NBG460N

Wireless N Gigabit Router

Users Guide

Version 3.60 3/2008 Edition 1

DEFAULT LOGIN

IP Address http://192.168.1.1 Password 1234

www.zyxel.com

About This User's Guide
Intended Audience This manual is intended for people who want to configure the NBG460N using the web configurator. You should have at least a basic knowledge of TCP/IP networking concepts and topology. Related Documentation Quick Start Guide The Quick Start Guide is designed to help you get up and running right away. It contains information on setting up your network and configuring for Internet access. Supporting Disk Refer to the included CD for support documents. ZyXEL Web Site Please refer to www.zyxel.com for additional support documentation and product certifications. User Guide Feedback Help us help you. Send all User Guide-related comments, questions or suggestions for improvement to the following address, or use e-mail instead. Thank you! The Technical Writing Team, ZyXEL Communications Corp., 6 Innovation Road II, Science-Based Industrial Park, Hsinchu, 300, Taiwan. E-mail: techwriters@zyxel.com.tw

NBG460N Users Guide

Document Conventions
Warnings and Notes These are how warnings and notes are shown in this Users Guide.
Warnings tell you about things that could harm you or your device.
Notes tell you other important information (for example, other things you may need to configure or helpful tips) or recommendations.
Syntax Conventions The NBG460N may be referred to as the NBG460N, the device, the product or the system in this Users Guide. Product labels, screen names, field labels and field choices are all in bold font. A key stroke is denoted by square brackets and uppercase text, for example, [ENTER] means the enter or return key on your keyboard. Enter means for you to type one or more characters and then press the [ENTER] key. Select or choose means for you to use one of the predefined choices. A right angle bracket ( > ) within a screen name denotes a mouse click. For example, Maintenance > Log > Log Setting means you first click Maintenance in the navigation panel, then the Log sub menu and finally the Log Setting tab to get to that screen. Units of measurement may denote the metric value or the scientific value. For example, k for kilo may denote 1000 or 1024, M for mega may denote 1000000 or 1048576 and so on. e.g., is a shorthand for for instance, and i.e., means that is or in other words.
Icons Used in Figures Figures in this Users Guide may use the following generic icons. The NBG460N icon is not an exact representation of your device.
NBG460N Computer Notebook computer

Server

Firewall

Telephone

Switch

Router

Safety Warnings
For your safety, be sure to read and follow all warning notices and instructions.
Do NOT use this product near water, for example, in a wet basement or near a swimming pool. Do NOT expose your device to dampness, dust or corrosive liquids. Do NOT store things on the device. Do NOT install, use, or service this device during a thunderstorm. There is a remote risk of electric shock from lightning. Connect ONLY suitable accessories to the device. Do NOT open the device or unit. Opening or removing covers can expose you to dangerous high voltage points or other risks. ONLY qualified service personnel should service or disassemble this device. Please contact your vendor for further information. Make sure to connect the cables to the correct ports. Place connecting cables carefully so that no one will step on them or stumble over them. Always disconnect all cables from this device before servicing or disassembling. Use ONLY an appropriate power adaptor or cord for your device. Connect the power adaptor or cord to the right supply voltage (for example, 110V AC in North America or 230V AC in Europe). Do NOT allow anything to rest on the power adaptor or cord and do NOT place the product where anyone can walk on the power adaptor or cord. Do NOT use the device if the power adaptor or cord is damaged as it might cause electrocution. If the power adaptor or cord is damaged, remove it from the power outlet. Do NOT attempt to repair the power adaptor or cord. Contact your local vendor to order a new one. Do not use the device outside, and make sure all the connections are indoors. There is a remote risk of electric shock from lightning. Do NOT obstruct the device ventilation slots, as insufficient airflow may harm your device. Antenna Warning! This device meets ETSI and FCC certification requirements when using the included antenna(s). Only use the included antenna(s). If you wall mount your device, make sure that no electrical lines, gas or water pipes will be damaged. This product is recyclable. Dispose of it properly.

List of Tables Table 39 Scheduling.... 108 Table 40 Login Screen.... 109 Table 41 System Status screen...111 Table 42 Port Forwarding....114 Table 43 Network > WAN > Internet Connection: Ethernet Encapsulation..119 Table 44 Network > WAN > Internet Connection: PPPoE Encapsulation.. 121 Table 45 Network > WAN > Internet Connection: PPTP Encapsulation... 123 Table 46 WAN > Advanced.... 125 Table 47 Network > LAN > IP.... 130 Table 48 Network > LAN > IP Alias.... 131 Table 49 Network > LAN > Advanced... 132 Table 50 Network > DHCP > General... 133 Table 51 Network > DHCP > Advanced.... 134 Table 52 Network > DHCP > Client List.... 136 Table 53 Network > NAT > General.... 139 Table 54 NAT Application.... 140 Table 55 Network > NAT > Advanced... 144 Table 56 Dynamic DNS.... 148 Table 57 Security > Firewall > General... 155 Table 58 Security > Firewall > Services.... 156 Table 59 Security > Firewall > Services > Adding a Rule... 158 Table 60 Security > Content Filter > Filter... 162 Table 61 Security > Content Filter > Schedule... 163 Table 62 Security > VPN > General.... 168 Table 63 SECURITY > VPN > Rule Setup: IKE (Basic)... 170 Table 64 Security > VPN > Rule Setup: IKE (Advanced)... 175 Table 65 Security > VPN > Rule Setup: Manual.... 180 Table 66 Security > VPN > SA Monitor... 184 Table 67 VPN Example: Matching ID Type and Content... 186 Table 68 VPN Example: Mismatching ID Type and Content... 187 Table 69 Management > Static Route > IP Static Route... 196 Table 70 Management > Static Route > IP Static Route: Static Route Setup.. 197 Table 71 Application and Subnet-based Bandwidth Management Example.. 200 Table 72 Bandwidth Management Priorities... 200 Table 73 Media Bandwidth Management Setup: Services... 201 Table 74 Bandwidth Management Priority with Default Classes.. 202 Table 75 Management > Bandwidth MGMT > General... 203 Table 76 Management > Bandwidth MGMT > Advanced... 204 Table 77 Bandwidth Management Rule Configuration: Pre-defined Service.. 205 Table 78 Management > Bandwidth MGMT > Advanced: User-defined Service Rule Configuration. 206 Table 79 Management > Remote MGMT > WWW... 210 Table 80 Management > Remote MGMT > Telnet...211 Table 81 Management > Remote MGMT > FTP... 212

5.4.2 WLAN and Maintenance Settings
The configuration of wireless and maintenance settings in AP Mode is the same as for Router Mode. See Chapter 5 on page 69 for information on the configuring your wireless network. See Maintenance and Troubleshooting (227) for information on the configuring your Maintenance settings.
5.5 Logging in to the Web Configurator in AP Mode
1 Connect your computer to the LAN port of the NBG460N. 2 The default IP address if the NBG460N is 192.168.1.1. In this case, your computer must have an IP address in the range between 192.168.1.2 and 192.168.1.255. 3 Click Start > Run on your computer in Windows. 4 Type cmd in the dialog box. 5 Type ipconfig to show your computers IP address. If your computers IP address is not in the correct range then see Appendix D on page 293 for information on changing your computers IP address. 6 After youve set your computers IP address, open a web browser such as Internet Explorer and type 192.168.1.1 as the web address in your web browser. See Chapter 6 on page 73 for a tutorial on setting up a network with an AP.

6.1 Wireless Tutorials

6.1.1 How to Connect to the Internet from an AP

Tutorials

This section gives you an example of how to set up an access point (AP) and wireless client (a notebook (B), in this example) for wireless communication. B can access the Internet through the AP wirelessly.
Figure 35 Wireless AP Connection to the Internet

Internet B AP

6.1.2 Configure Wireless Security Using WPS on both your NBG460N and Wireless Client
This section gives you an example of how to set up wireless network using WPS. This example uses the NBG460N as the AP and NWD210N as the wireless client which connects to a notebook.
The wireless client must be a WPS-aware device (for example, a WPS USB adapter or PCI card).
There are two WPS methods for creating a secure connection. This tutorial shows you how to do both. Push Button Configuration (PBC) - create a secure wireless network simply by pressing a button. See Section 6.1.2.1 on page 74.This is the easier method. PIN Configuration - create a secure wireless network simply by entering a wireless client's PIN (Personal Identification Number) in the NBG460Ns interface. See Section 6.1.2.2 on page 75. This is the more secure method, since one device can authenticate the other.

Chapter 6 Tutorials

6.1.2.1 Push Button Configuration (PBC) 1 Make sure that your NBG460N is turned on and that it is within range of your computer. 2 Make sure that you have installed the wireless client (this example uses the NWD210N) driver and utility in your notebook. 3 In the wireless client utility, find the WPS settings. Enable WPS and press the WPS button (Start or WPS button) 4 Log into NBG460Ns web configurator and press the Push Button button in the Network > Wireless Client > WPS Station screen.

Chapter 7 Wireless LAN Figure 60 Roaming Example
The steps below describe the roaming process. 1 Wireless station Y moves from the coverage area of access point AP 1 to that of access point AP 2. 2 Wireless station Y scans and detects the signal of access point AP 2. 3 Wireless station Y sends an association request to access point AP 2. 4 Access point AP 2 acknowledges the presence of wireless station Y and relays this information to access point AP 1 through the wired LAN. 5 Access point AP 1 updates the new position of wireless station Y.
7.3.1 Requirements for Roaming
The following requirements must be met in order for wireless stations to roam between the coverage areas. 1 All the access points must be on the same subnet and configured with the same ESSID. 2 If IEEE 802.1x user authentication is enabled and to be done locally on the access point, the new access point must have the user profile for the wireless station. 3 The adjacent access points should use different radio channels when their coverage areas overlap. 4 All access points must use the same port number to relay roaming information. 5 The access points must be connected to the Ethernet and be able to get IP addresses from a DHCP server if using dynamic IP address assignment.

7.4 Quality of Service

This section discusses the Quality of Service (QoS) features available on the NBG460N.

7.4.1 WMM QoS

WMM (Wi-Fi MultiMedia) QoS (Quality of Service) ensures quality of service in wireless networks. It controls WLAN transmission priority on packets to be transmitted over the wireless network. WMM QoS prioritizes wireless traffic according to delivery requirements. WMM QoS is a part of the IEEE 802.11e QoS enhancement to certified Wi-Fi wireless networks. On APs without WMM QoS, all traffic streams are given the same access priority to the wireless network. If the introduction of another traffic stream creates a data transmission demand that exceeds the current network capacity, then the new traffic stream reduces the throughput of the other traffic streams. The NBG460N uses WMM QoS to prioritize traffic streams according to the IEEE 802.1q tag or DSCP information in each packets header. The NBG460N automatically determines the priority to use for an individual traffic stream. This prevents reductions in data transmission for applications that are sensitive to latency (delay) and jitter (variations in delay). 7.4.1.1 WMM QoS Priorities The following table describes the WMM QoS priority levels that the NBG460N uses.
Table 28 WMM QoS Priorities
PRIORITY LEVEL voice (WMM_VOICE) video (WMM_VIDEO) best effort (WMM_BEST_EFFORT) background (WMM_BACKGROUND) DESCRIPTION Typically used for traffic that is especially sensitive to jitter. Use this priority to reduce latency for improved voice quality. Typically used for traffic which has some tolerance for jitter but needs to be prioritized over other data traffic. Typically used for traffic from applications or devices that lack QoS capabilities. Use best effort priority for traffic that is less sensitive to latency, but is affected by long delays, such as Internet surfing. This is typically used for non-critical traffic such as bulk transfers and print jobs that are allowed but that should not affect other applications and users. Use background priority for applications that do not have strict latency and throughput requirements.

Apply Reset Application Rules Summary # Active Name Port Wake On LAN Modify This is the number of an individual port forwarding server entry. This icon is turned on when the rule is enabled. This field displays a name to identify this rule. This field displays the port number(s). This field displays No when Wake On LAN is disabled and Yes when Wake On LAN is enabled. Click the Edit icon to display and modify an existing rule setting in the fields under Add Application Rule. Click the Remove icon to delete a rule. Click Apply to save your changes to the Application Rules Summary table. Click Reset to not save and return your new changes in the Service Name and Port fields to the previous one.
Server IP Address This field displays the inside IP address of the server.

11.4.1 Game List Example

Here is an example game list text file. The index number, service name and associated port(s) are specified by semi-colons (no spaces). Use the name=xxx (where xxx is the service name) to create a new service. Port range can be separated with a hyphen (-) (no spaces). Multiple (non-consecutive) ports can be separated by commas.
Chapter 11 Network Address Translation (NAT) Figure 92 Game List Example
version=1 1;name=Battlefield 1942;port=14567,22000,23000-23009,27900,28900 2;name=Call of Duty;port=28960 3;name=Civilization IV;port=2056 4;name=Diablo I and II;port=6112-6119,4000 5;name=Doom 3;port=27666 6;name=F.E.A.R;port=27888 7;name=Final Fantasy XI;port=25,80,110,443,50000-65535 8;name=Guild Wars;port=6112,80 9;name=Half Life;port=6003,7002,27005,27010,27011,27015 10;name=Jedi Knight III: Jedi Academy;port=28060-28062,28070-28081 11;name=Need for Speed: Hot Pursuit 2;port=1230,85118512,27900,28900,61200-61230 12;name=Neverwinter Nights;port=5120-5300,6500,27900,28900 13;name=Quake 2;port=27910 14;name=Quake 3;port=27660,27960 15;name=Rainbow Six 3: Raven Shield;port=7777-7787,8777-8787 16;name=Serious Sam II;port=25600-25605 17;name=Silent Hunter III;port=17997-18003 18;name=Soldier of Fortune II;port=20100-20112 19;name=Starcraft;port=6112-6119,4000 20;name=Star Trek: Elite Force II;port=29250,29256 21;name=SWAT 4;port=10480-10483 22;name=Warcraft II and III;port=6112-6119,4000 23;name=World of Warcraft;port=3724
11.5 Trigger Port Forwarding
Some services use a dedicated range of ports on the client side and a dedicated range of ports on the server side. With regular port forwarding you set a forwarding port in NAT to forward a service (coming in from the server on the WAN) to the IP address of a computer on the client side (LAN). The problem is that port forwarding only forwards a service to a single LAN IP address. In order to use the same service on a different LAN computer, you have to manually replace the LAN computer's IP address in the forwarding port with another LAN computer's IP address. Trigger port forwarding solves this problem by allowing computers on the LAN to dynamically take turns using the service. The NBG460N records the IP address of a LAN computer that sends traffic to the WAN to request a service with a specific port number and protocol (a "trigger" port). When the NBG460N's WAN port receives a response with a specific port number and protocol ("incoming" port), the NBG460N forwards the traffic to the LAN IP address of the computer that sent the request. After that computers connection for that service closes, another computer on the LAN can use the service in the same manner. This way you do not need to configure a new IP address each time you want a different LAN computer to use the application.

Restrict Web Features ActiveX

Cookies Web Proxy

Keyword Blocking Enable URL Keyword Blocking
Chapter 14 Content Filtering Table 60 Security > Content Filter > Filter
LABEL Keyword Keyword List Add DESCRIPTION Type a keyword in this field. You may use any character (up to 64 characters). Wildcards are not allowed. You can also enter a numerical IP address. This list displays the keywords already added. Click Add after you have typed a keyword. Repeat this procedure to add other keywords. Up to 64 keywords are allowed. When you try to access a web page containing a keyword, you will get a message telling you that the content filter is blocking this request. Highlight a keyword in the lower box and click Delete to remove it. The keyword disappears from the text box after you click Apply. Click this button to remove all of the listed keywords. Enter a message to be displayed when a user tries to access a restricted web site. The default message is Please contact your network administrator!! Click Apply to save your changes. Click Reset to begin configuring this screen afresh
Delete Clear All Denied Access Message Apply Reset

14.5 Schedule

Use this screen to set the day(s) and time you want the NBG460N to use content filtering. Click Security > Content Filter > Schedule. The following screen displays.
Figure 101 Security > Content Filter > Schedule
Table 61 Security > Content Filter > Schedule
LABEL Day to Block DESCRIPTION Select check boxes for the days that you want the NBG460N to perform content filtering. Select the Everyday check box to have content filtering turned on all days of the week. Time of Day to Block allows the administrator to define during which time periods content filtering is enabled. Time of Day to Block restrictions only apply to the keywords (see above). Restrict web server data, such as ActiveX, Java, Cookies and Web Proxy are not affected. Select All Day to have content filtering always active on the days selected in Day to Block with time of day limitations not enforced. Select From and enter the time period, in 24-hour format, during which content filtering will be enforced.
Time of Day to Block (24-Hour Format)
Chapter 14 Content Filtering Table 61 Security > Content Filter > Schedule

Additional IPSec VPN Topics
This section discusses other IPSec VPN topics that apply to either IKE SAs or IPSec SAs or both. Relationships between the topics are also highlighted.

SA Life Time

SAs have a lifetime that specifies how long the SA lasts until it times out. When an SA times out, the NBG460N automatically renegotiates the SA in the following situations: There is traffic when the SA life time expires The IPSec SA is configured on the NBG460N as nailed up (see below) Otherwise, the NBG460N must re-negotiate the SA the next time someone wants to send traffic. Note: If the IKE SA times out while an IPSec SA is connected, the IPSec SA stays connected. An IPSec SA can be set to keep alive Normally, the NBG460N drops the IPSec SA when the life time expires or after two minutes of outbound traffic with no inbound traffic. If you set the IPSec SA to keep alive , the NBG460N automatically renegotiates the IPSec SA when the SA life time expires, and it does not drop the IPSec SA if there is no inbound traffic. Note: The SA life time and keep alive settings only apply if the rule identifies the remote IPSec router by a static IP address or a domain name. If the Secure Gateway Address field is set to 0.0.0.0, the NBG460N cannot initiate the tunnel (and cannot renegotiate the SA).
Encryption and Authentication Algorithms
In most NBG460Ns, you can select one of the following encryption algorithms for each proposal. The encryption algorithms are listed here in order from weakest to strongest. Data Encryption Standard (DES) is a widely used (but breakable) method of data encryption. It applies a 56-bit key to each 64-bit block of data. Triple DES (3DES) is a variant of DES. It iterates three times with three separate keys, effectively tripling the strength of DES. You can select one of the following authentication algorithms for each proposal. The algorithms are listed here in order from weakest to strongest. MD5 (Message Digest 5) produces a 128-bit digest to authenticate packet data. SHA1 (Secure Hash Algorithm) produces a 160-bit digest to authenticate packet data.

Private DNS Server

Password Setup Old Password New Password Retype to Confirm Apply Reset

20.3 Time Setting Screen

To change your NBG460Ns time and date, click Maintenance > System > Time Setting. The screen appears as shown. Use this screen to configure the NBG460Ns time based on your local time zone.
Figure 146 Maintenance > System > Time Setting

Chapter 20 System

Table 85 Maintenance > System > Time Setting
LABEL Current Time and Date Current Time This field displays the time of your NBG460N. Each time you reload this page, the NBG460N synchronizes the time with the time server. This field displays the date of your NBG460N. Each time you reload this page, the NBG460N synchronizes the date with the time server. DESCRIPTION

Current Date

Time and Date Setup Manual Select this radio button to enter the time and date manually. If you configure a new time and date, Time Zone and Daylight Saving at the same time, the new time and date you entered has priority and the Time Zone and Daylight Saving settings do not affect it. This field displays the last updated time from the time server or the last time configured manually. When you set Time and Date Setup to Manual, enter the new time in this field and then click Apply. This field displays the last updated date from the time server or the last date configured manually. When you set Time and Date Setup to Manual, enter the new date in this field and then click Apply. Select this radio button to have the NBG460N get the time and date from the time server you specified below. Select Auto to have the NBG460N automatically search for an available time server and synchronize the date and time with the time server after you click Apply. Select User Defined Time Server Address and enter the IP address or URL (up to 20 extended ASCII characters in length) of your time server. Check with your ISP/network administrator if you are unsure of this information. Choose the time zone of your location. This will set the time difference between your time zone and Greenwich Mean Time (GMT). Daylight saving is a period from late spring to early fall when many countries set their clocks ahead of normal local time by one hour to give more daytime light in the evening. Select this option if you use Daylight Saving Time. Configure the day and time when Daylight Saving Time starts if you selected Daylight Savings. The o'clock field uses the 24 hour format. Here are a couple of examples: Daylight Saving Time starts in most parts of the United States on the first Sunday of April. Each time zone in the United States starts using Daylight Saving Time at 2 A.M. local time. So in the United States you would select First, Sunday, April and type 2 in the o'clock field. Daylight Saving Time starts in the European Union on the last Sunday of March. All of the time zones in the European Union start using Daylight Saving Time at the same moment (1 A.M. GMT or UTC). So in the European Union you would select Last, Sunday, March. The time you type in the o'clock field depends on your time zone. In Germany for instance, you would type 2 because Germany's time zone is one hour ahead of GMT or UTC (GMT+1).

LOG MESSAGE %s: Proxy mode detected %s %s:%s %s(cache hit) %s:%s(cache hit) %s: Trusted Web site %s DESCRIPTION The router detected proxy mode in the packet. The content filter server responded that the web site is in the blocked category list, but it did not return the category type. The content filter server responded that the web site is in the blocked category list, and returned the category type. The system detected that the web site is in the blocked list from the local cache, but does not know the category type. The system detected that the web site is in blocked list from the local cache, and knows the category type. The web site is in a trusted domain. When the content filter is not on according to the time schedule or you didn't select the "Block Matched Web Site check box, the system forwards the web content. The external content filtering server did not respond within the timeout period. The NBG460N cannot get the IP address of the external content filtering via DNS query.
Waiting content filter server timeout DNS resolving failed
Creating socket failed The NBG460N cannot issue a query because TCP/IP socket creation failed, port:port number. Connecting to content filter server fail The connection to the external content filtering server failed.
License key is invalid The external content filtering license key is invalid.

Table 98 Attack Logs

LOG MESSAGE attack [TCP | UDP | IGMP | ESP | GRE | OSPF] attack ICMP (type:%d, code:%d) land [TCP | UDP | IGMP | ESP | GRE | OSPF] land ICMP (type:%d, code:%d) ip spoofing - WAN [TCP | UDP | IGMP | ESP | GRE | OSPF] ip spoofing - WAN ICMP (type:%d, code:%d) icmp echo: ICMP (type:%d, code:%d) syn flood TCP ports scan TCP teardrop TCP DESCRIPTION The firewall detected a TCP/UDP/IGMP/ESP/GRE/OSPF attack. The firewall detected an ICMP attack. For type and code details, see Table 104 on page 247. The firewall detected a TCP/UDP/IGMP/ESP/GRE/OSPF land attack. The firewall detected an ICMP land attack. For type and code details, see Table 104 on page 247. The firewall detected an IP spoofing attack on the WAN port.
The firewall detected an ICMP IP spoofing attack on the WAN port. For type and code details, see Table 104 on page 247. The firewall detected an ICMP echo attack. For type and code details, see Table 104 on page 247. The firewall detected a TCP syn flood attack. The firewall detected a TCP port scan attack. The firewall detected a TCP teardrop attack.

Chapter 21 Logs Table 100 IKE Logs (continued)
LOG MESSAGE Verifying Local ID failed: IKE Packet Retransmit Failed to send IKE Packet Too many errors! Deleting SA Phase 1 IKE SA process done Duplicate requests with the same cookie DESCRIPTION The connection failed during IKE phase 2 because the router and the peers Local/Remote Addresses dont match. The router retransmitted the last packet sent because there was no response from the peer. An Ethernet error stopped the router from sending IKE packets. An SA was deleted because there were too many errors. The phase 1 IKE SA process has been completed. The router received multiple requests from the same peer while still processing the first IKE packet from the peer.
IKE Negotiation is in process The router has already started negotiating with the peer for the connection, but the IKE process has not finished yet. No proposal chosen Phase 1 or phase 2 parameters dont match. Please check all protocols / settings. Ex. One device being configured for 3DES and the other being configured for DES causes the connection to fail. The security gateway is set to 0.0.0.0 and the router used the peers Local Address as the routers Remote Address. This information conflicted with static rule #d; thus the connection is not allowed. The router couldnt resolve the IP address from the domain name that was used for the secure gateway address. The displayed ID information did not match between the two ends of the connection. The displayed ID information did not match between the two ends of the connection. The displayed ID information did not match between the two ends of the connection. A packet was sent. IKE uses ISAKMP to transmit data. Each ISAKMP packet contains many different types of payloads. All of them show in the LOG. Refer to RFC2408 ISAKMP for a list of all ISAKMP payload types. The router received an IKE negotiation request from the peer address specified. The router started negotiation with the peer. The peers Local IP Address is invalid. The security gateway is set to 0.0.0.0 and the router used the peers Local Address as the routers Remote Address. This information conflicted with static rule #d; thus the connection is not allowed. This routers "Peer ID Type" is different from the peer IPSec router's "Local ID Type". This routers "Peer ID Content" is different from the peer IPSec router's "Local ID Content".
Local / remote IPs of incoming request conflict with rule <%d> Cannot resolve Secure Gateway Addr for rule <%d> Peer ID: <peer id> <My remote type> -<My local type> vs. My Remote <My remote> <My remote> vs. My Local <My local>-<My local> Send <packet> Recv <packet>
Recv <Main or Aggressive> Mode request from <IP> Send <Main or Aggressive> Mode request to <IP> Invalid IP <Peer local> / <Peer local> Remote IP <Remote IP> / <Remote IP> conflicts

4 For statically assigned settings, do the following: From the Configure box, select Manually. Type your IP address in the IP Address box. Type your subnet mask in the Subnet mask box. Type the IP address of your Prestige in the Router address box. 5 Click Apply Now and close the window. 6 Turn on your Prestige and restart your computer (if prompted).
Check your TCP/IP properties in the Network window.
This section shows you how to configure your computers TCP/IP settings in Red Hat Linux 9.0. Procedure, screens and file location may vary depending on your Linux distribution and release version.
Make sure you are logged in as the root administrator.
Using the K Desktop Environment (KDE)
Follow the steps below to configure your computer IP address using the KDE. 1 Click the Red Hat button (located on the bottom left corner), select System Setting and click Network.
Figure 193 Red Hat 9.0: KDE: Network Configuration: Devices
2 Double-click on the profile of the network card you wish to configure. The Ethernet Device General screen displays as shown.
Appendix D Setting up Your Computers IP Address Figure 194 Red Hat 9.0: KDE: Ethernet Device: General
If you have a dynamic IP address click Automatically obtain IP address settings with and select dhcp from the drop down list. If you have a static IP address click Statically set IP Addresses and fill in the Address, Subnet mask, and Default Gateway Address fields. 3 Click OK to save the changes and close the Ethernet Device General screen. 4 If you know your DNS server IP address(es), click the DNS tab in the Network Configuration screen. Enter the DNS server information in the fields provided.
Figure 195 Red Hat 9.0: KDE: Network Configuration: DNS
5 Click the Devices tab. 6 Click the Activate button to apply the changes. The following screen displays. Click Yes to save the changes in all screens.
Appendix D Setting up Your Computers IP Address Figure 196 Red Hat 9.0: KDE: Network Configuration: Activate
7 After the network card restart process is complete, make sure the Status is Active in the Network Configuration screen.
Using Configuration Files
Follow the steps below to edit the network configuration files and set your computer IP address. 1 Assuming that you have only one network card on the computer, locate the ifconfigeth0 configuration file (where eth0 is the name of the Ethernet card). Open the configuration file with any plain text editor. If you have a dynamic IP address, enter dhcp in the BOOTPROTO= field. The following figure shows an example.
Figure 197 Red Hat 9.0: Dynamic IP Address Setting in ifconfig-eth0
DEVICE=eth0 ONBOOT=yes BOOTPROTO=dhcp USERCTL=no PEERDNS=yes TYPE=Ethernet
If you have a static IP address, enter static in the BOOTPROTO= field. Type IPADDR= followed by the IP address (in dotted decimal notation) and type NETMASK= followed by the subnet mask. The following example shows an example where the static IP address is 192.168.1.10 and the subnet mask is 255.255.255.0.

RADIUS

RADIUS is based on a client-server model that supports authentication, authorization and accounting. The access point is the client and the server is the RADIUS server. The RADIUS server handles the following tasks: Authentication Determines the identity of the users. Authorization Determines the network services available to authenticated users once they are connected to the network. Accounting Keeps track of the clients network activity. RADIUS is a simple package exchange in which your AP acts as a message relay between the wireless station and the network RADIUS server.

Types of RADIUS Messages

The following types of RADIUS messages are exchanged between the access point and the RADIUS server for user authentication: Access-Request Sent by an access point requesting authentication. Access-Reject Sent by a RADIUS server rejecting access. Access-Accept Sent by a RADIUS server allowing access. Access-Challenge Sent by a RADIUS server requesting more information in order to allow access. The access point sends a proper response from the user and then sends another Access-Request message. The following types of RADIUS messages are exchanged between the access point and the RADIUS server for user accounting: Accounting-Request Sent by the access point requesting accounting. Accounting-Response Sent by the RADIUS server to indicate that it has started or stopped accounting.
In order to ensure network security, the access point and the RADIUS server use a shared secret key, which is a password, they both know. The key is not sent over the network. In addition to the shared key, password information exchanged is also encrypted to protect the network from unauthorized access.

Types of Authentication

This appendix discusses some popular authentication types: EAP-MD5, EAP-TLS, EAPTTLS, PEAP and LEAP. The type of authentication you use depends on the RADIUS server or the AP. Consult your network administrator for more information.
EAP-MD5 (Message-Digest Algorithm 5)
MD5 authentication is the simplest one-way authentication method. The authentication server sends a challenge to the wireless station. The wireless station proves that it knows the password by encrypting the password with the challenge and sends back the information. Password is not sent in plain text. However, MD5 authentication has some weaknesses. Since the authentication server needs to get the plaintext passwords, the passwords must be stored. Thus someone other than the authentication server may access the password file. In addition, it is possible to impersonate an authentication server as MD5 authentication method does not perform mutual authentication. Finally, MD5 authentication method does not support data encryption with dynamic session key. You must configure WEP encryption keys for data encryption.

Finland France E-mail: info@zyxel.fr Telephone: +33-4-72-52-97-97 Fax: +33-4-72-52-19-20 Web: www.zyxel.fr Regular Mail: ZyXEL France, 1 rue des Vergers, Bat. 1 / C, 69760 Limonest, France Support E-mail: support@zyxel.fi Sales E-mail: sales@zyxel.fi Telephone: +358-9-4780-8411 Fax: +358-9-4780-8448 Web: www.zyxel.fi Regular Mail: ZyXEL Communications Oy, Malminkaari 10, 00700 Helsinki, Finland
Germany Support E-mail: support@zyxel.de Sales E-mail: sales@zyxel.de Telephone: +49-2405-6909-69 Fax: +49-2405-6909-99 Web: www.zyxel.de Regular Mail: ZyXEL Deutschland GmbH., Adenauerstr. 20/A2 D-52146, Wuerselen, Germany
Hungary India Japan Support E-mail: support@zyxel.co.jp Sales E-mail: zyp@zyxel.co.jp Telephone: +81-3-6847-3700 Fax: +81-3-6847-3705 Web: www.zyxel.co.jp Regular Mail: ZyXEL Japan, 3F, Office T&U, 1-10-10 Higashi-Gotanda, Shinagawa-ku, Tokyo 141-0022, Japan Support E-mail: support@zyxel.in Sales E-mail: sales@zyxel.in Telephone: +91-11-30888144 to +91-11-30888153 Fax: +91-11-30888149, +91-11-26810715 Web: http://www.zyxel.in Regular Mail: India - ZyXEL Technology India Pvt Ltd., II-Floor, F2/9 Okhla Phase -1, New Delhi 110020, India Support E-mail: support@zyxel.hu Sales E-mail: info@zyxel.hu Telephone: +36-1-3361649 Fax: +36-1-3259100 Web: www.zyxel.hu Regular Mail: ZyXEL Hungary, 48, Zoldlomb Str., H-1025, Budapest, Hungary
Kazakhstan Support: http://zyxel.kz/support Sales E-mail: sales@zyxel.kz Telephone: +7-3272-590-698 Fax: +7-3272-590-689 Web: www.zyxel.kz Regular Mail: ZyXEL Kazakhstan, 43 Dostyk Ave., Office 414, Dostyk Business Centre, 050010 Almaty, Republic of Kazakhstan
Malaysia Support E-mail: support@zyxel.com.my Sales E-mail: sales@zyxel.com.my Telephone: +603-8076-9933 Fax: +603-8076-9833 Web: http://www.zyxel.com.my Regular Mail: ZyXEL Malaysia Sdn Bhd., 1-02 & 1-03, Jalan Kenari 17F, Bandar Puchong Jaya, 47100 Puchong, Selangor Darul Ehsan, Malaysia
North America Support E-mail: support@zyxel.com Support Telephone: +1-800-978-7222 Sales E-mail: sales@zyxel.com Sales Telephone: +1-714-632-0882 Fax: +1-714-632-0858 Web: www.zyxel.com Regular Mail: ZyXEL Communications Inc., 1130 N. Miller St., Anaheim, CA 928062001, U.S.A.
Norway Support E-mail: support@zyxel.no Sales E-mail: sales@zyxel.no Telephone: +47-22-80-61-80 Fax: +47-22-80-61-81 Web: www.zyxel.no Regular Mail: ZyXEL Communications A/S, Nils Hansens vei 13, 0667 Oslo, Norway
Poland Russia Support: http://zyxel.ru/support Sales E-mail: sales@zyxel.ru Telephone: +7-095-542-89-29 Fax: +7-095-542-89-25 Web: www.zyxel.ru Regular Mail: ZyXEL Russia, Ostrovityanova 37a Str., Moscow 117279, Russia E-mail: info@pl.zyxel.com Telephone: +48-22-Fax: +48-22-Web: www.pl.zyxel.com Regular Mail: ZyXEL Communications, ul. Okrzei 1A, 03-715 Warszawa, Poland

ZyXEL NBG 460

ZyXEL NBG-460N Firmware Upgrade

Updated Notes

Firmware 3.60
1.Enabled Dual OP Mode Selection (AP/Router) 2.Support WDS 3.Enhance Wireless stability 4.Support IPTV port assignment 5.Jumbo Frame support (1.2KB/s) 6.Enabled manually set session to 16,000 in web UI

Page 1