ZyXEL Prestige 660HW Series
ADSL Router with Wireless + Firewall

Version 3.40 5/2005

Installation Guide
P-660HW Series Quick Start Guide

Overview

The P-660HW is an ADSL Internet gateway with IEEE 802.11g wireless capability and a 4-port built-in switch. You may need your Internet access information. The P-660HW is referred to as the Prestige in this guide. See your Users Guide for background information on all features. This guide is divided into the following sections. 1 Hardware Connections 2 Configuration for Internet Access 3 Wireless Configuration 4 NAT 5 Firewall 6 Troubleshooting

1 Hardware Connections

You need the following before you start.
Prestige Computer(s) Ethernet Cable Telephone Cable Power Adaptor
1 DSL: Connect the Prestige to a telephone jack using a telephone wire. 2 LAN: Use an Ethernet cable to connect a computer to a LAN 10/100M port for initial configuration and/or Internet access. 3 POWER: Use the included power adaptor to connect the POWER socket to an appropriate power source (see the Users Guide for power adaptors specifications by region). After youve made the connections, push in the power button to turn on the Prestige. Look at the front panel LEDs. The PWR/SYS LED blinks while performing system testing. The PWR/SYS and/or WLAN LEDs then turn steady on if the testing is successful. The LAN LED turns on if the LAN port is properly connected.
2 Configuration for Internet Access
You may configure the Prestige for Internet access in any one of these ways:
P-660HW Series Quick Start Guide Configuration Genie Zero Configuration Web Configurator Internet Access Wizard

2.1 Configuration Genie

From the included CD, click Multimedia Auto Provisioner (the installation and configuration assistant) and then click Installation Tutorial. After youve viewed the tutorial, click Configuration Genie at the end of the installation tutorial or from Multimedia Auto Provisioner in the CD.

2.2 Zero Configuration

Launch your web browser and navigate to any web site (for example, www.zyxel.com). The Prestige automatically detects and configures your Internet connection. This may take about two minutes. If you have a PPPoE or PPPoA connection, a screen displays prompting you to enter your Internet account information. Enter the username, password and/or service name exactly as provided. Click Apply.
2.3 Accessing the Web Configurator
1 Launch your web browser. Enter 192.168.1.1 as the web site address.
Note: If you do not see the next screen, then please read Section 6.1 on page 10
2 Click Login. 3 Type a new password (retype it to confirm) and click Apply. Otherwise click Ignore. You then see the main web configurator screen
P-660HW Series Quick Start Guide 4 In the MAIN MENU screen, click WIZARD SETUP.
2.3.1 Internet Access Setup Note: Enter the Internet access information given to you by your ISP exactly in each wizard screen and then click Next to continue or click Back to return to the previous screen. Screen information is not saved when you click Back.
1 From the Mode drop-down list box, select Routing (default) if you want to use routing features such as NAT.
P-660HW Series Quick Start Guide 2 The next wizard screen varies depending on the Encapsulation you chose in the first wizard screen. From the Network Address Translation drop-down list box, select SUA Only if you have one public IP address, Full Feature if you have more than one public IP address (for translation) or None to disable NAT. PPPoE. Select Connect on Demand when you don't want the connection up all the time and specify an idle time-out period (in seconds) in the Max. Idle Timeout field. Select NailedUp Connection when you want your connection up all the time. The Prestige will try to bring up the connection automatically if it is disconnected. ENET ENCAP

Note: You will only see the next two screens in Routing mode.

PPPoA RFC1483

3 Verify your LAN and WAN settings. To change the LAN settings, click Change LAN Configuration; otherwise click Save Settings to save the configuration and go to the final wizard screen.If you change the Prestiges LAN IP address, you must use the new IP address if you want to access the web configurator again.
4 Click Save Settings in the screen shown in step 3 to go to the final wizard screen.The Prestige automatically tests the connection to the computer(s) connected to the LAN port. To test the connection from the Prestige to the ISP, click Start Diagnose. Otherwise click Return to Main Menu to go back to the main screen.

3 Wireless Configuration

WPA-PSK encryption is preferred to WEP because it has user authentication and improved data encryption. If you dont have WPA-capable wireless clients, configure WEP encryption.
Note: Wireless clients and the Prestige must use the same SSID, channel ID, WEP or WPA-PSK key (if enabled).
1 Click the Wireless LAN link under Advanced Setup.
2 Click 802.1x/WPA. Select Authentication Required, then select WPAPSK and then type a Preshared Key.
3 Click Advanced Setup, Wireless LAN, Wireless. In the ESSID field, enter up to 32 printable characters to uniquely identify the Prestige. If you didnt configure WPA-PSK, configure WEP in this screen (not visible if youve configured WPA-PSK).
NAT (Network Address Translation - NAT, RFC 1631) means the translation of an IP address in one network to a different IP address in another. For example, you could translate one public IP address to multiple private IP addresses on your LAN (SUA Only).
Click Advanced Setup and then NAT to open the NAT-Mode screen. Select SUA Only if you have one public IP address and Full Feature if you have multiple public IP addresses (for address translation).
If you have servers on your LAN, configure an SUA server set to have them visible to the outside. From the NAT Mode screen click Edit Details and fill in the fields as shown.

5 Firewall

The firewall is already enabled by default on the Prestige. Click Advanced Setup and then Firewall to open the firewall screen. The firewall protects your LAN from attacks from the Internet. No traffic can enter your LAN unless a request was generated on the LAN first. Click Default Policy to see rule direction information. You can also disable the firewall here if you want.

6 Troubleshooting

PROBLEM CORRECTIVE ACTION None of the LEDs turn on when Make sure that you have the correct power adaptor connected to the Prestige, it you connect the Prestiges is plugged into an appropriate power source and the Prestige is turned on. power. Check all cable connections. If the LEDs still do not turn on, you may have a hardware problem. In this case, you should contact your local vendor. Cannot access the Prestige from my computer. Check the cable connection from your computer to the Prestige. Make sure your computers IP address is in the same subnet as the Prestiges IP address (see Section 6.1 on page 10). Ping the Prestige from a computer on the LAN. Make sure your computers Ethernet adapter is installed and functioning properly. In the computer, click Start, (All) Programs, Accessories and then Command Prompt. In the Command Prompt window, type "ping" followed by the Prestiges LAN IP address (192.168.1.1 is the default) and then press [ENTER]. The Prestige should reply; otherwise see Section 6.1 on page 10. If the Prestiges IP address has changed, then enter the new one as the URL. Use Internet Explorer 6.0 and later or Netscape Navigator 7.0 and later with JavaScript enabled. Make sure you enter the password correctly (the field is case sensitive). If youve forgotten the Prestiges password, use the RESET button. Press the button in for about 10 seconds (or until the PWR/SYS LED starts to blink), then release it. It returns the Prestige to the factory defaults (password is 1234, LAN IP address 192.168.1.1 etc.; see your Users Guide for details). Cannot access the Internet. Verify the Internet connection settings in the wizard. Make sure you entered the correct user name and password if you are using PPPoE or PPPoA. For wireless clients, check that both the Prestige and wireless client(s) are using the same SSID, channel and WEP or WPA-PSK keys (if configured).

6.1 Set Up Your Computers IP Address
This section shows you how to set your Windows NT/2000/XP computer to automatically get an IP address. This ensures that your computer can with your Prestige. Refer to your Users Guide for detailed IP address configuration for other Windows and Macintosh computer operating systems. 1 In Windows XP, click start, Control Panel. In Windows 2000/NT, click Start, Settings, Control Panel. 2 In Windows XP, click Network Connections. In Windows 2000/NT, click Network and Dial-up Connections. 3 Right-click Local Area Connection and then click Properties.
P-660HW Series Quick Start Guide 4 Select Internet Protocol (TCP/IP) (under the General tab in Windows XP) and click Properties. 5 The Internet Protocol TCP/IP Properties screen opens (the General tab in Windows XP). 6 Select the Obtain an IP address automatically and Obtain DNS server address automatically options. 7 Click OK to close the Internet Protocol (TCP/IP) Properties window. 8 Click Close (OK in Windows 2000/NT) to close the Local Area Connection Properties window. 9 Close the Network Connections screen.
6.2 Viewing Your Products Certifications
1 Go to www.zyxel.com. 2 Select your product from the drop-down list box on the ZyXEL home page to go to that product's page. 3 Select the certification you wish to view from this page.

Prestige 660W/HW Series

ADSL 2/2+ Gateway with 802.11g Wireless

Compact Guide

Version 3.40 May 2004
Prestige 660W/HW Series Compact Guide

Table of Contents

1 Introducing the Prestige....Hardware....5 2.1 Rear Panel Connections....5 2.2 The Front Panel LEDs...Internet Access With Zero Configuration...Setting Up Your Computers IP Address...11 4.1 Windows 95/98/Me....11 4.2 Windows 2000/NT/XP...14 4.3 Checking/Updating Your Computers IP Address..15 4.4 Testing the Connection to the Prestige...Configuring Your Prestige...17 5.1 Accessing Your Prestige Via Web Configurator..17 5.2 Common Screen Command Buttons...18 5.3 Internet Access Using the Wizard..19 5.4 Test Your Internet Connection....Advanced Configuration...25 6.1 Wireless LAN Setup....25 6.2 Wireless LAN Security Setup...27 6.3 802.1x and WPA Overview...29 6.4 Network Address Translation Overview...29
Prestige 660W/HW Series Compact Guide 6.5 Configuring SUA Server...30 6.6 Firewall Overview...32 6.7 Enabling the Firewall...33 6.8 Procedure for Configuring Firewall Rules...33 6.9 Configuring Source and Destination Addresses...Troubleshooting....39
1 Introducing the Prestige
The Prestige 660W/HW ADSL 2/2+ Gateway with 802.11g Wireless is the ideal all-inone device for small networks connecting to the Internet via ADSL. Key features of the Prestige include NAT, 802.1x wireless LAN security, WPA (Wi-Fi Protected Access) and Firewall. See your Users Guide for more details on all Prestige features. You should have an Internet account already set up and have been given most of the following information.
INTERNET ACCOUNT INFORMATION Your devices WAN IP Address (if given): __________________ DNS Server IP Address (if given): Primary __________________, Secondary _________________ Virtual Path Identifier (VPI): ____________ Virtual Channel Identifier (VCI): ____________ Multiplexing (VC-based or LLC-based): Encapsulation: (choose one below) RFC 1483 ENET ENCAP PPPoA PPPoE Ethernet Encapsulation Gateway IP Address: __________________ User Name: ____________ Service Name: ____________ User Name: ____________ Password: ____________ Password: ____________ VC LLC

Certifications

1. 2. 3. Go to www.zyxel.com Select your product from the drop-down list box on the ZyXEL home page to go to that product's page. Select the certification you wish to view from this page.

2 Hardware

2.1 Rear Panel Connections
Figure 1 P660HW Hardware Connections Table 1 Prestige Rear Panel Description
LABEL DSL LAN 1 to LAN 4 POWER DESCRIPTION Connect to a telephone jack using the included phone wire. Connect to a computer/external hub using an Ethernet cable. Connect to a power source using the power adaptor for your region (see your Users Guide).
After youve made the connections, connect the power adaptor to a power supply and push in the power button to turn on the Prestige. The PWR/SYS LED blinks while performing system testing and then turns steady on if the testing is successful. A LAN LED turns on if a LAN port is properly connected.
Prestige 660W/HW Series Compact Guide Table 1 Prestige Rear Panel Description
LABEL RESET DESCRIPTION You only need to use this button if youve forgotten the Prestiges password. It returns the Prestige to the factory defaults (password is 1234, LAN IP address 192.168.1.1 etc.; see your Users Guide for details).

2.2 The Front Panel LEDs

Figure 2 P660HW Front Panel Refer to the following table for more detailed LED descriptions. Table 2 P660HW Front Panel LED Description
LED PWR/SYS COLOR Green STATUS On Blinking Red On DESCRIPTION The Prestige is receiving power and functioning properly. The Prestige is rebooting. Power to the Prestige is too low.
Prestige 660W/HW Series Compact Guide Table 2 P660HW Front Panel LED Description
LED COLOR STATUS Off LAN 1 to LAN 4 Green On Blinking Amber On Blinking Off WLAN Green On DESCRIPTION The system is not ready or has malfunctioned. The Prestige has a successful 10Mb Ethernet connection. The Prestige is sending/receiving data. The Prestige has a successful 100Mb Ethernet connection. The Prestige is sending/receiving data. The LAN is not connected. The Prestige is ready, but is not sending/receiving data through the wireless LAN. The Prestige is sending/receiving data through the wireless LAN. The wireless LAN is not ready or has failed. The Prestige is sending/receiving non-PPP data. The Prestige is initializing the DSL line. The system is ready, but is not sending/receiving non-PPP data. The connection to the PPPoE server is up. The Prestige is sending/receiving PPP data. The DSL link is down.

Blinking Off DSL/PPP Green Fast Blinking Slow Blinking On Amber On Blinking Off
Figure 3 P660W Front Panel Refer to the following table for more detailed LED descriptions. Table 3 P660W Front Panel LED Description
LED PWR COLOR Green STATUS On Off SYS Green On Blinking Red On Off DSL Green On Blinking Off DESCRIPTION The Prestige is receiving power. The Prestige is not receiving power. The Prestige is functioning properly. The Prestige is rebooting. Power to the Prestige is too low. The system is not ready or has malfunctioned. The Prestige is linked successfully to a DSLAM. The Prestige is initializing the DSL line. The DSL link is down.
Prestige 660W/HW Series Compact Guide Table 3 P660W Front Panel LED Description
LED PPP/ACT COLOR Green Amber STATUS Blinking On Blinking Off WLAN Green On Blinking Off 10M/100M Green On Blinking Amber On Blinking Off DESCRIPTION The Prestige is sending/receiving non-PPP data. The Prestige has a PPP (PPPoA or PPPoE) connection. The Prestige is sending/receiving PPPoA or PPPoE traffic. The system is ready, but is not sending/receiving data. The Prestige is ready, but is not sending/receiving data through the wireless LAN. The Prestige is sending/receiving data through the wireless LAN. The wireless LAN is not ready or has failed. The Prestige has a successful 10Mb Ethernet connection. The Prestige is sending/receiving data. The Prestige has a successful 100Mb Ethernet connection. The Prestige is sending/receiving data. The LAN is not connected.
3 Internet Access With Zero Configuration
With the Prestiges Zero Configuration, you can access the Internet easily. Simply connect a computer to the Prestige and access the Internet without changing the network settings (such as the IP address and subnet mask) of the computer.

Step 1. Step 2.

Make the hardware connections and turn on the Prestige (refer to the Rear Panel Connections section). Wait until the DSL/ACT LED turns steady on. Launch your web browser and navigate to a web site (for example, www.zyxel.com). The Prestige automatically detects and configures your Internet connection. This may take about two minutes. If you have a PPPoE or PPPoA connection type, a screen displays prompting you to enter your Internet account username and/or password. Enter the username, password and/or service name exactly as provided by your ISP. Click Apply.

Step 3.

Step 4.
You should be able to access the Internet. Otherwise, follow the onscreen instructions to solve the problem(s). Refer to the rest of this guide or the Users Guide to manually configure your Prestige for Internet connection and other advanced settings.
If an Internet access parameter changes, either change it manually or restart the device to have the Prestige automatically reconfigure your Internet connection.
4 Setting Up Your Computers IP Address
Skip this section if your computer is already set up to accept a dynamic IP address. This is the default for most new computers. The Prestige is already set up to assign your computer an IP address. Use this section to set up your computer to receive an IP address or assign it a static IP address in the 192.168.1.2 to 192.168.1.254 range with a subnet mask of 255.255.255.0. This is necessary to ensure that your computer can communicate with your Prestige. Your computer must have an Ethernet card and TCP/IP installed. TCP/IP should already be installed on computers using Windows NT/2000/XP, Macintosh OS 7 and later operating systems.

4.1 Windows 95/98/Me

1. 2. Click Start, Settings, Control Panel and double-click the Network icon to open the Network window. The Network window Configuration tab displays a list of installed components. You need a network adapter, the TCP/IP protocol and Client for Microsoft Networks.
Prestige 660W/HW Series Compact Guide 3. In the Network window Configuration tab, select your network adapter's TCP/IP entry and click Properties.
Click the IP Address tab. -If your IP address is dynamic, select Obtain an IP address automatically. -If you have a static IP address, select Specify an IP address and type your information into the IP Address and Subnet Mask fields.
5. Click the DNS Configuration tab. -If you do not know your DNS information, select Disable DNS. -If you know your DNS information, select Enable DNS and type the information in the fields below (you may not need to fill them all in).

Click the Gateway tab. -If you do not know your gateways IP address, remove previously installed gateways. -If you have a gateway IP address, type it in the New gateway field and click Add.
Click OK to save and close the TCP/IP Properties window.
8. 9. Click OK to close the Network window. Insert the Windows CD if prompted. Turn on your Prestige and restart your computer when prompted.
Verifying Your Computers IP Address
1. 2. 3. Click Start and then Run. In the Run window, type "winipcfg" and then click OK to open the IP Configuration window. Select your network adapter. You should see your computer's IP address, subnet mask and default gateway.

4.2 Windows 2000/NT/XP

1. 2. In Windows XP, click start, Control Panel. In Windows 2000/NT, click Start, Settings, Control Panel. In Windows XP, click Network Connections. In Windows 2000/NT, click Network and Dial-up Connections. 3. 4. 5. Right-click Local Area Connection and then click Properties. Select Internet Protocol (TCP/IP) (under the General tab in Win XP) and click Properties. The Internet Protocol TCP/IP Properties screen opens (the General tab in Windows XP). - To have your computer assigned a dynamic IP address, click Obtain an IP address automatically. If you know your DNS sever IP address(es), type them in the Preferred DNS server and/or Alternate DNS server fields. -To configure a static IP address, click Use the following IP Address and fill in the IP address (choose one from192.168.1.2 to 192.168.1.254), Subnet mask (255.255.255.0), and Default gateway (192.168.1.1) fields.
Then enter your DNS server IP address(es) in the Preferred DNS server and/or Alternate DNS server fields. If you have more than two DNS servers, click Advanced, the DNS tab and then configure them using Add. 6. Click Advanced. Remove any previously installed gateways in the IP Settings tab and click OK to go back to the Internet Protocol TCP/IP Properties screen.
Click OK to close the Internet Protocol (TCP/IP) Properties window. Click OK to close the Local Area Connection Properties window.
4.3 Checking/Updating Your Computers IP Address
1. 2. In the computer, click Start, (All) Programs, Accessories and then Command Prompt. In the Command Prompt window, type "ipconfig" and then press ENTER to verify that your computers IP address is in the correct range (192.168.1.2 to 192.168.1.254) with subnet mask 255.255.255.0. This is necessary in order to communicate with the Prestige.
Refer to your Users Guide for detailed IP address configuration for other Windows and Macintosh computer operating systems.
4.4 Testing the Connection to the Prestige
1. 2. 3. Click Start, (All) Programs, Accessories and then Command Prompt. In the Command Prompt window, type "ping followed by a space and the IP address of the Prestige (192.168.1.1 is the default). Press ENTER and the following screen displays.
C:\>ping 192.168.1.1 Pinging 192.168.1.1 with 32 bytes of data: Reply Reply Reply Reply from from from from 192.168.1.1: 192.168.1.1: 192.168.1.1: 192.168.1.1: bytes=32 bytes=32 bytes=32 bytes=32 time=10ms time<10ms time<10ms time<10ms TTL=254 TTL=254 TTL=254 TTL=254

Ping statistics for 192.168.1.1: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 10ms, Average = 2ms
Your computer can now communicate with the Prestige using the LAN port.
5 Configuring Your Prestige
This Compact Guide shows you how to use the web configurator only. See your Users Guide for background information on all Prestige features and SMT (System Management Terminal) configuration.
5.1 Accessing Your Prestige Via Web Configurator

Step 1.

Launch your web browser. Enter 192.168.1.1 as the web site address.

Web site address.

Figure 4 Entering Prestige LAN IP Address in Internet Explorer

Step 2.

An Enter Network Password window displays. Enter the user name (admin is the default), password (1234 is the default) and click OK.

Default user name.

Figure 5 Web Configurator: Password Screen
You should now see the web configurator Site Map screen. Click Wizard Setup to begin a series of screens to configure your Prestige for the first time. Click a link under Advanced Setup to configure advanced Prestige features.
Prestige 660W/HW Series Compact Guide Click a link under Maintenance to see Prestige performance statistics, upload firmware and back up, restore or upload a configuration file. Click Logout in the navigation panel when you have finished a Prestige management session.

WIZARD

Navigation panel

LOGOUT

Figure 6 Web Configurator: Site Map Screen The Prestige automatically times out after five minutes of inactivity. Simply log back into the Prestige if this happens to you.
5.2 Common Screen Command Buttons
The following table shows common command buttons found on many web configurator screens.
Back Apply Reset/Cancel Click Back to return to the previous screen. Click Apply to save your changes back to the Prestige. Click Reset or Cancel to begin configuring this screen afresh.
5.3 Internet Access Using the Wizard
Use the Wizard Setup screens to configure your system for Internet access settings and fill in the fields with the information in the Internet Account Information table. Your ISP may have already configured some of the fields in the wizard screens for you.
In the Site Map screen click Wizard Setup to display the first wizard screen.
From the Mode drop-down list box, select Routing (default) if your ISP allows multiple computers to share an Internet account. Otherwise select Bridge. Select the encapsulation type your ISP uses from the Encapsulation drop-down list box. Choices vary depending on what you select in the Mode field. Select the multiplexing method used by your ISP from the Multiplex drop-down list box. Enter the correct Virtual Path Identifier (VPI) and Virtual Channel Identifier (VCI) numbers supplied by your ISP in the VPI and VCI fields. These fields may already be configured.

Figure 7 Wizard Screen 1

Click Next.
The second wizard screen varies depending on what mode and encapsulation type you use. All screens shown are with routing mode. Configure the fields and click Next to continue.
If your ISP provides the name of your PPPoE service provider, enter it in the Service Name field. Enter the user name and password exactly as your ISP assigned them. Select Obtain an IP Address Automatically if you have a dynamic IP address; otherwise select Static IP Address and type your ISP assigned IP address in the text box below. Select Connect on Demand when you don't want the connection up all the time and specify an idle time-out period (in seconds) in the Max. Idle Timeout field.
Figure 8 Internet Connection with PPPoE
Select Nailed-Up Connection when you want your connection up all the time. The Prestige will try to bring up the connection automatically if it is disconnected From the Network Address Translation drop-down list box, select SUA Only, Full Feature or None. Refer to the Network Address Translation section for more information. Enter the IP address given by your ISP in the IP Address field.
The IP Address field is not available for bridge mode.
Refer to Figure 8 for description of the Network Address Translation field.
Figure 9 Internet Connection with RFC 1483
In the ENET ENCAP Gateway field, enter the gateway IP address given by your ISP. Refer to Figure 8 for other field descriptions.
Figure 10 Internet Connection with ENET ENCAP
Refer to Figure 8 for field descriptions.
The IP Address and Network Address Translation fields are not available for bridge mode.
Figure 11 Internet Connection with PPPoA
Verify the settings in the screen shown next. To change the LAN information on the Prestige, click Change LAN Configurations. Otherwise click Save Settings to save the configuration and skip the following step.
Figure 12 Wizard Screen 3

Step 5.

If you want to change your Prestige LAN settings, click Change LAN Configuration to display the screen as shown next.
Enter the IP address of your Prestige in dotted decimal notation in the LAN IP Address field. For example, 192.168.1.1 (factory default).
If you change the Prestiges LAN IP address, you must use the new IP address if you want to access the web configurator again.
Enter a subnet mask in dotted decimal notation in the LAN Subnet Mask field.
Figure 13 Wizard: LAN Configuration
From the DHCP Server drop-down list box, select On to allow your Prestige to assign IP addresses, an IP default gateway and DNS servers to computer systems that support the DHCP client. Select Off to disable DHCP server. When DHCP server is used, set the following items: Specify the first of the contiguous addresses in the IP address pool in the Client IP Pool Starting Address field. Specify the size or count of the IP address pool in the Size of Client IP Pool field. Enter the IP address(es) of the DNS server(s) in the Primary DNS Server and/or Secondary DNS Server fields.

Step 6.

The Prestige automatically tests the connection to the computer(s) connected to the LAN ports. To test the connection from the Prestige to the ISP, click Start Diagnose. Otherwise click Return to Main Menu to go back to the Site Map screen.
Figure 14 Wizard Screen 4
5.4 Test Your Internet Connection
Launch your web browser and navigate to www.zyxel.com. Internet access is just the beginning. Refer to the Users Guide for more detailed information on the complete range of Prestige features. If you cannot access the Internet, open the web configurator again to confirm that the Internet settings you configured in the Wizard Setup are correct.

6 Advanced Configuration

This section shows how to configure some of the advanced features of the Prestige.

6.1 Wireless LAN Setup

A wireless LAN (WLAN) provides a flexible data communications system that you can use to access various services (the Internet, email, printer services, etc.) on the wired network without additional expensive network cabling infrastructure. In effect, a wireless LAN environment provides you the freedom to stay connected to the wired network while moving in the coverage area. The WLAN screens are only available when a WLAN card is installed. To configure wireless settings, click Advanced Setup, Wireless LAN and then click Wireless.
Figure 15 Wireless LAN: Wireless
Prestige 660W/HW Series Compact Guide The following table describes the fields in this screen. Table 4 Wireless LAN: Wireless
LABEL Enable Wireless LAN DESCRIPTION The wireless LAN is turned off by default, before you enable the wireless LAN you should configure some security by setting MAC filters and/or 802.1x security; otherwise your wireless LAN will be vulnerable upon enabling it. Select the check box to enable the wireless LAN. (Extended Service Set IDentity) The ESSID is a unique name to identify the Prestige in the wireless LAN. Wireless clients associating to an Access Point (the Prestige) must have the same ESSID. Enter a descriptive name (up to 32 printable 7-bit ASCII characters). Select Yes to hide the ESSID so a wireless client cannot obtain the ESSID through passive scanning. Select No to make the ESSID visible so a wireless client can obtain the ESSID through passive scanning. The radio frequency used by IEEE 802.11b wireless devices is called a channel. Select a channel from the drop-down list box. Select this option to enable the RTS (Request To Send)/CTS (Clear To Send) threshold to minimize collisions. Enter a value between 0 and 2432. The default is 2432. Request To Send is the threshold (number of bytes) for enabling the RTS/CTS handshake. Data with its frame size larger than this value will perform the RTS/CTS handshake. Setting this attribute to be larger than the maximum MSDU (MAC Service Data Unit) size turns off the RTS/CTS handshake. Fragmentation Threshold WEP Encryption Fragmentation Threshold is the maximum data fragment size that can be sent. WEP (Wired Equivalent Privacy) encrypts data frames before transmitting them over the wireless network. Select Disable allows all wireless computers to communicate with the access points without any data encryption. Select 64-bit WEP, 128-bit WEP or 256-bit WEP and then configure the keys in the fields provided to activate data encryption.

Hide ESSID

Channel ID RTS/CTS Threshold
Prestige 660W/HW Series Compact Guide Table 4 Wireless LAN: Wireless
LABEL Key 1 to Key 4 DESCRIPTION The WEP keys are used to encrypt data. Both the Prestige and the wireless clients must use the same WEP key for data transmission. If you chose 64-bit WEP, then enter any 5 ASCII characters or 10 hexadecimal characters ("0-9", "A-F"). If you chose 128-bit WEP, then enter 13 ASCII characters or 26 hexadecimal characters ("0-9", "A-F"). If you chose 256-bit WEP, then enter 29 ASCII characters or 58 hexadecimal characters ("0-9", "A-F"). You must configure all four keys, but only one key can be activated at any one time. The default key is key 1.
The wireless clients and Prestige must use the same ESSID, channel ID and WEP encryption key (if WEP is enabled) for wireless communication.
6.2 Wireless LAN Security Setup
For added security, set your Prestige to check the MAC address of the wireless client device against a list of allowed or denied MAC addresses. To set up the MAC address list for wireless LAN, click Advanced Setup in the navigation panel, Wireless LAN and then click the MAC Filter link.
Figure 16 Wireless LAN: MAC Address Filter The following table describes the fields in this screen. Table 5 Wireless LAN: MAC Address Filter
LABEL Active Action DESCRIPTION Select Yes from the drop down list box to enable MAC address filtering. Define the filter action for the list of MAC addresses in the MAC Address table. Select Deny Association to block access to the router, MAC addresses not listed will be allowed to access the router Select Allow Association to permit access to the router, MAC addresses
not listed will be denied access to the router. MAC Address Enter the MAC addresses (in XX:XX:XX:XX:XX:XX format) of the wireless station that are allowed or denied access to the Prestige in these address fields.
6.3 802.1x and WPA Overview
Wi-Fi Protected Access (WPA) is a subset of the IEEE 802.11i security specification draft. Key differences between WPA and WEP are user authentication and improved data encryption. WPA applies IEEE 802.1x and Extensible Authentication Protocol (EAP) to authenticate wireless clients using an external RADIUS database. You cant use the Prestiges local user database for WPA authentication purposes since the local user database uses MD5 EAP which cannot be used to generate keys. WPA improves data encryption by using Temporal Key Integrity Protocol (TKIP), Message Integrity Check (MIC) and IEEE 802.1x. Temporal Key Integrity Protocol (TKIP) uses 128-bit keys that are dynamically generated and distributed by the authentication server. It includes a per-packet key mixing function, a Message Integrity Check (MIC) named Michael, an extended initialization vector (IV) with sequencing rules, and a re-keying mechanism. To change your Prestiges authentication settings, click the Wireless LAN link under Advanced Setup and then the 802.1x/WPA tab. The screen varies by the wireless port control and key management protocol you select.

6.4 Network Address Translation Overview
NAT (Network Address Translation - NAT, RFC 1631) is the translation of the IP address of a host in a packet. For example, the source address of an outgoing packet, used within one network is changed to a different IP address known within another network. If you have a single public IP address then select SUA Only in the NAT-Mode screen (see Figure 17). If you have multiple public IP addresses then you may use full feature mapping types (see the Users Guide for more details). NAT supports five types of IP/port mapping. They are: 1. One-to-One: One-to-one mode maps one local IP address to one global IP address. Note that port numbers do not change for One-to-one NAT mapping type.
Prestige 660W/HW Series Compact Guide 2. 3. 4. 5. Many-to-One: Many-to-One mode maps multiple local IP addresses to one global IP address. Many-to-Many Overload: Many-to-Many Overload mode maps multiple local IP addresses to shared global IP addresses. Many-to-Many No Overload: Many-to-Many No Overload mode maps each local IP address to unique global IP addresses. Server: This type allows you to specify inside servers of different services behind the NAT to be accessible to the outside world.
6.5 Configuring SUA Server
An SUA server set is a list of inside (behind NAT on the LAN) servers, for example, web or FTP, that you can make visible to the outside world even though SUA makes your whole inside network appear as a single computer to the outside world.

Step 7.

From the main screen click Advanced Setup and then NAT to open the NAT-Mode screen. Select SUA Only.

Figure 17 NAT: Mode

Step 8.

Click Edit Details.

Figure 18 SUA/NAT Server The following table describes the labels in this screen. Table 6 SUA/NAT Server
LABEL Start Port No. End Port No. DESCRIPTION Type a port number in this field. To forward only one port, type the port number again in the End Port field. To forward a series of ports, type the start port number here and the end port number in the End Port field. Type a port number in this field. To forward only one port, type the port number in the Start Port field above and then type it again in this field. To forward a series of ports, type the last port number in a series that begins with the port number in the Start Port field above. Enter the inside IP address of the server here.

IP Address

6.6 Firewall Overview
The Prestige firewall is a stateful inspection firewall and is designed to protect against Denial of Service attacks when activated. The Prestiges purpose is to allow a private Local Area Network (LAN) to be securely connected to the Internet. The Prestige can be used to prevent theft, destruction and modification of data, as well as log events, which may be important to the security of your network. The Prestige also has packet-filtering capabilities. When activated, the firewall allows all traffic to the Internet that originates from the LAN, and blocks all traffic to the LAN that originates from the Internet. In other words the Prestige will: Allow all sessions originating from the LAN to the WAN Deny all sessions originating from the WAN to the LAN LAN-to-WAN rules are local network to Internet firewall rules. The default is to forward all traffic from your local network to the Internet. The following figure illustrates a Prestige firewall application.

Denial of Service Attacks
Figure 19 Prestige Firewall Application
6.7 Enabling the Firewall
From the main screen, click Advanced Setup, Firewall and then Config to open the Configuration screen. Enable (or activate) the firewall by selecting the Enable Firewall check box as seen in the following screen.
Figure 20 Enabling the Firewall
6.8 Procedure for Configuring Firewall Rules
From the main screen, click Advanced Setup, Firewall and then Rule Summary (for either local network to Internet rules or Internet to local network rules) to open the Summary screen.
Figure 21 Rule Summary The following table describes the labels in this screen. Table 7 Rule Summary
LABEL The default action for packets not matching following rules Default Permit Log DESCRIPTION Should packets that do not match the following rules be blocked or forwarded? Make your choice from the drop down list box. Note that block means the firewall silently discards the packet.
Click this check box to log all matched rules in the Access Control List (ACL) default set.
Prestige 660W/HW Series Compact Guide Table 7 Rule Summary

LABEL DESCRIPTION

The following read-only fields summarize the rules you have created that apply to traffic traveling in the selected packet direction. The firewall rules that you configure (summarized below) take priority over the general firewall action settings above. No. This is your firewall rule number. The ordering of your rules is important as rules are applied in turn. The Move field below allows you to reorder your rules. This drop-down list box displays the source addresses or ranges of addresses to which this firewall rule applies. Please note that a blank source or destination address is equivalent to Any. This drop-down list box displays the destination addresses or ranges of addresses to which this firewall rule applies. Please note that a blank source or destination address is equivalent to Any. This drop-down list box displays the services to which this firewall rule applies. Please note that a blank service type is equivalent to Any. This is the specified action for that rule, either Block or Forward. Note that Block means the firewall silently discards the packet. This field shows you if a log is created for packets that match the rule (Match), don't match the rule (Not Match), both (Both) or no log is created (None). You may reorder your rules using this function. Select the rule you want to move. The ordering of your rules is important as rules are applied in turn. Select the number you want to move the rule to. Click Move to move the rule.

Source IP

Destination IP

Service

Action Log

Rules Reorder

To Rule Number Move
Follow these directions to create a new rule.
In the Summary screen, click a rules index number. The Edit Rule screen opens. In the Available Services text box, select the services you want. Customize ports for services not predefined by the Prestige by clicking the Edit
Prestige 660W/HW Series Compact Guide Available Service buttons. For a comprehensive list of port numbers and services, visit the IANA (Internet Assigned Number Authority) web site.
Configure the Source Address and Destination Address for the rule.
Figure 22 Creating/Editing A Firewall Rule The following table describes the labels in this screen.
Prestige 660W/HW Series Compact Guide Table 8 Creating/Editing A Firewall Rule
LABEL Source Address DESCRIPTION Click SrcAdd to add a new address, SrcEdit to edit an existing one or SrcDelete to delete one. Please see the next section for more information on adding and editing source addresses. Click DestAdd to add a new address, DestEdit to edit an existing one or DestDelete to delete one. Please see the following section on adding and editing destination addresses.
Destination Address Services Available/ Selected Services Edit Available Service Action for Matched Packets Log Alert Delete
Highlight a service from the Available Services box on the left, then click >> to add it to the Selected Services box on the right. To remove a service, highlight it in the Selected Services box on the right, then click <<. Click this button to go to the list of available services. Should packets that match this rule be blocked or forwarded? Make your choice from the drop down list box. Note that Block means the firewall silently discards the packet. This field determines if a log is created for packets that match the rule, dont match the rule, both or no log is created. Check the Alert check box to determine that this rule generates an alert when the rule is matched. Click Delete to remove this rule.
6.9 Configuring Source and Destination Addresses
To add a new source or destination address, click SrcAdd or DestAdd from the previous screen. To edit an existing source or destination address, select it from the box and click SrcEdit or DestEdit from the previous screen. Either action displays the following screen.
Figure 23 Adding/Editing Source and Destination Addresses The following table describes the labels in this screen. Table 9 Adding/Editing Source and Destination Addresses
LABEL Address Type DESCRIPTION Do you want your rule to apply to packets with a particular (single) IP address, a range of IP addresses (e.g., 192.168.1.10 to 192.169.1.50), a subnet or any IP address? Select an option from the drop down list box Enter the single IP address or the starting IP address in a range here. Enter the ending IP address in a range here. Enter the subnet mask here, if applicable.

Start IP Address End IP Address Subnet Mask

7 Troubleshooting

Table 10 Troubleshooting
PROBLEM None of the LEDs turn on when you turn on the Prestige. CORRECTIVE ACTION Make sure that you have the correct power adaptor connected to the Prestige and plugged in to an appropriate power source. Check all cable connections. If the LEDs still do not turn on, you may have a hardware problem. In this case, you should contact your local vendor. Check the cable connection between the Prestige and your computer or hub. Refer to the Rear Panel Connections section for details. Ping the Prestige from a LAN computer. Make sure your computer Ethernet adapter is installed and functioning properly. Cannot ping any computer on the LAN. If the LAN LEDs are all off, check the cable connections between the Prestige and your LAN computers. Verify that the IP address, subnet mask of the Prestige and the LAN computers are in the same IP address range. Make sure the WLAN LED is on. Make sure the wireless card on the wireless client is working properly. Check that both the Prestige and wireless client(s) are using the same ESSID, channel and WEP keys (if WEP encryption is activated). Cannot get a WAN IP address from the ISP. The WAN IP is provided after the ISP verifies the MAC address, host name or user ID. Find out the verification method used by your ISP and configure the corresponding fields. If the ISP checks the user ID, check your service type, user name, and password in the WAN Setup screen. Verify the Internet connection settings in the WAN Setup screen. Make sure you entered the correct user name and password. For wireless clients, check that both the Prestige and wireless client(s) are using the same ESSID, channel and WEP keys (if WEP encryption is activated).
Cannot access the Prestige from the LAN.
Cannot ping any computer on the WLAN
Cannot access the Internet.