D-Link DSA-3600 User manual

Thursday
DSA-3600
User Guide
Version DSA-3600-1.0 April, 2007

Copyright © 2007 D-Link Corporation
All rights reserved. Printed in Taiwan. April 2007. D-Link Corporation reserves the right to change, modify, and revise
this publication without notice.
Trademarks
Copyright 2007 D-Link Corporation. All rights reserved. D-Link, the D-Link logo, and DSA-3600 are trademarks of
D-Link Corporation. All other brand and product names are registered trademarks or trademarks of their respective
holders.
Statement of Conditions
In the interest of improving internal design, operational function, and/or reliability, D-Link Corporation reserves the right
to make any changes to products described in this document without notice. D-Link Corporation shall be indemnified
against any liability that may occur due to the use or application of the product(s) described herein.

i
Table of Contents
Chapter 1. Before You Start....................................................................................................................1
1.1 Audience .............................................................................................................................................. 1
1.2 Document Conventions ........................................................................................................................ 1
Chapter 2. Overview................................................................................................................................2
2.1 Introduction of DSA-3600 ..................................................................................................................... 2
2.2 System Concept ................................................................................................................................... 2
Chapter 3. Hardware Installation............................................................................................................4
3.1 Panel Function Descriptions................................................................................................................. 4
3.2 Package Contents ................................................................................................................................ 5
3.3 System Requirement ............................................................................................................................ 5
3.4 Installation Steps .................................................................................................................................. 6
Chapter 4. Web Interface Configuration................................................................................................7
4.1 System ............................................................................................................................................... 10
4.1.1 General...................................................................................................................................................11
4.1.2 WAN1 .....................................................................................................................................................13
4.1.3 WAN2 .....................................................................................................................................................16
4.1.4 WAN Traffic.............................................................................................................................................18
4.1.5 LAN Port Mapping ..................................................................................................................................20
4.1.6 Service Zones.........................................................................................................................................26
4.2 Users .................................................................................................................................................. 47
4.2.1 Authentication.........................................................................................................................................48
4.2.2 Black List ................................................................................................................................................49
4.2.3 Policy ......................................................................................................................................................50
4.2.4 Additional Control ...................................................................................................................................56
4.3 Access Points ..................................................................................................................................... 58
4.3.1 List ..........................................................................................................................................................59
4.3.2 Discovery................................................................................................................................................60
4.3.3 Adding ....................................................................................................................................................62
4.3.4 Templates ...............................................................................................................................................63
4.3.5 Firmware.................................................................................................................................................65
4.3.6 Upgrade..................................................................................................................................................66
4.4 Network .............................................................................................................................................. 67
4.4.1 NAT.........................................................................................................................................................68

ii
4.4.2 Privilege..................................................................................................................................................70
4.4.3 Monitor IP ...............................................................................................................................................72
4.4.4 Walled Garden........................................................................................................................................74
4.4.5 Proxy Server...........................................................................................................................................75
4.4.6 DDNS......................................................................................................................................................76
4.4.7 Client Mobility .........................................................................................................................................76
4.4.8 VPN ........................................................................................................................................................77
4.5 Status ................................................................................................................................................. 80
4.5.1 System....................................................................................................................................................81
4.5.2 Interface..................................................................................................................................................83
4.5.3 Online Users...........................................................................................................................................84
4.5.4 User Logs ...............................................................................................................................................85
4.5.5 E-mail & SYSLOG ..................................................................................................................................87
4.6 Tools ................................................................................................................................................... 88
4.6.1 Setup Wizard ..........................................................................................................................................89
4.6.2 Change Password ..................................................................................................................................95
4.6.3 Backup/Restore ......................................................................................................................................96
4.6.4 System Upgrade.....................................................................................................................................97
4.6.5 Restart ....................................................................................................................................................98
4.6.6 Wake-On-LAN ........................................................................................................................................98
4.6.7 Quick Links .............................................................................................................................................99
4.7 Help103
Appendix A. External Network Access .............................................................................................104
Appendix B. Console Interface Configuration .................................................................................106
Appendix C. Proxy Configuration......................................................................................................109
Appendix D. Certificate Settings for IE6 and IE7 ............................................................................. 116
Appendix E. Service Zones – Deployment Examples .....................................................................123
Appendix F. Deploying DSA-3600 Using DWL-2100AP...................................................................127
Appendix G. Network Configuration on PC......................................................................................130
Appendix H. IPSec VPN......................................................................................................................135
Appendix I. DHCP Relay ...................................................................................................................140

Chapter1.BeforeYouStart
1
Chapter 1. Before You Start
1.1 Audience
This manual is intended for use by system integrators, field engineers and network administrators to help them set
up DSA-3600 Multi-Service Business Gateway in their network environments. It contains step by step procedures
and pictures to guide users with basic network system knowledge to complete the installation.
1.2 Document Conventions
The following information provides the details of conventions used in this manual.
For cautionary statements or warning requiring special attention by readers, a text box with italic font will be used:
Warning: For security purposes, you should immediately change the administrator’s password.
When any of the button symbol shown below is selected, the following action will be executed accordingly:
Apply all settings configured
Clear all settings configured prior to applying
Please Note: Screen captures and pictures used in this manual may be displayed in part or in whole, and may vary
or differ slightly from the actual product, depending on versioning and menu accessed.

Chapter2.Overview
2
Chapter 2. Overview
2.1 Introduction of DSA-3600
DSA-3600 is a Multi-Service Business Gateway specially designed for small and medium business, and branch
office operational environments. The major functional areas include user management, access control, AP
management, security management, and VLAN. The major features of DSA-3600 can be grouped into four
functional blocks:
A. User Access Control
B. Network Security (examples: Firewall, VLAN and VPN)
C. Web-based administration and centralized AP management
D. General networking features
2.2 System Concept
Small and Midsize Business (SMB) Network Environment
Networking devices such as switches, hubs, and access points are usually included in SMB environments. The
Internet connection of a SMB is usually via ADSL or cable modem. Figure-2.2a shows a typical network deployment
example which includes switches, access points, and connections to the Internet via ADSL/cable modem.
The DSA-3600 provides user authentication, authorization and management. The user account information is stored
in the local database or specified external databases server. User authentication is processed via the SSL encrypted
web interface. This interface is compatible to most desktop devices and palm computers. The appended figures are
typical examples of DSA-3600 deployed in a SMB environment. Figure-2.2b shows DSA-3600 authenticating the
users of its built-in database, as well as the users of external authentication database. Both LAN and WLAN can be
secured by IPSec VPN. PPTP VPN is supported for remote users to increase security at remote sites. The
DSA-3600 also supports Site-to-site VPN, WAN Failover, and DMZ.
The DSA-3600 can be used to control access to the company’s intranet. In a managed network that includes cable
and wireless network users, users located at the managed network can be set to be unable to access the network
resource without permission. In the event access right to the network beyond the managed area is required, an
Internet browser, such as the Internet Explorer, may be opened to connect to any website. When the browser
attempts to connect to a website, the DSA-3600 will force the browser to redirect to the user login webpage. The
user must then enter the username and password, where upon successful identification and authentication, the user
will then be granted proper access right as defined in the DSA-3600.

Chapter2.Overview
3
Figure-2.2a: An example deployment using DSA-3600
Figure-2.2b: An example of SMB environment using DSA-3600

Chapter3.HardwareInstallation
4
Chapter 3. Hardware Installation
3.1 Panel Function Descriptions
The DSA-3600 is implemented on an embedded platform with mini-desktop form factor. On the front panel of the
product, there are eight LEDs that are used to indicate the system power, system status, and the link status of the
six fast Ethernet ports. The interface ports are installed on the rear panel. Six fast Ethernet (100Mbps) ports are
provided by DSA-3600. Two are configured as WAN Ports, and the other four are configured as LAN Ports. Located
on the rear panel are a serial console port, a reset button, and the power socket.
Front Panel
1. Power 3. LEDs: WAN1~WAN2 5. Sign: Link
2. Status 4. LEDs: LAN1~LAN4 6. Sign: Act
1. Power
ON indicates that power is on and OFF indicates that power is off.
2. Status
While system power is on, status OFF indicates BIOS is running, BLINKING indicates the OS is running,
and ON indicates system is ready.
3. WAN1~WAN2 LEDs
OFF indicates no connection, ON indicates connection and BLINKING indicates transmitting data.
4. LAN1~LAN4 LEDs
OFF indicates no connection, ON indicates connection and BLINKING indicates transmitting data.
5. Link Sign
Sign to indicate the LED of WAN1~WAN2 and LAN1~LAN4 in the status of connection.
6. Act Sign
Sign to indicate the LED of WAN1~WAN2 and LAN1~LAN4 in the status of transmitting data.
1 2 3
4 5 6

Chapter3.HardwareInstallation
5
Rear Panel
1 Power Socket:
The power adapter is attached here.
2 Reset Button:
Press and hold the Reset button about five seconds, status LED on front panel starts to blink before
restarting the DSA-3600.
Press and hold the Reset button for more than ten seconds, status LED on the front panel starts to speed up
blinking before resetting the DSA-3600 to default configuration.
3 WAN1~WAN2:
The two WAN ports connected to an external network not managed by the DSA-3600. These ports may be
used to connect to the ATU-Router of an ADSL, or the port of a Cable Modem, or a Switch or Hub on the
LAN of an organization.
4 LAN1~LAN4:
The four LAN ports connect to networks managed by DSA-3600, such as to clients’ networking devices or
APs. There are two modes for service zone supported by DSA-3600, Port-Based and Tag-Based. By default,
all LAN ports are in Tag-based service zone. Under Tag-Based mode, service zones will be distinguished by
VLAN tagging instead of physical LAN ports.
5 Console:
The serial RS-232 DB9 cable attaches here.
3.2 Package Contents
The standard package of the DSA-3600 includes:
yDSA-3600 x 1
yQuick Installation Guide x 1
yCD-ROM x 1
yConsole Cable x 1
yStraight-through Ethernet Cable x 1
yPower Cord x 1
yPower Adapter x 1
3.3 System Requirement
yStandard 10/100BaseT including network cables with RJ-45 connectors
yAll PCs need to install the TCP/IP network protocol

Chapter3.HardwareInstallation
6
3.4 Installation Steps
Please follow the steps mentioned below to install the hardware of DSA-3600:
1. Connect the power adapter to the power socket on the rear panel. The Power LED on the front panel should be
ON to indicate a proper connection.
Warning: Using a non-certified power adapter may damage this product.
2. Connect an Ethernet cable to the WAN1 Port on the rear panel. Connect the other end of the Ethernet cable to
a networking device such as an ADSL modem, a cable modem, a switch, or a hub. The LED of WAN1 port
should light up to indicate a proper connection.
3. Connect an Ethernet cable to any LAN Port on the rear panel. Connect the other end of the cable to a
networking device such as the administrator’s PC. The LED of the LAN should be ON to indicate a proper
connection.
After the hardware of the DSA-3600 is installed completely, the system is ready to be configured in the following
sections. This manual will guide you step by step to set up the system using a single DSA-3600 to manage the
network.

Chapter4.WebInterfaceConfiguration
7
Chapter 4. Web Interface Configuration
This chapter provides further detailed information on setting up the DSA-3600. The following table shows all the
functions of DSA-3600.
In the web management interface, there are three main interface areas: Tools Menu, Main Menu Tree and
Working Area. The Working Area occupies the largest area of the web interface on the center right. It is also
referred as the current management page. The current management page is where status is displayed, controlled
are issued or parameters are configured. Main Menu Tree, on the left side of the web management interface, allows
administrators to traverse to various management functions of this system. The management functions are grouped
into five branches: System (System Settings), Users (User Management), Access Points (AP Management),
Network (Network Settings) and Status (Status and Report).
OPTION FUNCTION
General
WAN 1
WAN 2
WAN Traffic
LAN Port Mapping
System
Service Zones
Authentication
Black List
Policy
Users
Additional Control
List
Discovery
Adding
Temp lat e s
Firmware
Access Points
Upgrade
NAT
Privilege
Monitor IP
Walled Garden
Proxy Server
DDNS
Network
Client Mobility

Chapter4.WebInterfaceConfiguration
8
VPN
System
Interface
Online Users
User Logs
Status
E-mail & SYSLOG
Setup Wizard
Password Change
Backup & Restore
System Upgrade
Restart
Wake-On-LAN
Tools
Quick Links
Caution: After finishing the configuration, please click Apply and pay attention to see if a restart message appears
on the screen. If the message appears, the system must be restarted to allow the settings to take effect. All on-line
users will be disconnected during restart.
Web Management Interface
The DSA-3600 provides a web management interface for configuration. After completing the hardware installation,
the administrator can configure the DSA-3600 via web browsers with JavaScript enabled such as Internet Explorer
version 6.0.
After the basic installation has been completed according to the instructions of the previous chapter, the DSA-3600
can further be configured with the following steps:
1. First, set a PC as DHCP in the network with TCP/IP setting to get an IP address from the DHCP server
automatically. Next, connect the PC to the DSA-3600 via any LAN port. An IP address will be assigned to the PC
automatically via the DSA-3600 built-in DHCP server. Launch a web browser to access the web management
interface of DSA-3600 by entering “https://192.168.1.1” in the URL. (Note: https is used for a secured
connection.)

Chapter4.WebInterfaceConfiguration
9
Once the DSA-3600 has been connected, the Administrator Login Page will appear. Enter “admin” for both the
default username and password in the Username and Password fields. Select the Enter button to log in.
Caution: If you are unable to get to the login screen, please check the IP address used. The IPaddress should
be in the same subnet of the default gateway. set a static IP address such as 192.168.1.x in your network
and then open a new browser again.
1. After successfully logging into the DSA-3600, the System Overview page of the web management interface will
appear. To logout, simply click the Logout icon on the upper right corner of the interface to return to the
Administrator Login Page.

Chapter4.WebInterfaceConfiguration
10
4.1 System
This section provides information on the following functions: General, WAN1, WAN2, WAN Traffic, LAN Port
Mapping and Service Zones.

Chapter4.WebInterfaceConfiguration
11
4.1.1 General
The system and network related parameters such as System Name, Homepage Redirect URL, Management IP
Address List, and HTTPS Protected Login can be configured from the menu as shown below.
ySystem Name: Set the name of the system or use the default.
yInternet Domain Name: A fully qualified domain name (FQDN) of the system. When the administrator enters a
desired domain name in the Internal Domain Name field, the entered Internal Domain Name will be shown in the
top left of the Login Success page instead of an LAN IP address. In addition, when HTTPS is enabled, entering
the domain name of the uploaded certificate will increase login speed and the URL in the User Login page will
be changed. For example, if the Internal Domain Name is configured as ashop.com, the URL in the User Login
page will be https://ashop.com/loginpages/login.shtml.
yHomepage Redirect URL: Enter a URL in this field. When the clients are logged-in to the DSA-3600
successfully, their browsers will be directed to this URL regardless of the original homepage setting in their
browsers.
yUser Log Access IP Address: An external billing system may access the system's user logs by specifying a
desired IP address of the external billing system in this field. Only the billing system with this IP address may
directly access the system's user logs in text format via browsers. For example, if the access interface of
DSA-3600 is “10.30.1.23”, the user log can be found in following URLs.
User Log is located in the URL：https://10.30.1.23/status/history/2006-11-01
Guests User Log is located in the URL：https://10.30.1.23/status/odhistory/2006-11-01

Chapter4.WebInterfaceConfiguration
12
yManagement IP Address List: Set the IP addresses within a range which the administrator can use to connect
to the web management interface of DSA-3600 via its WAN and/or LAN ports. For example, if 10.2.3.0/24 is set
in this list, it means as long as the administration PCs are within the IP address range of 10.2.3.0/24, the
administrator can reach the administration page of DSA-3600. If the bit number of the IP range is omitted, 32 are
used to specify a single IP address.
PLEASE NOTE: While the default IP address of Network Interface is changed at System→Service
Zones→Basic Settings→DHCP Server→Enable DHCP Server, the management IP address has to be setup
again from default IP address to the new IP as the format, x.x.x.x/x.
ySNMP: The DSA-3600 supports SNMPv2. If the function is enabled, the Manager IP address and the SNMP
community name have to be configured to allow the SNMP server to access the management information base
(MIB) of DSA-3600.
yHTTPS Protected Login: Enable this function to activate https (encryption) or disable this function to activate
http (non encryption) user login page.
yTime: The DSA-3600 supports NTP communication protocol to synchronize the system time with remote time
servers. At least one NTP server has to be configured with the correct time zone, together with the IP address of
the NTP server in order to enable the DSA-3600 to automatically adjust its system time with the configured NTP
server. Up to five NTP servers may be configured in the system. The system time can also be manually
configured when selecting Manually set up. Please enter the date and time into the respective fields.

Chapter4.WebInterfaceConfiguration
13
4.1.2 WAN1
There are four methods of obtaining IP address for the WAN1 Port: Static, Dynamic, PPPoE, and PPTP.
yStatic (Use the following IP Settings): Select Static to specify a static IP address for WAN1 port manually
when a static IP address is available for DSA-3600. Fields with red asterisks are required to be filled in.
IP Address: The IP address of the WAN1 port.
Subnet Mask: The subnet mask of the WAN1 port.
Default Gateway: The gateway of the WAN1 port.
Preferred DNS Server: The primary DNS Server of the WAN1 port
Alternate DNS Server: The substitute DNS Server of the WAN1 port. This is optional.
yDynamic (IP settings assigned automatically): This connection type is only applicable when the DSA-3600 is
connected to a network with the presence of a DHCP Server. Select the option when a DHCP server is available
in the network implementation above the WAN1 port of the system. When Dynamic is selected, the system
works as a DHCP client and get an IP address for its WAN1 port automatically from the DHCP server.

Chapter4.WebInterfaceConfiguration
14
yPPPoE: This is the common connection type for ADSL. To properly configure PPPoE connection type, the
Username, Password, MTU and Clamp MSS fields are required. The Dial on Demand function is used to
guard the idle time out of the connection. The Maximum Idle Time field is required to enable this function.
When the idle time is reached, the connection will be automatically disconnected.
Select the option when PPPoE is the connection protocol provided by the network service providers. When Dial
on Demand is enabled, there is a Maximum Idle Time available. The system will disconnect itself from the
Internet automatically when the Maximum Idle Time is reached.

Chapter4.WebInterfaceConfiguration
15
yPPTP: Point to Point Tunneling Protocol is a service that applies to broadband connection used mainly in
Europe and Israel. Select Static to specify the IP address of the PPTP Client manually or select DHCP to get the
IP address automatically. The fields with red asterisks are required to be filled in. There is a Dial on Demand
function under PPTP. If this function is enabled, a Maximum Idle Time can be set. When the idle time is
reached, the system will automatically disconnect itself.
Select the option when PPTP (Point to Point Tunneling Protocol) is the connection protocol provided by the
network service providers. When Dial on Demand is enabled, there is a Maximum Idle Time available. The
system will disconnect itself from the Internet automatically when the Maximum Idle Time is reached.

Chapter4.WebInterfaceConfiguration
16
4.1.3 WAN2
The WAN2 can be disabled when selecting None. When WAN2 Port is enabled, it supports 3 connection types:
Static, Dynamic and PPPoE.
yNone: The WAN2 Port is disabled.
yStatic (Use the following IP Settings): Specify the IP Address, Subnet Mask, Default Gateway, Preferred
DSN Server and Alternate DSN Server of WAN2 Port, which should be applicable for the network environment.
Select the option to specify a static IP address for WAN2 interface manually when a static IP address is available
for the system.
yDynamic (IP settings assigned automatically): Select the option when a DHCP server is available in the
network implementation above the WAN2 port of the system. When Dynamic is selected, the system works as a
DHCP client and get an IP address for its WAN2 port automatically from the DHCP server.
yPPPoE: Select the option when PPPoE is the connection protocol provided by the network service providers.
When Dial on Demand is enabled, there is a Maximum Idle Time available. The system will disconnect itself
from the Internet automatically when the Maximum Idle Time is reached. This is the common connection type for
ADSL. To properly configure PPPoE connection type, the Username, Password, MTU and Clamp MSS fields
are required. The Dial on Demand function is used to guard the idle time out of the connection. The Maximum
Idle Time field is required to enable this function. When the idle time is reached, the connection will be