D-Link DSA-3600 User manual

DSA-3600
User Guide
Version DSA-3600-3.00 December, 2007

Copyright © 2007 D-Link Corporation
All rights reserved. Printed in Taiwan. D-Link Corporation reserves the right to change, modify, and revise this
publication without notice.
Trademarks
Copyright 2007 D-Link Corporation. All rights reserved. D-Link, the D-Link logo, and DSA-3600 are trademarks of
D-Link Corporation. All other brand and product names are registered trademarks or trademarks of their respective
holders.
Statement of Conditions
In the interest of improving internal design, operational function, and/or reliability, D-Link Corporation reserves the right
to make any changes to products described in this document without notice. D-Link Corporation shall be indemnified
against any liability that may occur due to the use or application of the product(s) described herein.

Table of Contents
Chapter 1. Before You Start.............................................................................................................................................1
1.1 Audience.................................................................................................................................................................1
1.2 Document Conventions...........................................................................................................................................1
Chapter 2. Overview........................................................................................................................................................2
2.1 Introduction of DSA-3600......................................................................................................................................2
2.2 System Concept ......................................................................................................................................................2
Chapter 3. Hardware Installation.....................................................................................................................................4
3.1 Panel Function Descriptions...................................................................................................................................4
3.2 Package Contents....................................................................................................................................................6
3.3 System Requirement...............................................................................................................................................6
3.4 Installation Steps.....................................................................................................................................................6
Chapter 4. Web Interface Configuration..........................................................................................................................7
4.1 System...................................................................................................................................................................11
4.1.1 General...........................................................................................................................................................12
4.1.2 WAN1............................................................................................................................................................14
4.1.3 WAN2............................................................................................................................................................17
4.1.4 WAN Traffic ..................................................................................................................................................19
4.1.5 LAN Port Mapping........................................................................................................................................21
4.1.6 Service Zones.................................................................................................................................................28
4.2 Users.....................................................................................................................................................................43
4.2.1 Authentication................................................................................................................................................44
4.2.1.1 Authentication Database – Local...................................................................................................................44
4.2.1.2 Authentication Database – POP3...................................................................................................................49
4.2.1.3 Authentication Database – RADIUS.............................................................................................................50
4.2.1.4 Authentication Database – LDAP..................................................................................................................52
4.2.1.5 Authentication Database – NT Domain.........................................................................................................53
4.2.1.6 Authentication Database – ONDEMAND.....................................................................................................54
4.2.1.7 Authentication Database – SIP......................................................................................................................63
4.2.2 Black List.......................................................................................................................................................64
4.2.3 Policy.............................................................................................................................................................65
4.2.3.1 Global Policy.................................................................................................................................................66
4.2.3.2 Policy 1 ~ Policy 12.......................................................................................................................................68
4.2.4 Additional Control.........................................................................................................................................74

4.3 Access Points........................................................................................................................................................76
4.3.1 List.................................................................................................................................................................77
4.3.2 Discovery.......................................................................................................................................................82
4.3.3 Adding...........................................................................................................................................................85
4.3.4 Templates.......................................................................................................................................................86
4.3.5 Firmware........................................................................................................................................................99
4.3.6 Upgrade .......................................................................................................................................................100
4.4 Network ..............................................................................................................................................................101
4.4.1 NAT .............................................................................................................................................................102
4.4.2 Privilege.......................................................................................................................................................104
4.4.3 Monitor IP....................................................................................................................................................106
4.4.4 Walled Garden .............................................................................................................................................108
4.4.5 Proxy Server ................................................................................................................................................109
4.4.6 DDNS ..........................................................................................................................................................110
4.4.7 Client Mobility.............................................................................................................................................111
4.4.8 VPN.............................................................................................................................................................112
4.5 Status...................................................................................................................................................................116
4.5.1 System .........................................................................................................................................................117
4.5.2 Interface.......................................................................................................................................................119
4.5.3 Routing Table...............................................................................................................................................121
4.5.4 Online Users ................................................................................................................................................123
4.5.5 User Logs.....................................................................................................................................................124
4.5.6 E-mail & SYSLOG......................................................................................................................................128
4.6 Tools ...................................................................................................................................................................130
4.6.1 Setup Wizard................................................................................................................................................131
4.6.2 Password Change.........................................................................................................................................138
4.6.3 Backup & Restore........................................................................................................................................139
4.6.4 System Upgrade...........................................................................................................................................141
4.6.5 Restart..........................................................................................................................................................142
4.6.6 Utilities ........................................................................................................................................................143
4.6.7 Quick Links .................................................................................................................................................144
4.7 Help ....................................................................................................................................................................148
Appendix A. An Example of User Login....................................................................................................................149
Appendix B. Console Interface Configuration............................................................................................................151
Appendix C. Proxy Configuration ..............................................................................................................................154
Appendix D. Certificate Settings for IE6 and IE7.......................................................................................................159
Appendix E. Service Zones – Deployment Examples................................................................................................166
Appendix F. Deploying DSA-3600 Using DWL-2100AP.........................................................................................170

Appendix G. Network Configuration on PC...............................................................................................................173
Appendix H. Local VPN.............................................................................................................................................178
Appendix I. DHCP Relay ..........................................................................................................................................184
Appendix J. Session Limit and Session Log..............................................................................................................186
Appendix K. Accepting Payments via PayPal ............................................................................................................188

Chapter 1. Be
f
oreYouStart
1
Chapter 1. Before You Start
1.1 Audience
This manual is intended for use by system integrators, field engineers and network administrators to help them set
up DSA-3600 Multi-Service Business Gateway in their network environments. It contains step by step procedures
and pictures to guide users with basic network system knowledge to complete the installation.
1.2 Document Conventions
The following information provides the details of conventions used in this manual.
For cautionary statements or warning requiring special attention by readers, a text box with italic font will be used:
Warning: For security purposes, you should immediately change the administrator’s password.
When any of the button symbol shown below is selected, the following action will be executed accordingly:
Log out the system.
Access Online Help interface.
Apply all settings configured.
Clear all settings configured prior to applying.
The red asterisk indicates information in this field is compulsory.
Please Note: Screen captures and pictures used in this manual may be displayed in part or in whole, and may vary
or differ slightly from the actual product, depending on versioning and menu accessed.

Chapter 2. Overview
2
Chapter 2. Overview
2.1 Introduction of DSA-3600
DSA-3600 is a Multi-Service Business Gateway specially designed for small and medium business, and branch
office operational environments. The major functional areas include user management, access control, AP
management, security management, and VLAN. The major features of DSA-3600 can be grouped into four
functional blocks:
A. User Access Control
B. Network Security (examples: Firewall, VLAN and VPN)
C. Web-based administration and centralized AP management
D. General networking features
2.2 System Concept
Small and Midsize Business (SMB) Network Environment
Networking devices such as switches, hubs, and access points are usually included in SMB environments. The
Internet connection of a SMB is usually via ADSL or cable modem. Figure-2.2a shows a typical network deployment
example which includes switches, access points, and connections to the Internet via ADSL/cable modem.
The DSA-3600 provides user authentication, authorization and management. The user account information is stored
in the local database or specified external database servers. User authentication is processed via the SSL encrypted
web interface. This interface is compatible to most desktop devices and palm computers. The appended figures are
typical examples of DSA-3600 deployed in a SMB environment. Figure-2.2b shows DSA-3600 authenticating the
users of its built-in database, as well as the users of external authentication database. Both LAN and WLAN can be
secured by IPSec VPN. PPTP VPN is supported for remote users to increase security at remote sites. The
DSA-3600 also supports Site-to-site VPN, WAN Failover, and DMZ.
The DSA-3600 can be used to control access to the company’s intranet. In a managed network that includes cable
and wireless network users, users located at the managed network can be set to be unable to access the network
resource without permission. In the event access right to the network beyond the managed area is required, an
Internet browser, such as the Internet Explorer, may be opened to connect to any website. When the browser
attempts to connect to a website, the DSA-3600 will force the browser to redirect to the user login webpage. The
user must then enter the username and password, where upon successful identification and authentication, the user
will then be granted proper access right as defined in the DSA-3600.

Chapter 2. Overview
3
Figure-2.2a: An example deployment using DSA-3600
Figure-2.2b: An example of SMB environment using DSA-3600

Chapter 3. Hardware Installation
4
Chapter 3. Hardware Installation
3.1 Panel Function Descriptions
The DSA-3600 is implemented on an embedded platform with mini-desktop form factor. On the front panel of the
product, there are eight LEDs that are used to indicate the system power, system status, and the link status of the
six fast Ethernet ports. The interface ports are installed on the rear panel. Six fast Ethernet (100Mbps) ports are
provided by DSA-3600. Two are configured as WAN Ports, and the other four are configured as LAN Ports. Located
on the rear panel are a serial console port, a reset button, and the power socket.
Front Panel
1. Power 3. LEDs: WAN1~WAN2 5. Sign: Link
2. Status 4. LEDs: LAN1~LAN4 6. Sign: Act
1. Power
ON indicates that power is on and OFF indicates that power is off.
2. Status
While system power is on, status OFF indicates BIOS is running; BLINKING indicates the OS is running,
and ON indicates system is ready.
3. WAN1~WAN2 LEDs
OFF indicates no connection; ON indicates connection and BLINKING indicates transmitting data.
4. LAN1~LAN4 LEDs
OFF indicates no connection; ON indicates connection and BLINKING indicates transmitting data.
5. Link Sign
Sign to indicate the LED of WAN1~WAN2 and LAN1~LAN4 in the status of connection.
6. Act Sign
Sign to indicate the LED of WAN1~WAN2 and LAN1~LAN4 in the status of transmitting data.
1 2 3 4 5 6

Chapter 3. Hardware Installation
5
Rear Panel
1 Power Socket:
The power adapter is attached here.
2 Reset Button:
Press and hold the Reset button about five seconds, status LED on front panel starts to blink before
restarting the DSA-3600.
Press and hold the Reset button for more than ten seconds; status LED on the front panel starts to speed
up blinking before resetting the DSA-3600 to default configuration.
3 WAN1~WAN2:
The two WAN ports connected to an external network not managed by the DSA-3600. These ports may
be used to connect to the ATU-Router of an ADSL, or the port of a Cable Modem, or a Switch or Hub on
the LAN of an organization.
4 LAN1~LAN4:
The four LAN ports connect to networks managed by DSA-3600, such as to clients’ networking devices
or APs. There are two modes for service zone supported by DSA-3600, Port-Based and Tag-Based. By
default, all LAN ports are in Tag-based service zone. Under Tag-Based mode, service zones will be
distinguished by VLAN tagging instead of physical LAN ports.
5 Console:
The serial RS-232 DB9 cable attaches here.

Chapter 3. Hardware Installation
6
3.2 Package Contents
The standard package of the DSA-3600 includes:
yDSA-3600 x 1
yQuick Install Guide x 1
yCD-ROM x 1
yConsole Cable x 1
yStraight-through Ethernet Cable x 1
yPower Cord x 1
yPower Adapter x 1
3.3 System Requirement
yStandard 10/100BaseT including network cables with RJ-45 connectors
yAll PCs need to install the TCP/IP network protocol
3.4 Installation Steps
Please follow the steps mentioned below to install the hardware of DSA-3600:
1. Connect the power adapter to the power socket on the rear panel. The Power LED on the front panel should be
ON to indicate a proper connection.
Warning: Using a non-certified power adapter may damage this product.
2. Connect an Ethernet cable to the WAN1 Port on the rear panel. Connect the other end of the Ethernet cable to
a networking device such as an ADSL modem, a cable modem, a switch, or a hub. The LED of WAN1 port
should light up to indicate a proper connection.
3. Connect an Ethernet cable to any LAN Port on the rear panel. Connect the other end of the cable to a
networking device such as the administrator’s PC. The LED of the LAN should be ON to indicate a proper
connection.
After the hardware of the DSA-3600 is installed completely, the system is ready to be configured in the following
sections. This manual will guide you step by step to set up the system using a single DSA-3600 to manage the
network.

Chapter 4. Web Inter
f
ace Con
f
i
g
uration
7
Chapter 4. Web Interface Configuration
This chapter provides further detailed information on setting up the DSA-3600. The following table shows all the
functions of DSA-3600.
In the web management interface, there are three main interface areas: Tools Menu, Main Menu Tree and
Working Area. The Working Area occupies the largest area of the web interface on the center right. It is also
referred as the current management page. The current management page is where status is displayed; controlled
are issued or parameters are configured. Tools Menu, near the upper left corner, provides the access to system
utilities, including: Setup Wizard, Password Change, Backup & Restore, System Upgrade, Restart, Wake-on-LAN
and Quick Links. Menu Tree, on the left side of the web interface, allows administrators to traverse to various
management functions of this system. The management functions are grouped into five branches: System (System
Settings), Users (User Management), Access Points (AP Management), Network (Network Settings) and Status
(Status and Report).
OPTION FUNCTION
General
WAN 1
WAN 2
WAN Traffic
LAN Port Mapping
System
Service Zones
Authentication
Black List
Policy
Users
Additional Control
List
Discovery
Adding
Templates
Firmware
Access Points
Upgrade

Chapter 4. Web Interface Configuration
8
OPTION FUNCTION
NAT
Privilege
Monitor IP
Walled Garden
Proxy Server
DDNS
Client Mobility
Network
VPN
System
Interface
Routing Table
Online Users
User Logs
Status
E-mail & SYSLOG
Setup Wizard
Password Change
Backup & Restore
System Upgrade
Restart
Utilities
Tools
Quick Links
Caution: After finishing the configuration, please click Apply and pay attention to see if a restart message appears
at the bottom of the screen. If the message appears, the system must be restarted to allow the configurations to take
effect. All on-line users will be disconnected during restart.

Chapter 4. Web Inter
f
ace Con
f
i
g
uration
9
Web Management Interface
The DSA-3600 provides a web management interface for configuration. After completing the hardware installation,
the administrator can configure the DSA-3600 via web browsers with JavaScript enabled such as Internet Explorer
version 6.0 or above.
After the basic installation has been completed according to the instructions of the previous chapter, the DSA-3600
can further be configured with the following steps:
1. First, set a PC as DHCP in the network with TCP/IP setting to get an IP address from the DHCP server
automatically. Next, connect the PC to the DSA-3600 via any LAN port. An IP address will be assigned to the PC
automatically via the DSA-3600 built-in DHCP server. Launch a web browser to access the web management
interface of DSA-3600 by entering “https://192.168.1.1” in the URL. (Note: https is used for a secured
connection.)
Once the DSA-3600 has been connected, the Administrator Login Page will appear. Enter “admin” for both the
default username and password in the Username and Password fields. Select the Enter button to log in.
Caution: If you are unable to get to the login screen, please check the IP address used. The IPaddress should
be in the same subnet of the default gateway. For using static IP in TCP/IP setting, set a static IP address such
as 192.168.1.x for your network interface and then open a new browser again.

Chapter 4. Web Interface Configuration
10
2. After successfully logging into the DSA-3600, the System Overview page of the web management interface will
appear. To logout, simply click the Logout icon on the upper right corner of the interface to return to the
Administrator Login Page.

Chapter 4.1 System
11
4.1 System
This section provides information on the following functions: General, WAN1, WAN2, WAN Traffic, LAN Port
Mapping and Service Zones. It displays the information such as System Time, Up Time and Firmware version.

Chapter 4. Web Interface Configuration
12
4.1.1 General
The system and network related parameters such as System Name, Homepage Redirect URL, Management IP
Address List, and HTTPS Protected Login can be configured from the menu shown as below.
ySystem Name: Set the name of the system or use the default.
yInternet Domain Name: A fully qualified domain name (FQDN) of the system. When the administrator enters a
desired domain name in the Internal Domain Name field, the entered Internal Domain Name will be shown in the
top left of the Login Success page instead of an LAN IP address. In addition, when HTTPS is enabled, entering
the domain name of the uploaded certificate will increase login speed and the URL in the User Login page will
be changed. For example, if the Internal Domain Name is configured as ashop.com, the URL in the User Login
page will be https://ashop.com/loginpages/login.shtml.
yHomepage Redirect URL: Enter a URL in this field. When the clients are logged-in to the DSA-3600
successfully, their browsers will be directed to this URL regardless of the original homepage setting in their
browsers when Local VPN is disabled.
yUser Log Access IP Address: An external billing system may access the system's user logs by specifying a
desired IP address of the external billing system in this field. Only the billing system with this IP address may
directly access the system's user logs in text format via browsers. For example, if the access interface of
DSA-3600 is “10.30.1.23”, the user log can be found in following URLs.
User Log is located in the URL：https://10.30.1.23/status/history/2006-11-01
On-demand User Log is located in the URL：https://10.30.1.23/status/odhistory/2006-11-01

Chapter 4.1 System
13
Management IP Address List: Set the IP addresses within a range which the administrator can use to connect
to the web management interface of DSA-3600 via its WAN and/or LAN ports. The administrator can grant the
access of the web management interface by specifying a list specific IP address or ranges of IP addresses, no
matter the access is from WAN or LAN port. For example, entering “192.168.3.1” and “192.168.1.0/24” means
the computer at 192.168.3.1 and the computers the range of 192.168.1.0 to 192.168.1.255 are able to reach the
web management interface.
Please Note: While the default IP address of Network Interface is changed at System
Æ Service Zones Æ Basic
Settings Æ DHCP Server Æ Enable DHCP Server, the management IP address has to be setup again from default
IP address to the new IP as the format, x.x.x.x/x.
ySNMP: The DSA-3600 supports SNMPv2. When the function is enabled, an implemented SNMP server is able
to access the system’s management information base.
yHTTPS Protected Login: The system supports HTTPS (encrypted) and HTTP (non-encrypted) when clients log
into the system. When this function is enabled, the Secured Socket Layer (SSL) will be activated and
implemented to the web-based user login page.
yTime: The system time can be set up manually or synchronized with remote NTP (Network Time Protocol)
servers. It supports up to five NTP servers. When NTP is enabled, at least one NTP server has to be configured
and the system time will be adjusted automatically according to the remote NTP servers. When manually set up
is enabled, the administrator needs to set configurations manually. The system time can also be manually
configured when selecting Manually set up. Please enter the date and time into the respective fields.

Chapter 4. Web Interface Configuration
14
4.1.2 WAN1
There are four connection types supported on the WAN1 Port: Static, Dynamic, PPPoE, and PPTP.
yStatic (Use the following IP Settings): Select Static to specify a static IP address for WAN1 port manually
when a static IP address is available for DSA-3600. Fields with red asterisks are required to be filled in.
IP Address: The IP address of the WAN1 port.
Subnet Mask: The subnet mask of the WAN1 port.
Default Gateway: The gateway of the WAN1 port.
Preferred DNS Server: The primary DNS Server of the WAN1 port.
Alternate DNS Server: The substitute DNS Server of the WAN1 port. This is optional.
yDynamic (IP settings assigned automatically): Select the option when a DHCP server is available in the
network implementation above the WAN1 port of the system. When Dynamic is selected, the system works as a
DHCP client and get an IP address for its WAN1 port automatically from the DHCP server.