ZyXEL Communications NXC2500 User manual

1/225
www.zyxel.com
NXC Series
NXC 2500/ 5500
NXC Controllers
Firmware Version 5.10
Edition 23, 10/2017
Handbook
Default Login Details
LAN Port IP Address
https://192.168.1.1
User Name
admin
Password
1234
Copyright © 2017 ZyXEL
Communications Corporation

2/225
www.zyxel.com
Contents
Manage APs through NXC Controller..........................................................7
1.1 How to Manage APs through NXC Controller.......................................7
1.1.1 Configuration in the AP................................................................... 8
1.1.2 Test the Result ................................................................................... 9
1.1.3 What Could Go Wrong?............................................................... 10
1.2 How to Enlarge Managed AP Number with License ..........................11
1.2.1 Device Registration ....................................................................... 12
1.2.2 Service Registration ....................................................................... 14
1.2.3 License Refresh............................................................................... 15
1.2.4 Test the Result ................................................................................. 16
Set up a Wireless Connection Environment ..............................................17
2.1 How to Set WiFi Multiple SSID for Office Environment? .......................17
2.1.1 When USG is DHCP Server for VLAN10 and VLAN20................. 17
2.1.1.1 Configure NXC‟s Interface to Go to Internet ......................... 18
2.1.1.2 Configure VLAN .......................................................................... 19
2.1.1.3 Configure Security and SSID...................................................... 23
2.1.1.4 Configure AP Profile to Broadcast SSID ................................... 26
2.1.2 When NXC is DHCP Server for VLAN10 and VLAN20 ................ 27
2.1.2.1 Configure Interface ge1 to Go to Internet............................. 28
2.1.2.2 Configure VLAN .......................................................................... 29
2.1.2.3 Set Policy Route .......................................................................... 33
2.1.2.4 Configure Security and SSID...................................................... 35
2.1.2.5 Configure AP Profile to Broadcast SSID ................................... 38
2.1.3 Test the Result ................................................................................. 39
2.1.4 What Could Go Wrong?............................................................... 40
2.2 How to Set up Fail Over/Fall Back?......................................................41
2.2.1 Configure Fail Over and Fall Back .............................................. 42
2.2.2 Test the Result ................................................................................. 43
2.2.3 What Could Go Wrong?............................................................... 44
2.3 How to Set up Mesh to Extend Wireless Coverage?...........................45
2.3.1 Configure ZyMesh Profile .............................................................. 46
2.3.2 Configure Root AP and Repeater AP......................................... 47
2.3.3 Test the Result ................................................................................. 48
2.3.4 What Could Go Wrong?............................................................... 49

3/225
www.zyxel.com
2.4 How to Set up Seamless Wireless Roaming?.......................................51
2.4.1 Configure APs via AP Group ........................................................ 52
2.4.2 Test the Result ................................................................................. 55
2.4.3 What Could Go Wrong?............................................................... 56
Optimize the Wireless Environment............................................................59
3.1 How to Set up User Ratio of 2.4GHz and 5GHz to Avoid WiFi
Congestion? .................................................................................................59
3.1.1 Configure Band Select.................................................................. 60
3.1.2 Test the Result ................................................................................. 64
3.1.3 What Could Go Wrong?............................................................... 65
3.2 How to Set up RSSI Threshold to Avoid Low Rate User Connection
Affected Wireless Performance?................................................................66
3.2.1 Configure Radio Setting for RSSI Threshold ................................ 67
3.2.2 Apply Radio with RSSI Threshold .................................................. 68
3.2.3 Test the Result ................................................................................. 69
3.3 How to Set up Rate Limiting for Bandwidth Control? ..........................70
3.3.1 Configure Rate Limiting ................................................................ 71
3.3.2 Apply Rate Limiting to Management AP ................................... 72
3.3.3 Test the Result ................................................................................. 73
3.4 How to Share AP loading to Optimize Wireless Performance? .........74
3.4.1 Configure Load Balance to “by Station Number” ................... 75
3.4.2 Configure Load Balance to “by Traffic Level” .......................... 76
3.4.3 Configure Load Balance to “by Smart Classroom” ................. 77
3.4.4 Test the Result ................................................................................. 78
3.4.5 What Could Go Wrong?............................................................... 80
Secure the Wireless Environment ...............................................................81
4.1 How to Configure 802.1x to Secure the Wireless Environment with an
External RADIUS Server? ..............................................................................81
4.1.1 Configure Radius Server Setting .................................................. 81
4.1.2 Configure AP Profile ...................................................................... 83
4.1.3 Test the Result ................................................................................. 85
4.1.4 What Could Go Wrong ................................................................. 90
4.2 How to Configure 802.1x to Secure the Wireless Environment with an
External AD Server? .....................................................................................91
4.2.1 Configure AD Server Setting......................................................... 92
4.2.2 Configure AP Profile ...................................................................... 95

4/225
www.zyxel.com
4.2.3 Test the Result ................................................................................. 97
4.2.4 What Could Go Wrong ............................................................... 102
4.3 How to Configure 802.1x to Secure the Wireless Environment with an
External LDAP Server?....................................................................................7
4.3.1 Configure LDAP Server Setting................................................... 104
4.3.2 Configure AP Profile .................................................................... 106
4.3.3 Test the Result ............................................................................... 108
4.3.4 What Could Go Wrong ............................................................... 109
4.4 How to Configure 802.1x to Secure the Wireless Environment with an
Internal RADIUS in NXC?............................................................................110
4.4.1 Configure Authentication Method Setting .............................. 111
4.4.2 Configure AP Profile .................................................................... 113
4.4.3 Test the Result ............................................................................... 115
4.5 How to Configure 802.1x to Secure the Wireless Environment with
Dynamic VLAN with NXC Controller Using External RADIUS Server? ....119
4.5.1 Configure Interface..................................................................... 121
4.5.2 Configure Radius Server Setting ................................................ 128
4.5.3 Configure AP Profile .................................................................... 129
4.5.4 Test the Result ............................................................................... 132
4.5.5 What Could Go Wrong ............................................................... 134
4.6 How to Configure Captive Portal? .....................................................135
4.6.1 Captive Portal Redirect on Controller?...........................................135
4.6.1.1 Configure Authentication Method Setting........................... 137
4.6.1.2 Configure Captive Portal ........................................................ 138
4.6.1.3 Configure AP Profile when USG is the Gateway.................. 140
4.6.1.4 Configure AP Profile when NXC is the Gateway ................. 142
4.6.1.5 Test the Result ............................................................................ 146
4.6.1.6 What Could Go Wrong ............................................................ 148
4.6.2 Captive Portal Redirect on AP?.......................................................150
4.6.2.1 Configure AP Profile and User................................................. 151
4.6.2.2 Configure Captive Portal ........................................................ 153
4.6.2.3 Broadcast SSlD........................................................................... 155
4.6.2.4 Test the Result ............................................................................ 157
4.6.2.5 What Could Go Wrong ............................................................ 158
4.6.3 Captive Portal with QR Code?.........................................................159
4.6.3.1 Configure AP Profile ................................................................. 160

5/225
www.zyxel.com
4.6.3.2 Configure VLAN ........................................................................ 163
4.6.3.3 Create Assistance Account.................................................... 165
4.6.3.4 Set Guest Address & Zone ....................................................... 167
4.6.3.5 Configure Captive Portal ........................................................ 168
4.6.3.6 Test the Result ............................................................................ 171
4.6.3.7 What Could Go Wrong ............................................................ 174
4.6.4 Captive Portal with External Webserver? .......................................160
4.6.4.1 Configure Interface.................................................................. 177
4.6.4.2 Configure Authentication Method Setting & Address........ 180
4.6.4.3 Configure Captive Portal ........................................................ 182
4.6.4.4 Configure AP Profile ................................................................. 184
4.6.4.5 Test the Result ............................................................................ 185
4.6.4.6 What Could Go Wrong ............................................................ 186
4.7 How to Generate and Import Certificate on NXC Controller? ........188
4.7.1 Create a Self-signed Certificate................................................ 189
4.7.2 Test the Result ............................................................................... 192
4.7.3 Create a Certification Request and Save It Locally for later
Manual Enrollment................................................................................ 193
4.7.4 Test the Result ............................................................................... 197
4.7.5 What Could Go Wrong ............................................................... 199
4.8 How to Defect the Rogue AP? ............................................................200
4.8.1 Configure AP to Monitor Mode ................................................. 201
4.8.2 Detected Devices and Containment ...................................... 202
4.8.3 Test the Result ............................................................................... 203
Maintain NXC Controller ...........................................................................204
5.1 How to Do Firmware upgrade ............................................................204
5.1.1 Firmware from GUI? ..........................................................................205
5.1.1.1 Firmware Upgrade on GUI....................................................... 206
5.1.1.2 Test the Result ............................................................................ 207
5.1.1.3 What Could Go Wrong ............................................................ 208
5.1.2 Firmware from FTP? ...........................................................................209
5.1.2.1 Firmware Upgrade on GUI....................................................... 210
5.1.2.2 Test the Result ............................................................................ 212
5.1.2.3 What Could Go Wrong ............................................................ 213
5.2 How to Reset the Controller/AP?........................................................214
5.2.1 Reset to Default from GUI........................................................... 215

6/225
www.zyxel.com
5.2.2 Reset to Default from Hardware ............................................... 215
5.2.3 Test the Result ............................................................................... 216
Trouble Shooting ........................................................................................217
6.1 How to Collect the Diagnostic Info? ..................................................217
6.1.1 Collect Diagnostic Info ............................................................... 218
6.1.2 Test the Result ............................................................................... 220
6.2 How to Configure the E-mail Settings for Sending Logs? .................221
6.2.1 Configure Log & Report.............................................................. 222
6.2.2 Test the Result ............................................................................... 224

7/225
www.zyxel.com
Manage APs through NXC Controller
1.1 How to Manage APs through NXC Controller
This example shows how to use the NXC controller to manage APs via
manual setting, DHCP option 138 and broadcast. In this case shown as
below, there are two subnets in the environment. The APs can find NXC
controller in the same subnet via broadcasting without any settings.
The APs in different subnet can find NXC controller by manually setting
NXC controller‟s IP or DHCP option 138 in DHCP server.
Figure 1 Manage APs through NXC Controller
Note:
All network IP addresses and subnet masks are used as examples in this article.
Please replace them with your actual network IP addresses and subnet masks. This
example was tested using USG20v2 (Firmware Version: V4.15), NXC5500 (Firmware
Version: 5.10), GS2210-8HP (Firmware Version: V4.30).

8/225
www.zyxel.com
1.1.1 Configuration in the AP
1In the same subnet (for AP1 and AP2), the APs don‟t
need to do any setting. The APs can find the NXC
controller via broadcast and NXC controller always
accepts APs to managed list by default. The NXC
controller manages the APs without any setting.
2In the different subnet (for AP3 and AP4), the APs need
to set the NXC controller‟s IP manually. Go to
CONFIGURATION > Network > AC Discovery, set
Discovery Setting to Manual and set the NXC controller‟s
IP 192.168.1.55 to Primary static AC IP. Click Apply to
apply the setting.
3Or, you can use DHCP option 138 in the DHCP server for the
APs which are in the different subnet from NXC controller.

9/225
www.zyxel.com
1.1.2 Test the Result
1When the APs and the NXC controller are in the same
subnet, the NXC controller manages the APs without any
settings. The result is visible in MONITOR > Wireless > AP
Information > AP List.
2When the APs and the NXC controller are in the different
subnets, the APs can find NXC controller through manually
setting NXC controller‟s IP or DHCP option 138. After the APs
find the NXC controller, the NXC controller can manage the
APs. The result is visible in MONITOR > Wireless > AP
Information > AP List.

10/225
www.zyxel.com
1.1.3 What Could Go Wrong?
1 To make sure the NXC controller goes to correct traffic
routing, please remember to set up the gateway in NXC
controller.
2 When you use the manual NXC controller IP or DHCP
option 138, please make sure the NXC controller‟s IP is
correct so that the APs can find the NXC controller.

11/225
www.zyxel.com
1.2 How to Enlarge Managed AP Number with License
This example shows how to enlarge managed AP number with license.
The default managed AP number for NXC2500 is 8 units and NXC5500 is
64 units. If you want to control more than default managed units, it‟s
necessary to import the license to enlarge managed AP number.
Figure 2 Enlarge Managed AP Number
Note:
All network IP addresses and subnet masks are used as examples in this article.
Please replace them with your actual network IP addresses and subnet masks. This
example was tested using USG20v2 (Firmware Version: V4.15), NXC2500 (Firmware
Version: 5.10), GS2210-8HP (Firmware Version: V4.30).

12/225
www.zyxel.com
1.2.1 Device Registration
1Click the hyperlink on NXC controller‟s GUI to connect
portal.myzyxel.com in CONFIGURATION > Licensing >
Registration.
2After log in the registration portal, click the Device
Registration to register a device by filling in the MAC Address
and Serial Number. Click Submit.

13/225
www.zyxel.com
3Click Next to activate security services on the device, and
click Close in next step.

14/225
www.zyxel.com
1.2.2 Service Registration
1Click Service Registration and fill in the License Key. Click
Submit to register the license key.
2Click Service Management, and click the Link. Select a
device, and then click Submit to activate the license key for
the selected device.

15/225
www.zyxel.com
1.2.3 License Refresh
1Click Service License Refresh in below path of NXC
controller web GUI.
CONFIGURATION > Licensing > Registration

16/225
www.zyxel.com
1.2.4 Test the Result
1The Count of Managed AP number changes from 8 to 16
in CONFIGURATION > Licensing > Registration.

17/225
www.zyxel.com
Set up a Wireless Connection Environment
2.1 How to Set WiFi Multiple SSID for Office Environment?
2.1.1 When USG is DHCP Server for VLAN10 and VLAN20
The example instructs how to configure VLANs and set different VLANs
for different SSIDs in NXC. In this example, USG is the only DHCP server in
the environment, and NXC only needs to set VLAN for passing traffic. In
this example, we configure interfaces, set VLANs, create security and
SSID profiles, and then configure AP profiles for managed APs.
Figure 3 Set Different VLANs for Different SSIDs When USG is DHCP
Server
Note:
All network IP addresses and subnet masks are used as examples in this article.
Please replace them with your actual network IP addresses and subnet masks. This
example was tested using USG20v2 (Firmware Version: V4.15), NXC5500 (Firmware
Version: 5.10), GS2210-8HP (Firmware Version: V4.30).

18/225
www.zyxel.com
2.1.1.1 Configure NXC’s Interface to Go to Internet
1Connect NXC controller to USG LAN port. In the USG, all
LAN ports are DHCP server for interface LAN, VLAN10,
VLAN20, and all the stations connected to APs get an IP
from the USG.
2In the NXC, go to CONFIGURATION > Network > Interface >
VLAN to set the NXC's IP address to be in the same subnet as
the USG's LAN IP and have the USG act as the gateway.
Double click vlan0 to edit IP Address Assignment section.
Click OK.

19/225
www.zyxel.com
2.1.1.2 Configure VLAN
1Connect Switch to NXC ge2 (P2), and connect all APs to the
switch.
2In the NXC, go to CONFIGURATION > Network > Interface >
VLAN, Click Add to create a new VLAN (VLAN10).

20/225
www.zyxel.com
3In General Settings, check Enable.
In Interface Properties, key in Interface Name: vlan10; set VID:
10
In Member Configuration, set ge2 to be a Member and Tx
Tagging to yes.
In IP Address Assignment, Use Fixed IP Address and key in IP
Address, Subnet Mask. Click OK.