D-Link DSA 5100 - Airspot - Gateway User manual

DSA-5100
INSTALLATION GUIDE
Package Contents
• D-Link®DSA-5100 Airspot™Enterprise Gateway
• CAT5 UTP Straight-Through Ethernet Cables (Qty. 3)
• CAT5 UTP Crossover Cable (Qty. 1)
• CD-ROM with manual
• Null modem RS-232 console cable (Qty. 1)
• Power Cord
System Requirements
• Computer with an Ethernet adapter and a Windows, Mac, or Unix based operating system.
• Internet Explorer or Netscape Navigator, version 6.0 or above, with JavaScript enabled.
©2006D-Link Systems, Inc.All rights reserved. Trademarks or registered trademarks are the property of their respective holders. Software and specifications subject to change without notice. DSA-5100. 04182006

2
Hardware Overview
DSA-5100 Installation Guide
Front Panel
Hardware Overview
Rear Panel
Port Function
Console Direct connection to your computer’s serial port using an RS-232 cable for gateway configuration.
(The console settings are: Bits per second: 115200, Data bits: 8, Parity: None, Stop bits: 1)
Public LAN Connects to your open network environment. Requires authentication to use network resources and Internet.
Private LAN Connects to your trusted internal network. Authentication is not required to access network resources.
WAN1 Connects to your Internet connection or Intranet.
WAN2 Connects to your Internet connection or Intranet.
LED Function
Link Solid green indicates a good connection on the associated port.
Act The Act LED flashes during data transmission on the associated port.
Power A solid light indicates a proper connection to the power supply.
Status
The status LED has three states:
• Unlit when the system’s BIOS is loading or when powered off.
• Flashing indicates the operating system is loading.
• Solid when the system is fully loaded and ready to use.
Item Description
Power Connector The power cord attaches here.
Power Switch Powers the unit off and on.
Cooling Fans Be sure to keep the unit in a well ventilated area and do not block the cooling fan vents.

3
Hardware Installation
DSA-5100 Installation Guide
Hardware Installation
1.Connect the power cord to the power connector on the rear panel of the DSA-5100. Plug the other end of the power
cord to a wall outlet or power strip.
2.Turn on the power switch on the rear panel of the DSA-5100. The Power LED will illuminate.
3.Connect an Ethernet cable to the port labeled Public LAN on the DSA-5100. Connect the other end of the Ethernet
cable to a switch or wireless access point that will provide public access to your broadband connection. The Public
LAN LED should illuminate to indicate a proper connection.
4.Connect an Ethernet cable to the port labeled Private LAN on the DSA-5100. Connect the other end of the Ethernet
cable to a switch. The Private LAN LED should illuminate to indicate a proper connection.
5.Connect an Ethernet cable to the port labeled WAN1 on the DSA-5100. Connect the other end of the Ethernet cable
to a broadband modem. If the connection is live, the WAN1 LED will illuminate.
6.(Optional) Connect an Ethernet cable to the port labeled WAN2 on the DSA-5100. Connect the other end of the
Ethernet cable to a router or directly to a high speed connection. If the connection is live, the WAN2 LED will
illuminate.

4
The Setup Wizard
DSA-5100 Installation Guide
The Setup Wizard
The DSA-5100 provides Web based configuration.
You can configure your DSA-5100 using Internet
Explorer or Netscape Navigator version 6.0 or above
with JavaScript enabled. To access the configuration
screen, launch your Web browser and enter the IP
addressoftheDSA-5100intheaddressfieldandpress
enter.If using the DSA-5100’sdefaultIPaddress, you
would enter https://192.168.0.40 (Note: Include the
“s”attheendofhttps toensureasecureconnection).
Once you’ve connected to the DSA-5100, the Login
screen appears. By default, admin is the User Name
and Password. Type admin in the User Name and
Password fields and click Enter.
After successfully logging in, the Home screen will
appear. Click on the System Configuration folder on
the left panel to reveal the System Configuration
options.ThefirstoptiondisplayedistheConfiguration
Wizard. Click on this to display the Configuration
Wizard screen.

5
The Setup Wizard
DSA-5100 Installation Guide
Step 1 - Change Admin’s Password
Enter a new password for the admin account and
retype it in the verify password field. Click Next to
continue.
Click on the Run Wizard button to begin the Setup
Wizard.
The Setup Wizard appears, click Next to begin.

6
The Setup Wizard
DSA-5100 Installation Guide
Step 2 - Choose System’s Time Zone
Select your time zone and click Next to continue.
Step 3 - Set System Information
•Succeed Page: Enter the URL that users should be
directed to when successfully authenticated.
•External Time Server: Enter the URL of external time
server for the gateway to synchronize the time from.
•WAN Port DNS Server: Enter a DNS Server provided by
your Internet Service Provider. Contact your ISP if you are
unsure of the IPAddress to enter here.
Step 4 - Select the Connection Type for
WAN1 Port
Select the type of Internet connection that you have. If you
are unsure of which to select, please contact you Internet
Service Provider. Click Next to continue. If you selected
DHCP, proceed to step 5 on page 8.

7
The Setup Wizard
DSA-5100 Installation Guide
Step 4 - Set WAN1 Port’s Static IP Address
If you selected Static IP, enter the IP address information
provided by your Internet Service Provider. You must
complete all of the fields. Click Next and continue to Step 5
on page 8.
Step 4 - Set PPPoE Client’s Information
If you selected PPPoE, enter the Username and Password
provided by your Internet Service Provider. Click Next and
continue to Step 5 on page 8.

8
The Setup Wizard
DSA-5100 Installation Guide
Step 5 - Configure Public LAN
• IP Address and Subnet Mask: Enter the IP
Address and Subnet Mask of the DSA-5100 for the
Public LAN port.
• Disable DHCP Server: If this option is selected,
then LAN clients must be configured with an IP
address manually.
• Enable DHCP Server: When selected, this allows
the DSA-5100 to automatically provide the
necessary IP information to all Public LAN clients
configured for DHCP.
Step 5 - Set Public LAN’s DHCP Server
• Start IP Address, End IP Address: These fields
define the IP address range that will be assigned to
the Public LAN clients configured for DHCP.
Be sure the IP range does not conflict with any
manually configured network devices or the IP
address of the DSA-5100.
• Domain Name: Enter a domain name provided by
your ISP.
• Primary DNS Server, Secondary DNS Server:
The DNS Server settings are provided by your
Internet Service Provider. Only the Primary DNS
Server field is mandatory. Contact your ISP if you
are unsure of the DNS Server settings.
Step 6 - Restart
Click on Restart to save the current settings and
restartthe DSA-5100.The Setup Wizard is complete!

9
System Configuration
DSA-5100 Installation Guide
System Configuration
System Information
•System Name: The system name of the DSA-5100. Used for SNMP purposes. The default is DSA-5100.
•Administrator Info: Information on how to contact the system administrator can be entered here. The administrator’s
name, phone number, and e-mail address can be entered here. If a user connects to the DSA-5100 and WAN1 has a
connection problem, the user logon screen will show the system administrator information that was entered here.
•Succeed Page: Enter a URL to direct users to once they have been authenticated. Typically this would be a company
web page such as www.dlink.com.
•Remote Management IP: When enabled, the IP address entered has the ability to manage the DSA-5100 via the
WAN1 interface. This allows the system at the specified IP address to manage the DSA-5100 over the Internet.
•Access History IP: The IP address of your billing system should be entered here to allow the billing system to access
the DSA-5100’s billing history information.
•SNMP: The DSA-5100 supports SNMP v2 read only data access. The administrator can specify the IP address and the
SNMP community name to determine the target of the management information base (MIB) exported from the DSA-5100.
•User Logon SSL: When enabled, the user logon is secure using https. If disabled, standard http is used.
•Time:The DSA-5100 supports NTPTime Server configuration for accurately synchronizing the network time. If NTP is
enabled,youcan enter an NTPserverfor time synchronization.Thealternateoption is Set Device Dateand Time,which
allows you to manually specify the time.

10
System Configuration
DSA-5100 Installation Guide
IP PNP: When enabled, you can use any IP address to connect to the Public LAN.You can authenticate to the DSA-5100
and access network resources regardless of your IP configuration. Note: This function only works when NAT is used.
Mobile IP: This option allows a user to use the same IP configuration across a network using several DSA-5100 units.
Global LAN Configuration
You can set the system to Enable or Disable the IP PNP or mobile IP options for the public LAN and private LAN
simultaneously.
Interface Configuration
The Interface Configuration options only vary slightly between the Public LAN, Private LAN, and VLAN Configurations.
The VLAN Configuration is the only configuration that provides the VLAN Tag option. The Private LAN Port doesn’t have
the option for UserAuthentication.
• VLAN: Enable or disable the VLAN option (only applicable in the Public LAN and VLAN Interface Configuration).
• Enable User Authentication: Controls user authentication per selected interface when enabled. The default is
disabled.
•Operation Mode:
NATMode: In this mode, all IP addresses that are connected through the Public LAN Port are converted into the IP
address of the WAN1 Port for external communication.
Router Mode: All IP addresses that are connected through the Public LAN Port use their individual IP addresses for
external communication. In this mode, the DSA-5100 acts like a Router.
• IP Address: The IP address to be used for the selected interface.
• Subnet Mask: The subnet mask to be used for the selected interface.

11
System Configuration
DSA-5100 Installation Guide
DHCP Server Options
You will find the DHCP Configuration options are the same beneath the Public LAN, Private LAN, and VLAN Port
configurations. The functionality is the same for all of the options, the only difference is the port to which they are applied.
Disable DHCP Server:When selected, the DSA-
5100 will not provide IP addresses to the clients
connected to the Public LAN Port.
Enable DHCP Server: When the DHCP Server
is enabled, the fields with the red asterisks must
be filled in.
The DHCP Scope defines the range of IP
addressesavailablefor assignment.
StartIPAddress:Definesthefirstavailable
IPaddressfor the unit to assignto aclient.
End IPAddress: Defines the last available
IP address for the unit to assign a client.
Alladdresses betweentheStartIPAddress
and End IPAddress are available for
assignment to clients.
Primary DNS Server: Enter the IPaddress of the
primary DNS server.
Secondary DNS Server: A secondary DNS server’s IP address can be entered here but is not required.
Domain Name: Enter the domain name.
WINS Server IP: Enter the IP address of the WINS server.
Lease Time: Select the amount of time for the DHCP assigned IP addresses to be in effect.
Reserved IPAddress List:This function allows youto reservespecificIPaddresses for specificsystems/devices.The IP
address will be reserved for the specified MAC address. To use this function, click on the Reserved IPAddress List link
and the Reserved IPAddress List options will appear. Enter the IP address to be reserved and the MAC address of the
device to assign it to. A description can be entered but is not mandatory. Click Apply to save the settings.
DHCP Server Relay: Select this mode to specify another DHCP server’s IP address.

12
UserAuthentication
DSA-5100 Installation Guide
User Authentication
Authentication Policies
The DSA-5100 provides five different management setups. TheAdministrator can adopt different authentication methods
according to each management setup. Each management setup can use up to twenty management rules in addition to
the group configuration. This allows more diversified and flexible management options for general users.
•Item: The item number.
•Policy Name: The policy name is displayed here.
•Status: Displays whether the policy is enabled or disabled.
•Default: Lists the policy that is the default. Only one policy may be selected as the default.
•Group: Displays the group assignment.

13
UserAuthentication
DSA-5100 Installation Guide
Authentication Policies Configuration
•Policy ID: The system provides five separate authentication policies. Select the desired control group from the pull-
down menu.
•Set as Default: Selecting this option will set the selected control group as the preferred authentication method. Only
one policy can be selected as the default.
•Policy Name: The friendly name for the authentication policy. The DSA-5100 controls priority according to the following
postfix when the user logs on the system (example user1@postfix1).
•Policy Status: The policy is enabled or disabled here.
•Black List Profile: Select one of the five profiles from the Black List configuration or None if you don’t wish to use one.
•Authentication Server: The are five authentication options listed here (Local, POP3, RADIUS, LDAP, and NT Domain)
and an additional option on the External Authentication screen (http or https).
•Assign to Group: Select a group to assign to the Authentication Policy using the pull-down menu.
•Exception Configuration:Allows exceptions to the configuration rules to be defined. Exceptions are defined based on
user’s attributes.

14
UserAuthentication
DSA-5100 Installation Guide
• Attribute:After authentication, the DSA-5100 will obtain the user’s attributes from the authentication server.Attributes
can be defined for management rules.
• Logic: The pull-down menu displays the logic conditions that filter the attribute.
• Value: This is the value that is matched to the attribute and logic.
• Group: Specifies the group the exception will be applied to.
Authentication Methods
Local
The Local user authentication method authenticates users from a list of users created on the DSA-5100. The DSA-5100
has a maximum of 2000 user accounts. To access the list of accounts, click on the Local Users List hyperlink from the
Authentication Policies Configuration page when Local is selected as theAuthentication Server.
To Add Users, click the Add User button and enter the following information:
•Username: Usernames can be up to 32 characters maximum. No spaces can be used.
•Password: Enter a password consisting of up to 20 characters. No spaces can be used.
•MAC: This field is optional. Enter the MAC address of the system the user will authenticate from. Be sure to include the
colon(:)betweeneachoctet (xx:xx:xx:xx:xx:xx).
• Max Bandwidth: The amount of maximum transmission capacity that is available on a network at any point in time.
• Request Bandwidth: The amount of minimum transmission capacity that is available on a network at any point in time.
•Group: You can assign users to groups to simplify administration.

15
UserAuthentication
DSA-5100 Installation Guide
To see newly added users, click the Refresh button. To edit a user, simply click on the Username. To delete a user, click
theDelete button.To delete all useraccounts,click theDelete All button.To search the userlist,enter the name to search
and click the Search button. The search function retrieves all usernames that contain the exact character(s) entered. The
user list displays names in sets of ten. The bottom right displays a menu for navigating through the list of users.
The user account can be edited by clicking on the Username.
The Edit Accout window will appear. Modify the account as
needed and click Submit to save changes. To retrieve the
currentlysaved accountsettings,clickthe Reset button.Toreturn
without saving changes, click the Back to Users List hyperlink.
Upload User Account
You can copy user account information to the DSA-5100 from a text file. You can either upload a previously saved file or
create a text file using the proper format. In the text file, each user must have their own line and there are no spaces. Use
the colon (:) between the octets of the MAC address. Spaces can only be used in the remarks section.There must not be
any spaces between the fields and the commas. The MAC field may be omitted but the trailing comma must remain.
When uploading user accounts, existing accounts in the embedded database that are also listed in the data file will be
replaced with the uploaded account information. The format is as follows:
username,password,MAC,remark
Editing Accounts
• Remark: This comment field is optional and for your reference only. You can enter up to 50 characters in this field.
Click Apply to add the users. Note: Each page only displays ten users at a time. If you've entered ten users and need to
add more, click Apply and a new screen will appear allowing you to enter up to ten more. Repeat the process until you've
added all of your users.

16
UserAuthentication
DSA-5100 Installation Guide
Download User Account
This option will save all of your user accounts to a text file that can be uploaded back to the DSA-5100. To Download the
user accounts, click on the Download UserAccount button. The user accounts will be displayed on the screen. Scroll to
thebottomof the page. Right click on theDownloadhyperlinkand select SaveTargetAs.Chooseafile name and location.
Click the Close button when finished.
POP3
When selecting POP3 as the authentication method, you must enter the IP address or domain name of the POP3 server.
You must also enter the port number. The standard port number is 110. A secondary POP3 server can be entered but is
not mandatory. The Enable SSL Connection option can be selected if your configuration supports this.

17
UserAuthentication
DSA-5100 Installation Guide
RADIUS
When selecting RADIUS as the authentication method, there are several parameters that need to be configured.
802.1X Authentication: When 802.1xAuthentication is enabled, an Edit option will appear just below the enable button.
Click the Edit hyperlink to configure the additional parameters. You must define the IP (segment) address and the secret
that you have configured.
Trans Full Name: If enabled, ID and postfix data will be transferred to the RADIUS server for authentication. When
disabled, only the ID will be transferred to the RADIUS server for authentication.
Class Configuration: Configuration reads parameters from a configuration file and returns their values on demand.
Set the Max Bandwidth and Request Bandwidth, and assign a group for every class.
Server IP: Enter the IP address or domain name of the RADIUS server.
Authentication Port: The authentication port number is entered in this field. The standard port number is 1812.
Accounting Port: Enter the port configured for accounting.
Secret Key:The secret key used for encryption /decryption.
Accounting Service: Select enabled or disabled as needed.
Authentication Method: Select either CHAP or PAP type of authentication.

18
UserAuthentication
DSA-5100 Installation Guide
LDAP
When selecting LDAP as the authentication method, you must configure all of the fields under Primary LDAPServer. The
Secondary LDAP Server fields are optional.
Server IP: The IP address or domain name of the LDAP server.
Port: Enter the port number in this field. The standard port number is 389.
Base DN: Base DN data of LDAP Server.
Account Attribute Type: Select the account attribute type. There are types, UID, CN and sAMAccountName.
Anonymous Bind: If you want to access the data from some LDAP servers which need to be authenticated, you have
to enter the username and password in the "Bind RDN" and "Bind Password" fields, or check "Anonymous Bind"
to just access the LDAP servers which don't need to be authenticated.

19
UserAuthentication
DSA-5100 Installation Guide
NT Domain:
When selecting the NT Domain authentication method, be sure the WAN1 Port Preferred DNS Server IP address is the
Domain Controller Server IP address. Policy Name is your complete domain name.
Server IP: Enter the IP address of the domain controller.
Transparent Login: When enabled, the user logs into the DSA-5100 after logging into the Windows Domain.
Note: Currently only Windows 2000 domain controllers can be used.
External Authentication
TheDSA-5100 also allows external authentication,allowingyouto put the loginpageon an external webserver.Thelogin
page can be changed at any time.
Protocol: Select HTTP or HTTPS.
Server IP: The External Web server’s IP address.
Server Port: The External Web server’s port number.
Login Page: The URL of the login page.

20
Group Profile
DSA-5100 Installation Guide
Group Profile
The DSA-5100 has three types of profile configurations: Firewall Profile, Specific Route Profile, and Login Schedule
Profile.
Firewall Profile
Thesystem has a defaultglobalfirewallprofile and fiveadditional firewallprofiles.You canusethe global firewall profileto
define the firewall rules for all users and create indepent profiles using the other five settings.
Profile Name: Enter a name for the profile here.