ZyXEL Communications P660HWDXV2 802.11g Wireless ADSL Gateway User Manual SMG 700 User s Guide V1 00 Nov 2004

ZyXEL Communications Corporation 802.11g Wireless ADSL Gateway SMG 700 User s Guide V1 00 Nov 2004

Contents

Part3

Download: ZyXEL Communications P660HWDXV2 802.11g Wireless ADSL Gateway User Manual SMG 700 User s Guide V1 00 Nov 2004
Mirror Download [FCC.gov]ZyXEL Communications P660HWDXV2 802.11g Wireless ADSL Gateway User Manual SMG 700 User s Guide V1 00 Nov 2004
Document ID803152
Application IDz8umwM6yhC62ww1Z6Fwwag==
Document DescriptionPart3
Short Term ConfidentialNo
Permanent ConfidentialNo
SupercedeNo
Document TypeUser Manual
Display FormatAdobe Acrobat PDF - pdf
Filesize326.49kB (4081173 bits)
Date Submitted2007-06-14 00:00:00
Date Available2007-06-14 00:00:00
Creation Date2007-06-05 09:23:23
Producing SoftwareAcrobat Distiller 5.0.5 (Windows)
Document Lastmod2007-06-05 09:23:37
Document TitleSMG-700 User’s Guide V1.00 (Nov 2004)
Document CreatorFrameMaker 7.1
Document Author: Cindy Yang

Chapter 14 Dynamic DNS Setup
Table 81 Dynamic DNS (continued)
LABEL
DESCRIPTION
Dynamic DNS
server auto
detect IP
Address
Select this option only when there are one or more NAT routers between the ZyXEL
Device and the DDNS server. This feature has the DDNS server automatically
detect and use the IP address of the NAT router that has a public IP address.
Note: The DDNS server may not be able to detect the proper IP
address if there is an HTTP proxy server between the
ZyXEL Device and the DDNS server.
Use specified IP
Address
Type the IP address of the host name(s). Use this if you have a static IP address.
Apply
Click Apply to save your changes to the ZyXEL Device.
Cancel
Click Cancel to begin configuring this screen afresh.
P-660HW-Dx v2 User’s Guide
201
Chapter 14 Dynamic DNS Setup
202
P-660HW-Dx v2 User’s Guide
CHAPTER
15
Remote Management
Configuration
This chapter provides information on configuring remote management.
15.1 Remote Management Overview
Remote management allows you to determine which services/protocols can access which
ZyXEL Device interface (if any) from which computers.
When you configure remote management to allow management from the WAN,
you still need to configure a firewall rule to allow access.
You may manage your ZyXEL Device from a remote location via:
•
•
•
•
Internet (WAN only)
ALL (LAN and WAN)
LAN only,
Neither (Disable).
When you choose WAN only or LAN & WAN, you still need to configure a
firewall rule to allow access. See Appendix E on page 311 for details on
configuring firewall rules.
To disable remote management of a service, select Disable in the corresponding Access
Status field.
You may only have one remote management session running at a time. The ZyXEL Device
automatically disconnects a remote management session of lower priority when another
remote management session of higher priority starts. The priorities for the different types of
remote management sessions are as follows.
1 Telnet
2 HTTP
P-660HW-Dx v2 User’s Guide
203
Chapter 15 Remote Management Configuration
15.1.1 Remote Management Limitations
Remote management over LAN or WAN will not work when:
• You have disabled that service in one of the remote management screens.
• The IP address in the Secured Client IP field does not match the client IP address. If it
does not match, the ZyXEL Device will disconnect the session immediately.
• There is already another remote management session with an equal or higher priority
running. You may only have one remote management session running at one time.
• There is a firewall rule that blocks it.
• A filter is applied (through the commands) to block a Telnet, FTP or Web service.
15.1.2 Remote Management and NAT
When NAT is enabled:
• Use the ZyXEL Device’s WAN IP address when configuring from the WAN.
• Use the ZyXEL Device’s LAN IP address when configuring from the LAN.
15.1.3 System Timeout
There is a default system management idle timeout of five minutes (three hundred seconds).
The ZyXEL Device automatically logs you out if the management session remains idle for
longer than this timeout period. The management session does not time out when a statistics
screen is polling.
15.2 WWW
To change your ZyXEL Device’s World Wide Web settings, click Advanced > Remote
MGMT to display the WWW screen.
Figure 115 Remote Management: WWW
204
P-660HW-Dx v2 User’s Guide
Chapter 15 Remote Management Configuration
The following table describes the labels in this screen.
Table 82 Remote Management: WWW
LABEL
DESCRIPTION
Port
You may change the server port number for a service if needed, however you must
use the same port number in order to use that service for remote management.
Access Status
Select the interface(s) through which a computer may access the ZyXEL Device
using this service.
Secured Client IP
A secured client is a “trusted” computer that is allowed to communicate with the
ZyXEL Device using this service.
Select All to allow any computer to access the ZyXEL Device using this service.
Choose Selected to just allow the computer with the IP address that you specify to
access the ZyXEL Device using this service.
Apply
Click Apply to save your settings to the ZyXEL Device.
Cancel
Click Cancel to begin configuring this screen afresh.
15.3 Telnet
You can configure your ZyXEL Device for remote Telnet access as shown next. The
administrator uses Telnet from a computer on a remote network to access the ZyXEL Device.
Figure 116 Telnet Configuration on a TCP/IP Network
15.4 Configuring Telnet
Click Advanced > Remote MGMT > Telnet tab to display the screen as shown.
P-660HW-Dx v2 User’s Guide
205
Chapter 15 Remote Management Configuration
Figure 117 Remote Management: Telnet
The following table describes the labels in this screen.
Table 83 Remote Management: Telnet
LABEL
DESCRIPTION
Port
You may change the server port number for a service if needed, however you must
use the same port number in order to use that service for remote management.
Access Status
Select the interface(s) through which a computer may access the ZyXEL Device
using this service.
Secured Client
IP
A secured client is a “trusted” computer that is allowed to communicate with the
ZyXEL Device using this service.
Select All to allow any computer to access the ZyXEL Device using this service.
Choose Selected to just allow the computer with the IP address that you specify to
access the ZyXEL Device using this service.
Apply
Click Apply to save your customized settings and exit this screen.
Cancel
Click Cancel to begin configuring this screen afresh.
15.5 Telnet Login
Use the following steps to Telnet into your ZyXEL Device’s command interpreter.
If your computer is connected to the ZyXEL Device over the Internet, skip to the next step.
Make sure your computer IP address and the ZyXEL Device IP address are on the same
subnet.
3 In Windows, click Start (usually in the bottom left corner) and Run. Then type telnet
and the ZyXEL Device’s IP address. For example, enter telnet 192.168.1.1 (the
default IP address).
4 Click OK. A login screen displays. Enter the password at the prompts.
206
The default password is 1234. The password is case-sensitive.
P-660HW-Dx v2 User’s Guide
Chapter 15 Remote Management Configuration
15.6 Configuring FTP
You can upload and download the ZyXEL Device’s firmware and configuration files using
FTP, please see the chapter on firmware and configuration file maintenance for details. To use
this feature, your computer must have an FTP client.
To change your ZyXEL Device’s FTP settings, click Advanced > Remote MGMT > FTP
tab. The screen appears as shown.
Figure 118 Remote Management: FTP
The following table describes the labels in this screen.
Table 84 Remote Management: FTP
LABEL
DESCRIPTION
Port
You may change the server port number for a service if needed, however you must
use the same port number in order to use that service for remote management.
Access Status
Select the interface(s) through which a computer may access the ZyXEL Device
using this service.
Secured Client IP
A secured client is a “trusted” computer that is allowed to communicate with the
ZyXEL Device using this service.
Select All to allow any computer to access the ZyXEL Device using this service.
Choose Selected to just allow the computer with the IP address that you specify to
access the ZyXEL Device using this service.
Apply
Click Apply to save your customized settings and exit this screen.
Cancel
Click Cancel to begin configuring this screen afresh.
15.7 SNMP
Simple Network Management Protocol (SNMP) is a protocol used for exchanging
management information between network devices. SNMP is a member of the TCP/IP
protocol suite. Your ZyXEL Device supports SNMP agent functionality, which allows a
manager station to manage and monitor the ZyXEL Device through the network. The ZyXEL
Device supports SNMP version one (SNMPv1) and version two (SNMPv2). The next figure
illustrates an SNMP management operation.
P-660HW-Dx v2 User’s Guide
207
Chapter 15 Remote Management Configuration
SNMP is only available if TCP/IP is configured.
Figure 119 SNMP Management Model
An SNMP managed network consists of two main types of component: agents and a manager.
An agent is a management software module that resides in a managed device (the ZyXEL
Device). An agent translates the local management information from the managed device into
a form compatible with SNMP. The manager is the console through which network
administrators perform network management functions. It executes applications that control
and monitor managed devices.
The managed devices contain object variables/managed objects that define each piece of
information to be collected about a device. Examples of variables include such as number of
packets received, node port status etc. A Management Information Base (MIB) is a collection
of managed objects. SNMP allows a manager and agents to communicate for the purpose of
accessing these objects.
SNMP itself is a simple request/response protocol based on the manager/agent model. The
manager issues a request and the agent returns responses using the following protocol
operations:
• Get - Allows the manager to retrieve an object variable from the agent.
• GetNext - Allows the manager to retrieve the next object variable from a table or list
within an agent. In SNMPv1, when a manager wants to retrieve all elements of a table
from an agent, it initiates a Get operation, followed by a series of GetNext operations.
• Set - Allows the manager to set values for object variables within an agent.
• Trap - Used by the agent to inform the manager of some events.
208
P-660HW-Dx v2 User’s Guide
Chapter 15 Remote Management Configuration
15.7.1 Supported MIBs
The ZyXEL Device supports MIB II that is defined in RFC-1213 and RFC-1215. The focus of
the MIBs is to let administrators collect statistical data and monitor status and performance.
15.7.2 SNMP Traps
The ZyXEL Device will send traps to the SNMP manager when any one of the following
events occurs:
Table 85 SNMP Traps
TRAP #
TRAP NAME
DESCRIPTION
coldStart (defined in RFC-1215)
A trap is sent after booting (power on).
warmStart (defined in RFC-1215)
A trap is sent after booting (software reboot).
whyReboot (defined in ZYXELMIB)
A trap is sent with the reason of restart before
rebooting when the system is going to restart (warm
start).
6a
For intentional reboot:
A trap is sent with the message "System reboot by
user!" if reboot is done intentionally, (for example,
download new files, CI command "sys reboot", etc.).
6b
For fatal error:
A trap is sent with the message of the fatal code if the
system reboots because of fatal errors.
15.7.3 Configuring SNMP
To change your ZyXEL Device’s SNMP settings, click Advanced > Remote MGMT >
SNMP. The screen appears as shown.
Figure 120 Remote Management: SNMP
P-660HW-Dx v2 User’s Guide
209
Chapter 15 Remote Management Configuration
The following table describes the labels in this screen.
Table 86 Remote Management: SNMP
LABEL
DESCRIPTION
SNMP
Port
You may change the server port number for a service if needed, however you
must use the same port number in order to use that service for remote
management.
Access Status
Select the interface(s) through which a computer may access the ZyXEL Device
using this service.
Secured Client IP
A secured client is a “trusted” computer that is allowed to communicate with the
ZyXEL Device using this service.
Select All to allow any computer to access the ZyXEL Device using this service.
Choose Selected to just allow the computer with the IP address that you specify
to access the ZyXEL Device using this service.
SNMP Configuration
Get Community
Enter the Get Community, which is the password for the incoming Get and
GetNext requests from the management station. The default is public and
allows all requests.
Set Community
Enter the Set community, which is the password for incoming Set requests
from the management station. The default is public and allows all requests.
TrapCommunity
Type the trap community, which is the password sent with each trap to the
SNMP manager. The default is public and allows all requests.
TrapDestination
Type the IP address of the station to send your SNMP traps to.
Apply
Click Apply to save your customized settings and exit this screen.
Cancel
Click Cancel to begin configuring this screen afresh.
15.8 Configuring DNS
Use DNS (Domain Name System) to map a domain name to its corresponding IP address and
vice versa. Refer to the chapter on LAN for background information.
To change your ZyXEL Device’s DNS settings, click Advanced > Remote MGMT > DNS.
The screen appears as shown. Use this screen to set from which IP address the ZyXEL Device
will accept DNS queries and on which interface it can send them your ZyXEL Device’s DNS
settings.
210
P-660HW-Dx v2 User’s Guide
Chapter 15 Remote Management Configuration
Figure 121 Remote Management: DNS
The following table describes the labels in this screen.
Table 87 Remote Management: DNS
LABEL
DESCRIPTION
Port
The DNS service port number is 53.
Access Status
Select the interface(s) through which a computer may send DNS queries to the
ZyXEL Device.
Secured Client IP
A secured client is a “trusted” computer that is allowed to send DNS queries to the
ZyXEL Device.
Select All to allow any computer to send DNS queries to the ZyXEL Device.
Choose Selected to just allow the computer with the IP address that you specify to
send DNS queries to the ZyXEL Device.
Apply
Click Apply to save your customized settings and exit this screen.
Cancel
Click Cancel to begin configuring this screen afresh.
15.9 Configuring ICMP
To change your ZyXEL Device’s security settings, click Advanced > Remote MGMT >
ICMP. The screen appears as shown.
If an outside user attempts to probe an unsupported port on your ZyXEL Device, an ICMP
response packet is automatically returned. This allows the outside user to know the ZyXEL
Device exists. Your ZyXEL Device supports anti-probing, which prevents the ICMP response
packet from being sent. This keeps outsiders from discovering your ZyXEL Device when
unsupported ports are probed.
P-660HW-Dx v2 User’s Guide
211
Chapter 15 Remote Management Configuration
Figure 122 Remote Management: ICMP
The following table describes the labels in this screen.
Table 88 Remote Management: ICMP
212
LABEL
DESCRIPTION
ICMP
Internet Control Message Protocol is a message control and error-reporting
protocol between a host server and a gateway to the Internet. ICMP uses Internet
Protocol (IP) datagrams, but the messages are processed by the TCP/IP software
and directly apparent to the application user.
Respond to Ping
on
The ZyXEL Device will not respond to any incoming Ping requests when Disable is
selected. Select LAN to reply to incoming LAN Ping requests. Select WAN to reply
to incoming WAN Ping requests. Otherwise select LAN & WAN to reply to both
incoming LAN and WAN Ping requests.
Do not respond to
requests for
unauthorized
services
Select this option to prevent hackers from finding the ZyXEL Device by probing for
unused ports. If you select this option, the ZyXEL Device will not respond to port
request(s) for unused ports, thus leaving the unused ports and the ZyXEL Device
unseen. By default this option is not selected and the ZyXEL Device will reply with
an ICMP Port Unreachable packet for a port probe on its unused UDP ports, and a
TCP Reset packet for a port probe on its unused TCP ports.
Note that the probing packets must first traverse the ZyXEL Device's firewall
mechanism before reaching this anti-probing mechanism. Therefore if the firewall
mechanism blocks a probing packet, the ZyXEL Device reacts based on the
corresponding firewall policy to send a TCP reset packet for a blocked TCP packet
or an ICMP port-unreachable packet for a blocked UDP packets or just drop the
packets without sending a response packet.
Apply
Click Apply to save your customized settings and exit this screen.
Cancel
Click Cancel to begin configuring this screen afresh.
P-660HW-Dx v2 User’s Guide
CHAPTER
16
Universal Plug-and-Play (UPnP)
This chapter introduces the UPnP feature in the web configurator.
16.1 Introducing Universal Plug and Play
Universal Plug and Play (UPnP) is a distributed, open networking standard that uses TCP/IP
for simple peer-to-peer network connectivity between devices. A UPnP device can
dynamically join a network, obtain an IP address, convey its capabilities and learn about other
devices on the network. In turn, a device can leave a network smoothly and automatically
when it is no longer in use.
See Section 16.2.1 on page 214 for configuration instructions.
16.1.1 How do I know if I'm using UPnP?
UPnP hardware is identified as an icon in the Network Connections folder (Windows XP).
Each UPnP compatible device installed on your network will appear as a separate icon.
Selecting the icon of a UPnP device will allow you to access the information and properties of
that device.
16.1.2 NAT Traversal
UPnP NAT traversal automates the process of allowing an application to operate through
NAT. UPnP network devices can automatically configure network addressing, announce their
presence in the network to other UPnP devices and enable exchange of simple product and
service descriptions. NAT traversal allows the following:
• Dynamic port mapping
• Learning public IP addresses
• Assigning lease times to mappings
Windows Messenger is an example of an application that supports NAT traversal and UPnP.
See the NAT chapter for more information on NAT.
16.1.3 Cautions with UPnP
The automated nature of NAT traversal applications in establishing their own services and
opening firewall ports may present network security issues. Network information and
configuration may also be obtained and modified by users in some network environments.
P-660HW-Dx v2 User’s Guide
213
Chapter 16 Universal Plug-and-Play (UPnP)
When a UPnP device joins a network, it announces its presence with a multicast message. For
security reasons, the ZyXEL Device allows multicast messages only on the LAN.
All UPnP-enabled devices may communicate freely with each other without additional
configuration. Disable UPnP if this is not your intention.
You must have IIS (Internet Information Services) enabled on the Windows web server for
UPnP to work.
16.2 UPnP and ZyXEL
ZyXEL has achieved UPnP certification from the Universal Plug and Play Forum UPnP™
Implementers Corp. (UIC). ZyXEL's UPnP implementation supports IGD 1.0 (Internet
Gateway Device).
See the following sections for examples of installing and using UPnP.
16.2.1 Configuring UPnP
Click Advanced > UPnP to display the screen shown next.
See Section 16.1 on page 213 for more information.
Figure 123 Configuring UPnP
The following table describes the fields in this screen.
Table 89 Configuring UPnP
214
LABEL
DESCRIPTION
Active the Universal Plug
and Play (UPnP) Feature
Select this check box to activate UPnP. Be aware that anyone could
use a UPnP application to open the web configurator's login screen
without entering the ZyXEL Device's IP address (although you must still
enter the password to access the web configurator).
Allow users to make
configuration changes
through UPnP
Select this check box to allow UPnP-enabled applications to
automatically configure the ZyXEL Device so that they can
communicate through the ZyXEL Device, for example by using NAT
traversal, UPnP applications automatically reserve a NAT forwarding
port in order to communicate with another UPnP enabled device; this
eliminates the need to manually configure port forwarding for the UPnP
enabled application.
P-660HW-Dx v2 User’s Guide
Chapter 16 Universal Plug-and-Play (UPnP)
Table 89 Configuring UPnP
LABEL
DESCRIPTION
Allow UPnP to pass through
Firewall
Select this check box to allow traffic from UPnP-enabled applications to
bypass the firewall.
Clear this check box to have the firewall block all UPnP application
packets (for example, MSN packets).
Apply
Click Apply to save the setting to the ZyXEL Device.
Cancel
Click Cancel to return to the previously saved settings.
16.3 Installing UPnP in Windows Example
This section shows how to install UPnP in Windows Me and Windows XP.
16.3.1 Installing UPnP in Windows Me
Follow the steps below to install the UPnP in Windows Me.
1 Click Start and Control Panel. Double-click Add/Remove Programs.
2 Click on the Windows Setup tab and select Communication in the Components
selection box. Click Details.
Figure 124 Add/Remove Programs: Windows Setup: Communication
3 In the Communications window, select the Universal Plug and Play check box in the
Components selection box.
P-660HW-Dx v2 User’s Guide
215
Chapter 16 Universal Plug-and-Play (UPnP)
Figure 125 Add/Remove Programs: Windows Setup: Communication: Components
4 Click OK to go back to the Add/Remove Programs Properties window and click
Next.
5 Restart the computer when prompted.
16.3.2 Installing UPnP in Windows XP
Follow the steps below to install the UPnP in Windows XP.
1 Click start and Control Panel.
2 Double-click Network Connections.
3 In the Network Connections window, click Advanced in the main menu and select
Optional Networking Components ….
Figure 126 Network Connections
4 The Windows Optional Networking Components Wizard window displays. Select
Networking Service in the Components selection box and click Details.
216
P-660HW-Dx v2 User’s Guide
Chapter 16 Universal Plug-and-Play (UPnP)
Figure 127 Windows Optional Networking Components Wizard
5 In the Networking Services window, select the Universal Plug and Play check box.
Figure 128 Networking Services
6 Click OK to go back to the Windows Optional Networking Component Wizard
window and click Next.
16.4 Using UPnP in Windows XP Example
This section shows you how to use the UPnP feature in Windows XP. You must already have
UPnP installed in Windows XP and UPnP activated on the ZyXEL Device.
P-660HW-Dx v2 User’s Guide
217
Chapter 16 Universal Plug-and-Play (UPnP)
Make sure the computer is connected to a LAN port of the ZyXEL Device. Turn on your
computer and the ZyXEL Device.
16.4.1 Auto-discover Your UPnP-enabled Network Device
1 Click start and Control Panel. Double-click Network Connections. An icon displays
under Internet Gateway.
2 Right-click the icon and select Properties.
Figure 129 Network Connections
3 In the Internet Connection Properties window, click Settings to see the port mappings
there were automatically created.
218
P-660HW-Dx v2 User’s Guide
Chapter 16 Universal Plug-and-Play (UPnP)
Figure 130 Internet Connection Properties
4 You may edit or delete the port mappings or click Add to manually add port mappings.
Figure 131 Internet Connection Properties: Advanced Settings
P-660HW-Dx v2 User’s Guide
219
Chapter 16 Universal Plug-and-Play (UPnP)
Figure 132 Internet Connection Properties: Advanced Settings: Add
When the UPnP-enabled device is disconnected from your computer, all port
mappings will be deleted automatically.
5 Select Show icon in notification area when connected option and click OK. An icon
displays in the system tray.
Figure 133 System Tray Icon
6 Double-click on the icon to display your current Internet connection status.
220
P-660HW-Dx v2 User’s Guide
Chapter 16 Universal Plug-and-Play (UPnP)
Figure 134 Internet Connection Status
16.4.2 Web Configurator Easy Access
With UPnP, you can access the web-based configurator on the ZyXEL Device without finding
out the IP address of the ZyXEL Device first. This comes helpful if you do not know the IP
address of the ZyXEL Device.
Follow the steps below to access the web configurator.
1 Click Start and then Control Panel.
2 Double-click Network Connections.
3 Select My Network Places under Other Places.
P-660HW-Dx v2 User’s Guide
221
Chapter 16 Universal Plug-and-Play (UPnP)
Figure 135 Network Connections
4 An icon with the description for each UPnP-enabled device displays under Local
Network.
5 Right-click on the icon for your ZyXEL Device and select Invoke. The web configurator
login screen displays.
222
P-660HW-Dx v2 User’s Guide
Chapter 16 Universal Plug-and-Play (UPnP)
Figure 136 Network Connections: My Network Places
6 Right-click on the icon for your ZyXEL Device and select Properties. A properties
window displays with basic information about the ZyXEL Device.
Figure 137 Network Connections: My Network Places: Properties: Example
P-660HW-Dx v2 User’s Guide
223
Chapter 16 Universal Plug-and-Play (UPnP)
224
P-660HW-Dx v2 User’s Guide
P ART VI
Maintenance and
Troubleshooting
System (227)
Logs (233)
Tools (251)
Diagnostic (257)
Troubleshooting (259)
225
226
CHAPTER
17
System
Use this screen to configure the ZyXEL Device’s time and date settings.
17.1 General Setup
17.1.1 General Setup and System Name
General Setup contains administrative and system-related information. System Name is for
identification purposes. However, because some ISPs check this name you should enter your
computer's "Computer Name".
• In Windows 95/98 click Start, Settings, Control Panel, Network. Click the
Identification tab, note the entry for the Computer Name field and enter it as the System
Name.
• In Windows 2000, click Start, Settings, Control Panel and then double-click System.
Click the Network Identification tab and then the Properties button. Note the entry for
the Computer name field and enter it as the System Name.
• In Windows XP, click start, My Computer, View system information and then click the
Computer Name tab. Note the entry in the Full computer name field and enter it as the
ZyXEL Device System Name.
17.1.2 General Setup
The Domain Name entry is what is propagated to the DHCP clients on the LAN. If you leave
this blank, the domain name obtained by DHCP from the ISP is used. While you must enter
the host name (System Name), the domain name can be assigned from the ZyXEL Device via
DHCP.
Click Maintenance > System to open the General screen.
P-660HW-Dx v2 User’s Guide
227
Chapter 17 System
Figure 138 System General Setup
The following table describes the labels in this screen.
Table 90 System General Setup
LABEL
DESCRIPTION
General Setup
System Name
Choose a descriptive name for identification purposes. It is recommended you enter
your computer’s “Computer name” in this field. This name can be up to 30
alphanumeric characters long. Spaces are not allowed, but dashes “-” and
underscores "_" are accepted.
Domain Name
Enter the domain name (if you know it) here. If you leave this field blank, the ISP
may assign a domain name via DHCP.
The domain name entered by you is given priority over the ISP assigned domain
name.
Administrator
Inactivity Timer
Type how many minutes a management session can be left idle before the session
times out. The default is 5 minutes. After it times out you have to log in with your
password again. Very long idle timeouts may have security risks. A value of "0"
means a management session never times out, no matter how long it has been left
idle (not recommended).
Password
228
User Password
If you log in with the user password, you can only view the ZyXEL Device status.
The default user password is user.
New Password
Type your new system password (up to 30 characters). Note that as you type a
password, the screen displays a (*) for each character you type. After you change
the password, use the new password to access the ZyXEL Device.
Retype to
Confirm
Type the new password again for confirmation.
Admin
Password
If you log in with the admin password, you can configure the advanced features as
well as the wizard setup on the ZyXEL Device.
P-660HW-Dx v2 User’s Guide
Chapter 17 System
Table 90 System General Setup
LABEL
DESCRIPTION
Old Password
Type the default admin password (1234) or the existing password you use to
access the system for configuring advanced features.
New Password
Type your new system password (up to 30 characters). Note that as you type a
password, the screen displays a (*) for each character you type. After you change
the password, use the new password to access the ZyXEL Device.
Retype to
Confirm
Type the new password again for confirmation.
Apply
Click Apply to save your changes to the ZyXEL Device.
Cancel
Click Cancel to begin configuring this screen afresh.
17.2 Time Setting
To change your ZyXEL Device’s time and date, click Maintenance > System > Time
Setting. The screen appears as shown. Use this screen to configure the ZyXEL Device’s time
based on your local time zone.
Figure 139 System Time Setting
P-660HW-Dx v2 User’s Guide
229
Chapter 17 System
The following table describes the fields in this screen.
Table 91 System Time Setting
LABEL
DESCRIPTION
Current Time and
Date
Current Time
This field displays the time of your ZyXEL Device.
Each time you reload this page, the ZyXEL Device synchronizes the time with the
time server.
Current Date
This field displays the date of your ZyXEL Device.
Each time you reload this page, the ZyXEL Device synchronizes the date with the
time server.
Time and Date
Setup
Manual
Select this radio button to enter the time and date manually. If you configure a
new time and date, Time Zone and Daylight Saving at the same time, the new
time and date you entered has priority and the Time Zone and Daylight Saving
settings do not affect it.
New Time
(hh:mm:ss)
This field displays the last updated time from the time server or the last time
configured manually.
When you set Time and Date Setup to Manual, enter the new time in this field
and then click Apply.
New Date
(yyyy/mm/dd)
This field displays the last updated date from the time server or the last date
configured manually.
When you set Time and Date Setup to Manual, enter the new date in this field
and then click Apply.
Get from Time
Server
Select this radio button to have the ZyXEL Device get the time and date from the
time server you specified below.
Time Protocol
Select the time service protocol that your time server uses. Not all time servers
support all protocols, so you may have to check with your ISP/network
administrator or use trial and error to find a protocol that works.
The main difference between them is the format.
Daytime (RFC 867) format is day/month/year/time zone of the server.
Time (RFC 868) format displays a 4-byte integer giving the total number of
seconds since 1970/1/1 at 0:0:0.
The default, NTP (RFC 1305), is similar to Time (RFC 868).
Time Server
Address
Enter the IP address or URL (up to 20 extended ASCII characters in length) of
your time server. Check with your ISP/network administrator if you are unsure of
this information.
Time Zone Setup
230
Time Zone
Choose the time zone of your location. This will set the time difference between
your time zone and Greenwich Mean Time (GMT).
Enable Daylight
Savings
Daylight saving is a period from late spring to early fall when many countries set
their clocks ahead of normal local time by one hour to give more daytime light in
the evening.
Select this option if you use Daylight Saving Time.
P-660HW-Dx v2 User’s Guide
Chapter 17 System
Table 91 System Time Setting (continued)
LABEL
DESCRIPTION
Start Date
Configure the day and time when Daylight Saving Time starts if you selected
Enable Daylight Saving. The o'clock field uses the 24 hour format. Here are a
couple of examples:
Daylight Saving Time starts in most parts of the United States on the first Sunday
of April. Each time zone in the United States starts using Daylight Saving Time at
2 A.M. local time. So in the United States you would select First, Sunday, April
and type 2 in the o'clock field.
Daylight Saving Time starts in the European Union on the last Sunday of March.
All of the time zones in the European Union start using Daylight Saving Time at
the same moment (1 A.M. GMT or UTC). So in the European Union you would
select Last, Sunday, March. The time you type in the o'clock field depends on
your time zone. In Germany for instance, you would type 2 because Germany's
time zone is one hour ahead of GMT or UTC (GMT+1).
End Date
Configure the day and time when Daylight Saving Time ends if you selected
Enable Daylight Saving. The o'clock field uses the 24 hour format. Here are a
couple of examples:
Daylight Saving Time ends in the United States on the last Sunday of October.
Each time zone in the United States stops using Daylight Saving Time at 2 A.M.
local time. So in the United States you would select Last, Sunday, October and
type 2 in the o'clock field.
Daylight Saving Time ends in the European Union on the last Sunday of October.
All of the time zones in the European Union stop using Daylight Saving Time at
the same moment (1 A.M. GMT or UTC). So in the European Union you would
select Last, Sunday, October. The time you type in the o'clock field depends on
your time zone. In Germany for instance, you would type 2 because Germany's
time zone is one hour ahead of GMT or UTC (GMT+1).
Apply
Click Apply to save your changes to the ZyXEL Device.
Cancel
Click Cancel to begin configuring this screen afresh.
P-660HW-Dx v2 User’s Guide
231
Chapter 17 System
232
P-660HW-Dx v2 User’s Guide
CHAPTER
18
Logs
This chapter contains information about configuring general log settings and viewing the
ZyXEL Device’s logs. Refer to the appendix for example log message explanations.
18.1 Logs Overview
The web configurator allows you to choose which categories of events and/or alerts to have
the ZyXEL Device log and then display the logs or have the ZyXEL Device send them to an
administrator (as e-mail) or to a syslog server.
18.1.1 Alerts and Logs
An alert is a type of log that warrants more serious attention. They include system errors,
attacks (access control) and attempted access to blocked web sites. Some categories such as
System Errors consist of both logs and alerts. You may differentiate them by their color in the
View Log screen. Alerts display in red and logs display in black.
18.2 Viewing the Logs
Click Maintenance > Logs to open the View Log screen. Use the View Log screen to see the
logs for the categories that you selected in the Log Settings screen (see Section 18.3 on page
234).
Log entries in red indicate alerts. The log wraps around and deletes the old entries after it fills.
Click a column heading to sort the entries. A triangle indicates ascending or descending sort
order.
P-660HW-Dx v2 User’s Guide
233
Chapter 18 Logs
Figure 140 View Log
The following table describes the fields in this screen.
Table 92 View Log
LABEL
DESCRIPTION
Display
The categories that you select in the Log Settings screen display in the drop-down
list box.
Select a category of logs to view; select All Logs to view logs from all of the log
categories that you selected in the Log Settings page.
Email Log Now
Click Email Log Now to send the log screen to the e-mail address specified in the
Log Settings page (make sure that you have first filled in the E-mail Log Settings
fields in Log Settings).
Refresh
Click Refresh to renew the log screen.
Clear Log
Click Clear Log to delete all the logs.
Time
This field displays the time the log was recorded.
Message
This field states the reason for the log.
Source
This field lists the source IP address and the port number of the incoming packet.
Destination
This field lists the destination IP address and the port number of the incoming
packet.
Notes
This field displays additional information about the log entry.
18.3 Configuring Log Settings
Use the Log Settings screen to configure to where the ZyXEL Device is to send logs; the
schedule for when the ZyXEL Device is to send the logs and which logs and/or immediate
alerts the ZyXEL Device is to record. See Section 18.1 on page 233 for more information.
To change your ZyXEL Device’s log settings, click Maintenance > Logs > Log Settings. The
screen appears as shown.
Alerts are e-mailed as soon as they happen. Logs may be e-mailed as soon as the log is full.
Selecting many alert and/or log categories (especially Access Control) may result in many emails being sent.
234
P-660HW-Dx v2 User’s Guide
Chapter 18 Logs
Figure 141 Log Settings
The following table describes the fields in this screen.
Table 93 Log Settings
LABEL
DESCRIPTION
E-mail Log Settings
Mail Server
Enter the server name or the IP address of the mail server for the e-mail addresses
specified below. If this field is left blank, logs and alert messages will not be sent via
E-mail.
Mail Subject
Type a title that you want to be in the subject line of the log e-mail message that the
ZyXEL Device sends. Not all ZyXEL models have this field.
Send Log To
The ZyXEL Device sends logs to the e-mail address specified in this field. If this field
is left blank, the ZyXEL Device does not send logs via e-mail.
Send Alerts To
Alerts are real-time notifications that are sent as soon as an event, such as a DoS
attack, system error, or forbidden web access attempt occurs. Enter the E-mail
address where the alert messages will be sent. Alerts include system errors, attacks
and attempted access to blocked web sites. If this field is left blank, alert messages
will not be sent via E-mail.
P-660HW-Dx v2 User’s Guide
235
Chapter 18 Logs
Table 93 Log Settings
LABEL
DESCRIPTION
Enable SMTP
Authentication
Select this option if your mail service requires a user name and password to use
email.
User Name
This is the user name required to access your mail server.
Password
This is the password name required to access your mail server.
Log Schedule
This drop-down menu is used to configure the frequency of log messages being
sent as E-mail:
• Daily
• Weekly
• Hourly
• When Log is Full
• None.
If you select Weekly or Daily, specify a time of day when the E-mail should be sent.
If you select Weekly, then also specify which day of the week the E-mail should be
sent. If you select When Log is Full, an alert is sent when the log fills up. If you
select None, no log messages are sent.
Day for Sending
Log
Use the drop down list box to select which day of the week to send the logs.
Time for
Sending Log
Enter the time of the day in 24-hour format (for example 23:00 equals 11:00 pm) to
send the logs.
Clear log after
sending mail
Select the checkbox to delete all the logs after the ZyXEL Device sends an E-mail of
the logs.
Syslog Logging
The ZyXEL Device sends a log to an external syslog server.
Active
Click Active to enable syslog logging.
Syslog Server
IP Address
Enter the server name or IP address of the syslog server that will log the selected
categories of logs.
Log Facility
Select a location from the drop down list box. The log facility allows you to log the
messages to different files in the syslog server. Refer to the syslog server manual
for more information.
Active Log and
Alert
Log
Select the categories of logs that you want to record.
Send Immediate
Alert
Select log categories for which you want the ZyXEL Device to send E-mail alerts
immediately.
Apply
Click Apply to save your customized settings and exit this screen.
Cancel
Click Cancel to return to the previously saved settings.
18.3.1 Example E-mail Log
An "End of Log" message displays for each mail in which a complete log has been sent. The
following is an example of a log sent by e-mail.
•
•
•
•
236
You may edit the subject title.
The date format here is Day-Month-Year.
The date format here is Month-Day-Year. The time format is Hour-Minute-Second.
"End of Log" message shows that a complete log has been sent.
P-660HW-Dx v2 User’s Guide
Chapter 18 Logs
Figure 142 E-mail Log Example
Subject:
Firewall Alert From xxxxx
Date:
Fri, 07 Apr 2000 10:05:42
From:
user@zyxel.com
To:
user@zyxel.com
1|Apr 7 00 |From:192.168.1.1
To:192.168.1.255
|default policy |forward
| 09:54:03 |UDP
src port:00520 dest port:00520 |<1,00>
2|Apr 7 00 |From:192.168.1.131
To:192.168.1.255
|default policy |forward
| 09:54:17 |UDP
src port:00520 dest port:00520 |<1,00>
3|Apr 7 00 |From:192.168.1.6
To:10.10.10.10 |match
|forward
| 09:54:19 |UDP
src port:03516 dest port:00053 |<1,01>
……………………………..{snip}…………………………………..
……………………………..{snip}…………………………………..
126|Apr 7 00 |From:192.168.1.1
To:192.168.1.255
|match
|forward
| 10:05:00 |UDP
src port:00520 dest port:00520 |<1,02>
127|Apr 7 00 |From:192.168.1.131
To:192.168.1.255
|match
|forward
| 10:05:17 |UDP
src port:00520 dest port:00520 |<1,02>
128|Apr 7 00 |From:192.168.1.1
To:192.168.1.255
|match
|forward
| 10:05:30 |UDP
src port:00520 dest port:00520 |<1,02>
End of Firewall Log
18.4 Log Descriptions
This section provides descriptions of example log messages.
Table 94 System Maintenance Logs
LOG MESSAGE
DESCRIPTION
Time calibration is
successful
The router has adjusted its time based on information from
the time server.
Time calibration failed
The router failed to get information from the time server.
WAN interface gets IP:%s
A WAN interface got a new IP address from the DHCP,
PPPoE, PPTP or dial-up server.
DHCP client IP expired
A DHCP client's IP address has expired.
DHCP server assigns%s
The DHCP server assigned an IP address to a client.
Successful WEB login
Someone has logged on to the router's web configurator
interface.
WEB login failed
Someone has failed to log on to the router's web configurator
interface.
Successful TELNET login
Someone has logged on to the router via telnet.
TELNET login failed
Someone has failed to log on to the router via telnet.
Successful FTP login
Someone has logged on to the router via ftp.
FTP login failed
Someone has failed to log on to the router via ftp.
NAT Session Table is Full!
The maximum number of NAT session table entries has been
exceeded and the table is full.
P-660HW-Dx v2 User’s Guide
237
Chapter 18 Logs
Table 94 System Maintenance Logs (continued)
LOG MESSAGE
DESCRIPTION
Starting Connectivity
Monitor
Starting Connectivity Monitor.
Time initialized by Daytime
Server
The router got the time and date from the Daytime server.
Time initialized by Time
server
The router got the time and date from the time server.
Time initialized by NTP
server
The router got the time and date from the NTP server.
Connect to Daytime server
fail
The router was not able to connect to the Daytime server.
Connect to Time server fail
The router was not able to connect to the Time server.
Connect to NTP server fail
The router was not able to connect to the NTP server.
Too large ICMP packet has
been dropped
The router dropped an ICMP packet that was too large.
Configuration Change: PC =
0x%x, Task ID = 0x%x
The router is saving configuration changes.
Successful SSH login
Someone has logged on to the router’s SSH server.
SSH login failed
Someone has failed to log on to the router’s SSH server.
Successful HTTPS login
Someone has logged on to the router's web configurator
interface using HTTPS protocol.
HTTPS login failed
Someone has failed to log on to the router's web configurator
interface using HTTPS protocol.
Table 95 System Error Logs
LOG MESSAGE
DESCRIPTION
%s exceeds the max.
number of session per
host!
This attempt to create a NAT session exceeds the maximum
number of NAT session table entries allowed to be created per
host.
setNetBIOSFilter: calloc
error
The router failed to allocate memory for the NetBIOS filter
settings.
readNetBIOSFilter: calloc
error
The router failed to allocate memory for the NetBIOS filter
settings.
WAN connection is down.
A WAN connection is down. You cannot access the network
through this interface.
Table 96 Access Control Logs
238
LOG MESSAGE
DESCRIPTION
Firewall default policy: [TCP |
UDP | IGMP | ESP | GRE | OSPF]

Attempted TCP/UDP/IGMP/ESP/GRE/OSPF access
matched the default policy and was blocked or forwarded
according to the default policy’s setting.
Firewall rule [NOT] match:[TCP |
UDP | IGMP | ESP | GRE | OSPF]
, 
Attempted TCP/UDP/IGMP/ESP/GRE/OSPF access
matched (or did not match) a configured firewall rule
(denoted by its number) and was blocked or forwarded
according to the rule.
P-660HW-Dx v2 User’s Guide
Chapter 18 Logs
Table 96 Access Control Logs (continued)
LOG MESSAGE
DESCRIPTION
Triangle route packet forwarded:
[TCP | UDP | IGMP | ESP | GRE |
OSPF]
The firewall allowed a triangle route session to pass
through.
Packet without a NAT table entry
blocked: [TCP | UDP | IGMP | ESP
| GRE | OSPF]
The router blocked a packet that didn't have a
corresponding NAT table entry.
Router sent blocked web site
message: TCP
The router sent a message to notify a user that the router
blocked access to a web site that the user requested.
Table 97 TCP Reset Logs
LOG MESSAGE
DESCRIPTION
Under SYN flood attack,
sent TCP RST
The router sent a TCP reset packet when a host was under a SYN
flood attack (the TCP incomplete count is per destination host.)
Exceed TCP MAX
incomplete, sent TCP RST
The router sent a TCP reset packet when the number of TCP
incomplete connections exceeded the user configured threshold.
(the TCP incomplete count is per destination host.) Note: Refer to
TCP Maximum Incomplete in the Firewall Attack Alerts screen.
Peer TCP state out of
order, sent TCP RST
The router sent a TCP reset packet when a TCP connection state
was out of order.Note: The firewall refers to RFC793 Figure 6 to
check the TCP state.
Firewall session time
out, sent TCP RST
The router sent a TCP reset packet when a dynamic firewall
session timed out.
The default timeout values are as follows:
ICMP idle timeout: 3 minutes
UDP idle timeout: 3 minutes
TCP connection (three way handshaking) timeout: 270 seconds
TCP FIN-wait timeout: 2 MSL (Maximum Segment Lifetime set in
the TCP header).
TCP idle (established) timeout (s): 150 minutes
TCP reset timeout: 10 seconds
Exceed MAX incomplete,
sent TCP RST
The router sent a TCP reset packet when the number of
incomplete connections (TCP and UDP) exceeded the userconfigured threshold. (Incomplete count is for all TCP and UDP
connections through the firewall.)Note: When the number of
incomplete connections (TCP + UDP) > “Maximum Incomplete
High”, the router sends TCP RST packets for TCP connections
and destroys TOS (firewall dynamic sessions) until incomplete
connections < “Maximum Incomplete Low”.
Access block, sent TCP
RST
The router sends a TCP RST packet and generates this log if you
turn on the firewall TCP reset mechanism (via CI command: "sys
firewall tcprst").
Table 98 Packet Filter Logs
LOG MESSAGE
DESCRIPTION
[TCP | UDP | ICMP | IGMP |
Generic] packet filter
matched (set:%d, rule:%d)
Attempted access matched a configured filter rule (denoted
by its set and rule number) and was blocked or forwarded
according to the rule.
P-660HW-Dx v2 User’s Guide
239
Chapter 18 Logs
Table 99 ICMP Logs
LOG MESSAGE
DESCRIPTION
Firewall default policy: ICMP
, ,

ICMP access matched the default policy and was
blocked or forwarded according to the user's setting. For
type and code details, see Table 110 on page 248.
Firewall rule [NOT] match: ICMP
, ,
, 
ICMP access matched (or didn’t match) a firewall rule
(denoted by its number) and was blocked or forwarded
according to the rule. For type and code details, see
Table 110 on page 248.
Triangle route packet forwarded:
ICMP
The firewall allowed a triangle route session to pass
through.
Packet without a NAT table entry
blocked: ICMP
The router blocked a packet that didn’t have a
corresponding NAT table entry.
Unsupported/out-of-order ICMP:
ICMP
The firewall does not support this kind of ICMP packets
or the ICMP packets are out of order.
Router reply ICMP packet: ICMP
The router sent an ICMP reply packet to the sender.
Table 100 CDR Logs
LOG MESSAGE
DESCRIPTION
board%d line%d channel%d,
call%d,%s C01 Outgoing Call
dev=%x ch=%x%s
The router received the setup requirements for a call. “call” is
the reference (count) number of the call. “dev” is the device
type (3 is for dial-up, 6 is for PPPoE, 10 is for PPTP).
"channel" or “ch” is the call channel ID.For example,"board 0
line 0 channel 0, call 3, C01 Outgoing Call dev=6 ch=0
"Means the router has dialed to the PPPoE server 3 times.
board%d line%d channel%d,
call%d,%s C02 OutCall
Connected%d%s
The PPPoE, PPTP or dial-up call is connected.
board%d line%d channel%d,
call%d,%s C02 Call
Terminated
The PPPoE, PPTP or dial-up call was disconnected.
Table 101 PPP Logs
240
LOG MESSAGE
DESCRIPTION
ppp:LCP Starting
The PPP connection’s Link Control Protocol stage has started.
ppp:LCP Opening
The PPP connection’s Link Control Protocol stage is opening.
ppp:CHAP Opening
The PPP connection’s Challenge Handshake Authentication Protocol stage is
opening.
ppp:IPCP
Starting
The PPP connection’s Internet Protocol Control Protocol stage is starting.
ppp:IPCP Opening
The PPP connection’s Internet Protocol Control Protocol stage is opening.
ppp:LCP Closing
The PPP connection’s Link Control Protocol stage is closing.
ppp:IPCP Closing
The PPP connection’s Internet Protocol Control Protocol stage is closing.
P-660HW-Dx v2 User’s Guide
Chapter 18 Logs
Table 102 UPnP Logs
LOG MESSAGE
DESCRIPTION
UPnP pass through Firewall
UPnP packets can pass through the firewall.
Table 103 Content Filtering Logs
LOG MESSAGE
DESCRIPTION
%s: Keyword blocking
The content of a requested web page matched a user defined
keyword.
%s: Not in trusted web
list
The web site is not in a trusted domain, and the router blocks all traffic
except trusted domain sites.
%s: Forbidden Web site The web site is in the forbidden web site list.
%s: Contains ActiveX
The web site contains ActiveX.
%s: Contains Java
applet
The web site contains a Java applet.
%s: Contains cookie
The web site contains a cookie.
%s: Proxy mode
detected
The router detected proxy mode in the packet.
%s
The content filter server responded that the web site is in the blocked
category list, but it did not return the category type.
%s:%s
The content filter server responded that the web site is in the blocked
category list, and returned the category type.
%s(cache hit)
The system detected that the web site is in the blocked list from the
local cache, but does not know the category type.
%s:%s(cache hit)
The system detected that the web site is in blocked list from the local
cache, and knows the category type.
%s: Trusted Web site
The web site is in a trusted domain.
%s
When the content filter is not on according to the time schedule or you
didn't select the "Block Matched Web Site” check box, the system
forwards the web content.
Waiting content filter
server timeout
The external content filtering server did not respond within the timeout
period.
DNS resolving failed
The ZyXEL Device cannot get the IP address of the external content
filtering via DNS query.
Creating socket failed The ZyXEL Device cannot issue a query because TCP/IP socket
creation failed, port:port number.
Connecting to content
filter server fail
The connection to the external content filtering server failed.
License key is invalid The external content filtering license key is invalid.
P-660HW-Dx v2 User’s Guide
241
Chapter 18 Logs
Table 104 Attack Logs
LOG MESSAGE
DESCRIPTION
attack [TCP | UDP | IGMP
| ESP | GRE | OSPF]
The firewall detected a TCP/UDP/IGMP/ESP/GRE/OSPF attack.
attack ICMP (type:%d,
code:%d)
The firewall detected an ICMP attack. For type and code details,
see Table 110 on page 248.
land [TCP | UDP | IGMP |
ESP | GRE | OSPF]
The firewall detected a TCP/UDP/IGMP/ESP/GRE/OSPF land
attack.
land ICMP (type:%d,
code:%d)
The firewall detected an ICMP land attack. For type and code
details, see Table 110 on page 248.
ip spoofing - WAN [TCP |
UDP | IGMP | ESP | GRE |
OSPF]
The firewall detected an IP spoofing attack on the WAN port.
ip spoofing - WAN ICMP
(type:%d, code:%d)
The firewall detected an ICMP IP spoofing attack on the WAN
port. For type and code details, see Table 110 on page 248.
icmp echo: ICMP (type:%d,
code:%d)
The firewall detected an ICMP echo attack. For type and code
details, see Table 110 on page 248.
syn flood TCP
The firewall detected a TCP syn flood attack.
ports scan TCP
The firewall detected a TCP port scan attack.
teardrop TCP
The firewall detected a TCP teardrop attack.
teardrop UDP
The firewall detected an UDP teardrop attack.
teardrop ICMP (type:%d,
code:%d)
The firewall detected an ICMP teardrop attack. For type and code
details, see Table 110 on page 248.
illegal command TCP
The firewall detected a TCP illegal command attack.
NetBIOS TCP
The firewall detected a TCP NetBIOS attack.
ip spoofing - no routing
entry [TCP | UDP | IGMP |
ESP | GRE | OSPF]
The firewall classified a packet with no source routing entry as an
IP spoofing attack.
ip spoofing - no routing
entry ICMP (type:%d,
code:%d)
The firewall classified an ICMP packet with no source routing
entry as an IP spoofing attack.
vulnerability ICMP
(type:%d, code:%d)
The firewall detected an ICMP vulnerability attack. For type and
code details, see Table 110 on page 248.
traceroute ICMP (type:%d,
code:%d)
The firewall detected an ICMP traceroute attack. For type and
code details, see Table 110 on page 248.
Table 105 IPSec Logs
242
LOG MESSAGE
DESCRIPTION
Discard REPLAY packet
The router received and discarded a packet with an incorrect
sequence number.
Inbound packet
authentication failed
The router received a packet that has been altered. A third party
may have altered or tampered with the packet.
Receive IPSec packet,
but no corresponding
tunnel exists
The router dropped an inbound packet for which SPI could not find a
corresponding phase 2 SA.
P-660HW-Dx v2 User’s Guide
Chapter 18 Logs
Table 105 IPSec Logs (continued)
LOG MESSAGE
DESCRIPTION
Rule <%d> idle time
out, disconnect
The router dropped a connection that had outbound traffic and no
inbound traffic for a certain time period. You can use the "ipsec timer
chk_conn" CI command to set the time period. The default value is 2
minutes.
WAN IP changed to 
The router dropped all connections with the “MyIP” configured as
“0.0.0.0” when the WAN IP address changed.
Table 106 IKE Logs
LOG MESSAGE
DESCRIPTION
Active connection allowed
exceeded
The IKE process for a new connection failed because the limit
of simultaneous phase 2 SAs has been reached.
Start Phase 2: Quick Mode
Phase 2 Quick Mode has started.
Verifying Remote ID failed:
The connection failed during IKE phase 2 because the router
and the peer’s Local/Remote Addresses don’t match.
Verifying Local ID failed:
The connection failed during IKE phase 2 because the router
and the peer’s Local/Remote Addresses don’t match.
IKE Packet Retransmit
The router retransmitted the last packet sent because there
was no response from the peer.
Failed to send IKE Packet
An Ethernet error stopped the router from sending IKE
packets.
Too many errors! Deleting SA
An SA was deleted because there were too many errors.
Phase 1 IKE SA process done
The phase 1 IKE SA process has been completed.
Duplicate requests with the
same cookie
The router received multiple requests from the same peer
while still processing the first IKE packet from the peer.
IKE Negotiation is in
process
The router has already started negotiating with the peer for
the connection, but the IKE process has not finished yet.
No proposal chosen
Phase 1 or phase 2 parameters don’t match. Please check all
protocols / settings. Ex. One device being configured for
3DES and the other being configured for DES causes the
connection to fail.
Local / remote IPs of
incoming request conflict
with rule <%d>
The security gateway is set to “0.0.0.0” and the router used
the peer’s “Local Address” as the router’s “Remote Address”.
This information conflicted with static rule #d; thus the
connection is not allowed.
Cannot resolve Secure
Gateway Addr for rule <%d>
The router couldn’t resolve the IP address from the domain
name that was used for the secure gateway address.
Peer ID:   -
The displayed ID information did not match between the two
ends of the connection.
vs. My Remote  
The displayed ID information did not match between the two
ends of the connection.
vs. My Local -
The displayed ID information did not match between the two
ends of the connection.
Send 
A packet was sent.
P-660HW-Dx v2 User’s Guide
243
Chapter 18 Logs
Table 106 IKE Logs (continued)
244
LOG MESSAGE
DESCRIPTION
Recv 
IKE uses ISAKMP to transmit data. Each ISAKMP packet
contains many different types of payloads. All of them show in
the LOG. Refer to RFC2408 – ISAKMP for a list of all
ISAKMP payload types.
Recv 

Mode request from 
The router received an IKE negotiation request from the peer
address specified.
Send 

Mode request to 
The router started negotiation with the peer.
Invalid IP  /

The peer’s “Local IP Address” is invalid.
Remote IP  /
 conflicts
The security gateway is set to “0.0.0.0” and the router used
the peer’s “Local Address” as the router’s “Remote Address”.
This information conflicted with static rule #d; thus the
connection is not allowed.
Phase 1 ID type mismatch
This router’s "Peer ID Type" is different from the peer IPSec
router's "Local ID Type".
Phase 1 ID content mismatch
This router’s "Peer ID Content" is different from the peer
IPSec router's "Local ID Content".
No known phase 1 ID type
found
The router could not find a known phase 1 ID in the
connection attempt.
ID type mismatch. Local /
Peer: 
The phase 1 ID types do not match.
ID content mismatch
The phase 1 ID contents do not match.
Configured Peer ID Content:

The phase 1 ID contents do not match and the configured
"Peer ID Content" is displayed.
Incoming ID Content:

The phase 1 ID contents do not match and the incoming
packet's ID content is displayed.
Unsupported local ID Type:
<%d>
The phase 1 ID type is not supported by the router.
Build Phase 1 ID
The router has started to build the phase 1 ID.
Adjust TCP MSS to%d
The router automatically changed the TCP Maximum
Segment Size value after establishing a tunnel.
Rule <%d> input idle time
out, disconnect
The tunnel for the listed rule was dropped because there was
no inbound traffic within the idle timeout period.
XAUTH succeed! Username:

The router used extended authentication to authenticate the
listed username.
XAUTH fail! Username:

The router was not able to use extended authentication to
authenticate the listed username.
Rule[%d] Phase 1 negotiation
mode mismatch
The listed rule’s IKE phase 1 negotiation mode did not match
between the router and the peer.
Rule [%d] Phase 1 encryption
algorithm mismatch
The listed rule’s IKE phase 1 encryption algorithm did not
match between the router and the peer.
Rule [%d] Phase 1
authentication algorithm
mismatch
The listed rule’s IKE phase 1 authentication algorithm did not
match between the router and the peer.
P-660HW-Dx v2 User’s Guide
Chapter 18 Logs
Table 106 IKE Logs (continued)
LOG MESSAGE
DESCRIPTION
Rule [%d] Phase 1
authentication method
mismatch
The listed rule’s IKE phase 1 authentication method did not
match between the router and the peer.
Rule [%d] Phase 1 key group
mismatch
The listed rule’s IKE phase 1 key group did not match
between the router and the peer.
Rule [%d] Phase 2 protocol
mismatch
The listed rule’s IKE phase 2 protocol did not match between
the router and the peer.
Rule [%d] Phase 2 encryption
algorithm mismatch
The listed rule’s IKE phase 2 encryption algorithm did not
match between the router and the peer.
Rule [%d] Phase 2
authentication algorithm
mismatch
The listed rule’s IKE phase 2 authentication algorithm did not
match between the router and the peer.
Rule [%d] Phase 2
encapsulation mismatch
The listed rule’s IKE phase 2 encapsulation did not match
between the router and the peer.
Rule [%d]> Phase 2 pfs
mismatch
The listed rule’s IKE phase 2 perfect forward secret (pfs)
setting did not match between the router and the peer.
Rule [%d] Phase 1 ID mismatch The listed rule’s IKE phase 1 ID did not match between the
router and the peer.
Rule [%d] Phase 1 hash
mismatch
The listed rule’s IKE phase 1 hash did not match between the
router and the peer.
Rule [%d] Phase 1 preshared
key mismatch
The listed rule’s IKE phase 1 pre-shared key did not match
between the router and the peer.
Rule [%d] Tunnel built
successfully
The listed rule’s IPSec tunnel has been built successfully.
Rule [%d] Peer's public key
not found
The listed rule’s IKE phase 1 peer’s public key was not found.
Rule [%d] Verify peer's
signature failed
The listed rule’s IKE phase 1verification of the peer’s
signature failed.
Rule [%d] Sending IKE
request
IKE sent an IKE request for the listed rule.
Rule [%d] Receiving IKE
request
IKE received an IKE request for the listed rule.
Swap rule to rule [%d]
The router changed to using the listed rule.
Rule [%d] Phase 1 key length
mismatch
The listed rule’s IKE phase 1 key length (with the AES
encryption algorithm) did not match between the router and
the peer.
Rule [%d] phase 1 mismatch
The listed rule’s IKE phase 1 did not match between the
router and the peer.
Rule [%d] phase 2 mismatch
The listed rule’s IKE phase 2 did not match between the
router and the peer.
Rule [%d] Phase 2 key length
mismatch
The listed rule’s IKE phase 2 key lengths (with the AES
encryption algorithm) did not match between the router and
the peer.
P-660HW-Dx v2 User’s Guide
245
Chapter 18 Logs
Table 107 PKI Logs
246
LOG MESSAGE
DESCRIPTION
Enrollment successful
The SCEP online certificate enrollment was successful. The
Destination field records the certification authority server IP address
and port.
Enrollment failed
The SCEP online certificate enrollment failed. The Destination field
records the certification authority server’s IP address and port.
Failed to resolve

The SCEP online certificate enrollment failed because the certification
authority server’s address cannot be resolved.
Enrollment successful
The CMP online certificate enrollment was successful. The Destination
field records the certification authority server’s IP address and port.
Enrollment failed
The CMP online certificate enrollment failed. The Destination field
records the certification authority server’s IP address and port.
Failed to resolve 
The CMP online certificate enrollment failed because the certification
authority server’s IP address cannot be resolved.
Rcvd ca cert: 
The router received a certification authority certificate, with subject
name as recorded, from the LDAP server whose IP address and port
are recorded in the Source field.
Rcvd user cert:

The router received a user certificate, with subject name as recorded,
from the LDAP server whose IP address and port are recorded in the
Source field.
Rcvd CRL :

The router received a CRL (Certificate Revocation List), with size and
issuer name as recorded, from the LDAP server whose IP address and
port are recorded in the Source field.
Rcvd ARL :

The router received an ARL (Authority Revocation List), with size and
issuer name as recorded, from the LDAP server whose address and
port are recorded in the Source field.
Failed to decode the
received ca cert
The router received a corrupted certification authority certificate from
the LDAP server whose address and port are recorded in the Source
field.
Failed to decode the
received user cert
The router received a corrupted user certificate from the LDAP server
whose address and port are recorded in the Source field.
Failed to decode the
received CRL
The router received a corrupted CRL (Certificate Revocation List) from
the LDAP server whose address and port are recorded in the Source
field.
Failed to decode the
received ARL
The router received a corrupted ARL (Authority Revocation List) from
the LDAP server whose address and port are recorded in the Source
field.
Rcvd data  too
large! Max size
allowed: 
The router received directory data that was too large (the size is listed)
from the LDAP server whose address and port are recorded in the
Source field. The maximum size of directory data that the router allows
is also recorded.
Cert trusted: 
The router has verified the path of the certificate with the listed subject
name.
Due to ,
cert not trusted:

Due to the reasons listed, the certificate with the listed subject name
has not passed the path verification. The recorded reason codes are
only approximate reasons for not trusting the certificate. Please see
Table 108 on page 247 for the corresponding descriptions of the
codes.
P-660HW-Dx v2 User’s Guide
Chapter 18 Logs
Table 108 Certificate Path Verification Failure Reason Codes
CODE
DESCRIPTION
Algorithm mismatch between the certificate and the search constraints.
Key usage mismatch between the certificate and the search constraints.
Certificate was not valid in the time interval.
(Not used)
Certificate is not valid.
Certificate signature was not verified correctly.
Certificate was revoked by a CRL.
Certificate was not added to the cache.
Certificate decoding failed.
10
Certificate was not found (anywhere).
11
Certificate chain looped (did not find trusted root).
12
Certificate contains critical extension that was not handled.
13
Certificate issuer was not valid (CA specific information missing).
14
(Not used)
15
CRL is too old.
16
CRL is not valid.
17
CRL signature was not verified correctly.
18
CRL was not found (anywhere).
19
CRL was not added to the cache.
20
CRL decoding failed.
21
CRL is not currently valid, but in the future.
22
CRL contains duplicate serial numbers.
23
Time interval is not continuous.
24
Time information not available.
25
Database method failed due to timeout.
26
Database method failed.
27
Path was not verified.
28
Maximum path length reached.
Table 109 ACL Setting Notes
PACKET DIRECTION
DIRECTION
DESCRIPTION
(L to W)
LAN to WAN
ACL set for packets traveling from the LAN to the WAN.
(W to L)
WAN to LAN
ACL set for packets traveling from the WAN to the LAN.
(L to L)
LAN to LAN/
ZyXEL Device
ACL set for packets traveling from the LAN to the LAN or
the ZyXEL Device.
(W to W)
WAN to WAN/
ZyXEL Device
ACL set for packets traveling from the WAN to the WAN
or the ZyXEL Device.
P-660HW-Dx v2 User’s Guide
247
Chapter 18 Logs
Table 110 ICMP Notes
TYPE
CODE
Echo Reply
Echo reply message
Destination Unreachable
Net unreachable
Host unreachable
Protocol unreachable
Port unreachable
A packet that needed fragmentation was dropped because it was set to Don't
Fragment (DF)
Source route failed
Source Quench
A gateway may discard internet datagrams if it does not have the buffer space
needed to queue the datagrams for output to the next network on the route to
the destination network.
Redirect
Redirect datagrams for the Network
Redirect datagrams for the Host
Redirect datagrams for the Type of Service and Network
Redirect datagrams for the Type of Service and Host
Echo
Echo message
Time Exceeded
11
Time to live exceeded in transit
Fragment reassembly time exceeded
Parameter Problem
12
Pointer indicates the error
Timestamp
13
Timestamp request message
Timestamp Reply
14
Timestamp reply message
Information Request
15
Information request message
Information Reply
16
248
DESCRIPTION
Information reply message
P-660HW-Dx v2 User’s Guide
Chapter 18 Logs
Table 111 Syslog Logs
LOG MESSAGE
DESCRIPTION
Mon dd
hr:mm:ss hostname
src=""
dst=""
msg="" note=""
devID="" cat="
"This message is sent by the system ("RAS" displays as
the system name if you haven’t configured one) when the
router generates a syslog. The facility is defined in the web
MAIN MENU->LOGS->Log Settings page. The severity is
the log’s syslog class. The definition of messages and
notes are defined in the various log charts throughout this
appendix. The “devID” is the last three characters of the
MAC address of the router’s LAN port. The “cat” is the
same as the category in the router’s logs.
The following table shows RFC-2408 ISAKMP payload types that the log displays. Please
refer to the RFC for detailed information on each type.
Table 112 RFC-2408 ISAKMP Payload Types
LOG DISPLAY
PAYLOAD TYPE
SA
Security Association
PROP
Proposal
TRANS
Transform
KE
Key Exchange
ID
Identification
CER
Certificate
CER_REQ
Certificate Request
HASH
Hash
SIG
Signature
NONCE
Nonce
NOTFY
Notification
DEL
Delete
VID
Vendor ID
P-660HW-Dx v2 User’s Guide
249
Chapter 18 Logs
250
P-660HW-Dx v2 User’s Guide
CHAPTER
19
Tools
This chapter describes how to upload new firmware, manage configuration and restart your
ZyXEL Device.
19.1 Firmware Upgrade
Find firmware at www.zyxel.com in a file that (usually) uses the system model name with a
.bin extension, for example, "ZyXEL Device.bin". The upload process uses HTTP (Hypertext
Transfer Protocol) and may take up to two minutes. After a successful upload, the system will
reboot.
Only use firmware for your device’s specific model. Refer to the label on the bottom of your
device.
Click Maintenance > Tools to open the Firmware screen. Follow the instructions in this
screen to upload firmware to your ZyXEL Device.
Figure 143 Firmware
P-660HW-Dx v2 User’s Guide
251
Chapter 19 Tools
The following table describes the labels in this screen.
Table 113 Firmware Upgrade
LABEL
DESCRIPTION
Current
Firmware
Version
This is the present Firmware version and the date created.
File Path
Type in the location of the file you want to upload in this field or click Browse ... to
find it.
Browse...
Click Browse... to find the .bin file you want to upload. Remember that you must
decompress compressed (.zip) files before you can upload them.
Upload
Click Upload to begin the upload process. This process may take up to two
minutes.
Do NOT turn off the ZyXEL Device while firmware upload is in progress!
After you see the Firmware Upload in Progress screen, wait two minutes before logging into
the ZyXEL Device again.
Figure 144 Firmware Upload In Progress
The ZyXEL Device automatically restarts in this time causing a temporary network
disconnect. In some operating systems, you may see the following icon on your desktop.
Figure 145 Network Temporarily Disconnected
After two minutes, log in again and check your new firmware version in the Status screen.
If the upload was not successful, the following screen will appear. Click Return to go back to
the Firmware screen.
252
P-660HW-Dx v2 User’s Guide
Chapter 19 Tools
Figure 146 Error Message
19.2 Configuration Screen
Click Maintenance > Tools > Configuration. Information related to factory defaults, backup
configuration, and restoring configuration appears as shown next.
Figure 147 Configuration
19.2.1 Backup Configuration
Backup configuration allows you to back up (save) the ZyXEL Device’s current configuration
to a file on your computer. Once your ZyXEL Device is configured and functioning properly,
it is highly recommended that you back up your configuration file before making
configuration changes. The backup configuration file will be useful in case you need to return
to your previous settings.
Click Backup to save the ZyXEL Device’s current configuration to your computer
P-660HW-Dx v2 User’s Guide
253
Chapter 19 Tools
19.2.2 Restore Configuration
Restore configuration allows you to upload a new or previously saved configuration file from
your computer to your ZyXEL Device.
Table 114 Maintenance Restore Configuration
LABEL
DESCRIPTION
File Path
Type in the location of the file you want to upload in this field or click Browse... to find
it.
Browse...
Click Browse... to find the file you want to upload. Remember that you must
decompress compressed (.ZIP) files before you can upload them.
Upload
Click Upload to begin the upload process.
Do not turn off the ZyXEL Device while configuration file upload is in progress
After you see a “Restore Configuration successful” screen, you must then wait one minute
before logging into the ZyXEL Device again.
Figure 148 Configuration Restore Successful
The ZyXEL Device automatically restarts in this time causing a temporary network
disconnect. In some operating systems, you may see the following icon on your desktop.
Figure 149 Temporarily Disconnected
If you uploaded the default configuration file you may need to change the IP address of your
computer to be in the same subnet as that of the default ZyXEL Device IP address
(192.168.1.1). See the appendix for details on how to set up your computer’s IP address.
If the upload was not successful, the following screen will appear. Click Return to go back to
the Configuration screen.
254
P-660HW-Dx v2 User’s Guide
Chapter 19 Tools
Figure 150 Configuration Restore Error
19.2.3 Back to Factory Defaults
Pressing the RESET button in this section clears all user-entered configuration information
and returns the ZyXEL Device to its factory defaults.
You can also press the RESET button on the rear panel to reset the factory defaults of your
ZyXEL Device. Refer to the chapter about introducing the web configurator for more
information on the RESET button.
19.3 Restart
System restart allows you to reboot the ZyXEL Device without turning the power off.
Click Maintenance > Tools > Restart. Click Restart to have the ZyXEL Device reboot. This
does not affect the ZyXEL Device's configuration.
Figure 151 Restart Screen
P-660HW-Dx v2 User’s Guide
255
Chapter 19 Tools
256
P-660HW-Dx v2 User’s Guide
CHAPTER
20
Diagnostic
These read-only screens display information to help you identify problems with the ZyXEL
Device.
20.1 General Diagnostic
Click Maintenance > Diagnostic to open the screen shown next.
Figure 152 Diagnostic: General
The following table describes the fields in this screen.
Table 115 Diagnostic: General
LABEL
DESCRIPTION
TCP/IP
Address
Type the IP address of a computer that you want to ping in order to test a connection.
Ping
Click this button to ping the IP address that you entered.
20.2 DSL Line Diagnostic
Click Maintenance > Diagnostic > DSL Line to open the screen shown next.
P-660HW-Dx v2 User’s Guide
257
Chapter 20 Diagnostic
Figure 153 Diagnostic: DSL Line
The following table describes the fields in this screen.
Table 116 Diagnostic: DSL Line
LABEL
DESCRIPTION
ATM Status
Click this button to view ATM status.
ATM Loopback
Test
Click this button to start the ATM loopback test. Make sure you have configured at
least one PVC with proper VPIs/VCIs before you begin this test. The ZyXEL Device
sends an OAM F5 packet to the DSLAM/ATM switch and then returns it (loops it
back) to the ZyXEL Device. The ATM loopback test is useful for troubleshooting
problems with the DSLAM and ATM network.
DSL Line Status
Click this button to view the DSL port’s line operating values and line bit allocation.
Reset ADSL
Line
Click this button to reinitialize the ADSL line. The large text box above then displays
the progress and results of this operation, for example:
"Start to reset ADSL
Loading ADSL modem F/W...
Reset ADSL Line Successfully!"
Capture All Logs Click this button to display all logs generated with the DSL line.
258
P-660HW-Dx v2 User’s Guide
CHAPTER
21
Troubleshooting
This chapter offers some suggestions to solve problems you might encounter. The potential
problems are divided into the following categories.
• Power, Hardware Connections, and LEDs
• ZyXEL Device Access and Login
• Internet Access
21.1 Power, Hardware Connections, and LEDs
The ZyXEL Device does not turn on. None of the LEDs turn on.
1 Make sure the ZyXEL Device is turned on.
2 Make sure you are using the power adaptor or cord included with the ZyXEL Device.
3 Make sure the power adaptor or cord is connected to the ZyXEL Device and plugged in
to an appropriate power source. Make sure the power source is turned on.
4 Turn the ZyXEL Device off and on.
5 If the problem continues, contact the vendor.
One of the LEDs does not behave as expected.
Make sure you understand the normal behavior of the LED. See Section 1.4 on page 35.
Check the hardware connections. See the Quick Start Guide.
Inspect your cables for damage. Contact the vendor to replace any damaged cables.
Turn the ZyXEL Device off and on.
If the problem continues, contact the vendor.
P-660HW-Dx v2 User’s Guide
259
Chapter 21 Troubleshooting
21.2 ZyXEL Device Access and Login
I forgot the IP address for the ZyXEL Device.
• The default IP address is 192.168.1.1.
6 If you changed the IP address and have forgotten it, you might get the IP address of the
ZyXEL Device by looking up the IP address of the default gateway for your computer.
To do this in most Windows computers, click Start > Run, enter cmd, and then enter
ipconfig. The IP address of the Default Gateway might be the IP address of the ZyXEL
Device (it depends on the network), so enter this IP address in your Internet browser.
7 If this does not work, you have to reset the device to its factory defaults. See Section 2.3
on page 42.
I forgot the password.
1 The default password is 1234.
2 If this does not work, you have to reset the device to its factory defaults. See Section 2.3
on page 42.
I cannot see or access the Login screen in the web configurator.
1 Make sure you are using the correct IP address.
• The default IP address is 192.168.1.1.
• If you changed the IP address (Section 6.2.1 on page 95), use the new IP address.
• If you changed the IP address and have forgotten it, see the troubleshooting
suggestions for I forgot the IP address for the ZyXEL Device.
2 Check the hardware connections, and make sure the LEDs are behaving as expected. See
the Quick Start Guide.
3 Make sure your Internet browser does not block pop-up windows and has JavaScripts
and Java enabled. See Appendix G on page 333.
4 If you disabled Any IP (Section 6.2.4 on page 97), make sure your computer is in the
same subnet as the ZyXEL Device. (If you know that there are routers between your
computer and the ZyXEL Device, skip this step.)
• If there is a DHCP server on your network, make sure your computer is using a
dynamic IP address. See Section 6.2.1 on page 95. Your ZyXEL Device is a DHCP
server by default.
• If there is no DHCP server on your network, make sure your computer’s IP address is
in the same subnet as the ZyXEL Device. See Section 6.2.1 on page 95.
260
P-660HW-Dx v2 User’s Guide
Chapter 21 Troubleshooting
5 Reset the device to its factory defaults, and try to access the ZyXEL Device with the
default IP address. See Section 2.3 on page 42.
6 If the problem continues, contact the network administrator or vendor, or try one of the
advanced suggestions.
Advanced Suggestions
• Try to access the ZyXEL Device using another service, such as Telnet. If you can access
the ZyXEL Device, check the remote management settings and firewall rules to find out
why the ZyXEL Device does not respond to HTTP.
• If your computer is connected to the WAN port or is connected wirelessly, use a computer
that is connected to a LAN/ETHERNET port.
I can see the Login screen, but I cannot log in to the ZyXEL Device.
1 Make sure you have entered the user name and password correctly. The default password
is 1234. This field is case-sensitive, so make sure [Caps Lock] is not on.
2 You cannot log in to the web configurator while someone is using Telnet to access the
ZyXEL Device. Log out of the ZyXEL Device in the other session, or ask the person
who is logged in to log out.
3 Turn the ZyXEL Device off and on.
4 If this does not work, you have to reset the device to its factory defaults. See Section 2.3
on page 42.
I cannot Telnet to the ZyXEL Device.
See the troubleshooting suggestions for I cannot see or access the Login screen in the web
configurator. Ignore the suggestions about your browser.
I cannot use FTP to upload / download the configuration file. / I cannot use FTP
to upload new firmware.
See the troubleshooting suggestions for I cannot see or access the Login screen in the web
configurator. Ignore the suggestions about your browser.
21.3 Internet Access
I cannot access the Internet.
P-660HW-Dx v2 User’s Guide
261
Chapter 21 Troubleshooting
1 Check the hardware connections, and make sure the LEDs are behaving as expected. See
the Quick Start Guide and Section 1.4 on page 35.
2 If your ISP gave you Internet connection information, make sure you entered it correctly
in the Network > WAN > Internet Connection screen. These fields are case-sensitive,
so make sure [Caps Lock] is not on.
3 If you are trying to access the Internet wirelessly, make sure the wireless settings in the
wireless client are the same as the settings in the AP.
4 Disconnect all the cables from your device, and follow the directions in the Quick Start
Guide again.
5 If the problem continues, contact your ISP.
I cannot access the Internet anymore. I had access to the Internet (with the
ZyXEL Device), but my Internet connection is not available anymore.
1 Check the hardware connections, and make sure the LEDs are behaving as expected. See
the Quick Start Guide and Section 1.4 on page 35.
2 Reboot the ZyXEL Device.
3 Turn the ZyXEL Device off and on.
4 If the problem continues, contact your ISP.
The Internet connection is slow or intermittent.
1 There might be a lot of traffic on the network. Try closing some programs that use the
Internet, especially peer-to-peer applications.
2 Check the signal strength. If the signal strength is low, look around to see if there are any
devices that might be interfering with the wireless network (for example, microwaves,
other wireless networks, and so on).Reboot the ZyXEL Device.
3 Turn the ZyXEL Device off and on.
4 If the problem continues, contact the network administrator or vendor, or try one of the
advanced suggestions.
Advanced Suggestions
• Check the settings for bandwidth management. If it is disabled, you might consider
activating it. If it is enabled, you might consider changing the allocations.
• Check the settings for QoS. If it is disabled, you might consider activating it. If it is
enabled, you might consider raising or lowering the priority for some applications
262
P-660HW-Dx v2 User’s Guide
P ART VII
Appendices and
Index
Product Specifications and Wall Mounting (265)
Wireless LANs (271)
Setting up Your Computer’s IP Address (285)
IP Addresses and Subnetting (301)
Firewall Commands (311)
Internal SPTGEN (317)
Command Interpreter (331)
Pop-up Windows, JavaScripts and Java Permissions (333)
NetBIOS Filter Commands (339)
Splitters and Microfilters (341)
Triangle Route (341)
Legal Information (343)
Customer Support (347)
Index (351)
263
264
APPENDIX
Product Specifications and Wall
Mounting
Product Specifications
The following tables summarize the ZyXEL Device’s hardware and firmware features.M4
Table 117 Hardware Specifications
Dimensions (W x D x H)
180 x 128 x 36 mm
Power Specification
12V AC 1A
Built-in Switch
Four auto-negotiating, auto MDI/MDI-X 10/100 Mbps RJ-45 Ethernet ports
Operation Temperature
0º C ~ 40º C
Storage Temperature
-20º ~ 60º C
Operation Humidity
20% ~ 85% RH (non-condensing)
Storage Humidity
20% ~ 90% RH (non-condensing)
Distance between the
centers of the holes (for
wall mounting) on the
device’s back.
108 mm
Screw size for wallmounting
M4 Tap Screw
Antenna
The ZyXEL Device is equipped with one 3dBi fixed antenna.
Table 118 Firmware Specifications
FEATURE
DESCRIPTION
Default IP Address
192.168.1.1
Default Subnet Mask
255.255.255.0 (24 bits)
Default Admin Password
1234
Default User Password
user
DHCP Pool
192.168.1.33 to 192.168.1.64
Device Management
Use the web configurator to easily configure the rich range of features on
the ZyXEL Device.
Firmware Upgrade
Download new firmware (when available) from the ZyXEL web site and
use the web configurator, an FTP or a TFTP tool to put it on the ZyXEL
Device.
Note: Only upload firmware for your specific model!
P-660HW-Dx v2 User’s Guide
265
Appendix A Product Specifications and Wall Mounting
Table 118 Firmware Specifications
266
FEATURE
DESCRIPTION
Configuration Backup &
Restoration
Make a copy of the ZyXEL Device’s configuration. You can put it back on
the ZyXEL Device later if you decide to revert back to an earlier
configuration.
Network Address
Translation (NAT)
Each computer on your network must have its own unique IP address.
Use NAT to convert your public IP address(es) to multiple private IP
addresses for the computers on your network.
Port Forwarding
If you have a server (mail or web server for example) on your network,
you can use this feature to let people access it from the Internet.
DHCP (Dynamic Host
Configuration Protocol)
Use this feature to have the ZyXEL Device assign IP addresses, an IP
default gateway and DNS servers to computers on your network.
Dynamic DNS Support
With Dynamic DNS (Domain Name System) support, you can use a
fixed URL, www.zyxel.com for example, with a dynamic IP address. You
must register for this service with a Dynamic DNS service provider.
IP Multicast
IP multicast is used to send traffic to a specific group of computers. The
ZyXEL Device supports versions 1 and 2 of IGMP (Internet Group
Management Protocol) used to join multicast groups (see RFC 2236).
IP Alias
IP alias allows you to subdivide a physical network into logical networks
over the same Ethernet interface with the ZyXEL Device itself as the
gateway for each subnet.
Time and Date
Get the current time and date from an external server when you turn on
your ZyXEL Device. You can also set the time manually. These dates
and times are then used in logs.
Logging and Tracing
Use packet tracing and logs for troubleshooting. You can send logs from
the ZyXEL Device to an external syslog server.
PPPoE
PPPoE mimics a dial-up Internet access connection.
PPTP Encapsulation
Point-to-Point Tunneling Protocol (PPTP) enables secure transfer of
data through a Virtual Private Network (VPN). The ZyXEL Device
supports one PPTP connection at a time.
Universal Plug and Play
(UPnP)
A UPnP-enabled device can dynamically join a network, obtain an IP
address and convey its capabilities to other devices on the network.
Firewall
You can configure firewall on the ZyXEL Device for secure Internet
access. When the firewall is on, by default, all incoming traffic from the
Internet to your network is blocked unless it is initiated from your
network. This means that probes from the outside to your network are
not allowed, but you can safely browse the Internet and download files
for example.
Content Filter
The ZyXEL Device blocks or allows access to web sites that you specify
and blocks access to web sites with URLs that contain keywords that
you specify. You can define time periods and days during which content
filtering is enabled. You can also include or exclude particular computers
on your network from content filtering.
You can also subscribe to category-based content filtering that allows
your ZyXEL Device to check web sites against an external database.
Bandwidth Management
You can efficiently manage traffic on your network by reserving
bandwidth and giving priority to certain types of traffic and/or to particular
computers.
Remote Management
This allows you to decide whether a service (HTTP or FTP traffic for
example) from a computer on a network (LAN or WAN for example) can
access the ZyXEL Device.
P-660HW-Dx v2 User’s Guide
Appendix A Product Specifications and Wall Mounting
Table 118 Firmware Specifications
FEATURE
DESCRIPTION
Any IP
The Any IP feature allows one computer to connect to the ZyXEL Device
(and then to other computers) when their IP addresses are in different
subnets. This is done without changing the network settings (such as IP
address and subnet mask) of the computer.
Traffic Redirect
Traffic redirect forwards WAN traffic to a backup gateway when the
ZyXEL Device cannot connect to the Internet, thus acting as an auxiliary
if your regular WAN connection fails.
Triple Play
The ZyXEL Device is capable of simultaneously transferring data, voice
and video over the Internet.
IP Policy Routing (IPPR)
Traditionally, routing is based on the destination address only and the
router takes the shortest path to forward a packet. IP Policy Routing
(IPPR) provides a mechanism to override the default routing behavior
and alter the packet forwarding based on the policy defined by the
network administrator.
Table 119 Wireless Firmware Specifications
FEATURE
DESCRIPTION
Wireless LAN
The ZyXEL Device is fully compatible with both IEEE 802.11b and IEEE
802.11g standards and can support both kinds of clients on the same
network.
WEP Encryption
WEP (Wired Equivalent Privacy) allows the encryption of data before its
transmission over networks.
Wi-Fi Protected Access
(WPA)
WPA is part of the IEEE 802.11i security specifications standard and
offers user authentication and data encryption.
WPA2
WPA2 is an improvement on WPA with enhanced data encryption, user
authentication and key management.
WPA2-PSK
WPA(2)-PSK: WPA-PSK and WPA2-PSK allow you to implement the
superior WPA and WPA2 encryption standards without using a RADIUS
server. Instead, WPA(2)-PSK uses pre-shared keys (PSKs) to
authenticate devices on the wireless network.
Output Power Management
This allows you to alter the level of power used by the ZyXEL Device.
For example, when access points are placed closely together power
output levels may be reduced.
Wireless LAN MAC
Address Filtering
This service checks the MAC address of a connection with a list of
allowed or denied MAC addresses, ensuring only wanted connections
are allowed.
The following list, which is not exhaustive, illustrates the standards supported in the ZyXEL
Device.
Table 120 Standards Supported
STANDARD
DESCRIPTION
RFC 867
Daytime Protocol
RFC 868
Time Protocol.
RFC 1058
RIP-1 (Routing Information Protocol)
RFC 1112
IGMP v1
RFC 1157
SNMPv1: Simple Network Management Protocol version 1
P-660HW-Dx v2 User’s Guide
267
Appendix A Product Specifications and Wall Mounting
Table 120 Standards Supported (continued)
268
STANDARD
DESCRIPTION
RFC 1305
Network Time Protocol (NTP version 3)
RFC 1441
SNMPv2 Simple Network Management Protocol version 2
RFC 1483
Multiprotocol Encapsulation over ATM Adaptation Layer 5
RFC 1631
IP Network Address Translator (NAT)
RFC 1661
The Point-to-Point Protocol (PPP)
RFC 1723
RIP-2 (Routing Information Protocol)
RFC 1901
SNMPv2c Simple Network Management Protocol version 2c
RFC 2236
Internet Group Management Protocol, Version 2.
RFC 2364
PPP over AAL5 (PPP over ATM over ADSL)
RFC 2408
Internet Security Association and Key Management Protocol (ISAKMP)
RFC 2516
A Method for Transmitting PPP Over Ethernet (PPPoE)
RFC 2684
Multiprotocol Encapsulation over ATM Adaptation Layer 5.
RFC 2766
Network Address Translation - Protocol
IEEE 802.11
Also known by the brand Wi-Fi, denotes a set of Wireless LAN/WLAN
standards developed by working group 11 of the IEEE LAN/MAN
Standards Committee (IEEE 802).
IEEE 802.11b
Uses the 2.4 gigahertz (GHz) band
IEEE 802.11g
Uses the 2.4 gigahertz (GHz) band
IEEE 802.11g+
Turbo and Super G modes
IEEE 802.11d
Standard for Local and Metropolitan Area Networks: Media Access
Control (MAC) Bridges
IEEE 802.11x
Port Based Network Access Control.
IEEE 802.11e QoS
IEEE 802.11 e Wireless LAN for Quality of Service
ANSI T1.413, Issue 2
Asymmetric Digital Subscriber Line (ADSL) standard.
G dmt(G.992.1)
G.992.1 Asymmetrical Digital Subscriber Line (ADSL) Transceivers
ITU G.992.1 (G.DMT)
ITU standard for ADSL using discrete multitone modulation.
ITU G.992.2 (G. Lite)
ITU standard for ADSL using discrete multitone modulation.
ITU G.992.3 (G.dmt.bis)
ITU standard (also referred to as ADSL2) that extends the capability of
basic ADSL in data rates.
ITU G.992.3 (G.lite.bis)
ITU standard (also referred to as ADSL2) that extends the capability of
basic ADSL in data rates.
ITU G.992.5 (ADSL2+)
ITU standard (also referred to as ADSL2+) that extends the capability of
basic ADSL by doubling the number of downstream bits.
Microsoft PPTP
MS PPTP (Microsoft's implementation of Point to Point Tunneling
Protocol)
MBM v2
Media Bandwidth Management v2
RFC 2383
ST2+ over ATM Protocol Specification - UNI 3.1 Version
TR-069
TR-069 DSL Forum Standard for CPE Wan Management.
1.363.5
Compliant AAL5 SAR (Segmentation And Re-assembly)
P-660HW-Dx v2 User’s Guide
Appendix A Product Specifications and Wall Mounting
Wall-mounting Instructions
Complete the following steps to hang your ZyXEL Device on a wall.
See the Hardware Specifications table for the size of screws to use and how far
apart to place them.
1 Select a high position on a sturdy wall that is free of obstructions.
2 Drill two holes for the screws.
3 Be careful to avoid damaging pipes or cables located inside the wall when drilling holes
for the screws.
4 Do not insert the screws all the way into the wall. Leave a small gap of about 0.5 cm
between the heads of the screws and the wall.
5 Make sure the screws are snugly fastened to the wall. They need to hold the weight of
the ZyXEL Device with the connection cables.
6 Align the holes on the back of the ZyXEL Device with the screws on the wall. Hang the
ZyXEL Device on the screws.
Figure 154 Wall-mounting Example
The following are dimensions of an M4 tap screw and masonry plug used for wall mounting.
All measurements are in millimeters (mm).
P-660HW-Dx v2 User’s Guide
269
Appendix A Product Specifications and Wall Mounting
Figure 155 Masonry Plug and M4 Tap Screw
270
P-660HW-Dx v2 User’s Guide
APPENDIX
Wireless LANs
Wireless LAN Topologies
This section discusses ad-hoc and infrastructure wireless LAN topologies.
Ad-hoc Wireless LAN Configuration
The simplest WLAN configuration is an independent (Ad-hoc) WLAN that connects a set of
computers with wireless adapters (A, B, C). Any time two or more wireless adapters are within
range of each other, they can set up an independent network, which is commonly referred to as
an ad-hoc network or Independent Basic Service Set (IBSS). The following diagram shows an
example of notebook computers using wireless adapters to form an ad-hoc wireless LAN.
Figure 156 Peer-to-Peer Communication in an Ad-hoc Network
BSS
A Basic Service Set (BSS) exists when all communications between wireless clients or
between a wireless client and a wired network client go through one access point (AP).
Intra-BSS traffic is traffic between wireless clients in the BSS. When Intra-BSS is enabled,
wireless client A and B can access the wired network and communicate with each other. When
Intra-BSS is disabled, wireless client A and B can still access the wired network but cannot
communicate with each other.
P-660HW-Dx v2 User’s Guide
271
Appendix B Wireless LANs
Figure 157 Basic Service Set
ESS
An Extended Service Set (ESS) consists of a series of overlapping BSSs, each containing an
access point, with each access point connected together by a wired network. This wired
connection between APs is called a Distribution System (DS).
This type of wireless LAN topology is called an Infrastructure WLAN. The Access Points not
only provide communication with the wired network but also mediate wireless network traffic
in the immediate neighborhood.
An ESSID (ESS IDentification) uniquely identifies each ESS. All access points and their
associated wireless clients within the same ESS must have the same ESSID in order to
communicate.
272
P-660HW-Dx v2 User’s Guide
Appendix B Wireless LANs
Figure 158 Infrastructure WLAN
Channel
A channel is the radio frequency(ies) used by wireless devices to transmit and receive data.
Channels available depend on your geographical area. You may have a choice of channels (for
your region) so you should use a channel different from an adjacent AP (access point) to
reduce interference. Interference occurs when radio signals from different access points
overlap causing interference and degrading performance.
Adjacent channels partially overlap however. To avoid interference due to overlap, your AP
should be on a channel at least five channels away from a channel that an adjacent AP is using.
For example, if your region has 11 channels and an adjacent AP is using channel 1, then you
need to select a channel between 6 or 11.
RTS/CTS
A hidden node occurs when two stations are within range of the same access point, but are not
within range of each other. The following figure illustrates a hidden node. Both stations (STA)
are within range of the access point (AP) or wireless gateway, but out-of-range of each other,
so they cannot "hear" each other, that is they do not know if the channel is currently being
used. Therefore, they are considered hidden from each other.
P-660HW-Dx v2 User’s Guide
273
Appendix B Wireless LANs
Figure 159
RTS/CTS
When station A sends data to the AP, it might not know that the station B is already using the
channel. If these two stations send data at the same time, collisions may occur when both sets
of data arrive at the AP at the same time, resulting in a loss of messages for both stations.
RTS/CTS is designed to prevent collisions due to hidden nodes. An RTS/CTS defines the
biggest size data frame you can send before an RTS (Request To Send)/CTS (Clear to Send)
handshake is invoked.
When a data frame exceeds the RTS/CTS value you set (between 0 to 2432 bytes), the station
that wants to transmit this frame must first send an RTS (Request To Send) message to the AP
for permission to send it. The AP then responds with a CTS (Clear to Send) message to all
other stations within its range to notify them to defer their transmission. It also reserves and
confirms with the requesting station the time frame for the requested transmission.
Stations can send frames smaller than the specified RTS/CTS directly to the AP without the
RTS (Request To Send)/CTS (Clear to Send) handshake.
You should only configure RTS/CTS if the possibility of hidden nodes exists on your network
and the "cost" of resending large frames is more than the extra network overhead involved in
the RTS (Request To Send)/CTS (Clear to Send) handshake.
If the RTS/CTS value is greater than the Fragmentation Threshold value (see next), then the
RTS (Request To Send)/CTS (Clear to Send) handshake will never occur as data frames will
be fragmented before they reach RTS/CTS size.
Enabling the RTS Threshold causes redundant network overhead that could
negatively affect the throughput performance instead of providing a remedy.
Fragmentation Threshold
A Fragmentation Threshold is the maximum data fragment size (between 256 and 2432
bytes) that can be sent in the wireless network before the AP will fragment the packet into
smaller data frames.
A large Fragmentation Threshold is recommended for networks not prone to interference
while you should set a smaller threshold for busy networks or networks that are prone to
interference.
274
P-660HW-Dx v2 User’s Guide
Appendix B Wireless LANs
If the Fragmentation Threshold value is smaller than the RTS/CTS value (see previously)
you set then the RTS (Request To Send)/CTS (Clear to Send) handshake will never occur as
data frames will be fragmented before they reach RTS/CTS size.
Preamble Type
Preamble is used to signal that data is coming to the receiver. Short and long refer to the length
of the synchronization field in a packet.
Short preamble increases performance as less time sending preamble means more time for
sending data. All IEEE 802.11 compliant wireless adapters support long preamble, but not all
support short preamble.
Use long preamble if you are unsure what preamble mode other wireless devices on the
network support, and to provide more reliable communications in busy wireless networks.
Use short preamble if you are sure all wireless devices on the network support it, and to
provide more efficient communications.
Use the dynamic setting to automatically use short preamble when all wireless devices on the
network support it, otherwise the ZyXEL Device uses long preamble.
The wireless devices MUST use the same preamble mode in order to
communicate.
IEEE 802.11g Wireless LAN
IEEE 802.11g is fully compatible with the IEEE 802.11b standard. This means an IEEE
802.11b adapter can interface directly with an IEEE 802.11g access point (and vice versa) at
11 Mbps or lower depending on range. IEEE 802.11g has several intermediate rate steps
between the maximum and minimum data rates. The IEEE 802.11g data rate and modulation
are as follows:
Table 121 IEEE 802.11g
DATA RATE (MBPS)
MODULATION
DBPSK (Differential Binary Phase Shift Keyed)
DQPSK (Differential Quadrature Phase Shift Keying)
5.5 / 11
CCK (Complementary Code Keying)
6/9/12/18/24/36/48/54
OFDM (Orthogonal Frequency Division Multiplexing)
Wireless Security Overview
Wireless security is vital to your network to protect wireless communication between wireless
clients, access points and the wired network.
P-660HW-Dx v2 User’s Guide
275
Appendix B Wireless LANs
Wireless security methods available on the ZyXEL Device are data encryption, wireless client
authentication, restricting access by device MAC address and hiding the ZyXEL Device
identity.
The following figure shows the relative effectiveness of these wireless security methods
available on your ZyXEL Device.
Table 122 Wireless Security Levels
SECURITY
LEVEL
SECURITY TYPE
Least
Secure
Unique SSID (Default)
Unique SSID with Hide SSID Enabled
MAC Address Filtering
WEP Encryption
IEEE802.1x EAP with RADIUS Server Authentication
Wi-Fi Protected Access (WPA)
Most Secure
WPA2
You must enable the same wireless security settings on the ZyXEL Device and
on all wireless clients that you want to associate with it.
IEEE 802.1x
In June 2001, the IEEE 802.1x standard was designed to extend the features of IEEE 802.11 to
support extended authentication as well as providing additional accounting and control
features. It is supported by Windows XP and a number of network devices. Some advantages
of IEEE 802.1x are:
• User based identification that allows for roaming.
• Support for RADIUS (Remote Authentication Dial In User Service, RFC 2138, 2139) for
centralized user profile and accounting management on a network RADIUS server.
• Support for EAP (Extensible Authentication Protocol, RFC 2486) that allows additional
authentication methods to be deployed with no changes to the access point or the wireless
clients.
RADIUS
RADIUS is based on a client-server model that supports authentication, authorization and
accounting. The access point is the client and the server is the RADIUS server. The RADIUS
server handles the following tasks:
• Authentication
Determines the identity of the users.
• Authorization
276
P-660HW-Dx v2 User’s Guide
Appendix B Wireless LANs
Determines the network services available to authenticated users once they are connected
to the network.
• Accounting
Keeps track of the client’s network activity.
RADIUS is a simple package exchange in which your AP acts as a message relay between the
wireless client and the network RADIUS server.
Types of RADIUS Messages
The following types of RADIUS messages are exchanged between the access point and the
RADIUS server for user authentication:
• Access-Request
Sent by an access point requesting authentication.
• Access-Reject
Sent by a RADIUS server rejecting access.
• Access-Accept
Sent by a RADIUS server allowing access.
• Access-Challenge
Sent by a RADIUS server requesting more information in order to allow access. The
access point sends a proper response from the user and then sends another Access-Request
message.
The following types of RADIUS messages are exchanged between the access point and the
RADIUS server for user accounting:
• Accounting-Request
Sent by the access point requesting accounting.
• Accounting-Response
Sent by the RADIUS server to indicate that it has started or stopped accounting.
In order to ensure network security, the access point and the RADIUS server use a shared
secret key, which is a password, they both know. The key is not sent over the network. In
addition to the shared key, password information exchanged is also encrypted to protect the
network from unauthorized access.
Types of EAP Authentication
This section discusses some popular authentication types: EAP-MD5, EAP-TLS, EAP-TTLS,
PEAP and LEAP. Your wireless LAN device may not support all authentication types.
EAP (Extensible Authentication Protocol) is an authentication protocol that runs on top of the
IEEE 802.1x transport mechanism in order to support multiple types of user authentication. By
using EAP to interact with an EAP-compatible RADIUS server, an access point helps a
wireless station and a RADIUS server perform authentication.
The type of authentication you use depends on the RADIUS server and an intermediary AP(s)
that supports IEEE 802.1x. .
P-660HW-Dx v2 User’s Guide
277
Appendix B Wireless LANs
For EAP-TLS authentication type, you must first have a wired connection to the network and
obtain the certificate(s) from a certificate authority (CA). A certificate (also called digital IDs)
can be used to authenticate users and a CA issues certificates and guarantees the identity of
each certificate owner.
EAP-MD5 (Message-Digest Algorithm 5)
MD5 authentication is the simplest one-way authentication method. The authentication server
sends a challenge to the wireless client. The wireless client ‘proves’ that it knows the password
by encrypting the password with the challenge and sends back the information. Password is
not sent in plain text.
However, MD5 authentication has some weaknesses. Since the authentication server needs to
get the plaintext passwords, the passwords must be stored. Thus someone other than the
authentication server may access the password file. In addition, it is possible to impersonate an
authentication server as MD5 authentication method does not perform mutual authentication.
Finally, MD5 authentication method does not support data encryption with dynamic session
key. You must configure WEP encryption keys for data encryption.
EAP-TLS (Transport Layer Security)
With EAP-TLS, digital certifications are needed by both the server and the wireless clients for
mutual authentication. The server presents a certificate to the client. After validating the
identity of the server, the client sends a different certificate to the server. The exchange of
certificates is done in the open before a secured tunnel is created. This makes user identity
vulnerable to passive attacks. A digital certificate is an electronic ID card that authenticates the
sender’s identity. However, to implement EAP-TLS, you need a Certificate Authority (CA) to
handle certificates, which imposes a management overhead.
EAP-TTLS (Tunneled Transport Layer Service)
EAP-TTLS is an extension of the EAP-TLS authentication that uses certificates for only the
server-side authentications to establish a secure connection. Client authentication is then done
by sending username and password through the secure connection, thus client identity is
protected. For client authentication, EAP-TTLS supports EAP methods and legacy
authentication methods such as PAP, CHAP, MS-CHAP and MS-CHAP v2.
PEAP (Protected EAP)
Like EAP-TTLS, server-side certificate authentication is used to establish a secure connection,
then use simple username and password methods through the secured connection to
authenticate the clients, thus hiding client identity. However, PEAP only supports EAP
methods, such as EAP-MD5, EAP-MSCHAPv2 and EAP-GTC (EAP-Generic Token Card),
for client authentication. EAP-GTC is implemented only by Cisco.
LEAP
LEAP (Lightweight Extensible Authentication Protocol) is a Cisco implementation of IEEE
802.1x.
278
P-660HW-Dx v2 User’s Guide
Appendix B Wireless LANs
Dynamic WEP Key Exchange
The AP maps a unique key that is generated with the RADIUS server. This key expires when
the wireless connection times out, disconnects or reauthentication times out. A new WEP key
is generated each time reauthentication is performed.
If this feature is enabled, it is not necessary to configure a default encryption key in the
wireless security configuration screen. You may still configure and store keys, but they will
not be used while dynamic WEP is enabled.
EAP-MD5 cannot be used with Dynamic WEP Key Exchange
For added security, certificate-based authentications (EAP-TLS, EAP-TTLS and PEAP) use
dynamic keys for data encryption. They are often deployed in corporate environments, but for
public deployment, a simple user name and password pair is more practical. The following
table is a comparison of the features of authentication types.
Table 123 Comparison of EAP Authentication Types
EAP-MD5
EAP-TLS
EAP-TTLS
PEAP
LEAP
Mutual Authentication
No
Yes
Yes
Yes
Yes
Certificate – Client
No
Yes
Optional
Optional
No
Certificate – Server
No
Yes
Yes
Yes
No
Dynamic Key Exchange
No
Yes
Yes
Yes
Yes
Credential Integrity
None
Strong
Strong
Strong
Moderate
Deployment Difficulty
Easy
Hard
Moderate
Moderate
Moderate
Client Identity Protection
No
No
Yes
Yes
No
WPA and WPA2
Wi-Fi Protected Access (WPA) is a subset of the IEEE 802.11i standard. WPA2 (IEEE
802.11i) is a wireless security standard that defines stronger encryption, authentication and
key management than WPA.
Key differences between WPA or WPA2 and WEP are improved data encryption and user
authentication.
If both an AP and the wireless clients support WPA2 and you have an external RADIUS
server, use WPA2 for stronger data encryption. If you don't have an external RADIUS server,
you should use WPA2-PSK (WPA2-Pre-Shared Key) that only requires a single (identical)
password entered into each access point, wireless gateway and wireless client. As long as the
passwords match, a wireless client will be granted access to a WLAN.
If the AP or the wireless clients do not support WPA2, just use WPA or WPA-PSK depending
on whether you have an external RADIUS server or not.
Select WEP only when the AP and/or wireless clients do not support WPA or WPA2. WEP is
less secure than WPA or WPA2.
P-660HW-Dx v2 User’s Guide
279
Appendix B Wireless LANs
Encryption
Both WPA and WPA2 improve data encryption by using Temporal Key Integrity Protocol
(TKIP), Message Integrity Check (MIC) and IEEE 802.1x. WPA and WPA2 use Advanced
Encryption Standard (AES) in the Counter mode with Cipher block chaining Message
authentication code Protocol (CCMP) to offer stronger encryption than TKIP.
TKIP uses 128-bit keys that are dynamically generated and distributed by the authentication
server. AES (Advanced Encryption Standard) is a block cipher that uses a 256-bit
mathematical algorithm called Rijndael. They both include a per-packet key mixing function,
a Message Integrity Check (MIC) named Michael, an extended initialization vector (IV) with
sequencing rules, and a re-keying mechanism.
WPA and WPA2 regularly change and rotate the encryption keys so that the same encryption
key is never used twice.
The RADIUS server distributes a Pairwise Master Key (PMK) key to the AP that then sets up
a key hierarchy and management system, using the PMK to dynamically generate unique data
encryption keys to encrypt every data packet that is wirelessly communicated between the AP
and the wireless clients. This all happens in the background automatically.
The Message Integrity Check (MIC) is designed to prevent an attacker from capturing data
packets, altering them and resending them. The MIC provides a strong mathematical function
in which the receiver and the transmitter each compute and then compare the MIC. If they do
not match, it is assumed that the data has been tampered with and the packet is dropped.
By generating unique data encryption keys for every data packet and by creating an integrity
checking mechanism (MIC), with TKIP and AES it is more difficult to decrypt data on a Wi-Fi
network than WEP and difficult for an intruder to break into the network.
The encryption mechanisms used for WPA(2) and WPA(2)-PSK are the same. The only
difference between the two is that WPA(2)-PSK uses a simple common password, instead of
user-specific credentials. The common-password approach makes WPA(2)-PSK susceptible to
brute-force password-guessing attacks but it’s still an improvement over WEP as it employs a
consistent, single, alphanumeric password to derive a PMK which is used to generate unique
temporal encryption keys. This prevent all wireless devices sharing the same encryption keys.
(a weakness of WEP)
User Authentication
WPA and WPA2 apply IEEE 802.1x and Extensible Authentication Protocol (EAP) to
authenticate wireless clients using an external RADIUS database. WPA2 reduces the number
of key exchange messages from six to four (CCMP 4-way handshake) and shortens the time
required to connect to a network. Other WPA2 authentication features that are different from
WPA include key caching and pre-authentication. These two features are optional and may not
be supported in all wireless devices.
Key caching allows a wireless client to store the PMK it derived through a successful
authentication with an AP. The wireless client uses the PMK when it tries to connect to the
same AP and does not need to go with the authentication process again.
Pre-authentication enables fast roaming by allowing the wireless client (already connecting to
an AP) to perform IEEE 802.1x authentication with another AP before connecting to it.
280
P-660HW-Dx v2 User’s Guide
Appendix B Wireless LANs
Wireless Client WPA Supplicants
A wireless client supplicant is the software that runs on an operating system instructing the
wireless client how to use WPA. At the time of writing, the most widely available supplicant is
the WPA patch for Windows XP, Funk Software's Odyssey client.
The Windows XP patch is a free download that adds WPA capability to Windows XP's builtin "Zero Configuration" wireless client. However, you must run Windows XP to use it.
WPA(2) with RADIUS Application Example
To set up WPA(2), you need the IP address of the RADIUS server, its port number (default is
1812), and the RADIUS shared secret. A WPA(2) application example with an external
RADIUS server looks as follows. "A" is the RADIUS server. "DS" is the distribution system.
1 The AP passes the wireless client's authentication request to the RADIUS server.
2 The RADIUS server then checks the user's identification against its database and grants
or denies network access accordingly.
3 A 256-bit Pairwise Master Key (PMK) is derived from the authentication process by the
RADIUS server and the client.
4 The RADIUS server distributes the PMK to the AP. The AP then sets up a key hierarchy
and management system, using the PMK to dynamically generate unique data encryption
keys. The keys are used to encrypt every data packet that is wirelessly communicated
between the AP and the wireless clients.
Figure 160 WPA(2) with RADIUS Application Example
WPA(2)-PSK Application Example
A WPA(2)-PSK application looks as follows.
1 First enter identical passwords into the AP and all wireless clients. The Pre-Shared Key
(PSK) must consist of between 8 and 63 ASCII characters or 64 hexadecimal characters
(including spaces and symbols).
2 The AP checks each wireless client's password and allows it to join the network only if
the password matches.
P-660HW-Dx v2 User’s Guide
281
Appendix B Wireless LANs
3 The AP and wireless clients generate a common PMK (Pairwise Master Key). The key
itself is not sent over the network, but is derived from the PSK and the SSID.
4 The AP and wireless clients use the TKIP or AES encryption process, the PMK and
information exchanged in a handshake to create temporal encryption keys. They use
these keys to encrypt data exchanged between them.
Figure 161 WPA(2)-PSK Authentication
Security Parameters Summary
Refer to this table to see what other security parameters you should configure for each
authentication method or key management protocol type. MAC address filters are not
dependent on how you configure these security features.
Table 124 Wireless Security Relational Matrix
AUTHENTICATION
ENCRYPTIO
METHOD/ KEY
MANAGEMENT PROTOCOL N METHOD
ENTER
MANUAL KEY
IEEE 802.1X
Open
No
Disable
None
Enable without Dynamic WEP Key
Open
Shared
282
WEP
WEP
No
Enable with Dynamic WEP Key
Yes
Enable without Dynamic WEP Key
Yes
Disable
No
Enable with Dynamic WEP Key
Yes
Enable without Dynamic WEP Key
Yes
Disable
WPA
TKIP/AES
No
Enable
WPA-PSK
TKIP/AES
Yes
Disable
WPA2
TKIP/AES
No
Enable
WPA2-PSK
TKIP/AES
Yes
Disable
P-660HW-Dx v2 User’s Guide
Appendix B Wireless LANs
Antenna Overview
An antenna couples RF signals onto air. A transmitter within a wireless device sends an RF
signal to the antenna, which propagates the signal through the air. The antenna also operates in
reverse by capturing RF signals from the air.
Positioning the antennas properly increases the range and coverage area of a wireless LAN.
Antenna Characteristics
Frequency
An antenna in the frequency of 2.4GHz (IEEE 802.11b and IEEE 802.11g) or 5GHz (IEEE
802.11a) is needed to communicate efficiently in a wireless LAN
Radiation Pattern
A radiation pattern is a diagram that allows you to visualize the shape of the antenna’s
coverage area.
Antenna Gain
Antenna gain, measured in dB (decibel), is the increase in coverage within the RF beam width.
Higher antenna gain improves the range of the signal for better communications.
For an indoor site, each 1 dB increase in antenna gain results in a range increase of
approximately 2.5%. For an unobstructed outdoor site, each 1dB increase in gain results in a
range increase of approximately 5%. Actual results may vary depending on the network
environment.
Antenna gain is sometimes specified in dBi, which is how much the antenna increases the
signal power compared to using an isotropic antenna. An isotropic antenna is a theoretical
perfect antenna that sends out radio signals equally well in all directions. dBi represents the
true gain that the antenna provides.
Types of Antennas for WLAN
There are two types of antennas used for wireless LAN applications.
• Omni-directional antennas send the RF signal out in all directions on a horizontal plane.
The coverage area is torus-shaped (like a donut) which makes these antennas ideal for a
room environment. With a wide coverage area, it is possible to make circular overlapping
coverage areas with multiple access points.
• Directional antennas concentrate the RF signal in a beam, like a flashlight does with the
light from its bulb. The angle of the beam determines the width of the coverage pattern.
Angles typically range from 20 degrees (very directional) to 120 degrees (less directional).
Directional antennas are ideal for hallways and outdoor point-to-point applications.
P-660HW-Dx v2 User’s Guide
283
Appendix B Wireless LANs
Positioning Antennas
In general, antennas should be mounted as high as practically possible and free of
obstructions. In point-to–point application, position both antennas at the same height and in a
direct line of sight to each other to attain the best performance.
For omni-directional antennas mounted on a table, desk, and so on, point the antenna up. For
omni-directional antennas mounted on a wall or ceiling, point the antenna down. For a single
AP application, place omni-directional antennas as close to the center of the coverage area as
possible.
For directional antennas, point the antenna in the direction of the desired coverage area.
284
P-660HW-Dx v2 User’s Guide
APPENDIX
Setting up Your Computer’s IP
Address
All computers must have a 10M or 100M Ethernet adapter card and TCP/IP installed.
Windows 95/98/Me/NT/2000/XP, Macintosh OS 7 and later operating systems and all
versions of UNIX/LINUX include the software components you need to install and use TCP/
IP on your computer. Windows 3.1 requires the purchase of a third-party TCP/IP application
package.
TCP/IP should already be installed on computers using Windows NT/2000/XP, Macintosh OS
7 and later operating systems.
After the appropriate TCP/IP components are installed, configure the TCP/IP settings in order
to "communicate" with your network.
If you manually assign IP information instead of using dynamic assignment, make sure that
your computers have IP addresses that place them in the same subnet as the ZyXEL Device’s
LAN port.
Windows 95/98/Me
Click Start, Settings, Control Panel and double-click the Network icon to open the Network
window.
P-660HW-Dx v2 User’s Guide
285
Appendix C Setting up Your Computer’s IP Address
Figure 162 WIndows 95/98/Me: Network: Configuration
Installing Components
The Network window Configuration tab displays a list of installed components. You need a
network adapter, the TCP/IP protocol and Client for Microsoft Networks.
If you need the adapter:
1 In the Network window, click Add.
2 Select Adapter and then click Add.
3 Select the manufacturer and model of your network adapter and then click OK.
If you need TCP/IP:
In the Network window, click Add.
Select Protocol and then click Add.
Select Microsoft from the list of manufacturers.
Select TCP/IP from the list of network protocols and then click OK.
If you need Client for Microsoft Networks:
Click Add.
Select Client and then click Add.
Select Microsoft from the list of manufacturers.
Select Client for Microsoft Networks from the list of network clients and then click
OK.
5 Restart your computer so the changes you made take effect.
286
P-660HW-Dx v2 User’s Guide
Appendix C Setting up Your Computer’s IP Address
Configuring
1 In the Network window Configuration tab, select your network adapter's TCP/IP entry
and click Properties
2 Click the IP Address tab.
• If your IP address is dynamic, select Obtain an IP address automatically.
• If you have a static IP address, select Specify an IP address and type your
information into the IP Address and Subnet Mask fields.
Figure 163 Windows 95/98/Me: TCP/IP Properties: IP Address
3 Click the DNS Configuration tab.
• If you do not know your DNS information, select Disable DNS.
• If you know your DNS information, select Enable DNS and type the information in
the fields below (you may not need to fill them all in).
P-660HW-Dx v2 User’s Guide
287
Appendix C Setting up Your Computer’s IP Address
Figure 164 Windows 95/98/Me: TCP/IP Properties: DNS Configuration
4 Click the Gateway tab.
• If you do not know your gateway’s IP address, remove previously installed gateways.
• If you have a gateway IP address, type it in the New gateway field and click Add.
5 Click OK to save and close the TCP/IP Properties window.
6 Click OK to close the Network window. Insert the Windows CD if prompted.
7 Turn on your ZyXEL Device and restart your computer when prompted.
Verifying Settings
1 Click Start and then Run.
2 In the Run window, type "winipcfg" and then click OK to open the IP Configuration
window.
3 Select your network adapter. You should see your computer's IP address, subnet mask
and default gateway.
Windows 2000/NT/XP
The following example figures use the default Windows XP GUI theme.
1 Click start (Start in Windows 2000/NT), Settings, Control Panel.
288
P-660HW-Dx v2 User’s Guide
Appendix C Setting up Your Computer’s IP Address
Figure 165 Windows XP: Start Menu
2 In the Control Panel, double-click Network Connections (Network and Dial-up
Connections in Windows 2000/NT).
Figure 166 Windows XP: Control Panel
3 Right-click Local Area Connection and then click Properties.
P-660HW-Dx v2 User’s Guide
289
Appendix C Setting up Your Computer’s IP Address
Figure 167 Windows XP: Control Panel: Network Connections: Properties
4 Select Internet Protocol (TCP/IP) (under the General tab in Win XP) and then click
Properties.
Figure 168 Windows XP: Local Area Connection Properties
5 The Internet Protocol TCP/IP Properties window opens (the General tab in
Windows XP).
• If you have a dynamic IP address click Obtain an IP address automatically.
• If you have a static IP address click Use the following IP Address and fill in the IP
address, Subnet mask, and Default gateway fields.
• Click Advanced.
290
P-660HW-Dx v2 User’s Guide
Appendix C Setting up Your Computer’s IP Address
Figure 169 Windows XP: Internet Protocol (TCP/IP) Properties
If you do not know your gateway's IP address, remove any previously installed
gateways in the IP Settings tab and click OK.
Do one or more of the following if you want to configure additional IP addresses:
• In the IP Settings tab, in IP addresses, click Add.
• In TCP/IP Address, type an IP address in IP address and a subnet mask in Subnet
mask, and then click Add.
• Repeat the above two steps for each IP address you want to add.
• Configure additional default gateways in the IP Settings tab by clicking Add in
Default gateways.
• In TCP/IP Gateway Address, type the IP address of the default gateway in Gateway.
To manually configure a default metric (the number of transmission hops), clear the
Automatic metric check box and type a metric in Metric.
• Click Add.
• Repeat the previous three steps for each default gateway you want to add.
• Click OK when finished.
P-660HW-Dx v2 User’s Guide
291
Appendix C Setting up Your Computer’s IP Address
Figure 170 Windows XP: Advanced TCP/IP Properties
7 In the Internet Protocol TCP/IP Properties window (the General tab in Windows
XP):
• Click Obtain DNS server address automatically if you do not know your DNS
server IP address(es).
• If you know your DNS server IP address(es), click Use the following DNS server
addresses, and type them in the Preferred DNS server and Alternate DNS server
fields.
If you have previously configured DNS servers, click Advanced and then the DNS
tab to order them.
292
P-660HW-Dx v2 User’s Guide
Appendix C Setting up Your Computer’s IP Address
Figure 171 Windows XP: Internet Protocol (TCP/IP) Properties
8 Click OK to close the Internet Protocol (TCP/IP) Properties window.
9 Click Close (OK in Windows 2000/NT) to close the Local Area Connection
Properties window.
10 Close the Network Connections window (Network and Dial-up Connections in
Windows 2000/NT).
11 Turn on your ZyXEL Device and restart your computer (if prompted).
Verifying Settings
1 Click Start, All Programs, Accessories and then Command Prompt.
2 In the Command Prompt window, type "ipconfig" and then press [ENTER]. You can
also open Network Connections, right-click a network connection, click Status and
then click the Support tab.
Macintosh OS 8/9
1 Click the Apple menu, Control Panel and double-click TCP/IP to open the TCP/IP
Control Panel.
P-660HW-Dx v2 User’s Guide
293
Appendix C Setting up Your Computer’s IP Address
Figure 172 Macintosh OS 8/9: Apple Menu
2 Select Ethernet built-in from the Connect via list.
Figure 173 Macintosh OS 8/9: TCP/IP
3 For dynamically assigned settings, select Using DHCP Server from the Configure: list.
4 For statically assigned settings, do the following:
• From the Configure box, select Manually.
294
P-660HW-Dx v2 User’s Guide
Appendix C Setting up Your Computer’s IP Address
• Type your IP address in the IP Address box.
• Type your subnet mask in the Subnet mask box.
• Type the IP address of your ZyXEL Device in the Router address box.
5 Close the TCP/IP Control Panel.
6 Click Save if prompted, to save changes to your configuration.
7 Turn on your ZyXEL Device and restart your computer (if prompted).
Verifying Settings
Check your TCP/IP properties in the TCP/IP Control Panel window.
Macintosh OS X
1 Click the Apple menu, and click System Preferences to open the System Preferences
window.
Figure 174 Macintosh OS X: Apple Menu
2 Click Network in the icon bar.
• Select Automatic from the Location list.
• Select Built-in Ethernet from the Show list.
• Click the TCP/IP tab.
3 For dynamically assigned settings, select Using DHCP from the Configure list.
P-660HW-Dx v2 User’s Guide
295
Appendix C Setting up Your Computer’s IP Address
Figure 175 Macintosh OS X: Network
4 For statically assigned settings, do the following:
• From the Configure box, select Manually.
• Type your IP address in the IP Address box.
• Type your subnet mask in the Subnet mask box.
• Type the IP address of your ZyXEL Device in the Router address box.
5 Click Apply Now and close the window.
6 Turn on your ZyXEL Device and restart your computer (if prompted).
Verifying Settings
Check your TCP/IP properties in the Network window.
Linux
This section shows you how to configure your computer’s TCP/IP settings in Red Hat Linux
9.0. Procedure, screens and file location may vary depending on your Linux distribution and
release version.
296
P-660HW-Dx v2 User’s Guide
Appendix C Setting up Your Computer’s IP Address
Make sure you are logged in as the root administrator.
Using the K Desktop Environment (KDE)
Follow the steps below to configure your computer IP address using the KDE.
1 Click the Red Hat button (located on the bottom left corner), select System Setting and
click Network.
Figure 176 Red Hat 9.0: KDE: Network Configuration: Devices
2 Double-click on the profile of the network card you wish to configure. The Ethernet
Device General screen displays as shown.
Figure 177 Red Hat 9.0: KDE: Ethernet Device: General
P-660HW-Dx v2 User’s Guide
297
Appendix C Setting up Your Computer’s IP Address
• If you have a dynamic IP address click Automatically obtain IP address settings
with and select dhcp from the drop down list.
• If you have a static IP address click Statically set IP Addresses and fill in the
Address, Subnet mask, and Default Gateway Address fields.
3 Click OK to save the changes and close the Ethernet Device General screen.
4 If you know your DNS server IP address(es), click the DNS tab in the Network
Configuration screen. Enter the DNS server information in the fields provided.
Figure 178 Red Hat 9.0: KDE: Network Configuration: DNS
5 Click the Devices tab.
6 Click the Activate button to apply the changes. The following screen displays. Click Yes
to save the changes in all screens.
Figure 179 Red Hat 9.0: KDE: Network Configuration: Activate
7 After the network card restart process is complete, make sure the Status is Active in the
Network Configuration screen.
Using Configuration Files
Follow the steps below to edit the network configuration files and set your computer IP
address.
1 Assuming that you have only one network card on the computer, locate the ifconfigeth0 configuration file (where eth0 is the name of the Ethernet card). Open the
configuration file with any plain text editor.
• If you have a dynamic IP address, enter dhcp in the BOOTPROTO= field. The following
figure shows an example.
298
P-660HW-Dx v2 User’s Guide
Appendix C Setting up Your Computer’s IP Address
Figure 180 Red Hat 9.0: Dynamic IP Address Setting in ifconfig-eth0
DEVICE=eth0
ONBOOT=yes
BOOTPROTO=dhcp
USERCTL=no
PEERDNS=yes
TYPE=Ethernet
• If you have a static IP address, enter static in the BOOTPROTO= field. Type
IPADDR= followed by the IP address (in dotted decimal notation) and type NETMASK=
followed by the subnet mask. The following example shows an example where the
static IP address is 192.168.1.10 and the subnet mask is 255.255.255.0.
Figure 181 Red Hat 9.0: Static IP Address Setting in ifconfig-eth0
DEVICE=eth0
ONBOOT=yes
BOOTPROTO=static
IPADDR=192.168.1.10
NETMASK=255.255.255.0
USERCTL=no
PEERDNS=yes
TYPE=Ethernet
2 If you know your DNS server IP address(es), enter the DNS server information in the
resolv.conf file in the /etc directory. The following figure shows an example where
two DNS server IP addresses are specified.
Figure 182 Red Hat 9.0: DNS Settings in resolv.conf
nameserver 172.23.5.1
nameserver 172.23.5.2
3 After you edit and save the configuration files, you must restart the network card. Enter
./network restart in the /etc/rc.d/init.d directory. The following figure
shows an example.
Figure 183 Red Hat 9.0: Restart Ethernet Card
[root@localhost init.d]# network restart
Shutting down interface eth0:
Shutting down loopback interface:
Setting network parameters:
Bringing up loopback interface:
Bringing up interface eth0:
P-660HW-Dx v2 User’s Guide
[OK]
[OK]
[OK]
[OK]
[OK]
299
Appendix C Setting up Your Computer’s IP Address
Verifying Settings
Enter ifconfig in a terminal screen to check your TCP/IP properties.
Figure 184 Red Hat 9.0: Checking TCP/IP Properties
[root@localhost]# ifconfig
eth0
Link encap:Ethernet HWaddr 00:50:BA:72:5B:44
inet addr:172.23.19.129 Bcast:172.23.19.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:717 errors:0 dropped:0 overruns:0 frame:0
TX packets:13 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:730412 (713.2 Kb) TX bytes:1570 (1.5 Kb)
Interrupt:10 Base address:0x1000
[root@localhost]#
300
P-660HW-Dx v2 User’s Guide
Source Exif Data: 
File Type                       : PDF
File Type Extension             : pdf
MIME Type                       : application/pdf
PDF Version                     : 1.5
Linearized                      : No
Page Count                      : 100
XMP Toolkit                     : XMP toolkit 2.9.1-13, framework 1.6
About                           : uuid:37fa56cf-cae8-44a0-9882-32e42b19c97f
Modify Date                     : 2007:06:05 09:23:37+08:00
Create Date                     : 2007:06:05 09:23:23+08:00
Metadata Date                   : 2007:06:05 09:23:37+08:00
Document ID                     : uuid:efb08f37-aa69-4b69-9971-0091280eb139
Format                          : application/pdf
Title                           : SMG-700 User’s Guide V1.00 (Nov 2004)
Creator                         : FrameMaker 7.1
Author                          : Cindy Yang
Producer                        : Acrobat Distiller 5.0.5 (Windows)
EXIF Metadata provided by EXIF.tools
FCC ID Filing: I88P660HWDXV2

Navigation menu