MAP-2000 / MAP-2000R MAP-2100

Transcription

1 PLANET Mesh Netwrk MAP-2000 / MAP-2000R MAP-2100 Web Based Management & User Manual Rev 1.0 Page 1 f 80

2 Table f Cntent 1 Intrductin 4 2 Web based management T start the Web based cnfiguratin Web based cnfiguratin menu verview Cnfiguratin Menu Cmmand Menu Inf Links Menu Cnfiguratin Menu Cnfiguratin->System Settings Cnfiguratin->Netwrk->WAN Cnfiguratin->Netwrk->Lcal Netwrk Cnfiguratin->Netwrk->WLAN Cnfiguratin->Netwrk->Nde t Nde Cnfiguratin->Netwrk->Rute Cnfiguratin->Security->MAC Filter Cnfiguratin->Security->Authenticatin Cnfiguratin->Lcal Services->DHCP-Server Cnfiguratin->Lcal Services->Firewall Cnfiguratin->Lcal Services->NAT Cnfiguratin->Lcal Services->VPN Server Cnfiguratin->Lcal Services->NTP-Client Cnfiguratin->Lcal Services->QS Cnfiguratin->Lcal Services->Traffic Shaping Cnfiguratin->System Management->Passwrd Cnfiguratin->System Management->SNMP Cnfiguratin->System Management->Remte-Syslg Cnfiguratin->Lgin Setup->Lgin Parameters Cnfiguratin->Lgin Setup->Radius Cnfiguratin->Lgin Setup->Lcal Users Database Cnfiguratin->Lgin Setup->Custmize Cnfiguratin->Lgin Setup->Webspace Cnfiguratin->Tls->Ping Cnfiguratin->Tls->Dwnlad Cnfiguratin->Tls->Firmware Update Cnfiguratin->Tls->Settings Cmmand Menu Cmmand->Rebt Cmmand->Reset Inf Menu Inf->Status->System Inf->Status->Interfaces Inf->Status->Services Inf->Status->Users Inf->Status->Mbile IP Inf->Tplgy Inf->Rute Inf->Syslg Links 76 3 Lgging in thrugh MESH AP 77 Step 1: User Starts WEB Brwser 77 Page 2 f 80

3 Step 2: Lgin Page Presented t User 77 Step 3: User Supplies Credentials 78 Step 4: User Lgin Success 78 Step 5: Display the Request Hme Page 78 Step 6: User Lgut 79 Page 3 f 80

4 1 Intrductin PLANET Mesh Netwrk features with a Web-based cnfiguratin interface management tl. It prvides an easy access t all cnfiguratin functins. Any cmputer either wired r wireless that establishes a valid cnnectin with the MESH AP can access the web-based cnfiguratin thrugh a web brwser. Fr the first time cnfiguratin, the MESH AP can be cnfigured with a wireless cmputer, equipped with wireless LAN adapter r a PC equipped with wired Ethernet card and crssver Ethernet cable t the MESH AP s Ethernet prt. Fr mre detail, please als refer t the Quick Guide. Fr the wireless cmputer that equipped with b/g wireless LAN adapter, the fllwing settings are required t ensure a successfully cnnectin t the MESH AP. ESSID: PLANET WEP: disabled TCP/IP installed and enable DHCP (Dynamic IP) Fr the cmputer that equipped with wired Ethernet card and crssver cable t the MESH AP s LAN prt. TCP/IP installed and enable DHCP The preset MESH AP administratr lgin user ID and passwrd is admin. After the first time cnfiguratin, the MESH AP can be managed either lcally r remtely. Fr lcal management, cmputer can cnnect t the MESH AP by wireless interfaces t MESH AP wireless interface r wired LAN interface with crssver cable t MESH AP LAN prt. Fr remte management, a VPN cnnectin t MESH AP via the Internet can manage the MESH AP remtely. The fllwing are all MESH AP default settings: Cnfiguratin System System Nde Name: PLANET Cntact Name: Cntact Phne: Cntact Object ID: Netwrk WAN Interface Type: DHCPC Netwrk Enable DNS Client : enabled DNS Client Default Dmain Name : PLANET Bridge IP Address: assigned autmatically Netmask: assigned autmatically WLAN WLAN0 Page 4 f 80

5 SSID: PLANETMeshNet Radi rle: Mesh Rate prfile: Aut Frequency channel : 7 Aut channel selectin: disabled Transmit pwer : Max WLAN1 SSID: PLANET Bradcast SSID: disabled Radi rle: Access Pint Rate prfile: Aut Frequency channel : 1 Aut channel selectin: enabled Transmit pwer : MAX NODE Aut IP cnfiguratin : enabled Traffic encryptin :disabled Enhanced traffic encryptin: disabled Rute Static Ruting: disabled Security MAC Access MAC Access cntrl : disabled Encryptin Encryptin: disabled Authenticatin type: pen Deny nn-encrypted data: disabled Authenticatin Mde: Nne Services DHCP-Server DHCP-Server: enabled Subnet Mask: assigned autmatically Gateway IP Address: assigned autmatically Primary DNS IP Address: assigned autmatically DHCP Dmain : PLANET IP Pl Table: assigned autmatically Firewall Mde: Disabled NAT Mde : Enabled NTP-Client Mde: Disabled QS Mde: Enabled Default Uplad : 256 Default Dwnlad :256 Management Webbased passwrd Username: admin Passwrd: admin Page 5 f 80

6 SNMP Passwrd SNMPv2 Read Passwrd: public SNMPv2 Read/Write Passwrd: private SNMPv3 Read Passwrd: snmpv3ruser SNMPv3 Read/Write Passwrd: snmpv3rwuser SNMPv3 Secret Passwrd: snmpv3passwrd SNMPv3 Secret Passphrase: snmpv3passphrase Remte-Syslg Mde: Disabled Lgin Setup Lgin Require User Lgin: enabled Idle timeut: 300 Lgin methd: http and https Radius NAS-Identifier: PLANET Called-Statin ID: PLANET NAS-Prt :1 NAS-Prt-Type: 19 Primary authenticatin prt :1812 Primary accunting prt :1813 Secndary authenticatin prt:1812 Secndary accunting prt: 1813 Interim-Update Interval:180 Lcal Users N users enrlled Page 6 f 80

7 2 Web based management 2.1 T start the Web based cnfiguratin a. Start the web brwser b. Enter Address f the MESH AP, in the address bx (make sure HTTPS, but nt HTTP) c. Accept the security certificate and click Yes t prceed. d. The Web-based cnfiguratin lgin page pens after the security certificatin has been accepted. e. Enter the user name and passwrd. By default, the user name and passwrd are bth set t admin. Page 7 f 80

8 f. After lgin successfully, the Web-based cnfiguratin main page is pen, which is appealed as belw. Page 8 f 80

9 2.2 Web based cnfiguratin menu verview This sectin gives a brief summary t the menu ptins f the Webbased cnfiguratin Cnfiguratin Menu This menu allws the administratrs t cnfigure the varius MESH AP settings, including netwrk setting, VPN server setting, WLAN interface setting and s n. Cmprise f seven different submenu System Settings Cntains the setting f general inf and peratin mde f the device Cntains ptins t fine tuning the netwrk peratins. Cntains the fllwing submenu: WAN T select and cnfigure the WAN cnnectin interface T specific the basic netwrk cnfiguratin such as hstname, dmain etc. Lcal Netwrk T specific the address f lcal netwrk. WLAN T cnfigure the WLAN interfaces settings such as ESSID, data rate, channel. Nde t nde Rute T cnfigure the nde cnfiguratin such as nde ip. T mdify the netwrk ruting table Security Cntains ptin t cnfigure the type f security Cntains the fllwing submenu: MAC Access T specific the access cntrl rule based n the MAC address Authenticatin T specific the type f authenticatin such as WEP, 802.1x, and i Lcal Service Cntain the ptins t cnfigure the varius netwrk services such as DHCP server, firewall, VPN server, etc Cntains the fllwing submenu: DHCP-Server T cnfigure the MESH AP t act as a DHCP server t the bridge interface T specify fixed IP address Firewall Page 9 f 80

10 T specific the firewall rules and settings t prtect the WAN prt NAT T specific the Netwrk Address Translatin (NAT) rule and let user t define static rutes t make cmputers n the internal netwrk (LAN/WLAN) visible t external cmputers VPN Server T cnfigure VPN server t make remte management available with enhanced security NTP-Client T synchrnize t the specified NTP (Netwrk Time Prtcl) server and let NTP server t cntrl system time Remte-Syslg T track and lg system messages t a remte syslg server QS T priritize packet based n TCP,prt,size f packet Traffic Shaping T cnfigure the uplad and dwnlad bandwidth f the users Mbile IP T cnfigure mbile IP fr the current ndes System Mgmt T manage cnfiguratins and firmware file and cntrl the administratr lgin passwrd Cntains the fllwing submenu Passwrd T change the administratr lgin passwrd SNMP T change the snmp passwrd Syslg Server T cnfigure the remte syslg parameter Lgin Setup Cntains the fllwing submenu: Lgin T specific the lgin methd RADIUS T define the RADIUS client settings that need t lgin t the external RADIUS server Lcal Users Database Custmize Webspace Tls Cntains the fllwing submenu Ping Dwnlad Firmware Update Settings T define the lcal user accunts that allw t access. Page 10 f 80

11 2.2.2 Cmmand Menu This menu allws the administratrs t d certain cmmands such as dwnlad, rebt, reset and help links. Cmprise f tw different submenu Rebt T rebt the MESH AP Reset T restre the default factry setting f MESH AP Inf This menu allws the administratr t view the current status f different cmpnents f the MESH AP. And, t prvide diagnstic tls t investigate the MESH AP behavirs. Cmprise f three different submenu Status T shw the current status f different cmpnent f MESH AP Cntains the fllwing submenu Links Menu System Interfaces Services Users T shw the current system uptime, CPU and memry status T shw the infrmatin f WAN, LAN and WAN physical interfaces T shw the current status f varius services available n the MESH AP T shw the list f nline users and their detail infrmatin that had lgin t the MESH AP successfully Tplgy T prvide a simple tplgy verview f the mesh netwrk. Rute Display the infrmatin f ruting table inside the system Syslg Display the lg messages frm the system This menu prvides the HTML links t the MESH AP main webpage and PLANET hmepage Page 11 f 80

12 2.3 Cnfiguratin Menu This sectin explains the detailed settings and ptins prvided by the Cnfiguratin Menu. Cnfiguratin menu allws the administratrs t cnfigure the varius settings, including netwrk setting, VPN server setting, WLAN interface setting and s n. Cnfiguratin menu cnsists f seven different submenus. They are knwn as system settings, netwrk, security, lcal services, system management, lgin setup and tls. Each submenu has its wn ptins t prvide cmplete cnfiguratin settings. Figure belw shws the main page f the Cnfiguratin Menu Cnfiguratin->System Settings Administratr als can assign name and lcatin t MESH AP fr better management. System parameters: Nde Name T specify the name f the nde Example: PLANET Nde Lcatin T specify the lcatin f the nde Example: Factry 1, Zne A, Ivy rad, Nde Operate Mde Display the peratin mde f current nde Fr MAP-2000 / MAP-2100, Gateway r Relay Fr MAP-2100, nly fixed at Relay mde Cntact Name T specify the name f cntact fr assistant fr the nde Example: Jhn, Tmsn,. Cntact Phne Page 12 f 80

13 T specify the phne number f the cntact persn Cntact T specify the f the supprt persn Example: supprt@abc.cm Object ID Display the bject ID f the system WAN IP Address Display the WAN IP address f the system Bridge IP Address Display the Bridge IP f the system Nde IP Address Display the Nde IP f the system Descriptr T specify the descriptin f the system Cnfiguratin->Netwrk->WAN This submenu defines the cnfiguratin f WAN prt interface. Three ptins are available t cnfigure the WAN prt interface t cnnect t the Internet. They are knwn as DHCPC (Dynamic Hst Cnfiguratin Prtcl client), Static IP and PPPE (Pint t Pint Prtcl ver Ethernet). Netwrk parameters are fr the cnfiguratins f gateway IP, DNS IP. WAN-Interface Parameters: Interface Type->DHCPC The ISP s DHCP server autmatic assigns an IP address t the WAN interface. T select DHCP client ptin, click the DHCPC radi buttn Click Cnfigure Details and Save buttn t cnfigure that ptin Page 13 f 80

14 Interface Type->Static IP T manually assign a fixed IP address t the WAN interface T select the Static IP ptin, click the Static IP radi buttn Click Cnfigure Details and Save buttn t cnfigure that ptin Static IP Parameters: IP T specific the IP address f the WAN-interface Netmask T specific the netwrk mask f the static IP address Click Save Cnfig t save the cnfiguratin changed Interface Type->PPPE ISP assigns a valid IP address t the WAN interface after MESH AP lgn t the ISP s PPPE with supplied valid username and passwrd. T enhance t netwrk security, MESH AP supprts server side authenticatin feature. PPPE server needs t supply valid username and passwrd t authenticate itself. Only CHAP (Challenge Handshake Authenticatin Prtcl) is supprted fr this feature. Tw authenticatin types are supprted in the PPPE mde, i.e. PAP (Passwrd Authenticatin Prtcl) and CHAP (Challenge Handshake Authenticatin Prtcl). Only CHAP (Challenge Handshake Authenticatin Prtcl) is supprted in the Server Side Authenticatin feature. T select the PPPE ptin, click the PPPE radi buttn Click APPLY buttn t cnfigure that ptin Page 14 f 80

15 PPP ver Ethernet Parameters: Authenticatin Authenticatin type T select the PPPE authenticatin type, either CHAP (Challenge Handshake Authenticatin Prtcl) r PAP (Plain Text Authenticatin Prtcl ) Username T specify the PPPE lgn user name Passwrd T specify the PPPE lgn passwrd Server-side Authenticatin ( CHAP-Only ) Enable server-side authenticatin T enable r disable this ptin Servers username T specify the server username Servers passwrd T specify the server passwrd Click Apply t save the cnfiguratin changed Netwrk Parameters: Gateway IP Address Specify the IP address f the default gateway Enable DNS Client Enable r disable the DNS Client Primary DNS Server IP Address Specify the IP address f primary dmain name server Example: Secndary DNS Server IP Address Specify the IP address f secndary dmain name server Example: DNS Client Default Dmain Name Specify the dmain name f the MESH AP Default value: PLANET Page 15 f 80

16 Click APPLY t save the cnfiguratin changed Cnfiguratin->Netwrk->Lcal Netwrk This submenu defines the IP cnfiguratin f bridge interface. MESH AP acts a bridge between wired LAN and wireless LAN. The LAN prt interface shares the same IP address range with the wireless LAN interfaces. A static IP address is required n this prt, because MESH AP cannt functin as a DHCP client n its LAN prt interface. The LAN prt (fr mdel MAP-2000R and MAP-2100) is used t cnnect the wired cmputers t the public access netwrk via the LAN prt interface. Be reminded, fr MAP-2000, the lcal netwrk setting is fr Wireless AP serviced netwrk subnet nly. Lcal Netwrk Parameters: IP Address T specify the IP address n the bridge interface Example: Subnet Mask T specify the netwrk mask Example: Click Apply t save the cnfiguratin changed Cnfiguratin->Netwrk->WLAN This submenu defines the cnfiguratins t the tw wireless LAN interfaces embedded in the MESH AP. The WLAN LAN devices settings include the WLAN netwrk settings such as ESSID (Extended Service Set Identifier), data rates. ESSID is the unique netwrk name t identify the WLAN netwrk. The data rate specifies the maximum data transfer in the WLAN netwrk. Page 16 f 80

17 Wireless LAN Devices Parameters: Wireless LAN Devices List dwn detected WLAN devices WLAN devices are distinguished by MAC and Type Select ne f the device t cnfigure the parameters. Radi 1 ( Mesh Backhaul Radi ) Parameters: MAC Address Display the MAC address f the devices Service Set ID Page 17 f 80

18 T specify the service set ID f the netwrk Default value: PLANETMeshNet Rle in Radi Netwrk Display the rle f radi Data Rate Prfile T cnfigure the date rate f this device Frequency Channel T cnfigure the channel f this device Default value: 7 Enable Aut Channel Select T enable the aut channel selectin mechanism Default value: disabled Transmit Pwer T specify the transmit pwer Default value: MAX Receive Antenna T specify the diversity f the antenna Default value: diversity Transmit Antenna T specify the diversity f the antenna Default value: diversity Cuntry T specify the regulatry dmain f the radi Nte: This value als will apply t Radi 2. Click Apply t save cnfiguratin changed Wireless-Interface(Radi 2) Parameters: MAC Address Display the MAC address f the devices Service Set ID T specify the service set ID f the netwrk Page 18 f 80

19 Default value: PLANET Enable Bradcast SSID T enable r disable the bradcast SSID f the device Rle in Radi Netwrk Display the rle in radi netwrk Data Rate Prfile T cnfigure the date rate f this device Frequency Channel T cnfigure the channel f this device Default value: 1 Enable Aut Channel Select T enable the aut channel selectin mechanism Default value: enabled Transmit Pwer T specify the transmit pwer Default value: MAX Receive Antenna T specify the diversity f the antenna Default value: diversity Transmit Antenna T specify the diversity f the antenna Default value: diversity Click APPLY t save cnfiguratin changed Cnfiguratin->Netwrk->Nde t Nde Nde Parameters: Nde Name Display the name f the nde Page 19 f 80

20 Enable Autmatic IP Cnfiguratin T enable r disable the autmatic IP cnfiguratin t MESH AP. This ptin will assign an IP address autmatically based n the MAC address f the WAN devices. The assigned IP range is as fllw: /12 reserved fr Bridge device MESH AP s bridge will be assigned 172.X.Y.1 MESH AP s client will be assigned frm 172.X.Y.2 t 172.X.Y.254 X & Y wuld be deduced frm the WAN devices /8 reserved fr Nde IP MESH AP s nde will be assigned 10.X.Y.1 MESH AP s vpn server will be assigned 10.X.Y.254 MESH AP s vpn client will be assigned frm 10.X.Y.2 t 10.X.Y.12 Example: With deduced X=9 and Y=100 (frm WAN MAC: 09h-64h), then MESH AP s nde IP will be assigned with , the VPN server will be assigned with , the VPN client will be assigned frm t Fr the bridge, it will use , and the MESH AP s client will be assigned with IP address ranging frm t by MESH AP s DHCP server Default value: enabled IP Address T specify the IP address f the nde Example: ; deduce frm the WAN MAC address. Subnet Mask T specify the netwrk mask f the nde Example: Enable Nde Traffic Encryptin T enable r disable nde traffic encryptin 128bit Encryptin key T specify the encryptin key f nde traffic in HEX value ( 0-9, A-F ) Example: abcdef abcdef Enable Enhanced Traffic Encryptin T enable r disable enhanced traffic encryptin 128bit AES Encryptin Key T specify the 128bit AES encryptin key in HEX value ( 0-9, A-F ) Example: abcdef fedcba Click Apply t save cnfiguratin changed Click Nde MAC Filtering t trigger the screen sht as belw t set a list f MAC address that needed t be blcked frm the current netwrk. Click Add t add new entry, Edit t edit selected entry Page 20 f 80

21 Nde MAC filter parameter MAC Address T specify the MAC address t be filtered ut frm the netwrk Cmment T specify cmments abut the entry Status T enable r disable the current entry Page 21 f 80

22 2.3.6 Cnfiguratin->Netwrk->Rute This submenu defines the static rute t direct the traffic t the apprpriate destinatin. Static Ruting Parameters: Enable Static Ruting T enable r disable the static ruting ptin Ruting Table T list the current ruting table Click Apply t save cnfiguratin changed Click Add t add new rule t the Ruting Table Click Edit t edit the selected rule Page 22 f 80

23 This Static ruting rules will be available after either Add r Edit buttn is pressed. Static Ruting Rules Parameters: Subnet T specify the IP subnet t be ruted Example: Netmask T specify the netwrk mask value f the IP subnet Example: Gateway T specify the gateway fr the specified rute Example: Device T specify the interfaces fr the specified rute Example: WAN Rute Using T specify the rute using device r gateway Example: Gateway Cmment T specify the cmment fr the specified rute Status T enable r disable the specified rute Click Apply t save the cnfiguratin Click back t g back t Cnfiguratin->Netwrk->Rute Cnfiguratin->Security->MAC Filter This submenu enable the MESH AP t cntrl the access frm the client based n the MAC address. Page 23 f 80

24 MAC Access Parameters: Enable MAC Access Cntrl T enable r disable MAC access cntrl Operatin Type T specify the type f peratin f the cntrl, ie blck r pass-thrugh MAC Access Cntrl Table List the MAC address cnfigured Click APPLY t save the cnfiguratin changed Click Add t add new entry Click Edit t edit the selected entry The MAC access cntrl entry will be available after Add r Edit buttn is pressed. Page 24 f 80

25 MAC Access Cntrl entry Parameters: MAC Address T specify the MAC address f the entry Example: 00:30:4f:08:6A:37 Cmment T specify the cmment fr the entry Status T enable r disable the entry Page 25 f 80

26 2.3.8 Cnfiguratin->Security->Authenticatin This submenu cnfigure the authenticatin methd t ff, WEP/802.11x, r WPA/802.11i. This security ptin prvide mre rbustness in netwrk security. Authenticatin Parameters: T cnfigure WPA/802.11i, click n the radi buttn f the WPA/802.11i Page 26 f 80

27 WPA/802.11i WPA/802.11i parameters: WPA PSK T specify the authenticatin mde t WPA Pre Shared Key WPA EAP ( RADIUS ) T specify the authenticatin mde WPA EAP, an external radius server is needed fr this type f authenticatin TKIP T specify the encryptin cipher t Tempral Key Integrity Prtcl (TKIP) AES T specify the encryptin cipher t Advanced Encryptin Standard ( AES ) Available authenticatin mde are WPA PSK with TKIP, WPA PSK with AES, WPA EAP with TKIP, WPA EAP with AES Click Save Cnfig t save cnfiguratin changed. Page 27 f 80

28 WEP/802.1x WEP/802.1x Parameters: 802.1x assignment f 128 bit key T specify the authenticatin mde t 802.1x 128bit 802.1x assignment f 64 bit key T specify the authenticatin mde t 802.1x 64bit 128 bit T specify the authenticatin mde t WEP 128bit Example: abcdef bit T specify the authenticatin mde t WEP 64bit Example: Select ne f the radi buttn t enable the authenticatin type. Click Save Cnfig t save cnfiguratin changed. Page 28 f 80

29 Off Off Parameters: Encryptin OFF T disable encryptin and authenticatin Click Encryptin OFF buttn t disable encryptin and authenticatin. Page 29 f 80

30 2.3.9 Cnfiguratin->Lcal Services->DHCP-Server MESH AP acts as a DHCP server by default. This means it will assign IP address t client statins n Wireless and Wired netwrk (except mdel: MAP-2000), up t 254 clients is supprted in each nde. DHCP Server Parameters: Enable DHCP Server T enable r disable the DCHP Server Default value: enabled Subnet Mask T specify the netwrk mask f the DHCP server Example: Gateway IP Address T specify the default gateway fr ruting Example: Primary DNS IP Address T specify DNS server t be used Example: Secndary DNS IP Address T specify secndary DNS server t be used DHCP Dmain T specify the dmain name fr the DHCP clients Example: PLANET IP Pl Table A list f tables that display the IP assignment Page 30 f 80

31 DHCP IP Pl Parameters: Start IP Address T specify the start IP f the IP pl table Example: End IP Address T specify the end IP f the IP pl table Example: Default Lease T specify the lease time t be assigned t the client statins Example: 3600 Maximum Lease T specify the maximum least time t be assigned t the client statins Example: Cmment T specify the cmments f the current entry f the table Status T enable r disable the current entry f the table DHCP Fixed Addresses Parameters: Fix this Hardware address Page 31 f 80

32 Fix the Hardware address t a fixed IP T this IP Fix the Hardware address t this IP Cmment Optinal cmments fr this entry Status Enable r disable this entry Cnfiguratin->Lcal Services->Firewall T safeguard MESH AP frm any intruders, MESH AP features a custmizable firewall. The firewall stps and blcks any unauthrized user access frm the WAN prt. It used t cntrl bth incming and utging data. T custmize the firewall, the rules need t be specified. MESH AP mnitrs the IP datagram that travel in and ut, analyzes the packet based n the firewall rules, and decides whether t accept r deny that packet. Firewall rules apply t bth wired and wireless LAN netwrk interfaces. Firewall Parameters: Enable Firewall T enable r disable the firewall Default Plicy Set the default plicy fr the firewall rule Select Optin: Accept r Deny Default value: Accept Existing Rules Display the current firewall rules Click Add buttn t add new rules. Click Edit buttn t edit the selected rule. Page 32 f 80

33 Firewall Rules Parameters: Rule Number T specify the rule number f this entry Surce Hst Page 33 f 80

34 T specify the hstname in FQDN frm r IP address as the surce address Subnet Netwrk T specify the netwrk IP address as the surce address Example: Netmask T specify the netwrk mask Example: Destinatin Hst T specify the hstname in FQDN frm r IP address as the surce address Subnet Netwrk T specify the netwrk IP address as the destinatin address Example: Netmask T specify the netwrk mask Example: Surce Interface T specify the interface as the surce interface Optin: Any, WLAN/LAN, WAN, LINK Destinatin Interface T specify the interface as the destinatin interface Optin: Any, WLAN/LAN, WAN, LINK Prtcl T specify the prtcl f the rule t check Optin Any Rules apply t any prtcl TCP Rules apply t TCP prtcl Specify an unique prt r a range f prt numbers UDP Rules apply t UDP prtcl Specify an unique prt r a range f prt numbers ICMP Rules apply t ICMP prtcl Specify the ICMP type GRE Rules apply t GRE prtcl By number # Rules apply t specified prt number such as ICQ defined prt Limits traffic Matching rule t limit the traffic fr certain applicatin Mre than #packet per minute Example: Rule: 5 packet per minute, and allw FTP packets. This means this rule is applied nly when the number 6 FTP packet is received fr that minute Target T set the plicy t the target rule Optin: Deny, Accept, Free Deny: T reject the packet that match the rule Page 34 f 80

35 Accept: T accept the packet that match the rule Free: T prvide the free access t that particular rule Cmments T specify the cmments f the rule Status Enable r disable this rule Page 35 f 80

36 Cnfiguratin->Lcal Services->NAT NAT (Netwrk Address Translatin) is the translatin f an Internet Prtcl address (IP address) used within ne netwrk t a different IP address knwn within anther netwrk. One netwrk is designated the inside netwrk and the ther is the utside. Typically, a cmpany maps its lcal inside netwrk addresses t ne r mre glbal utside IP addresses and unmaps the glbal IP addresses n incming packets back int lcal IP addresses. This helps ensure security since each utging r incming request must g thrugh a translatin prcess that als ffers the pprtunity t qualify r authenticate the request r match it t a previus request. NAT als cnserves n the number f glbal IP addresses that a cmpany needs and it lets the cmpany use a single IP address in its cmmunicatin with the wrld. NAT is included as part f a ruter and is ften part f a crprate firewall. Netwrk administratrs create a NAT table that des the glbal-t-lcal and lcal-t-glbal IP address mapping. NAT can als be used in cnjunctin with plicy ruting. NAT can be statically defined r it can be set up t dynamically translate frm and t a pl f IP addresses. MESH AP f NAT lets an administratr create tables that map: A lcal IP address t ne glbal IP address statically A lcal IP address t any f a rtating pl f glbal IP addresses that a cmpany may have A lcal IP address plus a particular TCP prt t a glbal IP address r ne in a pl f them A glbal IP address t any f a pl f lcal IP addresses n a rund-rbin basis NAT Parameters: Enable NAT T enable r disable the NAT service NAT Table A list f existing NAT rules Click Apply t save cnfiguratin changed Click Add t add new entry t the NAT table Page 36 f 80

37 Click Edit t edit selected entry NAT List Parameters: Prt T specify the prt f the entry Example: 23 ( telnet ) Prtcl T specify the prtcl f the entry Optin: TCP, UDP IP T specify the IP f the entry Example: Cmment T specify ptinal cmment fr this entry Status Enable r disable this entry Example: Frward prt 23 telnet traffic t hst by entering 23 t prt, tcp prtcl, and t the IP Click Apply t save the cnfiguratin changed. Page 37 f 80

38 Cnfiguratin->Lcal Services->VPN Server This submenu defines the cnfiguratins f built-in virtual private netwrk ( VPN ) cnnectin frm a remte netwrk. The traffic in the VPN tunnels is encrypted and prtected against eavesdrpping. Authenticatin and management traffic can be prtected thrugh the PPTP tunnel. VPN Server Parameters: Enable VPN Server T enable r disable the VPN Server service Example: enabled Click Apply t save cnfiguratin changed In VPN User List, click Add t add new entry, click Edit t edit selected entry User List Parameters Username T specify the username f a VPN user Passwrd T specify the passwrd f the VPN user Assign IP T specify the IP assigned t this VPN user Cmment T specify ptinal cmments n this entry Status Enable r disable this entry Cnfiguratin->Lcal Services->NTP-Client Netwrk Time Prtcl (NTP) is a prtcl that is used t synchrnize cmputer clck times in a netwrk f cmputers. Develped by David Mills at the University f Delaware, NTP is nw an Internet standard. In cmmn with similar prtcls, NTP uses Crdinated Universal Time (UTC) t synchrnize cmputer clck times t a millisecnd, and smetimes t a fractin f a millisecnd. Page 38 f 80

39 The term NTP applies t bth the prtcl and the client/server prgrams that run n cmputers. MESH AP acts as the NTP client that initiates a time request exchange with the time server. As a result f this exchange, the client is able t calculate the link delay, its lcal ffset, and adjust its lcal clck t match the clck at the server's cmputer. NTP Client Parameters: Enable NTP T enable r disable the NTP client service Server 1 T specify the IP f the NTP server Example: pl.ntp.rg Server 2 T specify the IP f the NTP server Server 3 T speciry the IP f the NTP server Timezne T specify the timezne Click Apply t save the cnfiguratin changed Page 39 f 80

40 Cnfiguratin->Lcal Services->QS This submenu defines the parameters f the QS within MESH AP. QOS parameters: Enable QOS T enable r disable the QOS setting Click Add t add new entry t the QS table Click Edit t edit the selected entry QS list parameters: Prtcl T specify the prtcl f this entry Prt T specify the prt f this entry Packet size T specify the size f the packet f this entry Pririty T priritize this entry Cmment T specify ptinal cmment n this entry Status Enable r disable this entry Page 40 f 80

41 Cnfiguratin->Lcal Services->Traffic Shaping This submenu defines the parameters f the traffic shaping within MESH AP. Traffic is very imprtant t limit certain user nt t use mre than assigned bandwidth. QS Parameters: Enable QS T enable r disable the QS service Default Uplad T specify the default uplad bandwidth in kbps per user basis Example: 256 Default Dwnlad T specify the default dwnlad bandwidth in kbps per user basis Example: 256 Click Apply t save cnfiguratin changed. Page 41 f 80

42 Cnfiguratin->System Management->Passwrd This submenu allws user t change the administratr lgin passwrd. Passwrd Parameters: New Passwrd T specify the new web-based cnfiguratin passwrd New Passwrd T specify the entered new passwrd again fr verificatin purpse Click Apply t save cnfiguratin changed. Page 42 f 80

43 Cnfiguratin->System Management->SNMP SNMP Passwrd Parameters: SNMP Versin T specify the versin f the SNMP SNMP v2 Read Passwrd T specify the SNMP-v2 read passwrd SNMP v2 Read/Write Passwrd T specify the SNMP-v2 read/write passwrd SNMP v3 Read Passwrd T specify the SNMP-v3 read passwrd SNMP v3 Read/Write Passwrd T specify the SNMP-v3 read/write passwrd SNMP v3 Secret Passwrd T specify the SNMP-v3 secret passwrd SNMP v3 Secret Passphrase T specify the SNMP-v3 secret passphrase Access cntrl Frm WAN T allw access frm WAN interface Frm LAN/WLAN T allw access frm LAN/WLAN interface Frm VPN T allw access frm VPN interface Page 43 f 80

44 Frm Mesh T allw access frm mesh netwrk SNMP Trap Enable SNMP Trap Enable r disable the SNMP trap Trap Cmmunity T specify cmmunity fr the SNMP trap Destinatin T specify the destinatin f the trap Authenticatin failures Enable r disable if authenticatin failures Click Apply t save cnfiguratin changed Cnfiguratin->System Management->Remte-Syslg The capability f remte lgging is critical t the functinality f the MESH AP. With remte lgging, remte syslg server can mnitr all traffic cming thrugh the firewall, any system changes, and even system infrmatin frm the MESH AP. The remte system lgger review the lg files frm the MESH AP and decide what t d when specific events ccur. Remte-Syslg Parameters: Remte Server T specify the IP address f the remte syslg server. Click Save Cnfig t save cnfiguratin changed Cnfiguratin->Lgin Setup->Lgin Parameters This submenu cntains the lgin parameters t the external RADIUS server cnnectin. Page 44 f 80

45 Click Cnfigure Details and Apply fr mre cnfigurable parameters as belw: Lgin Parameters: Require User Lgin T enable r disable the MESH AP Lgin service External Lgin Server T specify the URL fr the external lgin server Leave empty t disable this feature Idle-Timeuts T specify idle-timeuts in secnds Value entered will be verride by RADIUS server Default value: 5 minutes Aut-Relgin after idle lgut Click t enable the aut-relgin after idle timeut Sessin-Timeut T specify sessin-timeut in secnds Value entered will be verride by RADIUS server Default value: 0 minutes HTTPS allwed T enable r disable the lgin thrugh https HTTP allwed T enable r disable the lgin thrugh http Click Apply t save cnfiguratin changed Click Use Default t use the default value Page 45 f 80

46 Using the External Lgin Server MESH AP prvides an ptin that allws administratr t redirect users t a remte server t lg in t the public access interface instead f using the internal lgin page. The advantages f using the external lgin server are listed as fllw: The lgin page is cmpletely custmizable and centralized lcated at the web server. Users can lgin t the public access interface withut expsing their web brwsers t the SSL certificate n the MESH AP. Warning messages caused by having an SSL certificate n the MESH AP that is nt signed by a well-knwn certificate authrity is eliminated. Only a single SSL certificate signed by a well-knwn certificate authrity is required fr the remte web server. There is n need t btain the SSL certificate fr every MESH AP. External Lgin culd be used, fr example t deply a centralized lgin prtal. Fllwing diagram shws the sequence f the lgin prcess when a client start access internet using MESH AP Access Pint. Figure. External Lgin Prcess Cnfiguring the MESH AP Lgin t the access pint cnfiguratins, under Lgin Setup->User Lgin Parameters, enter the External Lgin URL (e.g. There are several macrs available in rder t retrieve infrmatin frm the access pint. Macr ##CLIENT_IP## ##REQUESTED_URL## Descriptin The IP address f the lgin client Original URL n which the client is requesting. Page 46 f 80

47 ##GATEWAY_LOGIN## The Access Pint s external lgin gateway. ( Where <accesspint-dmain> is the Cmmn Name (CN) fund in the Webserver Certificates. <https_prt> is the cnfigured Secure lgin prt ##EXT_IP## Return the WAN IP address f the access pint ##NAS_ID## Return the NAS Identifier f the access pint ##DOMAIN## Return the hstname (CN in the certificates) ##PORT_HTTPS## Return the secure lgin prt f the access pint Table Defined Macrs in the external lgin URL Nte that, the external server hstname must be able t reslve by the Access Pint fr prper Access Cntrl Setup. (This culd be verified using the Tls->Ping page in the web based cnfiguratins page). Access Cntrl t the external server is autmatically dne during startup r after cnfigured the new server address. Thus, if the external server is using dynamic IP address, the Access Cntrl will becme invalid after the address has changed Gateway Lgin URL This is the gateway between the external server and the access pint s radius client. External server will have t send back the USERNAME, PASSWORD, CLIENT_IP infrmatin t the access pint. All infrmatin shuld be encded accrding t the RFC 1738 specificatin. E.g. fr the username Dnald Duck, the POST shuld cntain USERNAME=Dnald%20Duck Gateway Lgut URL External server culd, frcing a lgged-in statin t lgut using the lgut URL. ip address> Lgin Reply After prcessing the authenticatin request, the Access Pint will reply the External Server with the fllwing cntents: Lgin Success <HTML> <!-- <?xml versin= 1.0 encding= UTF-8?> <WISPAccessGatewayParam Page 47 f 80

48 xmlns:xsi= xsi:nnamespaceschemalcatin= > <AuthenticatinReply> <MessageType>120</MessageType> <RespnseCde>50</RespnseCde> <ReplyMessage> radius reply message </ReplyMessage> </AuthenticatinReply> </WISPAccessGatewayParam> --> <!-- <LOGIN>SUCCESS</LOGIN> <REQUESTED_URL>Original Requested URL </REQUESTED_URL> <SERVER_NAME>Access Pint Hstname </SERVER_NAME> <INTERNAL_WEBSPACE_URL>Access Pint Internal Webspace URL </INTERNAL_WEBSPACE_URL> <USER_STATUS_URL>Access Pint Internal url t check user status </USER_STATUS_URL> <USER_IP>client IP address </USER_IP> <USER_MAC>client machine MAC address </USER_MAC> <USER_LOGINNAME>lgin name </USER_LOGINNAME> <USER_AUTH_MODE>authenticatin mde </USER_AUTH_MODE> <USER_AUTH_MSG>radius reply message </USER_AUTH_MSG> <USER_IDLE_TIMEOUT>user idle timeut </USER_IDLE_TIMEOUT> <USER_SESSION_TIMEOUT>user sessin timeut</user_session_timeout> <USER_CUSTOM>radius custm reply attributes</user_custom> <LOGIN_DNS_KEYWORDS>dns shrtcut t the access pint lgut url</login_dns_keywords> --> <bdy>login SUCCESS</bdy> </html> Already Lgged In <HTML> <!-- <?xml versin= 1.0 encding= UTF-8?> <WISPAccessGatewayParam xmlns:xsi= xsi:nnamespaceschemalcatin= > <AuthenticatinReply> <MessageType>120</MessageType> <RespnseCde>100</RespnseCde> <ReplyMessage> radius reply message </ReplyMessage> </AuthenticatinReply> </WISPAccessGatewayParam> --> <!-- <LOGIN>ERROR</LOGIN> <USER_STATUS_URL>Access Pint Internal url t check user status </USER_STATUS_URL> <USER_IP>client IP address </USER_IP> <USER_MAC>client machine MAC address </USER_MAC> <USER_LOGINNAME>lgin name </USER_LOGINNAME> <USER_AUTH_MODE>authenticatin mde </USER_AUTH_MODE> <USER_AUTH_MSG>radius reply message </USER_AUTH_MSG> <USER_IDLE_TIMEOUT>user idle timeut </USER_IDLE_TIMEOUT> <USER_SESSION_TIMEOUT>user sessin timeut</user_session_timeout> <USER_CUSTOM>radius custm reply attributes</user_custom> <LOGIN_DNS_KEYWORDS>dns shrtcut t the access pint lgut url</login_dns_keywords> --> <bdy>already LOGGED IN</bdy> </html> Page 48 f 80

49 Lgin Denied <HTML> <!-- <?xml versin= 1.0 encding= UTF-8?> <WISPAccessGatewayParam xmlns:xsi= xsi:nnamespaceschemalcatin= > <AuthenticatinReply> <MessageType>120</MessageType> <RespnseCde>100</RespnseCde> <ReplyMessage> radius reply message </ReplyMessage> </AuthenticatinReply> </WISPAccessGatewayParam> --> <!-- <LOGIN>ERROR</LOGIN> <REQUESTED_URL> Original Requested URL </REQUESTED_URL> <SERVER_NAME> Access Pint Hstname </SERVER_NAME> <USER_LOGINNAME> lgin name </USER_LOGINNAME> <USER_AUTH_MSG> radius reply message </USER_AUTH_MSG> --> <bdy>login DENIED</bdy> </html> Certificates and hstname The Access Pint will use the subject CN field in the installed certificates as its default hstname (prvided the CN field cntains a valid hstname, nly [.-a-za-z] character is allwed). AP returns the hstname as GATEWAY_LOGIN URL by default. External server culd use the ##EXT_IP## r using the REMOTE_ADDR variable frm the HTTP server, t btain the AP IP address, if the hstname is nt a knwn t the server Cnfiguratin->Lgin Setup->Radius Remte Authenticatin Dial-In User Service (RADIUS) is a client/server prtcl and sftware that enables remte access servers t cmmunicate with a central server t authenticate dial-in users and authrize their access t the requested system r service. RADIUS allws a cmpany t maintain user prfiles in a central database that all remte servers can share. It prvides better security, allwing a cmpany t set up a plicy that can be applied at a single administered netwrk pint. Having a central service als means that it's easier t track usage fr billing and fr keeping netwrk statistics. Created by Livingstn (nw wned by Lucent), RADIUS is a de fact industry standard used by a number f netwrk prduct cmpanies and is a prpsed IETF standard. This submenu cntains all ptins t define the settings that MESH AP need t cmmunicate t the external RADIUS server. It cntains lgin, RADIUS, and lcal users. The fllwing sectins explain the cnfiguratin parameters in detail. Page 49 f 80

50 Radius-Client Parameters: Server Primary RADIUS-Server T specify the IP address f the primary RADIUS server Example: Secret T specify the lgin passwrd f the primary RADIUS server Example: secretpasswrd Authenticatin Prt T specify the authenticatin prt fr the primary RADIUS server Default value: 1812 Accunting Prt T specify the accunting prt fr the primary RADIUS server Default value: 1813 Backup RADIUS-Server T specify the IP address f the secndary RADIUS server Secret T specify the lgin passwrd f the secndary RADIUS server Authenticatin Prt T specify the authenticatin prt fr the secndary RADIUS server Accunting Prt T specify the accunting prt fr the secndary RADIUS server Attributes. NAS-Identifier T specify the Netwrk Access Server ( NAS ) identifier fr the MESH AP. This ID attribute is included in all packets that send t RADIUS server. Called-Statin-Id T specify the MESH AP RADIUS client ID NAS-Prt Page 50 f 80

51 T specify the NAS prt number fr authenticatin NAS-Prt-Type T specify the type f NAS prt Interim-Update interval T specify the interval f updates t RADIUS server Cnfiguratin->Lgin Setup->Lcal Users Database Lcal Users Database List f Users T display current lcal users Click Delete t remve a lcal accunt Click Change Passwrd t change the passwrd f that accunt Add new User Page 51 f 80

52 Username T specify the new lcal user lgin name Passwrd T specify the new lcal user lgin passwrd Passwrd(repeat) T specify the new lcal user lgin passwrd again fr verificatin Click Add new User t add the new lcal user Cnfiguratin->Lgin Setup->Custmize The lgin page can be custmized t serve the administratr requirements. The administratr can uplad his r her wn web design t the MESH AP. Figure belw shws the lgin sequence. After a successful lgin, the user is identified and his r her preference language is knwn if the RADIUS server has sent that ptin. Therefre, the welcme and lgut page can be adjusted accrding t the language. Lgin.html Welcme Page (Lgin_success.html) Deny Page (Lgin_Denied.html) Lgut Page (Lgut.html) This submenu cntains the cnfiguratins fr administratr t custmize his r her lgin, welcme, deny, and lgut pages. MESH AP uses English as default preference language. Administratr can als custmize his r her preference language. Page 52 f 80

53 Custmizable lgin Parameters Existing Files T display the available current language and custmized pages f MESH AP Cmmn Cntains the custmized language independent web page such as lgin.html & lgin_denied.html Click the link t access the cmmn flder English Cntain the language dependent webpage such as lgin_success.html & lgut.html Click the link t access the language flder Uplad Files T uplad the custmized web pages t the MESH AP Add Language T add in a new language Enter the language name and click the Add buttn. Default Language The default language is preset t English Cmmn Optin Page 53 f 80

54 Existing files Shw the existing cmmn flder web pages T uplad a new custmized page, click Delete buttn t remve the existing custmized page and uplad the new file. Click back t link back t custmizable lgin main page Uplad Files T uplad the custmized web pages t the MESH AP Add Language T add in a new language Enter the language name and click the Add buttn. Default Language The default language is preset t English Language Optin e.g. English Page 54 f 80

55 Language Cmmn Flder Parameters Existing files Shw the existing cmmn flder web pages T uplad a new custmized page, click Delete buttn t remve the existing custmized page and uplad the new file. Click back t link back t custmizable lgin main page Uplad Files T uplad the custmized web pages t the MESH AP Add Language T add in a new language Enter the language name and click the Add buttn. Default Language The default language is preset t English Descriptin f RADIUS-Client Several parameters are transmitted frm and t the RADIUS-Server, t allw centralized lgging and cnfiguratin n a per-user base. The fllwing data is exchanged with the RADIUS. Attributes starting with PLANET are vendr attributes with the vendr ID (ID will change). RADIUS-Attribute User-Name User-Passwrd Descriptin Lgin name Lgin Passwrd Table 1 Attributes send t the RADIUS during Lgin (authenticatin) RADIUS-Attribute Reply-Message Idle-Timeut Sessin-Timeut lgin-language Descriptin Message t display t the user. Can be accessed by the lgin macr ##USER_AUTH_MSG##. Idle timeut in secnds Sessin timeut in secnds Preferred language f the user. Attribute type 1. Accessible by the macr ##USER_LANGUAGE##. The string can cntain nly the characters [a-za-z0-9]. Page 55 f 80

56 RADIUS-Attribute lgin-url lgin-custm Descriptin The URL, the user shuld be redirected after successful lgin. Attribute type 2. Accessible by the macr ##USER_STARTPAGE##. Full freely cusumizable infrmatin, which can be send t by the RADIUS. An example fr the usage can be t prvide accunt infrmatin, lcal news, etc. It is als pssible t pass multiple arguments in ne string and separate them using Java script. The Attribute type is 200 and it is accessible via the macr ##USER_CUSTOM##. Table 2 Attributes accepted frm the RADIUS during Lgin (authenticatin) RADIUS-Attribute User-Name Acct-Status-Type Descriptin Lgin name Value='Start'. Indicates start f Sessin t the RADIUS Table 3 Attributes send t the RADIUS during Lgin (accunting) RADIUS-Attribute <nne> Descriptin Table 4 Attributes accepted frm the RADIUS during Lgin (accunting) RADIUS-Attribute User-Name Acct-Status-Type Acct-Input-Octets Acct-Output-Octets Acct-Input-Packets Acct-Output-Packets Acct-Sessin-Time Descriptin Lgin name Value='Stp'. Indicates stp f sessin The number f bytes received by the user The number f bytes transmitted by the user The number f packets received by the user The number f packets transmitted by the user The time in secnds frm lgging in until the last time a transmissin was detected. Table 5 Attributes accepted frm the RADIUS during Lgut (accunting) Custmizable Lgin The lgin page can be custmized t serve the custmers requirements. The custmer can uplad his wn web design t the htspt AP. Page 56 f 80

57 Figure Lgin Sequence Figure abve shws the lgin sequence. It cnsists f system fixed parts, which cannt be mdified by the user and parts t be custmized. After a successful lgin, the user is identified and his preferred language is knwn if it has been sent by the RADIUS server. Therefre the welcme and lgut page can be adjusted accrding t the language. The files can be upladed t the htspt AP and are sharing the flash space with the Web-based cnfiguratin. All kinds f files can be upladed, html, pdf, etc. It just needs t be ensured that the naming f the key files, like Lgin_success.html remains. In this way, a page can be created n a lcal PC and afterwards the files can be upladed, withut need t change any link. The html files are nt displayed directly; furthermre they are parsed by a crrespnding cgi script in the same directry, which substitutes sme macrs, which are cntaining dynamic values like the username and IP address. A sample welcme page lks like this: <HTML> <BODY> <H1>Hell ##USER_LOGINNAME##</H1> </BODY> </HTML> The fllwing macrs can be used: Page 57 f 80

58 Macr ##SERVER_NAME## ##REQUESTED_URL## Descriptin IP address f the server. The url, the user requested, befre we redirected the request t ur lgin server. Table 6 Macrs fr Lgin.html Macr ##SERVER_NAME## ##REQUESTED_URL## Descriptin IP address f the server. The url, the user requested, befre we redirected the request t ur lgin server. Table 7 Macrs fr Lgin_denied.html Macr ##SERVER_NAME## ##REQUESTED_URL## ##USER_AUTH_MSG## Descriptin IP address f the server. The url, the user requested, befre we redirected the request t ur lgin server. Reply-Message attribute f the RADIUS server, r english default values if nt set. See table 2. ##USER_STATUS_URL## URL f the status page. This URL shuld be shwn in a seperate windw. ##INTERNAL_WEBSPACE_URL URL f the internal webspace, which is ## ##USER_IP## ##USER_MAC## ##USER_LOGINNAME## ##USER_AUTH_MODE## IP address f the User MAC address f the user Lginname f the user Authenticatin mde which has been used. Can be either 'lcal' fr authenticatin via lcal user database, r 'RADIUS' fr authenticatin via RADIUS. ##USER_STARTPAGE## ##USER_LANGUAGE## The startpage which has been assigned by the RADIUS server, using the lgin-url attribute. See table 2. Preferred language f the user as set by the RADIUS attribute lgin-language. See table 2. Page 58 f 80

59 Macr ##USER_IDLE_TIMEOUT## Descriptin Idle timeut in secnds as set by the RADIUS attribute Idle-Timeut. See table 2. ##USER_SESSION_TIMEOUT## Sessin timeut in secnds as set by the RADIUS attribute Sessin-Timeut. See table 2. ##USER_CUSTOM## Full freely user custmizable data, which can be set by the RADIUS attribute lgin-custm. See table 2. Table 8 Macrs fr Lgin_success.html Macr ##SERVER_NAME## ##USER_IP## ##USER_MAC## ##USER_LOGINNAME## ##USER_AUTH_MODE## ##USER_STARTPAGE## ##USER_LANGUAGE## Descriptin IP address f the server. IP address f the User MAC address f the user Lginname f the user Authenticatin mde which has been used. Can be either 'lcal' fr authenticatin via lcal user database, r 'RADIUS' fr authenticatin via RADIUS. The startpage which has been assigned by the RADIUS server, using the lgin-url attribute. See table 2. Preferred language f the user as set by the RADIUS attribute lgin-language. See table 2. ##USER_IDLE_TIMEOUT## Idle timeut in secnds as set by the RADIUS attribute Idle-Timeut. See table 2. ##USER_SESSION_TIMEOUT## Sessin timeut in secnds as set by the RADIUS attribute Sessin-Timeut. See table 2. ##USER_CUSTOM## Full freely user custmizable data, which can be set by the RADIUS attribute lgin-custm. See table 2. Table 9 Macrs fr Lgut.html Additinally, each page has the attribute ##HELP##, which enumerates the available attributes. Page 59 f 80

60 Cnfiguratin->Lgin Setup->Webspace Chsing the default page, which is displayed after a successful lgin, can be useful t prvide user sme lcal infrmatin, like the menu f a restaurant. At sme sites like this restaurant, there can t be assumed t be a netwrk infrastructure, besides the WAN cnnectin. This is maybe als n web server in the Internet t display the menu page. T serve these custmers, it is pssible t stre a simple page lcally in the MESH AP. MESH AP prvides up t 1MB f space fr administratr t stre sme lcal infrmatin. This submenu allws administratr t manage the lcal infrmatin t be display after successful lgin f the MESH AP lcally. Webspace parameter Existing files T display the existing webpages fr lcal infrmatin Click Delete t remve the selected webpage Uplad File T uplad a new webpage fr lcal infrmatin Click Brwse buttn t select the file t be upladed Click Uplad buttn t uplad the selected file Cnfiguratin->Tls->Ping Ping sends ICMP request messages t the netwrk hst. The cnnectivity between the netwrk hst and MESH AP is prven wrking when an ICMP respnd message frm the netwrk hst. Page 60 f 80

61 Ping Parameters: Ping T specify the hst IP address t ping Example: Number f pings Example: 2 Click Start buttn t start the Ping cmmand Output T specify number f cunt t send the ping cmmand Display the Ping cmmand result Page 61 f 80

62 Cnfiguratin->Tls->Dwnlad Dwnlad Parameters: System Infrmatin ( Display nly ) Display the infrmatin abut the firmware f the system Server IP Address T specify the IP address f the TFTP server Example: File Name T specify the name f the file Example: cnfig File Type T specify the file type Optin: cnfig, firmware Cnfig- cnfiguratin image Firmware- firmware image File Operatin T specify the peratin type Optin: uplad, dwnlad, dwnlad and rebt Uplad uplad t TFTP server Dwnlad dwnlad t MESH AP Dwnlad and rebt rebt after finish dwnlad t MESH AP Click Apply t perfrm peratin Cnfiguratin->Tls->Firmware Update This ptin allws user t update the MESH AP firmware. Cautin! Please dn t switch ff the device while updating the firmware. It may take average abut 6 minutes t update the firmware. Page 62 f 80

63 Firmware Update Parameters: Click Brwse buttn t brwse t the lcatin f new firmware and select that file Example: a:\firmware.img Click Uplad buttn t uplad the new firmware t MESH AP During the prcess, the services will shutdwn. After the firmware upgrade, the MESH AP will rebt. T knw when will be prcess cmpleted, simply set the MESH AP back t default befre upgrade and ping the default IP address f the MESH AP. Once the rebt prcess cmpleted, then the MESH AP will reply the ping. Page 63 f 80

64 Cnfiguratin->Tls->Settings Cnfiguratin Parameters: Save Cnfig Save the cnfiguratin image t a file Restre Cnfig T update the MESH AP cnfiguratin with saved cnfiguratin Click Brwse buttn t brwse t the lcatin f new cnfiguratin image and select that file Example: a:\mesh_ap1.cfg Click Uplad buttn t uplad the new cnfiguratin. Install New Webserver Certificate Install Web Server Certificate Uplad ur web certificatin that certified by authrized Certificate Authrity (CA) Click brwse buttn t select the certificate file frm user designated surce Page 64 f 80

65 Click Uplad buttn t uplad certificate t MESH AP Example: webserver-mesh.p12 Page 65 f 80

66 2.4 Cmmand Menu Cmmand->Rebt Rebt Parameters: Time t rebt T specify a delay in time befre rebting. Click Rebt t initiate the rebt sequence Cmmand->Reset Reset Parameters: Page 66 f 80

67 Reset t Factry Default T restre the default factry cnfiguratin Click Reset t Factry Default t restre t default factry setting 2.5 Inf Menu This menu allws the administratr t check the current status f varius MESH AP cmpnents such as system, interfaces. It als helps t prvide diagnstic tls t investigate the MESH AP behavirs. Inf menu cnsists f tw submenus, which knwn as status, tls and tplgy. The fllwing sectin will discuss each submenu in details. Page 67 f 80

68 2.5.1 Inf->Status->System The status menu displays the infrmatin f system, interfaces, services and existing lgin users details. System Parameters: Uptime Display the uptime in days/hurs/minutes Example: Time since last bt 0 days, 0 hrs, 34 minutes Hardware Display the MESH AP self-test after bt Value OK means self-test passed CPU T display the MESH AP MPC 8241 Prcessr status CPU-Speed Display the MCP 8241 CPU speed Average CPU usage ( Since bt ) Display the CPU usage since bt in terms f percentage Average CPU usage ( Last tw secnds ) Display the CPU usage f last tw secnds in terms f percentage Memry Free memry Display the available free system RAM memry Free Flash-Memry Display the available free system FLASH memry Versin Secndary versin Display the current secndary firmware versin Tertiary versin Display the current tertiary firmware versin Page 68 f 80

69 2.5.2 Inf->Status->Interfaces Display the LAN interface, WLAN interfaces and WAN interface general infrmatin. Interfaces Parameters: WAN Infrmatin T display the WAN interface general infrmatin Click WAN Infrmatin link t display details infrmatin. Interface T display current state f the WAN interface Hardware Address T display the MAC address f the WAN interface IP address T display the IP address assigned t the WAN interface LAN/WLAN-Bridge Infrmatin T display the LAN/WLAN Bridge interface general infrmatin Click LAN/WLAN Bridge Infrmatin link t display details infrmatin. Interface T display current state f the LAN/WLAN Bridge interface IP address T display the IP address assigned t the LAN/WLAN Bridge interface WLAN0 Infrmatin T display the WLAN0 interface general infrmatin Click WLAN0 Infrmatin link t display details infrmatin. Interface T display current state f the WLAN0 Bridge interface Hardware Address T display the MAC address f the WLAN0 interface WLAN1 Infrmatin Page 69 f 80

70 T display the WLAN1 interface general infrmatin Click WLAN1 Infrmatin link t display details infrmatin. Interface T display current state f the WLAN1 Bridge interface Hardware Address T display the MAC address f the WLAN1 interface LAN Infrmatin T display the LAN interface general infrmatin Click LAN Infrmatin link t display details infrmatin. Interface T display current state f the LAN interface Hardware Address T display the MAC address f the LAN interface Detailed Interface Infrmatin Each interface prvides its link t display the detailed interface infrmatin. Interface Parameters Infrmatin Hardware Address Display the interface MAC address IP address Display the interface IP address Bcast address Display the interface Bradcast address Netmask Display the interface Netmask MTU Size MTU Page 70 f 80

71 Display the interface Maximum Transfer Unit Data Transfer Rx bytes Display the received bytes n the interface Tx bytes Display the transmitted bytes n the interface Data Packet Rx packets Display the received packets Rx errrs Display the received errr packets Rx drpped Display the received drpped packets Tx packets Display the transmitted packets Tx errrs Display the transmitted errr packets Tx drpped Display the transmitted drpped packets Inf->Status->Services Services Parameters: Status Display current status f varius service cnfigured and running Page 71 f 80

72 2.5.4 Inf->Status->Users Click Restart buttn t restart the selected service Online Users Database Parameters: List f Users Display the current lgn user list User name Display the lgn user name Click this link t display the user details IP address Display the IP address assigned t the lgn user interface Actins Click Lgut buttn t lgut the user manually Inf->Status->Mbile IP Display the status f the mbile IP status Inf->Tplgy Display the current tplgy f the mesh netwrk. Page 72 f 80

73 Tplgy Parameters: Click Refresh t btain the current mesh netwrk tplgy. Output Inf->Rute Display the MESH AP IP ruting table. Rute Parameters: Click Refresh t btain the current IP ruting table infrmatin. Page 73 f 80

74 Output Display the current IP ruting table interfaces infrmatin Page 74 f 80

75 2.5.8 Inf->Syslg T view the system messages and significant events that ccur n the MESH AP. Syslg Parameters: Click Refresh t btain the current system lgging infrmatin. Output Display the current system lgging infrmatin. Page 75 f 80

76 2.6 Links This menu prvides the HTML links t the MESH AP main webpage and PLANET hmepage. Click the link t access the respective web page. Page 76 f 80

77 3 Lgging in thrugh MESH AP This chapter describes the basic steps t use the MESH AP service. Step 1: User Starts WEB Brwser User is ready t access the Internet and starts Web Brwer and requesting default Hme Page. Step 2: Lgin Page Presented t User Cnnecting t the Service The requested Hme Page is intercepted by MESH AP and replaced by a User Lgin Page The Lgin Page is prtected by SSL (HTTPS) CA Certificate is autmatically dwnladed prir t accessing the Lgin Page Nte: PDA Users can use HTTP (Nn-SSL) Lgin Page 77 f 80

78 Step 3: User Supplies Credentials Lgging On User supplies his/her ID and Passwrd t access the Internet User Credentials are validated against RADIUS Server Step 4: User Lgin Success Welcme Page Upn Successful Authenticatin and Authrizatin, the MESH AP ISP can present user with User and/r Lcatin specific Welcme Page t further the User Experience Step 5: Display the Request Hme Page After the Welcme Page, User is nw presented with the Hme Page initially requested and is nw ready t surf the Net A Sessin Page is nw displayed t User with infrmatin n Duratin f Usage Capacity f Data Transfer Time-Left fr Prepaid System, r etc Page 78 f 80

79 Step 6: User Lgut Once User is dne accessing the Internet r the remte Crprate Netwrk, the Sessin Page is used t Lgut A simple Click n the Lgut buttn Fr Pcket PC System just type in Lgut Lgut can als happen under cntrl f the Wireless Operatr r when the timecredit n prepaid system is expired Page 79 f 80