3e Technologies International AirGuard 3e-525C-3 User manual

AirGuard™ Wireless Access Point
User's Guide
Model 3e-525C–3
3e Technologies International
700 King Farm Blvd., Suite 600
Rockville, MD 20850
[phone] www.3eti.com
29000171-001 A publ. 12/12/05
�

This page intentionally left blank.

3e Technologies International's
AirGuard™ Wireless Access Point
User's Guide
Model 3e-525C–3

29000171-001 A iii
Copyright © 2005 3e Technologies International, Inc. All rights reserved. No part of this
documentation may be reproduced in any form or by any means or to make any derivative work
(such as translation, transformation, or adaptation) without written permission from 3e Technologies
International.
3e Technologies International reserves the right to revise this documentation and to make changes in
content from time to time without obligation on the part of 3e Technologies International to provide
notication of such revision or change.
3e Technologies International provides this documentation without warranty, term or condition
of any kind, either implied or expressed, including, but not limited to, the implied warranties,
terms, or conditions of merchantability, satisfactory quality, and tness for a particular purpose.
3e Technologies International may make improvements or changes in the product(s) and/or the
program(s) described in this documentation at any time. Certain features listed may have restricted
availability and/or are subject to change without notice - please conrm material features when
placing orders.
If there is any software or removable media described in this documentation, it is furnished under a
license agreement included with the product as a separate document, in the printed documentation,
or on the removable media in a readable le such as license.txt or the like. If you are unable to locate a
copy of the license, contact 3e Technologies International and a copy will be provided to you.
___________________________________
UNITED STATES GOVERNMENT LEGEND
If you are a United States Government agency, then this documentation and the product described
herein are provided to you subject to the following:
All technical data and computer software are commercial in nature and developed solely at private
expense. Software is delivered as “Commercial Computer Software” as dened in DFARS 252.227-
7014 (June 1995) or as a “commercial item” as dened in FAR 2.101(a) and as such is provided with
only such rights as are provided in 3e Technologies International’s standard commercial license for
the software. Technical data is provided with limited rights only as provided in DFAR 252.227-7015
(Nov 1995) or FAR 52.227-14 (June 1987), whichever is applicable. You agree not to remove or deface
any portion of any legend provided on any licensed program or documentation contained in, or
delivered to you in conjunction with, this User Guide.
___________________________________
3e Technologies International and the 3e Technologies International logo are registered trademarks.
AirGuard™ is a trademark of 3e Technologies International, Inc.
Windows is a registered trademark of Microsoft Corporation. Any other company and product name
mentioned herein is a trademark of the respective company with which they are associated.
___________________________________
EXPORT RESTRICTIONS
This product contains components, software, and/or rmware exported from the United States in
accordance with U. S. export administration regulations. Diversion contrary to U.S. law is prohibited.

29000171-001 A iii
Table of Contents
Chapter 1: Introduction...................................................................................................1
Basic Features .............................................................................................................2
Wireless Basics............................................................................................................2
802.11b.......................................................................................................................3
802.11g.......................................................................................................................3
802.11a .......................................................................................................................3
802.11b/g Mixed......................................................................................................3
802.11g Super and 802.11a Turbo ..........................................................................4
Network Conguration ..........................................................................................4
Access Point Congurations..................................................................................4
Possible AP Topologies.........................................................................................5
Bridging ....................................................................................................................6
Default Conguration.............................................................................................6
Data Encryption and Security................................................................................6
SSID ...........................................................................................................................6
WEP ...........................................................................................................................6
WPA/WPA2 with TKIP/ AES-CCMP..................................................................7
802.11i........................................................................................................................7
Wireless VLAN ........................................................................................................8
MAC Address Filtering ........................................................................................10
DHCP Server..........................................................................................................10
Operator Authentication and Management ......................................................10
Management.............................................................................................................11
3e–525C–3 Navigation Options .............................................................................12
Chapter 2: Hardware installation................................................................................13
Preparation for Use..................................................................................................13
Installation Instructions ..........................................................................................14
Minimum System and Component Requirements ............................................14
Cabling ......................................................................................................................15
Bridge Transmit Distance........................................................................................16
Bridge Antenna Location........................................................................................16
Outdoor Protection Kit Installation.......................................................................17
Earth Ground Connection....................................................................................18
Lighnting Arrestor Installation............................................................................18
Antenna Installation................................................................................................20
Sealing Antenna Connections..............................................................................20
Mounting Kit Setup .................................................................................................21
The Indicator Lights ................................................................................................21
Reset Button..............................................................................................................22
Chapter 3: Access Point Conguration ......................................................................23
Introduction ..............................................................................................................23
Preliminary Conguration Steps...........................................................................23
Initial Setup using the “LAN” Port.......................................................................24
System Conguration..............................................................................................26
General....................................................................................................................26
Operating Mode.....................................................................................................27
WAN........................................................................................................................28
LAN .........................................................................................................................29
Wireless Access Point Conguration ....................................................................30
General....................................................................................................................30
Security ...................................................................................................................33

iv 29000171-001 A
29000171-001 A v
No Encryption ....................................................................................................33
Static WEP Encryption .......................................................................................34
IEEE 802.11i and WPA ........................................................................................35
Wireless VLAN ......................................................................................................37
MAC Address Filtering ........................................................................................38
Rogue AP Detection ..............................................................................................39
Advanced................................................................................................................40
Wireless Bridge.........................................................................................................40
Services Settings.......................................................................................................41
SNMP Agent...........................................................................................................41
Admin User Management ......................................................................................43
List All Users..........................................................................................................43
Add New User .......................................................................................................44
Monitoring/Reports................................................................................................45
System Status .........................................................................................................45
Bridging Status.......................................................................................................46
Bridge Site Map .....................................................................................................47
Wireless Clients......................................................................................................48
Adjacent AP List ....................................................................................................48
DHCP Client List...................................................................................................49
Logs............................................................................................................................49
System Log .............................................................................................................49
Web Access Log .....................................................................................................50
System Administration ...........................................................................................51
System Upgrade ....................................................................................................51
Firmware Upgrade..............................................................................................51
Local Conguration Upgrade ...........................................................................52
Remote Conguration Upgrade .......................................................................53
Factory Default ......................................................................................................55
Remote Logging.....................................................................................................56
Reboot .....................................................................................................................56
Utilities....................................................................................................................57
Chapter 4: Gateway Conguration .............................................................................59
Introduction ..............................................................................................................59
Conguring in Gateway Mode..............................................................................61
WAN........................................................................................................................62
Main IP Setting ....................................................................................................62
IP Aliasing ............................................................................................................63
LAN .........................................................................................................................64
Security ...................................................................................................................65
Firewall......................................................................................................................65
Content Filtering....................................................................................................65
IP Filtering ..............................................................................................................66
Port Filtering ..........................................................................................................66
Virtual Server .........................................................................................................67
Demilitarized Zone (DMZ) ..................................................................................68
Advanced Firewall ................................................................................................69
Chapter 5: Wireless Bridge Conguration ................................................................71
Introduction ..............................................................................................................71
Wireless Bridge — General ..................................................................................72
Auto-forming Wireless Bridging ......................................................................72
Manual Bridging .................................................................................................74
Monitoring ...........................................................................................................75
Wireless Bridge — Radio......................................................................................75

iv 29000171-001 A
29000171-001 A v
Wireless Bridge — Encryption.............................................................................78
Wireless Bridge — MAC Address FIltering.......................................................79
Setting Up Bridging Type .......................................................................................80
Point-to-Point Bridge Conguration ..................................................................80
Point-to-Point Bridging Setup Guide - Manual Mode...................................81
Point-to-Point Bridging Setup Guide - Auto Mode .......................................81
Point-to-Multipoint Bridge Conguration ........................................................85
Point-to-Multipoint Bridging Setup Guide - Manual Mode.........................86
Point-to-Multipoint Bridging Setup Guide - Auto Mode..............................86
Repeater Bridge Conguration ...........................................................................87
Repeater Bridging Setup Guide - Manual Mode............................................87
Repeater Bridging Setup Guide - Auto Mode.................................................88
Chapter 6: Technical Support.......................................................................................89
Manufacturer’s Statement ......................................................................................89
Radio Frequency Interference Requirements.......................................................89
Glossary ........................................................................................................................G-a

vi 29000171-001 A

3e–525C–3 Wireless Access Point Chapter 1: Introduction
29000171-001 A 1
Chapter 1: Introduction
This manual covers the installation and operation of the 3e Technolo-
gies International’s 3e–525C–3 Wireless Access Point. The 3e–525C–3 is
a ruggedized access point/gateway/bridge which is intended for use
in industrial and external environments. It accommodates 802.11a/b/g,
802.11g Super, and 802.11a Turbo WLAN access and uses Power over
Ethernet (PoE) access to the Ethernet WAN to eliminate the need for
internal access point power supply units (AC-DC converters) and 110-
220V cabling installations. The wireless LANs can include mobile devices
such as handheld Personal Data Assistants (PDAs), mobile web pads, and
wireless laptops.
If encryption is desired for the WLAN, you can employ different
encryption depending on the mode you are in. You can select None, Static
WEP, WPA, or WPA2. WPA uses TKIP or AES-CCMP so you can employ
legacy client WEP cards and still secure the wireless band.
The 3e–525C–3 incorporates Power over Ethernet. The PoE interface
on the 3e–525C–3 is compatible with commercial vendor “injected power”
hub units.
The 3e–525C–3 includes cryptographic modules for wireless encryp-
tion and HTTPS/TLS, for secure web communication. In addition, it
contains the capability to use the traditional WEP algorithm, either as
static WEP or managed under WPA. The 3e–525C–3 has an Ethernet
WAN interface for communication to the wired LAN backbone, Ethernet
LAN local port for purposes of initial setup and conguration, and two
wireless AP antennas for communicating on the 802.11a/b/g frequen-
cies. Further, it has the capability for use of an external (remote) antenna,
for bridging, using the 802.11b/g Mixed, 802.11a, 802.11g Super, 802.11a
Turbo frequencies.

3e–525C–3 Wireless Access Point Chapter 1: Introduction
2 29000171-001 A
3e–525C–3 Wireless Access Point Chapter 1: Introduction
29000171-001 A 3
Basic Features
The 3e–525C–3 is housed in a sturdy case which is not meant to be
opened except by an authorized technician for maintenance or repair.
If you wish to reset to factory settings, use the reset function available
through the GUI-based management module.
The 3e–525C–3 is wall-mountable.
It has the following features:
• Ethernet uplink WAN port
• Local Ethernet LAN port (for conguration only)
• Wireless VLAN
• Wireless AP with operating range of 2000+ feet
• Wireless Bridge
• Power over Ethernet (PoE)
• Above average temperature range for extreme environments
(with TEC option)
• WEP encryption or WPA/WPA2/AES-CCM with TKIP
• HTTPS/TLS secure Web
• DHCP client
• Adjustable Radio Power
• MAC address ltering
• Load Balancing
• Rogue AP Detection
The following security modules have been implemented in the 3e–
525C–3 .
• WEP
• WPA/WPA2
• AES–CCM
Wireless Basics
Wireless networking uses electromagnetic radio frequency waves to
transmit and receive data. Communication occurs by establishing radio
links between the wireless access point and devices congured to be part
of the WLAN.

3e–525C–3 Wireless Access Point Chapter 1: Introduction
2 29000171-001 A
3e–525C–3 Wireless Access Point Chapter 1: Introduction
29000171-001 A 3
802.11b
The IEEE 802.11b standard ratied by IEEE, establishes a stable stan-
dard for compatibility. A user with an 802.11b product can use any brand
of access point with any other brand of client hardware that is built to
the 802.11b standard for basic interconnection. 802.11b devices provide
11 Mbps transmission (with a fallback to 5.5, 2 and 1 Mbps depending on
signal strength) in the 2.4 GHz band.
For wireless devices to communicate with the 3e–525C–3 , they must
meet the following conditions:
• The wireless device and wireless access point must have
been congured to recognize each other using the SSID (a
unique ID assigned in setup so that the wireless device is
seen to be part of the network by the 3e–525C–3 );
• Encryption and authentication capabilities and types en-
abled must conform; and
• If MAC ltering is used, the 3e–525C–3 must be congured
to allow/disallow the wireless device’s MAC address to
associate (communicate) with the 3e–525C–3 wireless inter-
face.
802.11g
Because 802.11g is backwards-compatible with 802.11b, it is a popular
component in LAN construction. 802.11g broadens 802.11b’s data rates
to 54 Mbps within the 2.4 GHz band using OFDM (orthogonal frequency
division multiplexing) technology.
802.11a
The IEEE 802.11a standard is an extension to 802.11 that applies to
wireless LANs and provides up to 54 Mbps in the 5GHz band. 802.11a
uses an orthogonal frequency division multiplexing encoding scheme
rather than FHSS or DSSS.
802.11b/g Mixed
802.11b/g combines 802.11b and 802.11g data rates to offer a broader
range.

3e–525C–3 Wireless Access Point Chapter 1: Introduction
4 29000171-001 A
3e–525C–3 Wireless Access Point Chapter 1: Introduction
29000171-001 A 5
802.11g Super and 802.11a Turbo
802.11g Super and 802.11a Turbo technologies provide speed and
throughput of more than double standard wireless LAN technologies in
networking products such as PCs, access points, routers and PC cards.
It is very helpful to users who require additional bandwidth (over stan-
dard WLAN technologies) that results in higher throughput necessary
for a variety of functions such as: streaming media (video, DVD, MPEG),
VoIP, etc., or for providing multiple users on a single WLAN with optimal
speeds despite network demand.
108 Mbps is the maximum link speed available and the typical MAXI-
MUM end-user throughput ranges from approximately 40 Mbps to 60+
Mbps, depending on application demand and network environment.
NOTE: Super G’s channel bonding feature can signicantly degrade
the performance of neighboring 2.4GHz WLANs that don’t use Super G,
because there isn’t enough room in the 2.4GHz wireless LAN spectrum
for the increased spectrum used by channel bonding. Moreover, Super
G doesn’t check to see if 11b or 11g standards-compliant devices are in
range before using its non-standard techniques.
Network Conguration
The 3e–525C–3 is an access point with bridging setup capability:
• Access point/Gateway plus:
• Wireless bridging with choice of:
- Point-to-point setup
- Point-to-multipoint setup
- Repeater setup
• Wireless mesh mode
Bridging actually has more choices, but the above choices are popular
and are discussed later in this user guide (Chapter 4).
Access Point Congurations
When a 3e–525C–3 is used as an access point, IP addresses for wireless
devices are typically assigned by the wired network’s DHCP server. The
wired LAN’s DHCP server assigns addresses dynamically, and the AP
virtually connects wireless users to the host wired network. All wireless
devices connected to the AP are congured on the same subnetwork as
the wired network interface and can be accessed by devices on the wired
network.

3e–525C–3 Wireless Access Point Chapter 1: Introduction
4 29000171-001 A
3e–525C–3 Wireless Access Point Chapter 1: Introduction
29000171-001 A 5
Possible AP Topologies
1. An access point can be used as a stand-alone AP without any
connection to a wired network. In this conguration, it simply
provides a stand-alone wireless network for a group of wireless
devices.

2. There can be multiple APs connected to an existing Ethernet
network to bridge between the wired and wireless environments.
Each AP can operate independently of the other APs on the LAN.
Multiple APs can coexist as separate individual networks at the
same site with a different network ID (SSID).

 
   
3. The last and most prevalent use is multiple APs connected to a
wired network and operating off that network’s DHCP server to
provide a wider coverage area for wireless devices, enabling the
devices to “roam” freely about the entire site. The APs have to use
the same SSID. This is the topology of choice today.
 


3e–525C–3 Wireless Access Point Chapter 1: Introduction
6 29000171-001 A
3e–525C–3 Wireless Access Point Chapter 1: Introduction
29000171-001 A 7
Bridging
The wireless bridging function in the 3e–525C–3 allows use as a
bridge, in a number of alternate congurations, including the following
popular congurations:
• Point-to-point bridging of 2 Ethernet Links;
• Point-to-multipoint bridging of several Ethernet links;
• Repeater mode (wireless client to wireless bridge.)
Default Conguration
The 3e–525C–3's default conguration is an Access Point/Bridge.
Data Encryption and Security
The 3e–525C–3 Wireless Access Point includes advanced wireless se-
curity features. Over the AP band, you have a choice of no security, Static
WEP, WPA, or AES-CCMP, depending on your mode of operation. Some
level of security is suggested. Static WEP gives you a choice of 64-bit or
128-bit encryption. WPA includes the option of using a WPA pre-shared
key or, for the enterprise that has a Radius Server installed, congura-
tion to use the Radius Server for key management with either TKIP or
AES-CCMP. Bridging encryption is established between 3e–525C–3’s and
includes use of AES-CCMP encryption.
SSID
The Service Set ID (SSID) is a string used to dene a common roam-
ing domain among multiple wireless access points. Different SSIDs on
access points can enable overlapping wireless networks. The SSID can
act as a basic password without which the client cannot connect to the
network. However, this is easily overridden by allowing the wireless AP
to broadcast the SSID, which means any client can associate with the AP.
SSID broadcasting can be disabled in the 3e–525C–3 setup menus.
WEP
WEP is an older encryption standard but is preferable to no encryp-
tion. If the 3e–525C–3 is congured with WEP encryption, it is compatible
with any 802.11b PC Card congured for WEP.

3e–525C–3 Wireless Access Point Chapter 1: Introduction
6 29000171-001 A
3e–525C–3 Wireless Access Point Chapter 1: Introduction
29000171-001 A 7
WPA/WPA2 with TKIP/ AES-CCMP
WPA, an interim standard developed by the WiFi Alliance, combines
several technologies. It includes the use of the 802.1x standard and the
Extensible Authentication Protocol (EAP). In addition, it uses, for encryp-
tion, the Temporal Key Integrity Protocol (TKIP) and WEP 128-bit encryp-
tion keys. Finally, a message integrity check (MIC) is used to prevent an
attacker from capturing and altering or forging data packets. In addition,
it can employ a form of AES called AES-CCMP.
WPA is a subset of the 802.11i standard and is expected to maintain
forward compatibility.
802.11i
Four major categories or primary functions of 802.11i are invoked
within 3eTI products, including the wireless client devices, wireless ac-
cess points, and the security server. These primary functions of 802.11i
include:
• EAP-TLS: Extensible Authentication Protocol Transport
Layer Security, EAP-TLS was compulsory for WPA2 Enter-
prise products certied prior to April 15, 2005; for products
certied after this date, EAP-TLS testing is compulsory if
the product can support EAP-TLS. The only products that
might not support EAP-TLS are tightly integrated systems
that do not support software upgrades by a third party, such
as some cell phones intended for, e.g., the 3G market. Non-
tightly integrated products like most laptop and PDU adapt-
ers still must support EAP-TLS to receive WPA2 certica-
tion. 3eTI wireless client and wireless access point devices
use standards-based EAP-TLS with no modications, for
complete interoperability with 802.11i and WPA2 certied
equipment.
• IEEE 802.1X: also known as port based network access con-
trol, 802.1X provides and authentication framework within
802.11i. 802.11i depends upon 802.1X to control the ow of
MSDUs between the DS and STAs by use of the IEEE 802.1X
Controlled/Uncontrolled Port model. IEEE 802.1X authen-
tication frames are transmitted in 802.11 Data frames and
passed via the IEEE 802.1X Uncontrolled Port. The 802.1X
Controlled Port is blocked from passing general data trafc
between two STAs until an 802.1X authentication procedure
completes successfully over the 802.1X Uncontrolled Port. It
is the responsibility of the authenticator (3eTI Access Point)
to implement port blocking. 802.11 depends upon IEEE
802.1X and the EAPOL-Key 4-Way and Group Key Hand-
shakes, to establish and change cryptographic keys. Keys
are established after authentication has completed. Keys
may change for a variety of reasons, including expiration
of an IEEE 802.1X authentication timer, key compromise,

3e–525C–3 Wireless Access Point Chapter 1: Introduction
8 29000171-001 A
3e–525C–3 Wireless Access Point Chapter 1: Introduction
29000171-001 A 9
danger of compromise, or policy. 3eTI products implement
standards-based 802.1X with absolutely no custom modi-
cations, again ensuring interoperability with 802.11i and
WPA2 certied equipment.
• 4-way handshake: The 4-way handshake dened in 802.11i
achieves the following important goals within the security
protocol:
– it conrms the PMK between the supplicant (3e client) and
authenticator (3e Access Point)
– it establishes the temporal keys to be used by the data-con-
dentiality protocol
– it authenticates the security parameters that were negotiated
– it provides keying material to implement the group key
handshake within 802.11i
3eTI implements the 4-way handshake within its wire-
less product line per the 802.11i specication, again with
absolutely no custom modications, in order to maximize
interoperability with 3rd party 802.11i and WPA2 compliant
equipment.
• AES CCMP: 802.11i and WPA2 employ AES CCM, which is a com-
bination of AES Counter (CTR) mode per packet data encryption,
combined with AES Cipher Block Chaining – Message Authentica-
tion Code (CBC-MAC) per packet data integrity / authentication
of the entire packet including the MAC header. AES CCMP has
been deemed to surpass the RC4 stream cipher, upon which the
older WEP and WPA security protocols are based. 3eTI was the
rst company to take it’s AES algorithm through the NIST CCM
algorithm certication process, thereby ensuring that 3eTI’s AES
CCMP is standards-based, non-proprietary, and ready for wide
WPA2 interoperability usage.
Wireless VLAN
According to the IEEE, VLANs dene broadcast domains in a Layer
2 network. VLANs have the same attributes as physical LANs with the
additional capability to group end stations physically to the same LAN
segment regardless of the end stations' geographical location
To interconnect two different VLANs, routers or Layer 3 switches are
used. These routers or Layer 3 switches execute inter-VLAN routing or
routing of trafc between VLANs. Broadcast trafc is then terminated
and isolated by these Layer 3 devices (for example, a router or Layer 3
switch will not route broadcast trafc from one VLAN to another).
Wireless VLAN is an extension of Layer 2 wired VLANs in wireless
LAN (WLAN) environment. As with wired VLANs, wireless VLANs
segregate the WLAN network into disjointed sections, each of which
can serve a different purpose or users, such as engineering, accounting
or guest. To get the same network conguration, with VLAN incapable

3e–525C–3 Wireless Access Point Chapter 1: Introduction
8 29000171-001 A
3e–525C–3 Wireless Access Point Chapter 1: Introduction
29000171-001 A 9
APs, a set of APs need to be installed for each network section; but with a
VLAN capable AP, like the 3e–525C–3, one AP can serve multiple sec-
tions with trafc segregated inside the AP, so that only one set of APs is
needed.
When wireless VLAN is enabled, an AP can be congured to have
multiple SSIDs, so that it supports multiple wireless networks. Each net-
work, per conguration, belongs to a VLAN. A wireless client talks with
the AP inside a wireless network dened by an SSID, so it does not know
the wireless VLAN exists. The mapping between the wireless network
and the wireless VLAN happens inside the AP. Each Wireless VLAN
can set its own security level. For example, the VLAN for an enterprise
network access may use 802.11i with EAP-TLS authentication, while the
VLAN for guest internet access may simply use 802.11i with Pre-Shared
Key.
3e–525C–3 supports up to 16 VLANs.
When VLAN is enabled, all data coming out of the WAN port is
VLAN-tagged, which means an external network unit such as a router,
switch, or a VLAN-enabled computer has to be used to terminate the
VLAN trafc. Data originating from or targeting to a wireless network
client is tagged with the VLAN ID corresponding to the SSID to which it
is associated. Data generated by an Access Point itself is tagged with the
management VLAN ID.

3e–525C–3 Wireless Access Point Chapter 1: Introduction
10 29000171-001 A
3e–525C–3 Wireless Access Point Chapter 1: Introduction
29000171-001 A 11
MAC Address Filtering
The MAC address, short for Media Access Control address, is a hard-
ware address that uniquely identies each node of a network. In IEEE 802
networks, the Data Link Control (DLC) layer of the OSI Reference Model
is divided into two sub-layers: the Logical Link Control (LLC) layer and the
Media Access Control (MAC) layer. The MAC layer interfaces directly with
the network media. Consequently, each type of network media requires a
unique MAC address.
Authentication is the process of proving a client identity. The 3e–
525C–3 access points, if set up to use MAC address ltering, detect an
attempt to connect by a client and compare the client’s MAC address
to those on a predened MAC address lter list. Only client addresses
found on the list are allowed to associate. MAC addresses are pre-as-
signed by the manufacturer for each wireless card.
DHCP Server
The DHCP function is accessible only from the local LAN port to be
used for initial conguration.
Operator Authentication and Management
Authentication mechanisms are used to authenticate an operator ac-
cessing the device and to verify that the operator is authorized to assume
the requested role and perform services within that role. The 3e–525C–3
provides authentication services for all users of the wireless network
when they rst attempt to connect. While the user must log in, basic non-
user generated information is allowed to pass on the wireless network
prior to authentication, including the authentication data to and from
the authentication server and audit records passed from the client to the
server. The user is not allowed to specically send any trafc over the net-
work until successful authentication. Once successfully authenticated, all
actions taken by that user (such as accessing a connected printer) and by
processes created or started by that user, will be associated with that user,
binding the credentials from the user account to all subsequent user pro-
cesses. This ensures that all processes and network trafc are authorized.
User accounts are dened with three basic attributes: username, role
and authentication credentials (i.e. password). A user account can be
dened as a normal user or as an administrator. Administrative users can
access the TOE management interface in addition to being able to use the
wireless network, while normal users can only access the wireless net-
work.
The TOE authentication sequence includes a counter for unsuccessful
attempts. When a user or administrator fails to enter the correct creden-
tials after a specied number of attempts (the default is 3), the account
will be locked. The account must then be unlocked by a Crypto Ofcer in
the case of an administrator locking their account). This is active for ac-
cess to the management website.

3e–525C–3 Wireless Access Point Chapter 1: Introduction
10 29000171-001 A
3e–525C–3 Wireless Access Point Chapter 1: Introduction
29000171-001 A 11
Access to the management screens for the 3e–525C–3 requires knowl-
edge of the assigned operator ID and Password. The Factory defaults are:
• ID: crypto
• Password: ofcer
The Crypto Ofcer initially installs and congures the 3e–525C–3 after
which the password should be changed from the default password. The
ID and Password are case sensitive.
Management
After initial setup, maintenance of the system and programming of
security functions are performed by personnel trained in the procedure
using the embedded web-based management screens.
The next chapter covers the basic procedure for setting up the hard-
ware.

3e–525C–3 Wireless Access Point Chapter 1: Introduction
12 29000171-001 A
3e–525C–3 Navigation Options
ACCESS POINT GATEWAY
System Conguration System Conguration
General General
Operating Mode Operating Mode
WAN WAN
LAN LAN
Wireless Access Point Wireless Access Point
General General
Security
• None
• Static WEP
• 802.11i and WPA
Security
• None
• Static WEP
• 802.11i and WPA
Wireless VLAN Wireless VLAN
MAC Address Filtering MAC Address Filtering
Rogue AP Detection Rogue AP Detection
Advanced Advanced
Wireless Bridge Wireless Bridge
General
• Monitoring
General
• Monitoring
Radio Radio
Encryption
• AES-CCM
Encryption
• AES-CCM
MAC Address Filtering
(Auto Bridge mode only)
MAC Address Filtering
(Auto Bridge mode only)
Services Settings Services Settings
SNMP Agent SNMP Agent
Firewall Firewall
Content Filtering
IP Filtering
Port Filtering
Virtual Server
DMZ
Advanced
Admin User Management Admin User Management
List All Users
• Edit/Delete
List All Users
• Edit/Delete
Add New User Add New User
Monitoring Reports Monitoring Reports
System Status System Status
Bridging Status Bridging Status
Bridging Site Map Bridging Site Map
Wireless Clients Wireless Clients
Adjacent AP List Adjacent AP List
DHCP Client List DHCP Client List
Logs Logs
System Log System Log
Web Access Log Web Access Log
System Administration System Admnistration
System Upgrade
• Firmware Upgrade
• Local Conguration Upgrade
• Remote Conguration Upgrade
System Upgrade
• Firmware Upgrade
• Local Conguration Upgrade
• Remote Conguration Upgrade
Factory Default Factory Default
Remot Logging Remote Logging
Reboot Reboot
Utilities Utilities