1. Home
    2. /
  2. Manuals
    3. /
  3. Zyxel
    4. /
  4. P-660HN-T1A
    5. /
  5. 27
Page 131 / 324 Scroll up to view Page 126 - 130
Chapter 8 Wireless LAN
P-660HN-TxA User’s Guide
131
The following figure shows a WPS-enabled client (installed in a notebook
computer) connecting to a WPS-enabled access point.
Figure 60
How WPS works
The roles of registrar and enrollee last only as long as the WPS setup process is
active (two minutes). The next time you use WPS, a different device can be the
registrar if necessary.
The WPS connection process is like a handshake; only two devices participate in
each WPS transaction. If you want to add more devices you should repeat the
process with one of the existing networked devices and the new device.
Note that the access point (AP) is not always the registrar, and the wireless client
is not always the enrollee. All WPS-certified APs can be a registrar, and so can
some WPS-enabled wireless clients.
By default, a WPS devices is “unconfigured”. This means that it is not part of an
existing network and can act as either enrollee or registrar (if it supports both
functions). If the registrar is unconfigured, the security settings it transmits to the
enrollee are randomly-generated. Once a WPS-enabled device has connected to
another device using WPS, it becomes “configured”. A configured wireless client
can still act as enrollee or registrar in subsequent WPS connections, but a
configured access point can no longer act as enrollee. It will be the registrar in all
subsequent WPS connections in which it is involved. If you want a configured AP to
act as an enrollee, you must reset it to its factory defaults.
SECURE TUNNEL
SECURITY INFO
WITHIN 2 MINUTES
COMMUNICATION
ACTIVATE
WPS
ACTIVATE
WPS
WPS HANDSHAKE
REGISTRAR
ENROLLEE
Page 132 / 324
Chapter 8 Wireless LAN
P-660HN-TxA User’s Guide
132
8.8.8.4
Example WPS Network Setup
This section shows how security settings are distributed in an example WPS setup.
The following figure shows an example network. In step
1
, both
AP1
and
Client 1
are unconfigured. When WPS is activated on both, they perform the handshake. In
this example,
AP1
is the registrar, and
Client 1
is the enrollee. The registrar
randomly generates the security information to set up the network, since it is
unconfigured and has no existing information.
Figure 61
WPS: Example Network Step 1
In step
2
, you add another wireless client to the network. You know that
Client 1
supports registrar mode, but it is better to use
AP1
for the WPS handshake with
the new client since you must connect to the access point anyway in order to use
the network. In this case,
AP1
must be the registrar, since it is configured (it
already has security information for the network).
AP1
supplies the existing
security information to
Client 2
.
Figure 62
WPS: Example Network Step 2
In step 3, you add another access point (
AP2
) to your network.
AP2
is out of
range of
AP1
, so you cannot use
AP1
for the WPS handshake with the new access
REGISTRAR
ENROLLEE
SECURITY INFO
CLIENT 1
AP1
REGISTRAR
CLIENT 1
AP1
ENROLLEE
CLIENT 2
EXISTING CONNECTION
SECURITY INFO
Page 133 / 324
Chapter 8 Wireless LAN
P-660HN-TxA User’s Guide
133
point. However, you know that
Client 2
supports the registrar function, so you use
it to perform the WPS handshake instead.
Figure 63
WPS: Example Network Step 3
8.8.8.5
Limitations of WPS
WPS has some limitations of which you should be aware.
•
WPS works in Infrastructure networks only (where an AP and a wireless client
communicate). It does not work in Ad-Hoc networks (where there is no AP).
•
When you use WPS, it works between two devices only. You cannot enroll
multiple devices simultaneously, you must enroll one after the other.
For instance, if you have two enrollees and one registrar you must set up the
first enrollee (by pressing the WPS button on the registrar and the first enrollee,
for example), then check that it successfully enrolled, then set up the second
device in the same way.
•
WPS works only with other WPS-enabled devices. However, you can still add
non-WPS devices to a network you already set up using WPS.
WPS works by automatically issuing a randomly-generated WPA-PSK or WPA2-
PSK pre-shared key from the registrar device to the enrollee devices. Whether
the network uses WPA-PSK or WPA2-PSK depends on the device. You can check
the configuration interface of the registrar device to discover the key the
network is using (if the device supports this feature). Then, you can enter the
key into the non-WPS device and join the network as normal (the non-WPS
device must also support WPA-PSK or WPA2-PSK).
CLIENT 1
AP1
REGISTRAR
CLIENT 2
EXISTING CONNECTION
SECURITY INFO
ENROLLEE
AP2
EXISTING CONNECTION
Page 134 / 324
Chapter 8 Wireless LAN
P-660HN-TxA User’s Guide
134
•
When you use the PBC method, there is a short period (from the moment you
press the button on one device to the moment you press the button on the
other device) when any WPS-enabled device could join the network. This is
because the registrar has no way of identifying the “correct” enrollee, and
cannot differentiate between your enrollee and a rogue device. This is a possible
way for a hacker to gain access to a network.
You can easily check to see if this has happened. WPS works between only two
devices simultaneously, so if another device has enrolled your device will be
unable to enroll, and will not have access to the network. If this happens, open
the access point’s configuration interface and look at the list of associated
clients (usually displayed by MAC address). It does not matter if the access
point is the WPS registrar, the enrollee, or was not involved in the WPS
handshake; a rogue device must still associate with the access point to gain
access to the network. Check the MAC addresses of your wireless clients
(usually printed on a label on the bottom of the device). If there is an unknown
MAC address you can remove it or reset the AP.
Page 135 / 324
P-660HN-TxA User’s Guide
135
C
HAPTER
9
Network Address Translation
(NAT)
9.1
Overview
This chapter discusses how to configure NAT on the ZyXEL Device. NAT (Network
Address Translation - NAT, RFC 1631) is the translation of the IP address of a host
in a packet, for example, the source address of an outgoing packet, used within
one network to a different IP address known within another network.
9.1.1
What You Can Do in the NAT Screens
•
Use the
NAT General Setup
screen (
Section 9.2 on page 137
) to configure the
NAT setup settings.
•
Use the
Port Forwarding
screen (
Section 9.3 on page 138
) to configure
forward incoming service requests to the server(s) on your local network.
•
Use the
Address Mapping
screen (
Section 9.4 on page 142
) to change your
ZyXEL Device’s address mapping settings.
•
Use the
ALG
screen (
Section 9.5 on page 145
) to enable and disable the SIP
(VoIP) ALG in the ZyXEL Device.
9.1.2
What You Need To Know About NAT
Inside/Outside
Inside/outside denotes where a host is located relative to the ZyXEL Device, for
example, the computers of your subscribers are the inside hosts, while the web
servers on the Internet are the outside hosts.
Global/Local
Global/local denotes the IP address of a host in a packet as the packet traverses a
router, for example, the local address refers to the IP address of a host when the
packet is in the local network, while the global address refers to the IP address of
the host when the same packet is traveling in the WAN side.

Rate

4.5 / 5 based on 2 votes.

Popular Zyxel Models

Famous Router IPs
Famous Router Companies
Bookmark Our Site

Press Ctrl + D to add this site to your favorites!

Share
Top