Welcome to use WiMAX CPE! Online Help Issue 02 Date 2013-03-06 Part Number 309075 Huawei Proprietary and Confidential Copyright © Huawei Technologies Co., Ltd. Copyright © Huawei Technologies Co., Ltd. 2013. All rights reserved. No part of this document may be reproduced or transmitted in any form or by any means without prior written consent of Huawei Technologies Co., Ltd. The product described in this manual may include copyrighted software of Huawei Technologies Co., Ltd. and possible licensors. Customers shall not in any manner reproduce, distribute, modify, decompile, disassemble, decrypt, extract, reverse engineer, lease, assign, or sublicense the said software, unless such restrictions are prohibited by applicable laws or such actions are approved by respective copyright holders under licenses. Trademarks and Permissions , , and Technologies Co., Ltd. are trademarks or registered trademarks of Huawei Other trademarks, product, service and company names mentioned are the property of their respective owners. Notice Some features of the product and its accessories described herein rely on the software installed, capacities and settings of local network, and may not be activated or may be limited by local network operators or network service providers, thus the descriptions herein may not exactly match the product or its accessories you purchase. Huawei Technologies Co., Ltd. reserves the right to change or modify any information or specifications contained in this manual without prior notice or obligation. NO WARRANTY THE CONTENTS OF THIS MANUAL ARE PROVIDED "AS IS". EXCEPT AS REQUIRED BY APPLICABLE LAWS, NO WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ARE MADE IN RELATION TO THE ACCURACY, RELIABILITY OR CONTENTS OF THIS MANUAL. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO CASE SHALL HUAWEI TECHNOLOGIES CO., LTD. BE LIABLE FOR ANY SPECIAL, INCIDENTAL, INDIRECT, OR CONSEQUENTIAL DAMAGES, OR LOST PROFITS, BUSINESS, REVENUE, DATA, GOODWILL OR ANTICIPATED SAVINGS. Import and Export Regulations Customers shall comply with all applicable export or import laws and regulations and will obtain all necessary governmental permits and licenses in order to export, re-export or import the product mentioned in this manual including the software and technical data therein. Huawei Proprietary and Confidential Copyright © Huawei Technologies Co., Ltd. Warnings and Precautions To use the device properly and safely, read these warnings and precautions carefully and strictly observe them during operation. Unless otherwise specified, the term "device" refers to the device and its accessories. Basic Requirements During storage, transportation, and operation of the device, keep it dry and prevent it from colliding with other objects. Do not dismantle the device. In case of any fault, contact an authorized service center for assistance or repair. Without authorization, no organization or individual can change the mechanical, safety, or performance design of the device. When using the device, observe all applicable laws and regulations and respect the legal rights of other people. Medical Device Follow rules and regulations set forth by hospitals and health care facilities. Do not use your device when using the device is prohibited. Some wireless devices may affect the performance of hearing aids or pacemakers. For any such problems, consult your service provider. If you are using an electronic medical device, consult the doctor or the device manufacturer to confirm whether radio waves affect the operation of this device. Potentially Explosive Atmosphere Do not use your device in any area with a potentially explosive atmosphere, and comply with all signs and instructions. Areas that may have potentially explosive atmospheres include the areas where you would normally be advised to turn off your vehicle engine. Triggering of sparks in such areas could cause an explosion or a fire, resulting in bodily injuries or even deaths. Do not use your device at refueling points such as service stations. Comply with restrictions on the use of radio equipment in fuel depots, storage, and distribution areas, and chemical plants. In addition, adhere to restrictions in areas where blasting operations are in progress. Before using the device, watch out for areas that have potentially explosive atmospheres that are often, but not always, clearly marked. Such locations include areas below the deck on boats, chemical transfer or storage facilities, and areas where the air contains chemicals or particles such as grain, dust, or metal powders. Ask the manufacturers of vehicles using liquefied petroleum gas (such as propane or butane) whether this device can be safely used in their vicinity. Traffic Security Observe local laws and regulations while using the device. To prevent accidents, do not use your wireless device while driving. Huawei Proprietary and Confidential Copyright © Huawei Technologies Co., Ltd. RF signals may affect electronic systems of motor vehicles. For more information, consult the vehicle manufacturer. In a motor vehicle, do not place the device over the air bag or in the air bag deployment area. Otherwise, the device may hurt you owing to the strong force when the air bag inflates. Do not use your device while flying in an aircraft and before boarding an aircraft. Using wireless devices in an aircraft may cause danger to the operation of the aircraft and disrupt the wireless telephone network. It may also be considered illegal. Environmental Requirements for Using the Device Before connecting and disconnecting cables, stop using the device, and then disconnect it from the power supply. Ensure that your hands are dry during operation. Keep the device far from sources of heat and fire, such as a heater or a candle. Keep the device far from electronic appliances that generate strong magnetic or electric fields, such as a microwave oven or a refrigerator. Place the device on a stable surface. Place the device in a cool and well-ventilated indoor area. Do not expose the device to direct sunlight. Use the device in an area with a temperature ranging from 0°C to 40°C. Do not block the openings on the device with any object. Reserve a minimum space of 10 cm around the device for heat dissipation. Do not place any object (such as a candle or a water container) on the device. If any foreign object or liquid enters the device, stop using the device immediately, power it off, remove all the cables connected to it, and then contact an authorized service center. During thunderstorms, power off the device, and then remove all the cables connected to it to prevent it from getting damaged due to lightning strikes. Precautions for Using Wireless Devices Do not use the device where using wireless devices is prohibited or may cause interference or danger. The radio waves generated by the device may interfere with the operation of electronic medical devices. If you are using any electrical medical device, contact its manufacturer for the restrictions on the use of the device. Do not take the device into operating rooms, intensive care units (ICUs), or coronary care units (CCUs). Accessory Requirements Use only the accessories supplied or authorized by the device manufacturer. Otherwise, the performance of the device may get affected, the warranty for the device or the laws and regulations related to telecommunications terminals may become null and void, or an injury may occur. Huawei Proprietary and Confidential Copyright © Huawei Technologies Co., Ltd. Do not use the power adapter if its cable is damaged. Otherwise, electric shocks or fires may occur. Ensure that the power adapter meets the specifications indicated on the device nameplate. Ensure that the power adapter meets the requirements of Clause 2.5 in IEC60950-1/EN60950-1 and it is tested and approved according to national or local standards. Safety of Children Keep the device and its accessories out of the reach of children. Otherwise, they may damage the device and its accessories by mistake, or they may swallow the small components of the device, causing suffocation or other dangerous situations. Maintenance If the device is not used for a long time, power it off, and then remove all the cables connected to it. If any exception occurs, for example, if the device emits any smoke or unusual sound or smell, stop using the device immediately, power it off, remove all the cables connected to it, and then contact an authorized service center. Do not trample, pull, or overbend any cable. Otherwise, the cable may get damaged, causing malfunction of the device. Before cleaning the device, stop using it, power it off, and then remove all the cables connected to it. Use a clean, soft, and dry cloth to clean the device shell. Do not use any cleaning agent or spray to clean the device shell. Disposal and Recycling Information This symbol on the device (and any included batteries) indicates that the device (and any included batteries) should not be disposed of as normal household garbage. Do not dispose of your device or batteries as unsorted municipal waste. The device (and any batteries) should be handed over to a certified collection point for recycling or proper disposal at the end of its life. For more detailed information about the recycling of the device or batteries, contact your local city office, the household waste disposal service, or the retail store where you purchased this device. The disposal of this device is subject to the Waste from Electrical and Electronic Equipment (WEEE) Directive of the European Union. The purpose for separating WEEE and batteries from other waste is to minimize any environmental impact and health hazard due to the presence of hazardous substances. Reduction of Hazardous Substances This device is compliant with the EU Registration, Evaluation, Authorisation and Restriction of Chemicals (REACH) Regulation (Regulation No 1907/2006/EC of the European Parliament and of the Council) and the EU Restriction of Hazardous Huawei Proprietary and Confidential Copyright © Huawei Technologies Co., Ltd. Substances (RoHS) Directive (Directive 2002/95/EC of the European Parliament and of the Council). For more information about the REACH compliance of the device, visit the web site www.huaweidevice.com/certification. You are recommended to visit the web site regularly for up-to-date information. EU Regulatory Conformance This device should be installed and operated with a minimum distance of 20 cm between the antenna and all persons. Български: С настоящето Huawei Technologies Co., Ltd. декларира, че този уред съответства на основните изисквания и другите разпоредби на Директива 1999/5/EC. Česky: Huawei Technologies Co., Ltd., tímto prohlašuje, že toto zařízení je ve shodě se základními požadavky a dalšími souvisejícími opatřeními směrnice 1999/5/EC. Dansk: Huawei Technologies Co., Ltd. erklærer hermed at denne enhed er i overensstemmelse med de obligatoriske krav og andre relevante bestemmelser i direktiv 1999/5/EF. Nederlands: Hierbij verklaart Huawei Technologies Co., Ltd. dat dit apparaat in overeenstemming is met de essentiële eisen en de andere relevante bepalingen van richtlijn 1999/5/EC. English: Hereby, Huawei Technologies Co., Ltd. declares that this device is in compliance with the essential requirements and other relevant provisions of Directive 1999/5/EC. Eesti: Käesolevaga kinnitab Huawei Technologies Co., Ltd., et see seade vastab Direktiivi 1999/5/EÜ põhinõudmistele ja teistele asjakohastele määrustele. Suomi: Huawei Technologies Co., Ltd. vakuuttaa täten, ettätämälaite on yhdenmukainen direktiivin 1999/5/EY olennaisten vaatimusten ja direktiivin muiden asiaankuuluvien lausumien kanssa. Français (Européen) : Huawei Technologies Co., Ltd. déclare que ce produit est conforme aux exigences essentielles et aux autres dispositions pertinentes de la directive 1999/5/CE. Deutsch: Huawei Technologies Co., Ltd. erklärt hiermit, dass dieses Produkt die erforderlichen Bestimmungen und andere relevante Verordnungen der Richtlinie 1999/5/EG einhält. Ελληνικά: Δια της παρούσης η Huawei Technologies Co., Ltd. δηλώνει ότι αυτή η συσκευή συμμορφώνεται με τις βασικές απαιτήσεις και άλλες σχετικές διατάξεις της οδηγίας 1999/5/ΕΚ. Magyar: Jelen nyilatkozaton keresztül a Huawei Technologies Co., Ltd. kijelenti, hogy a készülék megfelel az EC/5/1999 Irányelv összes lényeges követelményének és vonatkozó előírásának. Gaeilge: Fograí onn Huawei Technologies Co., Ltd. leis seo go bhfuil an fheiste seo i gcomhlíonadh leis na fíor-riachtanais agus na forálacha eile maidir le Treoir 1999/5/AE. Huawei Proprietary and Confidential Copyright © Huawei Technologies Co., Ltd. Italiano: Col presente documento, Huawei Technologies Co., Ltd. dichiara che questo dispositivo èconforme ai requisiti essenziali e alle altre disposizioni applicabili della Direttiva 1999/5/CE. Latviski: Ar šo Huawei Technologies Co., Ltd. paziņo, ka šī ierīce atbilst Direktīvas 1999/5/EC pamatprasībām un piemērojamajiem nosacījumiem. Lietuviškai: Šiuo Huawei Technologies Co., Ltd. praneša, kad šis įtaisas atitinka Direktyvos 1999/5/EC pagrindinius reikalavimus ir taikomas sąlygas. Malti: Hawnhekk, Huawei Technologies Co., Ltd. tiddikjara li dan it-tagħmir hu konformi mal-ħtiġijiet essenzjali u provvedimenti rilevanti oħrajn ta’ Direttiva 1999/5/KE. Polski: Wymieniona w tym dokumencie firma Huawei Technologies Co., Ltd. deklaruje, że niniejsze urządzenie spełnia zasadnicze wymagania w zakresie zgodności oraz inne odnośne postanowienia Dyrektywy 1999/5/EC. Português (Europeu) : Deste modo, a Huawei Technologies Co., Ltd. declara que este dispositivo estáem conformidade com os requisitos essenciais e outras provisões relevantes da Directiva 1999/5/CE. Română: Prin prezenta Huawei Technologies Co., Ltd. declară că acest dispozitiv este conform cu cerinţele esenţiale şi alte prevederi relevante ale directivei 1999/5/CE. Slovenčina: Huawei Technologies Co., Ltd. týmto vyhlasuje, že zariadenie je v súlade so základnými požiadavkami a inými relevantnými predpismi Smernice 1999/5/ES. Slovenščina: Huawei Technologies Co., Ltd. izjavlja, da je ta naprava v skladu z bistvenimi zahtevami in drugimi ustreznimi določbami Direktive 1999/5/ES. Español (Europeo) : Con el presente documento, Huawei Technologies Co., Ltd. declara que este dispositivo cumple con los requisitos esenciales y con las demás disposiciones correspondientes de la Directiva 1999/5/CE. Svenska: Huawei Technologies Co., Ltd. förklarar härmed att denna produkt överensstämmer med de grundläggande kraven och andra relevanta föreskrifter i direktiv 1999/5/EG. For the declaration of conformity, visit the web site www.huaweidevice.com/certification. Notice: This device can be operated in all European countries. Norge: Dette underavsnittet gjelder ikke for det geografiske området innen en radius på20 km fra Ny-Ålesund. GNU General Public License Notice This product contains code that is covered by the GNU General Public License (GPL). In accordance with the GPL, if you would like a copy of the GPL source Huawei Proprietary and Confidential Copyright © Huawei Technologies Co., Ltd. code contained in this product shipped to you on CD, for a charge no more than the cost of preparing and mailing a CD to you, please contact mobile@huawei.com. For further information on the GNU GPL Code, please visit the GNU Project home page http://www.gnu.org/home.html. For recently updated hotline and email address in your country or region, visit the web site www.huaweidevice.com/worldwide/support/hotline. Huawei Proprietary and Confidential Copyright © Huawei Technologies Co., Ltd. Online Help Contents Contents 1 Getting Started ...................................................................................................... 1-1 1.1 About this Help ........................................................................................................... 1-1 1.2 The CPE Overview...................................................................................................... 1-1 1.3 Accessing the Web-Based Utility ................................................................................ 1-1 2 Configuring Basic Settings ................................................................................. 2-1 2.1 WAN ........................................................................................................................... 2-1 2.1.1 Working Mode ................................................................................................ 2-1 2.1.2 Connection Type ............................................................................................. 2-1 2.1.3 Configuring the WAN ..................................................................................... 2-1 2.2 LAN ............................................................................................................................ 2-2 2.2.1 IP Address and Subnet Mask .......................................................................... 2-2 2.2.2 DHCP .............................................................................................................. 2-3 2.3 WLAN......................................................................................................................... 2-3 2.3.1 SSID ................................................................................................................ 2-3 2.3.2 Wireless Security ............................................................................................ 2-4 2.3.3 WPS ................................................................................................................ 2-5 2.3.4 Configuring the WLAN .................................................................................. 2-6 3 Configuring Advanced Settings......................................................................... 3-1 3.1 Security ....................................................................................................................... 3-1 3.1.1 URL Filter ....................................................................................................... 3-1 3.1.2 MAC Filter ...................................................................................................... 3-1 3.1.3 IP Filter ........................................................................................................... 3-2 3.1.4 Firewall ........................................................................................................... 3-3 3.1.5 DDoS Protection ............................................................................................. 3-4 3.2 NAT ............................................................................................................................ 3-5 3.2.1 ALG ................................................................................................................ 3-5 3.2.2 DMZ................................................................................................................ 3-6 3.2.3 Port Mapping .................................................................................................. 3-6 3.2.4 Port Triggering ................................................................................................ 3-7 3.3 UPnP ........................................................................................................................... 3-7 Issue 02 (2013-03-06) Huawei Proprietary and Confidential Copyright © Huawei Technologies Co., Ltd. i Online Help Contents 4 Managing the CPE ................................................................................................ 4-1 4.1 Checking the Status information ................................................................................. 4-1 4.2 Disconnecting from or reconnecting to the Network ................................................... 4-1 5 Maintaining the CPE ............................................................................................ 5-1 5.1 Maintaining the User Account..................................................................................... 5-1 5.2 Detecting the CPE ....................................................................................................... 5-1 6 Frequently Asked Questions (FAQ) .................................................................. 6-1 7 Acronyms and Abbreviations ............................................................................. 7-1 Issue 02 (2013-03-06) Huawei Proprietary and Confidential Copyright © Huawei Technologies Co., Ltd. ii Online Help 1 Getting Started 1 Getting Started 1.1 About this Help This help is designed to guide you through the configuration of the WiMAX CPE (Customer Premises Equipment) for accessing the network services and only for reference. The actual functions are subject to your product purchased. Generally, the WiMAX CPE will be referred to as the CPE in this help. And the following symbols are used in this help: A note provides additional information about a topic. A tip provides an alternative method or shortcut to perform an action. A caution warns you about potential problems or specific precautions that need to be taken. 1.2 The CPE Overview The WiMAX CPE is a gateway that is applicable to the WiMAX (Worldwide Interoperability for Microwave Access) network. Generally, with the CPE, you can build a secure home or small office network with easy setup and configuration through WiMAX wireless Internet access to enjoy various broadband network services easily and conveniently in areas covered by the network, you can make and receive Internet calls working with the VoIP (Voice over IP) communication capabilities of the CPE, and you can also configure firewall and various filtering for secure Internet access, as well as host of other features. You can operate and manage the CPE through the Web-Based Utility, which is a web browser-based configuration interface that allows easy device setup, configuration and management via Internet browser. It provides the interfaces for browsing, configuring, managing and maintaining the CPE. 1.3 Accessing the Web-Based Utility Take the Windows XP operating system and the Internet Explorer 7.0 for example, to access the Web-based utility, refer to the following steps: Step 1 Step 2 Make sure the hardware of the CPE is properly connected (refer to the Quick Start). Configure the IP address of the computer. Make sure that the IP address of the computer and the IP address of the CPE are in the same network segment. Issue 02 (2013-03-06) Huawei Proprietary and Confidential Copyright © Huawei Technologies Co., Ltd. 1-1 Online Help Step 3 Step 4 1 Getting Started By default, the IP address of the CPE is 192.168.1.1 and the subnet mask is 255.255.255.0, and the IP address of the computer must be within the range 192.168.1.2 to 192.168.1.254 to be compatible with the CPE. Run the Internet Explorer, enter the IP address of the CPE (http://192.168.1.1 by default) in the address bar, and then press Enter. Enter the user name and password in the login windows that opens and select Login. Both the initial user name and password are user. It is highly recommended you change the default user name and password, and see “5.1 Maintaining the User Account” for reference. Step 5 After the user name and the password are verified, you can perform operations through the Web-based utility. Select Logout if you want to log out the web-based utility. And for security concerns, by default the CPE automatically logs you out if you do not use the web-based utility for about five minutes, logging in again when in need. ----End Issue 02 (2013-03-06) Huawei Proprietary and Confidential Copyright © Huawei Technologies Co., Ltd. 1-2 Online Help 2 Configuring Basic Settings 2 Configuring Basic Settings 2.1 WAN A WAN (Wide Area Network) is an outside connection to another network or the Internet. With correct WAN settings, network devices such as computers and telephones on the LAN (Local Area Network) side can be connected to another network or the Internet through the CPE. 2.1.1 Working Mode When connecting to a WAN, the CPE supports the following two working modes with respect to connectivity between the WAN and the LAN: Routing mode, the CPE provides typical routing functionality between the WAN side and the LAN side. Based on packet information, the CPE searches for a route through which the packets are sent to the destination IP address. Bridging mode, the CPE provides only bridging functionality. The CPE only transparently transmits packets. 2.1.2 Connection Type When connecting to a WAN, the CPE supports the following three connection types: Dynamic IP address, also referred to as DHCP (Dynamic Host Configuration Protocol), the ISP (Internet service provider) assigns you a dynamic IP address automatically each time you connect to the Internet. Static IP address, the ISP provides you a fixed IP address and related information (Network Mask, Gateway IP address, and DNS address). PPPoE (Point-to-Point Protocol over Ethernet), the ISP provides you a PPPoE connection information. The IP address is usually allocated automatically. 2.1.3 Configuring the WAN For the sake of brevity, an abbreviated style for menu commands is used throughout this help. For example, "Select Basic > WAN" means "Select WAN from the Basic menu". Step 1 Step 2 Step 3 To configure the WAN settings, refer to the following steps: Access the Web-Based Utility. Select Basic > WAN in the navigation tree. Select Route or Bridge from Mode drop-down list box to set the CPE to work in routing mode or in bridging mode. Issue 02 (2013-03-06) Huawei Proprietary and Confidential Copyright © Huawei Technologies Co., Ltd. 2-1 Online Help Step 4 2 Configuring Basic Settings Select the connection type and configure the connection parameters and settings for the CPE according to the configuration information provided by your ISP. Only in the bridging mode you can enable the VLAN (Virtual Local Area Network) feature. Step 5 1. If you select Static, enter the corresponding parameter values provided by the ISP in the IP Address, Subnet Mask, Default Gateway, Primary DNS Server, and Secondary DNS Server text boxes. 2. If you select PPPoE, enter the user name and password provided by the ISP, and select the dial-up method in the Dial-up method drop-down list box. Two dial-up methods are provided: Automatic and Manual Dial. If you select Manual Dial, you need to select Connect to set up a dial-up connection. 3. If you have set the CPE to work in routing mode, you have to select the NAT (Network Address Translation) type. The NAT feature is enabled to facilitate the translation of IP addresses when the CPE works in the routing mode. Through NAT, the host IP address of a LAN can be effectively hidden. Thus, the security of the intranet is ensured. Two NAT types are provided: NAPT (Network Address Port Translation) and CONE NAT. Select Apply to save the configuration. ----End 2.2 LAN A LAN (Local Area Network) is a shared communication system to which more than one device are attached limited to the immediate area. With correct LAN settings, network devices such as computers can share communication on the LAN through the CPE. 2.2.1 IP Address and Subnet Mask By default, the LAN parameters of the CPE are the following values: IP address of 192.168.1.1 with subnet mask of 255.255.255.0. You can change the IP address to another individual IP address that is easy to remember, and make sure that IP address is not used by other device on your network. If you change the IP address of the CPE, you have to access the Web-Based Utility with the new IP address. To change the IP address and subnet mask of the CPE, refer to the following steps: Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Access the Web-Based Utility. Select Basic > LAN in the navigation tree. Select DHCP tab page. Enter a new individual IP address in the IP Address text box, make sure that IP address is not used by other device on your network. Enter the subnet mask in the Subnet Mask text box (for example, 255.255.255.0). Select Apply to save the configuration. ----End Issue 02 (2013-03-06) Huawei Proprietary and Confidential Copyright © Huawei Technologies Co., Ltd. 2-2 Online Help 2 Configuring Basic Settings 2.2.2 DHCP DHCP (Dynamic Host Configuration Protocol) allows individual clients to obtain TCP/IP configuration automatically at startup from a server. You can configure the CPE as a DHCP server or disable it when the CPE is working in the routing mode. When configured as a DHCP server, the CPE provides the TCP/IP configuration automatically for the LAN clients that support DHCP client capability. If DHCP server service is disabled, you must have another DHCP server on your LAN, or else each client must be manually configured. The CPE is pre-configured with a pool of IP addresses for the DHCP clients (DHCP Pool). With the DHCP server service enabled, you can change the start IP address and the end IP address for the Pool or reserve the default. To configure the DHCP settings, refer to the following steps: Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Access the Web-Based Utility. Select Basic > LAN in the navigation tree. Select DHCP tab page. Select or clear Enable DHCP Server check box to enable or disable the DHCP server feature of the CPE. If you disable the feature, go to Step 7. Enter the start IP address and the end IP address. Select the lease time that a client may use an IP address, the client will request a new IP address after the time limit expires. Select Apply to save the configuration. ----End 2.3 WLAN A WLAN (Wireless Local Area Network) links two or more devices over short distances using wireless distribution method instead of traditional network cabling, typically extending an existing wired local area network, and usually providing a connection through an access point to the wider internet. A WLAN gives you the mobility to move around within a local coverage area and still be connected to the network. 2.3.1 SSID An SSID (Service Set Identifier) is a unique identifier that distinguishes one WLAN from another. Wireless devices use the SSID to establish and maintain wireless connectivity. The CPE can support two separate SSIDs. This logically divides the access point into two virtual access points within a single hardware platform. You can assign different configuration settings to each SSID. Both the SSIDs are active at the same time; that is, client devices can associate to the access point using either of the SSIDs. This enables the separation of wireless applications based on security and performance requirements. For example, you could enable encryption and authentication on one SSID to protect private applications and no security on another SSID to maximize open connectivity for public usage. Issue 02 (2013-03-06) Huawei Proprietary and Confidential Copyright © Huawei Technologies Co., Ltd. 2-3 Online Help 2 Configuring Basic Settings Besides security settings, you can also assign the following two important settings to each SSID: SSID broadcasting. In some cases, such as public Internet access applications, you can broadcast the SSID to enable user radio cards to automatically find available access points. For private applications, it is generally best to not broadcast the SSID for security reasons. Multiple SSIDs means you can mix and match the broadcasting of SSIDs. Maximum number of client associations. You can set the number of users that can associate via a particular SSID, which makes it possible to control usage of particular applications. This can help provide a somewhat limited form of bandwidth control for particular applications. 2.3.2 Wireless Security The CPE supports different levels of security: None No security, and not recommended. WEP Not recommended as reliable, but can be used until your device can be upgraded to support WPA, and it is still a lot better than nothing. WEP (Wired Equivalent Privacy) is the encryption type for wireless security in early ages, but it has been found to be not strong enough to keep data secure and can be broken rather easily, and it has better replacements of WPA. Two methods of authentication can be used with WEP: Open and Shared. In Open, any device can authenticate to the AP. In Shared, only devices with the WEP key can successfully authenticate. Most devices that support WEP can be firmware/software upgraded to WPA. Do not use WEP unless some devices cannot be upgraded to support WPA. When using WEP, you can use a secure encryption key with random characters that will not be break easy and change it regularly to increase the security of your network. WPA (Wi-Fi Protected Access) In a broad sense, WPA is now in a second generation, referred to as WPA2. Unless otherwise specified, this document uses "WPA" to refer to both, but when corresponding to WPA2, "WPA" is referred to as the first generation in a narrow sense. WPA is a modified version of WEP, which changes the effective key quite often. It is much more secure than WEP, and it is currently believed more secure as long as you use a good password. WPA2 is a second-generation implementation based on new encryption technology, and is supposedly be more secure than WPA. WPA Encryption Type Issue 02 (2013-03-06) Huawei Proprietary and Confidential Copyright © Huawei Technologies Co., Ltd. 2-4 Online Help 2 Configuring Basic Settings The CPE supports the following WPA encryption types to protect your data being transferred from the device such as the computer to the CPE and the Internet: WPA-PSK WPA2-PSK Mixed WPA2/WPA-PSK WPA-PSK and WPA2-PSK is the simplification of WPA and WPA2, designed for home and small office networks that do not require the complexity of an RADIUS authentication server. Mixed WPA2/WPA-PSK may operate in a network that mixes WPA and WPA2 clients. WPA Encryption Technology The CPE supports the following WPA encryption technologies for each encryption type: TKIP AES TKIP+AES WPA uses the TKIP (Temporal Integrity Protocol) which changes key automatically, and WPA2 is built on WPA and uses the stronger AES (Advanced Encryption Standard) which is supposedly be more secure. However, some devices allow WPA with AES and WPA2 with TKIP. Thus AES is optional in WPA and is mandatory in WPA2, and TKIP is optional in WPA and is mandatory in WPA2. TKIP is not directly comparable to AES; TKIP is an integrity check, AES is an encryption algorithm. AES is preferred. When using TKIP+AES, the device will attempt to use AES for higher security if available and fall back to TKIP if not. This setting offers the most compatibility but will not guarantee a higher level of encryption in case a device falls back to TKIP. 2.3.3 WPS WPS (Wi-Fi Protected Setup) is a WLAN protocol that is used to facilitate the establishment of secure wireless connection for wireless home networks. The WPS protocol is to simplify the process of configuring security on wireless networks and automatically configure a wireless network with a network name (SSID) and strong WPA data encryption and authentication supported by all Wi-Fi certified devices for home users who know little of wireless security. To add a new device to the WLAN, WPS can be used in the following two methods: PBC (Push Button Configuration) The PBC method is to be used if the wireless client device has a WPS button (either an actual one or a virtual one). PIN (Personal Identification Number) PIN is a mandatory method of setup for all WPS certified devices. It works two ways on both the wireless client and on the CPE: use the PIN code generate by the CPE or use the PIN code pre-defined by the client. Issue 02 (2013-03-06) Huawei Proprietary and Confidential Copyright © Huawei Technologies Co., Ltd. 2-5 Online Help 2 Configuring Basic Settings 2.3.4 Configuring the WLAN To configure the WLAN settings, refer to the following steps: Step 1 Step 2 Step 3 Step 4 Access the Web-Based Utility. Select Basic > LAN in the navigation tree. Select WLAN tab page. Select or clear Enable Wireless check box to enable or disable the wireless feature of the CPE. If you disable the feature, you will not perform the further configuration. Step 5 Select the country from the Regulatory Domain drop-down list box. Step 6 Select the allowed number of multiple SSID to enable and start configuring more SSIDs. Step 7 Use the SSID Index selection to activate the corresponding SSID and configure the settings. Step 8 Give a name to the SSID. Step 9 Select or clear Hide SSID check box to prohibit the SSID from being broadcast or enable the SSID broadcasting. Step 10 Select a wireless security and configure the corresponding parameters for the network according to the page notes, and refer to section “2.3.2 Wireless Security” for details. The default share keys display in non-readable characters, it is highly recommended that you change it for easy-to-remember and security. Only in WPA-PSK, WPA2-PSK, and Mixed WPA2/WPA-PSK, you can enable the WPS feature and configure the WPS settings according to the page notes, and refer to “2.3.3 WPS” for details. Step 11 Select Apply to save the configuration. ----End Issue 02 (2013-03-06) Huawei Proprietary and Confidential Copyright © Huawei Technologies Co., Ltd. 2-6 Online Help 3 Configuring Advanced Settings 3 Configuring Advanced Settings 3.1 Security The security settings are used to control the rights of sending and receiving packets and the duration for accessing the network. 3.1.1 URL Filter The URL (Universal Resource Locator) filter is used to prevent a network device on the LAN side from accessing specific websites on the WAN side. To configure the URL filter, refer to the following steps: Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Access the Web-Based Utility. Select Advanced > Security in the navigation tree. Select URL Filter tab page. Select or clear Enable URL Filter check box to enable or disable the URL filter feature. If you disable the feature, you will not perform the further configuration. Select the filter mode. Two filter mode options are provided: Blacklist The identified entities are being denied, unrecognized, or ostracized with the privilege, service, mobility, access or recognition. Whitelist The identified entities are being approved or provided with the privilege, service, mobility, access or recognition. Enter a URL in the URL field. Select New to add a new URL rule, select a URL filter rule to edit it, or select Remove to delete a selected URL rule. Step 7 Select Apply to save the configuration. ----End 3.1.2 MAC Filter The MAC (Media Access Control) filter can filter data frames according to the defined filter rule. The filter takes effect only when all conditions of the filter rule are met. To configure the MAC filter, refer to the following steps: Step 1 Access the Web-Based Utility. Issue 02 (2013-03-06) Huawei Proprietary and Confidential Copyright © Huawei Technologies Co., Ltd. 3-1 Online Help Step 2 Step 3 Step 4 Step 5 Step 6 3 Configuring Advanced Settings Select Advanced > Security in the navigation tree. Select MAC Filter tab page. Select or clear Enable MAC Filter check box to enable or disable the MAC filter feature. If you disable the feature, you will not perform the further configuration. Select the filter mode. Two filter mode options are provided: Blacklist The identified entities are being denied, unrecognized, or ostracized with the privilege, service, mobility, access or recognition. Whitelist The identified entities are being approved or provided with the privilege, service, mobility, access or recognition. Refer to the following table to set the parameters of the MAC filter. Parameter Description Filter Name Name of a MAC filter rule Source MAC IP MAC address of the source host Destination MAC IP MAC address of the destination host Start Time Effective time of a rule, in the format of hh: mm End Time Expiration time of a rule, in the format of hh: mm Days Effective days of a rule Enable Enable this rule Select New to add a new MAC filter rule, select a MAC filter rule to edit it, or select Remove to delete a selected MAC filter rule. Step 7 Select Apply to save the configuration. ----End 3.1.3 IP Filter When the firewall feature is enabled, you can use the IP incoming filter to receive certain specified IP packets on the WAN side, and use the IP outgoing filter to prevent the LAN side from sending certain IP packets. To configure the IP filter, refer to the following steps: Step 1 Step 2 Step 3 Step 4 Access the Web-Based Utility. Select Advanced > Security in the navigation tree. Select Incoming IP or Outgoing IP tab page to go to the incoming IP filter configuration page or the outgoing IP filter configuration page. Select or clear Enable Incoming IP Filter or Enable IP Outgoing Filter check box to enable or disable the corresponding feature. If you disable the feature, you will not perform the further configuration. Issue 02 (2013-03-06) Huawei Proprietary and Confidential Copyright © Huawei Technologies Co., Ltd. 3-2 Online Help Step 5 Step 6 3 Configuring Advanced Settings If you are configuring incoming IP filter, skip this step. Or if you are configuring outgoing IP filter, select the filter mode. Two filter mode options are provided: Blacklist The identified entities are being denied, unrecognized, or ostracized with the privilege, service, mobility, access or recognition. Whitelist The identified entities are being approved or provided with the privilege, service, mobility, access or recognition. Refer to the following table to set the parameters of the IP filter. Parameter Description Filter Name Name of an IP incoming filter rule Protocol Protocol type Enable Enable this rule Source Start IP Start IP address of the source host Source End IP End IP address of the source host Source Start Port Start port number of the source host Source End Port End port number of the source host Destination Start IP Start IP address of the destination host Destination End IP End IP address of the destination host Destination Start Port Start port number of the destination host Destination End Port End port number of the destination host Select New to add a new IP filter rule, select an IP filter rule to edit it, or select Remove to delete a selected IP filter rule. Step 7 Select Apply to save the configuration. ----End 3.1.4 Firewall The firewall is used to prevent the protected network from the unauthorized or unverified access from the Internet. Users of an intranet are allowed to access the Internet. To configure the firewall, refer to the following steps: Step 1 Step 2 Step 3 Step 4 Access the Web-Based Utility. Select Advanced > Security in the navigation tree. Select Firewall tab page. Select a security level of the firewall from Security Level drop-down list box. The level options are as follows: Off Issue 02 (2013-03-06) Huawei Proprietary and Confidential Copyright © Huawei Technologies Co., Ltd. 3-3 Online Help 3 Configuring Advanced Settings The firewall is disabled. Low The firewall functions as a state firewall. It prevents port scanning and IP address spoofing, but allows both ping operation and ICMP (Internet Control Message Protocol) redirect packets on the WAN side. Medium Besides preventing port scanning and IP address spoofing, the firewall prevents ICMP redirection packets. High Besides preventing port scanning, IP address spoofing, and ICMP redirection packets, the firewall prevents the SYN (Synchronous Idle) character flood attack and the ping operation on the WAN side. Select Apply to save the configuration. Step 5 ----End 3.1.5 DDoS Protection DDoS (Distributed Denial of Service) is an attempt to make a computer resource unavailable to its intended users, and usually a multitude of compromised systems attacks a single target, causing denial of service for users of the targeted system. The CPE provides protection to you from sorts of DDoS attacks through high risk hosting. To configure the DDoS protection settings, refer to the following steps: Step 1 Step 2 Step 3 Step 4 Step 5 Access the Web-Based Utility. Select Advanced > Security in the navigation tree. Select DDoS tab page. You can select to enable the following four common protections: Prevent from UDP Flood UDP flood is a type of DoS (Denial-of-Service) attack that sends IP packets containing the UDP (User Datagram Protocol) to a computer, slowing down it to the point that it can no longer handle valid connections. Prevent from ICMP Flood ICMP flood is a type of DoS attack that sends large amounts of (or just over-sized) ICMP packets to a computer, causing it to stop responding to TCP/IP requests. Prevent from LAND Attack LAND (Local Area Network Denial) attack is a type of DoS attack that consists of sending a special poison spoofed packet to a computer, causing it to lock up. Prevent from PING of Death PING of death is a type of Dos attack on a computer that involves sending a malformed or otherwise malicious ping to a computer, crashing it or flooding it with so much ping traffic that normal traffic fails to reach it. Select Apply to save the configuration. ----End Issue 02 (2013-03-06) Huawei Proprietary and Confidential Copyright © Huawei Technologies Co., Ltd. 3-4 Online Help 3 Configuring Advanced Settings 3.2 NAT NAT (Network Address Translation) is the translation of an IP address used within one network to a different IP address known within another network. NAT allows private network addresses to be managed separately from public Internet addresses and allows private networks to interact with publicly routed networks. 3.2.1 ALG An ALG (Application Layer Gateway) is a common mechanism to allow users behind firewalls or behind a NAT gateway to use applications that would otherwise not be allowed to traverse the firewall or NAT gateway. It consists of a security component that augments a firewall or NAT employed in a computer network in the context of computer networking. To configure the ALG, refer to the following steps: Step 1 Step 2 Step 3 Step 4 Step 5 Access the Web-Based Utility. Select Advanced > NAT in the navigation tree. Select ALG tab page. Refer to the following table to enable the ALG features and let the corresponding application correctly pass though the NAT gateway. Feature Description L2TP ALG The L2TP (Layer 2 Tunneling Protocol) is a tunneling protocol used to support virtual private networks in computer networking. IPSec ALG The IPsec (Internet Protocol Security) is a protocol suite for securing IP communications by authenticating and encrypting each IP packet of a communication session. H.323 ALG The H.323 defines the protocols to provide audio-visual communication sessions on any packet network. RTSP ALG The RTSP (Real Time Streaming Protocol) is a network control protocol designed for using in entertainment and communications systems to control streaming media servers. PPTP ALG The PPTP (Point-to-Point Tunneling Protocol) is a method for implementing virtual private networks. SIP ALG The SIP ALG can be a central element in the VoIP service for apartment complexes. After the SIP ALG is enabled, enter the SIP port number (default is 5060). Select Apply to save the configuration. Issue 02 (2013-03-06) Huawei Proprietary and Confidential Copyright © Huawei Technologies Co., Ltd. 3-5 Online Help 3 Configuring Advanced Settings ----End 3.2.2 DMZ A DMZ (Demilitarized Zone) is used to forward the packets from the WAN without a port mapping to the host defined in the DMZ. To configure the DMZ, refer to the following steps: Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Access the Web-Based Utility. Select Advanced > NAT in the navigation tree. Select DMZ tab page. Enter the host IP address in the Host Address field. Select or clear Enable DMZ check box to enable or disable the DMZ feature. Select Apply to save the configuration. ----End 3.2.3 Port Mapping Port mapping allows one or more public IP addresses to be shared by multiple internal users. You can customize TCP and UDP port numbers for network services and applications. To configure the port mapping, refer to the following steps: Step 1 Step 2 Step 3 Step 4 Step 5 Access the Web-Based Utility. Select Advanced > NAT in the navigation tree. Select Port Mapping tab page. Select the port mapping type. Two type options are provided: Custom User-defined port mapping. Application Port-to-application mappings configured on the CPE and allow you to add. Refer to the following table to to set the parameters of the port mapping: Parameter Description Mapping Name The name for the mapping rule Protocol The inbound port protocol type External Port External port number Internal Port Internal port number Internal Host IP address of the internal host Select New to add a new port mapping rule, select a port mapping rule to edit it, or select Remove to delete a selected port mapping rule. Issue 02 (2013-03-06) Huawei Proprietary and Confidential Copyright © Huawei Technologies Co., Ltd. 3-6 Online Help Step 6 3 Configuring Advanced Settings Select Apply to save the configuration. ----End 3.2.4 Port Triggering Port Triggering is port forwarding with an on/off switch for the ports that have been forward. This on/off switch is turned on or off by data flowing out of a trigger port. To configure the port triggering, refer to the following steps: Step 1 Step 2 Step 3 Step 4 Step 5 Access the Web-Based Utility. Select Advanced > NAT in the navigation tree. Select Port Trigger tab page. Select the port triggering type. Two type options are provided: Custom User-defined port triggering. Application Port-to-application trigger configured on the CPE and allow you to add. Refer to the following table to set the parameters of the port triggering: Parameter Description Trigger Description Description for the trigger rule Trigger Protocol The inbound port protocol type Trigger Start Port The start port number Trigger End Port The end port number Open Start Port The open start port number Open End Port The open end port number Select New to add a new port triggering rule, select a port triggering rule to edit it, or select Remove to delete a selected port triggering rule. Step 6 Select Apply to save the configuration. ----End 3.3 UPnP UPnP (Universal Plug and Play) is a set of networking protocols that allow UPnP devices on a network to detect each other and connect seamlessly automatically, and establish functional network services for data sharing, communications, and entertainment. Simply, UPnP allows automatic discovery and configuration of device attached to your LAN. NAT-PMP (NAT Port Mapping Protocol) is a set of networking protocols that introduced by Apple Computer as an alternative to the more common IGD (Internet Issue 02 (2013-03-06) Huawei Proprietary and Confidential Copyright © Huawei Technologies Co., Ltd. 3-7 Online Help 3 Configuring Advanced Settings Gateway Device) Standardized Device Control Protocol implemented in many NAT routers. To configure the UPnP, refer to the following steps: Step 1 Step 2 Step 3 Step 4 Access the Web-Based Utility. Select Advanced > UPnP in the navigation tree. Select or clear Enable UPnP or Enable NAT-PMP check box to enable or disable the corresponding feature. Enable these features only if you trust the computers on the LAN. Select Apply to save the configuration. ----End Issue 02 (2013-03-06) Huawei Proprietary and Confidential Copyright © Huawei Technologies Co., Ltd. 3-8 Online Help 4 Managing the CPE 4 Managing the CPE 4.1 Checking the Status information To check the status information about LAN, VoIP or WiMAX, refer to the following steps: Step 1 Step 2 Access the Web-Based Utility. Refer to the path in the following table to access the corresponding status information page: Item Path LAN Status > LAN VoIP Status > VoIP WiMAX Status > WiMAX ----End 4.2 Disconnecting from or reconnecting to the Network When you do not use the Internet, you can disconnect the CPE from the network manually. After you disconnect the network connection, you need to connect the CPE to the network again before accessing the Internet. The device may get heated after being used for a long time. Therefore, power off the device when you are not using it. To manually disconnect from or reconnecting to the network, refer to the following steps: Step 1 Step 2 Step 3 Access the Web-Based Utility. Select Status > WiMAX in the navigation tree. Select Disconnect from Network or Connect to Network. ----End Issue 02 (2013-03-06) Huawei Proprietary and Confidential Copyright © Huawei Technologies Co., Ltd. 4-1 Online Help 5 Maintaining the CPE 5 Maintaining the CPE 5.1 Maintaining the User Account A user account allows you to log in to the Web-Based Utility of the CPE. For security concerns, you can change the user name and the password, and you need to remember the new account. If you forget the account, you can restore factory settings of the CPE to validate the initial account or contact your ISP. To change the user account parameters, refer to the following steps: Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Access the Web-Based Utility. Select Maintenance > Account in the navigation tree to open the Account tab page. Select the user name of the account which you want to change. Enter the old password. Enter a new user name and a new password, and then confirm the new password. Select Apply to save the parameters. ----End 5.2 Detecting the CPE The local network connection and the network connection of the ISP can be tested. To detect the CPE, do as follows: Step 1 Step 2 Step 3 In the navigation tree, choose Maintenance > Diagnose. Enter the IP address to be detected. Click Start. ----End Issue 02 (2013-03-06) Huawei Proprietary and Confidential Copyright © Huawei Technologies Co., Ltd. 5-1 Online Help 6 Frequently Asked Questions (FAQ) 6 Frequently Asked Questions (FAQ) The power indicator is not on. Check the power supply, ensuring that the power supply is properly connected. Check whether the power adapter meets the specification. The WiMAX indicator is not on or the WiMAX network cannot be found. Check the power supply, ensuring that the power supply is properly connected. Check whether you have activated the WiMAX online service. Place the device in an open space without any obstacle around it, such as a cement wall or a wooden wall, which affects reception of WiMAX network signals. Place the device far away from an electrical device that produces a strong magnetic field or a strong electric field, such as a microwave oven, a fridge, or a satellite dish antenna. The device or the power adapter overheats. The device may get heated after being used for a long time. Therefore, power off the device when you do not use the device. Place the device in a well-ventilated place and avoid direct sunshine. I forget the IP address of the web management page that I have changed. Enter http://setup.com in the address bar of the Internet Explorer to obtain the IP address automatically. I cannot log in to the Web-based utility. Check the power supply, ensuring that the power supply is properly connected. Check whether the network cable between the device and the computer is properly connected. Ensure that the device is properly connected to the computer. Check whether the parameters of the Web-based utility are properly set. For details, refer to section “1.3 Accessing the Web-Based Utility”. Check the Internet Explorer parameters, ensuring that the proxy server is disabled. Take the Internet Explorer 7.0 as an example. Disable the proxy server as follows: 1. Start the Internet Explorer 7.0. 2. Choose Tools > Internet Options…, and then select the Connections tab. 3. Select LAN Settings.... 4. Diselect the Use a proxy server for your LAN check box, and then click OK. Issue 02 (2013-03-06) Huawei Proprietary and Confidential Copyright © Huawei Technologies Co., Ltd. 6-1 Online Help 7 Acronyms and Abbreviations 7 Acronyms and Abbreviations AES Advanced Encryption Standard ALG Application Layer Gateway CPE Customer-Premises Equipment CWMP CPE WAN Management Protocol DDoS Distributed Denial of Service DHCP Dynamic Host Configuration Protocol DMZ Demilitarized Zone DNS Domain Name Server/Domain Name System DoS Denial-of-Service EAP Extensible Authentication Protocol GUI Graphical User Interface HTTP Hypertext Transfer Protocol ICMP Internet Control Message Protocol IGD Internet Gateway Device IP Internet Protocol IPSec Internet Protocol Security ISP Internet Service Provider L2TP Layer 2 Tunneling Protocol LAN Local Area Network LAND Local Area Network Denial MAC Media Access Control MIMO Multiple-Input Multiple-Output NAI Network Access Identifier NAPT Network Address Port Translation NAT Network Address Translation NAT-PMP NAT Port Mapping Protocol NTP Network Time Protocol PBC Push Button Configuration Issue 02 (2013-03-06) Huawei Proprietary and Confidential Copyright © Huawei Technologies Co., Ltd. 7-1 Online Help 7 Acronyms and Abbreviations PIN Personal Identification Number PKM Privacy Key Management PPPoE Point-to-Point Protocol over Ethernet PPTP Point-to-Point Tunneling Protocol RTSP Real Time Streaming Protocol SIP Session Initiation Protocol SSID Service Set Identifier SSH Secure Shell SYN Synchronous Idle TKIP Temporary Key Integrity Protocol UDP User Datagram Protocol UPnP Universal Plug and Play URI Uniform Resource Identifier URL Universal Resource Locator VLAN Virtual Local Area Network VoIP Voice over Internet Protocol WAN Wide Area Network WEP Wired Equivalent Privacy WiMAX Worldwide Interoperability for Microwave Access WLAN Wireless Local Area Network WPA Wi-Fi Protected Access WPA-PSK Wi-Fi Protected Access-Pre-Shared Key WPS Wi-Fi Protected Setup Issue 02 (2013-03-06) Huawei Proprietary and Confidential Copyright © Huawei Technologies Co., Ltd. 7-2