Option GlobeSurfer-II Router Manual PDF (Setup & Configuration Guide)

Home

Manuals

Option

GlobeSurfer-II

Page 76 / 126 Scroll up to view Page 71 - 75

GlobeSurfer

II 1.8 - 7.2 - 7.2 S

REFERENCE MANUAL

6.6.3

Universal Plug and Play

To access the UPnP settings perform the following:

1. Click ‘Universal Plug and Play’ on the ‘Advanced’ screen of the management console. The Universal Plug and Play

settings screen will be displayed (see Figure 6.22).

2. Check the Allow other network users to control GlobeSurfer

II’s setwork features checkbox, to enable the UPnP feature.

This will enable you to deﬁne UPnP services on any of the LAN hosts.

Check the Enable automatic cleanup of old unused UPnP services checkbox, to enable automatic cleanup of invalid rules.

When enabled, this feature checks validity of all the UPnP services and rules every 5 minutes. Any UPnP deﬁned service

that is found to be old and not in use, is removed, unless any user deﬁned rule (see Security screen) depends on it. This

feature is disabled by default.

Since there is a limitation on the maximum number of UPnP deﬁned services to 256, you should want to enable the

cleanup feature if you might exceed this limit.

In which case might the limit be exceeded UPnP services are not deleted when disconnecting a computer without proper

shutdown of the UpnP application

(e.g. messenger). Thus, if you are running a boingo, services may often not be deleted, and will eventually lead to

exhaustion of rules and services, and no new services could be deﬁned. In this scenario the cleanup feature will ﬁnd the

services that are no longer valid and will remove them, preventing services exhaustion.

Figure 6.22 UPnP

6.6.4

Scheduler Rules

Scheduler rules are used for limiting the activation of settings, such as ﬁrewall rules, to speciﬁc time periods, speciﬁed in days

of the week, and hours.

Figure 6.23 Scheduler rules

To deﬁne a Rule:

Click ‘Scheduler rules’ on the ‘Advanced’ screen of the management console. The Scheduler rules screen will appear

(see Figure 6.23).

Click the ‘New scheduler entry’ link. The Scheduler rule edit screen will appear (see Figure 6.24).

Page 77 / 126

GlobeSurfer

II 1.8 - 7.2 - 7.2 S

REFERENCE MANUAL

Figure 6.24 Edit scheduler rule

Specify a name for the rule in the ‘Name’ ﬁeld.

Specify if the rule will be active/inactive during the designated time period, by selecting the appropriate ‘Rule activity

settings’ check box.

Click the ‘New time segment’ entry link to deﬁne the time segment to which the rule will apply — the Time segment edit

screen will appear (see Figure 6.25).

Figure 6.25 Edit time segment

Select active/inactive days of the week.

Click the ‘New hours segment entry’ link to deﬁne an active/inactive hourly range.

8. Click OK.

Figure 6.26 Edit hour range

Page 78 / 126

GlobeSurfer

II 1.8 - 7.2 - 7.2 S

REFERENCE MANUAL

6.6.5

Certiﬁcates

6.6.5.1

Overview

Public-key cryptography uses a pair of keys: a public key and a corresponding private key. These keys can play

opposite roles, either encrypting or decrypting data. Your public key is made known to the world, while your private

key is kept secret.

The public and private keys are mathematically associated; however it is computationally infeasible to deduce the

private key from the public key. Anyone who has the public key can encrypt information that can only be decrypted

with the matching private key. Similarly, the person with the private key can encrypt information that can only be

decrypted with the matching public key.

Technically, both public and private keys are large numbers that work with cryptographic algorithms to produce

encrypted material. The primary beneﬁt of public-key cryptography is that it allows people who have no preexisting

security arrangement to authenticate each other and exchange messages securely.

GlobeSurfer

II makes use of public-key cryptography to encrypt and authenticate keys for the encryption of

Wireless and VPN data communication, the Web Based Management (WBM) utility, and secured telnet.

6.6.5.2

Digital Certiﬁcates

When working with public-key cryptography, you should be careful and make sure that you are using the correct

person’s public key. Man-in-the-middle attacks pose a potential threat, where an ill-intending 3rd party posts a

phony key with the name and user ID of an intended recipient. Data transfer that is intercepted by the owner of the

counterfeit key can fall in the wrong hands. Digital certiﬁcates provide a means for establishing whether a public

key truly belongs to the supposed owner. It is a digital form of credential. It has information on it that identiﬁes you,

and an authorized statement to the effect that someone else has conﬁrmed your identity.

Digital certiﬁcates are used to foil attempts by an ill-intending party to use an unauthorized public key. A digital

certiﬁcate consists of the following:

A PUBLIC KEY

Certiﬁcate information

The “identity” of the user, such as name, user ID and so on.

Digital signatures

A statement stating that the information enclosed in the certiﬁcate has been vouched for by a Certiﬁcate Authority (CA).

Binding this information together, a certiﬁcate is a public key with identiﬁcation forms attached, coupled with a

stamp of approval by a trusted party.

6.6.5.3

X.509 Certiﬁcate Format

GlobeSurfer

II supports X.509 certiﬁcates that comply with the ITU-T X.509 international standard. An X.509

certiﬁcate is a collection of a standard set of ﬁelds containing information about a user or device and their

corresponding public key. The X.509 standard deﬁnes what information goes into the certiﬁcate, and describes

how to encode it (the data format). All X.509 certiﬁcates have the following data:

The certiﬁcate holder’s public key

The public key of the certiﬁcate holder, together with an algorithm identiﬁer that speciﬁes which cryptosystem the

key belongs to and any associated key parameters.

The serial number of the certiﬁcate

The entity (application or person) that created the certiﬁcate is responsible for assigning it a unique serial number

to distinguish it from other certiﬁcates it issues. This information is used in numerous ways; for example when a

certiﬁcate is revoked, its serial number is placed on a Certiﬁcate Revocation List (CRL).

The certiﬁcate holder’s unique identiﬁer

This name is intended to be unique across the Internet. A DN consists of multiple subsections and may look

something like this: CN=Option Wireless Sweden AB, [email protected], OU=Development Department,

O=Option Wireless Sweden AB, C=SE (These refer to the subject’s Common Name, Organizational Unit,

Page 79 / 126

GlobeSurfer

II 1.8 - 7.2 - 7.2 S

REFERENCE MANUAL

Organization, and Country.)

The certiﬁcate’s validity period

The certiﬁcate’s start date/time and expiration date/time; indicates when the certiﬁcate will expire.

The unique name of the certiﬁcate issuer

The unique name of the entity that signed the certiﬁcate. This is normally a CA. Using the certiﬁcate implies

trusting the entity that signed this certiﬁcate. (Note that in some cases, such as root or top-level CA certiﬁcates,

the issuer signs its own certiﬁcate.) The digital signature of the issuer the signature using the private key of the

entity that issued the certiﬁcate.

The signature algorithm identiﬁer

Identiﬁes the algorithm used by the CA to sign the certiﬁcate.

6.6.5.4

GlobeSurfer

II Certiﬁcate Stores

GlobeSurfer

II maintains two certiﬁcate stores:

GlobeSurfer

II Local Store This store contains a list of approved certiﬁcates that are used to identify

GlobeSurfer

II to its clients. The list also includes certiﬁcate requests that are pending a CA’s endorsement.

You can obtain certiﬁcates for GlobeSurfer

II using the following methods:

•

Requesting an X509 Certiﬁcate

This method creates both a private and a matching public key. The public key is then sent to the CA to be

certiﬁed.

•

Creating a Self-Signed Certiﬁcate

This method is the same as requesting a certiﬁcate, only the authentication of the public key does not

require a CA. This is mainly intended for use within small organizations.

•

Loading a PKCS#12

Format Certiﬁcate This method loads a certiﬁcate using an already available and certiﬁed set of private

and public keys.

2. Certiﬁcate Authority (CA) Store This store contains a list of the trusted certiﬁcate authorities, which is used

to check certiﬁcates presented by GlobeSurfer

II clients.

6.6.5.4.1

Requesting an X509 Certiﬁcate

To obtain an X509 certiﬁcate, you must ask a CA to issue you one. You provide your public key, proof

that you possess the corresponding private key, and some speciﬁc information about yourself. You

then digitally sign the information and send the whole package – the certiﬁcate request – to the CA.

The CA then performs some due diligence in verifying that the information you provided is correct

and, if so, generates the certiﬁcate and returns it.

You might think of an X509 certiﬁcate as looking like a standard paper certiﬁcate with a public key

taped to it. It has your name and some information about you on it, plus the signature of the person

who issued it to you.

Click the ’Certiﬁcates’ icon in the ’Advanced’ screen of the Web-base Management. The

’Certiﬁcates’ screen will appear (see ﬁgure Error! Hyperlink reference not valid.

Figure 6.27 Certiﬁcates

Page 80 / 126

GlobeSurfer

II 1.8 - 7.2 - 7.2 S

REFERENCE MANUAL

Click the ’GlobeSurfer

II’s local’ certiﬁcates tab.

Click the ’Create Certiﬁcate Request’ button. The ’Create X509 Request’ screen will appear (see

Figure 6.28).

Enter the following certiﬁcation request parameters:

1. Certiﬁcate Name

2. Subject

3. Organizatin

4. State

5. Country

Click the ’Generate’ button. A screen will appear stating that the certiﬁcation request is being

generated (see Figure 6.29).

Figure 6.28 Create X509 request

Figure 6.29 New X509 request

After a short while, press the ’Refresh’ button, until the ’Save Certiﬁcate Request’ screen appears

(see Figure 6.30).

Click the ’Save Certiﬁcate Request’ button and save the request to a ﬁle.

Click the ’Close’ button. The main certiﬁcate management screen will reappear, listing your

certiﬁcate as “Unsigned” (see Figure 6.31). In this state, the request ﬁle may be opened at any time

by pressing the ’save’ icon under the ’Action’ column and then ’Open’ in the dialogue box (Windows

only).

After receiving a reply from the CA in form of a ’.pem’ ﬁle, click the ’Load Certiﬁcate’ link. The

’Load GlobeSurfer

II’s Local Certiﬁcate’ screen will appear (see Figure 6.32).

Figure 6.30 Save certiﬁcate request

Rate

Popular Option Models

Famous Router IPs

Famous Router Companies

Bookmark Our Site

Share