de Deutsch [German]

et Eesti [Estonian]

en English

Hereby, OvisLink Corp., declares that this AirLive pl Polski [Polish] WN-300ARM-VPN is in compliance with the essential requirements and other relevant provisions of Directive 1999/5/EC. Por medio de la presente OvisLink Corp. declara pt que el AirLive WN-300ARM-VPN cumple con los Portugus requisitos esenciales y cualesquiera otras [Portuguese] disposiciones aplicables o exigibles de la Directiva 1999/5/CE. sl Slovensko [Slovenian]

es Espaol [Spanish]

el OvisLink Corp. [Greek] AirLive WN-300ARM-VPN 1999/5/.
fr Par la prsente OvisLink Corp. dclare que sk OvisLink Corp tmto vyhlasuje, e AirLive Franais [French] l'appareil AirLive WN-300ARM-VPN est conforme Slovensky [Slovak] WN-300ARM-VPN spa zkladn poiadavky a aux exigences essentielles et aux autres vetky prslun ustanovenia Smernice 1999/5/ES. dispositions pertinentes de la directive 1999/5/CE it Italiano [Italian] Con la presente OvisLink Corp. dichiara che fi questo AirLive WN-300ARM-VPN conforme ai Suomi [Finnish] requisiti essenziali ed alle altre disposizioni pertinenti stabilite dalla direttiva 1999/5/CE. OvisLink Corp vakuuttaa tten ett AirLive WN-300ARM-VPN tyyppinen laite on direktiivin 1999/5/EY oleellisten vaatimusten ja sit koskevien direktiivin muiden ehtojen mukainen
lv Ar o OvisLink Corp. deklar, ka AirLive Latviski [Latvian] WN-300ARM-VPN atbilst Direktvas 1999/5/EK btiskajm prasbm un citiem ar to saisttajiem noteikumiem. sv Svenska [Swedish]
Hr me lsir OvisLink Corp yfir v a AirLive slenska [Icelandic] WN-300ARM-VPN er samrmi vi grunnkrfur og arar krfur, sem gerar eru tilskipun 1999/5/EC. OvisLink Corp erklrer herved at utstyret AirLive WN-300ARM-VPN er i samsvar med de grunnleggende krav og vrige relevante krav i direktiv 1999/5/EF.
Hrmed intygar OvisLink Corp. att denna AirLive no WN-300ARM-VPN str I verensstmmelse med Norsk [Norwegian] de vsentliga egenskapskrav och vriga relevanta bestmmelser som framgr av direktiv 1999/5/EG.
A copy of the full CE report can be obtained from the following address: OvisLink Corp. 5F, No.6 Lane 130, Min-Chuan Rd, Hsin-Tien City, Taipei, Taiwan, R.O.C. This equipment may be used in AT, BE, CY, CZ, DK, EE, FI, FR, DE, GR, HU, IE, IT, LV, LT, LU, MT, NL, PL, PT, SK, SI, ES, SE, GB, IS, LI, NO, CH, BG, RO, TR

Copyright

The contents of this publication may not be reproduced in any part or as a whole, stored, transcribed in an information retrieval system, translated into any language, or transmitted in any form or by any means, mechanical, magnetic, electronic, optical, photocopying, manual, or otherwise, without the prior written permission.

Trademarks

All products, company, brand names are trademarks or registered trademarks of their respective companies. They are used for identification purpose only. Specifications are subject to be changed without prior notice.

FCC Interference Statement
This equipment has been tested and found to comply with the limits for a Class B digital device, pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a residential installation. This equipment generates uses and can radiate radio frequency energy and, if not installed and used in accordance with the instructions, may cause harmful interference to radio communications. However, there is no guarantee that interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one of the following measures: Reorient or relocate the receiving antenna. Increase the separation between the equipment and receiver. Connect the equipment into an outlet on a circuit different from that to which the receiver is connected. Consult the dealer or an experienced radio/TV technician for help. To assure continued compliance, any changes or modifications not expressly approved by the party responsible for compliance could void the user's authority to operate this equipment. (Example - use only shielded interface cables when connecting to computer or peripheral devices).
FCC Radiation Exposure Statement
This equipment complies with FCC RF radiation exposure limits set forth for an uncontrolled environment. This equipment should be installed and operated with a minimum distance of 20 centimeters between the radiator and your body. This device complies with Part 15 of the FCC Rules. Operation is subject to the following two conditions:
AirLive WN-300ARM-VPN Users Manual
(1) This device may not cause harmful interference, and (2) This device must accept any interference received, including interference that may cause undesired operation. This transmitter must not be co-located or operating in conjunction with any other antenna or transmitter.
CE Declaration of Conformity
This equipment complies with the requirements relating to electromagnetic compatibility, EN 300328 v1.7.1, EN 301489-1/-17, EN 50385, EN 60950, Class B.
The specification is subject to change without notice.

Table of Contents

Chapter1.

4. When prompted for the User name and Password, enter values as follows: Notes: If you can't connect: If the WN-300ARM-VPN does not respond, check the following: The WN-300ARM-VPN is properly installed, LAN connection is OK, and it is powered ON. You can test the connection by using the "Ping" command: Open the MS-DOS window or command prompt window. Enter the command: ping 192.168.0.1 If no response is received, either the connection is not working, or your PC's IP address is not compatible with the WN-300ARM-VPN's IP Address. (See next item.) If your PC is using a fixed IP Address, its IP Address must be within the range 192.168.0.2 to 192.168.0.254 to be compatible with the WN-300ARM-VPN's default IP Address of 192.168.0.1. Also, the Network Mask must be set to 255.255.255.0. Ensure that your PC and the WN-300ARM-VPN are on the same network segment. (If you don't have a router, this must be the case.) Ensure you are using the wired LAN interface. The Wireless interface can only be used if its configuration matches your PC's wireless settings. User name Password admin airlive

3.1 Setup Wizard

The first time you connect to the WN-300ARM-VPN, you should run the Setup Wizard to configure the ADSL and Internet Connection. 1. Click the Setup Wizard link on the main menu 2. On the first screen, select VC 1 (Router - Primary Internet Connection), then click "Next"
Figure: Setup Wizard Home Page
3. Select the method of determining the type of Internet connection, then click Next.
Figure: Select desired option
17 AirLive WN-300ARM-VPN Users Manual
4. On the VC1 screen, shown below, enter the VPI and VCI values provided by your ISP, then click "Next".
Figure: Setup Wizard - VC1
Figure: Setup Wizard - Internet Access
5. On the Internet Access Screen, shown above, select the correct connection type, as used by your ISP. Click "Next" and complete the configuration for your connection method. You need the data supplied by your ISP. Your ISP's data will also have the DSL Multiplexing Method (LLC or VC) The common connection types are explained in the following table.
Connection Type Dynamic IP Address
Details Your IP Address is allocated automatically, when you connect to you ISP.
ISP Data required Often, none. Some ISP's may require you to use a particular Hostname or Domain name, or MAC (physical) address.
Static (Fixed) IP Address
Your ISP allocates a permanent IP Address to you. Usually, the connection is "Always on".
IP Address allocated to you, and related information, such as Network Mask, Gateway IP address, and DNS address. a) User name and password are always required. b) If using a Static (Fixed) IP address, you need the IP address and related information (Network Mask, Gateway IP address, and DNS address)

3.4 Wireless Security

This screen is accessed by clicking the "Configure SSID" button on the Wireless screen. There are 3 options for Wireless security: Disabled - no data encryption is used. WEP - data is encrypted using the WEP standard. WPA-PSK - data is encrypted using the WPA-PSK standard. This is a later standard than WEP, and provides much better security than WEP. If all your Wireless stations support WPA-PSK, you should use WPA-PSK rather than WEP. WPA2-PSK - This is a further development of WPA-PSK, and offers even greater security, using the AES (Advanced Encryption Standard) method of encryption. Mixed WPA-PSK/WAP2-PSK - This method, sometimes called "Mixed Mode", allows clients to use EITHER WPA-PSK OR WPA2-PSK. WPA-802.1x - This version of WPA requires a Radius Server on your LAN to provide the client authentication according to the 802.1x standard. Data transmissions are encrypted using the WPA standard. If this option is selected: This Access Point must have a "client login" on the Radius Server. Each user must have a "user login" on the Radius Server. Each user's wireless client must support 802.1x and provide the login data when required. All data transmission is encrypted using the WPA standard. Keys are automatically generated, so no key input is required.

WEP Wireless Security

Figure: WEP

Data - WEP Screen

WEP Data Encryption Authentication Type Normally, this should be left at the default value of "Automatic". If changed to "Open System" or "Shared Key", ensure that your Wireless Stations use the same setting. WEP Data Encryption Select the desired option, and ensure the Wireless Stations use the same setting. 64 Bit - data is encrypted, using the default key, before being transmitted. You must enter at least the default key. For 64 Bit Encryption, the key size is 10 chars in HEX (0~9 and A~F). 128 Bit - data is encrypted, using the default key, before being transmitted. You must enter at least the default key. For 128 Bit Encryption, the key size is 26 chars in HEX (0~9 and A~F). Default Key Select the key you wish to be the default. Transmitted data is ALWAYS encrypted using the Default Key; the other Keys are for decryption only. You must enter a Key Value for the Default Key. Key Value Enter the key value or values you wish to use. The Default Key is required, the other keys are optional. Other stations must have the same key. Passphrase If desired, you can generate a key from a phrase, instead of entering the key value directly. Enter the desired phrase, and click the "Generate Keys" button.

4.2 Macintosh Clients

From your Macintosh, you can access the Internet via the WN-300ARM-VPN. The procedure is as follows. 1. Open the TCP/IP Control Panel. 2. Select Ethernet from the Connect via pop-up menu. 3. Select Using DHCP Server from the Configure pop-up menu. The DHCP Client ID field can be left blank. 4. Close the TCP/IP panel, saving your settings.
If using manually assigned IP addresses instead of DHCP, the required changes are: Set the Router Address field to the WN-300ARM-VPN's IP Address. Ensure your DNS settings are correct.

4.3 Linux Clients

To access the Internet via the WN-300ARM-VPN, it is only necessary to set the WN-300ARM-VPN as the "Gateway". Ensure you are logged in as "root" before attempting any changes.

Fixed IP Address

By default, most Unix installations use a fixed IP Address. If you wish to continue using a fixed IP Address, make the following changes to your configuration. Set your "Default Gateway" to the IP Address of the WN-300ARM-VPN. Ensure your DNS (Name server) settings are correct.
To act as a DHCP Client (recommended)
The procedure below may vary according to your version of Linux and X -windows shell. 1. Start your X Windows client. 2. Select Control Panel - Network 3. Select the "Interface" entry for your Network card. Normally, this will be called "eth0". 4. Click the Edit button, set the "protocol" to "DHCP", and save this data. 5. To apply your changes: Use the "Deactivate" and "Activate" buttons, if available. OR, restart your system.

Other Unix Systems

To access the Internet via the WN-300ARM-VPN: Ensure the "Gateway" field for your network card is set to the IP Address of the WN-300ARM-VPN. Ensure your DNS (Name Server) settings are correct. 46
4.4 Wireless Station Configuration
This section applies to all Wireless stations wishing to use the WN-300ARM-VPN's Access Point, regardless of the operating system which is used on the client. To use the Wireless Access Point in the WN-300ARM-VPN, each Wireless Station must have compatible settings, as follows:

Displays the current connection method, as set in the Setup Wizard.
Click this button to view the details of multi PVC in the sub-screen.
Wireless SSID 1 SSID 2 Region Channel Wireless AP It displays the name of the SSID 1. It displays the name of the SSID 2. The current region, as set on the Wireless screen. This shows the Channel currently used, as set on the Wireless screen. This indicates whether or not the Wireless Access Point feature is enabled. Broadcast Name This indicates whether or not the SSID is Broadcast. This setting is on the Wireless screen. System Device Name The current name of the Router. This name is also the "hostname" for users with "@Home" type connection. Firmware Version Buttons ADSL Details Connection Details View the details of each VC (Virtual Circuit). Click this button to open a sub-window and view a detailed description of the current connection. MultiPVC Details Attached Devices Click this button to view the details of multi PVC in the sub-screen. This will open a sub-window, showing all LAN and Wireless devices currently on the network. Refresh Screen Help Update the data displayed on screen. The description of Status item. The version of the current firmware installed.
Connection Status - PPPoE & PPPoA
If using PPPoE (PPP over Ethernet) or PPPoA (PPP over ATM), a screen like the following example will be displayed when the "Connection Details" button is clicked.
Figure: PPPoE Status Screen

-2Connection Time

Data - PPPoE/PPPoA Screen
This indicates how long the current connection has been established.

Connection to Server

This indicates whether or not the connection is currently established. If the connection does not exist, the "Connect" button can be used to establish a connection. If the connection currently exists, the "Disconnect" button can be used to break the connection.

Negotiation IP Address

This indicates the status of the PPPoE Server login. The IP Address of this device, as seen by Internet users. This address is allocated by your ISP (Internet Service Provider).
Network Mask Buttons Connect Disconnect Close
The Network Mask associated with the IP Address above.
If not connected, establish a connection to your ISP. If connected to your ISP, hang up the connection. Close this window.
Connection Details - Dynamic IP Address
If your access method is "Direct" (no login), with a Dynamic IP address, a screen like the following example will be displayed when the "Connection Details" button is clicked.

DownStream UpStream Get from WAN

Category

Applications: Add a New Application (Once selected, please complete the following setups.) Ip/Net: Enter the IP addresses. Rate: Enter the desired rate value. Priority: Select the desired option (High, Normal, Low) Direct: Select Upstream or Downstream as required.
Self-Define Name. Enter a name for your device. Port Range: Enter the values for the desired port range. Protocol: Select the desired option. Ip/Net: Enter the IP addresses of your device. Rate: Enter the desired rate value. Priority: Select the option (High, Normal, Low) from the list. Direct: Select Upstream or Downstream as required.
Summary Priority Name Information The priority of the application. The Name of this Application or IP Address. The general Information of this Application or IP Address.

VPN (IPSec)

VPN Setup
The VPN (Virtual Private Network) feature in the WN-300ARM-VPN allows you to create a VPN connection between 2 WN-300ARM-VPN, or a remote PC to establish a VPN connection to the WN-300ARM-VPN. To establish a VPN connection from a remote PC to the Wireless ADSL Router, you need suitable (IPSec) VPN client software on your PC. For more information about VPNs, please refer to Appendix C - About VPNs.

VPN Policies

A "VPN Policy" contains all the configuration data for a particular VPN connection. Generally, you will have to create one policy for each site you wish to connect to. The remote VPN Gateway (or client) needs to have matching configuration. Traffic covered by an enabled policy will automatically be sent via a VPN tunnel. If the VPN tunnel does not exist, it will be created. The VPN tunnel is created according to the parameters in the SA (Security Association). The remote VPN Endpoint must have a matching SA, or it will refuse the connection.
The VPN Policies: Auto - Some parameters for the VPN tunnel are generated automatically. This requires using the IKE (Internet Key Exchange) protocol to perform negotiations between the 2 VPN Endpoints.

VPN Policies Screen

This screen is displayed when you select VPN on the Advanced menu. It allows you to create, modify and manage your VPN Policies. If you have not created any policies, the Policy Table will be empty.

Some VPN Gateways or programs let you specify the following settings separately for IKE and IPSec. For this device, the same settings are used for both IKE and IPSec. Authentication Encryption SA Lifetime 88
Configuration Settings - Gateway A
Gateway A should be configured as shown below.
Figure: Gateway A Configuration
Configuration Settings - Gateway B
Gateway B should be configured as shown below.
Figure: Gateway B Configuration
VPN Example - Connecting WN-300ARM-VPN and RS-1200
Setting Policy Name WN-300ARM-VPN wn-300 RS-1200 wn Notes Name does not affect operation. Select a meaningful name. Remote VPN Endpoint NetBIOS Local LAN IP address Mask Remote LAN IP address Mask IKE Direction Initiator & responder -Does not have to match. Either endpoint can block 1 direction. Exchange mode DH Group Local Identity Main Mode Group 2 (1024 bit) IP address Main Mode Group 2 (1024 bit) -Must match Must match IP address is the most common ID method Remote Identity WAN IP address -IP address is the most common ID method SA Parameters Encryption Authentication Pre-shared Key 3DES MD3DES MDMust match. Must match Must match; use any string. SA Life time Default Default Does not have to match. Shorter period will be used. PFS Enable Group 2 If WN-300ARM-VPN sets to enable, it will auto-detect the other VPN device of PFS. 192.168.1.0 255.255.255.0 192.168.0.0 255.255.255.0 Fixed IP Address 60.250.158.64 Enable 192.168.0.0 255.255.255.0 PPPoE DDNS enable Enable 192.168.1.0 255.255.255.0 Other endpoint's WAN (Internet) IP address. Disable if not required. Local Address subnet. Use a more restrictive definition if possible. Remote Address subnet. Use a more restrictive definition if possible.
Configuration: RS-1200 1. Policy Object VPN IPSec Autokey: Define the IPSec setting
2. Policy Object VPN Tunnel: Configure the else VPN setting
3. Policy Outgoing: Enable IPSec VPN setting
4. Policy Incoming: Enable IPSec VPN setting
Configuration: WN-300ARM-VPN
VPN Example - Connecting WN-300ARM-VPN and IP-2000VPN
Setting Policy Name WN-300ARM-VPN To_IP2K IP-2000VPN To_WN300 Notes Name does not affect operation. Select a meaningful name. Remote VPN Endpoint NetBIOS Local LAN IP address Mask Remote LAN IP address Mask IKE Direction Initiator & responder Initiator & responder Does not have to match. Either endpoint can block 1 direction. Exchange mode DH Group Local Identity Main Mode Group 2 (1024 bit) IP address Main Mode Group 2 (1024 bit) IP address Must match Must match IP address is the most common ID method Remote Identity WAN IP address WAN IP address IP address is the most common ID method SA Parameters Encryption Authentication Pre-shared Key 3DES MD3DES MDMust match. Must match Must match; use any string. SA Life time Default Default Does not have to match. Shorter period will be used. PFS Enable Group 2 If WN-300ARM-VPN sets to enable, it will auto-detect the other VPN device of PFS. 192.168.1.0 255.255.255.0 192.168.0.0 255.255.255.0 Fixed IP Address 60.250.158.64 Enable 192.168.0.0 255.255.255.0 PPPoE DDNS enable Enable 192.168.1.0 255.255.255.0 Other endpoint's WAN (Internet) IP address. Disable if not required. Local Address subnet. Use a more restrictive definition if possible. Remote Address subnet. Use a more restrictive definition if possible.

7.4 Email

This screen allows you to E-mail Logs and Alerts. A sample screen is shown below.

Figure: E-mail Screen

Data - E-mail Screen
E-Mail Notification Turn E-mail Notification on Send to this E-mail address Outgoing (SMTP) Mail Server Mail Sender Address My SMTP Mail Server requires authentication User Name Enter the address or IP address of the SMTP (Simple Mail Transport Protocol) Server you use for outgoing E-mail. Enter the mail address of the sender. The E-mail will also show this address as the Sender's address. To stop spanners, many SMTP mail servers require you to log in to send mail. In this case, enable this checkbox, and enter the login information (User name and Password) in the fields below. If you have enabled "My SMTP Mail Server requires authentication" above, enter the User Name required to login to your SMTP Server.
105 AirLive WN-300ARM-VPN Users Manual
Check this box to enable this feature. If enabled, the E-mail address information (below) must be provided. Enter the E-mail address the Log is to be sent to.

Password

If you have enabled "My SMTP Mail Server requires authentication" above, enter the password required to login to your SMTP Server.
E-mail Alerts Send E-mail alerts immediately You can choose to have alerts E-mailed to you, by checking the desired checkboxes. The WN-300ARM-VPN can send an immediate alert when it detects a significant security incident such as A known hacker attack is directed at your IP address A computer on the Internet scans your IP address for open ports Someone on your LAN (Local Area Network) tries to visit a blocked site. E-mail Logs Send Logs Select the desired option for sending the log by E-mail. Never (default) - This feature is disabled; Logs are not sent. When log is full - The time is not fixed. The log will be sent when the log is full, which will depend on the volume of traffic. Hourly, Daily, Weekly. - The log is sent on the interval specified.
If Daily is selected, the log is sent at the time specified. Select the time of day you wish the E-mail to be sent.
If Weekly is selected, the log is sent once per week, on the specified day, at the specified time. Select the day and the time of day you wish the E-mail to be sent.
Note: If the log is full before the time specified to send it, it will be sent regardless of the day and time specified.

7.5 Diagnostics

This screen allows you to perform a "Ping" or a "DNS lookup". These activities can be useful in solving network problems. An example Network Diagnostics screen is shown below.
Figure: Network Diagnostics Screen

-1Ping IP Address

Data - Network Diagnostics Screen
Enter the IP address you wish to ping. The IP address can be on your LAN, or on the Internet. Note that if the address is on the Internet, and no connection currently exists, you could get a "Timeout" error. In that case, wait a few seconds and try again.

Ping Button

After entering the IP address, click this button to start the "Ping" procedure. The results will be displayed in the Ping Results pane.
DNS Lookup Internet Name Enter the Domain name or URL for which you want a DNS (Domain Name Server) lookup. Note that if the address in on the Internet, and no connection currently exists, you could get a "Timeout" error. In that case, wait a few seconds and try again. Lookup Button Routing Display Click this button to display the internal routing table. This information can be used by Technical Support and other staff who understand Routing Tables. After entering the Domain name/URL, click this button to start the "DNS Lookup" procedure.
7.6 Remote Administration
If enabled, this feature allows you to manage the WN-300ARM-VPN via the Internet.
Figure: Remote Administration Screen
Data - Remote Administration Screen
Remote Administration Enable Remote Management Check to allow administration/management via the Internet. (To connect, see below). If Disabled, this device will ignore Administration connection attempts from the Internet. Current IP Address Port Number This is the current address you will use when accessing this device from the Internet. To connect, see details and an example below. Enter a port number between 1 and 65535. The default for HTTP (Web) connections is port 80, but using port 80 will prevent the use of a Web "Virtual Server" on your LAN. So using a different port number is recommended. The default value is 8080. The port number must be specified in your Browser when you connect. See the following section for details. Access Permission Allow Remote Access Select the desired option. Everyone - allow access by everyone on the Internet. Only This Computer - allow access by only one IP address. Enter the desired IP address. IP Address Range - allow access from a range of IP addresses on the Internet. Enter a beginning and ending IP address to define the allowed range.
For security, you should restrict access to as few external IP addresses as practical.
To connect from a remote PC via the Internet
1. Ensure your Internet connection is established, and start your Web Browser. 2. In the "Address" bar, enter "http://" followed by the Internet IP Address of the WN-300ARM-VPN. If the port number is not 80, the port number is also required. (After the IP Address, enter ":" followed by the port number.) e.g. http://123.123.123.123.8080 This example assumes the WAN IP Address is 123.123.123.123, and the port number is 8080. 3. You will then be prompted for the login name and password for this device.

Configuring Other Routers on your LAN
It is essential that all IP packets for devices are not on the local LAN be passed to the WN-300ARM-VPN, so that they can be forwarded to the external LAN, WAN, or Internet. To achieve this, the local LAN must be configured to use the WN-300ARM-VPN as the Default Route or Default Gateway.

Local Router

The local router is the Router installed on the same LAN segment as the WN-300ARM-VPN. This router requires that the Default Route is the WN-300ARM-VPN itself. Typically, routers have a special entry for the Default Route. It should be configured as follows. Destination IP Address Network Mask Normally 0.0.0.0, but check your router documentation. Normally 0.0.0.0, but check your router documentation. Gateway IP Address Metric The IP Address of the WN-300ARM-VPN. 1
Other Routers on the Local LAN
Other routers on the local LAN must use the WN-300ARM-VPN's Local Router as the Default Route. The entries will be the same as the WN-300ARM-VPN's local router, with the exception of the Gateway IP Address. For a router with a direct connection to the WN-300ARM-VPN's local Router, the Gateway IP Address is the address of the WN-300ARM-VPN's local router. For routers which must forward packets to another router before reaching the WN-300ARM-VPN's local router, the Gateway IP Address is the address of the intermediate router.

Static Routing - Example

Figure: Routing Example

-5follows.

For the WN-300ARM-VPN's Routing Table
For the LAN shown above, with 2 routers and 3 LAN segments, the WN-300ARM-VPN requires 2 entries as
Entry 1 (Segment 1) Destination IP Address Network Mask Gateway IP Address 192.168.1.0 255.255.255.0 (Standard Class C) 192.168.0.100 (WN-300ARM-VPN's local Router) Metric Entry 2 (Segment 2) Destination IP Address Network Mask Gateway IP Address Metric 192.168.2.0 255.255.255.0 (Standard Class C) 192.168.0.-6-7Destination IP Address Network Mask Gateway IP Address For Router A's Default Route 2

Appendiix B About Wiirelless LANs Append x B About W re ess LANs
Wireless LANs can work in either of two (2) modes: Ad-hoc Infrastructure

Ad-hoc Mode

Ad-hoc mode does not require an Access Point or a wired (Ethernet) LAN. Wireless Stations (e.g. notebook PCs with wireless cards) communicate directly with each other.

Infrastructure Mode

In Infrastructure Mode, one or more Access Points are used to connect Wireless Stations (e.g. Notebook PCs with wireless cards) to a wired (Ethernet) LAN. The Wireless Stations can then access all LAN resources.
Access Points can only function in "Infrastructure" mode, and can communicate only with Wireless Stations which are set to "Infrastructure" mode.

BSS/ESS

A group of Wireless Stations and a single Access Point, all using the same ID (SSID), form a Basic Service Set (BSS). Using the same SSID is essential. Devices with different SSIDs are unable to communicate with each other.
A group of Wireless Stations, and multiple Access Points, all using the same ID (ESSID), form an Extended Service Set (ESS). Different Access Points within an ESS can use different Channels. In fact, to reduce interference, it is recommended that adjacent Access Points SHOULD use different channels. As Wireless Stations are physically moved through the area covered by an ESS, they will automatically change to the Access Point which has the least interference or best performance. This capability is called Roaming. (Access Points do not have or require Roaming capabilities.)

Channels

The Wireless Channel sets the radio frequency used for communication. Access Points use a fixed Channel. You can select the Channel used. This allows you to choose a Channel which provides the least interference and best performance. In the USA and Canada, 11
123 AirLive WN-300ARM-VPN Users Manual
channels are available. If using multiple Access Points, it is better if adjacent Access Points use different Channels to reduce interference. In "Infrastructure" mode, Wireless Stations normally scan all Channels, looking for an Access Point. If more than one Access Point can be used, the one with the strongest signal is used. (This can only happen within an ESS.) If using "Ad-hoc" mode (no Access Point), all Wireless stations should be set to use the same Channel. However, most Wireless stations will still scan all Channels to see if there is an existing "Ad-hoc" group they can join.

Wireless LAN Configuration
To allow Wireless Stations to use the Access Point, the Wireless Stations and the Access Point must use the same settings, as follows: Mode On client Wireless Stations, the mode must be set to "Infrastructure". (The Access Point is always in "Infrastructure" mode.) SSID (ESSID) Wireless Stations should use the same SSID (ESSID) as the Access Point they wish to connect to. Alternatively, the SSID can be set to "any" or null (blank) to allow connection to any Access Point. Wireless Security The Wireless Stations and the Access Point must use the same settings for Wireless security. (None, WEP, WPA-PSK, WPA2-PSK, WPA-802.1x).
Appendiix C About VPNs Append x C About VPNs
A VPN (Virtual Private Network) provides a secure connection between 2 points, over an insecure network typically the Internet. This secure connection is called a VPN Tunnel. There are many standards and protocols for VPNs. The standard implemented in the WN-300ARM-VPN is IPSec.
IPSec is a near-ubiquitous VPN security standard, designed for use with TCP/IP networks. It works at the packet level, and authenticates and encrypts all packets traveling over the VPN Tunnel. Thus, it does not matter what applications are used on your PC. Any application can use the VPN like any other network connection.
IPsec VPNs exchange information through logical connections called SAs (Security Associations). An SA is simply a definition of the protocols, algorithms and keys used between the two VPN devices (endpoints).
Each IPsec VPN has two SAs - one in each direction. If IKE (Internet Key Exchange) is used to generate and exchange keys, there are also SA's for the IKE connection as well as the IPsec connection.
There are two security modes possible with IPSec: Transport Mode - the payload (data) part of the packet is encapsulated through encryption but the IP header remains in the clear (unchanged). The Wireless ADSL Router does NOT support Transport Mode. Tunnel Mode - everything is encapsulated, including the original IP header, and a new IP header is generated. Only the new header in the clear (i.e. not protected). This system provides enhanced security. The WN-300ARM-VPN always uses Tunnel Mode.
IKE (Internet Key Exchange) is an optional, but widely used, component of IPsec. IKE provides a method of negotiating and generating the keys and IDs required by IPSec. If using IKE, only a single key is required to be provided during configuration. Also, IKE supports using Certificates (provided by CAs - Certification Authorities) to authenticate the identify of the remote user or gateway.
If IKE is NOT used, then all keys and IDs (SPIs) must be entered manually, and Certificates can NOT be used. This is called a "Manual Key Exchange".
When using IKE, there are 2 phases to creating the VPN tunnel: Phase I is the negotiation and establishment up of the IKE connection. Phase II is the negotiation and establishment up of the IPsec connection.

AirLive WN-300ARM-VPN

11N ADSL2/2+ VPN Router

Table of Contents

List of Languages
English.. esky.. Deutsch. Espaol. . Franais.
Italiano.. Magyar.. Polski. Portugus. . Slovensky.

WN-300ARM-VPN

English
Declaration of Conformity
We, Manufacturer/Importer
OvisLink Corp. 5F., NO.6, Lane 130, Min-Chuan Rd., Hsin-Tien City, Taipei County, Taiwan

Declare that the product

11n ADSL VPN Router (Annex A / Annex B) AirLive WN-300ARM-VPN

is in conformity with

In accordance with 1999/5 EC-R & TTE Directive
Clause EN EN v1.7.1 (2006-10)
Description Electromagnetic compatibility and Radio spectrum Matters (ERM); Wideband transmission equipment operating in the 2.4GHz ISM band and using spread spectrum modulation techniques; Part 1technical characteristics and test conditions Part2Harmonized EN covering essential requirements under article 3.2 of the R&TTE Directive Electromagnetic compatibility and Radio spectrum Matters (ERM); Electromagnetic compatibility(EMC) standard for radio equipment and Services; Part 17Specific conditions for wideband data and HIPERLAN equipment Product standard to demonstrate the Compliance of radio base stations and fixed terminal stations for wireless Telecommunication System with the Basic restrictions or the reference levels related to human exposure to radio Frequency electromagnetic fields (110 MHz 40 GHz ) - General public Safety for information technology equipment including electrical business equipment
EN 301 489-1 V1.6.1 (2005-09) EN 301 489-17 V1.7.1 (2002-08) EN 50385:2002
EN 60950-1: 2000/All: 2004 CE marking

Manufacturer/Importer

Signature Name Position/ Title : Date
______________ Albert Yeh Vice President 2008/11/20
Note on the FCC standard This equipment has been tested and found to comply with the limits for a Class B digital device pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interferences when the equipment is operating in a commercial area. This equipment generates, uses and may radiate radio frequency energy, and if not installed in accordance with the user guide, may cause interference in the transmission of radio communications. If operating in a residential area, it is probable this equipment will cause harmful interference, in which case the user will be required to try to correct this interference using his own means. Note on CE Marking This is a Class B product. In a residential area this product may cause radio interference, in which case the user can be required to take the appropriate measures. OvisLink Corp. hereby declares that AirLive WN-300ARM-VPN meets the basic requisites of directive 99/05/CE, and is therefore liable for the accuracy of these data: OvisLink Corp. 5F, No.6 Lane 130, Min-Chuan Rd, Hsin-Tien City, Taipei, Taiwan TEL: +886-2-2218-6888 Warranties This product has undergone various quality controls to ensure proper operation. This product is covered by a two-year warranty for countries inside European Union. For other countries, the warranty period is one year only. In the event of any manufacturing fault or breakdown, it will be repaired by OvisLink Corp. Please contact your supplier for details on the procedure to follow. This warranty shall not be applicable in the event of damage caused by improper use of the product, accidents, faulty handling or manipulation nor any future incompatibility with third party products.

LED Indicators

Power LED Status LAN
Wireless ADSL Internet WPS
On (Green) - Power on Off - No power Flashing (Green) - Device is rebooting On (Orange) - Device error On (Green) - Corresponding LAN (hub) port is using 100BaseT On (Orange) - Corresponding LAN (hub) port is using 10BaseT Off - No active connection on the corresponding LAN (hub) port Flashing - Data is being transmitted or received via the corresponding LAN (hub) port On - Wireless enabled Off - No Wireless connections currently exist Flashing - Data is being transmitted or received via the Wireless access point. This includes "network traffic" as well as user data On - ADSL connection established Off - No ADSL connection currently exists Flashing - ADSL is synchronizing On (Green) - Internet connection is available Off - No Internet connection available On (Orange) - Authentication error On - WPS wireless security is enabled Off - WPS is not being set or enabled Flashing - The device is in the 2-minute interval to synchronize security

Real Panel

ADSL port LAN 1~4 Power ON/OFF Power port WPS Button Wireless ON/OFF
Connect this port to your ADSL line. Use standard LAN cables (RJ-45 connectors) to connect your PCs to these ports. Press this button to switch power on/off the device. Connect the supplied power adapter here. Push the WPS button on the device and on your other wireless device to perform WPS function that easily creates an encryption-secured wireless connection automatically. Press this button to switch wireless function on or off.

Important Information

The default IP address is 192.168.0.1 The default login name is admin The default password is airlive

Physical Installation

System Installation
1. 2. 3. Start your PC. If it is already started, restart it. It will then obtain an IP Address from the WN-300ARM-VPN's DHCP Server. Start your WEB browser. In the Address bar, enter the following: http://192.168.0.1 When prompted, use the following username and password. User name: admin Password: airlive 4. 5. Click Setup Wizard on the menu. Step through the Wizard until finished. Refer to the data from your ISP, and the table below, to ensure your choices are correct. Connection Type Dynamic IP Address Specified (Fixed) IP Address, or IPoA (IP over ATM) PPPoE, PPPoA Data required. Usually, none. IP Address allocated to you, and related information. Login name and password. If using a fixed IP address, the IP address and related information.
On the final screen of the Wizard, run the test and check that an Internet connection can be established. If the connection fails, check VC values and login name, password for the related information provided by ISP.
Please check manual on CD for more detail configuration.
FCC Standard - upozornn Toto zazen bylo testovno a vyhovuje pedpism tdy B pro digitln zazen, na zklad odstavce 15, FCC pravidel. Tyto limity jsou vytvoeny po poskytovn inn ochrany ped kodlivmi vlivy zazen pracujc v komern sfe. Toto zazen vyzauje radiov vlny a pokud nen instalovno a pouvno v souladu s touto uivatelskou prukou, tak me vykazovat ruen okoln radiov komunikace. Provoz tohoto zazen v osdlench oblastech bude pravdpodobn pinou nedoucho ruen. V tomto ppad by ml uivatel pijmout opaten, kter povedou ke korekci ruen. CE Marking - upozornn Toto zazen odpovd td B. V domcm prosted me zpsobovat radiov ruen. V tomto ppad by ml uivatel pijmout odpovdajc opaten. Spolenost OvisLink Corp. takto deklaruje, e AirLive WN-300ARM-VPN spluje zkladn pravidla norem 99/05/CE, a je proto odpovdn za sprvnost vech daj: OvisLink Corp. 5F, No.6 Lane 130, Min-Chuan Rd, Hsin-Tien City, Taipei, Taiwan TEL: +886-2-2218-6888 Zruka Tento produkt byl podroben rozlinm kontrolm kvality k zajitn vech funkc. Tento produkt podlh dvoulet zruce v krajinch Evropsk Unie. V ostatnch krajinch je zrun doba stanovena na jeden rok. V ppad vrobnch zvad nebo nefunknosti bude zazen opraveno spolenost OvisLink Corp. Prosm kontaktujte svho dodavatele, kter vm sdl detailn informace. Zruka nebude uznna pokud dojde k pokozen zazen vlivem nestandardnho uvn, nap.: fyzick ponien nsledkem pdu, nesprvn manipulace, neautorizovan zsahy, provoz v extremnch podmnkch atd.

Tipo Conexo Endereo IP Dinamico Especifico (Fixo) Endereo IP, ou IPoA (IP sobre ATM) PPPoE, PPPoA
Dados Requeridos Normalmente nenhum. Endereo IP que lhe foi atribudo, e informao relacionada Login Nome e palavra chave. Se usar um endereo IP fixo, e endereo IP e informao relacionada.
Na janela final do assistente, corra o teste e verifique que a ligao Internet foi estabelecida. Se a ligao falhar, verifique os valores VC e o nome do login, palavra-chave para a informao relacionada fornecida pelo seu ISP.
Verifique por favor o manual no CD para mais detalhes de configurao.
Note on the FCC standard This equipment has been tested and found to comply with the limits for a Class B digital device pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interferences when the equipment is operating in a commercial area. This equipment generates, uses and may radiate radio frequency energy, and if not installed in accordance with the user guide, may cause interference in the transmission of radio communications. If operating in a residential area, it is probable this equipment will cause harmful interference, in which case the user will be required to try to correct this interference using his own means. Note on CE Marking This is a Class B product. In a residential area this product may cause radio interference, in which case the user can be required to take the appropriate measures. OvisLink Corp. hereby declares that AirLive WN-300ARM-VPN meets the basic requisites of directive 99/05/CE, and is therefore liable for the accuracy of these data:
OvisLink Corp. 5F, No.6 Lane 130, Min-Chuan Rd, Hsin-Tien City, Taipei, Taiwan TEL: +886-2-2218-6888 Warranties This product has undergone various quality controls to ensure proper operation. This product is covered by a two-year warranty for countries inside European Union. For other countries, the warranty period is one year only. In the event of any manufacturing fault or breakdown, it will be repaired by OvisLink Corp. Please contact your supplier for details on the procedure to follow. This warranty shall not be applicable in the event of damage caused by improper use of the product, accidents, faulty handling or manipulation nor any future incompatibility with third party products.
() . . () . () . () LAN () 100BaseT. () LAN () 10BaseT. LAN LAN () . LAN (). . . . - ADSL . ADSL - ADSL. ADSL. () . . () . - WPS. WPS - WPS . .

ADSL. LAN ( RJ-45) .

LAN 1~4
/ /. WPS / . WPS WPS, . / .
IP 192.168.0.1 admin - airlive
1. 2. 3. 4. 5. . , . IP DHCP WN-300ARM-VPN. . : http://192.168.0.1 , : : admin : airlive . .
, , . () IP IPoA (IP ATM) PPPoE, PPPoA IP . . IP , IP .