ZyXEL Communications UAG5100 Instruction Manual

1/29
www.zyxel.com
© Copyright 1995-2017, ZYXEL Communications Corp. All rights reserved.
ZYXEL
Firmware Release Note
UAG5100
Release V4.18(AAPN.1)C0
Date: Aug 10, 2017
Author: XinHong Wu
Project Leader: Daniel Lin

2/29
www.zyxel.com
© Copyright 1995-2017, ZYXEL Communications Corp. All rights reserved.
Contents
Supported Platforms:..................................................................................................3
Versions:.......................................................................................................................3
Checksum:....................................................................................................................3
Files lists contains in the Release ZIP file...............................................................3
Read Me First ..............................................................................................................4
Design Limitations:......................................................................................................5
Layer 2 Isolation...................................................................................................5
User........................................................................................................................5
Web Authentication..............................................................................................5
Wireless.................................................................................................................5
Known Issues:..............................................................................................................5
BWM.......................................................................................................................5
Maintenance..........................................................................................................5
User Authentication..............................................................................................6
Wireless.................................................................................................................6
ZON........................................................................................................................6
Features: V4.18(AAPN.1)C0.....................................................................................7
Features: V4.18(AAPN.0)C0.....................................................................................8
Features: V4.15(AAPN.0)C0.....................................................................................9
Features: V4.10(AAPN.2)C0...................................................................................11
Features: V4.10(AAPN.1)C0...................................................................................12
Features: V4.10(AAPN.0)C0...................................................................................16
Features: V4.01(AAPN.1)C0...................................................................................18
Features: V4.00(AAPN.1)C0...................................................................................20
Features: V4.00(AAPN.0)C0...................................................................................21
Appendix 1. Firmware upgrade / downgrade procedure.....................................22
Appendix 2. Firmware Recovery.............................................................................24
Appendix 3. Supported AP List...............................................................................29

3/29
www.zyxel.com
© Copyright 1995-2017, ZYXEL Communications Corp. All rights reserved.
-
ZYXEL UAG5100
Release V4.18(AAPN.1)C0
Release Note
Date: Aug 10, 2017
Supported Platforms:
ZYXEL UAG5100
Versions:
Kernel Version : V2.6.32.27 | 2017-08-02 18:51:17
ZLD Version : V4.18(AAPN.1) | 2017-08-08 17:14:03
Printer Version : SP350E-V1.07
Checksum:
Core Checksum : 94CF83BD
Conf Checksum : D51D8A77
Files lists contains in the Release ZIP file
File name: 418AAPN1C0.bin
Purpose: This binary firmware image file is for normal system update.
Note: The firmware update may take five or more minutes depending on the scale of
device configuration. The more complex configuration will take more update time.
Do not turn off or reset the UAG while the firmware update is in progress. The
firmware might get damaged, if device loss power or you reset the device during the
firmware upload. You might need to refer to Appendix 2 of this document to recover
the firmware.
File name: 418AAPN1C0.conf
Purpose: This ASCII file contains default system configuration commands.
File name: 418AAPN1C0.db
Purpose: This binary file contains default system signatures.

4/29
www.zyxel.com
© Copyright 1995-2017, ZYXEL Communications Corp. All rights reserved.
Note: The file is only needed when doing system recovery from damage.
File name: 418AAPN1C0.pdf
Purpose: This is release file.
Read Me First
1. The system default configuration is summarized as below:
The default device administration username is “admin”, password is
“1234”.
The default LAN interface is lan1, which is P3 port on the front panel.
The default IP address of lan1 is 172.16.0.1/16.
By default, WWW/SSH/SNMP service can only be accessed from LAN
subnet.
The default WAN interface is wan1. The interface will automatically get IP
address using DHCP by default.
2. It is recommended that user backup the “startup-config.conf ”file first before
upgrading firmware. The backup configuration file can be used if user wants to
downgrade to an older firmware version.
3. If user upgrades from previous released firmware to this version, there is no need
to restore to system default configuration.
4. If there is difficult to configure via GUI (popup java script error, etc). It is
recommended to logout the configuration window and clear browser cache first,
then try to login and configure again.
5. To reset device to system default, user can press RESET button for 5 seconds and
the device will reset itself to system default configuration then reboot
automatically.
Note 1: After resetting, the original configuration will be removed. It is
recommended to backup the configuration before performing this operation.
Note 2: After resetting, if user has subscribed to security licenses, user
needs to connect to internet with myzyxel.com and refresh license
information.
6. If there is problem to reboot successfully after firmware upgrade, please refer to
Appendix 2: Firmware Recovery.

5/29
www.zyxel.com
© Copyright 1995-2017, ZYXEL Communications Corp. All rights reserved.
Design Limitations:
Note: These design limitations will be removed on next release once it is created into
announced knowledge base.
Layer 2 Isolation
1. [Symptom] Layer 2 Isolation may not block the clients immediately when clients
still use the old arp records.
[Workaround] If clients already had some ARP records, and it will not send ARP
request before record expired. For test result correctly, please clear test client's
ARP table before testing L2isolation.
User
1. [Symptom] Use IE8 browser to login pre-subscriber and click renew button,
reauthentication time shouldn’t be reset.
[Workaround] The function works fine. It’s a problem on display. The browser
with newer version doesn’t have this problem.
Web Authentication
1. [SPR: 140912458] eITS#141200460
[Symptom] Some URLs can’t be redirected to login page for chrome browser.
[Workaround] please access other URLs.
Wireless
1. [SPR: 150123013]
[Symptom] When set NXC/UAG to proxy mac authentication to UAG internal
radius server, wireless client can’t pass authentication.
Known Issues:
Note: These known issues represent current release so far unfix issues. And we
already plan to fix them on the future release.
BWM
1. [SPR: 150209358]
[Symptom] BWM does not take effect if the policy with service type as
application object and application object as FTP.
Maintenance
1. [SPR: 141224272]
[Symptom] After upgrading firmware and applying specific configuration file
with maximum NAT rules, UAG shows warning message and CPU is high
[Workaround] Please contact CSO to get fixed date code.

6/29
www.zyxel.com
© Copyright 1995-2017, ZYXEL Communications Corp. All rights reserved.
User Authentication
1. [SPR: 150130279]
[Symptom] Move function cannot work when user edits Auth Method.
[Workaround] If user had ever clicked method list column to sort, please clear
browser cache.
Wireless
1. [SPR: 150204154]
[Symptom] GUI still show rogue AP or friendly AP marked in detected device
page even after apply system default configuration.
ZON
1. [SPR: 150108180]
[Symptom] Neighbor information will keep a period of time if changing port
continuously

7/29
www.zyxel.com
© Copyright 1995-2017, ZYXEL Communications Corp. All rights reserved.
Features: V4.18(AAPN.1)C0
Modifications in V4.18(AAPN.1)C0 | 08/10/2017
1. [ENHANCEMENT]
[Payment] New currency RUB and BRL
2. [ENHANCEMENT]
Add Privacy Statement link at login page, it is a statement that declares Zyxel's
policy on how it collects, stores, and releases personal information it collects.
Customer can check the link for details. usage.
3. [ENHANCEMENT]
Add session page switch function. Default enable Session Page function, after
user logon device, welcome page will be covered by pop-up session page.
Customers can disable it and the session page will not pop up.
4. [ENHANCEMENT]
Patches for CVE-2017-9148, FreeRADIUS TLS resumption authentication bypass
5. [BUGFIX] eITS #170600617
Symptom:
Duplicate radius packets for the same account
Condition:
1. Create one external group user
2. Capture packets and login device
3. Filter all radius packets and there are duplicate packets
6. [BUGFIX] eITS #141000195
Symptom:
When the size of accounting request packet is too large, it may cause firewall to
drop it.

8/29
www.zyxel.com
© Copyright 1995-2017, ZYXEL Communications Corp. All rights reserved.
Features: V4.18(AAPN.0)C0
Modifications in V4.18(AAPN.0)C0 | 04/21/2017
1. [ENHANCEMENT]
Support Facebook Wi-Fi.
2. [FEATURE CHANGE]
Change the maximum number of schedule group member.
WAS: Maximum number in schedule group supports 2
IS: Maximum number in schedule group supports 4
3. [BUGFIX] eITS #170200815 SPR: 170314600
Symptom:
When WAN received DHCP packets, it will trigger device to show incorrect alert
log.
4. [BUGFIX] eITS #170200581 SPR: 170317773
Symptom:
The wireless clients cannot do 802.1x authentication anymore by device after
running for weeks.
5. [BUGFIX] eITS #170100106 SPR: 170126984
Symptom:
MacBook connection cause device reboot.
Condition:
1. Reboot device
2. MacBook Wi-Fi try to connect device SSID during booting up.
6. [BUGFIX] eITS #170100339 SPR: 170220882
Symptom:
There are duplicated login users display on Login Users monitor page, if the same
client open multiple UA (User Agreement) login pages at the same time.

9/29
www.zyxel.com
© Copyright 1995-2017, ZYXEL Communications Corp. All rights reserved.
Features: V4.15(AAPN.0)C0
Modifications in V4.15(AAPN.0)C0 | 12/08/2016
1. [FEATURE CHANGE]
Firmware version only display version on CNC. Follow the ISO specification,
Doc. No. ZA3004
WAS: V4.10(AAIZ.2)/1.22/2016-04-14 14:18:08
IS: V4.15(AAIZ.0)b1
2. [FEATURE CHANGE]
Change UAG built –in AP firmware
WAS: NWA3000/5000, NWA5120 and NWA5301 series
IS: WAC6100, NWA5120 and NWA5120-ac series
3. [ENHANCEMENT]
Support APC 1.97 features
Major Support WAC6500/WAC6100/NWA5123-AC Series and Cloud firmware
upgrade
4. [ENHANCEMENT]
Support Socifi social login
5. [ENHANCEMENT]
Enhance max unused account from 180 to 365
6. [ENHANCEMENT]eITS#160300976
Modify GUI page size : DHCP table, login user table, VPN table
7. [ENHANCEMENT]
Support customization Free time Page
8. [ENHANCEMENT]
Display create time column on dynamic guest GUI page by default
9. [ENHANCEMENT]
Support Free Time user auto login

10/29
www.zyxel.com
© Copyright 1995-2017, ZYXEL Communications Corp. All rights reserved.
10. [ENHANCEMENT]
Support HTTP 1.1 for PayPal connection
11. [ENHANCEMENT]
Support wireless PSK encryption.
12. [ENHANCEMENT]
Support WAC6103D-I antenna mode switch configuration
13. [ENHANCEMENT]
Upgrade Openssl-1.0.2h
14. [ENHANCEMENT]
Support internal web authentication portal with FQDN redirect
15. [ENHANCEMENT]
Support TLS 1.0/1.1/1.2 on Vianett SMS
16. [BUG FIX] eITS#160900035
Symptom: UAG5100 monitor display dynamic account expire time abnormally
17. [BUG FIX] eITS#160800386
Symptom: UAG4100 Stops Being Discoverable By ZON Utility
Condition:
1. PC open ZON utility
2. After 1 hours, ZON utility can't discovery device
18. [BUG FIX] eITS#160800867
Symptom: [Web authentication]Billing user login default-web-portal, it can’t use
logout IP to open user countdown page.
19. [BUG FIX] eITS#160900632
Symptom: Log-in user is able to download "startup-config.conf" via specific URL

11/29
www.zyxel.com
© Copyright 1995-2017, ZYXEL Communications Corp. All rights reserved.
Features: V4.10(AAPN.2)C0
Modifications in V4.10(AAPN.2)C0 | 04/15/2016
1. [ENHANCEMENT]
Patch for Vulnerability CVE-2015-7547.
2. [ENHANCEMENT]
Support TLS 1.2 for PayPal upgrade
3. [BUG FIX] eITS# 160201010 SPR 160302407
Symptom: [BIP] - UAG5100 Idle timeout doesn't work.
Condition:
Sometimes Idle timeout function can’t work when ZON utility activates.
4. [BUG FIX] eITS# 160200983
Symptom: Problem license
Condition:
There is one device with Managed AP Service license and manage maximum APs
which license supports. After customer transfers license to another device, this
original device still can control its own APs.

12/29
www.zyxel.com
© Copyright 1995-2017, ZYXEL Communications Corp. All rights reserved.
Features: V4.10(AAPN.1)C0
Modifications in V4.10(AAPN.1)C0 | 11/25/2015
5. [ENHANCEMENT]
Support generating SHA2 Certificate
6. [ENHANCEMENT]
Force users to change password at first login.
7. [ENHANCEMENT]
Patches for CVE-2015-4000, Logjam: TLS vulnerabilities (CVE-2015-4000).
8. [ENHANCEMENT] SPR 150923815
Patches for vulnerability of HTTP authentication module which may cause UAG
behave as an open proxy to proxy HTTP request from external clients to internal
servers.
9. [ENHANCEMENT]
Windows 10 Compatible
Test version:
Windows 10 64-bits
IE11 11.0.10240.16590
Edge 20.10240.16384.0
10. [FEATURE CHANGE]
WAS
Offering DHCP option 138 has been enabled by default.
IS
Offering DHCP option 138 has been disabled by default.
11. [BUG FIX] eITS# 150301158 SPR 150410815
Symptom: When WAN interface renames as ”firewall”, then go to
edit ”frewall_ppp” the GUI will hanging.
Condition:
1. When WAN interface renames as ”firewall”, then go to edit ”frewall_ppp”
the GUI will hanging.

13/29
www.zyxel.com
© Copyright 1995-2017, ZYXEL Communications Corp. All rights reserved.
12. [BUG FIX] eITS# 150400781 SPR 1504251756
Symptom: The conflict configuration cause bad config when firmware upgrade.
Condition:
1. fw 4.002. Configure Radio 1&2 with incorrect AP profile. (e.g. Set Radio 1
with 5G AP profile) / Disable the ”Firewall” for ”Remote syslog” from Lot
category.
2. upgrade fw from 4.00 ＞4.10 and device will get bad config problem
13. [BUG FIX] eITS# 150401075 SPR 1505211677
Symptom: User idle time would be update by another connection.
Condition:
1. Enable user idle time out e.g. 10min
2. User#1 login and then keep idle (e.g. Power off)
3. User#2 connect to device LAN via Wired or Wireless.
4. User#2 disconnect and re-connect from device.
5. User#1 idle time would be updated and cause the User#1 will not be kicked
14. [BUG FIX] eITS# 150500510 SPR 150601048
Symptom: UAG 5100 will reboot automatically randomly.
Condition:
1. UAG 5100 will reboot automatically randomly.
15. [BUG FIX] eITS# 150500773 SPR 1505292382
Symptom: Outside users cannot connect to UAG via URL if enable the web
authentication rule as any to any.
Condition:
1. Outside users cannot connect to UAG via URL if enable the web authentication
rule as any to any.
16. [BUG FIX] eITS# 150501129 SPR 150602174
Symptom: If you delete the dynamic guest, the user is still on the Login User list
and is able to surf the Internet.To make this account unavailable, the user needs to
log out or the administrator clicks the “force logout” button.
Condition:
1. If the account is time to finish, the administrator needs to “Force Logout” the
user to make this account unavailable because the user can’t logout by himself.If

14/29
www.zyxel.com
© Copyright 1995-2017, ZYXEL Communications Corp. All rights reserved.
the account is accumulation, the user needs to logout by himself or the
administrator needs to “Force Logout” the user to make this account unavailable.
17. [BUG FIX] eITS# 150600073 SPR 150611764
Symptom: If Guest A who purchased ticket and login to access Internet 2 for days,
the Guest B may get DHCP address from Guest A and can use Internet without
ticket.Change the design to support to check the IP/MAC address for all traffic at
the same time.
Condition:
1. If Guest A who purchased ticket and login to access Internet 2 for days, the
Guest B may get DHCP address from Guest A and can use Internet without
ticket.Change the design to support to check the IP/MAC address for all traffic at
the same time.
18. [BUG FIX] eITS# 150600587 SPR 1506171145
Symptom: Wrong translation.
Condition:
1. Wrong translation. Here is the customer’s suggestion. Please help to modify it.
2. GUI SSID profile block intr-BSS wrong wording
19. [BUG FIX] eITS# 150600540 SPR 1506261701
Symptom: After pay the bill via PayPal, web GUI will redirect to a page for
waiting 10 seconds.If click ”continue” button, the web page will redirect to wrong
page.But if wait for 10 seconds, then without this symptom.
Condition:
1. The reason PayPal changed behavior.Due to PayPal case sensitive in URL, so it
caused fail.
20. [BUG FIX] eITS# 150700901 SPR 1507291900
Symptom: Login page cannot display successfully after some time.
Condition:
1. Login page cannot display successfully after some time.
21. [BUG FIX] eITS# 150701271 150701272 SPR 150804177
Symptom: Named will occupy much CPU resource and might cause ZySH hang.
Condition:
1. Named will occupy much CPU resource and might cause ZySH hang.

15/29
www.zyxel.com
© Copyright 1995-2017, ZYXEL Communications Corp. All rights reserved.
22. [BUG FIX] eITS# 150800458 SPR 1508201113
Symptom: After rebooting, Content-Filter doesn’t work.
Condition:
1. After rebooting, Content-Filter doesn’t work.
23. [BUG FIX] eITS# 150800424 SPR 1508201112
Symptom: After rebooting, some accounts can’t change to expire / delete.
Condition:
1. After rebooting, some accounts can’t change to expire / delete.
24. [BUG FIX] eITS# 150800635 SPR 1508261347
Symptom: After users are authenticated by the external portal, they are not
redirected to the configured external welcome page but the default portal.
Condition:
1. After users are authenticated by the external portal, they are not redirected to
the configured external welcome page but the default portal. The customer use
external website and authenticate users by 微信認證. 在微信後台將跳轉連結跳
轉到設備上面.
25. [BUG FIX] eITS# 150900446
Symptom: There’re 2 entries of IP address which are unable to be deleted
Condition:
1. There’re 2 entries of IP address which are unable to be deleted
26. [BUG FIX] eITS# 150701145 SPR 1507312026
Symptom: The end user cannot get free account.
Condition:
1. The end user cannot get free account.

16/29
www.zyxel.com
© Copyright 1995-2017, ZYXEL Communications Corp. All rights reserved.
Features: V4.10(AAPN.0)C0
Modifications in V4.10(AAPN.0)C0 | 03/13/2015
1. [ENHANCEMENT]
Support APC 1.90 features
2. [ENHANCEMENT]
SP350E(Printer) firmware version upgrade to V1.06
3. [ENHANCEMENT]
Support mobile portal page
4. [ENHANCEMENT]
Support multiple portal
5. [ENHANCEMENT]
Keep user logged in after UAG reboot
6. [ENHANCEMENT]
Purple WiFi Social login integration
7. [ENHANCEMENT]
Free Time Enhancement
Time Period can be configured 5 minutes to 30 days
Reset Time can be configured Daily, Weekly and Monthly
8. [ENHANCEMENT] eITS#141100913
Support Local Printer
9. [ENHANCEMENT]
ZON Utility and Smart Connect support
10. [ENHANCEMENT]
Walled garden supports domain/subnet IP.
11. [ENHANCEMENT]
Support Multi-lingual.

17/29
www.zyxel.com
© Copyright 1995-2017, ZYXEL Communications Corp. All rights reserved.
English, French, German, Portuguese, Simplified_Chinese, Spanish,
Traditional_Chinese and Turkish.
12. [ENHANCEMENT]
Support Content Filtering
13. [ENHANCEMENT]
Support Application Patrol
14. [FEATURE CHANGE]
Firewall changes to Security Policy
15. [FEATURE CHANGE]
WAS
In SMS short message, no space character in string of wifi information
IS
In SMS short message, add space character in string of wifi information
16. [FEATURE CHANGE]
WAS
Support NWA 4.10 patch4 wtp image
IS
Support NWA 4.10 patch5 wtp image
17. [FEATURE CHANGE]
WAS
It supports ‘&’ character for SSID profile name
IS
It doesn’t support ‘&’ character for SSID profile name
18. [FEATURE CHANGE]
Combine core dump to diagnostic info.
19. [FEATURE CHANGE]
WAS
Press discover printer is countdown timer 20 to 0

18/29
www.zyxel.com
© Copyright 1995-2017, ZYXEL Communications Corp. All rights reserved.
IS
Press discover printer is accumulator timer 0 to 180
20. [FEATURE CHANGE]
WAS
SMS portal gateway is original Vianett gateway.
IS
SMS portal gateway is zyxel Vianett gateway.
21. [FEATURE CHANGE] SPR 141118801
WAS
Default setting ” Redirect HTTP to HTTPS ”
UAG5100, UAG2100 and UAG4100 are inconsistent
IS
Default setting ” Redirect HTTP to HTTPS ”
UAG5100, UAG2100 and UAG4100 are consistent
22. [FEATURE CHANGE] eITS#140900191
WAS
Maximum unused expire time is 30 days
IS
Maximum unused expire time is 180 days
23. [BUG FIX] eITS# 150200377
Symptom: UAG5100 用一段時間之後設備就會自動重啟
Condition:
1. UAG5100 用一段時間之後設備就會自動重啟
Features: V4.01(AAPN.1)C0
Modifications in V4.01(AAPN.1)C0 | 2014/11/11
1. [ENHANCEMENT]
SP350E(Printer) firmware version upgrade to V1.06
2. [ENHANCEMENT] eITS# 140302127
Add Payment currency check in billing general setting page

19/29
www.zyxel.com
© Copyright 1995-2017, ZYXEL Communications Corp. All rights reserved.
3. [BUG FIX] eITS# 141100072
Symptom: If using 24 hours in ”Unused account will be deleted after the time”,
the date of the ticket will not be added one.If using 5 hours, the ticket will print
correctly.
Condition:
If using 24 hours in ”Unused account will be deleted after the time”, the date of
the ticket will not be added one.If using 5 hours, the ticket will print correctly.
4. [BUG FIX] eITS# 140800429
Symptom: UAG4100 Crash
Condition:
1. SP350E Printer can´t sync succssfully, we everytime see "sync progressing".
The IP is fixed 172.16.0.7 and we can ping from SSH UAG to Printer and show
arp-table can show it correctly
2. (LOW intern reference) Use "Printer Discovery" Button cause running from 10
to 0 then go to -1, -2, -3 till -30/-40 seems a bug, please paste to PQA before v4.01
FCS
3. We´ve 1900 ticket in system, but value is Accumulation after 3 days delete it. It
will not delete and ticket storage will be full 2048 soon
4. Manual delete ticket can´t work UAG4100 ignore it
5. Coredump, PMD Module
5. [BUG FIX] eITS# 140900060
Symptom: The BWM function can't limit bandwidth success
Condition:
1. Can't limit trial-users bandwidth
6. [BUG FIX] eITS# 140900456
Symptom: UAG4100 / Printer Sync Issue
Condition:
1. thread have resource leak issue in some flow and will cause account could not
be created finally. On this customer's site, it seems easily reach this flow
and cause account resource exhausted
2. thread may block and could not work when some exception happens. It is
because
the printer thread does not handle it well when exception happens

20/29
www.zyxel.com
© Copyright 1995-2017, ZYXEL Communications Corp. All rights reserved.
3. The SP350E on customer's site could not respond UAG's command after
working for around a half of day
7. [BUG FIX] eITS# 140900336
Symptom: The Printer seems not support for daylight saving time
Condition:
1. When printer syncing with UAG, the printer can sync success. But the sync
time is not correct.
8. [BUG FIX] eITS# 140900501
Symptom: UAG4100 / crash issue all few days
Condition:
1. Enabling BWM sometimes causes device crash.GUI loading more than 25
minutes very slow. UAG not reachable from any LAN PortDHCP stockingPing
failsWIFI disableMaybe ”other config” running at this time, or auto reboot roll
back to previous..
Features: V4.00(AAPN.1)C0
Modifications in V4.00(AAPN.1)C0 | 2014/05/02
1. [FEATURE CHANGE]
WAS
L2-isolation white list supports 20 entries.
IS
L2-isolation white list supports 100 entries.
2. [FEATURE CHANGE]
WAS
Default managed AP is 8.
IS
Default managed AP is 16.
3. [ENHANCEMENT]
No matter web auth is activated or not, it will show client MAC in traffic log if we
enable traffic log function.