Federal Communications Commission (FCC) Interference Statement
FCC Certification The United States Federal Communication (FCC) and the Canadian Department of Communications have established certain rules governing the use of electronic equipment. Part 15, Class B The device complies with Part 15 of FCC rules. Operation is subject to the following two conditions: This device may not cause harmful interference. This device must accept any interference received, including interference that may cause undesired operations. This equipment has been tested and found to comply with the limits for a Class B digital device pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a commercial environment. This equipment generates, uses, and can radiate radio frequency energy, and if not installed and used in accordance with the instructions, may cause harmful interference to radio communications. If this equipment does cause harmful interference to radio/television reception, which can be determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures: 1. Reorient or relocate the receiving antenna. 2. Increase the separation between the equipment and the receiver. 3. Connect the equipment into an outlet on a circuit different from that to which the receiver is connected. Caution 1. To comply with FCC RF exposure compliance requirements, a separation distance of at least 20 cm must be maintained between the antenna of this device and all persons. 2. This Transmitter must not be co-located or operating in conjunction with any other antenna or transmitter.

FCC Statement

Customer Support
When contacting your Customer Support Representative, please have the following information ready: Product model and serial number. Warranty Information. The Date you purchased your product. Brief description of the problem and the steps you took to solve it.
METHOD SUPPORT E-MAIL SALES E-MAIL LOCATION NORTH AMERICA support@zyxel.com 800-255-4101 714-632-0882 www.us.zyxel.com ZyXEL Communications Inc. 1130 N. Miller St. Anaheim CA 92806-2001 U.S.A. ZyXEL Communications Corp. 6 Innovation Road II Science Park Hsinchu 300 Taiwan TELEPHONE1 FAX

WEB SITE FTP SITE

REGULAR MAIL

Appendix A Types of EAP Authentication.... i

Table Of Contents

Preface
Congratulations on the purchase of your new ZyXEL G-162/G-360! About This User's Guide This manual provides information about the ZyXEL Wireless LAN Utility. Syntax Conventions Type or Enter means for you to type one or more characters. "Select" or "Choose" means for you to use one of the predefined choices. Mouse action sequences are denoted using a comma. For example, click the Apple icon, Control Panels and then Modem means first click the Apple icon, then point your mouse pointer to Control Panels and then click Modem. Window and command choices are in Bold Times New Roman font. Predefined field choices are in Bold Arial font. The ZyXEL G-162/G-360 802.11g Wireless LAN Adapters are referred to as the ZyXEL G162/G-360 in this guide.
The ZyXEL Wireless LAN Utility may be referred to as the ZyXEL WLAN Utility or, simply, as the ZyXEL Utility in this guide. Related Documentation Support Disk Refer to the included CD for support documents and device drivers. Quick Start Guide Our Quick Start Guide is designed to help you get your ZyXEL G-162/G-360 up and running right away. It contains a detailed easy-to-follow connection diagram and information on installing your ZyXEL G-162/G-360. ZyXEL Glossary and Web Site Please refer to www.us.zyxel.com for an online glossary of networking terms and additional support documentation. User Guide Feedback Help us help you. E-mail all Users Guide-related comments, questions or suggestions for improvement to sales@zyxel.com or send regular mail to The Technical Spport Team, ZyXEL Communications Inc., 1130 N Miller St, Anaheim, CA 92806, USA. Thank you.
ZyXEL G-162/G-360 Users Guide Graphics Icons Key

Wireless Access Point

Computer

Notebook computer

Server

Wireless Signal

Telephone

Switch

Router
Chapter 1 Getting Started
This chapter introduces the ZyXEL G-162/G-360 and prepares you to use the ZyXEL Utility.
About Your ZyXEL G-162/G-360

The ZyXEL G-162/G-360 is an IEEE 802.11b and 802.11g compliant wireless LAN adapters. With the ZyXEL G-162/G-360, you can enjoy wireless mobility within almost any wireless networking environment. The following lists the main features of your ZyXEL G-162/G-360. Your ZyXEL G-162/G-360 can communicate with other IEEE 802.11b/g compliant wireless devices. Automatic rate selection. Standard data transmission rates up to 54Mbps. Proprietary transmission rates (Turbo Mode) of 22Mbps for 802.11b standard and up to 125Mbps for 802.11g standard when connected to the ZyXEL g+ access point or wireless router. Offers 64-bit, 128-bit and 256-bit 2WEP (Wired Equivalent Privacy) data encryption for network security. Supports IEEE802.1x, WPA and WPA2 (Wi-Fi Protected Access). Low CPU utilization allowing more computer system resources for other programs. A built-in antenna for G-162 and a removable antenna with RP-SMA connector type for G-360. Driver support for Windows XP/2000/Me/98 SE.
ZyXEL G-162/G-360 Hardware and Utility Installation
Follow the instructions in the Quick Start Guide to install the ZyXEL Utility and make hardware connections.
Using the ZyXEL Utility to Configure Your Network
The following are explanations on how to configure and use the ZyXEL Utility program. For initial setup, please see the included Quick Start Guide. After completing the installation procedure, a Z icon as shown below will automatically appear in the lower right tray bar.
256-bit WEP should be complied with your AP/Routers WEP setting 1-1

WLAN Networking

Double-clicking on the Z icon will display the following ZyXEL utility window.
Each of the pages (Site Survey, Profile, Link Info, About) presented in the ZyXEL Utility are explained in the following sections.

1.3.1 Site Survey

Site Survey screen shows how the network is presently configured: network mode, information, channel, signal strength, etc. The Selected Network window shows you a list of SSIDs in your vicinity. Information regarding each SSID is also shown as Security Status, SSID, Mode, Ch, Signal, AP MAC Add and Profile.
The Current Status (Top Red Rectangle) windows shows the network status, Profile Name, SSID, AP MAC Address, Transmission Rate, Channel, Network Mode, TX Rate, RX Rate, Signal Strength and Security Status between the client and AP/Router.

ZyXEL G-162/G-360 Users Guide Use Windows Zero Configuration Checking this box will allow you to use Windows to configure your wireless network settings. When you check this box to configure, you will no longer use ZyXELs utility. Connect Clicking on this bottom will guide you to the following Profile Configuration screen when you select an AP/Router to connect. Rescan Clicking on this bottom will scan the vicinity for a certain amount of time and display the scan results. Configure Clicking on this bottom will guide you to the following Profile Configuration screen when you select an AP/Router to connect. Table 1.1 Site Survey LABEL DESCRIPTION Wireless Network Status Profile Name This is the name of the profile you are currently using. Network Name The SSID identifies the Service Set to which a wireless station is associated. This Security Logo Unlock logo displays no security. AP MAC Address This field displays the MAC address of the wireless device to which the G-162/GTransmission Rate This field displays the current data transmission rate in Megabit per seconds Channel This field displays the radio channel the G-162/G-360 is currently using. Network Mode This field displays the network type (Infrastructure (BSS) or Ad Hoc) of the
ZyXEL G-162/G-360 Users Guide should use the same SSID (whatever your choice is). TX Rate RX Rate Signal Strength Security Status This field displays the current data transmission rate in Megabit per second (Mbps). This field displays the current data receiving rate in Megabit per second (Mbps). This shows the strength of the signal (the range from Excellent, Good, Normal, Bad, Poor, No signal, which relate to the dBm) This field displays whether data encryption is activated (No Security, WEP, WEP+ 802.1x, WPA, WPA-PSK, WPA2, WPA2-PSK)
Profile Configuration allow you to insert some basic setting for your wireless mode 1) Click on [Configure] and the following screen will appear
2) On this screen you will insert some basic settings on your left for your wireless network. WLAN Networking 1-5
ZyXEL G-162/G-360 Users Guide a. [Profile] Default profile name is ZyXEL. You may also enter in a descriptive name for this profile. b. [SSID Name] is depends on the AP/Router you connect to from Site Survey page. c. [Network Mode] if connecting to an AP/Router, choose Infrastructure. If you are going to network one computer directly to another computer without an AP/Router, then choose Ad Hoc. d. [Channel] is set default auto channel for the Infrastructure mode and default Ch6 for Ad-Hoc mode. e. [Band] shows you 802.11b and 802.11g on the 2.4GHz. f. [Security] will vary in appearance depending on whether any encryption was detected with your AP/Router. Select the appropriate security information. g. Click [OK]. Your setting will be saved and apply. 2.1) Security Setting is on your right and the screen will vary in appearance depending on whether any encryption was detected with your AP/Router. Please enter in the appropriate security information. [Security] shows you different types of security modes. a. Disable It represents no security. All data sent between the AP and the client is left unencrypted and may be viewed by other wireless devices. b. WEP Wired Equivalent Privacy Encrypts all traffic sent between the AP and the client using a shared key. When using WEP encryption (available in 64, 128, or 256-bit3), only those APs and PCs using the same WEP Key are allowed to communicate with each other. c. WPA-PSK WPA-PSK is designed for home users. Like WEP, it uses a pre-shared key that every user of the network must have in order to be able to send and receive data. Like WPA, it uses TKIP, which improves greatly over the encryption found in WEP. d. WPA2-PSK WPA2-PSK is designed for home users. Like WEP, it uses a pre-shared key that every user of the network must have in order to be able to send and receive data. Like WPA, it uses AES, which improves greatly over the encryption found in WEP. We recommend you use WPA-PSK/WPA2 or WPA-PSK/WPA2-PSK whenever possible. For the detail security setting, please refer to Chapter 4Configuring Wireless Security.

256-bit WEP shall be complied with your AP/Routers WEP setting. WLAN Networking
2.2) [Enable CCX Mode] refers the Cisco Compatible Extension, which is the certificate-based authentications (EAP-TLS, PEAP and LEAP) using dynamic keys for data encryption. Check this box will enable PEAP-MS-CHAP-V2, PEAP-GTC, TLS and LEAP. Please see your MIS administrator for these settings when you are about to enable one of these mode. Please refer to Ch4Configuring Wireless Security for detail WEP-802.1x and WPA-802.1x authentication information. Also, please see the User Guide of Funk Odyssey software for more WPA-enterprise security settings. 2.3) [Authentication Mode] includes PEAP-MS-CHAP-V2, PEAP-GTC, TLS and LEAP. Please refer to Chapter 4Configuring Wireless Security for the detail authentication information.
Advanced Mode: This screen (Bottom Red Rectangle) allows you to make changes to the default ways the card operates including advanced 802.11 settings. Unless you are an advanced user and have deep knowledge about each property on this page, it is recommended that you leave them at the default settings. For more information, please refer to section 2.3 and 2.4.
ZyXEL G-162/G-360 Users Guide [Turbo Mode] allows you either Active or Inactive the 22Mbps and 125Mbps. The information will be also shown under Link Info screen. Please refer to 1.1.3 Link Info for the detail explanation. [Packet Burst] allows you either Active or Inactive the packet burst. The information will be also shown under Link Info screen. Please refer to 1.1.3 Link Info for the detail explanation.

1.3.2 Profile

Profile screen enables you to create, edit and delete the profiles that the adapters used to connect AP/Router.
Explanation of each button in this page is shown below. WLAN Networking 1-9
ZyXEL G-162/G-360 Users Guide Profile Pool A list of inactive profiles, which are not currently connected to AP/Router. Default profile name is set ZyXEL. You can add new profile by clicking [New], modify profile by clicking [Edit] and delete it by clicking [Delete]. Active Profiles 1) A list of active profiles, which are currently connected to AP/Router. Each profile in the Active Profiles list has a priority based on its location on the list. 2) The higher in the list, the higher priority. When you connect the ZyXEL G-162/G-360 to AP/Router with a specific SSID, they will try to connect the AP/Router listed on the highest priority. If the connection is failed, it will connect to the second highest one. You can also select which AP/Router you want to connect to by clicking [up arrow] or [ down arrow]. 3) You may select AP/Router under the Profile Pool to the Active Profiles by clicking [right arrow]; likewise, clicking [left arrow] will move the AP/Router under the Active Profiles to the Profile Pool. 4) Click [Apply] will configure the profile you select. Also, when you finish the settings under the Profile Configuration, please go back to Profile screen and select the AP/Router you will connect to and then click [Apply] to active the connection.

1.3.3 Link Info

Link Info screen shows the current configuration and connection status of your G-162/G-360. The Link Info shows you the information including Receive, Transmit, Connection Information, Network information and OTIST.
ZyXEL G-162/G-360 Users Guide OTIST Function (Above Red Rectangle) OTIST (One Touch Intelligent Security Technology) is the ZyXEL proprietary one bottom security technology. You must have the ZyXEL P-334WT router or other ZyXEL AP/Router supporting OTIST to set the wireless adapter to use the same wireless settings. 1. Check this box to enable OTIST 2. [Setup Key] Enter the same setup key (of exactly eight ASCII characters) as the ZyXEL P-334WT router or other ZyXEL AP/Router to which you want to associate. The default OTIST setup key is 01234567. If you change the OTIST setup key on the ZyXEL P-334WT or other ZyXEL Routers supporting OTIST, you must also make the same change here. 3. Click [Start] to encrypt the wireless security data using the setup key and have the ZyXEL g+ AP or wireless router set your G-162/G-360 to use the same wireless settings as the ZyXEL g+ AP or wireless router at the same time. Please see the section for OTIST information. Table 1.2 Link Info Link Status Duration Receive Good Packets Duplicate Packets Error Packets Beacons Total Bytes Green Z icon displays Connected to Network This field displays the period when users enable the connection. This field displays the total number of complete, uninterrupted, and This field displays the total number of duplicated data received. This field displays the total number of incomplete, delayed or interrupted, This field displays a frame or message set by an adapter indicating a serious This field displays the total number of bytes received
ZyXEL G-162/G-360 Users Guide Transmit Good Packets Total Bytes Connection Information Association Rejects Association Timeouts Authentication Rejects Authentication Timeouts Packet Burst Mode This field displays the total number of rejections when connecting between Access Point/Router and your adapter. This field displays the total number of associations when connecting between AP/Router and your adapter failed after the certain period of time. This field displays the total number of rejections that occur during the authentication process This field displays the total number of authentications when connecting between AP/Router and your adapter failed after certain period of time. This is referring to an optional mode of transmitting data. Burst mode can significantly improve network performance because it allows more data to be sent without waiting for receiver acknowledgments. This field displays Active when enabling Packet Burst Mode. This field displays Inactive when disabling Packet Burst Mode. This field displays Active when enabling either 22Mbps or 125Mbps. This field displays Inactive when disabling either 22Mbps or 125Mbps. This field displays the total number of good packets transmitted This field displays the total number of bytes transmitted

Enter the WEP keys manually. Your ZyXEL G-162/G-360 allows you to configure up to four 64-bit, 128-bit or 256-bit4 WEP keys and only one key is used as the default key at any one time.
2.2.2 WPA-PSK and WPA2-PSK Application Example
A WPA-PSK/WPA-PSK2 application looks as follows. Step 1. First enter identical passwords into the AP and all wireless clients. The Pre-Shared Key (PSK) must consist of between 8 and 63 ASCII characters (including spaces and symbols). Step 2. The AP checks each clients password and (only) allows it to join the network if it matches its password. Step 3. The AP derives and distributes keys to the wireless clients. Step 4. The AP and wireless clients use the TKIP encryption process to encrypt data exchanged between them.
256-bit WEP shall be complied with your AP/Routers WEP setting. 2-19
Figure 2-6 WPA-PSK/WPA2-PSK Authentication
2.2.3 WPA and WPA2 with RADIUS Application Example
You need the IP address of the RADIUS server, its port number (default is 1812), and the RADIUS shared secret. A WPA/WPA2 application example with an external RADIUS server looks as follows. A is the RADIUS server. DS is the distribution system. Step 1. The AP passes the wireless clients authentication request to the RADIUS server. Step 2. The RADIUS server then checks the user's identification against its database and grants or denies network access accordingly. Step 3. The RADIUS server distributes a Pairwise Master Key (PMK) key to the AP that then sets up a key hierarchy and management system, using the pair-wise key to dynamically generate unique data encryption keys to encrypt every data packet that is wirelessly communicated between the AP and the wireless clients.
Figure 2-7 WPA/WPA2 with RADIUS Application Example

2.2.4 IEEE 802.1x

The IEEE 802.1x standard outlines enhanced security methods for both the authentication of wireless stations and encryption key management. Authentication can be done using an external RADIUS server. EAP Authentication EAP (Extensible Authentication Protocol) is an authentication protocol that runs on top of the IEEE802.1x transport mechanism in order to support multiple types of user authentication. By using EAP to interact with an EAP-compatible RADIUS server, an access point helps a wireless station and a RADIUS server perform authentication. The type of authentication you use depends on the RADIUS server and an intermediary AP(s) that supports IEEE802.1x. The ZyXEL G-162/G-360 supports EAP-TLS, EAP-TTLS and EAP-PEAP. For EAP-TLS authentication type, you must first have a wired connection to the network and obtain the certificate(s) from a certificate authority (CA). A certificate (also called digital IDs) can be used to authenticate users and a CA issues certificates and guarantees the identity of each certificate owner.

Fragmentation Threshold

The Fragmentation Threshold is the maximum data fragment size (between 256 and 2432 bytes) that can be sent in the wireless network before the ZyXEL G-162/G-360 will fragment the packet into smaller data frames. A large Fragmentation Threshold is recommended for networks not prone to interference while you should set a smaller threshold for busy networks or networks that are prone to interference. If the Fragmentation Threshold value is smaller than the RTS/CTS Threshold value (see previously) you set then the RTS (Request To Send)/CTS (Clear to Send) handshake will never occur as data frames will be fragmented before they reach RTS/CTS Threshold size.

RTS/CTS Threshold

A hidden node occurs when two stations are within range of the same access point, but are not within range of each other. The following figure illustrates a hidden node. Both stations are within range of the access point (AP) or wireless gateway, but out-of-range of each other, so they cannot hear each other, that is they do not know if the channel is currently being used. Therefore, they are considered hidden from each other.
Figure 2-8 RTS Threshold When station A sends data to the AP, it might not know that the station B is already using the channel. If these two stations send data at the same time, collisions may occur when both sets of data arrive at the AP at the same time, resulting in a loss of messages for both stations. RTS/CTS Threshold is designed to prevent collisions due to hidden nodes. An RTS/CTS Threshold defines the biggest size data frame you can send before an RTS (Request To Send)/CTS (Clear to Send) handshake is invoked. When a data frame exceeds the RTS/CTS Threshold value you set (between 0 to 2432 bytes), the station that wants to transmit this frame must first send an RTS (Request To Send) message to the AP for permission to send it. The AP then responds with a CTS (Clear to Send) message to all other stations within its range to notify them to defer their transmission. It also reserves and confirms with the requesting station the time frame for the requested transmission. 2-22 WLAN Networking
ZyXEL G-162/G-360 Users Guide Stations can send frames smaller than the specified RTS/CTS Threshold directly to the AP without the RTS (Request To Send)/CTS (Clear to Send) handshake. You should only configure RTS/CTS Threshold if the possibility of hidden nodes exists on your network and the cost of resending large frames is more than the extra network overhead involved in the RTS (Request To Send)/CTS (Clear to Send) handshake. If the RTS/CTS Threshold value is greater than the Fragmentation Threshold value (see next), then the RTS (Request To Send)/CTS (Clear to Send) handshake will never occur as data frames will be fragmented before they reach RTS/CTS Threshold size. Enabling the RTS Threshold causes redundant network overhead that could negatively affect the throughput performance.

OTIST (One Touch Intelligent Security Technology)
OTIST (One Touch Intelligent Security Technology) is the ZyXEL proprietary one bottom security technology. You must have the ZyXEL P-334WT router or other ZyXEL AP/Router supporting OTIST to set the wireless adapter to use the same wireless settings. The wireless adapter must also support OTIST and have OTIST enabled. The following are the wireless settings that the ZyXEL P-334WT or other ZyXEL AP/Router supporting OTIST assigns to the wireless adapter if OTIST is enabled on both devices and the OTIST setup keys are the same. SSID Security (WEP or WPA-PSK)

Chapter 3 Maintenance

This chapter describes how to uninstall or upgrade the ZyXEL Utility and Driver.

The About Screen

About screen displays related version numbers of the ZyXEL Wireless LAN Adapter (G-162 or G-360). When you contact ZyXEL for the tech support, please tell us the utility and driver version as follows.

Maintenance

ZyXEL G-162/G-360 Users Guide The following table describes the read-only fields in this screen. About
LABEL Model Name Driver Version Utility Version DESCRIPTION This field displays the devices model name. This field displays the version number of the ZyXEL driver. This field displays the version number of the ZyXEL utility.
Uninstalling the ZyXEL Utility
Follow the steps below to remove (or uninstall) the ZyXEL Utility from your computer. Step 1. Click Start, Programs, ZyXEL G-162v2&G-360v2 Utility, Uninstall. Step 2. When prompted, click [Yes] to remove the driver and the utility software.

Step 3.

Click [Finish] to finish the uninstall process. Reboot your computer if prompted to do so.
Upgrading the ZyXEL Utility
Before you uninstall the ZyXEL G-162/G-360v2 Utility, take note of the current network configuration.
To perform the upgrade, follow the steps below. Step 1. Download the latest version of the utility from the ZyXEL web site and save the file on your computer. Step 2. Follow the steps in Section 3.2 to remove the current ZyXEL Utility from your computer. Step 3. Restart your computer if prompted. Step 4. After restarting, refer to the procedure in the Quick Start Guide to install the new utility. Step 5. Check the version numbers in the About screen to make sure the new utility is installed properly.
Chapter 4 Configuring Wireless Security
This chapter covers the configuration of security options in the ZyXEL Utility.

Configuring WPA-PSK

1. 2. 3.
Select [WPA] under [Security] Select [PSK(Pre-Shared Key)] under [Authentication Mode] Click [Configure] and then you will see the screen below.
Enter the same pass phrase used to configure WPA-PSK on your access point. The key you enter is masked by default with asterisks (*). To view the key that you entered, check [Unmask].

Configuring WPA2-PSK

Select [WPA2] under [Security Mode]. Select [PSK(Pre-Shared Key)] under [Authentication Mode]. Click [Configure] and then you will see the screen below.
Enter the same pass phrase used to configure WPA-PSK on your access point. The same pass phrase used to configure WPA-PSK/WPA2-PSK on your access point. The key you enter is masked by default with asterisks (*). To view the key that you entered, check [Unmask].

Configuring WEP-802.1x

You need to know if your AP/Router support 802.1x or not and then follow its configuration. Check [Enable CCX mode] box when you need to enable the 802.1x setting. Then the EPA mode of LEAP, PEAP-MS-CHAP-V2, PEAP-GTC and TLS will be shown under [Authentication protocol]. For CCX mode information, please refer to Appendix A.
4.5.1 Configuring WEP-802.1x: EAP-LEAP
Select [WEP] under [Security]. Select [LEAP] under [Authentication Mode] Click [Configure] and then you will see the screen below.
Select an appropriate AP/Router to indicate whether: a. The utility prompts you for them each time you try to connect to AP/Router b. Enter login name and password under the [Login Name] and [Password]. The key you enter is masked by default with asterisks (*). To view the key that you entered, check [Unmask]. Click [OK]
4.5.2 Configuring WEP-802.1x: EAP-PEAP-MS-CHAPv2
Select [WEP] under [Security]. Select [PEAP MS-CHAP-V2] under [Authentication protocol] Click [Configure] and then you will see the screen below.

4. 5. 6. 7.

[Personal certificate] enables you to supply a personal certificate. This window is only applicable with Enterprise security. Please refer to your MIS administrator for this setting. To supply a personal certificate, please enter the user name assigned to the certificate under [User Name] Click [Browse] to see the [Intermediate Certification Authorities] screen below. [Validate Server Certificate]: Put a check in the box to activate server certificate.

8. 4-12

Select a certificate from the list, and click [OK]. Wireless Security
4.5.3 Configuring WEP-802.1x: PEAP-GTC
Select [WEP] under [Security]. Select [PEAP-GTC] under [Authentication Mode]. Click [Configure] and then you will see the screen below.
4.5.4 Configuring WEP-802.1x: EAP-TLS
Select [WEP] under [Security]. Select [TLS] under [Authentication protocol]. Click [Configure] and then you will see the screen below.

Troubleshooting

Problems with LED Status
Table 5-2 Troubleshooting LED Status
Make sure the ZyXEL G-162/G-360 is properly inserted. Please check and make sure your AP/Router is up and running.
LED PWR is not On LED LINK is not On or Blinking
Problems with the Link Status
Table 5-3 Troubleshooting Link Status
PROBLEM CORRECTIVE ACTION Search and connect to another AP with a better link quality using the Site Survey screen. Change the channel used by your AP. Move your computer closer to the AP or the peer computer(s) within the transmission range. There may be too much radio interference (for example microwave or another AP using the same channel) around your wireless network. Relocate or reduce the radio interference. When the ZyXEL G-360 happens into this problem, please also check the above corrective action. In addition, make sure your PC is not placed close to the wall or corner that the antenna cannot receive signal from the AP/Router. The antenna should be perpendicular to the ground but depending on your wireless environment, you may need to adjust the direction of antenna to get maximum signal.
The link quality and/or signal strength is poor all the time.
Problems with Security Settings
Table 5-4 Troubleshooting Security Settings
Make sure your AP/Router has the same setting as your client adapter and follow AP/Routers security settings.
Security Mode and Authentication Protocol cannot be configured
Problems Communicating With Other Computers
Table 5-5 Troubleshooting Communication Problems
PROBLEM CORRECTIVE ACTION Make sure your adapters are connected to the network.
The ZyXEL G-162/G-360 computer cannot communicate with the other computer. A. Infrastructure
Make sure that the AP and the associated computers are turned on and working properly. Make sure the ZyXEL G-162/G-360 computer and the associated AP use the same SSID. Change the AP and the associated wireless clients to use another radio channel if interference is high. Make sure that the computer and the AP share the same security option and key. Verify the settings in the Profile Security Settings screen. Verify that the peer computer(s) is turned on. Make sure the ZyXEL G-162/G-360 computer and the peer computer(s) are using the same SS ID and channel. Make sure that the computer and the peer computer(s) share the same security option and key. Change the wireless clients to use another radio channel if interference is high.

EAP-MD5 Mutual Authentication Certificate Client Certificate Server Dynamic Key Exchange Credential Integrity Deployment Difficulty Client Identity Protection No No No No None Easy No EAP-TLS Yes Yes Yes Yes Strong Hard No EAP-TTLS Yes Optional Yes Yes Strong Moderate Yes PEAP Yes Optional Yes Yes Strong Moderate Yes LEAP Yes No No Yes Moderate Moderate No

Appendix A

Chapter 5 AP Mode..... 65
5.1 AP Mode Overview.... 65 5.2 Setting your NBG460N to AP Mode... 65 5.3 The Status Screen in AP Mode... 66 5.3.1 Navigation Panel.... 68 5.4 Configuring Your Settings.... 69 5.4.1 LAN Settings.... 69 5.4.2 WLAN and Maintenance Settings... 71 5.5 Logging in to the Web Configurator in AP Mode... 71
Chapter 6 Tutorials..... 73
6.1 Wireless Tutorials.... 73
Table of Contents 6.1.1 How to Connect to the Internet from an AP... 73 6.1.2 Configure Wireless Security Using WPS on both your NBG460N and Wireless Client 73 6.1.3 Enable and Configure Wireless Security without WPS on your NBG460N. 76 6.1.4 Configure Your Notebook... 78 6.2 Site-To-Site VPN Tunnel Tutorial.... 80 6.2.1 Configuring Bobs NBG460N VPN Settings... 81 6.2.2 Configuring Jacks NBG460N VPN Settings.. 83 6.2.3 Checking the VPN Connection... 84

Part II: Network.... 87

Chapter 7 Wireless LAN..... 89
7.1 Wireless Network Overview.... 89 7.2 Wireless Security Overview.... 90 7.2.1 SSID..... 90 7.2.2 MAC Address Filter.... 90 7.2.3 User Authentication.... 90 7.2.4 Encryption.... 91 7.3 Roaming.... 92 7.3.1 Requirements for Roaming... 93 7.4 Quality of Service.... 93 7.4.1 WMM QoS.... 94 7.5 General Wireless LAN Screen.... 94 7.5.1 No Security..... 96 7.5.2 WEP Encryption.... 96 7.5.3 WPA-PSK/WPA2-PSK... 98 7.5.4 WPA/WPA2.... 99 7.6 MAC Filter.... 101 7.7 Wireless LAN Advanced Screen.... 102 7.8 Quality of Service (QoS) Screen.... 103 7.8.1 Application Priority Configuration.... 105 7.9 WiFi Protected Setup.... 106 7.9.1 WPS Screen.... 106 7.9.2 WPS Station Screen.... 107 7.9.3 Scheduling.... 107 7.10 iPod Touch Web Configurator... 108 7.10.1 Login Screen.... 109 7.10.2 System Status....110 7.10.3 WPS in Progress....112 7.10.4 Port Forwarding...113
Table of Contents 7.11 Accessing the iPod Touch Web Configurator...114 7.11.1 Accessing the iPod Touch Web Configurator...115

Chapter 8 WAN..... 117

8.1 WAN Overview....117 8.2 WAN MAC Address...117 8.3 Multicast.....117 8.4 Internet Connection...118 8.4.1 Ethernet Encapsulation...118 8.4.2 PPPoE Encapsulation....119 8.4.3 PPTP Encapsulation... 122 8.5 Advanced WAN Screen.... 125

Chapter 9 LAN..... 127

9.1 LAN Overview.... 127 9.1.1 IP Pool Setup.... 127 9.1.2 System DNS Servers.... 127 9.2 LAN TCP/IP.... 127 9.2.1 Factory LAN Defaults.... 127 9.2.2 IP Address and Subnet Mask... 128 9.2.3 Multicast.... 128 9.2.4 Any IP.... 128 9.3 LAN IP Screen.... 130 9.4 LAN IP Alias.... 130 9.5 Advanced LAN Screen.... 131

Chapter 10 DHCP.... 133

10.1 DHCP.... 133 10.2 DHCP General Screen.... 133 10.3 DHCP Advanced Screen.... 134 10.4 Client List Screen... 135
Chapter 11 Network Address Translation (NAT)... 137
11.1 NAT Overview.... 137 11.2 Using NAT.... 137 11.2.1 Port Forwarding: Services and Port Numbers... 137 11.2.2 Configuring Servers Behind Port Forwarding Example.. 138 11.3 General NAT Screen.... 138 11.4 NAT Application Screen.... 139

... 206

Chapter 18 Remote Management... 209
18.1 Remote Management Overview... 209 18.1.1 Remote Management Limitations... 209
Table of Contents 18.1.2 Remote Management and NAT... 210 18.1.3 System Timeout.... 210 18.2 WWW Screen.... 210 18.3 Telnet.....211 18.4 Telnet Screen....211 18.5 FTP Screen.... 212 18.6 DNS Screen.... 212
Chapter 19 Universal Plug-and-Play (UPnP)... 215
19.1 Introducing Universal Plug and Play... 215 19.1.1 How do I know if I'm using UPnP?... 215 19.1.2 NAT Traversal.... 215 19.1.3 Cautions with UPnP.... 215 19.2 UPnP and ZyXEL... 216 19.3 UPnP Screen.... 216 19.4 Installing UPnP in Windows Example... 217
Part V: Maintenance and Troubleshooting.. 227
Chapter 20 System..... 229
20.1 System Overview.... 229 20.2 System General Screen.... 229 20.3 Time Setting Screen.... 230

Chapter 21 Logs..... 233

21.1 View Log.... 233 21.2 Log Settings.... 234 21.3 Log Descriptions.... 237
Chapter 22 Tools..... 251
22.1 Firmware Upload Screen.... 251 22.2 Configuration Screen... 252 22.2.1 Backup Configuration... 253 22.2.2 Restore Configuration.... 253 22.2.3 Back to Factory Defaults... 254 22.3 Restart Screen..... 254 22.4 Wake On LAN.... 255
Chapter 23 Configuration Mode.... 257 Chapter 24 Sys Op Mode.... 259
24.1 Overview.... 259 24.1.1 Router.... 259 24.1.2 AP.... 259 24.2 Selecting System Operation Mode.... 260
Chapter 25 Language.... 263
25.1 Language Screen... 263
Chapter 26 Troubleshooting.... 265
26.1 Power, Hardware Connections, and LEDs... 265 26.2 NBG460N Access and Login... 266 26.3 Internet Access.... 268 26.4 Resetting the NBG460N to Its Factory Defaults.. 269 26.5 Wireless Router/AP Troubleshooting... 269 26.6 Advanced Features.... 270
Part VI: Appendices and Index... 271
Appendix A Product Specifications and Wall-Mounting Instructions. 273 Appendix B Pop-up Windows, JavaScripts and Java Permissions.. 279 Appendix C IP Addresses and Subnetting... 285 Appendix D Setting up Your Computers IP Address... 293

1.6 Good Habits for Managing the NBG460N
Do the following things regularly to make the NBG460N more secure and to manage the NBG460N more effectively. Change the password. Use a password thats not easy to guess and that consists of different types of characters, such as numbers and letters. Write down the password and put it in a safe place. Back up the configuration (and make sure you know how to restore it). Restoring an earlier working configuration may be useful if the device becomes unstable or even crashes. If you forget your password, you will have to reset the NBG460N to its factory default settings. If you backed up an earlier configuration file, you would not have to totally re-configure the NBG460N. You could simply restore your last configuration.

1.7 LEDs

Figure 3 Front Panel
The following table describes the LEDs.

Table 2 Front Panel LEDs

LED POWER COLOR Green STATUS On Off DESCRIPTION The NBG460N is receiving power and functioning properly. The NBG460N is not receiving power.
Chapter 1 Getting to Know Your NBG460N Table 2 Front Panel LEDs (continued)
LED LAN 1-4 COLOR Green STATUS On Blinking Amber On Blinking Off WAN Green On Blinking Amber On Blinking Off WLAN Green On Blinking Off WPS Green On DESCRIPTION The NBG460N has a successful 10/100MB Ethernet connection. The NBG460N is sending/receiving data. The NBG460N has a successful 1000MB Ethernet connection. The NBG460N is sending/receiving data. The LAN is not connected. The NBG460N has a successful 10/100MB WAN connection. The NBG460N is sending/receiving data. The NBG460N has a successful 1000MB Ethernet connection. The NBG460N is sending/receiving data. The WAN connection is not ready, or has failed. The NBG460N is ready, but is not sending/receiving data through the wireless LAN. The NBG460N is sending/receiving data through the wireless LAN. The wireless LAN is not ready or has failed. WPS (WiFi Protected Setup) is configured on your device. The NBG460N is attempting to connect with another wireless devices using WPS. WPS is disabled on your device.

Blinking Off

2.1 Overview

The WPS Button

Your NBG460N supports WiFi Protected Setup (WPS), which is an easy way to set up a secure wireless network. WPS is an industry standard specification, defined by the WiFi Alliance. WPS allows you to quickly set up a wireless network with strong security, without having to configure security settings manually. Each WPS connection works between two devices. Both devices must support WPS (check each devices documentation to make sure). Depending on the devices you have, you can either press a button (on the device itself, or in its configuration utility) or enter a PIN (a unique Personal Identification Number that allows one device to authenticate the other) in each of the two devices. When WPS is activated on a device, it has two minutes to find another device that also has WPS activated. Then, the two devices connect and set up a secure network by themselves. For more information on using WPS, see Section 6.1.2 on page 73.

Chapter 2 The WPS Button

Introducing the Web Configurator
This chapter describes how to access the NBG460N web configurator and provides an overview of its screens.
3.1 Web Configurator Overview
The web configurator is an HTML-based management interface that allows easy setup and management of the NBG460N via Internet browser. Use Internet Explorer 6.0 and later or Netscape Navigator 7.0 and later versions or Safari 2.0 or later versions. The recommended screen resolution is 1024 by 768 pixels. In order to use the web configurator you need to allow: Web browser pop-up windows from your device. Web pop-up blocking is enabled by default in Windows XP SP (Service Pack) 2. JavaScripts (enabled by default). Java permissions (enabled by default). Refer to the Troubleshooting chapter to see how to make sure these functions are allowed in Internet Explorer.
3.2 Accessing the Web Configurator
1 Make sure your NBG460N hardware is properly connected and prepare your computer or computer network to connect to the NBG460N (refer to the Quick Start Guide). 2 Launch your web browser. 3 Type "http://192.168.1.1" as the website address. Your computer must be in the same subnet in order to access this website address. In Router Mode enable the DHCP Server. The NBG460N assigns your computer an IP address on the same subnet. In AP Mode the NBG460N does not assign an IP address to your computer, so you should check its in the same subnet. See Section 5.5 on page 71 for more information.
Chapter 3 Introducing the Web Configurator
4 Type "1234" (default) as the password and click Login. In some versions, the default password appears automatically - if this is the case, click Login. 5 You should see a screen asking you to change your password (highly recommended) as shown next. Type a new password (and retype it to confirm) and click Apply or click Ignore.
Figure 4 Change Password Screen
The management session automatically times out when the time period set in the Administrator Inactivity Timer field expires (default five minutes). Simply log back into the NBG460N if this happens.
6 Select the setup mode you want to use. Click Go to Wizard Setup to use the Configuration Wizard for basic Internet and Wireless setup. Click Go to Basic Setup if you want to view and configure basic settings that are not part of the wizard setup. Not all Web Configurator screens are available in this mode. See Chapter 23 on page 257 for more information. Click Go to Advanced Setup to view and configure all the NBG460Ns settings. Select a language to go to the basic web configurator in that language. To change to the advanced configurator see Chapter 23 on page 257.

Chapter 3 Introducing the Web Configurator Figure 5 Selecting the setup mode
3.3 Resetting the NBG460N
If you forget your password or IP address, or you cannot access the web configurator, you will need to use the RESET button at the back of the NBG460N to reload the factory-default configuration file. This means that you will lose all configurations that you had previously saved, the password will be reset to 1234 and the IP address will be reset to 192.168.1.1.
3.3.1 Procedure to Use the Reset Button
1 Make sure the power LED is on. 2 Press the RESET button for five seconds or until the power LED begins to blink and then release it. When the power LED begins to blink, the defaults have been restored and the NBG460N restarts.
3.4 Navigating the Web Configurator
The following summarizes how to navigate the web configurator from the Status screen in Router Mode and AP Mode.
3.5 The Status Screen in Router Mode
Click on Status. The screen below shows the status screen in Router Mode. (For information on the status screen in AP Mode see Chapter 5 on page 66.)
Chapter 3 Introducing the Web Configurator Figure 6 Web Configurator Status Screen
The following table describes the icons shown in the Status screen.
Table 3 Status Screen Icon Key
ICON DESCRIPTION Click this icon to open the setup wizard. Click this icon to view copyright and a link for related product information. Click this icon at any time to exit the web configurator. Select a number of seconds or None from the drop-down list box to refresh all screen statistics automatically at the end of every time interval or to not refresh the screen statistics. Click this button to refresh the status screen statistics.
The following table describes the labels shown in the Status screen.
Table 4 Web Configurator Status Screen
LABEL Device Information System Name Firmware Version This is the System Name you enter in the Maintenance > System > General screen. It is for identification purposes. This is the firmware version and the date created. DESCRIPTION
Chapter 3 Introducing the Web Configurator Table 4 Web Configurator Status Screen (continued)
LABEL WAN Information - MAC Address - IP Address - IP Subnet Mask - DHCP LAN Information - MAC Address - IP Address - IP Subnet Mask - DHCP WLAN Information - MAC Address - Status - Name (SSID) - Channel - Operating Channel - Security Mode - 802.11 Mode - WPS This shows the wireless adapter MAC Address of your device. This shows the current status of the Wireless LAN - On, Off or Off by scheduler. This shows a descriptive name used to identify the NBG460N in the wireless LAN. This shows the channel number which you select manually. This shows the channel number which the NBG460N is currently using over the wireless LAN. This shows the level of wireless security the NBG460N is using. This shows the wireless standard. This displays Configured when the WPS has been set up. This displays Unconfigured if the WPS has not been set up. Click the status to display Network > Wireless LAN > WPS screen. This is the total time the NBG460N has been on. This field displays your NBG460Ns present date and time. This displays what percentage of the NBG460Ns processing ability is currently used. When this percentage is close to 100%, the NBG460N is running at full load, and the throughput is not going to improve anymore. If you want some applications to have more throughput, you should turn off other applications (for example, using bandwidth management. This shows what percentage of the heap memory the NBG460N is using. Heap memory refers to the memory that is not used by ZyNOS (ZyXEL Network Operating System) and is thus available for running processes like NAT and the firewall. This shows whether the firewall is active or not. This shows whether UPnP is active or not. This shows whether the advanced screens of each feature are turned on (Advanced) or not (Basic). This displays the NBG460N port types. The port types are: WAN, LAN and WLAN. This shows the LAN Ethernet adapter MAC Address of your device. This shows the LAN ports IP address. This shows the LAN ports subnet mask. This shows the LAN ports DHCP role - Server or None. This shows the WAN Ethernet adapter MAC Address of your device. This shows the WAN ports IP address. This shows the WAN ports subnet mask. This shows the WAN ports DHCP role - Client or None. DESCRIPTION

3.5.2 Summary: Any IP Table
This screen displays the IP address of each computer that is using the NBG460N via the any IP feature. Any IP allows computers to access the Internet through the NBG460N without changing their network settings when NAT is enabled. To access this screen, open the Status screen (see Section 3.5 on page 39), and click (Details.) next to Any IP Table.

Figure 7 Any IP Table

3.5.3 Summary: Bandwidth Management Monitor
Select the BW MGMT Monitor (Details.) hyperlink in Status screen. View the bandwidth usage of the WAN configured bandwidth rules. This is also shown as bandwidth usage over the bandwidth budget for each rule. The gray section of the bar represents the percentage of unused bandwidth and the blue color represents the percentage of bandwidth in use.
Chapter 3 Introducing the Web Configurator Figure 8 Summary: BW MGMT Monitor
3.5.4 Summary: DHCP Table
DHCP (Dynamic Host Configuration Protocol, RFC 2131 and RFC 2132) allows individual clients to obtain TCP/IP configuration at start-up from a server. You can configure the NBG460Ns LAN as a DHCP server or disable it. When configured as a server, the NBG460N provides the TCP/IP configuration for the clients. If DHCP service is disabled, you must have another DHCP server on that network, or else the computer must be manually configured. Click the DHCP Table (Details.) hyperlink in the Status screen. Read-only information here relates to your DHCP status. The DHCP table shows current DHCP client information (including IP Address, Host Name and MAC Address) of all network clients using the NBG460Ns DHCP server.
Figure 9 Summary: DHCP Table
The following table describes the labels in this screen.
Table 6 Summary: DHCP Table
LABEL # IP Address Host Name MAC Address DESCRIPTION This is the index number of the host computer. This field displays the IP address relative to the # field listed above. This field displays the computer host name. This field shows the MAC address of the computer with the name in the Host Name field. Every Ethernet device has a unique MAC (Media Access Control) address which uniquely identifies a device. The MAC address is assigned at the factory and consists of six pairs of hexadecimal characters, for example, 00:A0:C5:00:00:02. Click Refresh to renew the screen.

Refresh

3.5.5 Summary: Packet Statistics
Click the Packet Statistics (Details.) hyperlink in the Status screen. Read-only information here includes port status, packet specific statistics and the "system up time". The Poll Interval(s) field is configurable and is used for refreshing the screen.

Chapter 6 Tutorials

6.1.2.1 Push Button Configuration (PBC) 1 Make sure that your NBG460N is turned on and that it is within range of your computer. 2 Make sure that you have installed the wireless client (this example uses the NWD210N) driver and utility in your notebook. 3 In the wireless client utility, find the WPS settings. Enable WPS and press the WPS button (Start or WPS button) 4 Log into NBG460Ns web configurator and press the Push Button button in the Network > Wireless Client > WPS Station screen.
Your NBG460N has a WPS button located on its panel, as well as a WPS button in its configuration utility. Both buttons have exactly the same function; you can use one or the other.
It doesnt matter which button is pressed first. You must press the second button within two minutes of pressing the first one.
The NBG460N sends the proper configuration settings to the wireless client. This may take up to two minutes. Then the wireless client is able to communicate with the NBG460N securely. The following figure shows you an example to set up wireless network and security by pressing a button on both NBG460N and wireless client (the NWD210N in this example).
Chapter 6 Tutorials Figure 36 Example WPS Process: PBC Method

Wireless Client

WITHIN 2 MINUTES

SECURITY INFO

COMMUNICATION
6.1.2.2 PIN Configuration When you use the PIN configuration method, you need to use both NBG460Ns configuration interface and the clients utilities. 1 Launch your wireless clients configuration utility. Go to the WPS settings and select the PIN method to get a PIN number. 2 Enter the PIN number to the PIN field in the Network > Wireless LAN > WPS Station screen on the NBG460N. 3 Click Start buttons (or button next to the PIN field) on both the wireless client utility screen and the NBG460Ns WPS Station screen within two minutes. The NBG460N authenticates the wireless client and sends the proper configuration settings to the wireless client. This may take up to two minutes. Then the wireless client is able to communicate with the NBG460N securely. The following figure shows you the example to set up wireless network and security on NBG460N and wireless client (ex. NWD210N in this example) by using PIN method.

14.6 Customizing Keyword Blocking URL Checking
You can use commands to set how much of a websites URL the content filter is to check for keyword blocking. See the appendices for information on how to access and use the command interpreter.
14.6.1 Domain Name or IP Address URL Checking
By default, the NBG460N checks the URLs domain name or IP address when performing keyword blocking. This means that the NBG460N checks the characters that come before the first slash in the URL. For example, with the URL www.zyxel.com.tw/news/pressroom.php, content filtering only searches for keywords within www.zyxel.com.tw.
14.6.2 Full Path URL Checking
Full path URL checking has the NBG460N check the characters that come before the last slash in the URL. For example, with the URL www.zyxel.com.tw/news/pressroom.php, full path URL checking searches for keywords within www.zyxel.com.tw/news/. Use the ip urlfilter customize actionFlags 6 [disable | enable] command to extend (or not extend) the keyword blocking search to include the URL's full path.
14.6.3 File Name URL Checking
Filename URL checking has the NBG460N check all of the characters in the URL. For example, filename URL checking searches for keywords within the URL www.zyxel.com.tw/news/pressroom.php. Use the ip urlfilter customize actionFlags 8 [disable | enable] command to extend (or not extend) the keyword blocking search to include the URL's complete filename.

15.1 IPSec VPN Overview

IPSec VPN
A virtual private network (VPN) provides secure communications between sites without the expense of leased site-to-site lines. A secure VPN is a combination of tunneling, encryption, authentication, access control and auditing. It is used to transport traffic over the Internet or any insecure network that uses TCP/IP for communication. Internet Protocol Security (IPSec) is a standards-based VPN that offers flexible solutions for secure data communications across a public network like the Internet. IPSec is built around a number of standardized cryptographic techniques to provide confidentiality, data integrity and authentication at the IP layer. The following figure provides one perspective of a VPN tunnel.

Local ID Type

Local Content
LABEL Secure Gateway Address DESCRIPTION Type the WAN IP address or the domain name (up to 31 characters) of the IPSec router with which you're making the VPN connection. Set this field to 0.0.0.0 if the remote IPSec router has a dynamic WAN IP address (the IPSec Keying Mode field must be set to IKE). In order to have more than one active rule with the Secure Gateway Address field set to 0.0.0.0, the ranges of the local IP addresses cannot overlap between rules. If you configure an active rule with 0.0.0.0 in the Secure Gateway Address field and the LANs full IP address range as the local IP address, then you cannot configure any other active rules with the Secure Gateway Address field set to 0.0.0.0.
Note: You can also enter a remote secure gateways domain name in the Secure Gateway Address field if the remote secure gateway has a dynamic WAN IP address and is using DDNS. The NBG460N has to rebuild the VPN tunnel each time the remote secure gateways WAN IP address changes (there may be a delay until the DDNS servers are updated with the remote gateways new WAN IP address).
Peer ID Type Select IP to identify the remote IPSec router by its IP address. Select Domain Name to identify the remote IPSec router by a domain name. Select E-mail to identify the remote IPSec router by an e-mail address. The configuration of the peer content depends on the peer ID type. For IP, type the IP address of the computer with which you will make the VPN connection. If you configure this field to 0.0.0.0 or leave it blank, the NBG460N will use the address in the Secure Gateway Address field (refer to the Secure Gateway Address field description). For Domain Name or E-mail, type a domain name or e-mail address by which to identify the remote IPSec router. Use up to 31 ASCII characters including spaces, although trailing spaces are truncated. The domain name or e-mail address is for identification purposes only and can be any string. It is recommended that you type an IP address other than 0.0.0.0 or use the Domain Name or E-mail ID type in the following situations: When there is a NAT router between the two IPSec routers. When you want the NBG460N to distinguish between VPN connection requests that come in from remote IPSec routers with dynamic WAN IP addresses. Select Tunnel mode or Transport mode from the drop-down list box. Select the security protocols used for an SA. Both AH and ESP increase processing requirements and communications latency (delay). If you select ESP here, you must select options from the Encryption Algorithm and Authentication Algorithm fields (described below).

Peer Content

IPSec Algorithm Encapsulation Mode IPSec Protocol
LABEL Pre-Shared Key DESCRIPTION Type your pre-shared key in this field. A pre-shared key identifies a communicating party during a phase 1 IKE negotiation. It is called "pre-shared" because you have to share it with another party before you can communicate with them over a secure connection. Type from 8 to 31 case-sensitive ASCII characters or from 16 to 62 hexadecimal ("0-9", "A-F") characters. You must precede a hexadecimal key with a "0x (zero x), which is not counted as part of the 16 to 62 character range for the key. For example, in "0x0123456789ABCDEF", 0x denotes that the key is hexadecimal and 0123456789ABCDEF is the key itself. Both ends of the VPN tunnel must use the same pre-shared key. You will receive a PYLD_MALFORMED (payload malformed) packet if the same pre-shared key is not used on both ends. Select which key size and encryption algorithm to use for data communications. Choices are: DES - a 56-bit key with the DES encryption algorithm 3DES - a 168-bit key with the DES encryption algorithm The NBG460N and the remote IPSec router must use the same algorithms and key , which can be used to encrypt and decrypt the message or to generate and verify a message authentication code. Longer keys require more processing power, resulting in increased latency and decreased throughput. Select which hash algorithm to use to authenticate packet data. Choices are SHA1 and MD5. SHA1 is generally considered stronger than MD5, but it is also slower. Click Advanced. to configure more detailed settings of your IKE key management. Click Apply to save your changes back to the NBG460N. Click Reset to begin configuring this screen afresh. Click Cancel to exit the screen without making any changes.

Chapter 19 Universal Plug-and-Play (UPnP) Figure 142 Network Connections
4 An icon with the description for each UPnP-enabled device displays under Local Network. 5 Right-click on the icon for your NBG460N and select Invoke. The web configurator login screen displays.
Chapter 19 Universal Plug-and-Play (UPnP) Figure 143 Network Connections: My Network Places
6 Right-click on the icon for your NBG460N and select Properties. A properties window displays with basic information about the NBG460N.
Figure 144 Network Connections: My Network Places: Properties: Example

P ART V

Maintenance and Troubleshooting
System (229) Logs (233) Tools (251) Configuration Mode (257) Sys Op Mode (259) Language (263) Troubleshooting (265)
This chapter provides information on the System screens.

System

20.1 System Overview
See the chapter about wizard setup for more information on the next few screens.
20.2 System General Screen
Click Maintenance > System. The following screen displays.
Figure 145 Maintenance > System > General
Table 84 Maintenance > System > General
LABEL System Name DESCRIPTION System Name is a unique name to identify the NBG460N in an Ethernet network. It is recommended you enter your computers Computer name in this field (see the chapter about wizard setup for how to find your computers name). This name can be up to 30 alphanumeric characters long. Spaces are not allowed, but dashes - and underscores "_" are accepted. Enter the domain name (if you know it) here. If you leave this field blank, the ISP may assign a domain name via DHCP. The domain name entered by you is given priority over the ISP assigned domain name.
Chapter 20 System Table 84 Maintenance > System > General
LABEL Administrator Inactivity Timer DESCRIPTION Type how many minutes a management session can be left idle before the session times out. The default is 5 minutes. After it times out you have to log in with your password again. Very long idle timeouts may have security risks. A value of "0" means a management session never times out, no matter how long it has been left idle (not recommended). Change your NBG460Ns password (recommended) using the fields as shown. Type the default password or the existing password you use to access the system in this field. Type your new system password (up to 30 characters). Note that as you type a password, the screen displays an asterisk (*) for each character you type. Type the new password again in this field. Click Apply to save your changes back to the NBG460N. Click Reset to begin configuring this screen afresh.

Figure 172 Internet Options: Security
Click the Custom Level. button. Scroll down to Scripting. Under Active scripting make sure that Enable is selected (the default). Under Scripting of Java applets make sure that Enable is selected (the default). Click OK to close the window.
Appendix B Pop-up Windows, JavaScripts and Java Permissions Figure 173 Security Settings - Java Scripting

Java Permissions

5 From Internet Explorer, click Tools, Internet Options and then the Security tab. Click the Custom Level. button. Scroll down to Microsoft VM. Under Java permissions make sure that a safety level is selected. Click OK to close the window.
Figure 174 Security Settings - Java

JAVA (Sun)

1 From Internet Explorer, click Tools, Internet Options and then the Advanced tab. 2 Make sure that Use Java 2 for <applet> under Java (Sun) is selected. 3 Click OK to close the window.

Figure 175 Java (Sun)

This appendix introduces IP addresses and subnet masks.
IP Addresses and Subnetting
IP addresses identify individual devices on a network. Every networking device (including computers, servers, routers, printers, etc.) needs an IP address to communicate across the network. These networking devices are also known as hosts. Subnet masks determine the maximum number of possible hosts on a network. You can also use subnet masks to divide one network into multiple sub-networks.
Introduction to IP Addresses
One part of the IP address is the network number, and the other part is the host ID. In the same way that houses on a street share a common street name, the hosts on a network share a common network number. Similarly, as each house has its own house number, each host on the network has its own unique identifying number - the host ID. Routers use the network number to send packets to the correct network, while the host ID determines to which host on the network the packets are delivered.

Structure

An IP address is made up of four parts, written in dotted decimal notation (for example, 192.168.1.1). Each of these four parts is known as an octet. An octet is an eight-digit binary number (for example 11000000, which is 192 in decimal notation). Therefore, each octet has a possible range of 00000000 to 11111111 in binary, or 0 to 255 in decimal. The following figure shows an example IP address in which the first three octets (192.168.1) are the network number, and the fourth octet (16) is the host ID.
Appendix C IP Addresses and Subnetting Figure 176 Network Number and Host ID
How much of the IP address is the network number and how much is the host ID varies according to the subnet mask.

Subnet Masks

A subnet mask is used to determine which bits are part of the network number, and which bits are part of the host ID (using a logical AND operation). The term subnet is short for subnetwork. A subnet mask has 32 bits. If a bit in the subnet mask is a 1 then the corresponding bit in the IP address is part of the network number. If a bit in the subnet mask is 0 then the corresponding bit in the IP address is part of the host ID. The following example shows a subnet mask identifying the network number (in bold text) and host ID of an IP address (192.168.1.2 in decimal).
Table 117 Subnet Mask - Identifying Network Number
1ST OCTET: 2ND OCTET: (192) (168) IP Address (Binary) Subnet Mask (Binary) Network Number Host ID 3RD OCTET: (1) 4TH OCTET (2) 00000010 00000000
By convention, subnet masks always consist of a continuous sequence of ones beginning from the leftmost bit of the mask, followed by a continuous sequence of zeros, for a total number of 32 bits. Subnet masks can be referred to by the size of the network number part (the bits with a 1 value). For example, an 8-bit mask means that the first 8 bits of the mask are ones and the remaining 24 bits are zeroes.
Appendix C IP Addresses and Subnetting
Subnet masks are expressed in dotted decimal notation just like IP addresses. The following examples show the binary and decimal notation for 8-bit, 16-bit, 24-bit and 29-bit subnet masks.

Table 118 Subnet Masks

BINARY 1ST OCTET 8-bit mask 16-bit mask 24-bit mask 29-bit mask 2ND OCTET 3RD OCTET 4TH OCTET DECIMAL 255.0.0.0 255.255.0.0 255.255.255.0 255.255.255.248

Network Size

The size of the network number determines the maximum number of possible hosts you can have on your network. The larger the number of network number bits, the smaller the number of remaining host ID bits. An IP address with host IDs of all zeros is the IP address of the network (192.168.1.0 with a 24-bit subnet mask, for example). An IP address with host IDs of all ones is the broadcast address for that network (192.168.1.255 with a 24-bit subnet mask, for example). As these two IP addresses cannot be used for individual hosts, calculate the maximum number of possible hosts in a network as follows:

Private IP Addresses

Every machine on the Internet must have a unique address. If your networks are isolated from the Internet (running only between two branch offices, for example) you can assign any IP addresses to the hosts without problems. However, the Internet Assigned Numbers Authority (IANA) has reserved the following three blocks of IP addresses specifically for private networks: 10.0.0.0 10.255.255.255 172.16.0.0 172.31.255.255 192.168.0.0 192.168.255.255 You can obtain your IP address from the IANA, from an ISP, or it can be assigned from a private network. If you belong to a small organization and your Internet access is through an ISP, the ISP can provide you with the Internet addresses for your local networks. On the other hand, if you are part of a much larger organization, you should consult your network administrator for the appropriate IP addresses. Regardless of your particular situation, do not create an arbitrary IP address; always follow the guidelines above. For more information on address assignment, please refer to RFC 1597, Address Allocation for Private Internets and RFC 1466, Guidelines for Management of IP Address Space.
Setting up Your Computers IP Address
All computers must have a 10M or 100M Ethernet adapter card and TCP/IP installed. Windows 95/98/Me/NT/2000/XP, Macintosh OS 7 and later operating systems and all versions of UNIX/LINUX include the software components you need to install and use TCP/IP on your computer. Windows 3.1 requires the purchase of a third-party TCP/IP application package. TCP/IP should already be installed on computers using Windows NT/2000/XP, Macintosh OS 7 and later operating systems. After the appropriate TCP/IP components are installed, configure the TCP/IP settings in order to "communicate" with your network. If you manually assign IP information instead of using dynamic assignment, make sure that your computers have IP addresses that place them in the same subnet as the Prestiges LAN port.

Windows 95/98/Me

Click Start, Settings, Control Panel and double-click the Network icon to open the Network window.
Appendix D Setting up Your Computers IP Address Figure 179 WIndows 95/98/Me: Network: Configuration

Installing Components

The Network window Configuration tab displays a list of installed components. You need a network adapter, the TCP/IP protocol and Client for Microsoft Networks. If you need the adapter: 1 In the Network window, click Add. 2 Select Adapter and then click Add. 3 Select the manufacturer and model of your network adapter and then click OK. If you need TCP/IP: In the Network window, click Add. Select Protocol and then click Add. Select Microsoft from the list of manufacturers. Select TCP/IP from the list of network protocols and then click OK.