D-Link DUA-2000 User manual

Policy Manager
User Manual
DUA-2000
Ver. 1.0
Business Wireless Solution
Building Networks for People

D-Link DUA-2000 Policy Manager User Manual
ii
Information in this document is subject to change without notice.
© 2016 D-Link Corporation. All rights reserved.
Reproduction in any manner whatsoever without the written permission of D-Link Corporation is strictly
forbidden.
Trademarks used in this text: D-Link and the D-Link logo are trademarks of D-Link Corporation; Microsoft and
Windows are registered trademarks of Microsoft Corporation.
Other trademarks and trade names may be used in this document to refer to either the entities claiming the
marks and names or their products. D-Link Corporation disclaims any proprietary interest in trademarks and
trade names other than its own.
FCC Warning
This equipment has been tested and found to comply with the limits for a Class A digital device, pursuant to
Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful
interference when the equipment is operated in a commercial environment. This equipment generates, uses,
and can radiate radio frequency energy and, if not installed and used in accordance with this user’s guide, may
cause harmful interference to radio communications. Operation of this equipment in a residential area is likely
to cause harmful interference in which case the user will be required to correct the interference at his own
expense.
CE Mark Warning
This is a Class A product. In a domestic environment, this product may cause radio interference in which case
the user may be required to take adequate measures.
Warnung!
Dies ist ein Produkt der Klasse A. Im Wohnbereich kann dieses Produkt Funkstoerungen verursachen. In
diesem Fall kann vom Benutzer verlangt werden, angemessene Massnahmen zu ergreifen.
Precaución!
Este es un producto de Clase A. En un entorno doméstico, puede causar interferencias de radio, en cuyo case,
puede requerirse al usuario para que adopte las medidas adecuadas.
Attention!
Ceci est un produit de classe A. Dans un environnement domestique, ce produit pourrait causer des
interférences radio, auquel cas l`utilisateur devrait prendre les mesures adéquates.
Attenzione!
Il presente prodotto appartiene alla classe A. Se utilizzato in ambiente domestico il prodotto può causare
interferenze radio, nel cui caso è possibile che l`utente debba assumere provvedimenti adeguati.
VCCI Warning
May, 2016

D-Link DUA-2000 Policy Manager User Manual
iii
Table of Contents
Table of Contents.................................................................................................................................................................iii
1. Introduction ...................................................................................................................................................................1
Audience............................................................................................................................................................................1
Other Documentation.........................................................................................................................................................1
Conventions.......................................................................................................................................................................1
Notes, Notices, and Cautions ............................................................................................................................................2
2. Product Introduction.....................................................................................................................................................3
3. Hardware Installation....................................................................................................................................................4
Step 1: Unpacking..............................................................................................................................................................4
Packing Contents..........................................................................................................................................................4
Step 2: Server Installation..................................................................................................................................................4
Rack Installation ...........................................................................................................................................................4
Step 3: Powering the Device..............................................................................................................................................4
4. Connecting to the Device.............................................................................................................................................5
Configuring the Network ....................................................................................................................................................5
Logging on to the Web User Interface...............................................................................................................................5
Changing the Default IP Address ......................................................................................................................................6
5. System Overview...........................................................................................................................................................7
6. Network Configuration Example..................................................................................................................................9
Network Requirements ......................................................................................................................................................9
Network Topology............................................................................................................................................................10
Network Configuration .....................................................................................................................................................11
Wireless Controller .....................................................................................................................................................11
Policy Manager...........................................................................................................................................................11
Network Environment .................................................................................................................................................12
7. Status & Monitor..........................................................................................................................................................13
Dashboard........................................................................................................................................................................13
Dashboard ..................................................................................................................................................................13
Network............................................................................................................................................................................14
Interface Utilization .....................................................................................................................................................14
System .............................................................................................................................................................................14
Device Status..............................................................................................................................................................14
Logs............................................................................................................................................................................15
8. Network........................................................................................................................................................................17
Device..............................................................................................................................................................................17
IP Interface..................................................................................................................................................................17
IP Interface...............................................................................................................................................................17
Port Trunking Advance Setting ................................................................................................................................19
RADIUS Client............................................................................................................................................................20
Add RADIUS Server Client ......................................................................................................................................21
Identity Domain................................................................................................................................................................22
Identity Domain...........................................................................................................................................................22
Add Identity / Domain...............................................................................................................................................23
External Server ................................................................................................................................................................24
LDAP...........................................................................................................................................................................24
AD...............................................................................................................................................................................25
POP3 ..........................................................................................................................................................................27

D-Link DUA-2000 Policy Manager User Manual
iv
RADIUS ......................................................................................................................................................................28
9. Policy & Object............................................................................................................................................................31
Policy Rule.......................................................................................................................................................................31
Rule.............................................................................................................................................................................31
Add Policy Rule........................................................................................................................................................32
Client................................................................................................................................................................................34
User Database............................................................................................................................................................34
Group .......................................................................................................................................................................34
Account ....................................................................................................................................................................36
Device Database ........................................................................................................................................................38
Property Group.........................................................................................................................................................38
Device ......................................................................................................................................................................39
Endpoint...........................................................................................................................................................................42
Location Profile...........................................................................................................................................................42
Location Profile ........................................................................................................................................................42
Endpoint List ............................................................................................................................................................43
Endpoint to Location Profile.....................................................................................................................................46
Authorization....................................................................................................................................................................47
Authorization Profile....................................................................................................................................................47
Authorization Profile.................................................................................................................................................47
ACL Profile...............................................................................................................................................................49
ACL Rule..................................................................................................................................................................51
Schedule..........................................................................................................................................................................54
Schedule Profile..........................................................................................................................................................54
Add Schedule Profile................................................................................................................................................55
10. Maintenance.................................................................................................................................................................57
Administration ..................................................................................................................................................................57
System Information.....................................................................................................................................................57
Change Password ......................................................................................................................................................58
System Account..........................................................................................................................................................58
Date and Time ............................................................................................................................................................60
Session.......................................................................................................................................................................62
Management....................................................................................................................................................................63
SNMP..........................................................................................................................................................................63
SNMP v3 User .........................................................................................................................................................63
SNMP Traps.............................................................................................................................................................65
SNMP Host List........................................................................................................................................................66
Access Control List ..................................................................................................................................................68
SNMP Community....................................................................................................................................................69
Telnet / SSH................................................................................................................................................................71
Web Server Configuration ..........................................................................................................................................73
DDP ............................................................................................................................................................................74
System .............................................................................................................................................................................75
Firmware Upgrade......................................................................................................................................................75
Firmware Info ...........................................................................................................................................................75
Firmware Upgrade ...................................................................................................................................................76
Backup / Restore System...........................................................................................................................................78

D-Link DUA-2000 Policy Manager User Manual
v
Backup System ........................................................................................................................................................78
Restore System........................................................................................................................................................79
Reboot ........................................................................................................................................................................80
HA...............................................................................................................................................................................80
Logs .................................................................................................................................................................................82
Syslog Server .............................................................................................................................................................82
System Logs...............................................................................................................................................................83
Alert.............................................................................................................................................................................84
Email Alert................................................................................................................................................................84
Alert Type.................................................................................................................................................................86
Utilities..............................................................................................................................................................................87
Logo Setting................................................................................................................................................................87
Ping.............................................................................................................................................................................88
11. Appendix A - Technical Specifications.....................................................................................................................89
Capacity...........................................................................................................................................................................89
Hardware Specification....................................................................................................................................................89
Processor and System Memory..................................................................................................................................89
I/O Interface................................................................................................................................................................89
Physical & Environment...................................................................................................................................................89
12. Appendix B – Rack Mount Instructions....................................................................................................................90

D-Link DUA-2000 Policy Manager User Manual
1
1. Introduction
The manual is organized by the menu layout on the Policy Manager.
Audience
This reference manual is intended for network administrators and other IT networking
professionals responsible for managing the Policy Manager using the Web User Interface
(Web UI). Alternative management interfaces, such as the Command Line Interface (CLI)
are also available but not documented in this manual. This manual is written in a way that
assumes that you already have the experience and knowledge of modern networking
principles.
Other Documentation
The documents below are a further source of information in regards to configuring and
troubleshooting the DUA-2000. All the documents are available either from the CD, bundled
with the Policy Manager, or from the D-Link website. Other documents related to the device
are:
•Quick Installation Guide
Conventions
Convention Description
Boldface Font Indicates a button, a toolbar icon, menu, or menu item. For
example: Open the File menu and choose Cancel. Used for
emphasis. May also indicate system messages or prompts
appearing on screen. For example: You have mail. Bold font
is also used to represent filenames, program names and
commands. For example: use the copy command.
Initial capital letter Indicates a window name. Names of keys on the keyboard
have initial capitals. For example: Click Enter.
Menu Name > Menu
Option Indicates the menu structure. Device > Port > Port Properties means the Port Properties menu option under
the Port menu option that is located under the Device menu.
Blue Courier Font This convention is used to represent an example of a screen
console display including example entries of CLI command
input with the corresponding output.

D-Link DUA-2000 Policy Manager User Manual
2
Notes, Notices, and Cautions
Below are examples of the three types of indicators used in this manual. When administering
the Policy Manager using the information in this document, you should pay special attention
to these indicators. Each example below provides an explanatory remark regarding each
type of indicator.
NOTE: A note indicates important information that helps you make better use of
your device.
NOTICE: A notice indicates either potential damage to hardware or loss of data
and tells you how to avoid the problem.
CAUTION: A caution indicates a potential for property damage, personal injury,
or death.

D-Link DUA-2000 Policy Manager User Manual
3
2. Product Introduction
The trend of Bring Your Own Device (BYOD) is a new challenge for network administrators
and managers. Many companies that allow employees to use their own devices expect to
see improvements in performance and productivity, however BYOD brings its own
challenges to do with network security and control of sensitive information.
The D-Link DUA-2000 Policy Sever is the first secure access control server in D-Link’s
product portfolio. It is a fully-featured Policy Manager capable of assigning permissions
based on who you are, where you are, when you connect, the type of device and the device
ownership. Policy enforcement is implemented through the network layer, removing the
need for client software and ensuring compatibility with a wide range of devices.
The DUA-2000 provides multiple authentication options and can integrate with your existing
network. It has a high level of integration with existing D-Link products, such as Unified APs,
Wireless Switch/Controllers, and Layer 2 and 3 switches, providing a seamless user
experience. The DUA-2000 meets the requirement for enterprise BYOD management.

D-Link DUA-2000 Policy Manager User Manual
4
3. Hardware Installation
This chapter provides unpacking and installation information for the DUA-2000 Policy
Manager.
Step 1: Unpacking
Open the shipping carton and carefully unpack its contents. Please consult the list below to
make sure all items are present and undamaged. If any item is missing or damaged, please
contact your local D-Link reseller.
Packing Contents
•1 x DUA-2000 Policy Manager
•1 x Master CD
•1 x Quick Installation Guide
•1 x DB9-to-RS232 Console Cable
•1 x Power cord
•1 x Device Mounting Bracket Kit
•1 x CAT5e Ethernet cable (1.2m straight-through)
Step 2: Server Installation
For safe server installation and operation, it is recommended that you:
•Visually inspect the power cord to see that it is secured fully to the AC power
connector.
•Make sure that there is proper heat dissipation and adequate ventilation around the
server.
•Do not place heavy objects on the server.
Rack Installation
The Policy Manager can be mounted in an EIA standard size 19-inch rack, which can be
placed in a server room with other equipment. To install, attach the mounting brackets to the
Policy Manager’s side panels (one on each side) and secure them with the screws provided.
Then, use the screws provided with the server rack to mount the Policy Manager in the rack.
NOTICE: Please refer to Appendix B – Rack Mount Instructions for safety
instructions on rack mounting the Policy Manager.
Step 3: Powering the Device
Once the Policy Manager has been racked, it is then possible to power the device. Connect
the AC power cord to the rear of the Policy Manager and to an electrical outlet.
NOTICE: It is recommended that the Policy Manager be connected to an
Uninterruptible Power Supply (UPS) to prevent data loss and damage to
hardware in the event of an unexpected power outage.

D-Link DUA-2000 Policy Manager User Manual
5
Connecting to the Device
There are several methods of connecting to the Policy Manager, including the Web User
Interface (Web UI), SNMP and command-line access (Telnet / SSH / Console). Here we will
document the most common method of access, the Web User Interface. When it is possible
to manage the device, further configuration can be done to the Wireless Controller to
support features such as captive portal. This is detailed later on in the document as a
configuration example.
Configuring the Network
The Policy Manager only needs to be reachable from the Wireless Controller to support
authentication, authorization and accounting. This can either be in the same management
subnet, or another subnet altogether. Connect to the Policy Manager using its default IP
address and change this to be in line with your own network policies.
NOTE: The default IP address is 10.90.90.90, with a subnet mask of 255.0.0.0.
Logging on to the Web User Interface
To access the Web UI, open a web browser on a management PC and enter the Policy
Manager’s IP address.
NOTE: Please make sure that the device is reachable via ICMP Ping before
continuing with the instructions.
NOTE: The default login details are a username of ‘admin’ and a password of
‘admin’.
You will see the device’s dashboard when you have successfully connected to the Policy
Manager.

D-Link DUA-2000 Policy Manager User Manual
6
Figure 4-1 – Device Dashboard
Changing the Default IP Address
The default IP address of the Policy Manager will need to be changed to match your network
topology. It is recommended that this is completed before the device is connected to the
production network.
1. Navigate to: Network > Device > IP Interface
2. Click Edit next to the System interface
3. Change the address type from DHCP to Static
4. Enter an IP Address, Mask, Gateway and DNS server
5. Press Apply.
Ensure that you can connect to the Policy Manager using the new IP address.

D-Link DUA-2000 Policy Manager User Manual
7
4. System Overview
The Policy Manager works by authenticating clients and devices using either a username
and password combination or a MAC address. Depending on the policy type, users will
either be authenticated using their username and password (if they are a configured user on
the system), be authenticated as a guest or be authenticated as a device.
The process begins with an unauthenticated client or device supplying a username and
password or a MAC address to the Wireless Controller. This is, in turn, supplied to the Policy
Manager, which will attempt to authenticate the client using various sources and policies. If it
is not possible to authenticate the client, then the client will be denied access to the network.
The Policy Rule on the Policy Manager is the configuration entity which binds all of the
configuration elements, such as the User Group, Device Type, Location Profile and
Schedule Profile, together. It is linked with the Authentication Database, which can
authenticate against LDAP, Active Directory, POP3, RADIUS and the Policy Manager’s
internal SQL database. Once authentication is complete, then the Authorization Profile is
returned to the Wireless Controller, providing Layer 2 and Layer 3 network settings and
session timeout information to be applied to the client or device.
If a device MAC address is supplied to the Policy Manager as the username, the Policy
Device User Type is applied to the account and the device is authenticated using the Policy
Rule.
If a username and password is supplied to the Policy Manager, then either the Policy User
or Policy Guest User Types are applied to the account, depending on whether the user has
been configured as a guest. If it has, then the user is authenticated using the Policy Rule.
If a username has been supplied as a Policy User, then there are several more steps
required to authenticate the user and the device they are logging-in from.
The Group MAC Binding feature specifies whether any devices have been associated with
the user account. If they have, then the Property Group Usage field is used, if they have not,
then the user is authenticated using the Policy Rule.
If the device Usage is set to Single User or Multiple users then the Binding Device List on
the Account is consulted to verify that the user is logging-in from an approved device. If the
device Usage is set to Public Users, then the user is authenticated using the Policy Rule.
Once it has been verified that the configured user has supplied the correct username and
password and that they’re logging-in from a permitted device, they are authenticated using
the Policy Rule.
Users or devices can be authenticated using either a web page, which allows them to supply
a username and password, or via software running on the directly attached switch, which
authenticates the device using the MAC address as the username.
Look at the diagram in Figure 5-1 for a logical system overview.

D-Link DUA-2000 Policy Manager User Manual
8
Figure 5-1 – Logical System Overview

D-Link DUA-2000 Policy Manager User Manual
9
5. Network Configuration Example
The D-Link DUA-2000 Policy Manager is a highly integrated solution which requires access
to multiple services, such as Wireless Controllers, Unified Access Points (APs) and Layer 2
and 3 switches. This high level of integration requires careful planning and knowledge of
multiple products and technologies to implement. An example of how to configure the
network topology for use with the DUA-2000 is shown below.
NOTE: This configuration applies to the network only and information for
configuring the Policy Manager follows later in the document. It is designed to
illustrate what is required to support a Wireless Controller with external
authentication and captive portal.
Network Requirements
In this example, the following elements are required:
Convention Description
DHCP Server This is a Dynamic Host Configuration Protocol (DHCP) server for
dynamically assigning IP addresses to wireless clients. In the
example below, a router is used for this function.
PoE Switch This is a Layer 2 device that supplies Power over Ethernet (PoE) to
the Wireless APs and performs switching and VLAN tagging
functions.
Wireless AP This advertises the two Service Set Identifiers (SSIDs) for the
wireless Employee (corporate) and Personal (BYOD) networks.
Wireless Controller This controls access to wireless networks and manages wireless
clients and APs. Clients can be authenticated against a number of
sources, including the Policy Manager.
Policy Manager This is responsible for serving the captive portal and providing a
RADIUS source to the Wireless Controller. It itself can be pointed
to a number of authentication sources, including RADIUS, AD
(LDAP), POP3 and RADIUS.
Table 6-1 – Network Requirements
The following are optional but useful for testing:
Convention Description
Wireless device
(laptop, tablet or
smartphone)
This is used to join the wireless networks and test captive portal
and network functionality.
Internet access This can be used to test Internet access for authenticated clients.
TFTP Server This is used for testing the policy that has been applied to client
devices.
HTTP Server This is used for testing the policy that has been applied to client
devices.
Table 6-2 – Optional Requirements

D-Link DUA-2000 Policy Manager User Manual
10
Network Topology
This is an example of how the network can be configured to support wireless client access
control using a captive portal and an external RADIUS server.
The network topology is as follows:
Figure 6-1 – Example Network Topology
The VLANs configured and DHCP address ranges configured on the DHCP server are as
follows:
VLAN
Number Description Address Range Default Gateway Release Time
VLAN 1 Guest VLAN 192.168.10.110 - 150 192.168.10.1 30 Seconds
VLAN 20 Employee
VLAN 192.168.20.110 - 150 192.168.20.1 Default
VLAN 30 Personal VLAN 192.168.30.110 - 150 192.168.30.1 Default
Table 6-3 – VLANs and DHCP Ranges
The addresses assigned to devices are as follows:
VLAN
Number Device Address Netmask Default Gateway
VLAN 1 DHCP Server 192.168.10.1 255.255.255.0 192.168.10.1
VLAN 1 PoE Switch 192.168.10.2 255.255.255.0 192.168.10.1
VLAN 1 Wireless
Controller 192.168.10.3 255.255.255.0 192.168.10.1
VLAN 1 Policy Manager 192.168.10.4 255.255.255.0 192.168.10.1
Table 6-4 – Device IP Addresses
The TFTP and HTTP servers in the diagram above are used for testing purposes only.

D-Link DUA-2000 Policy Manager User Manual
11
Network Configuration
Use the following steps to configure the Wireless Controller and network devices for use with
the Policy Manager captive portal.
Wireless Controller
These steps can be used to configure the Wireless Controller for use with the captive portal.
The model used in these instructions is the DWS-4026:
1. Give the Wireless Controller an IP address, netmask and default gateway
Navigate to LAN >> Administration >> IP Address.
Set up IP address/ Mask/ Default Gateway.
2. Enable Captive Portal in the Global Configuration
Navigate to LAN >> Security >> Captive Portal >> Global Configuration.
Select Enable Captive Portal then press Submit button.
3. Enable Captive Portal in the Captive Portal Configuration.
Navigate to LAN >> Security >> Captive Portal >> CP Configuration.
Press default entry to edit CP configuration.
Enter Configuration name and Verification mode choose Policy Manager.
Choose RADIUS Auth Server then press submit button.
4. Configure a RADIUS Authentication Server.
Navigate to LAN >> Security >> RADIUS >> RADIUS Authentication Server
Configuration.
Select Add item then enter RADIUS Server Host Address, then chose “Yes” for
Policy Manager.
Enter RADIUS Server Name then select Apply then enter Secret then press submit
button.
5. Discover access points to the use with the Policy Manager.
Navigate to WLAN >> Administration >> Basic Setup >> Discovery.
Enter IP Address Range then press Add button to add IP List into L3/ IP Discovery.
6. Create an Access Point Profile.
Navigate to WLAN >> Administration >> Advanced Configuration >> AP Profiles.
Press default profile then enter profile name.
Select dlink1 SSID and press edit button then enter SSID name and enable Client
QoS.
Policy Manager
Use default settings and authenticate against the local user database or an external
authentication source.

D-Link DUA-2000 Policy Manager User Manual
12
Network Environment
A Dynamic Host Configuration Protocol (DHCP) server and multiple VLANs are required for
Captive Portal. A guest VLAN for unauthenticated guests is required, along with an
employee VLAN for authenticated corporate clients and a personal VLAN for authenticated
personal clients.
The DHCP server needs to offer an IP address in the range configured for each VLAN and
so the switch port connecting the DHCP server to the local switch needs to be set up for
VLAN tagging. The Wireless APs also need to advertise more than one SSID, one for each
VLAN. The DHCP release time should be set to 30 seconds for the guest VLAN.

D-Link DUA-2000 Policy Manager User Manual
13
6. Status & Monitor
Dashboard
Dashboard
This provides a system overview of the CPU status, RAM status, network status, hard drive
status, association status and number of active users. It is the default page that is displayed
when logging-in to the Policy Manager.
To get to the following page, browse to: Status & Monitor >> Dashboard >> Dashboard:
Figure 7-1 – Dashboard
The following fields are available:
Field Description
CPU Status (%) The CPU utilization, measured in percent (%).
RAM Status (%) Memory utilization, measured in percent (%).
System Network
Status (kbit/s) Combined network utilization of all 4 interfaces, measured in kilobits
per second (kbit/s).
Hard Drive Status
(%) Disk space utilization, measured in percent (%).
Table 7-1 – Dashboard

D-Link DUA-2000 Policy Manager User Manual
14
Network
Interface Utilization
The displays the network interface utilization of the 4 ports on the Policy Manager. The ports
are listed from Port 1 to 4 and refresh automatically.
To get to the following page, browse to: Status & Monitor >> Network >> Interface
Utilization:
Figure 7-2 – Interface Utilization
System
Device Status
This provides a device overview for the system and includes the system name, time, location,
contact information, software and hardware versions and MAC and IP address information.
To get to the following page, browse to: Status & Monitor >> System >> Device Status:

D-Link DUA-2000 Policy Manager User Manual
15
Figure 7-3 – Device Status
The following fields are available:
Field Description
System Name The hostname of the Policy Manager.
System Time The system date and time, in the format: HH:MM:SS MM/DD/YYYY.
System Location The location of the Policy Manager.
System Contact The contact information for the Policy Manager.
Firmware Version The system firmware version.
Hardware Version The system hardware version.
MAC Adddress The system MAC address of the active LAN interface(s).
IPv4 Address The IP address of the active LAN interface(s).
Netmask The netmask of the active LAN interface(s).
Gateway
The default gateway address of the active LAN interface(s).
Serial Number
The serial number of the device.
HDD
The serial number of the hard disk driver used by the Policy Manager.
Table 7-2 – Device Status
Logs
This page is for displaying the logs on the Policy Manager.
To get to the following page, browse to: Status & Monitor >> System >> Logs: