PheeNet WMS-308N User manual

Network Access Control
Gateway / Controller
User Manual Ver.0.0.5 WMS-308N

TableofContents
Chapter 1. Before You Start ...............................................................................................................5
1.1 Preface.................................................................................................................................................... 5
1.2 Package Contents................................................................................................................................... 5
Chapter 2. System Overview..............................................................................................................6
2.1 Introduction of WMS-308N ...................................................................................................................... 6
2.2 System Concept...................................................................................................................................... 6
2.3 Specification ............................................................................................................................................ 7
Chapter 3. Base Installations...........................................................................................................15
3.1 Installations ........................................................................................................................................... 15
3.1.1 System Requirements .............................................................................................................. 15
3.1.2 Panel Function Descriptions..................................................................................................... 15
3.1.3 Hardware Installation................................................................................................................ 17
3.2 Software Configuration.......................................................................................................................... 18
3.2.1 Getting Start ............................................................................................................................. 18
3.2.2 Quick Configuration.................................................................................................................. 20
3.2.3 Access Internet......................................................................................................................... 24
Chapter 4. Web Interface Configuration .........................................................................................25
4.1 Connect WMS-308N to the external Network...................................................................................... 26
4.1.1 Network Requirement............................................................................................................... 26
4.1.2 Configure WAN Port ................................................................................................................. 26
4.1.3 Configure WAN Traffic .............................................................................................................. 29
4.1.4 Configure Dynamic DNS .......................................................................................................... 31
4.1.5 Configure Local(LAN/VLAN) Network....................................................................................... 32
4.1.6 Manage Switch QoS................................................................................................................. 38
4.2 Manage the System .............................................................................................................................. 39
4.2.1 Configure System Time ............................................................................................................ 39
4.2.2 Configure Management ............................................................................................................ 40
4.2.3 Configure SNMP....................................................................................................................... 43
4.2.4 Backup / Restore and Reset to Factory.................................................................................... 44
4.2.5 Firmware Upgrade.................................................................................................................... 45
4.2.6 Network Utility .......................................................................................................................... 46
4.2.7 Format Database...................................................................................................................... 47
4.2.8 Reboot...................................................................................................................................... 48
4.3 Access To External Network With Service Domain ............................................................................... 49
4.3.1 Configure Service Domain........................................................................................................ 50
4.3.2 Configure Authentication .......................................................................................................... 55
4.3.2.1 Authentication Management .........................................................................................55
4.3.2.2 Configure Pregenerated Tickets ...................................................................................56

4.3.2.3 Configure On-Demand..................................................................................................62
4.3.2.3.1 Create Billing Plans..........................................................................................63
4.3.2.3.2 Create On-Demand Users ...............................................................................64
4.3.2.3.3 Configure External Payment Gateway .............................................................68
4.3.2.3.4 Configure Thermal Printer................................................................................71
4.3.2.3.5 Billing Plan Report ...........................................................................................76
4.3.2.3.6 Ticket Customization........................................................................................77
4.3.2.4 Configure Local Radius Accounts .................................................................................78
4.3.2.5 Configure Remote Radius Server.................................................................................81
4.3.2.6 Configure LDAP Server ................................................................................................82
4.3.2.7 Configure POP3 Server ................................................................................................83
4.3.3 Configure Privilege List............................................................................................................. 84
4.3.4 Configure Walled Garden ......................................................................................................... 85
4.3.5 Configure Notification ............................................................................................................... 86
4.3.6 Monitor Online Users................................................................................................................ 91
4.3.7 Log Information ........................................................................................................................ 92
4.4 Control your Managed AP ..................................................................................................................... 96
4.4.1 Discovery Managed AP ............................................................................................................ 96
4.4.2 Managed AP's Profiles Management........................................................................................ 98
4.4.3 Managed AP Batch Setup ...................................................................................................... 102
4.4.4 Managed AP Group Management .......................................................................................... 105
4.4.5 AP Group Status......................................................................................................................110
4.4.6 Website Monitor ........................................................................................................................112
4.5 Manage 3rd-Party AP.......................................................................................................................... 113
4.5.1 CGI Path Setup .......................................................................................................................113
4.5.2 3rd-Party AP Management ......................................................................................................115
4.5.3 3rd-Party AP Batch Setup Management..................................................................................116
4.5.4 3rd-Party AP Status .................................................................................................................119
4.6 Restrain the Users and Sharing Your Internal Service ........................................................................ 120
4.6.1 Configure Time Policy............................................................................................................. 120
4.6.2 IP Filter ................................................................................................................................... 121
4.6.3 MAC Filter .............................................................................................................................. 122
4.6.4 Virtual Server (Port/ IP Forwarding)........................................................................................ 123
4.6.5 DMZ........................................................................................................................................ 124
4.6.6 IP Routing............................................................................................................................... 125
4.7 Observer the Status............................................................................................................................. 127
4.7.1 Overview ................................................................................................................................ 127
4.7.2 Extra Info ................................................................................................................................ 128
4.7.3 Event Log ............................................................................................................................... 130
Appendix A. Web GUI valid Characters ....................................................................................131
Appendix B. System Manager Privileges .................................................................................137

Appendix D. Examples of Making Payments for End Users...................................................142
Appendix E. Issue Refund for PayPal.......................................................................................145
Appendix F. Example of AP Device Connection With VLAN ................................................149
Appendix G. Use Template to setup Managed APs..................................................................152
Appendix H. Use Auto Recovery To Setup Managed AP.........................................................155
Appendix I. AP Management API Description..........................................................................157

Chapter1.BeforeYouStart
1.1Preface
The WMS-308N is a full-featured Network Access Control Gateway / Controller that aggregates
up to 60 access points (APs), built-in 5000 local accounts/ on-demand accounts and delivers
centralized control and security for wireless deployments.
The WMS-308N is designed for applications in which a compact, cost-effective ”all-in-one”
networking solution is required. The WMS-308N included a policy forced firewall, Intelligent Dual-
WAN Load balance, Wireless LAN controller, IP sharing, and 4-Port Giga Ethernet switch in a
desktop-mount enclosure. This device centrallized configuration and management model enables
the controllers to be deployed, monitored, and controlled without local IT staff.
1.2PackageContents
WMS-308N x 1
CD-ROM (With User Manual and QIG) x 1
Power Adapter DC 12V 1.5A x 1
RJ-45 Ethernet Cable x 1
It is highly recommended to use all the supplies in the package instead of substituting any
components by other suppliers to guarantee best performance.

Chapter2.SystemOverview
2.1IntroductionofWMS-308N
The WMS-308N – applies to public access network such as WiFi-Hotspot, network management
guest access, hospitality deployments – which requires reliability, efficiency, and security. It
combines an IP Router / Firewall, Multi-WAN / QoS enforcement and Access Controller for
use in wireless environments. One single WMS-308N can serve up to 500 simultaneous users,
takes control over authentication, authorization, accounting and routing to the Internet as well as
to the operating central. Built-in AAA system allows the owners set up public access services
without extra RADIUS server.
2.2SystemConcept
WMS-308N Network Access Gateway / Controller provides authentication, authorization and
accounting for a wired/or wireless networks. Hotspot technology allows Internet providers to offer
Internet access to customers, while applying certain Internet use rules and limitation. It is
convenient for Internet cafes, hotels, airports, schools and universities. The Internet provider gets
complete tracking records of per customer time spent on the network, data amount sent/ received,
real-time accounting and more.
To begin browsing, a client must go through a registration process with the provider, and then
enter a Passcode/Username of access ticket in a browser Login window that appears on the
attempt to open a webpage. Hotspot technology proposes providers to establish and administrate
a user database, which can be useful for enterprise such as airports, hotels or universities that
offer wireless or Ethernet Internet connectivity to employees, students, guests or other groups of
users.

WMS-308N Network Access Control Gateway
User's Manual
7
2.3Specification
¾Access Point Management and Support
ÎWMS-308N Network Access Gateway / Controller Support
Max: 60 Access Points per Controller
Max: 500 wireless client per Controller
Provide Local Account : 5000
ÎAP Management – Control - Monitoring
Centralized AP Management
9AP Group management –maintain a set of setting templates that simplify the task to assign the
same setting to multiple APs
9AP-Automatic configuration and provisioning by WMS-308N
9Locally maintained configuration profiles for managed APs
9Auto discovery for managed APs
9Automatic recovery of APs in case of system failure
9Central firmware Upgrade-Select multiple APs and upgrade their firmware at the same time ,
including bulk upgrade
9Remote Firmware upgrade
9Zero Configuration technology to restore defective AP’s setting onto the replacement AP
Central AP Control
9Provides MAC address Control list of client stations for each managed APs
9Access Filter
9Time-based AP access control
9Single UI for upgrading and restoring managed APs’ firmware
9WLAN Partition – if enabled, WLAN clients are not allowed to exchange data through the AP
(WAP-854NP, WAP-954GP, WAP-1954NP, WAP-1954NP-C, CPE-2010G / CPE-2000GN-1, WLO-
15814N / WLO-15802N)
9Max allowed APs
9Support Roaming – Intra-Switch , Inter-band , Inter-Switch
Central AP Monitoring
9Monitor AP Status
9The number of associated clients to the AP
9The AP RF information
9Associated Station List
9Monitoring IP List
9Load balancing based on number of users
9Load balancing based on utilization

WMS-308N Network Access Control Gateway
User's Manual
8
9AP User Statistic – Maintain all wireless clients connection history and depict statics in diagrams
9Support Monitor IP on third-party APs
9System alarms and status reports on managed APs
9Topology Monitor-list monitored device; periodically updates devices’ status
9AP life check-real time tracking monitors APs status (AP Health Checking)
9Provide centralized remote management via HTTP/SNMP interface
9Support MIB’s: 802.11, 802.1X, MIBII, RADIUS authentication, RADIUS Accounting
9SYSLOG support including remote servers
9Log-system log: operator action log
ÎRadio Resource Management
Automatic Channel Assignment and power setting for controlled APs
Simultaneous air monitoring and end user service
Self-healing coverage based on dynamic RF condition
Dense deployment options for capacity optimizations
Multiple BSSID per Radio: 8
Hot Standby at AP mode (supports fail-over as a standby AP)
Load Balance with another available AP (Real-time users limitation)
Radio Management
Coverage interference detection
ÎConvergence
8 Hardware queues per port
IEEE802.11p Class of Service/Quality of Service (CoS/QoS)
IEEE802.11e Wi-Fi Multimedia (WMM)
8 BSSID per radio
DiffServ Codpoint (DSCP)
ÎWireless Encryption
WPA personal and enterprise
WPA2 personal and enterprise
AES(CCMP): 128bit (FIP-197)
WEP40/64 and 104/128-bit
TKIP: RC4-40
SSL and TLS: RC4 128-bit and RSA1024 and 2048 bit
EAP-TLS, EAP-TTL/MSCHAPv2
ÎWireless Security
IEEE802.1X network login user authentication (EAP-MD5/TLS/TTLs)
EAP over LAN (EAPoL) transport with PEAP and EAP-TLS authentication
RADIUS server authentication (RFC2618)

WMS-308N Network Access Control Gateway
User's Manual
9
IEEE802.1X user authentication of controller management on controller Telnet and console sessions
Multiple access privilege levels
Hierarchical management and password protection for management interface
EAP offload for AAA server scalability and survivability
Stateful 802.1X authentication for standalone APs
SSID and Location based authentication
Multi-SSID support for operation of Multiple WLANs
Simultaneous Centralized and distributed WLAN support
ÎIdentity –Based Security
802.1X Authentication with WPA,WAP2 and 802.11i
Local Accounts of 802.1X Authentication
Support RADIUS /LDAP for AAA server
User Name and encryption key binding for strong network identity creation
Local User Data Base for AAA fail-over protection
ÎWireless Roaming Support
Inter AP roaming
Fast roaming
L2 roaming
¾User Management
ÎSupport 500 simultaneous authentication users
ÎMax 5000 Pregenerated/ On-Demand/ Local RADIUS/ authentication users
ÎUsers Session Management
ÎConfigurable user Black list (with schedule)
ÎAllows MAC address and user identity binding for local user authentication
ÎAuthentication methods supported: Pregenerated/ On-Demand, Local RADIUS, LDAP, and
Remote RADIUS and POP3
ÎSSL protected login portal page
ÎSession idle timer
ÎLogin Session idle time out setting
ÎSession and account expiration control
ÎUser Log and traffic statistic notification via automatically email service
ÎLogin time frame control
ÎSession limit
ÎReal-Time Online Users Traffic Statistic Reporting
ÎSupport local account roaming

WMS-308N Network Access Control Gateway
User's Manual
10
ÎSeamless Mobility: User-centric networking manages wired and wireless users as they roam
between ports or wireless APs
¾Service Domain
ÎIntegrating with WAP-854NP/ WAP-954GP / WAP-1954NP / WAP-1954NP-C and other future
products to have Service Domain feature and each Service Domain can have its own settings:
ÎThe network is divided into maximum of 8 groups, each defined by VLAN Tag
ÎEach Domain has its own (1) login portal page (2) authentication options (3) LAN/VLAN
interface IP address range (4) Session number limit control (5) Traffic shaping (6) IP
Plug and Play (IP PnP) (7) Multiple Authentication
ÎEnable DHCP or not, and DHCP address range
ÎEnable authentication or not
ÎTypes of authentication options (Local, POP3, RADIUS, LDAP, On-Demand and
Pregenerated)
ÎWeb login/ logout/ redirected page (customizable)
ÎDefault Policy
NAT or Route Mode
Specific Route (WAN1 or WAN2 , or a specified gateway)
Login schedule
Bandwidth (max/min)
¾Authentication
ÎAuthentication : single sign-on (SSO) client with authentication integrated into the local
authentication environment through local/domain, LDAP, RADIUS, MAC authentication, and
802.1X
ÎCustomizable Login and Logout Portal Pages
ÎCustomizable Advertisement Links on Login Portal Page
ÎUser authentication with UAM (Universal Access Method), 802.1X/EAPoLAN, MAC address
ÎAllow MAC address and user identity binding for local user authentication
ÎNo. Of Registered RADIUS Servers: 2
ÎSupport MAC control list (ACL)
ÎSupport Multiple Login service on one Accounts
ÎSupport auto-expired guest accounts
ÎUsers can be divided into user groups
ÎEach group (role) may get different network policies in different service zones
ÎMax simultaneous user session (TCP/UDP) limit

WMS-308N Network Access Control Gateway
User's Manual
11
ÎConfigurable user black list
ÎExport/Import local users list to/from a text file
ÎWeb-based Captive Portal for SSL browser-based authentication
ÎAuthentication Type
ÎIEEE802.1X (EAP, LEAP, EAP-TLS, EAP-TTLS, EAP-GTC, EAP-MD5)
RFC2865 RADIUS Authentication
RFC3579 RADIUS Support for EAP
RFC3748 Extensible Authentication Protocol
MAC Address authentication
Web-based captive portal authentication
¾Authorization
Authorization: access control to network resource such as protected network with Intranet,
Internet, bandwidth, VPN, and full stateful packet firewall
¾Accounting
ÎProvides billing plans for Pregenerated accounts
ÎProvides billing plans for On-Demand accounts
ÎEnables session expiration control for On-Demand accounts by time (hour) and data volume
(MB)
ÎDetailed per-user traffic history based on time and data volume for both local and on-demand
accounts
ÎSupport local on-demand and external RADIUS server
ÎContain 10 configurable billing plans for on-demand accounts
ÎSupport credit card billing system by PayPal
ÎProvide session expiration control for on-demand accounts
ÎSupport automatic email network traffic history
¾Dual WAN
ÎLoad Balancing
Outbound Fault Tolerance
Outbound load balance
Multiple Domain Support
By Traffic
ÎBandwidth Management by individual and distribution on different network(Service Domain)
ÎWAN Connection Detection

WMS-308N Network Access Control Gateway
User's Manual
12
¾QoS Enforcement
ÎPacket classification via DSCP (Differentiated Services code Point )
ÎDiff/ToS
ÎIEEE802.11p/CoS
ÎIEEE 802.1Q Tag VLAN priority control
ÎIEEE 802.11e WMM
ÎAutomatic mapping of WMM priorities to 802.1p and IP DSCP
ÎIGMP Snooping for efficient multicast delivery
ÎUpload and Download Traffic Management
¾Firewall
ÎBuilt-in DoS attack protection
ÎInspection Full stateful packet filter
ÎAccess Control List
ÎLayer 7 Protocol Blocking
ÎMultiple Domain Support
ÎActive Firewall Session – 16,000
¾Network
ÎSupport NAT or Router Mode
ÎSupport Static IP, Dynamic IP (DHCP Client), PPPoE and PPTP on WAN connection
ÎDHCP Server per Interface; Multiple DHCP Networks
Î802.3 Bridging
ÎProxy DNS/Dynamic DNS
ÎIP/Port destination redirection
ÎDMZ server mapping
ÎVirtual server mapping
ÎH.323 pass-through
ÎBuilt-in with DHCP server
ÎSupport Static Routing
ÎBinding VLAN with Ethernet interface
ÎSupport MAC Filter

WMS-308N Network Access Control Gateway
User's Manual
13
ÎSupport IP Filter
ÎSupport Walled garden (free surfing zone)
ÎSupport MAC-address and IP –address pass through
ÎSupport IP Plug and Play (IP PnP)
¾System Administration
ÎThree administrator accounts
ÎProvide customizable login and logout portal page
ÎCLI access (Remote Management) via Telnet and SSH
ÎRemote firmware upgrade (via the Web)
ÎUtilities to backup and restore the system configuration
ÎFull Statistics and Status Reporting
ÎReal-time traffic monitoring
ÎPing Watchdog
¾Network Management
ÎEvent Syslog
ÎStatus monitoring of on-line users
ÎIP-based monitoring of network devices
ÎInterface connection status
ÎSupport Syslog for diagnosing and troubleshooting
ÎUser traffic history logging
ÎUser’s session log can be sent to Syslog server
ÎRemote Syslog reporting to external server
ÎTraffic Analysis and Statistics
ÎSNMP v1, v2c, v3
ÎSNMP Traps to a list of IP Addresses
ÎSupport MIB-II
ÎNTP Time Synchronization
ÎAdministrative Access : HTTP / HTTPS

WMS-308N Network Access Control Gateway
User's Manual
14
WMS-308N Hardware Specifications
Base Platform 32-bit , MIPS24K Processor
CPU Clock Speed 680 MHz
Serial Port 1 (DB-9)
USB Port 1 ( Optional 3G interface radio with major brands – ODM only)
Reset Switch Built-in Push-button momentary contact switch
Ethernet
Configuration
10/100/1000 BASE-TX auto-negotiation Ethernet port x 6 (RJ-45
connector)
WAN * 2
LAN * 4
DRAM On board : 256Mbytes
Flash On board : 32 Mbytes
CF Socket 1 (reserved for option)
Built-In LED
Indicators
1 * Power ; 1 * Status, 1 * Net Status ( This is for AP management, when
system can't detect managed AP )
Environmental & Mechanical Characteristics
Operating
Temperature
0 °C ~ 55 °C
Storage Temperature -20 °C ~ 75 °C
Operating Humidity 10% to 80% Non-Condensing
Storage Humidity 5% to 90% Non-Condensing
Power Supply 110 – 220V AC Power; 12 VDC, 1.5A input.
Unit Dimensions 243 x 150 x 45.5 (mm) (Width x Depth x Height)
Unit Weight 1.4 Kg
Form Factor Wall Mountable , Metal case
Certifications FCC/CE

WMS-308N Network Access Control Gateway
User's Manual
15
Chapter3.BaseInstallations
3.1Installations
3.1.1SystemRequirements
¾Standard 10/100Base T including five network cables with RJ-45 connectors
¾All PCs need to install the TCP/IP network protocol
3.1.2PanelFunctionDescriptions
Front Panel
1. Power/Status :
ÎLED Green ON indicates power on, OFF indicates power off.
ÎWhen system restart, LED Amber will flash three times after system up.
ÎLED Amber ON indicate the Flash is busy(For example, format database, create or delete accounts...etc)
2. Console : The serial RS-232 DB9 cable attaches here.
3. Reset : Press and hold the button for more than 10 seconds until Power/Status LED Amber FLASH to reset
the system to default configurations. After you release button, the LED Amber will ON and system’s
database will be formatted until LED Green ON to restart system.
4. WAN1/WAN2 : Two WAN ports are available on the system. LED Green ON indicates 10/100-Mbps link is
established on the port. LED Amber ON indicates 1000-Mbps link is established on the port.
5. LAN : Clients devices connect to WMS-308N via LAN ports

WMS-308N Network Access Control Gateway
User's Manual
16
Rear Panel
1. Power SOCKET (12V DC) : Attach the power socket here.

WMS-308N Network Access Control Gateway
User's Manual
17
3.1.3HardwareInstallation
Please follow the steps mentioned below to install the hardware of WMS-308N
1. Place the WMS-308N at a best location.
The best location for WMS-308N is usually at the center of your wireless network.
2. Connect WMS-308N to your outbound network device.
Connect one end of the Ethernet cable to the WAN1/WAN2 port of WMS-308N on the front panel. On your
environment, connect the other end of the cable to the external Internet . The WAN1/WAN2 LED indicator
should be ON to indicate a proper connection.
3. Connect WMS-308N to your network device.
Connect one end of the Ethernet cable to LAN port of WMS-308N on the front panel. Connect the other end
of cable to a PC for configuring the system. The LAN LED indicator should be ON to indicate a proper
connection.
4. Connect the DC power adapter to the WMS-308N power socket on the rear panel.
Please only use the power adapter supplied with the WMS-308N package. Using a different
power adapter may damage this system
Now, the hardware installation is completed.
To double verify the wired connection between WMS-308N and your switch/router/hub, please
check the LED status indication of these network devices.

WMS-308N Network Access Control Gateway
User's Manual
18
3.2SoftwareConfiguration
3.2.1GettingStart
Step :
1. Once the hardware installation is done, set DHCP in TCP/IP of the administrator's PC to get an IP address
automatically. Connect the PC to the LAN port of WMS-308N. An IP address will be assigned to the PC
automatically via the WMS-308N.
2. Launch a web browser to access the web GUI of WMS-308N by entering “http://192.168.2.254” in the
address field.
3. The following Administrator Login Page will appear. Enter “root” in the Username field, and “default” in the
Password field. Click OK button to login.
If you can't get the login screen, you may have incorrectly set your PC to obtain an IP address
automatically from LAN port or the IP address used does not have the same subnet as the URL.
Please use default IP address such as 192.168.2.x in your network and then try it again.

WMS-308N Network Access Control Gateway
User's Manual
19
You can login as root, admin or operator. The default username and password as follows.
¾Root : The administrator can access all area of the WMS-308N
Username : root
Password : default
¾admin : The admin can access the area under Service Domain, Wireless and Advanced setting (Please see
Appendix B.)
Username : admin
Password : admin
¾operator : The operator only can access the area of On-Demand authentication to create, edit and print out
the new on-demand user accounts. (Please see Appendix B.)
Username : operator
Password : 1234
4. After a successful login, the “Home Page” will appear on the screen.


WMS-308N Network Access Control Gateway
User's Manual
20
3.2.2QuickConfiguration
WMS-308N provides wireless and wired network service with authentication required for clients in Service
Domain. Clients in the each Service Domain are isolated with each other. WMS-308N supports 8 Service
Domains, Domain-0 to Domain-7. Administrator can select authentication type on each Service Domain. If
Authentication Required is enabled, the clients are required to get authenticated successfully before access
the Internet.
Configuration Steps :
Step 1 : Change Root's Password
ÎClick System -> Management, the Management Setup page will appear.
ÎEnter a New Root Password for the Root account ad retype in the Check Root Password field. (4-30
alphanumeric and specific characters; not support Space)
ÎClick Save button.
For security concern, it is strongly recommended to change the Root password.
Step 2 : Select Connection Type for WAN1 Port and Set DNS Server
ÎClick System -> WAN, the WAN Setup page will appear.
ÎSelect the appropriate Connection Type for WAN1 port, there are four types of WAN1 connections to be
selected from: Static IP, Dynamic IP, PPPoE Client and PPTP Client.
ÎEnter the IP Address of a DNS Server provided by your ISP(Internet Service Provider). Contact the ISP if the
DNS IP Address is unknown.
ÎClick Save button.