This chapter shows you how to use the Zyxel Device’s various features.

In this section, we show you how to:

The Zyxel Device has different Operation Modes (OP modes) to act as different roles in a network. You can choose different OP modes for each radios. Not all OP modes are supported by all models. To choose the OP mode, go to Configuration > Wireless > AP Management.

The Zyxel Device supports the following OP modes:

This example uses the following parameters to set up a WiFi network.

To wirelessly extend a WiFi network (WDS), you need two Zyxel Devices, one in Repeater mode and one in Root AP mode. You should already have the root AP set up.

If your Zyxel Device supports wireless bridging, you can extend a wired network from the port on the WiFi repeater, do the following steps:

To set up a WDS in APC-managed Zyxel Devices, see the ZyWALL ATP, USG FLEX, or NCC User’s Guide.

The following example shows you how to create two WiFi networks (Zyxel_General and Zyxel_Guest) using the following settings for both Radio 1 (2.4 GHz) and Radio 2 (5 GHz). You should have already created two security profiles, Security_Profile1 and Security_Profile2, on the Configuration > Object > AP Profile > SSID > Security List screen. See Creating a Security Profile for a tutorial on creating security profiles.

For the Guest WiFi, enable Enable Intra-BSS Traffic blocking to prohibit Guest WiFi clients from directly connecting to each other. To separate the Guest WiFi network from the General internal WiFi network, create two VLANs, VLAN 10 and VLAN 20, on your firewall (F), such as ZyWALL. Set the General WiFi network to be in VLAN 10, where your internal network is. Set the Guest WiFi network to be in VLAN 20. This way, Guest WiFi clients will not be able to access the wired LAN network of the firewall (F) in VLAN 10 while still able to access the Internet.

Restricting network bandwidth for each WiFi client ensures that all clients have equitable access to the network, preventing a few WiFi clients from monopolizing the bandwidth.

In this section, we show you how to:

Changing the security settings on a WiFi network enhances protection by blocking unauthorized client devices. This option is ideal for small WiFi networks with a few WiFi clients. For WiFi networks with a lot of clients, see RADIUS Server Setup for more information.

Setting up a RADIUS server on your Zyxel Device allows centralized user authentication and authorization, which enhances network security. This option is ideal for enterprise users who need to manage many WiFi clients.

This example shows you how to configure the rogue AP detection feature on the Zyxel Device. A rogue AP is a WiFi access point operating in a network’s coverage area that is not a sanctioned part of that network. See Rogue AP for background information on the rogue AP function and security considerations.

In this example, you want to ensure that your company’s data is not accessible to an attacker gaining entry to your WiFi network through a rogue AP.

Your WiFi network operates in an office building. It consists of four Zyxel access points (all NWAs) and a variable number of WiFi clients. You also know that the coffee shop on the ground floor has a WiFi network consisting of a single access point (AP 1), which can be detected and accessed from your floor of the building. There are no other static WiFi networks in your coverage area.

The following diagram shows the WiFi networks in your area. Your access points are marked A, B, C and D. You also have a computer, marked E, connected to the wired network. The coffee shop’s access point is marked 1.

In the figure, the solid circle represents the range of your WiFi network, and the dashed circle represents the extent of the coffee shop’s WiFi network. Note that the two networks overlap. This means that one or more of your APs can detect the AP 1 in the other WiFi network.

When configuring the rogue AP feature on your Zyxel Device in this example, you will need to use the information in the following table. You need the IP addresses of your APs to access their Web configurators, and you need the MAC address of each AP to configure the friendly AP list.

To find rogue APs, create a list of known friendly APs, then scan for all APs in your coverage area. Check if other APs are known and if not add them to the Rogue AP list.

Take the following steps to set up and save a list of access points you want to allow in your network’s coverage area.

Access point A is now configured to do the following.

Now you need to configure the other WiFi access points in your network to do the same things.

For each access point, take the following steps.

 

A MAC filter list blocks or allows a list of clients based on their MAC addresses, ensuring only authorized clients can access the network. This example shows how to block certain clients based on their MAC addresses.

This example shows you how to allow certain users to access only specific parts of your network. You can do this by using multiple MAC filters and layer-2 isolation profiles.

In this example, you run a company network in which certain employees must wirelessly access secure file servers containing valuable proprietary data.

You have two secure servers (1 and 2 in the following figure). WiFi user “Alice” (A) needs to access server 1 (but should not access server 2) and WiFi user “Bob” (B) needs to access server 2 (but should not access server 1). Your Zyxel Device is marked ZD. C is a workstation on your wired network, D is your main network switch, and E is the security gateway you use to connect to the Internet.

In this example, you have already set up the Zyxel Device in AP Mode (see WiFi Network Setup). It uses two SSID profiles simultaneously. You have configured each SSID profile as shown in the following table.

Each SSID profile already uses a different pre-shared key.

In this example, you will configure access limitations for each SSID profile. To do this, you will take the following steps.

To configure layer-2 isolation, you need to know the MAC addresses of the devices on your network, which are as follows.

To configure MAC filtering, you need to know the MAC addresses of the devices Alice and Bob use to connect to the network, which are as follows.

First, you will set up the SERVER_1 network which allows Alice to access secure server 1 through the network switch.

You will configure the MAC filter to restrict access to Alice alone, and then configure layer-2 isolation to allow her to access only the network router, the file server and the Internet security gateway.

Take the following steps to configure the SERVER_1 network.

You have restricted access to the SERVER_1 network to only the networking device whose MAC address you entered. The SERVER_1 network is now configured.

Next, you will configure the SERVER_2 network that allows Bob to access secure server 2 and the Internet.

To do this, repeat the procedure in Configure the SERVER_1 Network, substituting the following information.

Use the following sections to ensure that your WiFi networks are set up correctly.

Take the following steps to check that the Zyxel Device is using the correct SSIDs, MAC filters and layer-2 isolation profiles.

Before you allow employees to use the network, you need to thoroughly test whether the setup behaves as it should. Take the following steps to do this.

If you cannot do something that you should be able to do, check the settings as described in Check Settings, and in the individual Security, layer-2 isolation and MAC filter profiles for the relevant network. If this does not help, see the Troubleshooting chapter in this User’s Guide.

In this section, we show you how to:

Change the management IP address of the Zyxel Device to ensure it does not duplicate the IP address of any other device on the network. If IP addresses are duplicated, you may be unable to access the Zyxel Device.

Changing the system name ensures that the Zyxel Device's name is not duplicated with other devices on the network, which may otherwise cause confusion for network administrators.

Change the Web Configuration login password to help secure your account.

In this section, we show you how to:

Upload the firmware to the Zyxel Device for feature enhancements.

The section shows you how to restore the configuration. You need to download and upload the configuration file to restore the configuration on the Zyxel Device.

You should regularly download your configuration especially before you make major configuration changes.

This section shows how to upload a previously saved configuration file from your computer to the Zyxel Device. You might need to do this to recover settings after a reset or to fix problems after configuration changes.

In this section, we show you how to:

In this example, you will configure the first of your Zyxel Device to send a log message to your email inbox.

Backing up logs to a remote server allows you to store large amounts of log data and prevent log data lost on your Zyxel Device. The Zyxel Device can keep at most 512 logs. If the logs exceed this number, the oldest logs will be lost.

This section shows you how to configure WAN access for a specific trusted computer through HTTPS, HTTP or SSH to the Zyxel Device. Remote management determines which interface and web services are allowed to access the Zyxel Device.

Perform the following to find the options to configure remote access to your Zyxel Device.

Go to the Configuration > System > SSH screen. Select whether you want to access the Zyxel Device remotely through SSH. Click Apply to save your changes. You may change the server port number for a service if needed, however you must use the same port number in order to use that service for remote management.