick this button to send summary reports by email, change the logo and set email
schedules.
Top devices by usage
#This shows the index number of the Nebula device.
NameThis shows the descriptive name of the Nebula device.
ModelThis shows the model number of the Nebula device.
UsageThis shows the amount of date transmitted or received by the Nebula device.
ClientThis shows how many clients are currently connecting to the Nebula device.
LocationThis shows the location of the top Nebula devices on the map.
Top SSIDs by usage
#This shows the index number of the SSID.
SSIDThis shows the SSID network name.
# ClientsThis shows how many Wi-Fi clients are connecting to this SSID.
% ClientsThis shows what percentage of associated Wi-Fi clients are connecting to this SSID.
UsageThis shows the total amount of data transmitted or received by clients connecting to this
% UsageThis shows what percentage of the transmitted data is for this SSID.
Clients
TotalThis shows the total number of clients connected to the Nebula device within the specified
Daily AverageThis shows the average daily number of clients within the specified time period.
Clients per day
Top clients
#This shows the index number of the client.
DescriptionThis shows the descriptive name or MAC address of the client.
UsageThis shows the amount of data consumed by the client.
% UsageThis shows what percentage of the transmitted data is for the client.
NameThis shows the descriptive name of the switch.
ModelThis shows the model number of the switch.
Power usageThis shows what percentage of the power is used by the switch.
Ethernet power
Power rate over time This shows the average, maximum and minimum power consumption of the switches.
The y-axis shows how much power is used in Watts.
The x-axis shows the time period over which the power consumption is recorded.
Top client device manufacturer by usage
ManufacturerThis shows the manufacturer name of the client device.
# ClientsThis shows how many client devices are made by the manufacturer.
% ClientsThis shows the percentage of top client devices which are made by the manufacturer.
UsageThis shows the amount of data consumed by the client device.
% UsageThis shows what percentage of the transmitted data is for the client device.
Top operating systems by usage
OSThis shows the operating system of the client device.
# ClientsThis shows how many client devices use this operating system.
% ClientsThis shows the percentage of top client devices which use this operating system.
UsageThis shows the amount of data consumed by the client device on which this operating
% UsageThis shows what percentage of top client devices use this operating system.
system is running.
2.1.3 Map & Floor Plan
This screen allows you to locate a device on the world map and use a floor plan to show the space and
relationship between the Nebula devices. Click SITE-WIDE > Monitor > Map & floor plan to access this
screen.
NCC User’s Guide
22
Chapter 2 Site-Wide
Figure 9 SITE-WIDE > Monitor > Map & Floor Plan
Place devices on map
You can mark spots on the map, that is, the places where the devices are located. Click the Place
devices on map tab to display the device list for the selected site. Click Done to hide the device list.
Click the Placed button to show the devices that you have pined on the map and/or the floor plan.
Click the Un-placed button to show the devices that remain to be pined on the map. To pin a device,
select the device from the Un-placed list, then drag and drop it on to the map.
The pin icon next to a device name is blue ( ) if you have marked the device on the map. Otherwise,
the pin icon is gray ( ). Click the icon to remove a device from the map.
Figure 10 SITE-WIDE > Monitor > Map & Floor Plan: Place devices on map
NCC User’s Guide
23
Chapter 2 Site-Wide
Edit floor plans
Click the Edit floor plans tab to display the list of existing floor plan, a drawing that shows the rooms
scaled and viewed from above. Click Done to hide the list. Use the Create+ button to upload new floor
plans.
Select a floor plan from the list. The floor plan then shows on the Google map at the right side of the
screen. Use your mouse to move the floor plan, and use the icons at the top of the map to rotate,
change the transparency, resize or hide the floor plan. Click Set position to apply your changes.
Floor planThis shows the descriptive name of the floor plan.
Devices This shows the number of the device(s) marked on this floor plan.
EditClick this icon to open a screen, where you can modify the name, address and/or
RemoveClick this icon to delete the floor plan.
2.1.4 Topology
Use this screen to view the network topology of the site. Click SITE-WIDE > Monitor > Topology to access
this screen.
dimension of the floor plan.
NCC User’s Guide
24
Chapter 2 Site-Wide
Figure 12 SITE-WIDE > Monitor > Topology
2.2 Configure Menus
Use the Configure menus to set the general and email alert settings for the selected site, or register a
new Nebula device and assign it to the site.
2.2.1 General Setting
Use this screen to change the general settings for the site, such as the site name, device login password
and firmware upgrade schedule. Click SITE-WIDE > Configure > General Setting to access this screen.
NCC User’s Guide
25
Chapter 2 Site-Wide
Figure 13 SITE-WIDE > Configure > General setting
NCC User’s Guide
26
Chapter 2 Site-Wide
The following table describes the labels in this screen.
Table 5 SITE-Wide > Configure > General setting
LABELDESCRIPTION
Site Info
Site NameEnter a descriptive name for the site.
Local time zoneChoose the time zone of the site’s location.
Device configuration
Local credentialsThe default password is generated automatically by the NCC when the site is created. You
AP LED lightsClick to turn on or off the LED(s) on the APs.
Captive portal time
limit
For my AD server
users
For my RADIUS
server users
For click-tocontinue users
For cloud
authentication
users
SNMP
SNMP accessSelect V1/V2c to allow SNMP managers using SNMP to access the devices in this site.
SNMP community
string
Reporting
Syslog serverClick Add to create a new entry.
Server IPEnter the IP address of the server.
TypesSelect the type of logs the server is for.
ActionClick the Delete icon to remove the entry.
Firmware upgrades
Upgrade timeSelect the day of the week and time of the day to install the firmware.
Access point
upgrade
can specify a new password to access the status page of the device’s built-in web-based
configurator. The settings here apply to all Nebula devices in this site.
Select how often the user (authenticated by an AD server) has to log in again.
Select how often the user (authenticated by an RADIUS server) has to log in again.
Select how often the user (authenticated via the captive portal) has to log in again.
Select how often the user (authenticated using the NCC user database) has to log in
again.
Otherwise, select Disable.
This field is available when you select V1/V2c.
Enter the password for the incoming SNMP requests from the management station.
This section is grayed out if there is no AP in this site. It shows if there is a new version of the
firmware available for the APs, and the date and time of the last firmware upgrade.
Select Follow upgrade time to install the firmware at the time you choose in the Upgrade time field.
Select Schedule the upgrade to xx at xx to set a new schedule for the firmware upgrade.
Select Perform the upgrade now to install the firmware immediately.
NCC User’s Guide
27
Table 5 SITE-Wide > Configure > General setting (continued)
LABELDESCRIPTION
Switch upgradeThis section is grayed out if there is no switch in this site. It shows if there is a new version of
Gateway upgradeThis section is grayed out if there is no gateway in this site. It shows if there is a new version of
2.2.2 Alert Setting
Chapter 2 Site-Wide
the firmware available for the switches, and the date and time of the last firmware
upgrade.
Select Upgrade as scheduled to install the firmware at the time you choose in the Upgrade time field.
Select Schedule the upgrade to xx at xx to set a new schedule for the firmware upgrade.
Select Perform the upgrade now to install the firmware immediately.
the firmware available for the gateways, and the date and time of the last firmware
upgrade.
Select Upgrade as scheduled to install the firmware at the time you choose in the Upgrade time field.
Select Schedule the upgrade to xx at xx to set a new schedule for the firmware upgrade.
Select Perform the upgrade now to install the firmware immediately.
Use this screen to set which alerts are created and emailed. You can also set the email address(es) to
which an alert is sent. Click SITE-WIDE > Configure > Alert Setting to access this screen.
Figure 14 SITE-WIDE > Configure > Alert setting
NCC User’s Guide
28
The following table describes the labels in this screen.
Table 6 SITE-Wide > Configure > Alert setting
LABELDESCRIPTION
Send alerts via email
to
Wireless alertsClick On to have the NCC generate and send an alert when the event occurs.
Switch alertsClick On to have the NCC generate and send an alert when the event occurs.
Security gateway
alerts
Other alertsClick On to have the NCC generate and send an alert when the event occurs.
2.2.3 Add Device
Chapter 2 Site-Wide
Select Other email addresses to enter the email address(es) to which you want to send
alerts. Otherwise, select All site domains.
You can also specify how long in minutes the NCC waits before generating and sending an
alert when an AP becomes off-line.
You can also specify how long in minutes the NCC waits before generating and sending an
alert when a port or a switch goes down.
Click On to have the NCC generate and send an alert when the event occurs.
You can also specify how long in minutes the NCC waits before generating and sending an
alert when a gateway becomes off-line.
Use this screen to register a device and add it to the site. Click SITE-WIDE > Configure > Add device to
access this screen.
Figure 15 SITE-WIDE > Configure > Add device
The following table describes the labels in this screen.
Table 7 SITE-Wide > Configure > Add device
LABELDESCRIPTION
Add to this siteClick this button to assign the selected device(s) to the site.
Unused devicesThis shows the number of registered devices which have not been assigned to a site.