ZyXEL Communications NWA-3550 Instruction Manual

ZyXEL Confidential
360AAM1C0.rtf 1/13
ZyXEL
Firmware Release Note
NWA3550
Release 3.60(AAM.1)C0
Date: August 04, 2008
Author: LiKuang Tsai

ZyXEL Confidential
360AAM1C0.rtf 2/13
ZyXEL NWA3550 Standard Version
release 3.60(AAM.1)C0
Release Note
Date: August 04, 2008
Supported Platforms:
ZyXEL NWA3550.
Versions:
ZyNOS F/W Version : V3.60(AAM.1) | 08/04/2008 11:29:59
Bootbase Version: V1.04 | 05/22/2007 14:37:02
Notes:
1. Online help in eWC is not ready.
2. In Bridge/Repeater modes, wireless scan and rogue AP detection are not supported.
3. In MBSSID mode, if there is no BSSID enabled, wireless scan and rogue AP
detection are not supported.
4. In AP+Bridge mode, auto traffic classification (ATC) is not supported.
5. Rogue AP detection will affect the quality of VoIP service and may cause stations
disconnected.
6. SMTP authentication only allows the account owner as the mail receiver.
7. Enable “L2 isolation” will cause “IntraBSS blocking” be enabled.
8. 802.11h is supported only in AP and MBSSID mode.
5.25~5.7 GHz is supported only in AP and MBSSID mode.
No complete TPC support since no TPC report and related IEs in Beacon/Probe
response.
COT (Channel Observation Time) is 60~65 secs.
9. In AP+Bridge mode, WMM voice is not enabled for VoIP SSID profile, because it
will affect the performance of WDS links.
10. NWA3550 is a country dependent product. Please setup correct country code before
shipping.
11. “Enable Admin on RADIUS” will have a compatible problem with Funk server.
If you login used correct account and password at first time, then logout.
You can find that login use any account and password will success.
If you restart Funk server after first correct login, the problem will solved.
12. SMT is removed to save system resource to support Managed AP mode.
13. If your system name is entirely numeric, this name can’t be used to access web GUI
according to NETBIOS naming rule.

ZyXEL Confidential
360AAM1C0.rtf 3/13
Known Issues:
1. In 802.11b+g mode, CTS-to-self is used to replace RTS/CTS.
2. Fragmentation threshold shall be an even number.
3. NWA3550 support dual 802.11a/b/g configurable modules. However, it does not
recommend to set both WLAN modules in same band, for example, Ch1 for WLAN1
and Ch11 for WLAN2. It is possible that each card will interfere with each other. If
user must use same band operation, external antennas placed as far as possible is
suggested.
CI Command List:
Features:
Modification in 3.60(AAM.1)C0 | 08/04/2008
1. [FEATURE ENHANCED]
Convert to FCS version.
2. [BUG FIXED]
SPR: 080729800
Symptom:
Default value of RADIUS accounting interval is not 600 seconds.
Modification in 3.60(AAM.1)b2 | 07/04/2008
1. [FEATURE ENHANCED]
Update default value of accounting interval to 600 seconds.
2. [BUG FIXED]
SNMPv3 Authentication Vulnerabilities
Description: This vulnerability allows attackers to read and modify any
SNMP object that can be accessed by the impersonated user. Attackers
exploiting this vulnerability can view and modify the configuration of these
devices.
4. [BUG FIXED]
SPR: 080603184
Symptom: Association List show empty
Condition:
Check the association list from the status page and maintenance, one show empty
and the others have value.
5. [BUG FIXED]
SPR: 080603185
Symptom: The statistics page can’t resize
6. [BUG FIXED]
The SSID will be _ZyXEL during AP is booting up.
Modification in 3.60(AAM.1)b1 | 05/16/2008
1. [FEATURE ENHANCED]
Support CAPWAP protocol.
Access Controller (AC): NWA-3160.

ZyXEL Confidential
360AAM1C0.rtf 4/13
Wireless Termination Point (WTP): NWA-3160, NWA-3163, NWA-3500,
NWA3550.
2. [FEATURE ENHANCED]
Add two new methods to access web GUI
i. Type System Name as URL (if your System Name length is larger then 15
in your romfile, it will be changed to “NWA-Series” automatically.)
ii. Type zyxelXX:XX:XX as URL (XX:XX:XX means the last six number of
LAN MAC address)
3. [FEATURE ENHANCED]
Rogue AP Detection Enhancement (scan 802.11n AP)
4. [FEATURE ENHANCED]
DTIM and beacon interval can be change through web GUI.
5. [FEATURE ENHANCED]
Bridge/Repeater mode and AP + Bridge mode support DFS channel
6. [FEATURE ENHANCED]
Statistic data can be reset in AP Statistic page in AC controller mode
7. [FEATURE ENHANCED]
VLAN CI command is open to user.
8. [FEATURE ENHANCED]
Support A mode Tx power control.
9. [FEATURE ENHANCED]
Upgrade proprietary wireless MIB to ZYXEL_NWA_SERIES_v1.3.mib
10. [FEATURE ENHANCED]
Add hyperlink in Status page
11. [FEATURE ENHANCED]
Modify CI command “ip address” to save IP address in SPT.
12. [FEATURE ENHANCED]
Remove the limitation of “Auto Configuration”(Original function just only used CI
command “wlan” and “wcfg”).
13. [FEATURE ENHANCED]
Support rates configuration and antenna diversity in web GUI.
14. [BUG FIXED]
SPR: 080311577
Symptom:
IOP issue with X box live 360. (Xbox 360 wireless module can’t associate to
DUT with none security mode.)
15. [BUG FIXED]
SPR: 080219560
Symptom:
Sometimes configure with 11a mode, enable Rogue AP detection, and change the
channel to DFS channel, but GUI show the operating channel is other
(cha001~011).
Condition:
Step1:Restart DUT.
Step2:Changed the channel to DFS channel and enable Rogue AP Detection.
Step3:Apply

ZyXEL Confidential
360AAM1C0.rtf 5/13
Step4:Check the GUI, it show operating channel error and beacon stop.
16. [BUG FIXED]
Symptom: VLAN ID assign by RADIUS issue
Condition:
1. Enable VLAN assign by RADIUS.
2. Set VLAN ID "200" on RADIUS, and "200" didn't on VLAN mapping table.
3. AP will convert char "200" to number "512".
4. The correct VLAN ID should be convert to "200"
Modification in 3.60(AAM.0)C0 | 03/14/2008
1. [FEATURE ENHANCED]
Convert to FCS version.
Modification in 3.60(AAM.0)b1 | 02/01/2008
1. First release for C3 firmware.

ZyXEL Confidential
360AAM1C0.rtf 6/13
Appendix 1: CI Command List
Command Class List Table
System Related Command Exit Command Ethernet Related Command
Wireless LAN Related Command IP Related Command Bridge Related Command
Bandwidth Management Related
Command Certificates Related Command RADIUS Related Command
802.1x Related Command Wireless LAN Profile Configuration
Related Command Rogue AP Related Command
System Related Command Home
Command Description
sys
atsh show firmware and system information
callhist
display display call history
remove <index> remove entry from call history
countrycode [countrycode] show/set country code
datetime
date [year] [month] [day] show/set current date
time [hour] [minute] [second] show/set current time
period [day] show/set resync period
sync resync datetime with time server
domainname display domain name
edit <filename> edit a text file
extraphnum maintain extra phone numbers for outcalls
add <set 1-3> <1st phone num> [2nd
phone num] add extra phone numbers
display display extra phone numbers
node <num> set all extend phone number to remote node
<num>
remove <set 1-3> remove extra phone numbers
reset reset flag and mask
feature display feature bit
hostname [hostname] display system hostname
logs
category
[8021x|access|error|icmp|mten|packetfi
lter|ppp|cdr|pki|tls|remote|tcpreset|wirel
ess] [0|1|2|3] [0|1]
set various category log type setting
display display current logs setting
clear clear log
disp display log
errlog
clear clear error log
disp display error log
online [on|off] turn on/off error log online display
load load log
mail
alertAddr <mail address> alert mail target address
clearLog <no|yes> set clear log after sending mail
display display current mail setting

ZyXEL Confidential
360AAM1C0.rtf 7/13
logAddr log mail target address
schedule
display display current schedule setting
hour <0-23> set hourly schedule
minute <0-59> set minute
policy <0-5> set schedule policy
week <0-6> set weekly schedule
server <domain|IP> set mail server
subject <subject> set mail subjec
t
save save log
syslog
active <no|yes> set syslog active
display display current syslog setting
facility <1-7> set log facility
server <domain|IP> set syslog server
dupcheck <0|1> [seconds] set log duplicate check setting
updateSvrIP <minutes> set minutes to update log server IP address
rn
load <entry no.> load remote node information
disp <entry no.>(0:working buffer) display remote node information
nat <none|sua|full_feature> config remote node nat
nailup <no|yes> config remote node nailup
save [entry no.] save remote node information
stdio [second] change terminal timeout value
time [hour [min [sec]]] display/set system time
trcdisp parse, brief,
disp monitor packets
trclog
trcpacket
version display RAS code and driver version
view <filename> view a text file
wdog
switch [on|off] set on/off wdog
cnt [value] display watchdog counts value: 0-34463
romreset restore default romfile
pwderrtm [minutes] set password error timeout value
debug
socket display system socket information
filter
netbios
cpu
display display CPU utilization
ExitCommand Home
Command Description
exit exit smt menu
Ethernet Related Command Home
Command Description
ether
config display LAN configuration information

ZyXEL Confidential
360AAM1C0.rtf 8/13
driver
cnt
disp <name> display ether driver counters
ioctl <ch_name> Useless in this stage.
status <ch_name> see LAN status
version see ethernet device type
edit
load <ether no.> load ether data from spt
save save ether data to sp
t
Wireless LAN Related Command Home
Command Description
wlan
[0|1] select wlan interface (0:First, 1:Second)
active <on|off> set on/off wlan
association display association list
chid <channel id> set channel
essid <ess id> set ESS ID, only for the first ssid profile
fraThreshold set wlan fragmentation threshold
iapp display iapp statistics information
led <on|off> set wlan breath led
mcastRate set the wlan multicast rate
opmode <0-3> set wlan operation mode
(0=AP, 1=AP+Bridge, 2=Bridge only,
3=MESSID)
outputpower <0-4> set wlanoutput power level
(0=100%, 1=50%, 2=25%, 3=12.5%, 4=min)
radio <1-4> set wlan radio mode
(1: B Only, 2 G Only, 3: B+G, 4:A Only)
rtsThreshold set wlan RTS threshold
removeSTA <MAC> remove the specified station
reset reset wlan interface
scan scan wireless channels
ssidprofile
set <profile name 1> [profile
name 2] … select active SSID profiles
show display current selected SSID profiles
version display WLAN version information
wds display WDS information
vlan
config <ssid profile index> <vlan
id> <2nd rx vlan id > set VLAN ID for SSID profile
nativeVLAN <native vlan id > set management VLAN ID
status display VLAN settings
IP Related Command Home
Command Description
ip
address [addr] display host ip address
arp
status <iface> display ip arp status

ZyXEL Confidential
360AAM1C0.rtf 9/13
dhcp <iface>
client
release release DHCP client IP
renew renew DHCP client IP
status [option] show dhcp status
dns
query
stats
httpd
icmp
status display icmp statistic counter
discovery <iface> [on|off] set icmp router discovery flag
ifconfig [iface] [ipaddr] [broadcast <addr> |mtu
<value>|dynamic] configure network interface
ping <hostid> ping remote host
route
status [if] display routing table
add <dest_addr|default>[/<bits>]
<gateway> [<metric>] add route
addiface <dest_addr|default>[/<bits>]
<gateway> [<metric>] add an entry to the routing table to iface
addprivate <dest_addr|default>[/<bits>]
<gateway> [<metric>] add private route
drop <host addr> [/<bits>] drop a route
status display ip statistic counters
udp
status display udp status
rip
tcp
status [tcb] [<interval>] display TCP statistic counters
telnet <host> [port] execute telnet clinet command
tftp
traceroute <host> [ttl] [wait] [queries] send probes to trace route of a remote host
xparent
join <iface1> [<iface2>] join iface2 to iface1 group
break <iface> break iface to leave ipxparent group
stroute
dropIcmp <0:no|1:yes> set drop fragment ICMP packets
Bridge Related Command Home
Command Description
Bridge
cnt related to bridge routing statistic table
disp display bridge route counter
clear clear bridge route counter
stat related to bridge packet statistic table
disp display bridge route packet counter
clear clear bridge route packet counter
rstp
bridge
enable enable RSTP
disable disable RSTP

ZyXEL Confidential
360AAM1C0.rtf 10/13
priority <priority> set RSTP priority value
maxAge <max age> set RSTP max age value
helloTime <hello time> set RSTP hello time value
forwardDelay <delay> set RSTP forwarding delay value
version display RSTP version
port
enable <port no.> enable RSTP port
disable <port no.> disable RSTP port
pathCost <port no.>
<Cost|0:Auto> set port pathCost, 0 = auto value
priority <port no.>
<priority> set port priority
edgePort <port no.>
<0|1> set port is edgeport or not
p2pLink <port no.>
<0|1|2> set p2pLink, 2 = auto, 1 = true, 0 = false
mcheck <port no.> set port mcheck
disp show current RSTP detaied information
trace <debug level> set RSTP debug flag
state show current RSTP brief status
Bandwidth Management Related Command Home
Command Description
bm
monitor <interface> monitor bandwidth management status
threshold high/low <value> set auto traffic classification threshold
Certificates Related Command Home
Command Description
certificates
my_cert create Create Self-Signed Certificate
import Import Self-Signed Certificate
export <name> Export Sel
f
-Signed Certificate
view Display Self-Signed Certificate
delete <name> Delete Self-Signed Certificate
list List Self-Signed Certificate
ca_trusted create Create Trusted Certificate
RADIUS Related Command Home
Command Description
radius
show display radius settings
802.1x Related Command Home
Command Description
8021x
debug level [debug level] set ieee802.1x debug message level
trace show all supplications in the supplication table
user [username] show the specified user status in the supplicant
table
pmkcache show [channel] show pmk cache of the specified channel.
flush [channel] flush pmk cache of the specified channel.

ZyXEL Confidential
360AAM1C0.rtf 11/13
Wireless LAN Profile Configuration Related Command Home
Comman
d
Description
wcfg
ssid
<1/2/3/…/16
>
name <profile name> set name of the SSID profile
ssid <ssid> set SSID
hidenssid <enable | disable> enable/disable hidden ssid
intrabss <enable | disable> enable/disable intrabss blocking
security <security profile name> set selected security profile index
radius <radius profile name> set selected radius profile index
l2isolation <enable | disable>
<profile name> enable/disable L2 isolation profile
macfilter
<enable | disable>
<profile name> enable/disable macfilter profile
qos <0-6> set qos mode of the SSID profile
(0:NONE, 1:WMM,
2:WMM_VO, 3:WMM_VI,
4:WMM_BE, 5:WMM_BK,
6:ATC, 7:ATC_WMM)
clea
r
clear profile setting to default
save save current profile to flash
show display current profile information
display display a brief list of all SSID
profiles
saveall save all changed profiles into flash
security
<1/2/3/…/16
>
name <profile name> set name of the security profile
mode <security mode> security system mode selection.
wpa2 <pmkcache: 0:off 1:on>
<preauth: 0:off 1:on> enable/disable pmk cache and pre-authentication for WPA2
wep
keysize <64 | 128> < ascii | hex > set WEP keysize (64-bits /
128-
b
its) and WEP key encoding
auth <open | shared | auto> set WEP authentication method
key1 set WEP key string 1
key2 set WEP key string 2
key3 set WEP key string 3
key4 set WEP key string 4
keyindex key index (1~4)
reauthtime <seconds> time for re-authentication
0 for disable re-authentication
idletime <seconds> idle time before force
de-association
groupkeytime <seconds> time for group key update
passphrase <key string> passphrase for WPA-PSK and
WPA2-PSK
clear clear profile setting to default

ZyXEL Confidential
360AAM1C0.rtf 12/13
save save current profile to flash
show display current profile information
acct <0:off 1:on> <interval> set on/off accounting update and
interval
display display a brief list of all security
profiles
saveall save all changed profiles into flash
radius
<1/2/3/4>
name <profile name> set name of the radius profile
primaryauth <host> <port> <shared
secret> <enable | disable> set primary radius authentication server setting
primaryacct <host> <port> <shared
secret> <enable | disable> set primary radius accounting server setting
backupauth <host> <port> <shared
secret> <enable | disable> set backup radius authentication server setting
backupacct <host> <port> <shared
secret> <enable | disable> set backup radius accounting server setting
clear clear profile setting to default
save save current profile to flash
show display current profile information
display display a brief list of all radius
profiles
saveall save all changed profiles into flash
autocfg
server <IP> <filename> setup auto configuration TFTP
server IP and filename, only
works when static IP is used
dhcp [enable | disable] control auto configuration through
DHCP setting
macfilter
<1/2/3/…/16
>
name <profile name> set name of the macfilter profile
action <deny | allow> set action of the macfilter profile
macaddr <entry ID> <MAC
address> set mac address of the macfilter profile entry
description <entry ID> <description
string> set description of the l2isolation profile entry
clear clear profile setting to default
save save current profile to flash
show display current profile information
display display a brief list of all macfilter
profiles
saveall save all changed profiles into flash
l2isolation
<1/2/3/…/16
>
name <profile name> set name of the l2isolation profile
macaddr <entry ID> <MAC
address> set mac address of the l2isolation profile entry
description <entry ID> <description set description of the l2isolation

ZyXEL Confidential
360AAM1C0.rtf 13/13
string> profile entry
clear clear profile setting to default
save save current profile to flash
show display current profile information
display display a brief list of all
l2isolation profiles
saveall save all changed profiles into flash
Rogue AP Related Command Home
Command Description
rogueAP
config [0:off 1:on] [interval] set on/off rogue ap detection and interval
editlist [0:del 1:add] [MAC] [Description] add/delete entry of friendly AP list
clear clear friendly AP list
refresh refresh friendly AP list
rogueAPlist display rogue AP list
friendlyAPlist display friendly AP list