Note: When the features discussed in this document apply to the AirPort Extreme Base Station, AirPort Express, and Time Capsule, the devices are referred to collectively as Apple wireless devices. With an AirPort Extreme Base Station or a Time Capsule, you can connect a USB hard disk so that everyone on the network can back up, store, and share files. Every Time Capsule includes an internal AirPort disk, so you dont need to connect an external one. If you want, you can connect additional USB disks to the USB port on your Time Capsule. You can also connect a USB printer to the USB port on any Apple wireless device, so that everyone on the network can access the printer or hub. All Apple wireless devices provide strong, wireless security. They offer a built-in firewall and support industry-standard encryption technologies. Yet the simple setup utility and powerful access controls make it easy for authorized users to connect to the AirPort network they create. You can use an Apple wireless device to provide wireless Internet access and share a single Internet connection among several computers in the following ways: Set up the device to act as a router and provide Internet Protocol (IP) addresses to computers on the network using Dynamic Host Configuration Protocol (DHCP) and Network Address Translation (NAT). When the wireless device is connected to a DSL or cable modem that is connected to the Internet, it receives webpages and email content from the Internet through its Internet connection, and then sends the content to wireless-enabled computers, using the wireless network or using Ethernet if there are computers connected to the Ethernet ports. Set up the Apple wireless device to act as a bridge on an existing network that already has Internet access and a router providing IP addresses. The device passes IP addresses and the Internet connection to AirPort or wireless-enabled computers, or computers connected to the wireless device by Ethernet. This document provides information about the latest AirPort Extreme Base Station, AirPort Express, and Time Capsule, and detailed information about designing 802.11n networks with AirPort Utility for computers using Mac OS X v10.5 or later, and Windows Vista or Windows XP with Service Pack 2. If youre using previous versions of Mac OS X, or are setting up earlier versions of AirPort devices, youll find more information at www.apple.com/support/airport.

Set up your Apple wireless device manually using AirPort Utility when: You want to provide Internet access to computers that connect to the wireless device using Ethernet youve already set up your device, but you need to change one setting, such as your account information You need to configure advanced settings such as channel frequency, advanced security options, closed networks, DHCP lease time, access control, WAN privacy, power controls, or port mapping or other options For instructions on using AirPort Utility to manually set up your wireless device and network, see Using AirPort Utility on page 15.
Extending the Range of Your AirPort Network
You can extend the range of your network by using AirPort Utility to set up wireless connections among several devices in your network, or to connect a device using Ethernet to create a roaming network. For more information on extending the range of your network, see Connecting Additional Wireless Devices to Your AirPort Network on page 41.
Sharing a USB Hard Disk Connected to an AirPort Extreme Base Station or Time Capsule
If youre using an AirPort Extreme Base Station or a Time Capsule, you can connect a USB hard disk to it, and computers connected to the networkwired or wireless, Mac or Windowscan share files using the hard disk. Every Time Capsule includes an internal AirPort disk, so you dont need to connect an external one. If you want, you can connect additional USB disks to the USB port on your Time Capsule. See Sharing and Securing USB Hard Disks on Your Network on page 54.
Printing with an Apple Wireless Device
If you have a compatible USB printer connected to your Apple wireless device, computers on the AirPort network can use Bonjour (Apples zero-configuration networking technology) to print to the printer. For instructions about printing to a USB printer from a computer, see Connecting a USB Printer to an Apple Wireless Device on page 55.
Sharing Your Computers Internet Connection
If your computer is connected to the Internet, you can share your Internet connection with other computers using Mac OS X version 10.2 or later, or Windows XP with Service Pack 2. This is sometimes called using your computer as a software base station.
You can share your Internet connection as long as your computer is connected to the Internet. If your computer goes to sleep or is restarted, or if you lose your Internet connection, you need to restart Internet sharing. To start Internet sharing on a computer using Mac OS X v10.5 or later: 1 Open System Preferences and click Sharing. 2 Choose the port you want to use to share your Internet connection from the Share your connection using pop-up menu. 3 Select the port you want to use to share your Internet connection in the To computers using list. You can choose to share your Internet connection with AirPort-enabled computers or computers with built-in Ethernet, for example. 4 Select Internet Sharing in the Services list.

5 If you want to share your Internet connection with computers using AirPort, click AirPort Options to give your network a name and password.
To start Internet sharing on a computer using Windows: 1 Open Control Panel from the Start menu, and then click Network and Internet. 2 Click Network and Sharing Center. 3 Click Manage network connections in the Tasks list. 4 Right-click the network connection you want to share, and then select Properties. 5 Click Sharing and then select Allow other network users to connect through this computers Internet connection.
Note: If your Internet connection and your local network use the same port (built-in Ethernet, for example), contact your ISP before you turn on Internet sharing. In some cases (if you use a cable modem, for example) you might unintentionally affect the network settings of other ISP customers, and your ISP might terminate your service to prevent you from disrupting its network. The following chapters explain AirPort security options, AirPort network design and setup, and other advanced options.

AirPort Security

This chapter provides an overview of the security features available in AirPort.
Apple has designed its wireless devices to provide several levels of security, so you can enjoy peace of mind when you access the Internet, manage online financial transactions, or send and receive email. The AirPort Extreme Base Station and Time Capsule also include a slot for inserting a lock to deter theft. For information and instructions for setting up these security features, see Setting Up the AirPort Extreme Network on page 17.
Security for AirPort Networks at Home
Apple gives you ways to protect your wireless AirPort network as well as the data that travels over it.

NAT Firewall

You can isolate your wireless network with firewall protection. Apple wireless devices have a built-in Network Address Translation (NAT) firewall that creates a barrier between your network and the Internet, protecting data from Internet-based IP attacks. The firewall is automatically turned on when you set up the device to share a single Internet connection. For computers with a cable or DSL modem, AirPort can actually be safer than a wired connection.

Closed Network

Creating a closed network keeps the network name and the very existence of your network private. Prospective users of your network must know the network name and password to access it. Use AirPort Utility, located in the Utilities folder in the Applications folder on a Macintosh computer using Mac OS X, or in Start > All Programs > AirPort on a computer using Windows, to create a closed network.
Password Protection and Encryption
AirPort uses password protection and encryption to deliver a level of security comparable to that of traditional wired networks. Users can be required to enter a password to log in to the AirPort network. When transmitting data and passwords, the wireless device uses up to 128-bit encryption, through either Wi-Fi Protected Access (WPA), WPA2, or Wired Equivalent Privacy (WEP), to scramble data and help keep it safe. If youre setting up an 802.11n-based AirPort device, you can also use WEP (Transitional Security Network) if both WEP-compatible and WPA/WPA2-compatible computers will join your network. Note: WPA security is available only to AirPort Extreme wireless devices; AirPort and AirPort Extreme clients using Mac OS X 10.3 or later and AirPort 3.3 or later; and to non-Apple clients using other 802.11 wireless adapters that support WPA. WPA2 security requires firmware version 5.6 or later for an AirPort Extreme Base Station, firmware version 6.2 or later for an AirPort Express, firmware version 7.3 or later for a Time Capsule, and a Macintosh computer with an AirPort Extreme wireless card using AirPort 4.2 or later. If your computer uses Windows XP or Windows Vista, check the documentation that came with your computer to see if your computer supports WPA2.

Security for AirPort Networks in Businesses and Classrooms
Businesses and schools need to restrict network communications to authorized users and keep data safe from prying eyes. To meet this need, Apple wireless devices and software provide a robust suite of security mechanisms. Use AirPort Utility to set up these advanced security features.
Transmitter Power Control
Because radio waves travel in all directions, they can extend outside the confines of a specific building. The Transmit Power setting in AirPort Utility lets you adjust the transmission range of your devices network. Only users within the network vicinity have access to the network.
MAC Address Access Control
Every AirPort and wireless card have a unique Media Access Control (MAC) address. For AirPort Cards and AirPort Extreme Cards, the MAC address is sometimes referred to as the AirPort ID. Support for MAC address access control lets administrators set up a list of MAC addresses and restrict access to the network to only those users whose MAC addresses are in the access control list.
Chapter 2 AirPort Security

RADIUS Support

The Remote Authentication Dial-In User Service (RADIUS) makes securing a large network easy. RADIUS is an access control protocol that allows a system administrator to create a central list of the user names and passwords of computers that can access the network. Placing this list on a centralized server allows many wireless devices to access the list and makes it easy to update. If the MAC address of a users computer (which is unique to each 802.11 wireless card) is not on your approved MAC address list, the user cannot join your network.
Wi-Fi Protected Access (WPA) and WPA2
There has been increasing concern about the vulnerabilities of WEP. In response, the Wi-Fi Alliance, in conjunction with the IEEE, has developed enhanced, interoperable security standards called Wi-Fi Protected Access (WPA) and WPA2. WPA and WPA2 use specifications that bring together standards-based, interoperable security mechanisms that significantly increase the level of data protection and access control for wireless LANs. WPA and WPA2 provide wireless LAN users with a high-level assurance that their data remains protected and that only authorized network users can access the network. A wireless network that uses WPA or WPA2 requires all computers that access the wireless network to have WPA or WPA2 support. WPA provides a high level of data protection and (when used in Enterprise mode) requires user authentication. The main standards-based technologies that constitute WPA include Temporal Key Integrity Protocol (TKIP), 802.1X, Message Integrity Check (MIC), and Extensible Authentication Protocol (EAP). TKIP provides enhanced data encryption by addressing the WEP encryption vulnerabilities, including the frequency with which keys are used to encrypt the wireless connection. 802.1X and EAP provide the ability to authenticate a user on the wireless network. 802.1X is a port-based network access control method for wired as well as wireless networks. The IEEE adopted 802.1X as a standard in August 2001. The Message Integrity Check (MIC) is designed to prevent an attacker from capturing data packets, altering them, and resending them. The MIC provides a strong mathematical function in which the receiver and the transmitter each compute and then compare the MIC. If they do not match, the data is assumed to have been tampered with and the packet is dropped. If multiple MIC failures occur, the network may initiate countermeasures.

The EAP protocol known as TLS (Transport Layer Security) presents a users information in the form of digital certificates. A users digital certificates can comprise user names and passwords, smart cards, secure IDs, or any other identity credentials that the IT administrator is comfortable using. WPA uses a wide variety of standards-based EAP implementations, including EAP-Transport Layer Security (EAP-TLS), EAP-Tunnel Transport Layer Security (EAP-TTLS), and Protected Extensible Authentication Protocol (PEAP). AirPort Extreme also supports the Lightweight Extensible Authentication Protocol (LEAP), a security protocol used by Cisco access points to dynamically assign a different WEP key to each user. AirPort Extreme is compatible with Ciscos LEAP security protocol, enabling AirPort users to join Cisco-hosted wireless networks using LEAP. In addition to TKIP, WPA2 supports the AES-CCMP encryption protocol. Based on the very secure AES national standard cipher, combined with sophisticated cryptographic techniques, AES-CCMP was specifically designed for wireless networks. Migrating from WEP to WPA2 requires new firmware for the AirPort Extreme Base Station (version 5.6 or later), and for AirPort Express (version 6.2 or later). Devices using WPA2 mode are not backward compatible with WEP. WPA and WPA2 have two modes: Personal mode, which relies on the capabilities of TKIP or AES-CCMP without requiring an authentication server Enterprise mode, which uses a separate server, such as a RADIUS server, for user authentication

WPA and WPA2 Personal

For home or Small Office/Home Office (SOHO) networks, WPA and WPA2 operates in Personal mode, taking into account that the typical household or small office does not have an authentication server. Instead of authenticating with a RADIUS server, users manually enter a password to log in to the wireless network. When a user enters the password correctly, the wireless device starts the encryption process using TKIP or AES-CCMP. TKIP or AES-CCMP takes the original password and derives encryption keys mathematically from the network password. The encryption key is regularly changed and rotated so that the same encryption key is never used twice. Other than entering the network password, the user isnt required to do anything to make WPA or WPA2 Personal work in the home.

WPA and WPA2 Enterprise

WPA is a subset of the draft IEEE 802.11i standard and effectively addresses the wireless local area network (WLAN) security requirements for the enterprise. WPA2 is a full implementation of the ratified IEEE 802.11i standard. In an enterprise with IT resources, WPA should be used in conjunction with an authentication server such as RADIUS to provide centralized access control and management. With this implementation in place, the need for add-on solutions such as virtual private networks (VPNs) may be eliminated, at least for securing wireless connections in a network. For more information about setting up a WPA or WPA2 protected network, see Using Wi-Fi Protected Access on page 45.

Setting up a Guest Network
Click Guest Network and then enter the network name and other options for the guest network. When you set up a guest network, a portion of your connection to the Internet is reserved for guests wireless clients that can join the guest network and , connect to the Internet without accessing your private network.
Select Allow guest network clients to communicate with each other to allow client computers to share files and services with each other while theyre connected to the guest network. Make sure sharing services are set up on the client computers.
Configuring and Sharing Internet Access
The next step is setting up your wireless devices Internet connection and sharing its Internet access with client computers. The following sections tell you what to do, depending on how your device connects to the Internet.
Youre Using a DSL or Cable Modem
In most cases, you can implement this network design using AirPort Utility and following the onscreen instructions to set up your wireless device and network. You need to use AirPort Utility to manually set up your device only if you want to set up or adjust optional advanced settings.

What It Looks Like

to Ethernet port

2.4 or 5 GHz

Time Capsule

< Ethernet WAN port

DSL or cable modem

to Internet

How It Works The Apple wireless device (in this example, a Time Capsule) connects to the Internet through its Internet WAN (<) connection to your DSL or cable modem. Computers using AirPort or computers connected to the wireless devices Ethernet LAN port (G) connect to the Internet through the device. The device is set up to use a single, public IP address to connect to the Internet, and uses DHCP and NAT to share the Internet connection with computers on the network using private IP addresses. AirPort computers and Ethernet computers communicate with one another through the wireless device. Important: Connect Ethernet computers that are not connected to the Internet to the devices LAN port (G) only. Since the device can provide network services, you must set it up carefully to avoid interfering with other services on your Ethernet network. What You Need for a DSL or Cable Modem Connection

If you chose PPPoE, your ISP provides your IP address automatically using DHCP.
Contact your service provider for the information you should enter in these fields.
Use this pop-up menu if you need to adjust the speed of the Ethernet WAN port.
If your service provider asks you for the MAC address of your wireless device, use the address of the Ethernet WAN port (<), printed on the label on the bottom of the device. If youve already used AirPort Utility to set up your wireless device, the fields below the Configure IPv4 pop-up menu may already contain the information appropriate for your service provider. You can change the WAN Ethernet speed if you have specific requirements for the network youre connected to. In most cases, the settings that are configured automatically are correct. Your service provider should be able to tell you if you need to adjust these settings. Changing the WAN Ethernet speed can affect the way the wireless device interacts with the Internet. Unless your service provider has given you specific settings, use the automatic settings. Entering the wrong settings can affect network performance.
If you configure TCP/IP using DHCP, choose Using DHCP from the Configure IPv4 pop-up menu. Your IP information is provided automatically by your ISP using DHCP.
Your service provider may require you to enter information in these fields.
5 If you chose PPPoE from the Connect Using pop-up menu, enter the PPPoE settings your service provider gave you. Leave the Service Name field blank unless your service provider requires a service name. Note: With AirPort, you dont need to use a third-party PPPoE connection application. You can connect to the Internet using AirPort.
If youre connecting to the Internet through a router that uses PPPoE to connect to the Internet, and your wireless device is connected to the router via Ethernet, you do not need to use PPPoE on your device. Choose Ethernet from the Connect Using pop-up menu in the Internet pane, and deselect the Distribute IP addresses checkbox in the Network pane. Because your router is distributing IP addresses, your wireless device doesnt need to. More than one device on a network providing IP addresses can cause problems. 6 Click PPPoE to set PPPoE options for your connection.
Choose Always On, Automatic, or Manual, depending on how you want to control when your wireless device is connected to the Internet. If you choose Always On, your device stays connected to your modem and the Internet as long as the modem is turned on. If you choose Automatic, the wireless device connects to the modem, which connects to the Internet when you use an application that requires an Internet connection, such as email or an instant message or web application. If you choose Manual, you need to connect the modem to the Internet when you use an application that requires an Internet connection. If you chose Automatic or Manual from the Connection pop-up menu, you need to choose an increment, such as 10 minutes, from the Disconnect if idle pop-up menu. If you dont use an Internet application after the increment of time has passed, youll be disconnected from the Internet. Note: If your wireless device is connected to your modem using an Ethernet LAN port, and your modem is connected to the Internet using PPPoE, you may not be able to use the manual setting.

Enter Domain Name System (DNS) server addresses and a specific domain name your wireless device accesses when you connect to the Internet. 7 Click the Network button and configure how the device will share its Internet access with AirPort and Ethernet computers. If you chose Ethernet from the Connect Using pop-up menu, choose how your device will share the Internet connection from the Connection Sharing pop-up menu.
To share a single Internet connection with AirPort computers and computers connected to the device with Ethernet using DHCP and NAT, choose Share a public IP address from the Connection Sharing pop-up menu. Using DHCP and NAT lets the wireless device dynamically and automatically assign IP addresses to client computers, which simplifies each computers TCP/IP configuration. See Setting DHCP and NAT Options on page 31. By default, the wireless device allows other devices, computers using Ethernet, and computers using AirPort to communicate with each other using non-IP protocols like AppleTalk. If you want to connect an AppleTalk Ethernet printer to the Apple wireless device or use AppleTalk between wired and wireless computers, make sure the devices are connected to the Ethernet LAN port (G) on the device. To distribute a range of IP addresses using only DHCP, choose Distribute a range of IP addresses. See Setting DHCP Only Options on page 33.
If you dont want your wireless device to share its IP address, choose Off (Bridge Mode). If you set up your device in bridge mode, AirPort computers have access to all services on the Ethernet network, and the device does not provide Internet sharing services. See Youre Using an Existing Ethernet Network on page 37 for more information about setting up your wireless device as a bridge. Using the wireless device as a bridge can be a way to address incompatibilities between the devices Internet sharing features and your ISPs connection method. Setting DHCP and NAT Options If you chose Share a public IP address from the Connection Sharing pop-up menu, you can set DHCP and NAT options. Click DHCP.
Choose a range of IP addresses from the DHCP Range pop-up menu. Choose 10.0, 192.168, or 172.16 and then enter a beginning and ending address in the DHCP Beginning Address and the DHCP Ending Address fields, depending on which addresses you want the wireless device to provide. Enter a number in the DHCP Lease field, and then choose minutes, hours, or days from the pop-up menu. Type a welcome message in the DHCP Message field. This message is displayed when a computer joins your network. If your network is set up to use a Lightweight Directory Access Protocol (LDAP) server on your network, you can enter the address of the server in the LDAP Server field, and computers on your network will have access to it.

Next, choose DHCP from the Configure IPv4 pop-up menu.
b If you enabled a DHCP server when you set up the wireless devices network, and the client computer is using Ethernet, select Ethernet in the network connection services list, and then choose Using DHCP from the Configure pop-up menu.
c If you selected Distribute a range of IP addresses when you set up the wireless devices network, you can provide Internet access to client computers using Ethernet by setting the client IP addresses manually. Select Ethernet in the network connection services list, and then choose Manually from the Configure pop-up menu.
Enter the IP and router addresses from the range your device is providing. Enter the DNS and Search Domain addresses if necessary.
When you configure Ethernet clients manually for a wireless device that provides NAT over Ethernet, you can use IP addresses in the range 10.0.1.2 to 10.0.1.200. In the Subnet Mask field, enter 255.255.255.0. In the Router field, enter 10.0.1.1. Enter the same name server address and search domain information that you entered in the wireless device configuration. To configure TCP/IP on client computers using Windows Make sure youve installed the wireless adapter in your computer and the software necessary to set up the adapter. To configure TCP/IP on client computers: 1 Open Control Panel from the Start menu, and then click Network and Internet. 2 Click Network and Sharing Center. 3 Click Manage network connections in the Tasks list. 4 Right-click the wireless connection you want to share, and then select Properties.
5 Click Internet Protocol Version 4 (TCP/IPv4), and then click Properties. If you chose Share a public IP address in the Network pane of AirPort Utility, select Obtain an IP address automatically.
If you chose Distribute a range of IP addresses when you set up the wireless devices network, you can provide Internet access to client computers by setting the client IP addresses manually. Select Use the following IP address.
When you configure clients manually for a wireless device that provides NAT service, use IP addresses in the range 10.0.1.2 to 10.0.1.200, 172.16.1.2 to 172.16.1.200, or 192.168.1.2 to 192.168.1.200. In the Subnet mask field, enter 255.255.255.0. In the Default gateway field, enter 10.0.1.1, 172.16.1.1, or 192.168.1.1, depending on which addressing scheme you used. Enter the same name server address and search domain information that you entered in the wireless device configuration.
Youre Using an Existing Ethernet Network
You can use AirPort Utility to easily set up the Apple wireless device for Internet access through an existing Ethernet network that already has a router, switch, or other network device providing IP addresses. Use the manual setup features of AirPort Utility if you need to adjust optional advanced settings. What It Looks Like

Setting Up Access Control Access control lets you specify which computers can send or receive information through the wireless device to the wired network. Each wireless-enabled computer has a unique MAC address. You can restrict access by creating an access control list that includes only the MAC addresses for computers you want to access your wired network. To find the MAC address (AirPort ID) of your computers AirPort Card, click the AirPort button in the Network pane of System Preferences. To set up the access control list: 1 Open AirPort Utility, select your wireless device, and then choose Base Station > Manual Setup. Enter the password if necessary. 2 Click the AirPort button, and then click Access. 3 Choose Timed Access or RADIUS from the MAC Address Access Control pop-up menu, depending on the device youre setting up.
If you choose Timed Access, click the Add (+) button and enter the MAC address and description or name of the computers youre allowing to access the network. You can also click This Computer to add the MAC address and name of the computer youre using to set up this wireless device. Double-click the computer in the list and choose a value from each pop-up menu. Choose a day of the week or Everyday from the day pop-up menu, and then choose either all day or between from the other pop-up menu. If you choose between, you can edit the times of the day by double-clicking in the time fields.
If you choose RADIUS, enter the type of RADIUS service, the RADIUS IP addresses, shared secret, and primary port for the primary RADIUS server. Enter the information for the secondary RADIUS server if there is one. Check with the server administrator if you dont have that information. Important: AirPort access control prevents computers that arent on the access control list from accessing the AirPort network. For information on how to prevent unauthorized computers from joining the AirPort network, see Setting Up the AirPort Extreme Network on page 17. You can also add the MAC address of a third-party 802.11 wireless networking card to the access control list. Most third-party cards have the MAC address on a label attached to the metal case of the card. Access control is not compatible with WPA or WPA2 Enterprise mode. You can use either access control or WPA Enterprise in a network, but you cant use both. Using a RADIUS Server Using a RADIUS server on your network lets you authenticate MAC addresses (AirPort IDs) on a separate computer, so that each device on the network doesnt need to store the MAC addresses of computers that have access to the network. Instead, all the addresses are stored on a server that is accessed through a specific IP address. To set up authentication using a RADIUS server: 1 On the server, enter the MAC addresses of the computers that will access the network. 2 When the RADIUS server is set up, open AirPort Utility, select your wireless device, and then choose Base Station > Manual Setup, or double-click the device icon to open its configuration in a separate window. Enter the password if necessary. 3 Click AirPort, click Access, and then choose RADIUS from the MAC Address Access Control pop-up menu. 4 Choose a format from the RADIUS pop-up menu. If you choose Default, your wireless device formats the MAC addresses as 0102030a0b0c, and they are used as the user names on the RADIUS server. The shared secret is the password for users joining the network. This format is often used for Lucent and Agere servers. If you choose Alternate, MAC addresses are formatted as 0102030a0b0c and are used for both the user name and password by users joining the network. This format is often used for Cisco servers.

5 Enter the IP address, port, and shared secret (or password) for the primary and secondary servers.
See the RADIUS documentation that came with your server, or check with the network administrator for more information on setting up the RADIUS server. The access control list and RADIUS work together. When a user tries to join a network that authenticates using access control or a RADIUS server, the wireless device searches first in the access control list, and if the MAC address is there, the user can join the network. If the MAC address is not in the access control list, the device checks the RADIUS server for the MAC address. If it is there, the user can join the network. Note: RADIUS access control is not compatible with WPA or WPA2 Personal mode. You can use either RADIUS access control or WPA Enterprise in a network, but you cant use both.
Directing Network Traffic to a Specific Computer on Your Network (Port Mapping)
AirPort Extreme uses Network Address Translation (NAT) to share a single IP address with the computers that join the AirPort Extreme network. To provide Internet access to several computers with one IP address, NAT assigns private IP addresses to each computer on the AirPort Extreme network, and then matches these addresses with port numbers. The wireless device creates a port-to-private IP address table entry when a computer on your AirPort (private) network sends a request for information to the Internet.
If youre using a web, AppleShare, or FTP server on your AirPort Extreme network, other computers initiate communication with your server. Because the Apple wireless device has no table entries for these requests, it has no way of directing the information to the appropriate computer on your AirPort network. To ensure that requests are properly routed to your web, AppleShare, or FTP server, you need to establish a permanent IP address for your server and provide inbound port mapping information to your Apple wireless device. To set up inbound port mapping: 1 Open AirPort Utility, select your wireless device, and then choose Base Station > Manual Setup, or double-click the device icon to open its configuration in a separate window. Enter the password if necessary. 2 Click the Advanced button, and then click Port Mapping.
3 Click the Add (+) button and choose a service, such as Personal File Sharing, from the Service pop-up menu.

USB hard disk DSL or cable modem
To share a hard disk on your network: 1 Plug the hard disk into the USB port on the back of the AirPort Extreme Base Station or Time Capsule. 2 Open AirPort Utility, located in the Utilities folder in the Applications folder on a Mac, or in Start > All Programs > AirPort on a Windows computer. 3 Select your AirPort Extreme Base Station or your Time Capsule, and then choose Base Station > Manual Setup, or double-click the device icon to open its configuration in a separate window. Enter the password if necessary. 4 Click the Disks button, and then click File Sharing. 5 Choose With a disk password, or With base station password if you want to secure the shared disk with a password, or choose With accounts if you want to secure the disk using accounts. If you choose to use accounts, click Configure Accounts, click the Add (+) button, and then enter a name and password for each user that will access the disk. 6 Choose Not allowed, Read only, or Read and write to assign guest access to the disk. 7 Select the Share disks over Ethernet WAN port checkbox if you want to provide remote access to the disk over the WAN port. Data transfer speed may vary, depending on the network.
Using a Time Capsule in Your Network
If youre using a Time Capsule and a computer with Mac OS X Leopard (v10.5.2 or later), you can use Time Machine to automatically back up all of the computers on the network that are using Leopard. Other Mac computers and Windows computers can access the Time Capsules internal AirPort disk to back up, store, and share files. And because every Time Capsule is also a full-featured 802.11n base station, you can set up your Time Capsule to share an Internet connection with computers on the AirPort network it creates.
For information about using your Time Capsule with Time Machine in Mac OS X Leopard, search for Time Capsule in Mac Help.
Connecting a USB Printer to an Apple Wireless Device
You can connect a compatible USB printer to your Apple wireless device (an AirPort Extreme Base Station, AirPort Express, or Time Capsule), so that anyone on the network using Mac OS X v10.2.3 or later, Windows XP with Service Pack 2, or Windows Vista can print to that printer. To use a printer on your network: 1 Connect the printer to the USB port on the Apple wireless device. 2 Set up the client computers: On a computer using Mac OS X v10.5 or later, open System Preferences and click Print & Fax. Select the printer from the Printers list. If the printer isnt in the list, click Add (+) at the bottom of the list, locate the printer, and then click Add. On a computer using Mac OS X v10.2.3 or later, open Printer Setup Utility located in the Utilities folder in the Applications folder, and then select the printer from the list. If the printer is not in the list, click Add, choose Bonjour from the pop-up menu, and then select the printer from the list.

Using the AirPort Express
This section describes the different network interfaces of the AirPort Express Base Station and describes the functions the base station can provide.
AirPort Express Interfaces
To set up the AirPort Express Base Station, you configure how its networking interfaces will be used. The AirPort Express Base Station has four hardware networking interfaces: AirPort interface: The AirPort interface creates an AirPort network for AirPortenabled computers to join. The base station can provide IP services such as DHCP and NAT using this interface. The base station cannot use the AirPort interface to establish a connection with the Internet. Ethernet WAN (<) interface: Use the Ethernet WAN interface to connect DSL or cable modems and connect to the Internet. USB (d) interface: Use the USB interface to connect a USB printer to the AirPort Extreme Base Station.
Audio (-) interface: Use the analog and optical digital audio stereo mini-jack to connect an AirPort Express to a home stereo or powered speakers.

AC plug adapter

G Ethernet port

- Line Out port

(Analog and optical digital audio mini-jack)
Apple Wireless Device Functions
Bridge: Each Apple wireless device is configured by default as a bridge between the wireless AirPort network and the wired Ethernet network. Connecting an AirPort network to an Ethernet network through the devices Ethernet LAN port (G) bridges the wireless AirPort network to the wired Ethernet network. Important: If youre connecting an Ethernet network to the devices Ethernet LAN port (G), make sure the Ethernet network does not have an Internet connection. NAT router: One of the most powerful features of Apple wireless devices is their ability to share one Internet connection with several computers. To provide this service, the device acts as a router. The device can be configured to provide both bridging services and routing services at the same time. DHCP server: When you configure the wireless device to act as a DHCP server, it provides IP addresses to both wired and wireless client computers that are configured to obtain IP addresses using DHCP. Using DHCP makes IP configuration simple for client computers, since they dont need to enter their own IP information.

How Wireless Internet Access Is Provided
Wireless Internet access requires an AirPort Card or an AirPort Extreme Card, an AirPort Extreme Base Station or AirPort Express, and an account with an Internet service provider (fees may apply). Some Internet service providers (ISPs) are not currently compatible with AirPort. Some cable modem and DSL providers may not be compatible with AirPort. Contact your service provider for more information. AirPort technology is similar to cordless telephone technology. The handset of the cordless phone makes a wireless connection to the base, which is connected to the telephone system. Likewise, with AirPort, your computer does not establish a wireless connection with your ISP directly. You set up a wireless connection from the computer to a base station that is connected to the Internet by a wire, such as a DSL or telephone line.
Chapter 1 Getting Started
LL0214.book Page 7 Monday, October 25, 2004 4:06 PM
Use AirPort to provide wireless Internet access and share a single Internet connection among multiple computers in the following ways: Connect the AirPort Extreme Base Station or AirPort Express to a DSL or cable modem. If you are using an AirPort Extreme Base Station that has an internal modem, you can connect it to a telephone line. Once connected to the Internet, the AirPort Extreme Base Station or AirPort Express receives webpages and email content from the Internet via its Internet connection and then sends it to AirPort-equipped computers, using the wireless network. Connect the AirPort Extreme Base Station or AirPort Express to an existing network that already has Internet access, such as in a school or small office. AirPort-equipped computers connect wirelessly to the base station and receive network and Internet content.
Configuring the AirPort Extreme Base Station and AirPort Express for Internet Access
Like your computer, the AirPort Extreme Base Station or AirPort Express must be set up with the appropriate hardware and Internet Protocol (IP) networking information to connect to the Internet. To provide the Internet configuration information to your AirPort Extreme Base Station or AirPort Express, you can use the AirPort Setup Assistant. The AirPort Setup Assistant asks a series of questions to determine how the base stations Internet connection and other interfaces should be set up. To set up more complex configurations, you use AirPort Admin Utility. For more information about the AirPort Setup Assistant and AirPort Admin Utility, see the following sections.

AirPort Setup Assistant

Use the AirPort Setup Assistant to enter the settings your AirPort Extreme Base Station or AirPort Express needs to connect to the Internet. Enter the settings you received from your ISP for Ethernet, PPP over Ethernet (PPPoE), or the internal modem if your base station has one. You can also give your AirPort network a name and password. You can use the AirPort Setup Assistant to set up a base station as a wireless bridge and extend the range of your existing AirPort Extreme or AirPort Express network. If you are using an AirPort Express, you can create a new wireless network or join an existing wireless network. If you connect AirPort Express to your stereo or powered speakers, you can set up your AirPort Express to play iTunes music using AirTunes. See Chapter 5, Using AirPort Express, on page 65 for more information. When you have finished entering the settings, the AirPort Setup Assistant transfers the settings to your base station and your base station shares its Internet connection with computers that join its AirPort network.

AirTunes

If you are using AirPort Express, and you have connected it to your stereo or powered speakers, you can play iTunes music on the stereo using AirTunes. AirTunes is an encoding technology that allows for CD-quality transmission of iTunes music over the air. You can stream music from your iTunes library to AirPort Express wirelessly, and AirPort Express plays the music on your stereo through cables connected to the analog and optical digital audio stereo mini-jack. The music is buffered to ensure smooth playback without skips or jumps. Anything you play in iTunesMP3 files, AAC files, audio books, even Dolby surroundsoundyou can play using AirTunes. To use AirTunes, you need an AirPort Express connected to your stereo or powered speakers, AirPort 4.0 or later, and iTunes 4.6 or later.
Printing via an AirPort Extreme Base Station or AirPort Express
If you have a USB printer connected to your AirPort Extreme Base Station or AirPort Express, computers on the AirPort network can print to the printer by selecting it via Rendezvous in Printer Setup Utility, located in Applications/Utilities. You must use Mac OS X version 10.2.3 or later to print to a USB printer via an AirPort Extreme Base Station. If your AirPort Extreme Base Station supports PoE, and is receiving power from an 802.3af-compliant PSE, you cannot connect a printer to it.
LL0214.book Page 10 Monday, October 25, 2004 4:06 PM
Sharing Your Computers Internet Connection
If you have an AirPort Card installed in your computer and you are connected to the Internet, you can share your Internet connection with other computers using Mac OS X version 10.2 or later. This is sometimes called using your computer as a software base station. You can share your Internet connection as long as your computer is connected to the Internet. If your computer goes to sleep or is restarted, or if you lose your Internet connection, you need to restart Internet sharing. To start Internet sharing: 1 Open System Preferences, click Sharing, and then click Internet. 2 Select how you would like to share your Internet connection, then click Start. You can choose to share your Internet connection with AirPort-equipped computers, computers with built-in Ethernet, or both.
Note: If your Internet connection and your local network use the same port (built-in Ethernet, for example), contact your ISP before you turn on Internet sharing. In some cases (if you use a cable modem, for example) you might unintentionally affect the network settings of other ISP customers, and your ISP might terminate your service to prevent you from disrupting its network.

If you have trouble connecting to the Internet, check these network and IP configurations on your computer first.

Chapter 2 Network Basics

LL0214.book Page 15 Monday, October 25, 2004 4:06 PM
Software Used for IP Networking in Mac OS X
Youll frequently use several preferences and applications on your computer for networking. Heres what each is used for: Network Preferences Use the Show pop-up menu to configure how you connect to the network or the Internet, for example via AirPort or Ethernet. Use the TCP/IP pane of Network preferences to configure your computer for IP networking. The information in this pane must be correct to connect to the Internet. To configure how you receive an IP address, for example manually or via DHCP, use the Configure IPv4 pop-up menu. Use the remaining fields to fill in the other information you need in order to connect to the Internet. Contact your ISP or network administrator for the information to type in these fields. Internet Connect Application Use the Internet Connect application to specify the phone number, user name, and password for making a dial-up connection to the Internet. If you use a dial-up connection to the Internet, the AirPort Setup Assistant transfers the settings in the Internal Modem portion of the Internet Connect application to the base station. If you use AirPort to connect to the Internet, choose AirPort from the Configuration pop-up menu. You also use Internet Connect to authenticate with or set up a network protected by 802.1X. AppleTalk AppleTalk is a protocol used in local networks. Use the AppleTalk pane of Network preferences to set up AppleTalk networking. Location Management Use the Location pop-up menu in Network preferences to manage sets of TCP/IP, AppleTalk, and Internet Connect configurations. After you create your locations, you can switch all of your network settings by choosing a location from the Location pop-up menu in Network preferences. For more information about network locations, see Mac OS Help, available in the Help menu.
LL0214.book Page 16 Monday, October 25, 2004 4:06 PM
Software Used for AirPort Networking in Mac OS X
Youll use different Mac OS X and AirPort applications to create and manage your wireless network. Heres what each is used for: Internet Connect Application Use the Internet Connect application to: Turn AirPort on or off Monitor the signal quality of the AirPort wireless connection Find the Base Station ID (the hardware address of your AirPort Extreme Base Station or AirPort Express) See the connection status of an AirPort Extreme Base Station that is configured to connect to a dial-up ISP Select an AirPort network Create or join a Computer-to-Computer network Join a closed network Join or set up an 802.1X protected network AirPort Status Menu Use the AirPort status icon in the menu bar to: Turn AirPort on or off Monitor the signal quality of the AirPort wireless connection Select an AirPort network Open the Internet Connect application Create or join a Computer-to-Computer network AirPort Setup Assistant Use the AirPort Setup Assistant to: Set up an AirPort Extreme Base Station or AirPort Express Extend the range of your AirPort Extreme or AirPort Express network Set up an AirPort Express to join an existing AirPort network Set up AirPort Express to play iTunes music on your stereo using AirTunes AirPort Admin Utility Use AirPort Admin Utility to set optional advanced settings and to: Download the base station configuration to your computer Modify the configuration on your base station Set advanced security options for the AirPort network Upload a modified configuration to the base station Upgrade the base station software

LL0214.book Page 17 Monday, October 25, 2004 4:06 PM

AirPort Security

This chapter provides an overview of the security features available in AirPort for Mac OS X.
Apple has designed the AirPort Extreme Base Station and AirPort Express to provide multiple levels of security, so you can enjoy peace of mind when you access the Internet, manage online financial transactions, or send and receive email. The AirPort Extreme Base Station also includes a slot for inserting a Kensington lock to deter theft. For information and instructions for setting up these security features, see Setting Up the AirPort Network on page 23.
Security for AirPort Networks at Home
Apple gives you ways to protect your wireless AirPort network as well as the data that travels over it.

Firewall

You can separate your wireless network from the outside world with firewall protection. The AirPort Extreme Base Station and AirPort Express have a built-in firewall that creates a barrier between your network and the Internet, protecting data from Internetbased IP attacks. The firewall is automatically turned on when you set up the base station to share a single Internet connection. For computers with a cable or DSL modem, AirPort can actually be safer than a wired connection.

Closed Network

Creating a closed network keeps the network name and the very existence of your network private. The network will not show up in a scan of available networks, so prospective users of your network must know the network name and password to access it. Use AirPort Admin Utility, located in Applications/Utilities, to create a closed network.
LL0214.book Page 18 Monday, October 25, 2004 4:06 PM
Password Protection and Encryption
AirPort uses password protection and encryption to deliver a level of security comparable to traditional wired networks. Users can be required to enter a password to log in to the AirPort network. When transmitting data and passwords, the base station uses up to 128-bit encryption, through either Wi-Fi Protected Access (WPA) or Wireless Equivalent Privacy (WEP), to scramble data and help keep it safe. Note: WPA security features are available only to AirPort Extreme Base Stations; AirPort Express; AirPort and AirPort Extreme clients using Mac OS X 10.3 or later and AirPort 3.3 or later, and to non-Apple clients using other 802.11 wireless adapters that support WPA. If youre using AirPort in conjunction with an America Online account, you can use AOL parental controls to further restrict access. The settings you configure are used for all clients connected to that base station.

iTunes Speaker Password

If you are using AirPort Express to play iTunes music on your stereo or powered speakers using AirTunes, you can password-protect the speaker name that is displayed in the speakers pop-up menu in iTunes. Anyone trying to play music from iTunes to the stereo or speaker will need to enter the password.

Security for AirPort Networks in Business and Education
Businesses, schools, colleges, and universities want to restrict network communications to authorized users and keep data safe from prying eyes, so AirPort Extreme hardware and software provide a robust suite of security mechanisms. Use AirPort Admin Utility to set up these advanced security features.
Transmitter Power Control
Because radio waves travel in all directions, they can extend outside the confines of a specific building. The Transmitter Power setting in AirPort Admin Utility lets you adjust the transmission range of your base stations network. Only users within the network vicinity have access to the network.

MAC Filtering

Every AirPort and wireless card has a unique MAC address. For AirPort and AirPort Extreme Cards, the MAC address is sometimes referred to as the AirPort ID. Support for MAC (Media Access Control) filtering lets administrators set up a list of MAC addresses and restrict access to the network to only those users whose MAC addresses are in the access control list.
Chapter 3 AirPort Security
LL0214.book Page 19 Monday, October 25, 2004 4:06 PM

RADIUS Support

The Remote Authentication Dial-In User Service (RADIUS) makes securing a large network easy. RADIUS is an access control protocol that allows a system administrator to create a central list of the computers that can access the network. Placing this list on a centralized server allows many base stations to access the list and makes it easy to update. If the MAC address of a users computer (which is unique to each 802.11 wireless card) is not on your approved MAC address list, the user cannot join your network.

LEAP Support

The Lightweight Extensible Authentication Protocol (LEAP) is a security protocol used by Cisco access points to dynamically assign a different WEP key to each user. AirPort Extreme is compatible with Ciscos LEAP security protocol, enabling AirPort users to join Cisco-hosted wireless networks using LEAP.
Wi-Fi Protected Access (WPA)
There has been increasing concern about the vulnerabilities of WEP. In response, the Wi-Fi Alliance, in conjunction with the IEEE, has developed a strongly enhanced, interoperable security standard called Wi-Fi Protected Access (WPA). WPA is a specification that brings together standards-based, interoperable security mechanisms that strongly increase the level of data protection and access control for wireless LANs. WPA provides wireless LAN users with a high level of assurance that their data remains protected and that only authorized network users can access the network. A wireless network that uses WPA requires that all computers that access the wireless network have WPA support. It provides a high level of data protection and (when used in Enterprise mode) requires user authentication. The main standards-based technologies that comprise WPA include Temporal Key Integrity Protocol (TKIP), 802.1X, Message Integrity Check (MIC), and Extensible Authentication Protocol (EAP). TKIP provides enhanced data encryption by addressing the WEP encryption vulnerabilities, including the frequency with which keys are used to encrypt the wireless connection. 802.1X and EAP provide the ability to authenticate a user on the wireless network. 802.1X is a port-based network access control method for wired as well as wireless networks. The IEEE adopted 802.1X as a standard in August 2001.

The base station password protects the base station configuration so that only the administrator can modify it. The default password is public. It is a good idea to change the base station password to prevent unauthorized changes to the base station. If the base station password is not changed from public, you will not be prompted for a password when you select it from the Select Base Station list and click Configure.
Naming the AirPort Network
Give your AirPort network a name. This name appears in the AirPort status menu on the AirPort-equipped computers that are in range of your AirPort network.
LL0214.book Page 25 Monday, October 25, 2004 4:06 PM
Password-Protecting Your Network
To password-protect your network, you can choose from a number of wireless security options. In the AirPort pane of AirPort Admin Utility, click Change Wireless Security and choose one of the following options: Not Enabled Choosing this option turns off all password protection for the network. Any computer with a wireless adapter or card can join the network, unless the network is set up to use access control. See Setting Up Access Control on page 58. 128 bit or 40 bit WEP Choose either of these options to protect your network with a Wireless Equivalent Protection password. Your AirPort Extreme Base Station and AirPort Express support 40-bit and 128-bit encryption. Choose standard 40-bit encryption for maximum compatibility, or choose 128-bit encryption, which provides more WEP security. If you choose 128-bit encryption, only computers with 128-bit encryption-capable wireless networking cards will be able to join your network. If you choose 40-bit encryption, computers with 40-bit and 128-bit encryption-capable wireless networking cards will be able to join your wireless network, but they will join with only 40-bit encryption.
WPA Personal Choose this option and enter a password for the wireless network.
When a wireless client enters the password correctly, the base station starts the encryption process using TKIP. The password you choose can be between 8 and 63 ASCII characters, or if you choose to enter a Pre-Shared Key, it must be exactly 64 hexadecimal characters.
WPA Enterprise Choose this option if you are setting up a network that includes a
RADIUS server with individual user accounts. Enter the IP address and port number for the RADIUS server, and enter a shared secret, which is the password for the server.
Note: WPA security features are available only to AirPort Extreme Base Stations; AirPort Express; AirPort and AirPort Extreme clients using Mac OS X 10.3 or later and AirPort 3.3 or later, and clients using other 802.11 wireless adapters that support WPA. For more information and instructions for setting up WPA on your network, see Using Wi-Fi Protected Access (WPA) on page 56.

LL0214.book Page 26 Monday, October 25, 2004 4:06 PM
Joining a 128-Bit Encrypted Wireless Network If you want to join a wireless network that requires 128-bit encryption, you have two options for entering a password, depending on the password scheme the network administrator has set up. If you were given a password that is 13 characters, enter it exactly. Thirteen-character passwords are usually case-sensitive. Example: password12345 If you were given a password that is 26 characters, put a dollar sign ($) before the password. Twenty-six-character passwords may be case-sensitive. Example: $12345678901234567890abcdef If you need additional information on your 128-bit password, contact your network administrator. Joining a WPA Personal Network If you want to join a wireless network that is protected by WPA Personal (also known as Pre-Shared Key), you must enter either an ASCII password of 8 to 63 ASCII characters, or a hexadecimal password of exactly 64 hexadecimal characters. Check with your system administrator to find out which to use. Joining a WPA Enterprise Network If you are joining a WPA Enterprise network, you were probably given an Internet Connect configuration file that contains network settings specific to the network you want to join. Double-click the configuration file to open it in Internet Connect. If prompted, enter the user name and password you were given for the network, and if necessary, choose the network from the Wireless Network pop-up menu. Once the network settings are in Internet Connect, you should be able to choose the WPA Enterprise network from the AirPort status menu. You may be prompted for your user name and password. Some authentication protocols, such as TLS, require a digital certificate to authenticate the user before joining the network. If your network administrator gave you a digital certificate file, open it in Keychain Access (located in Applications/Utilities), authenticate your network credentials, and join the network. Check with your network administrator for more information about digital certificates and joining a WPA Enterprise network.

Youre Using a DSL or Cable Modem
In most cases, you can implement this network design with the AirPort Setup Assistant. You only need to use AirPort Admin Utility to adjust optional advanced base station settings. What It Looks Like
AirPort Extreme Base Station

Cable/DSL modem

To the Internet
LL0214.book Page 30 Monday, October 25, 2004 4:06 PM
How It Works The AirPort Extreme Base Station connects to the Internet through its Ethernet WAN ( ) connection to your DSL or cable modem. AirPort Express connects to the modem through it Ethernet port. Computers using AirPort or computers connected to the AirPort Extreme Base Stations Ethernet LAN (G) port connect to the Internet through the base station. AirPort computers and Ethernet computers communicate with one another through the base station. Important: Connect Ethernet computers that are not connected to the Internet to the AirPort Extreme Base Stations LAN (G) port only. Since the base station can provide network services, you must set it up carefully to avoid interfering with other services on your Ethernet network. What You Need for a DSL or Cable Modem Connection
Components Internet account with cable modem or DSL service provider Check Comments Does your service provider use a You can get this information static IP or DHCP configuration? from your service provider or the Network preferences pane on the computer you use to access the Internet through this service provider. Place the base station near your DSL or cable modem. If you want to add more than one computer to your network using Ethernet, you need an Ethernet hub.
AirPort Extreme Base Station or AirPort Express Optional Ethernet hub

Check

What to Do If you are using the AirPort Setup Assistant to configure the AirPort Extreme Base Station or AirPort Express for Internet access: 1 Open the setup assistant, located in Applications/Utilities. 2 Follow the onscreen instructions and enter the settings for your service provider. If you are using AirPort Admin Utility: 1 Make sure that your DSL or cable modem is connected to the Ethernet WAN ( ) port on your base station. 2 Open AirPort Admin Utility, located in Applications/Utilities. Select your base station and click Configure.
LL0214.book Page 31 Monday, October 25, 2004 4:06 PM

Joining an AirPort Network To join your AirPort network, clients can choose the network from the AirPort status menu in the menu bar.
LL0214.book Page 43 Monday, October 25, 2004 4:06 PM
Youre Using a Dial-Up Internet Service Provider (ISP)
If your AirPort Extreme Base Station came with an internal modem, you can set up its connection to the Internet with the AirPort Setup Assistant. You only need to use AirPort Admin Utility to adjust optional advanced base station settings, such as port mapping, advanced security options, or controlling access to your AirPort network. What It Looks Like
Phone jack (to the Internet)
How It Works The base station connects to your ISP and the Internet using its internal modem. Computers using AirPort or computers connected to the base stations Ethernet LAN (G) port can connect to the Internet through the AirPort Extreme Base Station. AirPort computers and Ethernet computers communicate with one another through the base station using AppleTalk and other networking protocols.
LL0214.book Page 44 Monday, October 25, 2004 4:06 PM
What You Need for a Dial-Up Connection
Components Working dial-up ISP account using standard PPP Check Make sure you have the following: ISP phone number account name and password DNS address other information your ISP may provide Comments You can get this information (except the account password) from the Internet Connect application and Network preferences on the computer you use to access the Internet. If Network preferences on your computer doesnt have DNS information, you may not need to provide DNS information in the AirPort Setup Assistant. Place the base station near a phone jack and power outlet. If you want to add more than one computer to your network using Ethernet, you need an Ethernet hub.
AirPort Extreme Base Station with an internal modem Optional Ethernet hub
What to Do If you are using the AirPort Setup Assistant to configure the AirPort Extreme Base Station for Internet access: 1 Open the AirPort Setup Assistant, located in Applications/Utilities. 2 Follow the onscreen instructions and enter the phone number and other account information for your ISP.
LL0214.book Page 45 Monday, October 25, 2004 4:06 PM
If you are using AirPort Admin Utility to configure the AirPort Extreme Base Station or AirPort Express for Internet access: 1 Open AirPort Admin Utility, located in Applications/Utilities. Select your base station and click Configure. 2 Click Internet and choose Modem (V.90) from the Connect using pop-up menu if you are connecting to an ISP. Enter the phone number and other account information. The DNS servers and Domain name information may be optional; check with your ISP.

LL0214.book Page 59 Monday, October 25, 2004 4:06 PM
Using a RADIUS Server Using a RADIUS (Remote Authentication Dial-In User Service) server on your network lets you authenticate MAC addresses (AirPort IDs) on a separate computer, so that each base station on the network doesnt need to store the MAC addresses of computers that have access to the network. Instead, all the addresses are stored on a server that is accessed through a specific IP address. To set up authentication using a RADIUS server: 1 On the server, enter the MAC addresses of the computers that will access the network. 2 When the RADIUS server is set up, open AirPort Admin Utility, select your base station, and click Configure. 3 Click Access Control. 4 Choose a format from the RADIUS pop-up menu. If you choose Default, the base station formats the MAC addresses as 010203-0a0b0c and they are used as the user names on the RADIUS server. The shared secret is the password for users joining the network. This format is often used for Lucent and Agere servers. If you choose Alternate, MAC addresses are formatted as 0102030a0b0c and are used for both the user name and password by users joining the network. This format is often used for Cisco servers. 5 Enter the IP address, port, and shared secret (or password) for the primary and secondary servers. See the RADIUS documentation that came with your server, or check with the network administrator for more information on setting up the RADIUS server. The access control list and RADIUS work together. When a user tries to join a network that authenticates using access control or a RADIUS server, the base station looks first in the access control list, and if the MAC address is there the user can join the network. If the MAC address is not in the access control list, the base station checks the RADIUS server for the MAC address. If it is there, the user can join the network. Note: RADIUS access control is not compatible with WPA Enterprise mode. You can use either RADIUS access control or WPA Enterprise in a network, but you cant use both.

Using Port Mapping

Solving Problems

If you have trouble connecting to the Internet with any AirPort network design, try the following: Make sure the base station is connected to the Internet. The computers on your AirPort network cannot connect to the Internet if your base station is not connected to the Internet. Check your Internet connection using your computer. If you cant connect with your computer, the problem may be with your Internet connection. Check the active network ports by choosing Active Network Ports from the Show pop-up menu in the Network pane of System Preferences. Make sure the ports you want to use are selected.
LL0214.book Page 63 Monday, October 25, 2004 4:06 PM
Open Internet Connect (in the Applications folder on the hard disk) and choose
AirPort from the Configuration pop-up menu.
Check to make sure that the computer has joined the AirPort network created by

your base station.

Restart your computer. This renews the IP address you receive from the base station.
The IP addresses should be in the range of 10.0.1.2 to 10.0.1.200, 172.16.1.2 to 172.16.1.200, or 192.168.1.2 to 192.168.1.200, depending on the address scheme the base station uses. If the base station is set up as a DHCP server, make sure the Distribute IP addresses checkbox is selected in the Network pane of AirPort Admin Utility. If you are using a cable modem and your base station cannot connect to the Internet, turn off the cable modem, wait a few minutes and then turn it back on.
More Information About AirPort
You can find more information about AirPort in the following locations: AirPort Help Look in AirPort Help for information on setting up an AirPort network, using an AirPort Extreme Base Station or AirPort Express, editing base station settings, avoiding sources of interference, locating additional information on the Internet, and more. Choose Help > Mac Help, and then choose Library > AirPort Help.

World Wide Web

Apple AirPort website at www.apple.com/airportextreme Apple AirPort Express website at www.apple.com/airport Apple Support website at www.apple.com/support
LL0214.book Page 64 Monday, October 25, 2004 4:06 PM
LL0214.book Page 65 Monday, October 25, 2004 4:06 PM

Using AirPort Express

This chapter provides information and instructions for using the AirPort Setup Assistant to set up your AirPort Express.

LL0214.book Page 73 Monday, October 25, 2004 4:06 PM
5 Click Status Light, and choose a setting from the Status Light pop-up menu.
Using Ethernet to Play iTunes Music on AirPort Express You can enable AirTunes over Ethernet. This allows you to play iTunes music on the stereo or powered speakers connected to your AirPort Express from computers connected by Ethernet. To use Ethernet to play iTunes Music: Make sure your AirPort Express is connected to your computer using Ethernet, and to your stereo or powered speakers with an audio cable. 1 Open AirPort Admin Utility, select your AirPort Express, and click Configure. 2 Click Music, and select the Enable AirTunes over the Ethernet port checkbox. Setting Up and Managing Configuration Profiles AirPort Express can store up to 5 different configurations, known as profiles. A profile contains settings for your AirPort Express, such as the iTunes speaker name and password, and network information, such as network name and password. To create a new profile: 1 Open AirPort Admin Utility, located in Applications/Utilities. 2 Select your AirPort Express in the list and click Configure. 3 Click the Profiles icon in the toolbar. 4 Click Add to create a new profile, give the profile a name, then click OK.
LL0214.book Page 74 Monday, October 25, 2004 4:06 PM
5 Set options, such as network name, remote speaker name, passwords, and the Internet connection method. 6 When you are finished setting the options, click Update.
To edit an existing profile: 1 Open AirPort Admin Utility, located in Applications/Utilities. 2 Select your AirPort Express in the list and click Configure. 3 Click the Profiles icon in the toolbar. 4 Select a profile in the list and click OK. 5 Edit options for the profile. When you are finished editing the options, click Update to save the profile.
LL0214.book Page 75 Monday, October 25, 2004 4:06 PM

Behind the Scenes

This chapter defines terms and concepts used when working with computer networks. Use it as a reference to help you understand what is taking place behind the scenes of your AirPort wireless network.

Basic Networking

Packets and Traffic Information travels across a network in chunks called packets. Each packet has a header that tells where the packet is from and where its going, like the address on the envelope when you send a letter. The flow of all these packets on the network is called traffic.
How Information Reaches Its Destination
Hardware Addresses Your computer listens to all of the traffic on its local network and selects the packets that belong to it by checking for its hardware address (also called the media access control, or MAC address) in the packet header. This address is a number unique to your computer. Every hardware product used for networking is required to have a unique hardware address permanently embedded in it. Your AirPort Cards number is called the AirPort ID. IP Addresses Since the Internet is a network of networks (connecting millions of computers), hardware addresses alone are not enough to deliver information on the Internet. It would be impossible for your computer to find its packets in all the worlds network traffic, and impossible for the Internet to move all traffic to every network.

This section describes the different network interfaces of the AirPort Express and describes the functions the base station can provide.
AirPort Express Interfaces
AirPort Express has three ports, located on the bottom side: Ethernet port (G) for connecting a DSL or cable modem, or for connecting to an existing Ethernet network Analog and optical digital audio stereo mini-jack (-) for connecting AirPort Express to a home stereo or powered speakers USB port ( ) for connecting a compatible printer to AirPort Express

Status light

AC plug adapter USB port Reset button

Ethernet port

Line Out port (Analog and optical digital audio mini-jack)
Next to the ports is a reset button, which is used for troubleshooting your AirPort Express. The status light on the side of AirPort Express shows the current status.
LL0214.book Page 80 Monday, October 25, 2004 4:06 PM
Items That Can Cause Interference With AirPort
The farther away the interference source, the less likely it is to cause a problem. The following items can cause interference with AirPort communication: Microwave ovens DSS (Direct Satellite Service) radio frequency leakage The original coaxial cable that came with certain types of satellite dishes. Contact the device manufacturer and obtain newer cables. Certain electrical devices, such as power lines, electrical railroad tracks, and power stations Cordless telephones that operate in the 2.4 gigahertz (GHz) range. If you have problems with your phone or AirPort communication, change the channel of your base station. Other AirPort networks Adjacent base stations using nearby channels. If base station A is set to channel 1, base station B should be set to channel 4 or higher. Moving objects that temporarily place metal between your computer and the base station
LL0214.book Page 81 Monday, October 25, 2004 4:06 PM
www.apple.com/airportextreme www.apple.com/airport www.apple.com/support/airport
2004 Apple Computer, Inc. All rights reserved.
Apple, the Apple logo, AirPort, AppleShare, AppleTalk, Mac, and Mac OS are trademarks of Apple Computer, Inc., registered in the U.S. and other countries. AirPort Express, AirTunes, and Rendezvous are trademarks of Apple Computer, Inc. Apple Store is a service mark of Apple Computer, Inc., registered in the U.S. and other countries.Wi-Fi is a registered certification mark, and Wi-Fi Protected Access is a certification mark, of the Wi-Fi Alliance. Monster Cable is a registered trademark of Monster Cable Product, Inc. 019-0271