ZyXEL Communications P660WTXV2 802.11g Wireless ADSL2+ Router User Manual SMG 700 User s Guide V1 00 Nov 2004

ZyXEL Communications Corporation 802.11g Wireless ADSL2+ Router SMG 700 User s Guide V1 00 Nov 2004

UserManual.wiki >

ZyXEL Communications >

P660WTXV2 User Manual >

Contents

Users manual1

www.zyxel.comP-660W-Tx v2ADSL Router over POTS/ISDNUser’s GuideVersion 3.4003/2008Edition 2DEFAULT LOGINIP Address http://192.168.1.1Password 1234

About This User's GuideP-660W-Tx v2 User’s Guide 3About This User's GuideIntended AudienceThis manual is intended for people who want to configure the ZyXEL Device using the web configurator. You should have at least a basic knowledge of TCP/IP networking concepts and topology.Related Documentation• Quick Start Guide The Quick Start Guide is designed to help you get up and running right away. It contains information on setting up your network and configuring for Internet access.• Web Configurator Online HelpEmbedded web help for descriptions of individual screens and supplementary information.• Command Reference GuideThe Command Reference Guide explains how to use the Command-Line Interface (CLI) and CLI commands to configure the ZyXEL Device."It is recommended you use the web configurator to configure the ZyXEL Device.• Supporting DiskRefer to the included CD for support documents.• ZyXEL Web SitePlease refer to www.zyxel.com for additional support documentation and product certifications.User’s Guide FeedbackHelp us help you. Send all User’s Guide-related comments, questions or suggestions for improvement to the following address, or use e-mail instead. Thank you!The Technical Writing Team,ZyXEL Communications Corp.,6 Innovation Road II,Science-Based Industrial Park, Hsinchu, 300, Taiwan.E-mail: techwriters@zyxel.com.tw

Document ConventionsP-660W-Tx v2 User’s Guide4Document ConventionsWarnings and NotesThese are how warnings and notes are shown in this User’s Guide. 1Warnings tell you about things that could harm you or your ZyXEL Device."Notes tell you other important information (for example, other things you may need to configure or helpful tips) or recommendations.Syntax Conventions• The P-660W-T1 v2 and the P-660W-T3 v2 may be referred to as the “ZyXEL Device”, the “P-660W-Tx v2”, the “device”, the “system” or the “product” in this User’s Guide.• Product labels, screen names, field labels and field choices are all in bold font.• A key stroke is denoted by square brackets and upper case text, for example, [ENTER] means the “enter” or “return” key on your keyboard.• “Enter” means for you to type one or more characters and then press the [ENTER] key. “Select” or “choose” means for you to use one of the predefined choices.• A right angle bracket (>) within a screen name denotes a mouse click. For example, Maintenance > Log > Log Setting means you first click Maintenance in the navigation panel, then the Log sub menu and finally the Log Setting tab to get to that screen.• Units of measurement may denote the “metric” value or the “scientific” value. For example, “k” for kilo may denote “1000” or “1024”, “M” for mega may denote “1000000” or “1048576” and so on.• “e.g.,” is a shorthand for “for instance”, and “i.e.,” means “that is” or “in other words”.Icons Used in FiguresFigures in this User’s Guide may use the following generic icons. The ZyXEL Device icon is not an exact representation of your ZyXEL Device.

Document ConventionsP-660W-Tx v2 User’s Guide 5Table 1 Common IconsZyXEL Device Computer NotebookServer Printer TelephoneSwitch Router Internet CloudFirewall Modem Wireless SignalTelevision DSLAM

Safety WarningsP-660W-Tx v2 User’s Guide6Safety Warnings1For your safety, be sure to read and follow all warning notices and instructions.• Do NOT use this product near water, for example, in a wet basement or near a swimming pool.• Do NOT expose your device to dampness, dust or corrosive liquids.• Do NOT store things on the device.• Do NOT install, use, or service this device during a thunderstorm. There is a remote risk of electric shock from lightning.• Connect ONLY suitable accessories to the device.• ONLY qualified service personnel should service or disassemble this device.• Make sure to connect the cables to the correct ports.• Place connecting cables carefully so that no one will step on them or stumble over them.• Always disconnect all cables from this device before servicing or disassembling.• Use ONLY an appropriate power adaptor or cord for your device. Connect it to the right supply voltage (for example, 110V AC in North America or 230V AC in Europe).• Use ONLY power wires of the appropriate wire gauge (see Chapter 20 on page 201 for details) for your device. Connect it to a power supply of the correct voltage (see Chapter 20 on page 201 for details).• Do NOT allow anything to rest on the power adaptor or cord and do NOT place the product where anyone can walk on the power adaptor or cord.• Do NOT use the device if the power adaptor or cord is damaged as it might cause electrocution.• If the power adaptor or cord is damaged, remove it from the device and the power source.• Do NOT attempt to repair the power adaptor or cord. Contact your local vendor to order a new one.• Do not use the device outside, and make sure all the connections are indoors. There is a remote risk of electric shock from lightning. • Do NOT obstruct the device ventilation slots, as insufficient airflow may harm your device. • Use only No. 26 AWG (American Wire Gauge) or larger telecommunication line cord. • Antenna Warning! This device meets ETSI and FCC certification requirements when using the included antenna(s). Only use the included antenna(s). • If you wall mount your device, make sure that no electrical lines, gas or water pipes will be damaged. This product is recyclable. Dispose of it properly.

Safety WarningsP-660W-Tx v2 User’s Guide 7

Safety WarningsP-660W-Tx v2 User’s Guide8

Contents OverviewP-660W-Tx v2 User’s Guide 9Contents OverviewIntroduction ............................................................................................................................ 27Introducing the ZyXEL Device ...................................................................................................29Introducing the Web Configurator .............................................................................................. 33Setup Wizard .......................................................................................................................... 39Connection Setup Wizard.......................................................................................................... 41Media Bandwidth Management Wizard ..................................................................................... 49Advanced Setup ..................................................................................................................... 53LAN Setup ................................................................................................................................. 55Wireless LAN ............................................................................................................................. 65WAN Setup ................................................................................................................................ 81Network Address Translation (NAT) Screens ............................................................................ 93Dynamic DNS Setup ................................................................................................................ 103Time and Date ......................................................................................................................... 105Firewalls .................................................................................................................................. 107Firewall Configuration ...............................................................................................................119Content Filtering ...................................................................................................................... 139Remote Management Configuration ........................................................................................ 143Universal Plug-and-Play (UPnP) ............................................................................................. 147Logs Screens ........................................................................................................................... 159Media Bandwidth Management Advanced Setup .................................................................... 165Maintenance ......................................................................................................................... 179Maintenance ............................................................................................................................ 181Troubleshooting and Specifications .................................................................................. 193Troubleshooting ....................................................................................................................... 195Product Specifications ............................................................................................................. 201Appendices ........................................................................................................................... 207

Contents OverviewP-660W-Tx v2 User’s Guide10

Table of ContentsP-660W-Tx v2 User’s Guide 11Table of ContentsAbout This User's Guide ..........................................................................................................3Document Conventions............................................................................................................4Safety Warnings........................................................................................................................ 6Contents Overview ...................................................................................................................9Table of Contents.................................................................................................................... 11List of Figures ......................................................................................................................... 19List of Tables........................................................................................................................... 23Part I: Introduction................................................................................. 27Chapter 1Introducing the ZyXEL Device............................................................................................... 291.1 Overview .............................................................................................................................. 291.2 Ways to Manage the ZyXEL Device .................................................................................... 291.3 Good Habits for Managing the ZyXEL Device ..................................................................... 301.4 LEDs .................................................................................................................................... 30Chapter 2Introducing the Web Configurator ........................................................................................ 332.1 Web Configurator Overview ................................................................................................. 332.1.1 Accessing the Web Configurator ................................................................................ 332.1.2 Resetting the ZyXEL Device ...................................................................................... 342.1.3 Navigating the Web Configurator ............................................................................... 342.2 Change Login Password .................................................................................................... 37Part II: Setup Wizard .............................................................................. 39Chapter 3Connection Setup Wizard ...................................................................................................... 413.1 Introduction .......................................................................................................................... 413.1.1 Internet Access Wizard Setup .................................................................................... 41

Table of ContentsP-660W-Tx v2 User’s Guide12Chapter 4Media Bandwidth Management Wizard................................................................................. 494.1 Introduction .......................................................................................................................... 494.1.1 Media Bandwidth Management Wizard ..................................................................... 49Part III: Advanced Setup........................................................................ 53Chapter 5LAN Setup................................................................................................................................ 555.1 LAN Overview ..................................................................................................................... 555.1.1 LANs, WANs and the ZyXEL Device .......................................................................... 555.1.2 DHCP Setup ...............................................................................................................565.1.3 DNS Server Address .................................................................................................. 565.1.4 DNS Server Address Assignment .............................................................................. 565.2 LAN TCP/IP ......................................................................................................................... 575.2.1 IP Address and Subnet Mask ..................................................................................... 575.2.2 RIP Setup ................................................................................................................... 585.2.3 Multicast ..................................................................................................................... 585.2.4 Any IP ......................................................................................................................... 595.3 Configuring LAN ................................................................................................................. 605.4 Configuring Static DHCP .................................................................................................... 62Chapter 6Wireless LAN........................................................................................................................... 656.1 Wireless Network Overview ................................................................................................. 656.2 Wireless Security Overview .................................................................................................666.2.1 SSID ........................................................................................................................... 666.2.2 MAC Address Filter .................................................................................................... 666.2.3 User Authentication .................................................................................................... 666.2.4 Encryption .................................................................................................................. 676.3 Additional Wireless Terms ................................................................................................... 686.4 The Main Wireless LAN Screen .......................................................................................... 686.5 Configuring the Wireless Screen ........................................................................................ 706.5.1 No Security ................................................................................................................. 716.5.2 WEP Encryption ......................................................................................................... 726.5.3 WPA-PSK/WPA2-PSK ................................................................................................ 736.5.4 WPA/WPA2 ................................................................................................................ 756.6 Configuring MAC Filters ................................................................................................... 776.7 WDS Screen ........................................................................................................................ 79Chapter 7WAN Setup............................................................................................................................... 81

Table of ContentsP-660W-Tx v2 User’s Guide 137.1 WAN Overview ................................................................................................................... 817.1.1 Encapsulation ............................................................................................................. 817.1.2 Multiplexing ................................................................................................................ 827.1.3 VPI and VCI ............................................................................................................... 827.1.4 IP Address Assignment .............................................................................................. 827.1.5 Nailed-Up Connection (PPP) ..................................................................................... 837.1.6 NAT ............................................................................................................................ 837.2 Metric .................................................................................................................................. 837.3 PPPoE Encapsulation ......................................................................................................... 847.4 Traffic Shaping ..................................................................................................................... 847.5 Zero Configuration Internet Access ..................................................................................... 857.6 The Main WAN Screen .......................................................................................................857.7 Configuring WAN Setup ...................................................................................................... 867.8 Traffic Redirect .................................................................................................................... 907.9 Configuring WAN Backup ................................................................................................... 90Chapter 8Network Address Translation (NAT) Screens.......................................................................938.1 NAT Overview ..................................................................................................................... 938.1.1 NAT Definitions ..........................................................................................................938.1.2 What NAT Does ......................................................................................................... 948.1.3 How NAT Works ......................................................................................................... 948.1.4 NAT Application ..........................................................................................................948.1.5 NAT Mapping Types ................................................................................................... 958.2 SUA (Single User Account) Versus NAT ............................................................................. 968.3 SUA Server .......................................................................................................................... 968.3.1 Default Server IP Address .......................................................................................... 978.3.2 Port Forwarding: Services and Port Numbers ............................................................ 978.3.3 Configuring Servers Behind SUA (Example) ............................................................. 978.4 Selecting the NAT Mode ..................................................................................................... 988.5 Configuring SUA Server Set ............................................................................................... 988.6 Configuring Address Mapping Rules .................................................................................. 998.7 Editing an Address Mapping Rule .................................................................................... 101Chapter 9Dynamic DNS Setup .............................................................................................................1039.1 Dynamic DNS Overview ................................................................................................... 1039.1.1 DYNDNS Wildcard ................................................................................................... 1039.2 Configuring Dynamic DNS ................................................................................................. 103Chapter 10Time and Date ....................................................................................................................... 10510.1 Configuring Time and Date ............................................................................................. 105

Table of ContentsP-660W-Tx v2 User’s Guide14Chapter 11Firewalls................................................................................................................................. 10711.1 Firewall Overview ............................................................................................................ 10711.2 Types of Firewalls ............................................................................................................ 10711.2.1 Packet Filtering Firewalls ....................................................................................... 10711.2.2 Application-level Firewalls ...................................................................................... 10811.2.3 Stateful Inspection Firewalls .................................................................................. 10811.3 Introduction to ZyXEL’s Firewall ....................................................................................... 10811.3.1 Denial of Service Attacks ....................................................................................... 10911.4 Denial of Service .............................................................................................................. 10911.4.1 Basics ..................................................................................................................... 10911.4.2 Types of DoS Attacks ..............................................................................................11011.5 Stateful Inspection .............................................................................................................11311.5.1 Stateful Inspection Process .....................................................................................11411.5.2 Stateful Inspection and the ZyXEL Device ..............................................................11411.5.3 TCP Security ...........................................................................................................11511.5.4 UDP/ICMP Security .................................................................................................11511.5.5 Upper Layer Protocols .............................................................................................11611.6 Guidelines for Enhancing Security with Your Firewall .......................................................11611.6.1 Security In General ..................................................................................................11611.7 Packet Filtering Vs Firewall ...............................................................................................11711.7.1 Packet Filtering: .......................................................................................................11711.7.2 Firewall ....................................................................................................................118Chapter 12Firewall Configuration ..........................................................................................................11912.1 Access Methods ...............................................................................................................11912.2 Firewall Policies Overview ...............................................................................................11912.3 Rule Logic Overview ....................................................................................................... 12012.3.1 Rule Checklist ........................................................................................................ 12012.3.2 Security Ramifications ............................................................................................ 12012.3.3 Key Fields For Configuring Rules .......................................................................... 12112.4 Connection Direction ....................................................................................................... 12112.4.1 LAN to WAN Rules ................................................................................................. 12112.4.2 Alerts ...................................................................................................................... 12212.5 The Main Firewall Screen ................................................................................................ 12212.6 Configuring Default Firewall Policy ............................................................................... 12212.7 Rule Summary ............................................................................................................... 12312.7.1 Configuring Firewall Rules ................................................................................... 12512.8 Customized Services ......................................................................................................12812.9 Configuring A Customized Service ................................................................................. 12812.10 Example Firewall Rule ................................................................................................... 12912.11 Predefined Services ....................................................................................................... 133

Table of ContentsP-660W-Tx v2 User’s Guide 1512.12 Anti-Probing ................................................................................................................... 13412.13 DoS Thresholds ............................................................................................................ 13512.13.1 Threshold Values ................................................................................................. 13512.13.2 Half-Open Sessions ............................................................................................. 13512.13.3 Configuring Firewall Thresholds ........................................................................... 136Chapter 13Content Filtering ................................................................................................................... 13913.1 Content Filtering Overview ............................................................................................. 13913.2 The Main Content Filter Screen ....................................................................................... 13913.3 Configuring Keyword Blocking ........................................................................................ 14013.4 Configuring the Schedule ............................................................................................... 14113.5 Configuring Trusted Computers ...................................................................................... 141Chapter 14Remote Management Configuration ................................................................................... 14314.1 Remote Management Overview ..................................................................................... 14314.1.1 Remote Management Limitations .......................................................................... 14314.1.2 Remote Management and NAT .............................................................................. 14414.1.3 System Timeout .................................................................................................... 14414.2 Telnet ............................................................................................................................... 14414.3 FTP .................................................................................................................................. 14414.4 Web ................................................................................................................................. 14514.5 Configuring Remote Management .................................................................................. 145Chapter 15Universal Plug-and-Play (UPnP).......................................................................................... 14715.1 Introducing Universal Plug and Play ............................................................................... 14715.1.1 How do I know if I'm using UPnP? ......................................................................... 14715.1.2 NAT Traversal ........................................................................................................ 14715.1.3 Cautions with UPnP ............................................................................................... 14715.2 UPnP and ZyXEL ............................................................................................................14815.2.1 Configuring UPnP ................................................................................................. 14815.3 Installing UPnP in Windows Example .............................................................................. 14915.4 Using UPnP in Windows XP Example ............................................................................. 152Chapter 16Logs Screens ........................................................................................................................15916.1 Logs Overview ................................................................................................................ 15916.1.1 Alerts and Logs ...................................................................................................... 15916.2 Configuring Log Settings ................................................................................................. 15916.3 Displaying the Logs ........................................................................................................ 16116.3.1 Example E-mail Log ............................................................................................... 162

Table of ContentsP-660W-Tx v2 User’s Guide16Chapter 17Media Bandwidth Management Advanced Setup .............................................................. 16517.1 Media Bandwidth Management Overview ...................................................................... 16517.2 Bandwidth Classes and Filters ........................................................................................ 16517.3 Proportional Bandwidth Allocation ................................................................................... 16617.4 Bandwidth Management Usage Examples ...................................................................... 16617.4.1 Application-based Bandwidth Management Example ............................................ 16617.4.2 Subnet-based Bandwidth Management Example .................................................. 16617.4.3 Application and Subnet-based Bandwidth Management Example ........................ 16717.5 Scheduler ........................................................................................................................ 16717.5.1 Priority-based Scheduler ........................................................................................ 16817.5.2 Fairness-based Scheduler ..................................................................................... 16817.6 Maximize Bandwidth Usage ............................................................................................ 16817.6.1 Reserving Bandwidth for Non-Bandwidth Class Traffic .......................................... 16817.6.2 Maximize Bandwidth Usage Example .................................................................... 16817.7 Bandwidth Borrowing .......................................................................................................17017.7.1 Maximize Bandwidth Usage With Bandwidth Borrowing ........................................ 17017.8 The Main Media Bandwidth Management Screen .......................................................... 17117.9 Configuring Summary ..................................................................................................... 17117.10 Configuring Class Setup ............................................................................................... 17217.10.1 Media Bandwidth Management Class Configuration ......................................... 17317.10.2 Media Bandwidth Management Statistics ........................................................... 17617.11 Bandwidth Monitor ....................................................................................................... 177Part IV: Maintenance............................................................................ 179Chapter 18Maintenance .......................................................................................................................... 18118.1 Maintenance Overview .................................................................................................... 18118.2 System Status Screen .................................................................................................... 18118.2.1 System Statistics .................................................................................................... 18318.3 DHCP Table Screen ....................................................................................................... 18518.4 Any IP Table Screen ....................................................................................................... 18518.5 Wireless Screen ............................................................................................................. 18618.5.1 Association List ..................................................................................................... 18618.6 Diagnostic Screens .......................................................................................................... 18718.6.1 General Diagnostic ................................................................................................ 18718.6.2 DSL Line Diagnostic ............................................................................................. 18818.7 Firmware Upgrade .......................................................................................................... 18918.8 FTP Command Line ........................................................................................................ 19018.8.1 Filename Conventions .......................................................................................... 191

Table of ContentsP-660W-Tx v2 User’s Guide 1718.8.2 FTP Command Line Procedure ............................................................................. 19118.8.3 GUI-based FTP Clients .......................................................................................... 19218.8.4 FTP Restrictions .................................................................................................... 192Part V: Troubleshooting and Specifications...................................... 193Chapter 19Troubleshooting.................................................................................................................... 19519.1 Power, Hardware Connections, and LEDs ...................................................................... 19519.2 ZyXEL Device Access and Login .................................................................................... 19619.3 Internet Access ................................................................................................................ 19719.4 Reset the ZyXEL Device to Its Factory Defaults .............................................................. 19819.5 Wireless Router/AP Troubleshooting ............................................................................... 199Chapter 20Product Specifications .........................................................................................................20120.1 General ZyXEL Device Specifications ............................................................................. 20120.2 Wall-mounting Instructions .............................................................................................. 20520.3 Power Adaptor Specifications .......................................................................................... 206Part VI: Appendices ............................................................................. 207Appendix A Pop-up Windows, JavaScripts and Java Permissions ...................................... 209Appendix B Wireless LANs .................................................................................................. 217Appendix C Common Services ............................................................................................ 231Appendix D Legal Information .............................................................................................. 235Appendix E Customer Support.............................................................................................241Index....................................................................................................................................... 247

Table of ContentsP-660W-Tx v2 User’s Guide18

List of FiguresP-660W-Tx v2 User’s Guide 19List of FiguresFigure 1 High-speed Internet Access with the ZyXEL Device ................................................................ 29Figure 2 Password Screen ..................................................................................................................... 34Figure 3 Change Password at Login ...................................................................................................... 34Figure 4 Web Configurator: Site Map Screen ....................................................................................... 35Figure 5 Password .................................................................................................................................. 37Figure 6 Internet Access Wizard Setup: ISP Parameters ....................................................................... 42Figure 7 Internet Connection with PPPoE .............................................................................................. 43Figure 8 Internet Connection with RFC 1483 ........................................................................................ 44Figure 9 Internet Connection with ENET ENCAP ...................................................................................44Figure 10 Internet Connection with PPPoA ............................................................................................ 45Figure 11 Internet Access Wizard Setup: Third Screen .......................................................................... 46Figure 12 Internet Access Wizard Setup: LAN Configuration ................................................................ 46Figure 13 Internet Access Wizard Setup: Connection Tests .................................................................. 47Figure 14 MBM Wizard: Media Bandwidth Management ...................................................................... 50Figure 15 MBM Wizard: Media Bandwidth Management ...................................................................... 51Figure 16 LAN and WAN IP Addresses .................................................................................................. 55Figure 17 Any IP Example ...................................................................................................................... 59Figure 18 LAN Setup .............................................................................................................................. 61Figure 19 LAN > Static DHCP ................................................................................................................ 62Figure 20 Example of a Wireless Network ............................................................................................. 65Figure 21 Wireless LAN .......................................................................................................................... 69Figure 22 Wireless Security Methods ..................................................................................................... 69Figure 23 Network > Wireless LAN ....................................................................................................... 70Figure 24 Network > Wireless LAN: No Security ................................................................................... 71Figure 25 Wireless Screen ..................................................................................................................... 72Figure 26 Network > Wireless LAN: WPA-PSK/ .....................................................................................74Figure 27 Network > Wireless LAN > General: WPA/WPA2 ................................................................... 75Figure 28 MAC Filter .............................................................................................................................. 78Figure 29 Connecting Wireless Networks Using WDS .......................................................................... 79Figure 30 Advanced Setup > Wireless LAN > WDS ............................................................................... 80Figure 31 Example of Traffic Shaping .................................................................................................... 85Figure 32 WAN ...................................................................................................................................... 85Figure 33 WAN Setup (PPPoE) .............................................................................................................. 87Figure 34 Traffic Redirect Example ........................................................................................................ 90Figure 35 Traffic Redirect LAN Setup ..................................................................................................... 90Figure 36 WAN Backup .......................................................................................................................... 91Figure 37 How NAT Works ..................................................................................................................... 94Figure 38 NAT Application With IP Alias ................................................................................................ 95

List of FiguresP-660W-Tx v2 User’s Guide20Figure 39 Multiple Servers Behind NAT Example ..................................................................................97Figure 40 NAT Mode .............................................................................................................................. 98Figure 41 Edit SUA/NAT Server Set ....................................................................................................... 99Figure 42 Address Mapping Rules ....................................................................................................... 100Figure 43 Edit Address Mapping Rule ................................................................................................. 101Figure 44 Dynamic DNS ....................................................................................................................... 104Figure 45 Time and Date ...................................................................................................................... 105Figure 46 ZyXEL Device Firewall Application ....................................................................................... 109Figure 47 Three-Way Handshake ..........................................................................................................110Figure 48 SYN Flood .............................................................................................................................111Figure 49 Smurf Attack ..........................................................................................................................112Figure 50 Stateful Inspection .................................................................................................................113Figure 51 Content Filtering .................................................................................................................. 122Figure 52 Firewall: Default Policy ......................................................................................................... 123Figure 53 Firewall: Rule Summary ...................................................................................................... 124Figure 54 Firewall: Edit Rule ................................................................................................................ 126Figure 55 Firewall: Customized Services ............................................................................................. 128Figure 56 Firewall: Configure Customized Services ............................................................................. 129Figure 57 Firewall Example: Rule Summary ........................................................................................ 130Figure 58 Firewall Example: Edit Rule: Destination Address .............................................................. 130Figure 59 Edit Custom Port Example ................................................................................................... 131Figure 60 Firewall Example: Edit Rule: Select Customized Services ................................................... 132Figure 61 Firewall Example: Rule Summary: My Service ................................................................... 133Figure 62 Firewall: Anti Probing ........................................................................................................... 134Figure 63 Firewall: Threshold ............................................................................................................... 136Figure 64 Content Filtering .................................................................................................................. 139Figure 65 Content Filter: Keyword ........................................................................................................ 140Figure 66 Content Filter: Schedule ....................................................................................................... 141Figure 67 Content Filter: Trusted .......................................................................................................... 141Figure 68 Telnet Configuration on a TCP/IP Network ........................................................................... 144Figure 69 Remote Management ........................................................................................................... 145Figure 70 Configuring UPnP ................................................................................................................. 148Figure 71 Add/Remove Programs: Windows Setup: Communication .................................................. 149Figure 72 Add/Remove Programs: Windows Setup: Communication: Components ............................ 150Figure 73 Network Connections ........................................................................................................... 150Figure 74 Windows Optional Networking Components Wizard ............................................................ 151Figure 75 Networking Services ............................................................................................................. 151Figure 76 Network Connections ........................................................................................................... 152Figure 77 Internet Connection Properties ............................................................................................ 153Figure 78 Internet Connection Properties: Advanced Settings ............................................................. 154Figure 79 Internet Connection Properties: Advanced Settings: Add .................................................... 154Figure 80 System Tray Icon .................................................................................................................. 155Figure 81 Internet Connection Status ................................................................................................... 155

List of FiguresP-660W-Tx v2 User’s Guide 21Figure 82 Network Connections ........................................................................................................... 156Figure 83 Network Connections: My Network Places .......................................................................... 157Figure 84 Network Connections: My Network Places: Properties: Example ........................................ 157Figure 85 Log Settings ......................................................................................................................... 160Figure 86 View Logs ............................................................................................................................. 162Figure 87 E-mail Log Example ............................................................................................................. 163Figure 88 Application-based Bandwidth Management Example .......................................................... 166Figure 89 Subnet-based Bandwidth Management Example ................................................................ 167Figure 90 Application and Subnet-based Bandwidth Management Example ....................................... 167Figure 91 Bandwidth Allotment Example .............................................................................................. 169Figure 92 Maximize Bandwidth Usage Example .................................................................................. 170Figure 93 Media Bandwidth Mgnt. ....................................................................................................... 171Figure 94 Media Bandwidth Management: Summary .......................................................................... 171Figure 95 Media Bandwidth Management: Class Setup ...................................................................... 173Figure 96 Media Bandwidth Management: Class Configuration .......................................................... 174Figure 97 Media Bandwidth Management Statistics ............................................................................ 176Figure 98 Media Bandwidth Management: Monitor ............................................................................. 177Figure 99 System Status ...................................................................................................................... 182Figure 100 System Status: Show Statistics .......................................................................................... 184Figure 101 DHCP Table ........................................................................................................................ 185Figure 102 Any IP Table ....................................................................................................................... 186Figure 103 Association List .................................................................................................................. 186Figure 104 Diagnostic: General ............................................................................................................ 187Figure 105 Diagnostic: DSL Line .......................................................................................................... 188Figure 106 Firmware Upgrade .............................................................................................................. 189Figure 107 Network Temporarily Disconnected ....................................................................................190Figure 108 Error Message .................................................................................................................... 190Figure 109 Wall-mounting Example ...................................................................................................... 205Figure 110 Masonry Plug and M4 Tap Screw .......................................................................................206Figure 111 Pop-up Blocker ................................................................................................................... 209Figure 112 Internet Options: Privacy .................................................................................................... 210Figure 113 Internet Options: Privacy .....................................................................................................211Figure 114 Pop-up Blocker Settings ......................................................................................................211Figure 115 Internet Options: Security ................................................................................................... 212Figure 116 Security Settings - Java Scripting ....................................................................................... 213Figure 117 Security Settings - Java ...................................................................................................... 213Figure 118 Java (Sun) .......................................................................................................................... 214Figure 119 Mozilla Firefox: Tools > Options .......................................................................................... 215Figure 120 Mozilla Firefox Content Security ......................................................................................... 215Figure 121 Peer-to-Peer Communication in an Ad-hoc Network ......................................................... 217Figure 122 Basic Service Set ............................................................................................................... 218Figure 123 Infrastructure WLAN ........................................................................................................... 219Figure 124 RTS/CTS ............................................................................................................................ 220

List of FiguresP-660W-Tx v2 User’s Guide22Figure 125 WPA(2) with RADIUS Application Example ....................................................................... 227Figure 126 WPA(2)-PSK Authentication ............................................................................................... 228

List of TablesP-660W-Tx v2 User’s Guide 23List of TablesTable 1 Common Icons ............................................................................................................................ 5Table 2 Front Panel LEDs ...................................................................................................................... 30Table 3 Web Configurator Screens Summary ....................................................................................... 35Table 4 Password .................................................................................................................................. 37Table 5 Internet Access Wizard Setup: ISP Parameters ....................................................................... 42Table 6 Internet Connection with PPPoE ............................................................................................... 43Table 7 Internet Connection with RFC 1483 .......................................................................................... 44Table 8 Internet Connection with ENET ENCAP ...................................................................................44Table 9 Internet Connection with PPPoA ............................................................................................... 45Table 10 Internet Access Wizard Setup: LAN Configuration ................................................................. 47Table 11 MBM Wizard: Media Bandwidth Management ........................................................................ 50Table 12 MBM Wizard: Media Bandwidth Management ........................................................................ 51Table 13 LAN Setup ............................................................................................................................... 61Table 14 LAN Setup ............................................................................................................................... 63Table 15 Types of Encryption for Each Type of Authentication ............................................................. 67Table 16 Additional Wireless Terms ....................................................................................................... 68Table 17 Wireless LAN .......................................................................................................................... 69Table 18 Network > Wireless LAN > General ........................................................................................ 70Table 19 Wireless No Security ............................................................................................................... 72Table 20 Wireless LAN .......................................................................................................................... 73Table 21 Network > Wireless LAN > General: WPA-PSK/WPA2-PSK .................................................. 74Table 22 Network > Wireless LAN > General: WPA/WPA2 ................................................................... 76Table 23 MAC Filter ............................................................................................................................... 78Table 24 Advanced Setup > Wireless LAN > WDS ............................................................................... 80Table 25 WAN ........................................................................................................................................ 86Table 26 WAN Setup ............................................................................................................................. 88Table 27 WAN Backup ........................................................................................................................... 91Table 28 NAT Definitions ....................................................................................................................... 93Table 29 NAT Mapping Types ................................................................................................................ 96Table 30 Services and Port Numbers .................................................................................................... 97Table 31 NAT Mode ............................................................................................................................... 98Table 32 Edit SUA/NAT Server Set ....................................................................................................... 99Table 33 Address Mapping Rules ........................................................................................................ 100Table 34 Edit Address Mapping Rule .................................................................................................. 102Table 35 Dynamic DNS ....................................................................................................................... 104Table 36 Time and Date ....................................................................................................................... 106Table 37 Common IP Ports ...................................................................................................................110Table 38 ICMP Commands That Trigger Alerts ....................................................................................112

List of TablesP-660W-Tx v2 User’s Guide24Table 39 Legal NetBIOS Commands ....................................................................................................112Table 40 Legal SMTP Commands .......................................................................................................112Table 41 Firewall > Firewall Functions ................................................................................................. 122Table 42 Firewall: Default Policy .......................................................................................................... 123Table 43 Rule Summary ...................................................................................................................... 124Table 44 Firewall: Edit Rule ................................................................................................................. 127Table 45 Customized Services ............................................................................................................ 128Table 46 Firewall: Configure Customized Services ............................................................................. 129Table 47 Firewall: Anti Probing ............................................................................................................ 134Table 48 Firewall: Threshold ................................................................................................................ 137Table 49 Content Filter > Functions ..................................................................................................... 139Table 50 Content Filter: Keyword ........................................................................................................ 140Table 51 Content Filter: Schedule ....................................................................................................... 141Table 52 Content Filter: Trusted .......................................................................................................... 142Table 53 Remote Management ........................................................................................................... 145Table 54 Configuring UPnP ................................................................................................................. 148Table 55 Log Settings .......................................................................................................................... 160Table 56 View Logs ............................................................................................................................. 162Table 57 Application and Subnet-based Bandwidth Management Example ....................................... 167Table 58 Media Bandwidth Mgnt. ........................................................................................................ 171Table 59 Media Bandwidth Management: Summary ........................................................................... 172Table 60 Media Bandwidth Management: Class Setup ....................................................................... 173Table 61 Media Bandwidth Management: Class Configuration ........................................................... 174Table 62 Services and Port Numbers .................................................................................................. 175Table 63 Media Bandwidth Management Statistics ............................................................................. 176Table 64 Media Bandwidth Management: Monitor .............................................................................. 177Table 65 System Status ....................................................................................................................... 182Table 66 System Status: Show Statistics ............................................................................................. 184Table 67 DHCP Table .......................................................................................................................... 185Table 68 Any IP Table .......................................................................................................................... 186Table 69 Association List ..................................................................................................................... 187Table 70 Diagnostic: General .............................................................................................................. 188Table 71 Diagnostic: DSL Line ............................................................................................................ 188Table 72 Firmware Upgrade ................................................................................................................ 189Table 73 Filename Conventions .......................................................................................................... 191Table 74 General Commands for GUI-based FTP Clients .................................................................. 192Table 75 Hardware Specifications ....................................................................................................... 201Table 76 Firmware Specifications ........................................................................................................ 202Table 77 Standards Supported ............................................................................................................ 203Table 78 Power Adaptor Specifications ............................................................................................... 206Table 79 IEEE 802.11g ........................................................................................................................ 221Table 80 Wireless Security Levels ....................................................................................................... 222Table 81 Comparison of EAP Authentication Types ............................................................................ 225

List of TablesP-660W-Tx v2 User’s Guide 25Table 82 Wireless Security Relational Matrix ...................................................................................... 228Table 83 Commonly Used Services ..................................................................................................... 231

List of TablesP-660W-Tx v2 User’s Guide26

27PART IIntroductionIntroducing the ZyXEL Device (29)Introducing the Web Configurator (33)

P-660W-Tx v2 User’s Guide 29CHAPTER 1 Introducing the ZyXEL DeviceThis chapter introduces the main applications and features of the ZyXEL Device. It also introduces the ways you can manage the ZyXEL Device.1.1 OverviewThe ZyXEL Device is an ADSL2+ gateway that allows fast, secure Internet access over analog (POTS) or digital (ISDN) telephone lines (depending on your model).The ZyXEL Device is an ADSL (Asymmetric Digital Subscriber Line) router and modem with wireless capability. See Chapter 20 on page 201 for a complete list of features.Figure 1 High-speed Internet Access with the ZyXEL DeviceConnect your computer(s) to the ZyXEL Device. The ZyXEL Device uses the phone line to provide high-speed Internet access to the computer(s). You can continue to use the phone line for regular phone calls as well. See the Quick Start Guide for instructions on making these connections.1.2 Ways to Manage the ZyXEL DeviceUse any of the following methods to manage the ZyXEL Device.• Web Configurator. This is recommended for everyday management of the ZyXEL Device using a (supported) web browser. See Chapter 2 on page 33. • Command Line Interface. Line commands are mostly used for troubleshooting by service engineers. See the CLI Reference Guide.INTERNET

Chapter 1 Introducing the ZyXEL DeviceP-660W-Tx v2 User’s Guide30• FTP. Use File Transfer Protocol for firmware upgrades and configuration backup/restore. See Chapter 18 on page 190. 1.3 Good Habits for Managing the ZyXEL DeviceDo the following things regularly to make the ZyXEL Device more secure and to manage the ZyXEL Device more effectively.• Change the password. Use a password that’s not easy to guess and that consists of different types of characters, such as numbers and letters.• Write down the password and put it in a safe place.• Back up the configuration (and make sure you know how to restore it). Restoring an earlier working configuration may be useful if the ZyXEL Device becomes unstable or even crashes. If you forget your password, you will have to reset the ZyXEL Device to its factory default settings. If you backed up an earlier configuration file, you would not have to totally re-configure the ZyXEL Device. You could simply restore your last configuration.1.4 LEDsThe following figure shows the front panel LEDs.The following table describes the LEDs. Table 2 Front Panel LEDsLED COLOR STATUS DESCRIPTIONPOWER Green On The ZyXEL Device is receiving power and functioning properly. Blinking The ZyXEL Device is rebooting or performing diagnostics.Off The system is not ready or has malfunctioned.ETHERNET Green On The ZyXEL Device has a successful 10/100 Mb Ethernet connection. Blinking The ZyXEL Device is sending/receiving data.Off The ZyXEL Device does not have an Ethernet connection.

Chapter 1 Introducing the ZyXEL DeviceP-660W-Tx v2 User’s Guide 31WLAN Green On The ZyXEL Device is ready, but is not sending/receiving data through the wireless LAN. Blinking The ZyXEL Device is sending/receiving data through the wireless LAN.Off The wireless LAN is not ready or has failed.DSL Green Fast Blinking The ZyXEL Device is trying to detect the DSL signal.Slow BlinkingThe ZyXEL Device is initializing the DSL line.On The DSL link is successful.Off The DSL link is down.INTERNET Green On The ZyXEL Device has a successful connection to the Internet.Blinking There is data traffic on the ZyXEL Device’s Internet connection.Off The ZyXEL Device has no connection with the Internet.Table 2 Front Panel LEDs (continued)LED COLOR STATUS DESCRIPTION

Chapter 1 Introducing the ZyXEL DeviceP-660W-Tx v2 User’s Guide32

P-660W-Tx v2 User’s Guide 33CHAPTER 2 Introducing the WebConfiguratorThis chapter describes how to access and navigate the web configurator.2.1 Web Configurator OverviewThe web configurator is an HTML-based management interface that allows easy ZyXEL Device setup and management via Internet browser. Use Internet Explorer 6.0 and later or Netscape Navigator 7.0 and later versions. The recommended screen resolution is 1024 by 768 pixels.In order to use the web configurator you need to allow:• Web browser pop-up windows from your device. Web pop-up blocking is enabled by default in Windows XP SP (Service Pack) 2.• JavaScripts (enabled by default).• Java permissions (enabled by default).See the chapter on troubleshooting if you need to make sure these functions are allowed in Internet Explorer.2.1.1 Accessing the Web Configurator Note: Even though you can connect to the ZyXEL Device wirelessly, it is recommended that you connect your computer to a LAN port for initial configuration.1Make sure your ZyXEL Device hardware is properly connected (refer to the Quick Start Guide).2Prepare your computer/computer network to connect to the ZyXEL Device (refer to the Quick Start Guide).3Launch your web browser.4Type “192.168.1.1” as the URL.5A window displays as shown.The Password field already contains the default password “1234”. Click Login to proceed to a screen asking you to change your password or click Cancel to revert to the default password.

Chapter 2 Introducing the Web ConfiguratorP-660W-Tx v2 User’s Guide34Figure 2 Password Screen6It is highly recommended you change the default password! Enter a new password between 1 and 30 characters, retype it to confirm and click Apply; alternatively click Ignore to proceed to the main menu if you do not want to change the password now. Note: If you do not change the password at least once, the following screen appears every time you log in.Figure 3 Change Password at Login7You should now see the SITE MAP screen.Note: The ZyXEL Device automatically times out after five minutes of inactivity. Simply log back into the ZyXEL Device if this happens to you.2.1.2 Resetting the ZyXEL DeviceIf you forget your password or cannot access the web configurator, you will need to use the RESET button at the back of the ZyXEL Device to reload the factory-default configuration file. This means that you will lose all configurations that you had previously and the password will be reset to “1234”.2.1.2.1 Using the Reset Button1Make sure the POWER LED is on (not blinking).2Press the RESET button for ten seconds or until the POWER LED begins to blink and then release it. When the POWER LED begins to blink, the defaults have been restored and the ZyXEL Device restarts.2.1.3 Navigating the Web ConfiguratorThe following summarizes how to navigate the web configurator from the SITE MAP screen.

Chapter 2 Introducing the Web ConfiguratorP-660W-Tx v2 User’s Guide 35• Click Wizard Setup to begin a series of screens to configure your ZyXEL Device for the first time.• Click a link under Advanced Setup to configure advanced ZyXEL Device features.• Click a link under Maintenance to see ZyXEL Device performance statistics, upload firmware and back up, restore or upload a configuration file.• Click Site Map to go to the Site Map screen. • Click Logout in the navigation panel when you have finished a ZyXEL Device management session.Figure 4 Web Configurator: Site Map Screen Note: Click the icon (located in the top right corner of most screens) to view embedded help. Table 3 Web Configurator Screens SummaryLINK SUB-LINK FUNCTIONWizard Setup Connection Setup Use these screens for initial configuration including general setup, ISP parameters for Internet Access and WAN IP/DNS Server/MAC address assignment.Media Bandwidth MgntUse these screens to limit bandwidth usage by application. Advanced SetupPassword Use this screen to change your password.LAN LAN Setup Use this screen to configure LAN settings.Static DHCP Use this screen to configure static DHCP settings on your LAN.Wireless LAN Wireless Use this screen to configure the wireless LAN settings.MAC Filter Use this screen to change MAC filter settings on the ZyXEL Device.WAN WAN Setup Use this screen to change the ZyXEL Device’s WAN remote node settings.WAN Backup Use this screen to configure your traffic redirect properties and WAN backup settings.NAT Use this screen to configure the NAT mode.Dynamic DNS Use this screen to set up dynamic DNS.Time and Date Use this screen to change your ZyXEL Device’s time and date.

Chapter 2 Introducing the Web ConfiguratorP-660W-Tx v2 User’s Guide36Firewall Default Policy Use this screen to activate/deactivate the firewall and the direction of network traffic to which to apply the rule. Rule Summary This screen shows a summary of the firewall rules, and allows you to edit/add a firewall rule.Anti Probing Use this screen to change your anti-probing settings.Threshold Use this screen to configure the threshold for DoS attacks.Content Filter Keyword Use this screen to block sites containing certain keywords in the URL.Schedule Use this screen to set the days and times for the ZyXEL Device to perform content filtering.Trusted Use this screen to exclude a range of users on the LAN from content filtering on your ZyXEL Device.Remote ManagementUse this screen to configure through which interface(s) and from which IP address(es) users can use Telnet/FTP/Web to manage the ZyXEL Device.UPnP Use this screen to enable UPnP on the ZyXEL Device.Logs Log Settings Use this screen to change your ZyXEL Device’s log settings.View Log Use this screen to view the logs for the categories that you selected.Media Bandwidth ManagementSummary Use this screen to assign bandwidth limits to specific types of traffic.Class Setup Use this screen to define a bandwidth class. Monitor Use this screen to view bandwidth class statistics. MaintenanceSystem Status This screen contains administrative and system-related information.DHCP Table This screen displays DHCP (Dynamic Host Configuration Protocol) related information and is READ-ONLY.Any IP Table Use this screen to view the IP and MAC addresses of LAN computers communicating with the ZyXEL Device. Wireless LAN Association List This screen displays the MAC address(es) of the wireless stations that are currently associating with the ZyXEL Device. Diagnostic General These screens display information to help you identify problems with the ZyXEL Device general connection.DSL Line These screens display information to help you identify problems with the DSL line.Firmware Use this screen to upload firmware to your ZyXEL DeviceLOGOUT Click Logout to exit the web configurator.Table 3 Web Configurator Screens Summary (continued)LINK SUB-LINK FUNCTION

Chapter 2 Introducing the Web ConfiguratorP-660W-Tx v2 User’s Guide 372.2 Change Login Password It is highly recommended that you periodically change the password for accessing the ZyXEL Device. If you didn’t change the default one after you logged in or you want to change to a new password again, then click Password in the Site Map screen to display the screen as shown next. Figure 5 PasswordThe following table describes the fields in this screen.Table 4 PasswordLABEL DESCRIPTIONOld Password Type the default password or the existing password you use to access the system in this field.New Password Type the new password in this field.Retype to Confirm Type the new password again in this field.Apply Click Apply to save your changes back to the ZyXEL Device.Cancel Click Cancel to begin configuring this screen afresh.

Chapter 2 Introducing the Web ConfiguratorP-660W-Tx v2 User’s Guide38

39PART IISetup WizardConnection Setup Wizard (41)Media Bandwidth Management Wizard (49)

P-660W-Tx v2 User’s Guide 41CHAPTER 3 Connection Setup WizardThe Connection Wizard assists you in setting up Internet access. This chapter provides information on the Connection Wizard screens in the web configurator.3.1 IntroductionUse the Connection Wizard screens to configure your system for Internet access with the information given to you by your ISP (Internet Service Provider). Note: See the advanced menu chapters for background information on these fields.3.1.1 Internet Access Wizard Setup1 In the SITE MAP screen click Connection Setup to display the first wizard screen.

Chapter 3 Connection Setup WizardP-660W-Tx v2 User’s Guide42Figure 6 Internet Access Wizard Setup: ISP ParametersThe following table describes the fields in this screen.2The next wizard screen varies depending on what mode and encapsulation type you use. All screens shown are with routing mode. Configure the fields and click Next to continue. Table 5 Internet Access Wizard Setup: ISP ParametersLABEL DESCRIPTIONMode From the Mode drop-down list box, select Routing (default) if your ISP allows multiple computers to share an Internet account. Otherwise select Bridge. Encapsulation Select the encapsulation type your ISP uses from the Encapsulation drop-down list box. Choices vary depending on what you select in the Mode field. If you select Bridge in the Mode field, select either PPPoA or RFC 1483. If you select Routing in the Mode field, select PPPoA, RFC 1483, ENET ENCAP or PPPoE.Multiplex Select the multiplexing method used by your ISP from the Multiplex drop-down list box either VC-based or LLC-based. Virtual Circuit IDVPI (Virtual Path Identifier) and VCI (Virtual Channel Identifier) define a virtual circuit. Refer to the appendix for more information.VPI Enter the VPI assigned to you. This field may already be configured.VCI Enter the VCI assigned to you. This field may already be configured.Next Click this button to go to the next wizard screen. The next wizard screen you see depends on what protocol you chose above. Click on the protocol link to see the next wizard screen for that protocol.

Chapter 3 Connection Setup WizardP-660W-Tx v2 User’s Guide 43Figure 7 Internet Connection with PPPoEThe following table describes the fields in this screen.Table 6 Internet Connection with PPPoELABEL DESCRIPTIONService Name Type the name of your PPPoE service here.User Name Enter the user name exactly as your ISP assigned. If assigned a name in the form user@domain where domain identifies a service name, then enter both components exactly as given.Password Enter the password associated with the user name above.IP Address A static IP address is a fixed IP that your ISP gives you. A dynamic IP address is not fixed; the ISP assigns you a different one each time you connect to the Internet. Select Obtain an IP Address Automatically if you have a dynamic IP address; otherwise select Static IP Address and type your ISP assigned IP address in the text box below. Connection Select Connect on Demand when you don't want the connection up all the time and specify an idle time-out (in seconds) in the Max. Idle Timeout field. The default setting selects Connection on Demand with 0 as the idle time-out, which means the Internet session will not timeout.Select Nailed-Up Connection when you want your connection up all the time. The ZyXEL Device will try to bring up the connection automatically if it is disconnected. Network Address Translation Select None, SUA Only or Full Feature from the drop-down list box. Refer to the NAT chapter for more details.Back Click Back to go back to the first wizard screen.Next Click Next to continue to the next wizard screen.

Chapter 3 Connection Setup WizardP-660W-Tx v2 User’s Guide44Figure 8 Internet Connection with RFC 1483The following table describes the fields in this screen.Figure 9 Internet Connection with ENET ENCAPThe following table describes the fields in this screen.Table 7 Internet Connection with RFC 1483LABEL DESCRIPTIONIP Address This field is available if you select Routing in the Mode field.Type your ISP assigned IP address in this field. Network Address Translation Select None, SUA Only or Full Feature from the drop-down list box. Refer to the NAT chapter for more details.Back Click Back to go back to the first wizard screen.Next Click Next to continue to the next wizard screen.Table 8 Internet Connection with ENET ENCAPLABEL DESCRIPTIONIP Address A static IP address is a fixed IP that your ISP gives you. A dynamic IP address is not fixed; the ISP assigns you a different one each time you connect to the Internet.Select Obtain an IP Address Automatically if you have a dynamic IP address; otherwise select Static IP Address and type your ISP assigned IP address in the IP Address text box below.Subnet Mask Enter a subnet mask in dotted decimal notation. Refer to the appendices to calculate a subnet mask If you are implementing subnetting.

Chapter 3 Connection Setup WizardP-660W-Tx v2 User’s Guide 45Figure 10 Internet Connection with PPPoAThe following table describes the fields in this screen.ENET ENCAP GatewayYou must specify a gateway IP address (supplied by your ISP) when you use ENET ENCAP in the Encapsulation field in the previous screen.Network Address Translation Select None, SUA Only or Full Feature from the drop-sown list box. Refer to the NAT chapter for more details.Back Click Back to go back to the first wizard screen.Next Click Next to continue to the next wizard screen.Table 9 Internet Connection with PPPoALABEL DESCRIPTIONUser Name Enter the login name that your ISP gives you. Password Enter the password associated with the user name above.IP Address This option is available if you select Routing in the Mode field.A static IP address is a fixed IP that your ISP gives you. A dynamic IP address is not fixed; the ISP assigns you a different one each time you connect to the Internet. Click Obtain an IP Address Automatically if you have a dynamic IP address; otherwise click Static IP Address and type your ISP assigned IP address in the IP Address text box below. Connection Select Connect on Demand when you don't want the connection up all the time and specify an idle time-out (in seconds) in the Max. Idle Timeout field. The default setting selects Connection on Demand with 0 as the idle time-out, which means the Internet session will not timeout.Select Nailed-Up Connection when you want your connection up all the time. The ZyXEL Device will try to bring up the connection automatically if it is disconnected. Table 8 Internet Connection with ENET ENCAP (continued)LABEL DESCRIPTION

Chapter 3 Connection Setup WizardP-660W-Tx v2 User’s Guide463Verify the settings in the screen shown next. To change the LAN information on the ZyXEL Device, click Change LAN Configurations. Otherwise click Save Settings to save the configuration and skip to the section 3.13. Figure 11 Internet Access Wizard Setup: Third ScreenIf you want to change your ZyXEL Device LAN settings, click Change LAN Configuration to display the screen as shown next. Figure 12 Internet Access Wizard Setup: LAN Configuration Network Address Translation This option is available if you select Routing in the Mode field.Select None, SUA Only or Full Feature from the drop-sown list box. Refer to the NAT chapter for more details.Back Click Back to go back to the first wizard screen.Next Click Next to continue to the next wizard screen.Table 9 Internet Connection with PPPoA (continued)LABEL DESCRIPTION

Chapter 3 Connection Setup WizardP-660W-Tx v2 User’s Guide 47The following table describes the fields in this screen.4The ZyXEL Device automatically tests the connection to the computer(s) connected to the LAN ports. To test the connection from the ZyXEL Device to the ISP, click Start Diagnose. Otherwise click Return to Main Menu to go back to the Site Map screen. Figure 13 Internet Access Wizard Setup: Connection TestsLaunch your web browser and navigate to www.zyxel.com. Refer to the rest of this guide for more detailed information on the complete range of ZyXEL Device features. If you cannot access the Internet, open the web configurator again to confirm that the Internet settings you configured in the Wizard Setup are correct.Table 10 Internet Access Wizard Setup: LAN ConfigurationLABEL DESCRIPTIONLAN IP Address Enter the IP address of your ZyXEL Device in dotted decimal notation, for example, 192.168.1.1 (factory default). If you changed the ZyXEL Device's LAN IP address, you must use the new IP address if you want to access the web configurator again.LAN Subnet Mask Enter a subnet mask in dotted decimal notation.DHCPDHCP Server From the DHCP Server drop-down list box, select On to allow your ZyXEL Device to assign IP addresses, an IP default gateway and DNS servers to computer systems that support the DHCP client. Select Off to disable DHCP server. When DHCP server is used, set the following items:Client IP Pool Starting AddressThis field specifies the first of the contiguous addresses in the IP address pool.Size of Client IP Pool This field specifies the size or count of the IP address pool.Primary DNS Server Enter the IP addresses of the DNS servers. The DNS servers are passed to the DHCP clients along with the IP address and the subnet mask.Secondary DNS Server As above.Back Click Back to go back to the previous screen.Finish Click Finish to save the settings and proceed to the next wizard screen.

Chapter 3 Connection Setup WizardP-660W-Tx v2 User’s Guide48

P-660W-Tx v2 User’s Guide 49CHAPTER 4 Media Bandwidth ManagementWizard4.1 IntroductionBandwidth management allows you to allocate priority to different kinds of traffic on your network to ensure the smoother flow of network traffic. For example, you can allocate a high priority to XBox Live traffic. Use the Media Bandwidth Management (MBM) Wizard screens to configure bandwidth management on your ZyXEL Device. "See Chapter 17 on page 165 for background information on Media Bandwidth Management.4.1.1 Media Bandwidth Management Wizard1 In the SITE MAP screen click Media Bandwidth Management Wizard to display the first wizard screen.

Chapter 4 Media Bandwidth Management WizardP-660W-Tx v2 User’s Guide50Figure 14 MBM Wizard: Media Bandwidth Management The following table describes the fields in this screen.2Configure levels of priority for the services you have selected in the next screen.Table 11 MBM Wizard: Media Bandwidth ManagementLABEL DESCRIPTIONActive Select Active to enable the Media Bandwidth Management feature on your ZyXEL Device. Select the service to apply bandwidth managementSelect the traffic type(s) to which you want to allocate priority. You can select the following:XBox Live - a game playing device used for gaming on the Internet, as well as playing media files such as videos. VoIP (SIP) - Voice over IP, this allows you to make calls over the Internet using a SIP server. FTP - File Transfer Protocol, a service used for downloading files.E-Mail - the email application used on your computer, rather than web-based email.eMule - a file-sharing applicationWWW - the World Wide WebIf you do not use a service, it is not necessary to set a priority for that service.Next Click Next to continue with the Wizard.

Chapter 4 Media Bandwidth Management WizardP-660W-Tx v2 User’s Guide 51Figure 15 MBM Wizard: Media Bandwidth Management The following table describes the fields in this screen.Table 12 MBM Wizard: Media Bandwidth ManagementLABEL DESCRIPTIONService This field lists the services selected in the previous screenPriority Select a priority level for each service you have specified in the previous screen. The options are High, Mid, Low and Others. Give voice and video applications a high priority, as quality is affected by transmission delays. VoIP is a voice service and XBox Live is a video service, so they should receive a high priority. Give Internet browsing a medium level priority as quality is not noticeably affected by brief delays.Give data transfer services such as eMule, FTP or E-Mail a low priority as quality is not affected by delays in transmission.Select Others for applications to which you do not want to apply QoS.Back Click Back to return to the previous screen.Finish Click Finish to save your settings and return to the main menu.

Chapter 4 Media Bandwidth Management WizardP-660W-Tx v2 User’s Guide52

53PART IIIAdvanced SetupLAN Setup (55)Wireless LAN (65)WA N Se tu p ( 81 )Network Address Translation (NAT) Screens (93)Dynamic DNS Setup (103)Time and Date (105)Firewalls (107)Firewall Configuration (119)Content Filtering (139)Remote Management Configuration (143)Universal Plug-and-Play (UPnP) (147)Logs Screens (159)Media Bandwidth Management Advanced Setup (165)

P-660W-Tx v2 User’s Guide 55CHAPTER 5 LAN SetupThis chapter describes how to configure LAN settings.5.1 LAN Overview A Local Area Network (LAN) is a shared communication system to which many computers are attached. A LAN is a computer network limited to the immediate area, usually the same building or floor of a building. The LAN screens can help you configure a LAN DHCP server and manage IP addresses. See Section 5.3 on page 60 to configure the LAN screens. 5.1.1 LANs, WANs and the ZyXEL DeviceThe actual physical connection determines whether the ZyXEL Device ports are LAN or WAN ports. There are two separate IP networks, one inside the LAN network and the other outside the WAN network as shown next.Figure 16 LAN and WAN IP Addresses

Chapter 5 LAN SetupP-660W-Tx v2 User’s Guide565.1.2 DHCP SetupDHCP (Dynamic Host Configuration Protocol, RFC 2131 and RFC 2132) allows individual clients to obtain TCP/IP configuration at start-up from a server. You can configure the ZyXEL Device as a DHCP server or disable it. When configured as a server, the ZyXEL Device provides the TCP/IP configuration for the clients. If you turn DHCP service off, you must have another DHCP server on your LAN, or else the computer must be manually configured. 5.1.2.1 IP Pool SetupThe ZyXEL Device is pre-configured with a pool of IP addresses for the DHCP clients (DHCP Pool). See the product specifications in the appendices. Do not assign static IP addresses from the DHCP pool to your LAN computers.5.1.3 DNS Server AddressDNS (Domain Name System) is for mapping a domain name to its corresponding IP address and vice versa. The DNS server is extremely important because without it, you must know the IP address of a machine before you can access it. The DNS server addresses that you enter in the DHCP setup are passed to the client machines along with the assigned IP address and subnet mask.There are two ways that an ISP disseminates the DNS server addresses. The first is for an ISP to tell a customer the DNS server addresses, usually in the form of an information sheet, when s/he signs up. If your ISP gives you the DNS server addresses, enter them in the DNS Server fields in DHCP Setup, otherwise, leave them blank.Some ISP’s choose to pass the DNS servers using the DNS server extensions of PPP IPCP (IP Control Protocol) after the connection is up. If your ISP did not give you explicit DNS servers, chances are the DNS servers are conveyed through IPCP negotiation. The ZyXEL Device supports the IPCP DNS server extensions through the DNS proxy feature.If the Primary and Secondary DNS Server fields in the LAN Setup screen are not specified, for instance, left as 0.0.0.0, the ZyXEL Device tells the DHCP clients that it itself is the DNS server. When a computer sends a DNS query to the ZyXEL Device, the ZyXEL Device forwards the query to the real DNS server learned through IPCP and relays the response back to the computer.Please note that DNS proxy works only when the ISP uses the IPCP DNS server extensions. It does not mean you can leave the DNS servers out of the DHCP setup under all circumstances. If your ISP gives you explicit DNS servers, make sure that you enter their IP addresses in the LAN Setup screen. This way, the ZyXEL Device can pass the DNS servers to the computers and the computers can query the DNS server directly without the ZyXEL Device’s intervention.5.1.4 DNS Server Address AssignmentUse DNS (Domain Name System) to map a domain name to its corresponding IP address and vice versa. The DNS server is extremely important because without it, you must know the IP address of a computer before you can access it. There are two ways that an ISP disseminates the DNS server addresses.

Chapter 5 LAN SetupP-660W-Tx v2 User’s Guide 57• The ISP tells you the DNS server addresses, usually in the form of an information sheet, when you sign up. If your ISP gives you DNS server addresses, enter them in the DNS Server fields in the LAN Setup screen.• The ZyXEL Device acts as a DNS proxy when the Primary and Secondary DNS Server fields are left blank in the LAN Setup screen.5.2 LAN TCP/IP The ZyXEL Device has built-in DHCP server capability that assigns IP addresses and DNS servers to systems that support DHCP client capability.5.2.1 IP Address and Subnet MaskSimilar to the way houses on a street share a common street name, so too do computers on a LAN share one common network number.Where you obtain your network number depends on your particular situation. If the ISP or your network administrator assigns you a block of registered IP addresses, follow their instructions in selecting the IP addresses and the subnet mask.If the ISP did not explicitly give you an IP network number, then most likely you have a single user account and the ISP will assign you a dynamic IP address when the connection is established. If this is the case, it is recommended that you select a network number from 192.168.0.0 to 192.168.255.0 and you must enable the Network Address Translation (NAT) feature of the ZyXEL Device. The Internet Assigned Number Authority (IANA) reserved this block of addresses specifically for private use; please do not use any other number unless you are told otherwise. Let's say you select 192.168.1.0 as the network number; which covers 254 individual addresses, from 192.168.1.1 to 192.168.1.254 (zero and 255 are reserved). In other words, the first three numbers specify the network number while the last number identifies an individual computer on that network.Once you have decided on the network number, pick an IP address that is easy to remember, for instance, 192.168.1.1, for your ZyXEL Device, but make sure that no other device on your network is using that IP address.The subnet mask specifies the network number portion of an IP address. Your ZyXEL Device will compute the subnet mask automatically based on the IP address that you entered. You don't need to change the subnet mask computed by the ZyXEL Device unless you are instructed to do otherwise.5.2.1.1 Private IP AddressesEvery machine on the Internet must have a unique address. If your networks are isolated from the Internet, for example, only between your two branch offices, you can assign any IP addresses to the hosts without problems. However, the Internet Assigned Numbers Authority (IANA) has reserved the following three blocks of IP addresses specifically for private networks:• 10.0.0.0 — 10.255.255.255• 172.16.0.0 — 172.31.255.255• 192.168.0.0 — 192.168.255.255

Chapter 5 LAN SetupP-660W-Tx v2 User’s Guide58You can obtain your IP address from the IANA, from an ISP or it can be assigned from a private network. If you belong to a small organization and your Internet access is through an ISP, the ISP can provide you with the Internet addresses for your local networks. On the other hand, if you are part of a much larger organization, you should consult your network administrator for the appropriate IP addresses." Regardless of your particular situation, do not create an arbitrary IP address; always follow the guidelines above. For more information on address assignment, please refer to RFC 1597, Address Allocation for Private Internets and RFC 1466, Guidelines for Management of IP Address Space.5.2.2 RIP SetupRIP (Routing Information Protocol) allows a router to exchange routing information with other routers. The RIP Direction field controls the sending and receiving of RIP packets. When set to:•Both - the ZyXEL Device will broadcast its routing table periodically and incorporate the RIP information that it receives.•In Only - the ZyXEL Device will not send any RIP packets but will accept all RIP packets received.•Out Only - the ZyXEL Device will send out RIP packets but will not accept any RIP packets received.•None - the ZyXEL Device will not send any RIP packets and will ignore any RIP packets received.The Version field controls the format and the broadcasting method of the RIP packets that the ZyXEL Device sends (it recognizes both formats when receiving). RIP-1 is universally supported; but RIP-2 carries more information. RIP-1 is probably adequate for most networks, unless you have an unusual network topology.Both RIP-2B and RIP-2M sends the routing data in RIP-2 format; the difference being that RIP-2B uses subnet broadcasting while RIP-2M uses multicasting.5.2.3 MulticastTraditionally, IP packets are transmitted in one of either two ways - Unicast (1 sender - 1 recipient) or Broadcast (1 sender - everybody on the network). Multicast delivers IP packets to a group of hosts on the network - not everybody and not just 1. IGMP (Internet Group Multicast Protocol) is a network-layer protocol used to establish membership in a Multicast group - it is not used to carry user data. IGMP version 2 (RFC 2236) is an improvement over version 1 (RFC 1112) but IGMP version 1 is still in wide use. If you would like to read more detailed information about interoperability between IGMP version 2 and version 1, please see sections 4 and 5 of RFC 2236. The class D IP address is used to identify host groups and can be in the range 224.0.0.0 to 239.255.255.255. The address

Chapter 5 LAN SetupP-660W-Tx v2 User’s Guide 59224.0.0.0 is not assigned to any group and is used by IP multicast computers. The address 224.0.0.1 is used for query messages and is assigned to the permanent group of all IP hosts (including gateways). All hosts must join the 224.0.0.1 group in order to participate in IGMP. The address 224.0.0.2 is assigned to the multicast routers group. The ZyXEL Device supports both IGMP version 1 (IGMP-v1) and IGMP version 2 (IGMP-v2). At start up, the ZyXEL Device queries all directly connected networks to gather group membership. After that, the ZyXEL Device periodically updates this information. IP multicasting can be enabled/disabled on the ZyXEL Device LAN and/or WAN interfaces in the web configurator (LAN; WAN ). Select None to disable IP multicasting on these interfaces.5.2.4 Any IPTraditionally, you must set the IP addresses and the subnet masks of a computer and the ZyXEL Device to be in the same subnet to allow the computer to access the Internet (through the ZyXEL Device). In cases where your computer is required to use a static IP address in another network, you may need to manually configure the network settings of the computer every time you want to access the Internet via the ZyXEL Device. With the Any IP feature and NAT enabled, the ZyXEL Device allows a computer to access the Internet without changing the network settings (such as IP address and subnet mask) of the computer, when the IP addresses of the computer and the ZyXEL Device are not in the same subnet. Whether a computer is set to use a dynamic or static (fixed) IP address, you can simply connect the computer to the ZyXEL Device and access the Internet. The following figure depicts a scenario where a computer is set to use a static private IP address in the corporate environment. In a residential house where a ZyXEL Device is installed, you can still use the computer to access the Internet without changing the network settings, even when the IP addresses of the computer and the ZyXEL Device are not in the same subnet. Figure 17 Any IP ExampleThe Any IP feature does not apply to a computer using either a dynamic IP address or a static IP address that is in the same subnet as the ZyXEL Device’s IP address.

Chapter 5 LAN SetupP-660W-Tx v2 User’s Guide60"You must enable NAT/SUA to use the Any IP feature on the ZyXEL Device. 5.2.4.1 How Any IP WorksAddress Resolution Protocol (ARP) is a protocol for mapping an Internet Protocol address (IP address) to a physical machine address, also known as a Media Access Control or MAC address, on the local area network. IP routing table is defined on IP Ethernet devices (the ZyXEL Device) to decide which hop to use, to help forward data along to its specified destination.The following lists out the steps taken, when a computer tries to access the Internet for the first time through the ZyXEL Device.1When a computer (which is in a different subnet) first attempts to access the Internet, it sends packets to its default gateway (which is not the ZyXEL Device) by looking at the MAC address in its ARP table. 2When the computer cannot locate the default gateway, an ARP request is broadcast on the LAN. 3The ZyXEL Device receives the ARP request and replies to the computer with its own MAC address. 4The computer updates the MAC address for the default gateway to the ARP table. Once the ARP table is updated, the computer is able to access the Internet through the ZyXEL Device. 5When the ZyXEL Device receives packets from the computer, it creates an entry in the IP routing table so it can properly forward packets intended for the computer. After all the routing information is updated, the computer can access the ZyXEL Device and the Internet as if it is in the same subnet as the ZyXEL Device. 5.3 Configuring LAN Click LAN > LAN Setup to open the LAN Setup screen. See Section 5.1 on page 55 for background information.

Chapter 5 LAN SetupP-660W-Tx v2 User’s Guide 61Figure 18 LAN SetupThe following table describes the fields in this screen. Table 13 LAN SetupLABEL DESCRIPTIONDHCPDHCP If set to Server, your ZyXEL Device can assign IP addresses, an IP default gateway and DNS servers to Windows 95, Windows NT and other systems that support the DHCP client.If set to None, the DHCP server will be disabled. If set to Relay, the ZyXEL Device acts as a surrogate DHCP server and relays DHCP requests and responses between the remote server and the clients. Enter the IP address of the actual, remote DHCP server in the Remote DHCP Server field in this case. When DHCP is used, the following items need to be set: Client IP Pool Starting AddressThis field specifies the first of the contiguous addresses in the IP address pool.Size of Client IP PoolThis field specifies the size or count of the IP address pool.Primary DNS ServerEnter the IP addresses of the DNS servers. The DNS servers are passed to the DHCP clients along with the IP address and the subnet mask.Secondary DNS ServerAs above.Remote DHCP ServerIf Relay is selected in the DHCP field above then enter the IP address of the actual remote DHCP server here.TCP/IP

Chapter 5 LAN SetupP-660W-Tx v2 User’s Guide625.4 Configuring Static DHCP Click LAN > Static DHCP to open the Static DHCP screen. See Section 5.1.2 on page 56 for background information. Figure 19 LAN > Static DHCPIP Address Enter the IP address of your ZyXEL Device in dotted decimal notation, for example, 192.168.1.1 (factory default). IP Subnet Mask Type the subnet mask assigned to you by your ISP (if given).RIP Direction Select the RIP direction from None, Both, In Only and Out Only.RIP Version Select the RIP version from RIP-1, RIP-2B and RIP-2M.Multicast IGMP (Internet Group Multicast Protocol) is a network-layer protocol used to establish membership in a multicast group. The ZyXEL Device supports both IGMP version 1 (IGMP-v1) and IGMP-v2. Select None to disable it.Any IP Setup Select the Active check box to enable the Any IP feature. This allows a computer to access the Internet without changing the network settings (such as IP address and subnet mask) of the computer, even when the IP addresses of the computer and the ZyXEL Device are not in the same subnet. When you disable the Any IP feature, only computers with dynamic IP addresses or static IP addresses in the same subnet as the ZyXEL Device’s LAN IP address can connect to the ZyXEL Device or access the Internet through the ZyXEL Device.Apply Click Apply to save your changes back to the ZyXEL Device.Cancel Click Cancel to begin configuring this screen afresh.Table 13 LAN Setup (continued)LABEL DESCRIPTION

Chapter 5 LAN SetupP-660W-Tx v2 User’s Guide 63The following table describes the fields in this screen. Table 14 LAN SetupLABEL DESCRIPTION# This is the index number for the entries in this table.MAC Address Type the MAC address of the device for which you are configuring the IP address. Use hexadecimal characters in the following format: “0A:A0:00:BB:CC:DD” IP Address Type the IP address for the device you are configuring in dotted decimal notation, for example, “150.222.0.1”.Back Click Back to return to the previous screen.Apply Click Apply to save your changes back to the ZyXEL Device.Cancel Click Cancel to begin configuring this screen afresh.

Chapter 5 LAN SetupP-660W-Tx v2 User’s Guide64

P-660W-Tx v2 User’s Guide 65CHAPTER 6 Wireless LANThis chapter discusses how to configure the wireless network settings in your ZyXEL Device. See the appendices for more detailed information about wireless networks.6.1 Wireless Network OverviewThe following figure provides an example of a wireless network.Figure 20 Example of a Wireless NetworkThe wireless network is the part in the blue circle. In this wireless network, devices A and B are called wireless clients.The wireless clients use the access point (AP) to interact with other devices (such as the printer) or with the Internet. Your ZyXEL Device is the AP.Every wireless network must follow these basic guidelines.• Every wireless client in the same wireless network must use the same SSID.The SSID is the name of the wireless network. It stands for Service Set IDentity.• If two wireless networks overlap, they should use different channels.Like radio stations or television channels, each wireless network uses a specific channel, or frequency, to send and receive information.

Chapter 6 Wireless LANP-660W-Tx v2 User’s Guide66• Every wireless client in the same wireless network must use security compatible with the AP.Security stops unauthorized devices from using the wireless network. It can also protect the information that is sent in the wireless network.6.2 Wireless Security OverviewThe following sections introduce different types of wireless security you can set up in the wireless network.6.2.1 SSIDNormally, the AP acts like a beacon and regularly broadcasts the SSID in the area. You can hide the SSID instead, in which case the AP does not broadcast the SSID. In addition, you should change the default SSID to something that is difficult to guess.This type of security is fairly weak, however, because there are ways for unauthorized devices to get the SSID. In addition, unauthorized devices can still see the information that is sent in the wireless network.6.2.2 MAC Address FilterEvery wireless client has a unique identification number, called a MAC address.1 A MAC address is usually written using twelve hexadecimal characters2; for example, 00A0C5000002 or 00:A0:C5:00:00:02. To get the MAC address for each wireless client, see the appropriate User’s Guide or other documentation.You can use the MAC address filter to tell the AP which wireless clients are allowed or not allowed to use the wireless network. If a wireless client is allowed to use the wireless network, it still has to have the correct settings (SSID, channel, and security). If a wireless client is not allowed to use the wireless network, it does not matter if it has the correct settings.This type of security does not protect the information that is sent in the wireless network. Furthermore, there are ways for unauthorized devices to get the MAC address of an authorized wireless client. Then, they can use that MAC address to use the wireless network.6.2.3 User AuthenticationYou can make every user log in to the wireless network before they can use it. This is called user authentication. However, every wireless client in the wireless network has to support IEEE 802.1x to do this.For wireless networks, there are two typical places to store the user names and passwords for each user.• In the AP: this feature is called a local user database or a local database.• In a RADIUS server: this is a server used in businesses more than in homes.1. Some wireless devices, such as scanners, can detect wireless networks but cannot use wireless networks. These kinds of wireless devices might not have MAC addresses.2. Hexadecimal characters are 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, A, B, C, D, E, and F.

Chapter 6 Wireless LANP-660W-Tx v2 User’s Guide 67If your AP does not provide a local user database and if you do not have a RADIUS server, you cannot set up user names and passwords for your users.Unauthorized devices can still see the information that is sent in the wireless network, even if they cannot use the wireless network. Furthermore, there are ways for unauthorized wireless users to get a valid user name and password. Then, they can use that user name and password to use the wireless network.Local user databases also have an additional limitation that is explained in the next section.6.2.4 EncryptionWireless networks can use encryption to protect the information that is sent in the wireless network. Encryption is like a secret code. If you do not know the secret code, you cannot understand the message.The types of encryption you can choose depend on the type of user authentication. (See Section 6.2.3 on page 66 for information about this.)For example, if the wireless network has a RADIUS server, you can choose WPA or WPA2. If users do not have to log in with a user name and password in order to access the wireless network, you can choose no encryption, Static WEP, WPA-PSK, or WPA2-PSK.Usually, you should set up the strongest encryption that every wireless client in the wireless network supports. For example, suppose the AP does not have a local user database, and you do not have a RADIUS server. Therefore, there is no user authentication. Suppose the wireless network has two wireless clients. Device A only supports WEP, and device B supports WEP and WPA. Therefore, you should set up Static WEP in the wireless network."It is recommended that wireless networks use WPA-PSK, WPA, or stronger encryption. IEEE 802.1x and WEP encryption are better than none at all, but it is still possible for unauthorized devices to figure out the original information pretty quickly."It is not possible to use WPA-PSK, WPA or stronger encryption with a local user database. In this case, it is better to set up stronger encryption with no authentication than to set up weaker encryption with the local user database.Table 15 Types of Encryption for Each Type of AuthenticationNO AUTHENTICATION RADIUS SERVERWeakest No Security WPAStatic WEPWPA-PSKStrongest WPA2-PSK WPA2

Chapter 6 Wireless LANP-660W-Tx v2 User’s Guide68When you select WPA2 or WPA2-PSK in your ZyXEL Device, you can also select an option (WPA Compatible) to support WPA as well. In this case, if some wireless clients support WPA and some support WPA2, you should set up WPA2-PSK or WPA2 (depending on the type of wireless network login) and select the WPA Compatible option in the ZyXEL Device.Many types of encryption use a key to protect the information in the wireless network. The longer the key, the stronger the encryption. Every wireless client in the wireless network must have the same key.6.3 Additional Wireless TermsThe following table describes wireless network terms and acronyms used in the ZyXEL Device’s Web Configurator.6.4 The Main Wireless LAN Screen Click Wireless LAN in the navigation panel to display the main Wireless LAN screen. Table 16 Additional Wireless TermsTERM DESCRIPTIONIntra-BSS Traffic This describes direct communication (not through the ZyXEL Device) between two wireless devices within a wireless network. You might disable this kind of communication to enhance security within your wireless network.RTS/CTS Threshold In a wireless network which covers a large area, wireless devices are sometimes not aware of each other’s presence. This may cause them to send information to the AP at the same time and result in information colliding and not getting through.By setting this value lower than the default value, the wireless devices must sometimes get permission to send information to the ZyXEL Device. The lower the value, the more often the devices must get permission.If this value is greater than the fragmentation threshold value (see below), then wireless devices never have to get permission to send information to the ZyXEL Device.Preamble A preamble affects the timing in your wireless network. There are two preamble modes: long and short. If a device uses a different preamble mode than the ZyXEL Device does, it cannot communicate with the ZyXEL Device.Authentication The process of verifying whether a wireless device is allowed to use the wireless network.Max. Frame Burst Enable this to improve the performance of both pure IEEE 802.11g and mixed IEEE 802.11b/g networks. Maximum Frame Burst sets the maximum time that the ZyXEL Device transmits IEEE 802.11g wireless traffic only.Fragmentation ThresholdA small fragmentation threshold is recommended for busy networks, while a larger threshold provides faster performance if the network is not very busy.Roaming If you have two or more ZyXEL Devices (or other wireless access points) on your wireless network, you can enable this option so that wireless devices can change locations without having to log in again. This is useful for devices, such as notebooks, that move around a lot.

Chapter 6 Wireless LANP-660W-Tx v2 User’s Guide 69Figure 21 Wireless LANThe following table describes the links in this screen. The following figure shows the relative effectiveness of these wireless security methods available on your ZyXEL Device.Figure 22 Wireless Security Methods"You must enable the same wireless security settings on the ZyXEL Device and on all wireless clients that you want to associate with it. Table 17 Wireless LAN LINK DESCRIPTIONWireless Click this link to go to a screen where you can configure wireless settings. MAC Filter Click this link to go to a screen where you can restrict access to your wireless network by MAC address.WDS Click this link to go to a screen where you can set up a WDS (Wireless Distribution System) connection between your AP’s (access points).

Chapter 6 Wireless LANP-660W-Tx v2 User’s Guide70"If you do not enable any wireless security on your ZyXEL Device, your network is accessible to any wireless networking device that is within range. 6.5 Configuring the Wireless Screen Click Advanced Setup > Wireless LAN to open the Wireless LAN screen.Figure 23 Network > Wireless LAN The following table describes the general wireless LAN labels in this screen.Table 18 Network > Wireless LAN > GeneralLABEL DESCRIPTIONEnable Wireless LANClick the check box to activate the wireless feature on your ZyXEL Device.Block Traffic between WLAN and LANESSID The ESSID (Extended Service Set IDentity) identifies your wireless network. Enter a descriptive name (up to 32 printable characters including spaces; alphabetic characters are case-sensitive) for the wireless LAN. Hide ESSID Select Yes to hide the ESSID from unauthorized individuals scanning for ESSIDs using a site survey tool or select No.to make it visible to wireless devices in range.Channel ID The range of radio frequencies used by wireless devices is called a channel.Select a wireless channel if interference from other nearby devices is a problem. The ZyXEL Device and other wireless devices in your wireless network must use the same channel.

Chapter 6 Wireless LANP-660W-Tx v2 User’s Guide 71See the rest of this chapter for information on the other labels in this screen. 6.5.1 No SecuritySelect No Security to allow wireless stations to communicate with the access points without any data encryption. "If you do not enable any wireless security on your ZyXEL Device, your network is accessible to any wireless networking device that is within range.Figure 24 Network > Wireless LAN: No Security RTS/CTS ThresholdThe RTS (Request To Send) threshold (number of bytes) is for enabling RTS/CTS. Data with its frame size larger than this value will perform the RTS/CTS handshake. Setting this value to be larger than the maximum MSDU (MAC service data unit) size turns off RTS/CTS. Setting this value to zero turns on RTS/CTS. Select the check box to change the default value and enter a new value between 0 and 2432.Fragmentation Threshold This is the threshold (number of bytes) for the fragmentation boundary for directed messages. It is the maximum data fragment size that can be sent. Select the check box to change the default value and enter a value between 256 and 2432.Apply Click Apply to save your changes.Reset Click Reset to reload the previous configuration for this screen.Table 18 Network > Wireless LAN > GeneralLABEL DESCRIPTION

Chapter 6 Wireless LANP-660W-Tx v2 User’s Guide72The following table describes the labels in this screen.6.5.2 WEP EncryptionWEP encryption scrambles the data transmitted between the wireless stations and the access points to keep network communications private. It encrypts unicast and multicast communications in a network. Both the wireless stations and the access points must use the same WEP key. Your ZyXEL Device allows you to configure up to four 64-bit, 128-bit or 256-bit WEP keys but only one key can be enabled at any one time. In order to configure and enable WEP encryption; click Wireless LAN and Wireless to the display the Wireless screen.Figure 25 Wireless ScreenTable 19 Wireless No SecurityLABEL DESCRIPTIONSecurity Mode Choose No Security from the drop-down list box.Back Click Back to return to the previous screen.Apply Click Apply to save your changes.Reset Click Reset to reload the previous configuration for this screen.

Chapter 6 Wireless LANP-660W-Tx v2 User’s Guide 73The following table describes the labels in this screen.6.5.3 WPA-PSK/WPA2-PSKClick Advanced Setup > Wireless LAN to display the Wireless LAN screen. Select WPA-PSK or WPA2-PSK from the Security Mode list.Table 20 Wireless LANLABEL DESCRIPTIONSecurity Mode Select Static WEP from the drop-down list.You won’t see the following WEP-related fields if you have WPA or WPA-PSK enabled.Passphrase Enter a "passphrase" (password phrase) of up to 63 case-sensitive printable characters and click Generate to have the ZyXEL Device create four different WEP keys. At the time of writing, you cannot use passphrase to generate 256-bit WEP keys. Generate After you enter the passphrase, click Generate to have the ZyXEL Device generate a WEP key automatically. The key displays in the WEP Key field. WEP Key The WEP Key is used to encrypt data. Both the ZyXEL Device and other wireless devices on your network must use the same WEP key.If you want to manually set the WEP keys, type the key in this field. The length of the key corresponds to the security strength.For 64-bit security, type 5 ASCII characters or 10 hexadecimal characters ("0-9", "A-F"). For 128-bit security, type13 ASCII characters or 26 hexadecimal characters ("0-9", "A-F"). Back Click Back to go to the main wireless LAN setup screen. Apply Click Apply to save your changes back to the ZyXEL Device. Cancel Click Cancel to begin configuring this screen afresh.

Chapter 6 Wireless LANP-660W-Tx v2 User’s Guide74Figure 26 Network > Wireless LAN: WPA-PSK/The following table describes the labels in this screen.Table 21 Network > Wireless LAN > General: WPA-PSK/WPA2-PSKLABEL DESCRIPTIONSecurity Mode Select WPA-PSK or WPA2-PSK from the drop-down box. WPA Compatible This check box is available only when you select WPA2-PSK or WPA2 in the Security Mode field.Select the check box to have both WPA2 and WPA wireless clients be able to communicate with the ZyXEL Device even when the ZyXEL Device is using WPA2-PSK or WPA2.Pre-Shared Key The encryption mechanisms used for WPA/WPA2 and WPA-PSK/WPA2-PSK are the same. The only difference between the two is that WPA-PSK/WPA2-PSK uses a simple common password, instead of user-specific credentials.Type a pre-shared key from 8 to 63 case-sensitive ASCII characters (including spaces and symbols).ReAuthentication Timer (in seconds)Specify how often wireless stations have to resend usernames and passwords in order to stay connected. Enter a time interval between 10 and 9999 seconds. The default time interval is 1800 seconds (30 minutes). Note: If wireless station authentication is done using a RADIUS server, the reauthentication timer on the RADIUS server has priority.Idle Timeout The ZyXEL Device automatically disconnects a wireless station from the wired network after a period of inactivity. The wireless station needs to enter the username and password again before access to the wired network is allowed. The default time interval is 3600 seconds (or 1 hour).

Chapter 6 Wireless LANP-660W-Tx v2 User’s Guide 756.5.4 WPA/WPA2Click Advanced Setup > Wireless LAN to display the Wireless LAN screen. Select WPA or WPA2 from the Security Mode list.Figure 27 Network > Wireless LAN > General: WPA/WPA2Group Key Update TimerThe Group Key Update Timer is the rate at which the AP (if using WPA-PSK/WPA2-PSK key management) or RADIUS server (if using WPA/WPA2 key management) sends a new group key out to all clients. The re-keying process is the WPA/WPA2 equivalent of automatically changing the WEP key for an AP and all stations in a WLAN on a periodic basis. Setting of the Group Key Update Timer is also supported in WPA-PSK/WPA2-PSK mode. The default is 1800 seconds (30 minutes).Apply Click Apply to save your changes back to the ZyXEL Device.Reset Click Reset to reload the previous configuration for this screen.Table 21 Network > Wireless LAN > General: WPA-PSK/WPA2-PSKLABEL DESCRIPTION

Chapter 6 Wireless LANP-660W-Tx v2 User’s Guide76The following table describes the labels in this screen.Table 22 Network > Wireless LAN > General: WPA/WPA2LABEL DESCRIPTIONWPA Compatible This check box is available only when you select WPA2-PSK or WPA2 in the Security Mode field.Select the check box to have both WPA2 and WPA wireless clients be able to communicate with the ZyXEL Device even when the ZyXEL Device is using WPA2-PSK or WPA2.ReAuthentication Timer Specify how often wireless stations have to resend usernames and passwords in order to stay connected. Enter a time interval between 10 and 9999 seconds. The default time interval is 1800 seconds (30 minutes). Note: If wireless station authentication is done using a RADIUS server, the reauthentication timer on the RADIUS server has priority.Idle Timeout The ZyXEL Device automatically disconnects a wireless station from the wired network after a period of inactivity. The wireless station needs to enter the username and password again before access to the wired network is allowed. The default time interval is 3600 seconds (or 1 hour).Group Key Update TimerThe Group Key Update Timer is the rate at which the AP (if using WPA-PSK/WPA2-PSK key management) or RADIUS server (if using WPA/WPA2 key management) sends a new group key out to all clients. The re-keying process is the WPA/WPA2 equivalent of automatically changing the WEP key for an AP and all stations in a WLAN on a periodic basis. Setting of the Group Key Update Timer is also supported in WPA-PSK/WPA2-PSK mode. The ZyXEL Device default is 1800 seconds (30 minutes).Authentication ServerIP Address Enter the IP address of the external authentication server in dotted decimal notation.Port Number Enter the port number of the external authentication server. The default port number is 1812. You need not change this value unless your network administrator instructs you to do so with additional information. Shared Secret Enter a password (up to 31 alphanumeric characters) as the key to be shared between the external authentication server and the ZyXEL Device.The key must be the same on the external authentication server and your ZyXEL Device. The key is not sent over the network. Accounting ServerActive Select Yes from the drop down list box to enable user accounting through an external authentication server.IP Address Enter the IP address of the external accounting server in dotted decimal notation.Port Number Enter the port number of the external accounting server. The default port number is 1813. You need not change this value unless your network administrator instructs you to do so with additional information. Shared Secret Enter a password (up to 31 alphanumeric characters) as the key to be shared between the external accounting server and the ZyXEL Device.The key must be the same on the external accounting server and your ZyXEL Device. The key is not sent over the network. Apply Click Apply to save your changes back to the ZyXEL Device.Reset Click Reset to reload the previous configuration for this screen.

Chapter 6 Wireless LANP-660W-Tx v2 User’s Guide 77"If you are configuring the ZyXEL Device from a computer connected to the wireless LAN and you change the ZyXEL Device’s ESSID or security settings (see Figure 22 on page 69), you will lose your wireless connection when you press Apply to confirm. You must then change the wireless settings of your computer to match the ZyXEL Device’s new settings.6.6 Configuring MAC Filters Every Ethernet device has a unique MAC (Media Access Control) address. The MAC address is assigned at the factory and consists of six pairs of hexadecimal characters, for example, 00:A0:C5:00:00:02. You need to know the MAC addresses of the devices to configure this screen. To change your ZyXEL Device’s MAC filter settings, click Advanced Setup > Wireless LAN > MAC Filter to open the MAC Filter screen. The screen appears as shown."Be careful not to list your computer’s MAC address and set the Action field to Deny Association when managing the ZyXEL Device via a wireless connection. This would lock you out.

Chapter 6 Wireless LANP-660W-Tx v2 User’s Guide78Figure 28 MAC FilterThe following table describes the fields in this menu.Table 23 MAC FilterLABEL DESCRIPTIONActive Select Yes from the drop down list box to enable MAC address filtering. Action Define the filter action for the list of MAC addresses in the MAC Address table. Select Deny Association to block access to the router, MAC addresses not listed will be allowed to access the ZyXEL Device. Select Allow Association to permit access to the router, MAC addresses not listed will be denied access to the ZyXEL Device. MAC Address Enter the MAC addresses in a valid MAC address format, that is, six hexadecimal character pairs, for example, 12:34:56:78:9a:bc of the wireless stations that are allowed or denied access to the ZyXEL Device in these address fields.Back Click Back to go to the main wireless LAN setup screen.

Chapter 6 Wireless LANP-660W-Tx v2 User’s Guide 796.7 WDS ScreenThe WDS (Wireless Distribution System) allows you to configure the ZyXEL Device to connect to two or more APs via wireless when WDS is enabled. An AP using WDS can function as a wireless network bridge allowing you to wirelessly connect two wired network segments.Figure 29 Connecting Wireless Networks Using WDS Use this screen to set up WDS between your ZyXEL Device and another AP."WDS security is independent of the security settings between the ZyXEL Device and any wireless clients."At the time of writing, WDS is compatible with other ZyXEL APs only. Not all models support WDS links. Check your other AP’s documentation.Apply Click Apply to save your changes back to the ZyXEL Device. Cancel Click Cancel to begin configuring this screen afresh.Table 23 MAC Filter (continued)LABEL DESCRIPTION

Chapter 6 Wireless LANP-660W-Tx v2 User’s Guide80Figure 30 Advanced Setup > Wireless LAN > WDSThe following table describes the labels in this screen.Table 24 Advanced Setup > Wireless LAN > WDSLABEL DESCRIPTIONEnable WDS SecuritySelect this to set up security on your ZyXEL Device’s bridged connection with an AP. Select AES (Advanced Encryption Standard) as your security method if the AP’s on your network support it. Otherwise select TKIP Security (ZyAIR Series Compatible) (Temporal Key Integrity Protocol).If you de-select this option, the data sent between APs is not encrypted. Anyone can read it.#This is the index number of the access point (AP) with which you are setting up a WDS connection.Active Select this to enable a WDS connection with this AP.Remote Bridge MAC AddressType the MAC address of the AP with which you are setting up a WDS connection in a valid MAC address format (six hexadecimal character pairs, for example 12:34:56:78:9a:bc)..PSK Type a PSK (Pre-Shared Key) in this field between 8~63 characters long (A~Z, a~z,0~9). Back Click Back to return to the Wireless LAN menu screen.Apply Click Apply to save your changes back to the ZyXEL Device.Cancel Click Cancel to cancel your changes.

P-660W-Tx v2 User’s Guide 81CHAPTER 7 WAN SetupThis chapter describes how to configure WAN settings.7.1 WAN Overview A WAN (Wide Area Network) is an outside connection to another network or the Internet.7.1.1 EncapsulationBe sure to use the encapsulation method required by your ISP. The ZyXEL Device supports the following methods.7.1.1.1 ENET ENCAPThe MAC Encapsulated Routing Link Protocol (ENET ENCAP) is only implemented with the IP network protocol. IP packets are routed between the Ethernet interface and the WAN interface and then formatted so that they can be understood in a bridged environment. For instance, it encapsulates routed Ethernet frames into bridged ATM cells. ENET ENCAP requires that you specify a gateway IP address in the ENET ENCAP Gateway field in the second wizard screen. You can get this information from your ISP.7.1.1.2 PPP over EthernetPPPoE provides access control and billing functionality in a manner similar to dial-up services using PPP. The ZyXEL Device bridges a PPP session over Ethernet (PPP over Ethernet, RFC 2516) from your computer to an ATM PVC (Permanent Virtual Circuit) which connects to ADSL Access Concentrator where the PPP session terminates. One PVC can support any number of PPP sessions from your LAN. For more information on PPPoE, see the appendices.7.1.1.3 PPPoAPPPoA stands for Point to Point Protocol over ATM Adaptation Layer 5 (AAL5). A PPPoA connection functions like a dial-up Internet connection. The ZyXEL Device encapsulates the PPP session based on RFC1483 and sends it through an ATM PVC (Permanent Virtual Circuit) to the Internet Service Provider’s (ISP) DSLAM (digital access multiplexer). Please refer to RFC 2364 for more information on PPPoA. Refer to RFC 1661 for more information on PPP.

Chapter 7 WAN SetupP-660W-Tx v2 User’s Guide827.1.1.4 RFC 1483RFC 1483 describes two methods for Multiprotocol Encapsulation over ATM Adaptation Layer 5 (AAL5). The first method allows multiplexing of multiple protocols over a single ATM virtual circuit (LLC-based multiplexing) and the second method assumes that each protocol is carried over a separate ATM virtual circuit (VC-based multiplexing). Please refer to the RFC for more detailed information.7.1.2 MultiplexingThere are two conventions to identify what protocols the virtual circuit (VC) is carrying. Be sure to use the multiplexing method required by your ISP.7.1.2.1 VC-based MultiplexingIn this case, by prior mutual agreement, each protocol is assigned to a specific virtual circuit; for example, VC1 carries IP, etc. VC-based multiplexing may be dominant in environments where dynamic creation of large numbers of ATM VCs is fast and economical.7.1.2.2 LLC-based MultiplexingIn this case one VC carries multiple protocols with protocol identifying information being contained in each packet header. Despite the extra bandwidth and processing overhead, this method may be advantageous if it is not practical to have a separate VC for each carried protocol, for example, if charging heavily depends on the number of simultaneous VCs.7.1.3 VPI and VCIBe sure to use the correct Virtual Path Identifier (VPI) and Virtual Channel Identifier (VCI) numbers assigned to you. The valid range for the VPI is 0 to 255 and for the VCI is 32 to 65535 (0 to 31 is reserved for local management of ATM traffic). Please see the appendix for more information.7.1.4 IP Address AssignmentA static IP is a fixed IP that your ISP gives you. A dynamic IP is not fixed; the ISP assigns you a different one each time. The Single User Account feature can be enabled or disabled if you have either a dynamic or static IP. However the encapsulation method assigned influences your choices for IP address and ENET ENCAP gateway.7.1.4.1 IP Assignment with PPPoA or PPPoE EncapsulationIf you have a dynamic IP, then the IP Address and ENET ENCAP Gateway fields are not applicable (N/A). If you have a static IP, then you only need to fill in the IP Address field and not the ENET ENCAP Gateway field.7.1.4.2 IP Assignment with RFC 1483 EncapsulationIn this case the IP Address Assignment must be static with the same requirements for the IP Address and ENET ENCAP Gateway fields as stated above.

Chapter 7 WAN SetupP-660W-Tx v2 User’s Guide 837.1.4.3 IP Assignment with ENET ENCAP EncapsulationIn this case you can have either a static or dynamic IP. For a static IP you must fill in all the IP Address and ENET ENCAP Gateway fields as supplied by your ISP. However for a dynamic IP, the ZyXEL Device acts as a DHCP client on the WAN port and so the IP Address and ENET ENCAP Gateway fields are not applicable (N/A) as the DHCP server assigns them to the ZyXEL Device.7.1.5 Nailed-Up Connection (PPP)A nailed-up connection is a dial-up line where the connection is always up regardless of traffic demand. The ZyXEL Device does two things when you specify a nailed-up connection. The first is that idle timeout is disabled. The second is that the ZyXEL Device will try to bring up the connection when turned on and whenever the connection is down. A nailed-up connection can be very expensive for obvious reasons. Do not specify a nailed-up connection unless your telephone company offers flat-rate service or you need a constant connection and the cost is of no concern.7.1.6 NATNAT (Network Address Translation - NAT, RFC 1631) is the translation of the IP address of a host in a packet, for example, the source address of an outgoing packet, used within one network to a different IP address known within another network.7.2 Metric The metric represents the "cost of transmission". A router determines the best route for transmission by choosing a path with the lowest "cost". RIP routing uses hop count as the measurement of cost, with a minimum of "1" for directly connected networks. The number must be between "1" and "15"; a number greater than "15" means the link is down. The smaller the number, the lower the "cost".The metric sets the priority for the ZyXEL Device routes to the Internet. If any two of the default routes have the same metric, the ZyXEL Device uses the following pre-defined priorities:• Normal route: designated by the ISP (see Section 7.7 on page 86) • Traffic-redirect route (see Section 7.8 on page 90)• WAN-backup route, also called dial-backup (see Section 7.9 on page 90)For example, if the normal route has a metric of "1" and the traffic-redirect route has a metric of "2" and dial-backup route has a metric of "3", then the normal route acts as the primary default route. If the normal route fails to connect to the Internet, the ZyXEL Device tries the traffic-redirect route next. In the same manner, the ZyXEL Device uses the dial-backup route if the traffic-redirect route also fails. If you want the dial-backup route to take first priority over the traffic-redirect route or even the normal route, all you need to do is set the dial-backup route’s metric to "1" and the others to "2" (or greater).

Chapter 7 WAN SetupP-660W-Tx v2 User’s Guide84IP Policy Routing overrides the default routing behavior and takes priority over all of the routes mentioned above.7.3 PPPoE EncapsulationThe ZyXEL Device supports PPPoE (Point-to-Point Protocol over Ethernet). PPPoE is an IETF Draft standard (RFC 2516) specifying how a personal computer (PC) interacts with a broadband modem (DSL, cable, wireless, etc.) connection. The PPPoE option is for a dial-up connection using PPPoE.For the service provider, PPPoE offers an access and authentication method that works with existing access control systems (for example Radius). PPPoE provides a login and authentication method that the existing Microsoft Dial-Up Networking software can activate, and therefore requires no new learning or procedures for Windows users.One of the benefits of PPPoE is the ability to let you access one of multiple network services, a function known as dynamic service selection. This enables the service provider to easily create and offer new IP services for individuals.Operationally, PPPoE saves significant effort for both you and the ISP or carrier, as it requires no specific configuration of the broadband modem at the customer site.By implementing PPPoE directly on the ZyXEL Device (rather than individual computers), the computers on the LAN do not need PPPoE software installed, since the ZyXEL Device does that part of the task. Furthermore, with NAT, all of the LANs’ computers will have access.7.4 Traffic ShapingTraffic Shaping is an agreement between the carrier and the subscriber to regulate the average rate and fluctuations of data transmission over an ATM network. This agreement helps eliminate congestion, which is important for transmission of real time data such as audio and video connections.Peak Cell Rate (PCR) is the maximum rate at which the sender can send cells. This parameter may be lower (but not higher) than the maximum line speed. 1 ATM cell is 53 bytes (424 bits), so a maximum speed of 832Kbps gives a maximum PCR of 1962 cells/sec. This rate is not guaranteed because it is dependent on the line speed.Sustained Cell Rate (SCR) is the mean cell rate of each bursty traffic source. It specifies the maximum average rate at which cells can be sent over the virtual connection. SCR may not be greater than the PCR.Maximum Burst Size (MBS) is the maximum number of cells that can be sent at the PCR. After MBS is reached, cell rates fall below SCR until cell rate averages to the SCR again. At this time, more cells (up to the MBS) can be sent at the PCR again.If the PCR, SCR or MBS is set to the default of "0", the system will assign a maximum value that correlates to your upstream line rate. The following figure illustrates the relationship between PCR, SCR and MBS.

Chapter 7 WAN SetupP-660W-Tx v2 User’s Guide 85Figure 31 Example of Traffic Shaping7.5 Zero Configuration Internet AccessOnce you turn on and connect the ZyXEL Device to a telephone jack, it automatically detects the Internet connection settings (such as the VCI/VPI numbers and the encapsulation method) from the ISP and makes the necessary configuration changes. In cases where additional account information (such as an Internet account user name and password) is required or the ZyXEL Device cannot connect to the ISP, you will be redirected to web screen(s) for information input or troubleshooting.Zero configuration for Internet access is disabled when • the ZyXEL Device is in bridge mode• you set the ZyXEL Device to use a static (fixed) WAN IP address. 7.6 The Main WAN Screen Click WA N in the navigation panel to display the man WA N screen. See Section 7.1 on page 81 for more information. Figure 32 WAN

Chapter 7 WAN SetupP-660W-Tx v2 User’s Guide86The following table describes the links in this screen. 7.7 Configuring WAN Setup To change your ZyXEL Device’s WAN remote node settings, click WA N and WA N S et up . The screen differs by the encapsulation. See Section 7.1 on page 81 for more information. Table 25 WANLINK DESCRIPTIONWAN Setup Click this link to go to the screen where you can configure your ZyXEL Device for an Internet connection. WAN Backup Click this link to go to the screen where you can configure WAN backup connections (traffic redirect and dial backup).

Chapter 7 WAN SetupP-660W-Tx v2 User’s Guide 87Figure 33 WAN Setup (PPPoE)

Chapter 7 WAN SetupP-660W-Tx v2 User’s Guide88The following table describes the fields in this screen. Table 26 WAN SetupLABEL DESCRIPTIONName Enter the name of your Internet Service Provider, e.g., MyISP. This information is for identification purposes only.Mode Select Routing (default) from the drop-down list box if your ISP allows multiple computers to share an Internet account. Otherwise select Bridge. Encapsulation Select the method of encapsulation used by your ISP from the drop-down list box. Choices vary depending on the mode you select in the Mode field. If you select Bridge in the Mode field, select either PPPoA or RFC 1483. If you select Routing in the Mode field, select PPPoA, RFC 1483, ENET ENCAP or PPPoE.Multiplex Select the method of multiplexing used by your ISP from the drop-down list. Choices are VC or LLC.Virtual Circuit ID VPI (Virtual Path Identifier) and VCI (Virtual Channel Identifier) define a virtual circuit. Refer to the appendix for more information.VPI The valid range for the VPI is 0 to 255. Enter the VPI assigned to you.VCI The valid range for the VCI is 32 to 65535 (0 to 31 is reserved for local management of ATM traffic). Enter the VCI assigned to you.ATM QoS Type Select CBR (Continuous Bit Rate) to specify fixed (always-on) bandwidth for voice or data traffic. Select UBR (Unspecified Bit Rate) for applications that are non-time sensitive, such as e-mail. Select VBR (Variable Bit Rate) for bursty traffic and bandwidth sharing with other applications. Cell Rate Cell rate configuration often helps eliminate traffic congestion that slows transmission of real time data such as audio and video connections. Peak Cell Rate Divide the DSL line rate (bps) by 424 (the size of an ATM cell) to find the Peak Cell Rate (PCR). This is the maximum rate at which the sender can send cells. Type the PCR here.Sustain Cell Rate The Sustain Cell Rate (SCR) sets the average cell rate (long-term) that can be transmitted. Type the SCR, which must be less than the PCR. Note that system default is 0 cells/sec. Maximum Burst SizeMaximum Burst Size (MBS) refers to the maximum number of cells that can be sent at the peak rate. Type the MBS, which is less than 65535. Login Information (PPPoA and PPPoE encapsulation only)Service Name (PPPoE only) Type the name of your PPPoE service here.User Name Enter the user name exactly as your ISP assigned. If assigned a name in the form user@domain where domain identifies a service name, then enter both components exactly as given.Password Enter the password associated with the user name above.IP Address This option is available if you select Routing in the Mode field.A static IP address is a fixed IP that your ISP gives you. A dynamic IP address is not fixed; the ISP assigns you a different one each time you connect to the Internet. Select Obtain an IP Address Automatically if you have a dynamic IP address; otherwise select Static IP Address and type your ISP assigned IP address in the IP Address field below.

Chapter 7 WAN SetupP-660W-Tx v2 User’s Guide 89Connection (PPPoA and PPPoE encapsulation only)Nailed-Up ConnectionSelect Nailed-Up Connection when you want your connection up all the time. The ZyXEL Device will try to bring up the connection automatically if it is disconnected.Connect on DemandSelect Connect on Demand when you don't want the connection up all the time and specify an idle time-out in the Max Idle Timeout field.Max Idle Timeout Specify an idle time-out in the Max Idle Timeout field when you select Connect on Demand. The default setting is 0, which means the Internet session will not timeout.PPPoE Passthrough(PPPoE encapsulation only)This field is available when you select PPPoE encapsulation. In addition to the ZyXEL Device's built-in PPPoE client, you can enable PPPoE pass through to allow up to ten hosts on the LAN to use PPPoE client software on their computers to connect to the ISP via the ZyXEL Device. Each host can have a separate account and a public WAN IP address. PPPoE pass through is an alternative to NAT for application where NAT is not appropriate.Disable PPPoE pass through if you do not need to allow hosts on the LAN to use PPPoE client software on their computers to connect to the ISP.Subnet Mask (ENET ENCAP encapsulation only)Enter a subnet mask in dotted decimal notation. Refer to the appendices to calculate a subnet mask If you are implementing subnetting.ENET ENCAP Gateway(ENET ENCAP encapsulation only)You must specify a gateway IP address (supplied by your ISP) when you select ENET ENCAP in the Encapsulation field.Zero Configuration This feature is not applicable/available when you configure the ZyXEL Device to use a static WAN IP address or in bridge mode. Select Yes to set the ZyXEL Device to automatically detect the Internet connection settings (such as the VCI/VPI numbers and the encapsulation method) from the ISP and make the necessary configuration changes.Select No to disable this feature. You must manually configure the ZyXEL Device for Internet access. MTU The MTU (Maximum Transmission Unit, measured in bytes) sets the largest frame size your ZyXEL Device can send. Setting a high MTU allows larger frames to be sent from your device resulting in the more efficient use of bandwidth. However, the size of frames on your network may be limited by the Ethernet maximum frame size limit of 1500 bytes. Furthermore, if other devices have a smaller MTU setting, they must fragment packets received from the ZyXEL Device, resulting in slower overall transmission speeds. Type the MTU in this field if your ISP gave you it. Otherwise leave it at its default setting.Back Click Back to return to the previous screen.Apply Click Apply to save the changes. Cancel Click Cancel to begin configuring this screen afresh.Table 26 WAN Setup (continued)LABEL DESCRIPTION

Chapter 7 WAN SetupP-660W-Tx v2 User’s Guide907.8 Traffic Redirect Traffic redirect forwards traffic to a backup gateway when the ZyXEL Device cannot connect to the Internet. An example is shown in the figure below.Figure 34 Traffic Redirect ExampleThe following network topology allows you to avoid triangle route security issues when the backup gateway is connected to the LAN. Use IP alias to configure the LAN into two or three logical networks with the ZyXEL Device itself as the gateway for each LAN network. Put the protected LAN in one subnet (Subnet 1 in the following figure) and the backup gateway in another subnet (Subnet 2). Configure filters that allow packets from the protected LAN (Subnet 1) to the backup gateway (Subnet 2). Figure 35 Traffic Redirect LAN Setup7.9 Configuring WAN Backup Click WA N , then WAN Backup. The screen appears as shown. Use this screen to change your ZyXEL Device’s WAN backup settings.

Chapter 7 WAN SetupP-660W-Tx v2 User’s Guide 91Figure 36 WAN BackupThe following table describes the fields in this screen. Table 27 WAN BackupLABEL DESCRIPTIONBackup Type Select the method that the ZyXEL Device uses to check the DSL connection. Select DSL Link to have the ZyXEL Device check if the connection to the DSLAM is up. Select ICMP to have the ZyXEL Device periodically ping the IP addresses configured in the Check WAN IP Address fields.Check WAN IP Address1-3Configure this field to test your ZyXEL Device's WAN accessibility. Type the IP address of a reliable nearby computer (for example, your ISP's DNS server address). "If you activate either traffic redirect or dial backup, you must configure at least one IP address here. When using a WAN backup connection, the ZyXEL Device periodically pings the addresses configured here and uses the other WAN backup connection (if configured) if there is no response.Fail Tolerance Type the number of times (2 recommended) that your ZyXEL Device may ping the IP addresses configured in the Check WAN IP Address field without getting a response before switching to a WAN backup connection (or a different WAN backup connection).Recovery Interval When the ZyXEL Device is using a lower priority connection (usually a WAN backup connection), it periodically checks to whether or not it can use a higher priority connection.Type the number of seconds (30 recommended) for the ZyXEL Device to wait between checks. Allow more time if your destination IP address handles lots of traffic.

Chapter 7 WAN SetupP-660W-Tx v2 User’s Guide92Timeout Type the number of seconds (3 recommended) for your ZyXEL Device to wait for a ping response from one of the IP addresses in the Check WAN IP Address field before timing out the request. The WAN connection is considered "down" after the ZyXEL Device times out the number of times specified in the Fail Tolerance field. Use a higher value in this field if your network is busy or congested.Traffic Redirect Traffic redirect forwards traffic to a backup gateway when the ZyXEL Device cannot connect to the Internet.Active Select this check box to have the ZyXEL Device use traffic redirect if the normal WAN connection goes down."If you activate traffic redirect, you must configure at least one Check WAN IP Address.Metric This field sets this route's priority among the routes the ZyXEL Device uses. The metric represents the "cost of transmission". A router determines the best route for transmission by choosing a path with the lowest "cost". RIP routing uses hop count as the measurement of cost, with a minimum of "1" for directly connected networks. The number must be between "1" and "15"; a number greater than "15" means the link is down. The smaller the number, the lower the "cost".Backup Gateway Type the IP address of your backup gateway in dotted decimal notation. The ZyXEL Device automatically forwards traffic to this IP address if the ZyXEL Device's Internet connection terminates. Back Click Back to return to the previous screen.Apply Click Apply to save the changes. Cancel Click Cancel to begin configuring this screen afresh.Table 27 WAN Backup (continued)LABEL DESCRIPTION

P-660W-Tx v2 User’s Guide 93CHAPTER 8 Network Address Translation(NAT) ScreensThis chapter discusses how to configure NAT on the ZyXEL Device.8.1 NAT Overview NAT (Network Address Translation - NAT, RFC 1631) is the translation of the IP address of a host in a packet, for example, the source address of an outgoing packet, used within one network to a different IP address known within another network. 8.1.1 NAT DefinitionsInside/outside denotes where a host is located relative to the ZyXEL Device, for example, the computers of your subscribers are the inside hosts, while the web servers on the Internet are the outside hosts. Global/local denotes the IP address of a host in a packet as the packet traverses a router, for example, the local address refers to the IP address of a host when the packet is in the local network, while the global address refers to the IP address of the host when the same packet is traveling in the WAN side. Note that inside/outside refers to the location of a host, while global/local refers to the IP address of a host used in a packet. Thus, an inside local address (ILA) is the IP address of an inside host in a packet when the packet is still in the local network, while an inside global address (IGA) is the IP address of the same inside host when the packet is on the WAN side. The following table summarizes this information.NAT never changes the IP address (either local or global) of an outside host.Table 28 NAT DefinitionsITEM DESCRIPTIONInside This refers to the host on the LAN.Outside This refers to the host on the WAN.Local This refers to the packet address (source or destination) as the packet travels on the LAN.Global This refers to the packet address (source or destination) as the packet travels on the WAN.

Chapter 8 Network Address Translation (NAT) ScreensP-660W-Tx v2 User’s Guide948.1.2 What NAT DoesIn the simplest form, NAT changes the source IP address in a packet received from a subscriber (the inside local address) to another (the inside global address) before forwarding the packet to the WAN side. When the response comes back, NAT translates the destination address (the inside global address) back to the inside local address before forwarding it to the original inside host. Note that the IP address (either local or global) of an outside host is never changed.The global IP addresses for the inside hosts can be either static or dynamically assigned by the ISP. In addition, you can designate servers, for example, a web server and a telnet server, on your local network and make them accessible to the outside world. If you do not define any servers (for Many-to-One and Many-to-Many Overload mapping – see Table 29 on page 96), NAT offers the additional benefit of firewall protection. With no servers defined, your ZyXEL Device filters out all incoming inquiries, thus preventing intruders from probing your network. For more information on IP address translation, refer to RFC 1631, The IP Network Address Translator (NAT).8.1.3 How NAT WorksEach packet has two addresses – a source address and a destination address. For outgoing packets, the ILA (Inside Local Address) is the source address on the LAN, and the IGA (Inside Global Address) is the source address on the WAN. For incoming packets, the ILA is the destination address on the LAN, and the IGA is the destination address on the WAN. NAT maps private (local) IP addresses to globally unique ones required for communication with hosts on other networks. It replaces the original IP source address (and TCP or UDP source port numbers for Many-to-One and Many-to-Many Overload NAT mapping) in each packet and then forwards it to the Internet. The ZyXEL Device keeps track of the original addresses and port numbers so incoming reply packets can have their original values restored. The following figure illustrates this.Figure 37 How NAT Works8.1.4 NAT ApplicationThe following figure illustrates a possible NAT application, where three inside LANs (logical LANs using IP Alias) behind the ZyXEL Device can communicate with three distinct WAN networks. More examples follow at the end of this chapter.

Chapter 8 Network Address Translation (NAT) ScreensP-660W-Tx v2 User’s Guide 95Figure 38 NAT Application With IP Alias8.1.5 NAT Mapping TypesNAT supports five types of IP/port mapping. They are:•One to One: In One-to-One mode, the ZyXEL Device maps one local IP address to one global IP address.•Many to One: In Many-to-One mode, the ZyXEL Device maps multiple local IP addresses to one global IP address. This is equivalent to SUA (for instance, PAT, port address translation), ZyXEL’s Single User Account feature that previous ZyXEL routers supported (the SUA Only option in today’s routers). •Many to Many Overload: In Many-to-Many Overload mode, the ZyXEL Device maps the multiple local IP addresses to shared global IP addresses.•Many-to-Many No Overload: In Many-to-Many No Overload mode, the ZyXEL Device maps each local IP address to a unique global IP address. •Server: This type allows you to specify inside servers of different services behind the NAT to be accessible to the outside world.Port numbers do NOT change for One-to-One and Many-to-Many No Overload NAT mapping types.

Chapter 8 Network Address Translation (NAT) ScreensP-660W-Tx v2 User’s Guide96The following table summarizes these types.8.2 SUA (Single User Account) Versus NATSUA (Single User Account) is a ZyNOS implementation of a subset of NAT that supports two types of mapping, Many-to-One and Server. The ZyXEL Device also supports Full Feature NAT to map multiple global IP addresses to multiple private LAN IP addresses of clients or servers using mapping types as outlined in Table 29 on page 96. • Choose SUA Only if you have just one public WAN IP address for your ZyXEL Device.• Choose Full Feature if you have multiple public WAN IP addresses for your ZyXEL Device.8.3 SUA Server A SUA server set is a list of inside (behind NAT on the LAN) servers, for example, web or FTP, that you can make visible to the outside world even though SUA makes your whole inside network appear as a single computer to the outside world. You may enter a single port number or a range of port numbers to be forwarded, and the local IP address of the desired server. The port number identifies a service; for example, web service is on port 80 and FTP on port 21. In some cases, such as for unknown services or where one server can support more than one service (for example both FTP and web service), it might be better to specify a range of port numbers. You can allocate a server IP address that corresponds to a port or a range of ports.Many residential broadband ISP accounts do not allow you to run any server processes (such as a Web or FTP server) from your location. Your ISP may periodically check for servers and may suspend your account if it discovers any active services at your location. If you are unsure, refer to your ISP.Table 29 NAT Mapping TypesTYPE IP MAPPINGOne-to-One ILA1ÅÆ IGA1Many-to-One (SUA/PAT) ILA1ÅÆ IGA1ILA2ÅÆ IGA1…Many-to-Many Overload ILA1ÅÆ IGA1ILA2ÅÆ IGA2ILA3ÅÆ IGA1ILA4ÅÆ IGA2…Many-to-Many No Overload ILA1ÅÆ IGA1ILA2ÅÆ IGA2ILA3ÅÆ IGA3…Server Server 1 IPÅÆ IGA1Server 2 IPÅÆ IGA1Server 3 IPÅÆ IGA1

Chapter 8 Network Address Translation (NAT) ScreensP-660W-Tx v2 User’s Guide 978.3.1 Default Server IP AddressIn addition to the servers for specified services, NAT supports a default server IP address. A default server receives packets from ports that are not specified in this screen.If you do not assign an IP address in Server Set 1 (default server) the ZyXEL Device discards all packets received for ports that are not specified here or in the remote management setup.8.3.2 Port Forwarding: Services and Port NumbersThe most often used port numbers are shown in the following table. Please refer to RFC 1700 for further information about port numbers. 8.3.3 Configuring Servers Behind SUA (Example)Let's say you want to assign ports 21-25 to one FTP, Telnet and SMTP server (A in the example), port 80 to another (B in the example) and assign a default server IP address of 192.168.1.35 to a third (C in the example). You assign the LAN IP addresses and the ISP assigns the WAN IP address. The NAT network appears as a single host on the Internet.IP address assigned by ISP.Figure 39 Multiple Servers Behind NAT ExampleTable 30 Services and Port NumbersSERVICES PORT NUMBERECHO 7FTP (File Transfer Protocol) 21SMTP (Simple Mail Transfer Protocol) 25DNS (Domain Name System) 53Finger 79HTTP (Hyper Text Transfer protocol or WWW, Web) 80POP3 (Post Office Protocol) 110NNTP (Network News Transport Protocol) 119SNMP (Simple Network Management Protocol) 161SNMP trap 162PPTP (Point-to-Point Tunneling Protocol) 1723

Chapter 8 Network Address Translation (NAT) ScreensP-660W-Tx v2 User’s Guide988.4 Selecting the NAT Mode You must create a firewall rule in addition to setting up SUA/NAT, to allow traffic from the WAN to be forwarded through the ZyXEL Device. Click NAT to open the following screen. Figure 40 NAT ModeThe following table describes the labels in this screen. 8.5 Configuring SUA Server Set If you do not assign an IP address in Server Set 1 (default server) the ZyXEL Device discards all packets received for ports that are not specified here or in the remote management setup.Click NAT, select SUA Only and click Edit Details to open the following screen. See Section 8.3 on page 96 for more information. See Table 30 on page 97 for port numbers commonly used for particular services. Table 31 NAT ModeLABEL DESCRIPTIONNone Select this radio button to disable NAT.SUA Only Select this radio button if you have just one public WAN IP address for your ZyXEL Device. The ZyXEL Device uses Address Mapping Set 1 in the NAT - Edit SUA/NAT Server Set screen. Edit Details Click this link to go to the NAT - Edit SUA/NAT Server Set screen. Full Feature Select this radio button if you have multiple public WAN IP addresses for your ZyXEL Device. Edit Details Click this link to go to the NAT - Address Mapping Rules screen. Apply Click Apply to save your configuration.

Chapter 8 Network Address Translation (NAT) ScreensP-660W-Tx v2 User’s Guide 99Figure 41 Edit SUA/NAT Server SetThe following table describes the fields in this screen. 8.6 Configuring Address Mapping Rules Ordering your rules is important because the ZyXEL Device applies the rules in the order that you specify. When a rule matches the current packet, the ZyXEL Device takes the corresponding action and the remaining rules are ignored. If there are any empty rules before your new configured rule, your configured rule will be pushed up by that number of empty Table 32 Edit SUA/NAT Server SetLABEL DESCRIPTIONStart Port No. Enter a port number in this field. To forward only one port, enter the port number again in the End Port No. field. To forward a series of ports, enter the start port number here and the end port number in the End Port No. field.End Port No. Enter a port number in this field. To forward only one port, enter the port number again in the Start Port No. field above and then enter it again in this field. To forward a series of ports, enter the last port number in a series that begins with the port number in the Start Port No. field above.Server IP AddressEnter your server IP address in this field.Save Click Save to save your changes back to the ZyXEL Device.Cancel Click Cancel to return to the previous configuration.

Chapter 8 Network Address Translation (NAT) ScreensP-660W-Tx v2 User’s Guide100rules. For example, if you have already configured rules 1 to 6 in your current set and now you configure rule number 9. In the set summary screen, the new rule will be rule 7, not 9. Now if you delete rule 4, rules 5 to 7 will be pushed up by 1 rule, so old rules 5, 6 and 7 become new rules 4, 5 and 6. Click NAT, select Full Feature and click Edit Details to open the following screen. Use this screen to change your ZyXEL Device’s address mapping settings. Figure 42 Address Mapping RulesThe following table describes the fields in this screen. Table 33 Address Mapping RulesLABEL DESCRIPTIONLocal Start IP This is the starting Inside Local IP Address (ILA). Local IP addresses are N/A for Server port mapping.Local End IP This is the end Inside Local IP Address (ILA). If the rule is for all local IP addresses, then this field displays 0.0.0.0 as the Local Start IP address and 255.255.255.255 as the Local End IP address. This field is N/A for One-to-one and Server mapping types.Global Start IP This is the starting Inside Global IP Address (IGA). Enter 0.0.0.0 here if you have a dynamic IP address from your ISP. You can only do this for Many-to-One and Server mapping types. Global End IP This is the ending Inside Global IP Address (IGA). This field is N/A for One-to-one, Many-to-One and Server mapping types.

Navigation menu