ZyXEL Communications OX253P WiMAX MIMO 2.5GHz Outdoor Simple CPE User Manual User s manual

ZyXEL Communications Corporation WiMAX MIMO 2.5GHz Outdoor Simple CPE User s manual

UserManual.wiki >

ZyXEL Communications >

OX253P User Manual

User Manual

OX253PWiMAX MIMO Outdoor Simple CPEFirmware Version 3.70Edition 1, 11/2010Default Login DetailsIP Address: http://192.168.1.1Administrator’s User Name and Password:admin/adminGeneral User’s User Name and Password:user/user

About This User's GuideOX253P User’s Guide 3About This User's GuideIntended AudienceThis manual is intended for people who want to configure the OX253P using the web configurator. You should have at least a basic knowledge of TCP/IP networking concepts and topology.Related Documentation•Quick Start Guide The Quick Start Guide is designed to help you get up and running right away. It contains information on setting up your network and configuring for Internet access.•Web Configurator Online HelpEmbedded web help for descriptions of individual screens and supplementary information.•Command Reference GuideThe Command Reference Guide explains how to use the Command-Line Interface (CLI) and CLI commands to configure the OX253P.Note: It is recommended you use the web configurator to configure the OX253P.•Support DiscDisclaimerGraphics in this book may differ slightly from the product due to differences in operating systems, operating system versions, or if you installed updated firmware/software for your device. Every effort has been made to ensure that the information in this manual is accurate.

Document ConventionsOX253P User’s Guide4Document ConventionsWarnings and NotesThese are how warnings and notes are shown in this User’s Guide. Warnings tell you about things that could harm you or your OX253P.Note: Notes tell you other important information (for example, other things you may need to configure or helpful tips) or recommendations.Syntax Conventions•The product(s) described in this book may be referred to as the “OX253P”, the “device”, the “system” or the “product” in this User’s Guide.•Product labels, screen names, field labels and field choices are all in bold font.•A key stroke is denoted by square brackets and uppercase text, for example, [ENTER] means the “enter” or “return” key on your keyboard.•“Enter” means for you to type one or more characters and then press the [ENTER] key. “Select” or “choose” means for you to use one of the predefined choices.•A right angle bracket ( > ) within a screen name denotes a mouse click. For example, TOOLS > Logs > Log Settings means you first click Tools in the navigation panel, then the Logs sub menu and finally the Log Settings tab to get to that screen.•Units of measurement may denote the “metric” value or the “scientific” value. For example, “k” for kilo may denote “1000” or “1024”, “M” for mega may denote “1000000” or “1048576” and so on.•“e.g.,” is a shorthand for “for instance”, and “i.e.,” means “that is” or “in other words”.

Document ConventionsOX253P User’s Guide 5Icons Used in FiguresFigures in this User’s Guide may use the following generic icons. The OX253P icon is not an exact representation of your OX253P.Table 1 Common IconsWiMAX Access PointComputerWireless SignalNotebookServerWiMAX Base StationTelephoneSwitchRouterInternet CloudInternet/WiMAX Cloud

Safety WarningsOX253P User’s Guide6Safety WarningsFor your safety, be sure to read and follow all warning notices and instructions.•Do NOT use this product near water, for example, in a wet basement or near a swimming pool.•Do NOT expose your device to dampness, dust or corrosive liquids.•Do NOT store things on the device.•Do NOT install, use, or service this device during a thunderstorm. There is a remote risk of electric shock from lightning.•Connect ONLY suitable accessories to the device.•Do NOT open the device or unit. Opening or removing covers can expose you to dangerous high voltage points or other risks. ONLY qualified service personnel should service or disassemble this device. Please contact your vendor for further information.•Make sure to connect the cables to the correct ports.•Place connecting cables carefully so that no one will step on them or stumble over them.•Always disconnect all cables from this device before servicing or disassembling.•Use ONLY an appropriate power adaptor or cord for your device. Connect it to the right supply voltage (for example, 110V AC in North America or 230V AC in Europe).•Do NOT remove the plug and connect it to a power outlet by itself; always attach the plug to the power adaptor first before connecting it to a power outlet.•Do NOT allow anything to rest on the power adaptor or cord and do NOT place the product where anyone can walk on the power adaptor or cord.•Do NOT use the device if the power adaptor or cord is damaged as it might cause electrocution.•If the power adaptor or cord is damaged, remove it from the device and the power source.•Do NOT attempt to repair the power adaptor or cord. Contact your local vendor to order a new one.Do not use the device outside, and make sure all the connections are indoors. There is a remote risk of electric shock from lightning.•Do NOT obstruct the device ventilation slots, as insufficient airflow may harm your device.Use only No. 26 AWG (American Wire Gauge) or larger telecommunication line cord.•Antenna Warning! This device meets ETSI and FCC certification requirements when using the included antenna(s). Only use the included antenna(s).•If you wall mount your device, make sure that no electrical lines, gas or water pipes will be damaged.

Safety WarningsOX253P User’s Guide 7•Make sure that the cable system is grounded so as to provide some protection against voltage surges.Your product is marked with this symbol, which is known as the WEEE mark. WEEE stands for Waste Electronics and Electrical Equipment. It means that used electrical and electronic products should not be mixed with general waste. Used electrical and electronic equipment should be treated separately.

Safety WarningsOX253P User s Guide8Federal Communication Commission Interference Statement This equipment has been tested and found to comply with the limits for a Class B digital device, pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a residential installation. This equipment generates, uses and can radiate radio frequency energy and, if not installed and used in accordance with the instructions, may cause harmful interference to radio communications. However, there is no guarantee that interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one of the following measures: - Reorient or relocate the receiving antenna. - Increase the separation between the equipment and receiver. - Connect the equipment into an outlet on a circuit different from that to which the receiver is connected. - Consult the dealer or an experienced radio/TV technician for help. FCC Caution: Any changes or modifications not expressly approved by the party responsible for compliance could void the user's authority to operate this equipment. This device complies with Part 15 of the FCC Rules. Operation is subject to the following two conditions: (1) This device may not cause harmful interference, and (2) this device must accept any interference received, including interference that may cause undesired operation. IMPORTANT NOTE: FCC Radiation Exposure Statement: This equipment complies with FCC radiation exposure limits set forth for an uncontrolled environment. This equipment should be installed and operated with minimum distance 20cm between the radiator & your body. This transmitter must not be co-located or operating in conjunction with any other antenna or transmitter.

Contents OverviewOX253P User’s Guide 9Contents OverviewUser’s Guide ...........................................................................................................................17Getting Started ...........................................................................................................................19Introducing the Web Configurator ..............................................................................................23Internet Connection Wizard....................................................................................................... 29Tutorials .....................................................................................................................................35Technical Reference ..............................................................................................................45The Setup Screens ....................................................................................................................47The LAN Configuration Screens ................................................................................................53The WAN Configuration Screens ...............................................................................................65The NAT Configuration Screens ................................................................................................77The System Configuration Screens ...........................................................................................87The Certificates Screens ...........................................................................................................97The Firewall Screens ................................................................................................................119Content Filter ...........................................................................................................................129The Remote Management Screens .........................................................................................133QoS .........................................................................................................................................145The Logs Screens ...................................................................................................................149The Status Screen ...................................................................................................................163Troubleshooting .......................................................................................................................173Product Specifications .............................................................................................................181

Table of ContentsOX253P User’s Guide 11Table of ContentsAbout This User's Guide..........................................................................................................3Document Conventions............................................................................................................4Safety Warnings........................................................................................................................6Contents Overview...................................................................................................................9Table of Contents....................................................................................................................11Part I: User’s Guide................................................................................17Chapter 1Getting Started........................................................................................................................191.1 About Your OX253P ............................................................................................................191.1.1 WiMAX Internet Access .............................................................................................191.2 OX253P Hardware ..............................................................................................................201.2.1 LEDs ..........................................................................................................................201.3 Good Habits for Managing the Device .................................................................................21Chapter 2Introducing the Web Configurator........................................................................................232.1 Overview ..............................................................................................................................232.1.1 Accessing the Web Configurator ................................................................................232.2 The Main Screen .................................................................................................................25Chapter 3Internet Connection Wizard...................................................................................................293.1 Overview ..............................................................................................................................293.1.1 Welcome to the Setup Wizard ....................................................................................293.1.2 System Information ....................................................................................................303.1.3 Authentication Settings ..............................................................................................313.1.4 IP Address ..................................................................................................................333.1.5 Setup Complete .........................................................................................................34Chapter 4Tutorials...................................................................................................................................354.1 Overview ..............................................................................................................................35

Table of ContentsOX253P User’s Guide124.2 Setting Up a Small Network .................................................................................................354.2.1 Connecting Your Small Network to the Internet .........................................................374.2.2 Changing Service Providers .......................................................................................374.2.3 Blocking Web Access During Specific Hours .............................................................394.2.4 Blocking Web Sites by Keyword ................................................................................424.3 Remotely Managing Your OX253P ......................................................................................44Part II: Technical Reference..................................................................45Chapter 5The Setup Screens..................................................................................................................475.1 Overview ..............................................................................................................................475.1.1 What You Can Do in This Chapter .............................................................................475.1.2 What You Need to Know ............................................................................................475.1.3 Before You Begin .......................................................................................................485.2 Set IP Address .....................................................................................................................485.3 DHCP Client ........................................................................................................................495.4 Time Setting .........................................................................................................................505.4.1 Pre-Defined NTP Time Servers List ...........................................................................515.4.2 Resetting the Time .....................................................................................................52Chapter 6The LAN Configuration Screens............................................................................................536.1 Overview ..............................................................................................................................536.1.1 What You Can Do in This Chapter .............................................................................536.1.2 What You Need to Know ............................................................................................536.2 DHCP Setup ........................................................................................................................546.3 Static DHCP .........................................................................................................................566.4 IP Static Route .....................................................................................................................576.4.1 IP Static Route Setup .................................................................................................586.5 Other Settings ......................................................................................................................596.6 Technical Reference ............................................................................................................606.6.1 IP Address and Subnet Mask .....................................................................................616.6.2 DHCP Setup ...............................................................................................................616.6.3 LAN TCP/IP ................................................................................................................626.6.4 DNS Server Address ..................................................................................................626.6.5 RIP Setup ...................................................................................................................636.6.6 Multicast .....................................................................................................................63Chapter 7The WAN Configuration Screens...........................................................................................65

Table of ContentsOX253P User’s Guide 137.1 Overview ..............................................................................................................................657.1.1 What You Can Do in This Chapter .............................................................................657.1.2 What You Need to Know ............................................................................................657.2 Internet Connection .............................................................................................................687.3 WiMAX Configuration ..........................................................................................................707.3.1 Frequency Ranges .....................................................................................................727.3.2 Configuring Frequency Settings .................................................................................737.3.3 Using the WiMAX Frequency Screen .........................................................................737.4 Buzzer .................................................................................................................................747.5 Advanced .............................................................................................................................75Chapter 8The NAT Configuration Screens............................................................................................778.1 Overview ..............................................................................................................................778.1.1 What You Can Do in This Chapter .............................................................................778.2 General ................................................................................................................................778.3 Port Forwarding ..................................................................................................................788.3.1 Port Forwarding Options ............................................................................................798.3.2 Port Forwarding Rule Setup .......................................................................................818.4 Trigger Port ..........................................................................................................................828.4.1 Trigger Port Forwarding Example ..............................................................................848.5 ALG .....................................................................................................................................85Chapter 9The System Configuration Screens......................................................................................879.1 Overview ..............................................................................................................................879.1.1 What You Can Do in This Chapter .............................................................................879.1.2 What You Need to Know ............................................................................................879.2 General ...............................................................................................................................899.3 Dynamic DNS ......................................................................................................................909.4 Firmware ..............................................................................................................................929.4.1 The Firmware Upload Process ...................................................................................939.5 Configuration .......................................................................................................................939.5.1 The Restore Configuration Process ...........................................................................949.6 Restart .................................................................................................................................959.6.1 The Restart Process ..................................................................................................959.7 Bridge ..................................................................................................................................95Chapter 10The Certificates Screens........................................................................................................9710.1 Overview ............................................................................................................................9710.1.1 What You Can Do in This Chapter ...........................................................................9710.1.2 What You Need to Know ..........................................................................................97

Table of ContentsOX253P User’s Guide1410.2 My Certificates ...................................................................................................................9810.2.1 My Certificates Create ............................................................................................10010.2.2 My Certificate Edit ..................................................................................................10410.2.3 My Certificate Import ............................................................................................10710.3 Trusted CAs .....................................................................................................................10810.3.1 Trusted CA Edit ......................................................................................................11010.3.2 Trusted CA Import ..................................................................................................11310.4 Technical Reference .........................................................................................................11310.4.1 Certificate Authorities ..............................................................................................11410.4.2 Verifying a Certificate ..............................................................................................116Chapter 11The Firewall Screens............................................................................................................11911.1 Overview ...........................................................................................................................11911.1.1 What You Can Do in This Chapter ..........................................................................11911.1.2 What You Need to Know .........................................................................................11911.2 Firewall Setting ................................................................................................................12011.2.1 Firewall Rule Directions ..........................................................................................12011.2.2 Triangle Route ........................................................................................................12111.2.3 Firewall Setting Options .........................................................................................12211.3 Services ...........................................................................................................................12311.4 Technical Reference ........................................................................................................12411.4.1 Stateful Inspection Firewall. ....................................................................................12411.4.2 Guidelines For Enhancing Security With Your Firewall ..........................................12511.4.3 The “Triangle Route” Problem ................................................................................125Chapter 12Content Filter.........................................................................................................................12912.1 Overview ..........................................................................................................................12912.1.1 What You Can Do in This Chapter .........................................................................12912.2 Filter .................................................................................................................................13012.3 Schedule ..........................................................................................................................132Chapter 13The Remote Management Screens.....................................................................................13313.1 Overview ..........................................................................................................................13313.1.1 What You Can Do in This Chapter .........................................................................13313.1.2 What You Need to Know ........................................................................................13413.2 WWW ..............................................................................................................................13513.3 Telnet ...............................................................................................................................13613.4 FTP ..................................................................................................................................13613.5 SNMP ..............................................................................................................................13713.5.1 SNMP Traps ...........................................................................................................138

Table of ContentsOX253P User’s Guide16Appendix B Setting Up Your Computer’s IP Address...........................................................189Appendix C Pop-up Windows, JavaScripts and Java Permissions......................................217Appendix D IP Addresses and Subnetting...........................................................................229Appendix E Importing Certificates........................................................................................241Appendix F Common Services.............................................................................................271Index.......................................................................................................................................275

OX253P User’s Guide 19CHAPTER 1 Getting Started1.1 About Your OX253P The OX253P has a built-in switch and allows you to access the Internet by connecting to a WiMAX wireless network. You can configure firewall and content filtering as well as a host of other features. The web browser-based Graphical User Interface (GUI), also known as the web configurator, provides easy management.See Chapter 18 on page 181 for a complete list of features for your model.1.1.1 WiMAX Internet AccessConnect your computer or network to the OX253P for WiMAX Internet access. See the Quick Start Guide for instructions on hardware connection.In a wireless metropolitan area network (MAN), the OX253P connects to a WiMAX base station (BS) for Internet access. The following diagram shows a notebook computer equipped with the OX253P connecting to the Internet through a WiMAX base station (marked BS).Figure 1 Mobile Station and Base StationWhen the firewall is on, all incoming traffic from the Internet to your network is blocked unless it is initiated from your network. Use content filtering to block access to web sites with URLs containing keywords that you specify. You can define time periods and days during which content

Chapter 1Getting StartedOX253P User’s Guide20filtering is enabled and include or exclude particular computers on your network from content filtering. For example, you could block access to certain web sites for the kids.1.2 OX253P HardwareFollow the instructions in the Quick Start Guideto make hardware connections.1.2.1 LEDsThe following figure shows the LEDs (lights) on the OX253P.Figure 2 The OX253P’s LEDsThe following table describes your OX253P’s LEDs (from right to left). Table 2 The OX253PLED STATE DESCRIPTIONPower (IDU only) OffThe OX253P is not receiving power.GreenThe OX253P is receiving power and functioning correctly.STRENGTHINDICATORSACTIVITYINDICATOR

Chapter 1Getting StartedOX253P User’s Guide 211.3 Good Habits for Managing the DeviceDo the following things regularly to make the OX253P more secure and to manage the OX253P more effectively.•Change the password. Use a password that’s not easy to guess and that consists of different types of characters, such as numbers and letters.•Write down the password and put it in a safe place.•Back up the configuration (and make sure you know how to restore it). Restoring an earlier working configuration may be useful if the OX253P becomes unstable or even crashes. If you forget your password, you will have to reset the OX253P to its factory default settings. If you backed up an earlier configuration file, you would not have to totally re-configure the OX253P. You could simply restore your last configuration.StrengthIndicator The Strength Indicator LEDs display the Received Signal Strength Indication (RSSI) of the wireless (WiMAX) connection. 5 Signal LEDsThe signal strength is greater than or equal to -59 dBm.4 Signal LEDsThe signal strength is between -69 and -60 dBm.3 Signal LEDsThe signal strength is between -79 and -70 dBm.2 Signal LEDsThe signal strength is between -89 and -90 dBm.1 Signal LEDThe signal strength is between -90 and -95 dBm.0 Signal LEDsThere is no WiMAX connection.Activity Indicator OffThe OX253P is not ready.GreenThe OX253P is connected to the network.BlinkingThe OX253P system is booting up or the OX253P is seeking a viable signal.Table 2 The OX253PLED STATE DESCRIPTION

Chapter 1Getting StartedOX253P User’s Guide22

OX253P User’s Guide 23CHAPTER 2 Introducing the WebConfigurator2.1 OverviewThe web configurator is an HTML-based management interface that allows easy device set up and management via any web browser that supports: HTML 4.0, CSS 2.0, and JavaScript 1.5, and higher. The recommended screen resolution for using the web configurator is 1024 by 768 pixels and 16-bit color, or higher.In order to use the web configurator you need to allow:•Web browser pop-up windows from your device. Web pop-up blocking is enabled by default in many operating systems and web browsers.•JavaScript (enabled by default in most web browsers).•Java permissions (enabled by default in most web browsers).See the Appendix C on page 217 for more information on configuring your web browser.2.1.1 Accessing the Web Configurator1Make sure your OX253P hardware is properly connected (refer to the Quick Start Guide for more information).2Launch your web browser.3Enter "192.168.1.1" as the URL.4Select your preferable language from the language drop-down list.

Chapter 2Introducing the Web ConfiguratorOX253P User’s Guide245A password screen displays. Enter the default username (admin) and password (admin) and then click Login. Click Cancel to revert to the default password in the password field. If you have changed the password, enter your password and click Login.6The following screen displays. Click Apply to have the OX253P generate a new certificate. You can also click Ignore to have the OX253P use the default certificate.7A screen displays to let you choose to go to the Wizard or the Advanced screens.•Click Go to Wizard setup if you are logging in for the first time or if you want to make basic changes. The wizard selection screen appears. See Chapter 3 on page 29 for more information.•Click Go to Advanced setup if you want to configure features that are not available in the wizards. The main screen appears. See Section 16.2 on page 163 for more information.•Click Exit if you want to log out.

Chapter 2Introducing the Web ConfiguratorOX253P User’s Guide 25Note: For security reasons, the OX253P automatically logs you out if you do not use the Web Configurator for five minutes. If this happens, log in again.2.2 The Main ScreenWhen you first log into the web configurator and by-pass the wizard, the Main screen appears. Here you can view a summary of your OX253P connection status. This is also the default “home” page for the web configurator and it contains conveniently-placed shortcuts to all of the other screens.Note: Some features in the web configurator may not be available depending on your firmware version and/or configuration.Figure 3 Main ScreenThe following table describes the icons in this screen.Table 3 Main > IconsICON DESCRIPTIONMAINClick to return to the Main screen.SETUPClick to go the Setup screen, where you can configure LAN, DHCP and WAN settings.

Chapter 2Introducing the Web ConfiguratorOX253P User’s Guide26The following table describes the labels in this screen. ADVANCEDClick to go to the Advanced screen, where you can configure features like Port Forwarding and Triggering, SNTP and so on.TOOLSClick to go the Tools screen, where you can configure your firewall, QoS, and content filter, among other things.STATUSClick to go to the Status screen, where you can view status and statistical information for all connections and interfaces.Strength IndicatorDisplays a visual representation of the quality of your WiMAX connection.•Disconnected - Zero bars•Poor reception - One bar•Good reception - Two bars•Excellent reception - Three barsTable 4 MainLABEL DESCRIPTIONWizardClick to run the Internet Connection Setup Wizard. All of the settings that you can configure in this wizard are also available in these web configurator screens.LogoutClick to log out of the web configurator.Note: This does not log you off the WiMAX network, it simply logs you out of the OX253P’s browser-based configuration interface.WiMAX Connection Status This field indicates the current status of your WiMAX connection.Status messages are as follows:•Connected - Indicates that the OX253P is connected to the WiMAX network. Use the Strength Indicator icon to determine the quality of your network connection.•Disconnected - Indicates that the OX253P is not connected to the WiMAX network.•DL_SYN - Indicates a download synchronization is in progress. This means the firmware is checking with the server for any updates or settings alterations.Table 3 Main > Icons (continued)ICON DESCRIPTION

Chapter 2Introducing the Web ConfiguratorOX253P User’s Guide 27Software VersionThis field indicates the version number of the OX253P’s firmware. The version number takes the form of: Version(Build),release status (candidate) | Version Release Date.For example: V3.70(TPG.0)c4 | 07/08/2010 indicates that the firmware is 3.70, build TPG.0, candidate 4, released on July 08, 2010.Version DateThis field indicates the exact date and time the current firmware was compiled.System UptimeThis field indicates how long the OX253P has been on. This resets every time you shut the device down or restart it.WiMAX UptimeThis field indicates how long the OX253P has been connected to the WiMAX network. This resets every time you disconnect from the WiMAX network, shut the device down, or restart it.Table 4 Main (continued)LABEL DESCRIPTION

Chapter 2Introducing the Web ConfiguratorOX253P User’s Guide28

OX253P User’s Guide 29CHAPTER 3 Internet Connection Wizard3.1 OverviewThis chapter provides information on the Setup Wizard screens. The wizard guides you through several steps where you can configure your Internet settings.3.1.1 Welcome to the Setup WizardThis is the welcome screen for the Setup Wizard.The Internet Connection Wizard screens are described in detail in the following sections.Figure 4 Select a Mode

Chapter 3Internet Connection WizardOX253P User’s Guide303.1.2 System InformationThis Internet Connection Wizard screen allows you to configure your OX253P’s system information. The settings here correspond to the ADVANCED > System Configuration > General screen (see Section 9.2 on page 89 for more).Figure 5 Internet Connection Wizard > System InformationThe following table describes the labels in this screen.Table 5 Internet Connection Wizard > System InformationLABEL DESCRIPTIONSystem Name System Name is a unique name to identify the OX253P in an Ethernet network. Enter a descriptive name. This name can be up to 30 alphanumeric characters long. Spaces are not allowed, but dashes "-" and underscores "_" are accepted. DomainName Type the domain name (if you know it) here. If you leave this field blank, the ISP may assign a domain name via DHCP. The domain name entered by you is given priority over the ISP assigned domain name.Back Click to display the previous screen.Next Click to proceed to the next screen. Close Click to close the wizard without saving.

Chapter 3Internet Connection WizardOX253P User’s Guide 313.1.3 Authentication SettingsThis Internet Connection Wizard screen allows you to configure your Internet access settings. The settings here correspond to the ADVANCED > WAN Configuration > Internet Connection screen (see Section 7.2 on page 68 for more information).Figure 6 Internet Connection Wizard > Authentication Settings ScreenThe following table describes the labels in this screen.Table 6 Internet Connection Wizard > Authentication Settings ScreenLABEL DESCRIPTIONUser NameUse this field to enter the username associated with your Internet access account. You can enter up to 61 printable ASCII characters.PasswordUse this field to enter the password associated with your Internet access account. You can enter up to 47 printable ASCII characters.Anonymous Identity Enter the anonymous identity provided by your Internet Service Provider. Anonymous identity (also known as outer identity) is used with EAP-TTLS encryption. The anonymous identity is used to route your authentication request to the correct authentication server, and does not reveal your real user name. Your real user name and password are encrypted in the TLS tunnel, and only the anonymous identity can be seen.Leave this field blank if your ISP did not give you an anonymous identity to use.PKMThis field displays the Privacy Key Management version number. PKM provides security between the OX253P and the base station. At the time of writing, the OX253P supports PKMv2 only. See the WiMAX security appendix for more information.

Chapter 3Internet Connection WizardOX253P User’s Guide32AuthenticationThis field displays the user authentication method. Authentication is the process of confirming the identity of a mobile station (by means of a username and password, for example).Check with your service provider if you are unsure of the correct setting for your account. Choose from the following user authentication methods:•TTLS (Tunnelled Transport Layer Security)•TLS (Transport Layer Security)Note: Not all OX253Ps support TLS authentication. Check with your service provider for details.TTLS Inner EAPThis field displays the type of secondary authentication method. Once a secure EAP-TTLS connection is established, the inner EAP is the protocol used to exchange security information between the mobile station, the base station and the AAA server to authenticate the mobile station. See the WiMAX security appendix for more details. The OX253P supports the following inner authentication types:•CHAP (Challenge Handshake Authentication Protocol)•MSCHAP (Microsoft CHAP)•MSCHAPV2 (Microsoft CHAP version 2)•PAP (Password Authentication Protocol)CertificateThis is the security certificate the OX253P uses to authenticate the AAA server. Use the TOOLS > Certificates > Trusted CA screen to import certificates to the OX253P.Back Click to display the previous screen.Next Click to proceed to the next screen.Close Click to close the wizard without saving.Table 6 Internet Connection Wizard > Authentication Settings Screen (continued)LABEL DESCRIPTION

Chapter 3Internet Connection WizardOX253P User’s Guide 333.1.4 IP AddressThis Internet Connection Wizard screen allows you to configure your IP address. The settings here correspond to the SETUP > Set IP Address screen (see Section 5.2 on page 48).A fixed IP address is a static IP that your ISP gives you. An automatic (dynamic) IP address is not fixed; the ISP assigns you a different one each time you connect to the Internet.Figure 7 Internet Connection Wizard > IP AddressThe following table describes the labels in this screen.Table 7 Internet Connection Wizard > IP AddressLABEL DESCRIPTIONIP AddressMy computer or device gets its IP address automatically from the networkSelect this if you have a dynamic IP address. A dynamic IP address is not fixed; the ISP assigns you a different one each time you connect to the Internet.Use fixed IP AddressA static IP address is a fixed IP that your ISP gives you.BackClick to display the previous screen.Next Click to proceed to the next screen.Close Click to close the wizard screen without saving.

Chapter 3Internet Connection WizardOX253P User’s Guide343.1.5 Setup CompleteClick Close to complete and save the Internet Connection Wizard settings.Figure 8 Internet Connection Wizard > CompleteLaunch your web browser and navigate to a website of your choice . If everything was configured properly, the web page should display. You can now surf the Internet!Refer to the rest of this guide for more detailed information on the complete range of OX253P features available in the more advanced web configurator. Note: If you cannot access the Internet, open the web configurator again to confirm that the Internet settings you configured in the wizard setup are correct.

OX253P User’s Guide 35CHAPTER 4 Tutorials4.1 OverviewThis chapter shows you how to configure some of the OX253P’s features.Note: Be sure to read Introducing the Web Configurator on page 23 before working through the tutorials presented here. For field descriptions of individual screens, see the related technical reference in this User's Guide.4.2 Setting Up a Small NetworkThis tutorial shows you how to set up a small network in your office or home.Goal: Connect three computers to your OX253P to form a small network.

Chapter 4TutorialsOX253P User’s Guide36Required: The following table provides a summary of the information you will need to complete the tasks in this tutorial. 1In the Web Configurator, open the SETUP > Set IP Address screen and set the IP Address to 192.168.100.1. Use the default IP Subnet Mask of 255.255.255.0.2Open the ADVANCED > LAN Configuration > DHCP Setup screen.3Select Enable DHCP Server, then enter 192.168.100.34 as your IP Pool Starting Address and 32 for your Pool Size.4In the DNS Server section, set the First,Second and Third DNS Server fields to From ISP in order to use the DNS servers linked to your ISP.5Click Apply to save your DHCP settings.INFORMATION VALUE SEE ALSOLAN IP Address192.168.100.1 Chapter 5 on page 47Starting IP Address192.168.100.33 Chapter 6 on page 53Pool Size32DNS ServersFrom ISP

Chapter 4TutorialsOX253P User’s Guide 376Next, go to the ADVANCED > NAT Configuration > General screen and select the Enable Network Address Translation option.7Click Apply to save your settings.8Connect your computers to the OX253P’s Ethernet ports and you’re all set!Note: You may need to configure the computers on your LAN to automatically obtain IP addresses. For information on how to do this, see Appendix B on page 189.4.2.1 Connecting Your Small Network to the InternetOnce your network is configured and hooked up, you will want to connect it to the Internet next. To do this, just run the Internet Connection Wizard (Chapter 3 on page 29), which walks you through the process.4.2.2 Changing Service ProvidersThis tutorial shows you how to import a new security certificate, which allows your device to communicate with the company’s network servers. This is necessary if you ever change Internet Service Providers and your OX253P is still compatible with the new network. (In some cases it may not be.)Goal: Import a new security certificate into the OX253P.See Also:Chapter 10 on page 97.

Chapter 4TutorialsOX253P User’s Guide381In the Web Configurator, open the TOOLS > Certificates > My Certificatesscreen and click the Import button.2In the Import Certificate screen, click Browse andlocate the security certificate that was provided by your new ISP.

Chapter 4TutorialsOX253P User’s Guide 393Next, go to the ADVANCED > WAN Configuration screen and configure your new Internet access settings based on the information provided by your ISP.Note: You can also use the Internet Connection Wizard to configure these settings.4From the Certificates menu, select the security certificate that you just imported.5Click Apply to save your settings. You should now be able to connect to the Internet through your new service provider!4.2.3 Blocking Web Access During Specific HoursIf your OX253P is in a home or office environment you may decide that you want to block web access and video chat during a specific block of hours, such as during your daughter’s designated study hours. Goal: Configure the OX253P’s firewall to block web and video chat access on weekdays between the hours of 3:30 PM and 8:30 PM.’See Also:Chapter 11 on page 119.

Chapter 4TutorialsOX253P User’s Guide401Open the TOOLS > Firewall > Services to screen.2Select Enable Services Blocking.

Chapter 4TutorialsOX253P User’s Guide 413Under Available Services, select HTTP(TCP:80) then click the Add button.Repeat this for CU-SEEME(TCP/UDP:7648,24032).This blocks all web and video chat traffic, while leaving other ports open for other types of traffic, such as ports 25 and 587 for e-mail and port 21 for FTP.The Blocked Services window updates accordingly.4Next, configure the Schedule to Block area with the days and hours for blocking web access to your employees.In this example, the five weekly work days are selected as well as the standard work hours of 3:30 PM to 8:30 PM (or 20:30 in 24-hour format).5Finally, click Apply to save your settings.

Chapter 4TutorialsOX253P User’s Guide424.2.4 Blocking Web Sites by KeywordYou can further refine web access by specifying keywords that appear in a URL and blocking them. This allows you to control the content you do allow to pass through the OX253P. For example, once your daughter’s designated study hours end, you allow web access and video chat but want to restrict certain sites.Goal: Restrict websites with the words “poker”, “sex”, and “beer” in their URLs.See Also:Chapter 12 on page 129.1Open the TOOLS > Content Filter > Filter screen.2Select Enable URL Keyword Blocking.

Chapter 4TutorialsOX253P User’s Guide 433Enter the first Keyword then click Add. Repeat for additional keywords.As you enter them, the keywords appear in the Keyword List.4(Optional) If you want to allow websites with these keywords for a specific computer in your household, such as the computer in the master bedroom, then add that computer’s IP address to the Trusted IP Address field.5Click Apply to save these settings.6Next, open the TOOLS > Content Filter > Schedule screen.7To keep things simple, set the Days to Block to Everyday and the Time of Day to Block to All Day.8Click Apply to save these settings.

Chapter 4TutorialsOX253P User’s Guide444.3 Remotely Managing Your OX253PThe remote management feature allows you to log into the device over the Internet and configure its settings from a second trusted location.Goal: Set up the OX253P to allow management requests from the (demonstration) IP address 2.2.2.2.See Also:Chapter 13 on page 133.1Open the TOOLS > Remote Management > WWW screen.2Leave the Server Port setting as ‘80’, in order to allow computers back at the OX253P’s location to continue to access the Internet.3From the Server Access menu, select WAN. This allows remote management connections only from the Internet.4Finally, in the Secured Client IP Address field enter 2.2.2.2 as the IP address from which you will be connecting to the OX253P. Any other attempts by computer on the Internet to connect will be rejected because their IP addresses won’t match the one specified here.5Click Apply to save your changes.

OX253P User’s Guide 47CHAPTER 5 The Setup Screens5.1 OverviewUse these screens to configure or view LAN, DHCP Client and WAN settings.5.1.1 What You Can Do in This Chapter•The Set IP Address screen (Section 5.2 on page 48) lets you configure the OX253P’s IP address and subnet mask.•The DHCP Client screen (Section 5.3 on page 49) to view connection information for clients configured by the OX253P’s internal DHCP server.•The Time Setting screen (Section 5.4 on page 50) lets you configure your OX253P’s time and date keeping settings.5.1.2 What You Need to KnowThe following terms and concepts may help as you read through this chapter.LANA Local Area Network, or a shared communication system to which many computers are attached. A LAN, as its name implies, is limited to a local area such as a home or office environment. LANs have different topologies, the most common being the linear bus and the star configuration.IP AddressIP addresses identify individual devices on a network. Every networking device (including computers, servers, routers, printers, etc.) needs an IP address to communicate across the network. These networking devices are also known as hosts.Subnet MaskThe subnet mask specifies the network number portion of an IP address. Your device will compute the subnet mask automatically based on the IP Address that

Chapter 5The Setup ScreensOX253P User’s Guide48you entered. You do not need to change the computer subnet mask unless you are instructed to do so.DaytimeA network protocol used by devices for debugging and time measurement. A computer can use this protocol to set its internal clock but only if it knows in which order the year, month, and day are returned by the server. Not all servers use the same format.TimeA network protocol for retrieving the current time from a server. The computer issuing the command compares the time on its clock to the information returned by the server, adjusts itself automatically for time zone differences, then calculates the difference and corrects itself if there has been any temporal drift.NTPNTP stands for Network Time Protocol. It is employed by devices connected to the Internet in order to obtain a precise time setting from an official time server. These time servers are accurate to within 200 microseconds.5.1.3 Before You Begin•Make sure that you have made all the appropriate hardware connections to the OX253P, as described in the Quick Start Guide.•Make sure that you have logged in to the web configurator at least one time and changed your password from the default, as described in the Quick Start Guide.5.2 Set IP AddressClick the SETUP icon in the navigation bar to set up the OX253P’s IP address and subnet mask. This screen displays this screen by default. If you are in any other sub-screen you can simply choose Set IP Address from the navigation menu on the left to open it again.Figure 9 SETUP > Set IP Address

Chapter 5The Setup ScreensOX253P User’s Guide 49The following table describes the labels in this screen. 5.3 DHCP ClientClick the SETUP > DHCP Client to view connection information for all clients that have been configured by the OX253P’s internal DHCP server.Figure 10 SETUP > Set IP AddressThe following table describes the labels in this screen. Table 8 SETUP > Set IP AddressLABEL DESCRIPTIONIP Address Enter the IP address of the OX253P on the LAN.Note: This field is the IP address you use to access the OX253P on the LAN. If the web configurator is running on a computer on the LAN, you lose access to it as soon as you change this field and click Apply. You can access the web configurator again by typing the new IP address in the browser.IP Subnet Mask Enter the subnet mask of the LAN.Apply Click to save your changes.Reset Click to restore your previously saved settings.Table 9 SETUP > Set IP AddressLABEL DESCRIPTION#This indicates the number of the item in this list.IP Address This indicates the IP address of a connected client device.Host Name This indicates the host name of a connected client device. If the device is computer, then the host name is the computer name.MAC Address This indicates the MAC address of a connected client device.

Chapter 5The Setup ScreensOX253P User’s Guide505.4 Time SettingClick SETUP >Time Setting to set the date, time, and time zone for the OX253P.Figure 11 SETUP > Time SettingThe following table describes the labels in this screen. Reserve This indicates whether the IP address for the connected client device is reserved. When the DHCP server issues IP addresses, reserved IPs are assigned to specific client devices.If the IP address is reserved, the client device identified by its MAC address will always receive this IP address from the DHCP server.Apply Click to save your changes.Refresh Click to refresh the information in the screen.Table 9 SETUP > Set IP Address (continued)LABEL DESCRIPTIONTable 10 SETUP > Time SettingLABEL DESCRIPTIONCurrent Time and DateCurrent TimeDisplays the current time according to the OX253P.

Chapter 5The Setup ScreensOX253P User’s Guide 515.4.1 Pre-Defined NTP Time Servers ListThe OX253P uses a pre-defined list of NTP time servers if you do not specify a time server or it cannot synchronize with the time server you specified. It can use this list regardless of the time protocol you select.When the OX253P uses the list, it randomly selects one server and tries to synchronize with it. If the synchronization fails, then it goes through the rest of Current DateDisplays the current time according to the OX253P.Time and Date SetupManual Select this if you want to specify the current date and time in the fields below.New Time Enter the new time in this field, and click Apply.New Date Enter the new date in this field, and click Apply.Get from Time Server Select this if you want to use a time server to update the current date and time in the OX253P.Time ProtocolSelect the time service protocol that your time server uses.Check with your ISP or network administrator, or use trial-and-error to find a protocol that works.Daytime (RFC-867) - This format is day/month/year/time zone.Time (RFC-868) - This format displays a 4-byte integer giving the total number of seconds since 1970/1/1 at 0:0:0.NTP (RFC-1305) - This format is similar to Time (RFC 868).Time Server Address Enter the IP address or URL of your time server. Check with your ISP or network administrator if you are unsure of this information.Time Zone SetupTime ZoneSelect the time zone at your location.Daylight SavingsSelect this if your location uses daylight savings time. Daylight savings is a period from late spring to early fall when many places set their clocks ahead of normal local time by one hour to give more daytime light in the evening.Start DateEnter which hour on which day of which week of which month daylight-savings time starts.End DateEnter which hour on the which day of which week of which month daylight-savings time ends.Apply Click to save your changes.Reset Click to restore your previously saved settings.Table 10 SETUP > Time Setting (continued)LABEL DESCRIPTION

Chapter 5The Setup ScreensOX253P User’s Guide52the list in order until either it is successful or all the pre-defined NTP time servers have been tried. 5.4.2 Resetting the TimeThe OX253P automatically resets the time in the following circumstances:•When the device starts up, such as when you press the Power button.•When you click Apply in the SETUP > Time Setting screen.•Once every 24-hours after starting up.Table 11 Pre-defined NTP Time Serversntp1.cs.wisc.eduntp1.gbg.netnod.sentp2.cs.wisc.edutock.usno.navy.milntp3.cs.wisc.eduntp.cs.strath.ac.ukntp1.sp.setime1.stupi.setick.stdtime.gov.twtock.stdtime.gov.twtime.stdtime.gov.tw

OX253P User’s Guide 53CHAPTER 6 The LAN Configuration Screens6.1 OverviewUse the ADVANCED > LAN Configuration screens to set up the OX253P on the LAN. You can configure its IP address and subnet mask, DHCP services, and other subnets. You can also control how the OX253P sends routing information using RIP.A Local Area Network (LAN) is a shared communication system to which many computers are attached. A LAN is usually a computer network limited to the immediate area, such as the same building or floor of a building.6.1.1 What You Can Do in This Chapter•The DHCP Setup screen (Section 6.2 on page 54) lets you enable, disable, and configure the DHCP server in the OX253P.•The Static DHCP screen (Section 6.3 on page 56) lets you assign specific IP addresses to specific computers on the LAN.•The IP Static Route screen (Section 6.4 on page 57) lets you examine the static routes configured in the OX253P.•The Other Settings screen (Section 6.5 on page 59) lets you control the routing information that is sent and received by each subnet assign specific IP addresses to specific computers on the LAN.6.1.2 What You Need to KnowThe following terms and concepts may help as you read through this chapter.IP AddressIP addresses identify individual devices on a network. Every networking device (including computers, servers, routers, printers, etc.) needs an IP address to communicate across the network. These networking devices are also known as hosts.

Chapter 6The LAN Configuration ScreensOX253P User’s Guide54Subnet MasksSubnet masks determine the maximum number of possible hosts on a network. You can also use subnet masks to divide one network into multiple sub-networks.DNSDNS (Domain Name System) is for mapping a domain name to its corresponding IP address and vice versa. The DNS server is extremely important because without it, you must know the IP address of a networking device before you can access it.DHCPA DHCP (Dynamic Host Configuration Protocol) server can assign your OX253P an IP address, subnet mask, DNS and other routing information when it’s turned on.6.2 DHCP SetupClick ADVANCED > LAN Configuration > DHCP Setup to enable, disable, and configure the DHCP server in the OX253P.Figure 12 ADVANCED > LAN Configuration > DHCP SetupThe following table describes the labels in this screen. Table 12 ADVANCED > LAN Configuration > DHCP SetupLABEL DESCRIPTIONDHCP SetupEnable DHCP Server Select this if you want the OX253P to be the DHCP server on the LAN. As a DHCP server, the OX253P assigns IP addresses to DHCP clients on the LAN and provides the subnet mask and DNS server information.

Chapter 6The LAN Configuration ScreensOX253P User’s Guide 55IP Pool Starting Address Enter the IP address from which the OX253P begins allocating IP addresses, if you have not specified an IP address for this computer in ADVANCED > LAN Configuration > Static DHCP.Pool Size Enter the number of IP addresses to allocate. This number must be at least one and is limited by a subnet mask of 255.255.255.0 (regardless of the subnet the OX253P is in). For example, if the IP Pool Start Address is 10.10.10.10, the OX253P can allocate up to 10.10.10.254, or 245 IP addresses.DNS ServerFirst, Second and Third DNS ServerSpecify the IP addresses of a maximum of three DNS servers that the network can use. The OX253P provides these IP addresses to DHCP clients. You can specify these IP addresses two ways.From ISP - provide the DNS servers provided by the ISP on the WAN port.User Defined - enter a static IP address.DNS Relay - this setting will relay DNS information from the DNS server obtained by the OX253P.None - no DNS service will be provided by the OX253P.Apply Click to save your changes.Reset Click to restore your previously saved settings.Table 12 ADVANCED > LAN Configuration > DHCP Setup (continued)LABEL DESCRIPTION

Chapter 6The LAN Configuration ScreensOX253P User’s Guide566.3 Static DHCPClick ADVANCED > LAN Configuration > Static DHCP to assign specific IP addresses to specific computers on the LAN.Note: This screen has no effect if the DHCP server is not enabled. You can enable it in ADVANCED > LAN Configuration > DHCP Setup.Figure 13 ADVANCED > LAN Configuration > Static DHCPThe following table describes the labels in this screen. Table 13 ADVANCED > LAN Configuration > Static DHCPLABEL DESCRIPTION#The number of the item in this list.MAC Address Enter the MAC address of the computer to which you want the OX253P to assign the same IP address.IP Address Enter the IP address you want the OX253P to assign to the computer.Apply Click to save your changes.Reset Click to restore your previously saved settings.

Chapter 6The LAN Configuration ScreensOX253P User’s Guide 576.4 IP Static RouteClick ADVANCED > LAN Configuration > IP Static Route to look at the static routes configured in the OX253P.Note: The first static route is the default route and cannot be modified or deleted.Figure 14 Advanced> LAN Configuration > IP Static RouteThe following table describes the icons in this screen.The following table describes the labels in this screen. Table 14 Advanced> LAN Configuration > IP Static RouteICON DESCRIPTIONEditClick to edit this item.DeleteClick to delete this item.Table 15 Advanced> LAN Configuration > IP Static RouteLABEL DESCRIPTION#The number of the item in this list.Name This field displays the name that describes the static route.

Chapter 6The LAN Configuration ScreensOX253P User’s Guide586.4.1 IP Static Route SetupClick an Edit icon in ADVANCED > LAN Configuration > IP Static Route to edit a static route in the OX253P.Figure 15 Advanced> LAN Configuration > IP Static Route Setup > EditThe following table describes the labels in this screen.Active This field shows whether this static route is active (Yes) or not (No).Destination This field displays the destination IP address(es) that this static route affects.Gateway This field displays the IP address of the gateway to which the OX253P should send packets for the specified Destination. The gateway is a router or a switch on the same network segment as the device's LAN or WAN port. The gateway helps forward packets to their destinations.Action Click the Edit icon to modify this item.Click the Delete icon to remove this item.Table 15 Advanced> LAN Configuration > IP Static Route (continued)LABEL DESCRIPTIONTable 16 Advanced> LAN Configuration > IP Static Route Setup > EditLABEL DESCRIPTIONRoute Name Enter the name of the static route.Active Select this if you want the static route to be used. Clear this if you do not want the static route to be used.Private Select this if you do not want the OX253P to tell other routers about this static route. For example, you might select this if the static route is in your LAN. Clear this if you want the OX253P to tell other routers about this static route.Destination IP Address Enter one of the destination IP addresses that this static route affects.

Chapter 6The LAN Configuration ScreensOX253P User’s Guide 596.5 Other SettingsClick ADVANCED > LAN Configuration > Other Settings to set the RIP and Multicast options.Figure 16 ADVANCED > LAN Configuration > Other SettingsIP Subnet Mask Enter the subnet mask that defines the range of destination IP addresses that this static route affects. If this static route affects only one IP address, enter 255.255.255.255.Gateway IP Address Enter the IP address of the gateway to which the OX253P should send packets for the specified Destination. The gateway is a router or a switch on the same network segment as the device's LAN or WAN port. The gateway helps forward packets to their destinations.Metric Usually, you should keep the default value. This field is related to RIP.The metric represents the "cost of transmission". A router determines the best route for transmission by choosing a path with the lowest "cost". The smaller the metric, the lower the "cost". RIP uses hop count as the measurement of cost, where 1 is for a directly-connected network. The metric must be 1-15; if you use a value higher than 15, the routers assume the link is down.Apply Click to save your changes.Cancel Click to return to the previous screen without saving your changes.Table 16 Advanced> LAN Configuration > IP Static Route Setup > Edit (continued)LABEL DESCRIPTION

Chapter 6The LAN Configuration ScreensOX253P User’s Guide60The following table describes the labels in this screen.6.6 Technical ReferenceThe following section contains additional technical information about the OX253P features described in this chapter.Table 17 ADVANCED > LAN Configuration > Other SettingsLABEL DESCRIPTIONRIP & Multicast SetupRIP Direction Use this field to control how much routing information the OX253P sends and receives on the subnet.•None - The OX253P does not send or receive routing information on the subnet.•Both - The OX253P sends and receives routing information on the subnet.•In Only - The OX253P only receives routing information on the subnet.•Out Only - The OX253P only sends routing information on the subnet.RIP Version Select which version of RIP the OX253P uses when it sends or receives information on the subnet.•RIP-1 - The OX253P uses RIPv1 to exchange routing information.•RIP-2B - The OX253P broadcasts RIPv2 to exchange routing information.•RIP-2M - The OX253P multicasts RIPv2 to exchange routing information.Multicast You do not have to enable multicasting to use RIP-2M. (See RIPVersion.)Select which version of IGMP the OX253P uses to support multicasting on the LAN. Multicasting sends packets to some computers on the LAN and is an alternative to unicasting (sending packets to one computer) and broadcasting (sending packets to every computer).•None - The OX253P does not support multicasting.•IGMP-v1 - The OX253P supports IGMP version 1.•IGMP-v2 - The OX253P supports IGMP version 2.Multicasting can improve overall network performance. However, it requires extra processing and generates more network traffic. In addition, other computers on the LAN have to support the same version of IGMP.Apply Click to save your changes.Reset Click to restore your previously saved settings.

Chapter 6The LAN Configuration ScreensOX253P User’s Guide 616.6.1 IP Address and Subnet MaskSimilar to the way houses on a street share a common street name, computers on a LAN share one common network number.Where you obtain your network number depends on your particular situation. If the ISP or your network administrator assigns you a block of registered IP addresses, follow their instructions in selecting the IP addresses and the subnet mask.If the ISP did not explicitly give you an IP network number, then most likely you have a single user account and the ISP will assign you a dynamic IP address when the connection is established. If this is the case, it is recommended that you select a network number from 192.168.0.0 to 192.168.255.0 and you must enable the Network Address Translation (NAT) feature of the OX253P. The Internet Assigned Number Authority (IANA) reserved this block of addresses specifically for private use; please do not use any other number unless you are told otherwise. Let's say you select 192.168.1.0 as the network number; which covers 254 individual addresses, from 192.168.1.1 to 192.168.1.254 (zero and 255 are reserved). In other words, the first three numbers specify the network number while the last number identifies an individual computer on that network.Once you have decided on the network number, pick an IP address that is easy to remember, for instance, 192.168.1.1, for your OX253P, but make sure that no other device on your network is using that IP address.The subnet mask specifies the network number portion of an IP address. Your OX253P will compute the subnet mask automatically based on the IP address that you entered. You don't need to change the subnet mask computed by the OX253P unless you are instructed to do otherwise.6.6.2 DHCP SetupDHCP (Dynamic Host Configuration Protocol, RFC 2131 and RFC 2132) allows individual clients to obtain TCP/IP configuration at start-up from a server. You can configure the OX253P as a DHCP server or disable it. When configured as a server, the OX253P provides the TCP/IP configuration for the clients. If DHCP service is disabled, you must have another DHCP server on your LAN, or else each computer must be manually configured.The OX253P is pre-configured with a pool of IP addresses for the DHCP clients (DHCP Pool). See the product specifications in the appendices. Do not assign static IP addresses from the DHCP pool to your LAN computers.These parameters should work for the majority of installations. If your ISP gives you explicit DNS server address(es), see Section 6.3 on page 56.

Chapter 6The LAN Configuration ScreensOX253P User’s Guide626.6.3 LAN TCP/IPThe OX253P has built-in DHCP server capability that assigns IP addresses and DNS servers to systems that support DHCP client capability.The LAN parameters of the OX253P are preset in the factory with the following values:•IP address of 192.168.1.1 with subnet mask of 255.255.255.0 (24 bits)•DHCP server enabled with 32 client IP addresses starting from 192.168.1.33. These parameters should work for the majority of installations. If your ISP gives you explicit DNS server address(es), see Section 6.3 on page 56.6.6.4 DNS Server AddressDNS (Domain Name System) is for mapping a domain name to its corresponding IP address and vice versa. The DNS server is extremely important because without it, you must know the IP address of a machine before you can access it. The DNS server addresses that you enter in the DHCP setup are passed to the client machines along with the assigned IP address and subnet mask.There are two ways that an ISP disseminates the DNS server addresses. The first is for an ISP to tell a customer the DNS server addresses, usually in the form of an information sheet, when s/he signs up. If your ISP gives you the DNS server addresses, enter them in the DNS Server fields in DHCP Setup, otherwise, leave them blank.Some ISPs choose to pass the DNS servers using the DNS server extensions of PPP IPCP (IP Control Protocol) after the connection is up. If your ISP did not give you explicit DNS servers, chances are the DNS servers are conveyed through IPCP negotiation. The OX253P supports the IPCP DNS server extensions through the DNS proxy feature.If the Primary and Secondary DNS Server fields in the LAN Setup screen are notspecified, for instance, left as 0.0.0.0, the OX253P tells the DHCP clients that it itself is the DNS server. When a computer sends a DNS query to the OX253P, the OX253P forwards the query to the real DNS server learned through IPCP and relays the response back to the computer.Please note that DNS proxy works only when the ISP uses the IPCP DNS server extensions. It does not mean you can leave the DNS servers out of the DHCP setup under all circumstances. If your ISP gives you explicit DNS servers, make sure that you enter their IP addresses in the LAN Setup screen. This way, the OX253P can pass the DNS servers to the computers and the computers can query the DNS server directly without the OX253P’s intervention.

Chapter 6The LAN Configuration ScreensOX253P User’s Guide 636.6.5 RIP SetupRIP (Routing Information Protocol) allows a router to exchange routing information with other routers. The RIP Direction field controls the sending and receiving of RIP packets. When set to:•Both - the OX253P will broadcast its routing table periodically and incorporate the RIP information that it receives.•In Only - the OX253P will not send any RIP packets but will accept all RIP packets received.•Out Only - the OX253P will send out RIP packets but will not accept any RIP packets received.•None - the OX253P will not send any RIP packets and will ignore any RIP packets received.The Version field controls the format and the broadcasting method of the RIP packets that the OX253P sends (it recognizes both formats when receiving). RIP-1is universally supported; but RIP-2 carries more information. RIP-1 is probably adequate for most networks, unless you have an unusual network topology.Both RIP-2B and RIP-2M sends the routing data in RIP-2 format; the difference being that RIP-2B uses subnet broadcasting while RIP-2M uses multicasting.6.6.6 MulticastTraditionally, IP packets are transmitted in one of either two ways - Unicast (1 sender - 1 recipient) or Broadcast (1 sender - everybody on the network). Multicast delivers IP packets to a group of hosts on the network - not everybody and not just 1.IGMP (Internet Group Multicast Protocol) is a network-layer protocol used to establish membership in a Multicast group - it is not used to carry user data. IGMP version 2 (RFC 2236) is an improvement over version 1 (RFC 1112) but IGMP version 1 is still in wide use. If you would like to read more detailed information about interoperability between IGMP version 2 and version 1, please see sections 4 and 5 of RFC 2236. The class D IP address is used to identify host groups and can be in the range 224.0.0.0 to 239.255.255.255. The address 224.0.0.0 is not assigned to any group and is used by IP multicast computers. The address 224.0.0.1 is used for query messages and is assigned to the permanent group of all IP hosts (including gateways). All hosts must join the 224.0.0.1 group in order to participate in IGMP. The address 224.0.0.2 is assigned to the multicast routers group.The OX253P supports both IGMP version 1 (IGMP-v1) and IGMP version 2 (IGMP-v2). At start up, the OX253P queries all directly connected networks to gather group membership. After that, the OX253P periodically updates this

Chapter 6The LAN Configuration ScreensOX253P User’s Guide64information. IP multicasting can be enabled/disabled on the OX253P LAN and/or WAN interfaces in the web configurator (LAN; WAN). Select None to disable IP multicasting on these interfaces.

OX253P User’s Guide 65CHAPTER 7 The WAN Configuration Screens7.1 Overview Use the ADVANCED > WAN Configuration screens to set up your OX253P’s Wide Area Network (WAN) or Internet features.A Wide Area Network (or WAN) links geographically dispersed locations to other networks or the Internet. A WAN configuration can include switched and permanent telephone circuits, terrestrial radio systems and satellite systems.7.1.1 What You Can Do in This Chapter•The Internet Connection screen (Section 7.2 on page 68) lets you set up your OX253P’s Internet settings.•The WiMAX Configuration screen (Section 7.3 on page 70) lets set up the frequencies used by your OX253P.•The Advanced screen (Section 7.5 on page 75) lets configure your DNS server, RIP, Multicast and Windows Networking settings.7.1.2 What You Need to KnowThe following terms and concepts may help as you read through this chapter.WiMAX WiMAX (Worldwide Interoperability for Microwave Access) is the IEEE 802.16 wireless networking standard, which provides high-bandwidth, wide-range wireless service across wireless Metropolitan Area Networks (MANs). In a wireless MAN, a wireless-equipped computer is known either as a mobile station (MS) or a subscriber station (SS). Mobile stations use the IEEE 802.16e standard and are able to maintain connectivity while switching their connection from one base station to another base station (handover) while subscriber stations use other standards that do not have this capability (IEEE 802.16-2004, for

Chapter 7The WAN Configuration ScreensOX253P User’s Guide66example). The following figure shows an MS-equipped notebook computer MS1moving from base station BS1’s coverage area and connecting to BS2.Figure 17 WiMax: Mobile StationWiMAX technology uses radio signals (around 2 to 10 GHz) to connect subscriber stations and mobile stations to local base stations. Numerous subscriber stations and mobile stations connect to the network through a single base station (BS), as in the following figure. Figure 18 WiMAX: Multiple Mobile StationsA base station's coverage area can extend over many hundreds of meters, even under poor conditions. A base station provides network access to subscriber stations and mobile stations, and communicates with other base stations.The radio frequency and bandwidth of the link between the OX253P and the base station are controlled by the base station. The OX253P follows the base station’s configuration.

Chapter 7The WAN Configuration ScreensOX253P User’s Guide 67AuthenticationWhen authenticating a user, the base station uses a third-party RADIUS or Diameter server known as an AAA (Authentication, Authorization and Accounting) server to authenticate the mobile or subscriber stations. The following figure shows a base station using an AAA server to authenticate mobile station MS, allowing it to access the Internet.Figure 19 Using an AAA ServerIn this figure, the dashed arrow shows the PKM (Privacy Key Management) secured connection between the mobile station and the base station, and the solid arrow shows the EAP secured connection between the mobile station, the base station and the AAA server. See the WiMAX security appendix for more details.

Chapter 7The WAN Configuration ScreensOX253P User’s Guide687.2 Internet ConnectionClick ADVANCED > WAN Configuration to set up your OX253P’s Internet settings.Note: Not all OX253P models have all the fields shown here.Figure 20 ADVANCED > WAN Configuration > Internet ConnectionThe following table describes the labels in this screen. Table 18 ADVANCED > WAN Configuration > Internet Connection > ISP Parameters for Internet AccessLABEL DESCRIPTIONISP Parameters for Internet AccessUser NameUse this field to enter the username associated with your Internet access account. You can enter up to 61 printable ASCII characters.PasswordUse this field to enter the password associated with your Internet access account. You can enter up to 47 printable ASCII characters.

Chapter 7The WAN Configuration ScreensOX253P User’s Guide 69Anonymous Identity Enter the anonymous identity provided by your Internet Service Provider. Anonymous identity (also known as outer identity) is used with EAP-TTLS encryption. The anonymous identity is used to route your authentication request to the correct authentication server, and does not reveal your real user name. Your real user name and password are encrypted in the TLS tunnel, and only the anonymous identity can be seen.Leave this field blank if your ISP did not give you an anonymous identity to use.PKMThis field displays the Privacy Key Management version number. PKM provides security between the OX253P and the base station. At the time of writing, the OX253P supports PKMv2 only. See the WiMAX security appendix for more information.AuthenticationThis field displays the user authentication method. Authentication is the process of confirming the identity of a mobile station (by means of a username and password, for example).Check with your service provider if you are unsure of the correct setting for your account. Choose from the following user authentication methods:•TTLS (Tunnelled Transport Layer Security)•TLS (Transport Layer Security)Note: Not all OX253Ps support TLS authentication. Check with your service provider for details.TTLS Inner EAPThis field displays the type of secondary authentication method. Once a secure EAP-TTLS connection is established, the inner EAP is the protocol used to exchange security information between the mobile station, the base station and the AAA server to authenticate the mobile station. See the WiMAX security appendix for more details.This field is available only when TTLS is selected in the Authentication field.The OX253P supports the following inner authentication types:•CHAP (Challenge Handshake Authentication Protocol)•MSCHAP (Microsoft CHAP)•MSCHAPV2 (Microsoft CHAP version 2)•PAP (Password Authentication Protocol)Auth ModeSelect the authentication mode from the drop-down list box.This field is not available in all OX253Ps. Check with your service provider for details.The OX253P supports the following authentication modes:•User Only•Device Only with Cert•Certs and User AuthenticationTable 18 ADVANCED > WAN Configuration > Internet Connection > ISP Parameters for Internet Access (continued)LABEL DESCRIPTION

Chapter 7The WAN Configuration ScreensOX253P User’s Guide707.3 WiMAX ConfigurationClick ADVANCED > WAN Configuration > WiMAX Configuration to set up the frequencies used by your OX253P.In a WiMAX network, a mobile or subscriber station must use a radio frequency supported by the base station to communicate. When the OX253P looks for a connection to a base station, it can search a range of frequencies.CertificateThis is the security certificate the OX253P uses to authenticate the AAA server. Use the TOOLS > > Trusted CAs screen to import certificates to the OX253P.WAN IP Address AssignmentGetautomatically from ISP (Default)Select this if you have a dynamic IP address. A dynamic IP address is not fixed; the ISP assigns you a different one each time you connect to the Internet. Use Fixed IP Address A static IP address is a fixed IP that your ISP gives you. Type your ISP assigned IP address in the IP Address field below. IP Subnet MaskEnter a subnet mask in dotted decimal notation. Refer to the appendicesto calculate a subnet mask If you are implementing subnetting.Gateway IP Address Specify a gateway IP address (supplied by your ISP).ApplyClick to save your changes.ResetClick to restore your previously saved settings.Table 18 ADVANCED > WAN Configuration > Internet Connection > ISP Parameters for Internet Access (continued)LABEL DESCRIPTION

Chapter 7The WAN Configuration ScreensOX253P User’s Guide 71Radio frequency is measured in Hertz (Hz). Figure 21 ADVANCED > WAN Configuration >WiMAX Configuration The following table describes the labels in this screen.Table 19 Radio Frequency Conversion1 kHz = 1000 Hz1 MHz = 1000 kHz (1000000 Hz)1 GHz = 1000 MHz (1000000 kHz)Table 20 ADVANCED > WAN Configuration >WiMAX ConfigurationLABEL DESCRIPTIONDL Frequency / Bandwidth These fields show the downlink frequency settings in kilohertz (kHz). Enter values in these fields to have the OX253P scan these frequencies for available channels in ascending numerical order.Note: The Bandwidth field is not user-configurable; when the OX253P finds a WiMAX connection, its frequency is displayed in this field.Contact your service provider for details of supported frequencies.

Chapter 7The WAN Configuration ScreensOX253P User’s Guide727.3.1 Frequency RangesThe following figure shows the OX253P searching a range of frequencies to find a connection to a base station. Figure 22 Frequency RangesIn this figure, A is the WiMAX frequency range. “WiMAX frequency range” refers to the entire range of frequencies the OX253P is capable of using to transmit and receive (see the Product Specifications appendix for details). In the figure, B shows the operator frequency range. This is the range of frequencies within the WiMAX frequency range supported by your operator (service provider).The operator range is subdivided into bandwidth steps. In the figure, each C is a bandwidth step.The arrow D shows the OX253P searching for a connection.Have the OX253P search only certain frequencies by configuring the downlink frequencies. Your operator can give you information on the supported frequencies. The downlink frequencies are points of the frequency range your OX253P searches for an available connection. Use the Site Survey screen to set these bands. You can set the downlink frequencies anywhere within the WiMAX frequency range. In this example, the downlink frequencies have been set to search all of the operator range for a connection.ApplyClick to save your changes.ResetClick to restore your previously saved settings.Table 20 ADVANCED > WAN Configuration >WiMAX Configuration (continued)LABEL DESCRIPTION

Chapter 7The WAN Configuration ScreensOX253P User’s Guide 737.3.2 Configuring Frequency SettingsYou need to set the OX253P to scan one or more specific radio frequencies to find an available connection to a WiMAX base station. Use the WiMAX Frequency screen to define the radio frequencies to be searched for available wireless connections. See Section 7.3.3 on page 73 for an example of using the WiMAX Frequency screen.Note: It may take several minutes for the OX253P to find a connection.•The OX253P searches the DL Frequency settings in ascending numerical order, from [1] to [9].Note: The Bandwidth field is not user-configurable; when the OX253P finds a WiMAX connection, its frequency is displayed in this field.•If you enter a 0 in a DL Frequency field, the OX253P immediately moves on to the next DL Frequency field.•When the OX253P connects to a base station, the values in this screen are automatically set to the base station’s frequency. The next time the OX253P searches for a connection, it searches only this frequency. If you want the OX253P to search other frequencies, enter them in the DL Frequency fields.The following table describes some examples of DL Frequency settings.7.3.3 Using the WiMAX Frequency ScreenIn this example, your Internet service provider has given you a list of supported frequencies: 2.51, 2.525, 2.6, and 2.625. 1In the DL Frequency [1] field, enter 2510000 (2510000 kilohertz (kHz) is equal to 2.51 gigahertz).Table 21 DL Frequency Example SettingsEXAMPLE 1 EXAMPLE 2DL Frequency [1] 25000002500000DL Frequency [2] 25500002550000DL Frequency [3] 02600000DL Frequency [4] 00DL Frequency [5] 00The OX253P searches at 2500000 kHz, and then searches at 2550000 kHz if it has not found a connection.The OX253P searches at 2500000 kHz and then at 2550000 kHz if it has not found an available connection. If it still does not find an available connection, it searches at 2600000 kHz.

Chapter 7The WAN Configuration ScreensOX253P User’s Guide742In the DL Frequency [2] field, enter 2525000.3In the DL Frequency [3] field, enter 2600000.4In the DL Frequency [4] field, enter 2625000.Leave the rest of the DL Frequency fields at zero. The screen appears as follows.Figure 23 Completing the WiMAX Frequency Screen5Click Apply. The OX253P stores your settings. When the OX253P searches for available frequencies, it scans all frequencies from DL Frequency [1] to DL Frequency [4]. When it finds an available connection, the fields in this screen will be automatically set to use that frequency.7.4 BuzzerClick ADVANCED > WAN Configuration > Buzzer to enable or disable buzzer in the ODU. The buzzer sounds beeps when the OX253P receives signal from the connected base station. Figure 24 ADVANCED > WAN Configuration > Buzzer

Chapter 7The WAN Configuration ScreensOX253P User’s Guide 75The following table describes the labels in this screen.7.5 AdvancedClick ADVANCED > WAN Configuration > Advanced to configure your DNS server, RIP, Multicast and Windows Networking settings.Figure 25 ADVANCED > WAN Configuration > Advanced Table 22 ADVANCED > WAN Configuration > BuzzerLABEL DESCRIPTIONEnable BuzzerSelect this to turn on the buzzer in the outdoor unit (ODU). You may need to turn on the buzzer when you set up the ODU. The buzzer sounds the number of beeps based on the signal strength (the RSSI value) received from the base station.•RSSI > -50: The five LEDs on the ODU light on and the buzzer sounds five beeps regularly. •-50 > RSSI > -60: Four of the five LEDs on the ODU light on and the buzzer sounds four beeps regularly.•-60 > RSSI > -70: Three of the five LEDs on the ODU light on and the buzzer sounds three beeps regularly.•-70 > RSSI > -80: Two of the five LEDs on the ODU light on and the buzzer sounds two beeps regularly.•-80 > RSSI > -90: One of the five LEDs on the ODU lights on and the buzzer sounds one beep regularly.•-90 > RSSI - The buzzer does not sound.Disable BuzzerSelect this to turn the buzzer off.ApplyClick to save your changes.ResetClick to restore your previously saved settings.

Chapter 7The WAN Configuration ScreensOX253P User’s Guide76The following table describes the labels in this screen.Table 23 ADVANCED > WAN Configuration > AdvancedLABEL DESCRIPTIONDNS ServersFirst, Second and Third DNS Server Select Obtainedfrom ISP if your ISP dynamically assigns DNS server information (and the OX253P's WAN IP address). Use the drop-down list box to select a DNS server IP address that the ISP assigns in the field to the right. Select UserDefined if you have the IP address of a DNS server. Enter the DNS server's IP address in the field to the right. If you chose UserDefined, but leave the IP address set to 0.0.0.0, UserDefined changes to None after you click Apply. If you set a second choice to UserDefined, and enter the same IP address, the second UserDefined changes to None after you click Apply.Select None if you do not want to configure DNS servers. You must have another DHCP server on your LAN, or else the computers must have their DNS server addresses manually configured. If you do not configure a DNS server, you must know the IP address of a computer in order to access it.Multicast SetupMulticastIGMP (Internet Group Multicast Protocol) is a network-layer protocol used to establish membership in a multicast group. The OX253P supports both IGMP version 1 (IGMP-v1) and IGMP-v2.Select None to disable it.Windows Networking (NetBIOS over TCP/IP)Allow between LAN and WAN Select this check box to forward NetBIOS packets from the LAN to the WAN and from the WAN to the LAN. If your firewall is enabled with the default policy set to block WAN to LAN traffic, you also need to enable the default WAN to LAN firewall rule that forwards NetBIOS traffic.Clear this check box to block all NetBIOS packets going from the LAN to the WAN and from the WAN to the LAN.ApplyClick to save your changes.ResetClick to restore your previously saved settings.

OX253P User’s Guide 77CHAPTER 8 The NAT Configuration Screens8.1 OverviewUse these screens to configure port forwarding and trigger ports for the OX253P. You can also enable and disable SIP, FTP, and H.323 ALG.Network Address Translation (NAT) maps a host’s IP address within one network to a different IP address in another network. For example, you can use a NAT router to map one IP address from your ISP to multiple private IP addresses for the devices in your home network.8.1.1 What You Can Do in This Chapter•The General screen (Section 8.2 on page 77) lets you enable or disable NAT and to allocate memory for NAT and firewall rules.•The Port Forwarding screen (Section 8.3 on page 78) lets you look at the current port-forwarding rules in the OX253P, and to enable, disable, activate, and deactivate each one.•The Trigger Port screen (Section 8.4 on page 82) lets you maintain trigger port forwarding rules for the OX253P.•The ALG screen (Section 8.5 on page 85) lets you enable and disable SIP (VoIP), FTP (file transfer), and H.323 (audio-visual) ALG in the OX253P.8.2 GeneralClick ADVANCED > NAT Configuration > General to enable or disable NAT and to allocate memory for NAT and firewall rules.Figure 26 ADVANCED > NAT Configuration > General

Chapter 8The NAT Configuration ScreensOX253P User’s Guide78The following table describes the labels in this screen.8.3 Port Forwarding A NAT server set is a list of inside (behind NAT on the LAN) servers, for example, web or FTP, that you can make accessible to the outside world even though NAT makes your whole inside network appear as a single machine to the outside world.Use the ADVANCED > NAT Configuration > Port Forwarding screen to forward incoming service requests to the server(s) on your local network. You may enter a single port number or a range of port numbers to be forwarded, and the local IP address of the desired server. The port number identifies a service; for example, web service is on port 80 and FTP on port 21. In some cases, such as for unknown services or where one server can support more than one service (for example both FTP and web service), it might be better to specify a range of port numbers. In addition to the servers for specified services, NAT supports a default server. A service request that does not have a server explicitly designated for it is forwarded to the default server. If the default is not defined, the service request is simply discarded.Table 24 ADVANCED > NAT Configuration > GeneralLABEL DESCRIPTIONEnable Network Address Translation Select this if you want to use port forwarding, trigger ports, or any of the ALG.Max NAT/Firewall Session Per User When computers use peer to peer applications, such as file sharing applications, they may use a large number of NAT sessions. If you do not limit the number of NAT sessions a single client can establish, this can result in all of the available NAT sessions being used. In this case, no additional NAT sessions can be established, and users may not be able to access the Internet. Each NAT session establishes a corresponding firewall session. Use this field to limit the number of NAT/firewall sessions each client computer can establish through the OX253P. If your network has a small number of clients using peer to peer applications, you can raise this number to ensure that their performance is not degraded by the number of NAT sessions they can establish. If your network has a large number of users using peer to peer applications, you can lower this number to ensure no single client is using all of the available NAT sessions. Apply Click to save your changes.ResetClick to return to the previous screen without saving your changes.

Chapter 8The NAT Configuration ScreensOX253P User’s Guide 79For example, let's say you want to assign ports 21-25 to one FTP, Telnet and SMTP server (A in the example), port 80 to another (B in the example) and assign a default server IP address of 192.168.1.35 to a third (C in the example). You assign the LAN IP addresses and the ISP assigns the WAN IP address. The NAT network appears as a single host on the Internet.Figure 27 Multiple Servers Behind NAT Example8.3.1 Port Forwarding OptionsClick ADVANCED > NAT Configuration > Port Forwarding to look at the current port-forwarding rules in the OX253P, and to enable, disable, activate, and deactivate each one. You can also set up a default server to handle ports not covered by rules.Figure 28 ADVANCED > NAT Configuration > Port Forwarding

Chapter 8The NAT Configuration ScreensOX253P User’s Guide80The following table describes the icons in this screen.The following table describes the labels in this screen.Table 25 Advanced> VPN Transport > Customer InterfaceICON DESCRIPTIONEditClick to edit this item.DeleteClick to delete this item.Table 26 ADVANCED > NAT Configuration > Port ForwardingLABEL DESCRIPTIONDefault Server SetupDefault Server Enter the IP address of the server to which the OX253P should forward packets for ports that are not specified in the Port Forwarding section below or in the TOOLS > Remote MGMT screens. Enter 0.0.0.0 if you want the OX253P to discard these packets instead.Port Forwarding#The number of the item in this list.Active Select this to enable this rule. Clear this to disable this rule.Name This field displays the name of the rule. It does not have to be unique.Start Port This field displays the beginning of the range of port numbers forwarded by this rule.End Port This field displays the end of the range of port numbers forwarded by this rule. If it is the same as the Start Port, only one port number is forwarded.Server IP Address This field displays the IP address of the server to which packet for the selected port(s) are forwarded.ActionClick the Edit icon to set up a port forwarding rule or alter the configuration of an existing port forwarding rule.Click the Delete icon to remove an existing port forwarding rule. Apply Click to save your changes.Reset Click to restore your previously saved settings.

Chapter 8The NAT Configuration ScreensOX253P User’s Guide 818.3.2 Port Forwarding Rule SetupClick a port forwarding rule’s Edit icon in the ADVANCED >NAT Configuration >Port Forwarding screen to activate, deactivate, or edit it.Figure 29 ADVANCED > NAT Configuration > Port Forwarding > Rule SetupThe following table describes the labels in this screen.Table 27 ADVANCED > NAT Configuration > Port Forwarding > Rule SetupLABEL DESCRIPTIONActive Select this to enable this rule. Clear this to disable this rule.Service Name Enter a name to identify this rule. You can use 1 - 31 printable ASCII characters, or you can leave this field blank. It does not have to be a unique name.Start PortEnd PortEnter the port number or range of port numbers you want to forward to the specified server.To forward one port number, enter the port number in the Start Portand End Port fields.To forward a range of ports,•enter the port number at the beginning of the range in the Start Port field•enter the port number at the end of the range in the End Port field.Server IP Address Enter the IP address of the server to which to forward packets for the selected port number(s). This server is usually on the LAN.Apply Click to save your changes.CancelClick to return to the previous screen without saving your changes.

Chapter 8The NAT Configuration ScreensOX253P User’s Guide828.4 Trigger PortSome services use a dedicated range of ports on the client side and a dedicated range of ports on the server side. With regular port forwarding you set a forwarding port in NAT to forward a service (coming in from the server on the WAN) to the IP address of a computer on the client side (LAN). The problem is that port forwarding only forwards a service to a single LAN IP address. In order to use the same service on a different LAN computer, you have to manually replace the LAN computer's IP address in the forwarding port with another LAN computer's IP address, Trigger port forwarding solves this problem by allowing computers on the LAN to dynamically take turns using the service. The OX253P records the IP address of a LAN computer that sends traffic to the WAN to request a service with a specific port number and protocol (a "trigger" port). When the OX253P's WAN port receives a response with a specific port number and protocol ("incoming" port), the OX253P forwards the traffic to the LAN IP address of the computer that sent the request. After that computer’s connection for that service closes, another computer on the LAN can use the service in the same manner. This way you do not need to configure a new IP address each time you want a different LAN computer to use the application.Click ADVANCED > NAT Configuration > Trigger Port to maintain trigger port forwarding rules for the OX253P.Figure 30 ADVANCED > NAT Configuration > Trigger Port

Chapter 8The NAT Configuration ScreensOX253P User’s Guide 83The following table describes the labels in this screen.Table 28 ADVANCED > NAT Configuration > Trigger PortLABEL DESCRIPTION#The number of the item in this list.Name Enter a name to identify this rule. You can use 1 - 15 printable ASCII characters, or you can leave this field blank. It does not have to be a unique name.IncomingStart PortEnd Port Enter the incoming port number or range of port numbers you want to forward to the IP address the OX253P records.To forward one port number, enter the port number in the Start Portand End Port fields.To forward a range of ports,•enter the port number at the beginning of the range in the Start Port field•enter the port number at the end of the range in the End Port field.If you want to delete this rule, enter zero in the Start Port and EndPort fields.TriggerStart PortEnd Port Enter the outgoing port number or range of port numbers that makes the OX253P record the source IP address and assign it to the selected incoming port number(s).To select one port number, enter the port number in the Start Port and End Port fields.To select a range of ports,•enter the port number at the beginning of the range in the Start Port field•enter the port number at the end of the range in the End Port field.If you want to delete this rule, enter zero in the Start Port and EndPort fields.Apply Click to save your changes.ResetClick to return to the previous screen without saving your changes.

Chapter 8The NAT Configuration ScreensOX253P User’s Guide848.4.1 Trigger Port Forwarding ExampleThe following is an example of trigger port forwarding. In this example, J is Jane’s computer and S is the Real Audio server.Figure 31 Trigger Port Forwarding Example1Jane requests a file from the Real Audio server (port 7070).2Port 7070 is a “trigger” port and causes the OX253P to record Jane’s computer IP address. The OX253P associates Jane's computer IP address with the "incoming" port range of 6970-7170.3The Real Audio server responds using a port number ranging between 6970-7170.4The OX253P forwards the traffic to Jane’s computer IP address. 5Only Jane can connect to the Real Audio server until the connection is closed or times out. The OX253P times out in three minutes with UDP (User Datagram Protocol), or two hours with TCP/IP (Transfer Control Protocol/Internet Protocol). Two points to remember about trigger ports:1Trigger events only happen on data that is coming from inside the OX253P and going to the outside.2If an application needs a continuous data stream, that port (range) will be tied up so that another computer on the LAN can’t trigger it.

Chapter 8The NAT Configuration ScreensOX253P User’s Guide 858.5 ALGSome applications, such as SIP, cannot operate through NAT (are NAT un-friendly) because they embed IP addresses and port numbers in their packets’ data payload. Some NAT routers may include a SIP Application Layer Gateway (ALG). An Application Layer Gateway (ALG) manages a specific protocol (such as SIP, H.323 or FTP) at the application layer. A SIP ALG allows SIP calls to pass through NAT by examining and translating IP addresses embedded in the data stream.Click ADVANCED > NAT Configuration > ALG to enable and disable SIP (VoIP), FTP (file transfer), and H.323 (audio-visual) ALG in the OX253P.Figure 32 ADVANCED > NAT Configuration > ALGThe following table describes the labels in this screen.Table 29 ADVANCED > NAT Configuration > ALGLABEL DESCRIPTIONEnable SIP ALG Select this to make sure SIP (VoIP) works correctly with port-forwarding and port-triggering rules.Enable FTP ALG Select this to make sure FTP (file transfer) works correctly with port-forwarding and port-triggering rules.Enable H.323 ALG Select this to make sure H.323 (audio-visual programs, such as NetMeeting) works correctly with port-forwarding and port-triggering rules.Apply Click to save your changes.CancelClick to return to the previous screen without saving your changes.

Chapter 8The NAT Configuration ScreensOX253P User’s Guide86

OX253P User’s Guide 87CHAPTER 9 The System ConfigurationScreens9.1 OverviewClick ADVANCED > System Configuration to set up general system settings, change the system mode, change the password, configure the DDNS server settings, and set the current date and time.9.1.1 What You Can Do in This Chapter•The General screen (Section 9.2 on page 89) lets you change the OX253P’s mode, set up its system name, domain name, idle timeout, and administrator password.•The Dynamic DNS screen (Section 9.3 on page 90) lets you set up the OX253P as a dynamic DNS client.•The Firmware screen (Section 9.4 on page 92) lets you upload new firmware to the OX253P.•The Configuration screen (Section 9.5 on page 93) lets you back up or restore the configuration of the OX253P.•The Restart screen (Section 9.6 on page 95) lets you restart your OX253P from within the web configurator.9.1.2 What You Need to KnowThe following terms and concepts may help as you read through this chapter.System NameThe System Name is often used for identification purposes. Because some ISPs check this name you should enter your computer's "Computer Name". •In Windows 2000: Click Start > Settings > Control Panel and then double-click the System icon. Select the Network Identification tab and then click the Properties button. Note the entry for the Computer Name field and enter it as the System Name.

Chapter 9The System Configuration ScreensOX253P User’s Guide 899.2 General Click ADVANCED > System Configuration > General to change the OX253P’s mode, set up its system name, domain name, idle timeout, and administrator password.Figure 33 ADVANCED > System Configuration > GeneralThe following table describes the labels in this screen.Table 30 ADVANCED > System Configuration > GeneralLABEL DESCRIPTIONSystem SetupSystem NameEnter your computer's "Computer Name". This is for identification purposes, but some ISPs also check this field. This name can be up to 30 alphanumeric characters long. Spaces are not allowed, but dashes “-” and underscores "_" are accepted.Domain NameEnter the domain name entry that is propagated to DHCP clients on the LAN. If you leave this blank, the domain name obtained from the ISP is used. Use up to 38 alphanumeric characters. Spaces are not allowed, but dashes “-” and periods "." are accepted.Administrator Inactivity Timer Enter the number of minutes a management session can be left idle before the session times out. After it times out, you have to log in again. A value of "0" means a management session never times out, no matter how long it has been left idle. This is not recommended. Long idle timeouts may have security risks. The default is five minutes. Password SetupOld PasswordEnter the current password you use to access the OX253P.New PasswordEnter the new password for the OX253P. You can use up to 30 characters. As you type the password, the screen displays an asterisk (*) for each character you type.

Chapter 9The System Configuration ScreensOX253P User’s Guide909.3 Dynamic DNSDynamic DNS allows you to update your current dynamic IP address with one or many dynamic DNS services so that anyone can contact you (in NetMeeting, CU-SeeMe, etc.). You can also access your FTP server or Web site on your own computer using a domain name (for instance myhost.dhs.org, where myhost is a name of your choice) that will never change instead of using an IP address that changes each time you reconnect. Your friends or relatives will always be able to call you even if they don't know your IP address.First of all, you need to have registered a dynamic DNS account with www.dyndns.org. This is for people with a dynamic IP from their ISP or DHCP server that would still like to have a domain name. The Dynamic DNS service provider will give you a password or key.Enabling the wildcard feature for your host causes *.yourhost.dyndns.org to be aliased to the same IP address as yourhost.dyndns.org. This feature is useful if you want to be able to use, for example, www.yourhost.dyndns.org and still reach your hostname.Note: If you have a private WAN IP address, then you cannot use Dynamic DNS.Retype to Confirm Enter the new password again.ApplyClick to save your changes.ResetClick to restore your previously saved settings.Table 30 ADVANCED > System Configuration > General (continued)LABEL DESCRIPTION

Chapter 9The System Configuration ScreensOX253P User’s Guide 91Click ADVANCED > System Configuration > Dynamic DNS to set up the OX253P as a dynamic DNS client.Figure 34 ADVANCED > System Configuration > Dynamic DNSThe following table describes the labels in this screen.Table 31 ADVANCED > System Configuration > Dynamic DNSLABEL DESCRIPTIONDynamic DNS SetupEnable Dynamic DNS Select this to use dynamic DNS.Service Provider Select the name of your Dynamic DNS service provider.Dynamic DNS Type Select the type of service that you are registered for from your Dynamic DNS service provider.Host Name Enter the host name. You can specify up to two host names, separated by a comma (",").User Name Enter your user name.Password Enter the password assigned to you.Enable Wildcard Option Select this to enable the DynDNS Wildcard feature.Enable offline option This field is available when CustomDNS is selected in the DDNS Type field. Select this if your Dynamic DNS service provider redirects traffic to a URL that you can specify while you are off line. Check with your Dynamic DNS service provider.

Chapter 9The System Configuration ScreensOX253P User’s Guide929.4 FirmwareClick ADVANCED > System Configuration > Firmware to upload new firmware to the OX253P. Firmware files usually use the system model name with a "*.bin" extension, such as "OX253P.bin". The upload process uses HTTP (Hypertext Transfer Protocol) and may take up to two minutes. After a successful upload, the system will reboot. Contact your service provider for information on available firmware upgrades.Note: Only use firmware for your OX253P’s specific model.Figure 35 ADVANCED > System Configuration > FirmwareThe following table describes the labels in this screen.IP Address Update PolicyUse WAN IP Address Select this if you want the OX253P to update the domain name with the WAN port's IP address.Dynamic DNS server auto detect IP addressSelect this if you want the DDNS server to update the IP address of the host name(s) automatically. Select this optionwhen there are one or more NAT routers between the OX253P and the DDNS server.Note: The DDNS server may not be able to detect the proper IP address if there is an HTTP proxy server between the OX253P and the DDNS server.Use specified IP address Select this if you want to use the specified IP address with the host name(s). Then, specify the IP address. Use this option if you have a static IP address.ApplyClick to save your changes.ResetClick to restore your previously saved settings.Table 31 ADVANCED > System Configuration > Dynamic DNS (continued)LABEL DESCRIPTIONTable 32 ADVANCED > System Configuration > FirmwareLABEL DESCRIPTIONFile Path Enter the location of the *.bin file you want to upload, or click Browse... to find it. You must decompress compressed (.zip) files before you can upload them.

Chapter 9The System Configuration ScreensOX253P User’s Guide 939.4.1 The Firmware Upload ProcessWhen the OX253P uploads new firmware, the process usually takes about two minutes. The device also automatically restarts in this time. This causes a temporary network disconnect.Note: Do not turn off the device while firmware upload is in progress!After two minutes, log in again, and check your new firmware version in the Status screen. You might have to open a new browser window to log in.If the upload is not successful, you will be notified by error message.Click Return to go back to the Firmware screen.9.5 ConfigurationClick ADVANCED > System Configuration > Configuration to back up or restore the configuration of the OX253P. You can also use this screen to reset the OX253P to the factory default settings.Figure 36 ADVANCED > System Configuration > ConfigurationBrowse... Click this to find the *.bin file you want to upload.Upload Click this to begin uploading the selected file. This may take up to two minutes.Note: Do not turn off the device while firmware upload is in progress!Table 32 ADVANCED > System Configuration > Firmware (continued)LABEL DESCRIPTION

Chapter 9The System Configuration ScreensOX253P User’s Guide94The following table describes the labels in this screen. 9.5.1 The Restore Configuration ProcessWhen the OX253P restores a configuration file, the device automatically restarts. This causes a temporary network disconnect. Note: Do not turn off the device while configuration file upload is in progress.If the OX253P’s IP address is different in the configuration file you selected, you may need to change the IP address of your computer to be in the same subnet as that of the default management IP address (192.168.5.1). See the Quick Start Guide or the appendices for details on how to set up your computer’s IP address.You might have to open a new browser to log in again.If the upload was not successful, you are notified by Configuration Upload Errormessage:Click Return to go back to the Configuration screen.Table 33 ADVANCED > System Configuration > ConfigurationLABEL DESCRIPTIONBackup ConfigurationBackup Click this to save the OX253P’s current configuration to a file on your computer. Once your device is configured and functioning properly, it is highly recommended that you back up your configuration file before making configuration changes. The backup configuration file is useful if you need to return to your previous settings.Restore ConfigurationFile PathEnter the location of the file you want to upload, or click Browse... to find it.BrowseClick this to find the file you want to upload.UploadClick this to restore the selected configuration file.Note: Do not turn off the device while configuration file upload is in progress.Back to Factory DefaultsReset Click this to clear all user-entered configuration information and return the OX253P to its factory defaults. There is no warning screen.

Chapter 9The System Configuration ScreensOX253P User’s Guide 959.6 RestartClick ADVANCED > System Configuration > Restart to reboot the OX253P without turning the power off.Note: Restarting the OX253P does not affect its configuration.Figure 37 ADVANCED > System Configuration > RestartThe following table describes the labels in this screen. 9.6.1 The Restart Process When you click Restart, the the process usually takes about two minutes. Once the restart is complete you can log in again.9.7 BridgeClick ADVANCED > System Configuration > Bridge to switch the OX253P between the bridge or router mode. You may need the bridge mode when you need to use VLAN applications in your network.Figure 38 ADVANCED > System Configuration > BridgeTable 34 ADVANCED > System Configuration > FirmwareLABEL DESCRIPTIONRestart Click this button to have the device perform a software restart. The Power LED blinks as it restarts and the shines steadily if the restart is successful.Note: Wait one minute before logging back into the OX253P after a restart.

Chapter 9The System Configuration ScreensOX253P User’s Guide96The following table describes the labels in this screen. Table 35 ADVANCED > System Configuration > BridgeLABEL DESCRIPTIONBridge ModeSelect this to switch to the bridge mode for the OX253P.Router ModeSelect this to switch to the router mode for the OX253P.ApplyClick to save your change.

OX253P User’s Guide 97CHAPTER 10The Certificates Screens10.1 OverviewUse the TOOLS > Certificates screens to manage public key certificates on the OX253P.The OX253P can use public key certificates (also sometimes called “digital IDs”) to authenticate users. Certificates are based on public-private key pairs. A certificate contains the certificate owner’s identity and public key. Certificates provide a way to exchange public keys for use in authentication.Public key certificates are used by web browsers to ensure that a secure web site is legitimate. When a certificate authority such as VeriSign, Comodo, or Network Solutions (to name a few) receives a certificate request from a website operator, they confirm that the web domain and contact information in the request match those on public record with a domain name registrar. If they match, then the certificate is issued to the website operator, who then places it on his site to be issued to all visiting web browsers to let them know that the site is legitimate.10.1.1 What You Can Do in This Chapter•The My Certificates screen (Section 10.2 on page 98) lets you generate and export self-signed certificates or certification requests and import the OX253P’s CA-signed certificates.•The Trusted CAs screen (Section 10.3 on page 108) lets you display a summary list of certificates of the certification authorities that you have set the OX253P to accept as trusted.10.1.2 What You Need to KnowThe following terms and concepts may help as you read through this chapter.Certificate AuthoritiesA Certification Authority (CA) issues certificates and guarantees the identity of each certificate owner. There are commercial certification authorities like CyberTrust or VeriSign and government certification authorities. You can use the

Chapter 10The Certificates ScreensOX253P User’s Guide98OX253P to generate certification requests that contain identifying information and public keys and then send the certification requests to a certification authority. 10.2 My CertificatesClick TOOLS > Certificates > My Certificates to access this screen. Use this screen to generate and export self-signed certificates or certification requests and import the OX253P’s CA-signed certificates.Figure 39 TOOLS > Certificates > My Certificates The following table describes the icons in this screen.The following table describes the labels in this screen. Table 36 TOOLS > Certificates > My CertificatesICON DESCRIPTIONEditClick to edit this item.ExportClick to export an item.DeleteClick to delete this item.Table 37 TOOLS > Certificates > My CertificatesLABEL DESCRIPTIONPKI Storage Space in Use This bar displays the percentage of the OX253P’s PKI storage space that is currently in use. When the storage space is almost full, you should consider deleting expired or unnecessary certificates before adding more certificates.#The number of the item in this list.NameThis field displays the name used to identify this certificate. It is recommended that you give each certificate a unique name.

Chapter 10The Certificates ScreensOX253P User’s Guide 99TypeThis field displays what kind of certificate this is. REQ represents a certification request and is not yet a valid certificate. Send a certification request to a certification authority, which then issues a certificate. Use the My Certificate Import screen to import the certificate and replace the request.SELF represents a self-signed certificate. *SELF represents the default self-signed certificate which signs the imported remote host certificates.CERT represents a certificate issued by a certification authority.SubjectThis field displays identifying information about the certificate’s owner, such as CN (Common Name), OU (Organizational Unit or department), O (Organization or company) and C (Country). It is recommended that each certificate have unique subject information. IssuerThis field displays identifying information about the certificate’s issuing certification authority, such as a common name, organizational unit or department, organization or company and country. With self-signed certificates, this is the same information as in the Subject field.Valid FromThis field displays the date that the certificate becomes applicable. Valid ToThis field displays the date that the certificate expires. The text displays in red and includes an Expired! message if the certificate has expired.ActionClick the Edit icon to open a screen with an in-depth list of information about the certificate.Click the Export icon to save a copy of the certificate without its private key. Browse to the location you want to use and click Save.Click the Delete icon to remove a certificate. A window displays asking you to confirm that you want to delete the certificate. Subsequent certificates move up by one when you take this action.The OX253P keeps all of your certificates unless you specifically delete them. Uploading new firmware or default configuration file does not delete your certificates.You cannot delete certificates that any of the OX253P’s features are configured to use.ImportClick to a certificate into the OX253P.CreateClick to go to the screen where you can have the OX253P generate a certificate or a certification request.RefreshClick to display the current validity status of the certificates.Table 37 TOOLS > Certificates > My Certificates (continued)LABEL DESCRIPTION

Chapter 10The Certificates ScreensOX253P User’s Guide10010.2.1 My Certificates Create Click TOOLS > Certificates > My Certificates and then the Create icon to open the My Certificates Create screen. Use this screen to have the OX253P create a self-signed certificate, enroll a certificate with a certification authority or generate a certification request.Figure 40 TOOLS > Certificates > My Certificates > Create

$Chapter 10The Certificates ScreensOX253P User’s Guide 101The following table describes the labels in this screen. Table 38 TOOLS > Certificates > My Certificates > CreateLABEL DESCRIPTIONCertificate NameType a name to identify this certificate. You can use up to 31 alphanumeric and ;‘~!@#$%^&()_+[]{}’,.=- characters.Subject Information Use these fields to record information that identifies the owner of the certificate. You do not have to fill in every field, although the Common Name is mandatory. The certification authority may add fields (such as a serial number) to the subject information when it issues a certificate. It is recommended that each certificate have unique subject information.Common Name Select a radio button to identify the certificate’s owner by IP address, domain name or e-mail address. Type the IP address (in dotted decimal notation), domain name or e-mail address in the field provided. The domain name or e-mail address is for identification purposes only and can be any string.A domain name can be up to 255 characters. You can use alphanumeric characters, the hyphen and periods.An e-mail address can be up to 63 characters. You can use alphanumeric characters, the hyphen, the @ symbol, periods and the underscore.Organizational UnitIdentify the organizational unit or department to which the certificate owner belongs. You can use up to 63 characters. You can use alphanumeric characters, the hyphen and the underscore.OrganizationIdentify the company or group to which the certificate owner belongs. You can use up to 63 characters. You can use alphanumeric characters, the hyphen and the underscore.CountryIdentify the state in which the certificate owner is located. You can use up to 31 characters. You can use alphanumeric characters, the hyphen and the underscore.Key LengthSelect a number from the drop-down list box to determine how many bits the key should use (512 to 2048). The longer the key, the more secure it is. A longer key also uses more PKI storage space.Enrollment OptionsThese radio buttons deal with how and when the certificate is to be generated.Create a self-signed certificate Select Create a self-signed certificate to have the OX253P generate the certificate and act as the Certification Authority (CA) itself. This way you do not need to apply to a certification authority for certificates.Create a certificationrequest and save it locally for later manual enrollmentSelect Create a certification request and save it locally for later manual enrollment to have the OX253P generate and store a request for a certificate. Use the My Certificate Details screen to view the certification request and copy it to send to the certification authority.Copy the certification request from the My Certificate Detailsscreen and then send it to the certification authority.$

$Chapter 10The Certificates ScreensOX253P User’s Guide102Create a certificationrequest and enroll for a certificate immediately onlineSelect Create a certification request and enroll for a certificate immediately online to have the OX253P generate a request for a certificate and apply to a certification authority for a certificate. You must have the certification authority’s certificate already imported in the Trusted CAs screen.When you select this option, you must select the certification authority’s enrollment protocol and the certification authority’s certificate from the drop-down list boxes and enter the certification authority’s server address. You also need to fill in the Reference Number and Key if the certification authority requires them. EnrollmentProtocol This field applies when you select Create a certification request and enroll for a certificate immediately online. Select the certification authority’s enrollment protocol from the drop-down list box.Simple Certificate Enrollment Protocol (SCEP) is a TCP-based enrollment protocol that was developed by VeriSign and Cisco.Certificate Management Protocol (CMP) is a TCP-based enrollment protocol that was developed by the Public Key Infrastructure X.509 working group of the Internet Engineering Task Force (IETF) and is specified in RFC 2510.CA Server Address This field applies when you select Create a certification request and enroll for a certificate immediately online. Enter the IP address (or URL) of the certification authority server.For a URL, you can use up to 511 of the following characters. a-zA-Z0-9'()+,/:.=?;!*#@$_%-CA CertificateThis field applies when you select Create a certification request and enroll for a certificate immediately online. Select the certification authority’s certificate from the CA Certificate drop-down list box.You must have the certification authority’s certificate already imported in the Trusted CAs screen. Click Trusted CAs to go to the Trusted CAs screen where you can view (and manage) the OX253P's list of certificates of trusted certification authorities.Request Authentication When you select Create a certification request and enroll for a certificate immediately online, the certification authority may want you to include a reference number and key to identify you when you send a certification request. Fill in both the Reference Number and the Key fields if your certification authority uses CMP enrollment protocol. Just the Keyfield displays if your certification authority uses the SCEP enrollment protocol. For the reference number, use 0 to 99999999.For the key, use up to 31 of the following characters. a-zA-Z0-9;|`~!@#$%^&*()_+\{}':,./<>=-Table 38 TOOLS > Certificates > My Certificates > CreateLABEL DESCRIPTION$

Chapter 10The Certificates ScreensOX253P User’s Guide 103If you configured the My Certificate Create screen to have the OX253P enroll a certificate and the certificate enrollment is not successful, you see a screen with a Return button that takes you back to the My Certificate Create screen. Click Return and check your information in the My Certificate Create screen. Make sure that the certification authority information is correct and that your Internet connection is working properly if you want the OX253P to enroll a certificate online.Apply Click to save your changes.Cancel Click to return to the previous screen without saving your changes.Table 38 TOOLS > Certificates > My Certificates > CreateLABEL DESCRIPTION

$Chapter 10The Certificates ScreensOX253P User’s Guide10410.2.2 My Certificate EditClick TOOLS > Certificates > My Certificates then the Edit icon to access this screen. Use this screento view in-depth certificate information and change the certificate’s name. Figure 41 TOOLS > Certificates > My Certificates > Edit The following table describes the labels in this screen. Table 39 TOOLS > Certificates > My Certificates > EditLABEL DESCRIPTIONNameThis field displays the identifying name of this certificate. You can use up to 31 alphanumeric and ;‘~!@#$%^&()_+[]{}’,.=- characters.PropertySelect Default self-signed certificate which signs the imported remote host certificates to use this certificate to sign the remote host certificates you upload in the TOOLS > Certificates >TrustedCAs screen.$

Chapter 10The Certificates ScreensOX253P User’s Guide 105Certification PathThis field displays for a certificate, not a certification request.Click the Refresh button to have this read-only text box display the hierarchy of certification authorities that validate the certificate (and the certificate itself).If the issuing certification authority is one that you have imported as a trusted certification authority, it may be the only certification authority in the list (along with the certificate itself). If the certificate is a self-signed certificate, the certificate itself is the only one in the list. The OX253P does not trust the certificate and displays “Not trusted” in this field if any certificate on the path has expired or been revoked.RefreshClick to display the certification path.Certification InformationTypeThis field displays general information about the certificate. CA-signed means that a Certification Authority signed the certificate. Self-signed means that the certificate’s owner signed the certificate (not a certification authority). “X.509” means that this certificate was created and signed according to the ITU-T X.509 recommendation that defines the formats for public-key certificates.VersionThis field displays the X.509 version number. “Serial NumberThis field displays the certificate’s identification number given by the certification authority or generated by the OX253P.SubjectThis field displays information that identifies the owner of the certificate, such as Common Name (CN), Organizational Unit (OU), Organization (O) and Country (C).IssuerThis field displays identifying information about the certificate’s issuing certification authority, such as Common Name, Organizational Unit, Organization and Country. With self-signed certificates, this is the same as the Subject Namefield.“none” displays for a certification request. SignatureAlgorithm This field displays the type of algorithm that was used to sign the certificate. The OX253P uses rsa-pkcs1-sha1 (RSA public-private key encryption algorithm and the SHA1 hash algorithm). Some certification authorities may use rsa-pkcs1-md5 (RSA public-private key encryption algorithm and the MD5 hash algorithm).Valid FromThis field displays the date that the certificate becomes applicable. “none” displays for a certification request. Valid ToThis field displays the date that the certificate expires. The text displays in red and includes an Expired! message if the certificate has expired. “none” displays for a certification request. Key AlgorithmThis field displays the type of algorithm that was used to generate the certificate’s key pair (the OX253P uses RSA encryption) and the length of the key set in bits (1024 bits for example).Subject Alternative Name This field displays the certificate owner‘s IP address (IP), domain name (DNS) or e-mail address (EMAIL). Table 39 TOOLS > Certificates > My Certificates > EditLABEL DESCRIPTION

Chapter 10The Certificates ScreensOX253P User’s Guide106Key UsageThis field displays for what functions the certificate’s key can be used. For example, “DigitalSignature” means that the key can be used to sign certificates and “KeyEncipherment” means that the key can be used to encrypt text.Basic ConstraintThis field displays general information about the certificate. For example, Subject Type=CA means that this is a certification authority’s certificate and “Path Length Constraint=1” means that there can only be one certification authority in the certificate’s path. This field does not display for a certification request. MD5 FingerprintThis is the certificate’s message digest that the OX253P calculated using the MD5 algorithm. SHA1 FingerprintThis is the certificate’s message digest that the OX253P calculated using the SHA1 algorithm. Certificate in PEM (Base-64) Encoded FormatThis read-only text box displays the certificate or certification request in Privacy Enhanced Mail (PEM) format. PEM uses lowercase letters, uppercase letters and numerals to convert the binary certificate into a printable form. You can copy and paste a certification request into a certification authority’s web page, an e-mail that you send to the certification authority or a text editor and save the file on a management computer for later manual enrollment.You can copy and paste a certificate into an e-mail to send to friends or colleagues or you can copy and paste a certificate into a text editor and save the file on a management computer for later distribution (via floppy disk for example).Apply Click to save your changes.Cancel Click to return to the previous screen without saving your changes.Table 39 TOOLS > Certificates > My Certificates > EditLABEL DESCRIPTION

Chapter 10The Certificates ScreensOX253P User’s Guide 10710.2.3 My Certificate ImportClick TOOLS > Certificates > My Certificates > Import to access this screen. Use this screen to import a certificate that matches a corresponding certification request that was generated by the OX253P. You must remove any spaces from the certificate’s filename before you can import it.Figure 42 TOOLS > Certificates > My Certificates > ImportThe following table describes the labels in this screen. Table 40 TOOLS > Certificates > My Certificates > ImportLABEL DESCRIPTIONFile Path Type in the location of the file you want to upload in this field or click Browseto find it.You cannot import a certificate with the same name as a certificate that is already in the OX253P.Browse Click to find the certificate file you want to upload. Apply Click to save your changes.Cancel Click to return to the previous screen without saving your changes.

Chapter 10The Certificates ScreensOX253P User’s Guide10810.3 Trusted CAsClick TOOLS > Certificates >Trusted CAs access this screen. Use this screen to display a summary list of certificates of the certification authorities that you have set the OX253P to accept as trusted. The OX253P accepts any valid certificate signed by a certification authority on this list as being trustworthy; thus you do not need to import any certificate that is signed by one of these certification authorities. Figure 43 TOOLS > Certificates > Trusted CAsThe following table describes the icons in this screen.The following table describes the labels in this screen. Table 41 TOOLS > Certificates > Trusted CAsICON DESCRIPTIONEditClick to edit this item.ExportClick to export an item.DeleteClick to delete this item.Table 42 TOOLS > Certificates > Trusted CAsLABEL DESCRIPTIONPKI Storage Space in Use This bar displays the percentage of the OX253P’s PKI storage space that is currently in use. When the storage space is almost full, you should consider deleting expired or unnecessary certificates before adding more certificates.#The number of the item in this list.NameThis field displays the name used to identify this certificate. SubjectThis field displays identifying information about the certificate’s owner, such as CN (Common Name), OU (Organizational Unit or department), O (Organization or company) and C (Country). It is recommended that each certificate have unique subject information.

Chapter 10The Certificates ScreensOX253P User’s Guide 109IssuerThis field displays identifying information about the certificate’s issuing certification authority, such as a common name, organizational unit or department, organization or company and country. With self-signed certificates, this is the same information as in the Subject field.Valid FromThis field displays the date that the certificate becomes applicable. The text displays in red and includes a Not Yet Valid! message if the certificate has not yet become applicable.Valid ToThis field displays the date that the certificate expires. The text displays in red and includes an Expiring! or Expired! message if the certificate is about to expire or has already expired.CRL IssuerThis field displays Yes if the certification authority issues CRL (Certificate Revocation Lists) for the certificates that it has issued and you have selected the Check incoming certificates issued by this CA against a CRL check box in the certificate’s details screen to have the OX253P check the CRL before trusting any certificates issued by the certification authority. Otherwise the field displays No.ActionClick the Edit icon to open a screen with an in-depth list of information about the certificate.Use the Export icon to save the certificate to a computer. Click the icon and then Save in the File Download screen. The Save As screen opens, browse to the location that you want to use and click Save.Click the Delete icon to remove the certificate. A window displays asking you to confirm that you want to delete the certificate. Note that subsequent certificates move up by one when you take this action.ImportClick Import to open a screen where you can save the certificate of a certification authority that you trust, from your computer to the OX253P.RefreshClick this button to display the current validity status of the certificates.Table 42 TOOLS > Certificates > Trusted CAs (continued)LABEL DESCRIPTION

$Chapter 10The Certificates ScreensOX253P User’s Guide11010.3.1 Trusted CA Edit Click TOOLS > Certificates >Trusted CAs and then click the Edit icon to open the Trusted CAs screen. Use this screen to view in-depth certificate information and change the certificate’s name.Figure 44 TOOLS > Certificates > Trusted CAs > Edit The following table describes the labels in this screen. Table 43 TOOLS > Certificates > Trusted CAs > EditLABEL DESCRIPTIONNameThis field displays the identifying name of this certificate. You can use up to 31 alphanumeric and ;‘~!@#$%^&()_+[]{}’,.=- characters.PropertySelect Default self-signed certificate which signs the imported remote host certificates to use this certificate to sign the remote host certificates you upload in the TOOLS > Certificates >TrustedCAs screen.$