GemTek Technology R950829G High Performance Hotspot Access Point User Manual BW1330 UG v1 0
Gemtek Technology Co., Ltd. High Performance Hotspot Access Point BW1330 UG v1 0
UserManual.wiki
>
GemTek Technology
>
R950829G User Manual
>
Manual Part 2
Contents
1.
Manual Part 1
2.
Manual Part 2
3.
Manual Part 3
Manual Part 2
Navigation menu
Upload a User Manual
Namespaces
Wiki Guide
HTML
PDF
Info
Views
User Manual
Discussion / Help
Navigation
![User’s Guide Version 1.0 Figure 103 – Edit DHCP Server Settings IP Address from/IP Address to – specify the IP address range supported for the DHCP service [mandatory fields]. WINS Address (Windows Internet Naming Service) – specify service IP address if it is available on the network [dots and digits]. Lease Time – specify the IP address renewal in seconds [1-1000000]. Domain – specify DHCP domain name [optional, 1-128 sting]. DNS address – specify the DNS server’s IP address [in digits and dots notation]. DNS secondary address – specify the secondary DNS server’s IP address [in digits and dots notation]. Case 2 Configure the DHCP relay Select the interface on which you want to configure the DHCP service. Select the DHCP relay and click the update button specify the DHCP relay parameters: Figure 104 – Edit DHCP Relay Settings Circuit ID – the unique DHCP relay parameter [optional, by default the MAC address of the device WAN interface is used]. If want designate the DHCP relay server, please refer to network configuration | DHCP relay. If DHCP relay service is selected, the default WAN gateway is used automatically. Update – to update entered values, the following screen appears: Figure 105 – Apply or Discard DHCP Server Settings Apply Changes – to save entered new DHCP settings. Discard Changes – to restore previous values. BROWAN Page 69](https://usermanual.wiki/GemTek-Technology/R950829G.Manual-Part-2/User-Guide-716070-Page-1.png)
![User’s Guide Version 1.0 Network Interface | POP3 It is convenient to use POP3 authentication way if there has no RADIUS server. BW1330 use POP3 interface to authenticate clients instead of RADIUS protocol. Figure 106 – POP3 Server configuration Just fill out the POP3 server IP address or URL name such like “mail.browan.com”. Network Interface | RADIUS RADIUS is an authentication and accounting system used by many Internet Service Providers (ISP). RADIUS enables ISPs to maintain a very large database of users. By using RADIUS, service providers can implement policy-based management of their subscribers’ base. RADIUS also helps ISPs to collect statistical data about their subscribers (e.g. amount of time, amount of transferred bytes, and session time). Use the RADIUS (Remote Authentication Dial In User Service) menu to set-up the following RADIUS settings: RADIUS Settings – general RADIUS settings configuration (e.g. NAS server ID, servers timeouts) RADIUS Servers – up to 32 different RADIUS servers’ configuration (accounting and authentication servers) WISP (Wireless Internet Service Provider) – specify WISP domain for RADIUS server Proxy – configure the BW1330 to act as RADIUS proxy server. Accounting Backup – backup the RADIUS subscribers accounting information. Network Interface | RADIUS | Settings General RADIUS settings are configured using the RADIUS settings menu under the network interface: Figure 107 – RADIUS Settings Configuration RADIUS Retries – retry count of sending RADIUS packets before giving up. RADIUS Timeout – maximum amount of time before retrying RADIUS packets [sec]. BROWAN Page 70](https://usermanual.wiki/GemTek-Technology/R950829G.Manual-Part-2/User-Guide-716070-Page-2.png)
![User’s Guide Version 1.0 NAS Server ID – name of the RADIUS client. User Session Timeout - amount of time from the user side (no network carrier) before closing the connection [sec]. User Accounting Update - period after which server should update accounting information [sec]. User Accounting Update Retry – retry time period in which server should try to update accounting information before giving up [sec]. User Idle Timeout - amount of user inactivity time, before automatically disconnecting user from the network [sec]. Location ISO Country code – location ID attribute, country code according ISO standards [string]. Location E.164 Country code – location ID attribute, country code according E.164 specification. Location E.164 Area code – location ID attribute, area code according E.164 specification. See the Location ID and ISO Country codes for your country in the Appendix: D) Location ID and ISO Country Codes. Location Network – location ID attribute, network name [string]. Hotspot Operator Name – location name attribute, operator’s name [string]. Location – location name attribute, textual description of the location [string]. Bandwidth Up – maximum bandwidth up at which corresponding user is allowed to transmit [bps]. Bandwidth Down – maximum bandwidth down at which corresponding user is allowed to receive [bps]. User can check its available bandwidth in the logout page statistics. Each setting in this table can be edited. Select RADIUS setting you need to update, click the edit next to the selected setting and change the value: Figure 108 – Edit RADIUS Settings Use the update button to update to an entered value. Now select another RADIUS setting to edit, or apply changes and restart the server if the server configuration is finished: BROWAN Page 71](https://usermanual.wiki/GemTek-Technology/R950829G.Manual-Part-2/User-Guide-716070-Page-3.png)
![User’s Guide Version 1.0 To edit RADIUS server click the edit button: Figure 112 – Add New RADIUS Server Name – specify the new RADIUS server name. Default – check the check box to make the selected RADIUS the default server. Authentication IP – authentication RADIUS server IP address [dots and digits]. Authentication Port – specify the network port used to communicate with RADIUS [1-65535]. The port default value of 1812 is based on RFC 2138 "Remote Authentication Dial-in User Service (RADIUS)". Authentication Secret – shared secret string that is used to encrypt data frames used for authentication server. Accounting IP – accounting RADIUS server IP address [dots and digits]. Accounting Port – specify the network port used to communicate with RADIUS [1-65535]. Accounting Secret – shared secret string that is used to encrypt data frames used for accounting server. Backup IP – backup RADIUS server IP address [dots and digits]. Backup Port – specify the network port used to communicate with RADIUS [1-65535]. Backup Secret – shared secret string that is used to encrypt data frames used for backup server. Shared secret must be the same on RADIUS server and RADIUS client. Reverse Accounting – [enabled/disabled]. The RADIUS accounting request contains Acc-Input-Octets and Acc-Output-Octets attributes. The interpretation of these attributes according the RFC2866 is relative to the point of view. If this point is at the AC - Acct-Input* attributes should contain the bytes/packets received at AC port from the client and Acct-Output* attributes should contain bytes/packets sent from AC port to the client. If we move this point to the client - we will get the reversing of Acct-Input* and Acct-Output* attributes values. The Acct-Input* then should contain bytes/packets received from AC, what is bytes/packets that AC sent to the user in AC point of view and what was Acct-Output*. The AC implementation of RADIUS accounting request is at the client point of view (reverse accounting is disabled). BROWAN Page 73](https://usermanual.wiki/GemTek-Technology/R950829G.Manual-Part-2/User-Guide-716070-Page-5.png)
![User’s Guide Version 1.0 The value "disabled" means that Acct-Input* RADIUS attributes will contain bytes/packets sent to the client and Acct-Output* RADIUS attributes will contain bytes/packets received from the client during the curse of service being provided. The value "enabled" means that info in the Acct-Input* and Acct-Output* RADIUS attributes will be swapped (reversed). That is the Acct-Input* will contain bytes/packets received from the client and the Acct-Output* will contain bytes/packets sent to the client. User password md5sum secret: if enabled, user input password will be md5-summerized before pass to RADIUS server for more security (Need RADIUS Server do relevant configurations). Strip WISP – [enabled/disabled] select ‘enabled' if you want to strip WISP domain name before sending it to the RADIUS server. Stripping means removing everything before the “/” character including character itself for such user name login format like: “WISPdomain/username”. Select “disabled” if you need to send the user login name to RADIUS server unmodified. Some RADIUS servers can be configured in such way that requires full-unmodified user name to be sent. UAM authentication method – select authentication method from drop-down menu: PAP – Password Authentication Protocol Update – add new specified RADIUS server. Cancel – restore all previous values. After adding a new RADIUS server or editing an existing one, the following controls appears: figure – 113 apply and reboot Apply Changes – save changed configuration. Discard Changes – discard all changes. Restart – after applying changes to the system, you should restart the controller to make applied changes work. Network Interface | RADIUS | WISP Up to 32 WISP entries can be defined using the network interface | RADIUS | WISP menu. Different WISPs (Wireless Internet Service Providers) can be associated with appropriate RADIUS servers and device interfaces using the network interface | RADIUS | WISP menu: Figure 114 – WISP Menu Domain policy means BW1330 use which policy to fetch WISP name from user name then to judge user belong which domain. Hotspot owner can use three policy to judge the WISP name from user name: BROWAN Page 74](https://usermanual.wiki/GemTek-Technology/R950829G.Manual-Part-2/User-Guide-716070-Page-6.png)
![User’s Guide Version 1.0 1. username follow the format: username@WISPdomain 2. username follow the format: WISPdomain/username 3. use prefix of username as wisp name, the range of prefix length is from 2 to 6. Figure 115 – Domain Policy New – click to define WISP for RADIUS server. Figure 116 – Define New WISP Name – new WISP domain name [string, up to 256 symbols, no space, dot or dash allowed]. RADIUS Name – select RADIUS for new WISP from list box [non editable]. Bound To – select the WISP binder interface. The WISP can be associated with appropriate device interface. Update – system with new WISP. Cancel – restore all previous values. Network Interface | RADIUS | Proxy The BW1330 can forward the RADIUS authentication and accounting requests from Access Point (AP) to the real RADIUS server. To configure the RADIUS proxy, follow the steps: Step 1 Connect the Access Point to any LAN port available on the Access Controller (BW1330). The AP should be in the bridge mode. Step 2 Using the network interface | RADIUS | proxy menu configure the RADIUS proxy parameters: RADIUS authentication port (UDP), RADIUS accounting port (UDP) - different from authentication port and Accounting detection timeout: Figure 117 – RADIUS Proxy Settings RADIUS Proxy Status – select [enabled] to enable the RADIUS proxy feature [enabled/disabled]. Authentication Port – specify the port on AC for listening the RADIUS authentication packets. The AC RADIUS proxy authentication port will accept only RADIUS authentication packets [1-65535, default: 1812]. Accounting Port – specify the port on AC for listening the RADIUS accounting packets. The AC RADIUS proxy accounting port will accept only RADIUS accounting packets [1-65535, default: 1813]. Detection Timeout – specify the RADIUS proxy accounting detection timeout in seconds. The AC will wait the specified period for accounting packet after the authentication request was got [0-3600]. BROWAN Page 75](https://usermanual.wiki/GemTek-Technology/R950829G.Manual-Part-2/User-Guide-716070-Page-7.png)
![User’s Guide Version 1.0 The authentication RADIUS proxy port should differ from the accounting port. Step 3 Configure the AP to send the RADIUS authentication and accounting packets to the AC LAN IP address and UDP ports which are configured on AC RADIUS proxy configuration. Step 4 The RADIUS secrets on AC should be set to value, which is good at the real RADIUS server for which the following packet will be forwarded. Such preconfigured AC will act as RADIUS proxy and will forward the RADIUS authentication and accounting packets from AP according WISP and RADIUS server settings in the AC configuration without any modification. Network Interface | RADIUS | Accounting Backup The administrator can backup the hotspot subscribers’ RADIUS accounting information in two ways: Via syslog protocol to the specified host Download to the selected location (e.g. on your PC) Use the network interface | RADIUS | accounting backup menu: Figure 118 – Accounting Backup Backup via syslog – enable this type to send the RADIUS accounting information via syslog protocol to the specified host [enable/disable] and note that the Host IP specification is obligatory. Host – enter host IP address where to send accounting backup messages. Backup to local file – enable this option, and the download button appears: Figure 119 – Accounting Backup enable Download – click the button to download the accounting information file to your selected location. Both types of accounting backup can be enabled. BROWAN Page 76](https://usermanual.wiki/GemTek-Technology/R950829G.Manual-Part-2/User-Guide-716070-Page-8.png)
![User’s Guide Version 1.0 Network Interface | Tunnels This chapter describes the configuration of VPN tunnels. VPN tunnels can be used to secure management and AAA traffic between the hotspot network and the network operation center of the operator. The Access Controllers support GRE tunnels. Furthermore PPP (Point-to-Point Protocol) can be use to authenticate the AC to a authentication server and to assign IP settings to the WAN port of the AC. Network Interface | Tunnels | PPPoE/GRE Use the network interface | tunnels | PPPoE/ GRE menu to connect to ISP via PPPoE or GRE tunnel. All traffic will be sent via this tunnel. Default gateway specified in network interface | configuration page will not be used, because all Internet traffic will be sent/received via the specified PPPoE or GRE server (tunnel). By default no services are available on the controller: Figure 120 – PPPoE /GRE for DSL To specify PPPoE tunnel for your controller click the edit button and enter the following: Figure 121 – Specify PPPoE Tunnel Service – select service PPPoE. Username – enter username to connect to the server [text string, can not be empty]. The same username should be configured on the PPPoE server. Password – enter password by which user should be authenticated [text string, can not be empty]. Encryption – enables use of MPPE encryption. When PPPoE tunnel is used, then no server IP is required - broadcast address will be used. To specify GRE tunnel for your controller click the edit button and enter the following: Figure 122 – Specify GRE Tunnel Service – select service GRE. Remote IP – IP address of GRE tunnel endpoint [IP address]. Interface IP – enter the IP address of GRE interface [IP address]. Interface Netmask – enter the netmask of GRE interface [netmask]. BROWAN Page 77](https://usermanual.wiki/GemTek-Technology/R950829G.Manual-Part-2/User-Guide-716070-Page-9.png)
![User’s Guide Version 1.0 for a better performance. 2.4GHz (11g only) mode only allows 11g client access. 2.4GHz(Mixed 11g) mode allows 11b/11g client access.2.4GHz(Mixed 11g WiFi) or 2.4GHz(11g only WiFi) can make sure to compatible with Wi-Fi. Tx Power – the BW1330 transmission output power in dBm. Different power level is based on domain setting. Default is 18dBm&WORLD. Total Output Power (EIRP) = Antenna Gain + RF card output power The range of the EIRP varies with channel and regulatory domain. RTS Threshold – when set, this settings specifies the maximum packet size beyond which RTS/CTS mechanism is be invokes. The value range of this is [0 …2347]. Default is 2347 which means that RTS is disabled. DCA threshold – show the value (in minutes) of DCA threshold. This threshold is been used to judge if there is no wireless users connected during this time. And if yes, BW1330 will monitor the environment and adjust channel for the best operational one. DCA optional channel – show the channels only in which auto channel selection (DCA) will be processed to reduce interference. Only when DCA is enabled, DCA threshold and DCA optional channel will be shown. Layer 2 Isolation – Layer2 wireless client separation. Connected clients with user isolation function enabled cannot access each other directly. The clients are isolated from each other using their MAC addresses [enabled/disabled]. Mode – the operating of Access Point[AP]. For such each change of settings, the BW1330 needs to be reboot to apply all settings changes when clicking Apply Changes. Request for reboot server appears: Figure 128 – Configuration changed Figure 129 – Click apply changes button and reboot device BROWAN Page 812.33 dBi 20 dBm 2.33 dBi 20](https://usermanual.wiki/GemTek-Technology/R950829G.Manual-Part-2/User-Guide-716070-Page-13.png)
![User’s Guide Version 1.0 Figure 131 – Multiple BSSID Setting Radio – showing which RF card, for BW1330 it is fixed: wlan1; Mode – showing the current operation mode, for BW1330 it is fixed: AP mode; SSID – a unique ID for your wireless network. It is case sensitive and must not exceed 32 characters. The SSID is important for clients when connecting to the access point. All client stations must have their client SSID settings configured and must use the same SSID. Each MBSSID entry (BSSID) can has its own SSID. And SSID can be same for different BSSID Hidden SSID – When enabled, the SSID of this Interface is invisible in the networks list while scanning the available networks for wireless client (SSID is not broadcasted with its Beacons). When disabled, the AP’s SSID is visible in the available network list [enabled/disabled]. By default the Hidden SSID is disabled. BROWAN Page 83](https://usermanual.wiki/GemTek-Technology/R950829G.Manual-Part-2/User-Guide-716070-Page-15.png)
![User’s Guide Version 1.0 Network Interface | Wireless | WDS A WDS (Wireless Distribution System) allows you to create a wireless network infrastructure. Normally the access points must be connected with a wired network (LAN), which is generally an Ethernet connection. Once connected, these access points create wireless cells allowing wireless connection to the wired network. The WDS feature allows the access points to be wirelessly connected to another access point, eliminating the need for a wired connection between them: Data from a wireless client attached to an AP configured for WDS will be repeated on the wireless interface to the peer AP where it will be delivered to it’s destination. Consequently , the overall throughput of the wireless system is reduced by half for each relay link added. WDS mode is configured by entering the WDS link peer AP’s MAC address in each other’s AP configurations. To configure the WDS links use the network interface | wireless | WDS menu, click the new button and enter the MAC addresses of the peer APs: figure 132 – WDS setting The radio channel in all WDS link peer APs must be the same, although their SSIDs may be different. Configure WDS settings.Click the “new” button. figure 133 – add WDS Remote MAC- enter WAN MAC address of the peer AP for the WDS link [6-HEX pairs separated by colon [1-9] [A-F] [a-f]]. Security- set WEP/WPA-PSK encryption or disable of WDS link. Specify the WEP Key Index and use network interface | wireless | SecWep to set the WEP Key if you choose the WEP encryption of WDS link. You can discover the WAN (ixp1) MAC address of your BW1330 in the system | status page. BROWAN Page 85](https://usermanual.wiki/GemTek-Technology/R950829G.Manual-Part-2/User-Guide-716070-Page-17.png)
![User’s Guide Version 1.0 BW1330 automatically adds defined content-type and content-language to generated XML. Then user pages (.XSL) templates will use these parameters to generate the output HTML. Click the change button to define new headers of the web management interface on user pages templates. The default HTML encoding is ISO-8859-1, language = English. Enable the HTTP header status and default values appear: Figure 142 – Set HTTP Headers The system administrator can set his own header encoding and language settings. Use the HTML 4.01 specification to define the header encoding and language. User Interface | Configuration | Remote Authentication Read more about the extended UAM feature in Chapter 4, section: Extended UAM. The Remote Authentication feature under the user interface | configuration menu allows an external Web Application Server (WAS) to intercept/take part in the user authentication process, and to log on and log off users externally. It provides a means to query user session information as well. By default such remote authentication is disabled: figure 143 - Remote Authentication Click the edit button next to appropriate settings to specify remote authentication parameters: figure 144 – Enable Remote Authentication Remote Authentication – select status: [enabled/disabled]. Shared Secret – enter password for WAS to communicate with AC [sting (4-32), no spaces allowed]. The shared secret must match that configured on the WAS. This shared secret allows the WAS to initiate a secure (SSL) command session with the BW1330 to pass login commands. User Interface | Configuration | Custom Uam Customized UAM let hotspot owner upload their own login and logout page to BW1330 to apply with hotspot or enterprise style or do advertisements. User customized page is based on HTML. User can use Microsoft FrontPage to edit their login and logout page and upload their pages to BW1330. BROWAN Page 89](https://usermanual.wiki/GemTek-Technology/R950829G.Manual-Part-2/User-Guide-716070-Page-21.png)
![User’s Guide Version 1.0 User Interface | Administrator The administrator menu is for changing the administrator’s settings: user name, password and session timeout: There are two kinds of administrator for BW1330: one is the super administrator and the other is the normal administrator or named ebilling administrator. Super administrator has the full power to manage BW1330; While the normal administrator with limitation authority to access some menus list as below: User interface | start page User interface | walled garden(URLs column) system | configuration | clock system | access | web auth system | access | status Connection | Users All menus under Built-in AAA | E-Billing All menus under Built-in AAA | Pre-paid except “receipts” and “manage net print” menus. All menus under Built-in AAA | Configuration except “backup and restore” menu. The administrator menu is for changing the super administrator and normal administrator (ebilling administrator)’s settings: user name and password: Figure 152 – Administrators Settings Default super administrator logon settings is: User Name: admin Password: admin01 Default normal administrator logon settings is: User Name: ebilling Password: admin01 To edit or change the super and normal administrator settings click the edit button: Figure 153 – Change Administrator Setting Username – administrator username for access to Access Controller (e.g. web interface, CLI mode) [1-32 symbols, spaces not allowed]. Idle Timeout – amount of administrator inactivity time, before automatically disconnecting administrator from the web interface [300-3600 seconds]. The default idle time: 10minutes (600 seconds). Permission – permission rights of this account, cannot be changed. Old Password – old password value. New Password –new password value used for user authentication in the system [4-32 symbols, spaces not allowed]. BROWAN Page 94](https://usermanual.wiki/GemTek-Technology/R950829G.Manual-Part-2/User-Guide-716070-Page-26.png)
![User’s Guide Version 1.0 Confirm Password – re-enter the new password to verify its accuracy. Save – click to save new administrator settings. Only super administrator can change the settings of super administrator and normal administrator. User Interface | Start Page The start page is the default web page where users will be redirected after log-on. This value will be overwritten by the WISP RADIUS attribute no.4 "Redirection-URL" if provided in the authentication response message. Use the user interface | start page menu to view or change the start page URL: Figure 154 – Start Page The administrator can change the start page by clicking the edit button. The value entry field will change into an editable field: Figure 155– Edit Start Page Value – enter new redirection URL of start page in valid format [http://www.startpageurl.com]. Save – to save new settings. Cancel – restores all previous values. User Interface | Walled Garden The walled garden is an environment that controls the user's access to Web content and services. This feature gives the ability to define a free, restricted service set for a user not yet logged into the system. Use the user interface | walled garden menu to view or change the free URLs or hosts. Figure 156 – Walled Garden Edit – edit the selected URL or host. All settings become available for editing. Delete – delete the selected URL or host. New URL – click the new URL button and enter the new URL and its description. Save entered information by clicking the update button: Figure 157 – Add New URL part 1 BROWAN Page 95](https://usermanual.wiki/GemTek-Technology/R950829G.Manual-Part-2/User-Guide-716070-Page-27.png)
![User’s Guide Version 1.0 URL for User – define full URL address [ex:www.browan.com]. String to Display – site description. New Host – If you need to define hosts (web servers) for walled garden, specify hosts by clicking the new host button and click the update button: Figure 158 – Walled Garden Host Type –select the data traffic protocol for host server [TCP/UDP]. Host – Web server address [IP address or host name]. Netmask – enter the network mask to specify the host servers network. Port – network port, which is used to reach the host [1-65535]. For standard protocols use the default ports: Protocol Port HTTP 80 HTTPS 443 FTP 21 User Interface | Web Proxy The enabled web proxy allows any clients’ connections with configured proxy settings on their browsers. The AC accepts any client proxy configurations and grants the access to the Internet. The system administrator should list only ports the AC is listening on for proxy requests. Figure 159 – Web Proxy Web proxy is enabled by default and the port numbers are: 3128 and 8080. To add more port number for web proxy, click the new button: Figure 160 – Add Web Proxy Port Port – add port number for web proxy to listen to [1-65535]. Save – click the button to save new port. BROWAN Page 96](https://usermanual.wiki/GemTek-Technology/R950829G.Manual-Part-2/User-Guide-716070-Page-28.png)
![User’s Guide Version 1.0 System Use the system menu to configure such system utilities: Syslog – for sending system and debug messages via the syslog protocol. Clock – manual setting of internal device clock. NTP – set the Network Time Protocol service on the AC. Certificates – upload your own SSL certificate and private key files for server. Save and Restore – save current AC configuration and restore. Use the system menu to define default access/visitor access to the device via or using: Telnet – enable telnet connections to AC. AAA – enable different AAA methods. UAT – enable the service. SNMP – enable/configure SNMP management. Use the system menu to check the system status, reset the device, or update with new firmware. Figure 161 – System Menu System | Configuration | Syslog You can trace your AC system processes and get the system log messages remotely using the system | configuration | syslog menu (by default the syslog utility is disabled): To enable the syslog remote sending function, click the edit button and choose the enabled option: Figure 162 – Syslog Settings Remote Log Status – choose disable/enable remote log [enabled/disabled]. Host – specify the host IP address where to send the syslog messages [host IP address]. Be sure the remote host is configured properly to receive the syslog protocol messages. Level – select the messages level you need to trace. The level determines the importance of the message. The levels are, in order of increasing importance: Debug – debug messages including more important level messages: [info/warning/error/fatal]. Informational – informational messages including [warning/error/fatal] Warning – warning condition messages including [error/fatal] Error – error and critical condition messages including [fatal] Fatal – critical and fatal condition for device messages. Actions should be taken immediately. Save – save changes. The syslog messages will be started to send to the specified host. Cancel – restore the previous values. BROWAN Page 97](https://usermanual.wiki/GemTek-Technology/R950829G.Manual-Part-2/User-Guide-716070-Page-29.png)
![User’s Guide Version 1.0 System | Configuration | Clock To set the Wireless PAC internal clock, use the clock utility, accessed by selecting the system | configuration | clock menu link: clock adjustment is allowed only when NTP is disabled. To adjust the clock settings, click the change button: Figure 163 – Clock Utility Figure 164 – Set Clock Settings Date – specify new date value [year/month/day]. Time – specify time [hours: minutes]. Time Zone – select the time zone [-12.00 – 14.00]. If the NTP service is enabled the selected time zone will be applied to the clock settings also. If the NTP server (see the next section for reference) is enabled on the system, no manual clock setting is available except time zone. Only time zone change is available when NTP server is used. System | Configuration | NTP The NTP (Network Time Protocol) is used to synchronize the clock of the AC to a selected time reference. You can synchronize the system clock settings using the system | configuration | NTP menu: Figure 165 – NTP Service By default NTP service is enabled with two server: time.windows.com and time.nist.gov. To disable the service, click the first edit button: Figure 166 – Disable NTP Status – select appropriate status for NTP service [enabled/disabled]. BROWAN Page 98](https://usermanual.wiki/GemTek-Technology/R950829G.Manual-Part-2/User-Guide-716070-Page-30.png)
![User’s Guide Version 1.0 Host – specify the trusted NTP server IP on the field. It works only with enabled NTP function. The NTP synchronize the device clock with GMT + 0 time. If you need to set the time zone, use the system | configuration | clock menu. You may want to add more than one NTP host, for example, in the case where the first host fails to connect. Click the new button to add additional host settings: Figure 167 – Add New NTP Host Host – add additional NTP service hosts [1-128]. This NTP server will be used, if connection to the first defined NTP server is lost. If the system not right when BW1330 start up, the Pre-paid account and E-Billing account can not be created, and UAM login page would not be popped out but replace with below figure. At this case administrator need check if NTP works or adjust the clock manually. Figure 168 – Wrong system time when user login For BW1330 has no RTC, the default setting of NTP is enabled and the default server is time.windows.com. NTP enabled is necessary for E-Billing account and pre-paid account. System | Configuration | Certificate You can upload your own SSL certificates files for HTTP connection using the certificate menu under the system | configuration menu: Figure 169 – Certificate Upload Only these certificate files are accepted: Server PEM-encoded X.509 certificate file Server PEM-encoded private key file Click the upload to upload your own SSL certificates and private key files: Figure 170 – Upload New Certificate BROWAN Page 99](https://usermanual.wiki/GemTek-Technology/R950829G.Manual-Part-2/User-Guide-716070-Page-31.png)
![User’s Guide Version 1.0 Edit – click to edit the default access status [allow/deny]. New – click to create new access control rule for specific network to specific service(s) [all/ /ssh/telnet/snmp]. To configure the access control, click the edit button and specify the network address and select services to allow/deny: Figure 179 –Modify Access Control Service – select services that access you need to control [all/ssh/telnet/snmp]. Telnet service must be separately enabled under system | access | telnet to enable the telnet deamon on the controller. BW1330 will first match the allow rules, then match the deny rules. In another words, allow rules has the higher priority than the deny rules. The default access rule has the lowest priority to other rules whenever its status is allow or deny. Network Address – specify the network or host address with netmask in bit format separated by a forward slash. The /N stands for the number of bits that are in the network address. There are 32 bits, so we have 32-N bits left that are part of the network. The first N bits of x.x.x.x correspond to x.0.0.0 when N=8, our network address, and the netmask is 255.0.0.0 (when N=8). bits netmask /32 255.255.255.255 /31 255.255.255.252 /30 255.255.255.248 … … /26 255.255.255.192 /25 255.255.255.128 /24 255.255.255.0 … … /16 255.255.0.0 … … /8 255.0.0.0 … … /0 0.0.0.0 Access – select the access policy: [allow/deny]. Up to 255 different access control rules can be set. BROWAN Page 103](https://usermanual.wiki/GemTek-Technology/R950829G.Manual-Part-2/User-Guide-716070-Page-35.png)
![User’s Guide Version 1.0 When enabled 802.1x authentication in this menu, it will only take effect for the wired connection of the BVW1330. For wireless 802.1x authentication, please refer in Network interface | wireless | Advance section to enable 802.1x for wireless. Status – change status of selected AAA method [enabled/disabled]. For MAC-RADIUS authentication the following settings are required: Figure 183 – MAC-RADIUS Authentication Use Password – select [RADIUS secret] or [User defined] password for user authenticating by its MAC address. Password – enter password with user-defined option selected. Password will be one for all users authenticated by MAC address [string, 4-32 characters, no spaces allowed]. Current RADIUS secret value is only displayed and CANNOT be changed under the AAA menu. To change the RADIUS secret value use the network interface | RADIUS | servers menu. For MAC-ACL authentication, BW1330 will use the local MAC address database, which can be configured on system | Access | MAC List. System | Access | UAT With Universal Address Translation (UAT) enabled, the Wireless PAC will automatically and transparently translate fixed IP settings (IP address, gateway, DNS, proxy server) on a user’s PC so that he can connect to the broadband Internet service. There is no need for end-users to reset their corporate IP or web settings. Also outgoing subscriber e-mails can be redirected to the operator's e-mail server in order to facilitate e-mail forwarding for foreign subscribers. Universal address translation works only on LAN and VLAN interfaces with authentication setting enabled (see more about these settings in the System | Access | NAV). The Universal Address Translation (UAT) function can be enabled using the system | access | UAT menu. Figure 184 – Universal Address Translation Settings To change UAT settings on interface click the edit button in the action column. The status can be changed now: Figure 185 – Change Universal Address Translation Status BW1330 current support 50 UAT clients simultaneously. BROWAN Page 105](https://usermanual.wiki/GemTek-Technology/R950829G.Manual-Part-2/User-Guide-716070-Page-37.png)
![User’s Guide Version 1.0 System | Access | Isolation Isolation mechanism under the system | access | isolation menu increases the security of the AC users. Figure 186 – Isolation Bindmac – with bindmac function enabled, the AC binds the user’s MAC and IP addresses together after a successful logon by the wireless client and thereby preventing Internet access to a new user who uses the same client IP address, although be it with a different MAC address [enabled/disabled]. Isolation – enable this function to prevent users on the same LAN to communicate with each other. Users can communicate only through the AC [enabled/disabled]. System | Access | NAV To change visitor access on different LANs or VLANs, authentication or NAT attributes for AC users, go to the system | access | NAV menu: Figure 187 – NAT, Authentication and Visitor Access Interface – interface on which the changes will be done [br1, non editable]. IP Address – IP address of interface [non editable]. NAT – network address translation service status [enabled/disabled]. If enabled, users can access the Internet under its network gateway address. Authentication – with disabled authentication, the user from his LAN gets access to the Internet without any authentication. If enabled, authentication for Internet access is required for all users [enabled/disabled]. This setting is important when configuring the UAT. See section: System | Access | UAT for more details. Visitor Access – client with specific WISPr attribute can reach the LAN with enabled visitor access [enabled/disabled]. Only one selected interface can have the visitor access enabled. Attempting to enable an additional interface for visitor access will disable the previous interface. System | Access | SNMP SNMP is the standard protocol that regulates network management over the Internet. With enabled SNMP service Wireless PAC can act as SNMP agent. To communicate with SNMP manager you must set up the same SNMP communities and identifiers on both ends: manager and agent. For more information about SNMP see Chapter 7 – SNMP Management. Use the system | access | SNMP menu to enable/disable SNMP service or change current SNMP configuration on your BW1330 controller. BROWAN Page 106](https://usermanual.wiki/GemTek-Technology/R950829G.Manual-Part-2/User-Guide-716070-Page-38.png)
![User’s Guide Version 1.0 Figure 188– SNMP Settings SNMP Table: SNMP Service – enable or disable SNMP service on AC [enabled/disabled]. By default SNMP service is enabled. With service enabled the AC acts as the SNMP agent. If enabled, then device can be configured via SNMP: SNMP Name – An administratively assigned name for this managed node [0-99 any string]. By convention, this is the node’s fully qualified domain name. SNMP Location – The physical location of this node (e.g., `telephone closet, 3rd floor') [0-99 any string]. SNMP Contact – The textual identification of the contact person for this managed node, together with information on how to contact this person [0-99 any string]. SNMP Read-Only Community – Community name is used in SNMP version 1 and version 2c. Read-only (public) community allows reading values, but denies any attempt to change values [1-32 all ASCII printable characters, no spaces]. SNMP Read-Write Community – Community name is used in SNMP version 1 and version 2c. Read-write (private) community allows to read and (where possible) change values [1-32 all ASCII printable characters, no spaces]. Default Trap Community Name – The default SNMP community name used for traps without specified communities. The default community by most systems is "public". The community string must match the community string used by the SNMP network management system (NMS) 1-32 all ASCII printable characters, no spaces]. Authentication Failure Taps Generation – select [enable/disable] getting the authentication failure traps from your AC. SNMP Users Table: SNMP Users table is only used for SNMP v3. BROWAN Page 107](https://usermanual.wiki/GemTek-Technology/R950829G.Manual-Part-2/User-Guide-716070-Page-39.png)
![User’s Guide Version 1.0 SNMP Users – Users are used in SNMP version 3. They have the same access rights as communities, but instead of a single community name there are user name and password. Strong encryption is supported in SNMPv3. Figure 189 –SNMP user User Name – enter user name for read-only (RO) or read-write (RW) SNMP access [1-32 all ASCII printable characters, no spaces]. Password – enter password for read-only (RO) or read-write (RW) SNMP access [8-32 all ASCII characters, no spaces]. SNMP Proxies Table: SNMP Proxies – SNMP proxy configuration specifies that any incoming SNMP requests can be send to another host. SNMP proxy can be configured in such a way that can proxy only specified SNMP request under specific OID (OID local). Click the new button to create SNMP proxy: Figure 190 – Add SNMP Proxies Context Name – enter the context name for SNMP proxy rule between client and AC. Context name only works with SNMP v3. If a "context name" is specified, it assigns the proxy rule to a particular context name within the local agent [1-32 all ASCII printable characters, no spaces]: LANWAN Figure 191– SNMP and Content Name This is the proper way to query multiple SNMP agents through a single proxy. Assign each remote agent to a different context name. Then you can use "snmpwalk -n contextname1" to walk one remote proxied agent and "snmpwalk -n contextname2" to walk another, assuming you are using SNMPv3 to talk to the proxy (snmpv1 and snmpv2c context mappings aren’t currently supported but might be in the future) (see the Figure 191– SNMP and Content Name). Type – select SNMP version for SNMP proxy rule between AP and AC [v1/v2c]. Community Name – enter community name for communicating with the host (see Figure 191– SNMP and Content Name, the host is AP in this case) [1-32 all ASCII printable characters, no spaces]. IP Address – specify the host address (AP in our case) to which any incoming requests should be re-sent [dots and digits]. OID Local – enter Object Identifier (OID) of MIB tree if you want to proxy only the specified SNMP requests under the specific OID in the MIB tree. That part is specified by OID local tree [optional, number and dots]. BROWAN Page OID Target – Optionally, you can relocate the "OID local” tree to the new location at the "OID target" 108](https://usermanual.wiki/GemTek-Technology/R950829G.Manual-Part-2/User-Guide-716070-Page-40.png)