Chapter 6 Broadband

VMG4380-B10A / VMG4325-B10A User’s Guide

96

6.5.1

Edit 802.1x Settings

Use this screen to edit a 802.1x authentication’s settings. Click the

Edit

icon next to the rule you

want to edit. The screen shown next appears.

Figure 29

802.1x: Add/Edit

The following table describes the labels in this screen.

Apply

Click

Apply

to save your changes back to the Device.

Cancel

Click

Cancel

to return to the previous configuration.

Table 14

Network Setting

>

Network Setting > 8021x (continued)

LABEL

DESCRIPTION

Table 15

802.1x: Add/Edit

LABEL

DESCRIPTION

Active

This field allows you to activate/deactivate the authentication.

Select this to enable the authentication. Clear this to disable this authentication without

having to delete the entry.

Interface

Select the interface that uses the authentication.

EAP Identity

Enter the EAP identity of the authentication.

EAP method

This is the EAP method used for this authentication.

Enable

Bidirectional

Authentication

Select this to allow bidirectional authentication.

Certificate

Select the certificate you want to assign to the authentication. You need to import the

certificate in the

Security

>

Certificates

>

Local Certificates

screen.

Trusted CA

Select the Trusted CA you want to assign to the authentication. You need to import the

certificate in the

Security

>

Certificates

>

Trusted CA

screen.

Apply

Click

Apply

to save your changes.

Cancel

Click

Cancel

to exit this screen without saving.

Chapter 6 Broadband

VMG4380-B10A / VMG4325-B10A User’s Guide

97

6.6

Technical Reference

The following section contains additional technical information about the Device features described

in this chapter.

Encapsulation

Be sure to use the encapsulation method required by your ISP. The Device can work in bridge mode

or routing mode. When the Device is in routing mode, it supports the following methods.

IP over Ethernet

IP over Ethernet (IPoE) is an alternative to PPPoE. IP packets are being delivered across an

Ethernet network, without using PPP encapsulation. They are routed between the Ethernet interface

and the WAN interface and then formatted so that they can be understood in a bridged

environment. For instance, it encapsulates routed Ethernet frames into bridged Ethernet cells.

PPP over ATM (PPPoA)

PPPoA stands for Point to Point Protocol over ATM Adaptation Layer 5 (AAL5). A PPPoA connection

functions like a dial-up Internet connection. The Device encapsulates the PPP session based on

RFC1483 and sends it through an ATM PVC (Permanent Virtual Circuit) to the Internet Service

Provider’s (ISP) DSLAM (digital access multiplexer). Please refer to RFC 2364 for more information

on PPPoA. Refer to RFC 1661 for more information on PPP.

PPP over Ethernet (PPPoE)

Point-to-Point Protocol over Ethernet (PPPoE) provides access control and billing functionality in a

manner similar to dial-up services using PPP. PPPoE is an IETF standard (RFC 2516) specifying how

a personal computer (PC) interacts with a broadband modem (DSL, cable, wireless, etc.)

connection.

For the service provider, PPPoE offers an access and authentication method that works with existing

access control systems (for example RADIUS).

One of the benefits of PPPoE is the ability to let you access one of multiple network services, a

function known as dynamic service selection. This enables the service provider to easily create and

offer new IP services for individuals.

Operationally, PPPoE saves significant effort for both you and the ISP or carrier, as it requires no

specific configuration of the broadband modem at the customer site.

By implementing PPPoE directly on the Device (rather than individual computers), the computers on

the LAN do not need PPPoE software installed, since the Device does that part of the task.

Furthermore, with NAT, all of the LANs’ computers will have access.

ATM Traffic Classes

These are the basic ATM traffic classes defined by the ATM Forum Traffic Management 4.0

Specification.

Chapter 6 Broadband

VMG4380-B10A / VMG4325-B10A User’s Guide

98

Constant Bit Rate (CBR)

Constant Bit Rate (CBR) provides fixed bandwidth that is always available even if no data is being

sent. CBR traffic is generally time-sensitive (doesn't tolerate delay). CBR is used for connections

that continuously require a specific amount of bandwidth. A PCR is specified and if traffic exceeds

this rate, cells may be dropped. Examples of connections that need CBR would be high-resolution

video and voice.

Variable Bit Rate (VBR)

The Variable Bit Rate (VBR) ATM traffic class is used with bursty connections. Connections that use

the Variable Bit Rate (VBR) traffic class can be grouped into real time (VBR-RT) or non-real time

(VBR-nRT) connections.

The VBR-RT (real-time Variable Bit Rate) type is used with bursty connections that require closely

controlled delay and delay variation. It also provides a fixed amount of bandwidth (a PCR is

specified) but is only available when data is being sent. An example of an VBR-RT connection would

be video conferencing. Video conferencing requires real-time data transfers and the bandwidth

requirement varies in proportion to the video image's changing dynamics.

The VBR-nRT (non real-time Variable Bit Rate) type is used with bursty connections that do not

require closely controlled delay and delay variation. It is commonly used for "bursty" traffic typical

on LANs. PCR and MBS define the burst levels, SCR defines the minimum level. An example of an

VBR-nRT connection would be non-time sensitive data file transfers.

Unspecified Bit Rate (UBR)

The Unspecified Bit Rate (UBR) ATM traffic class is for bursty data transfers. However, UBR doesn't

guarantee any bandwidth and only delivers traffic when the network has spare bandwidth. An

example application is background file transfer.

IP Address Assignment

A static IP is a fixed IP that your ISP gives you. A dynamic IP is not fixed; the ISP assigns you a

different one each time. The Single User Account feature can be enabled or disabled if you have

either a dynamic or static IP. However the encapsulation method assigned influences your choices

for IP address and default gateway.

Introduction to VLANs

A Virtual Local Area Network (VLAN) allows a physical network to be partitioned into multiple logical

networks. Devices on a logical network belong to one group. A device can belong to more than one

group. With VLAN, a device cannot directly talk to or hear from devices that are not in the same

group(s); the traffic must first go through a router.

In Multi-Tenant Unit (MTU) applications, VLAN is vital in providing isolation and security among the

subscribers. When properly configured, VLAN prevents one subscriber from accessing the network

resources of another on the same LAN, thus a user will not see the printers and hard disks of

another user in the same building.

VLAN also increases network performance by limiting broadcasts to a smaller and more

manageable logical broadcast domain. In traditional switched environments, all broadcast packets

go to each and every individual port. With VLAN, all broadcasts are confined to a specific broadcast

domain.

Chapter 6 Broadband

VMG4380-B10A / VMG4325-B10A User’s Guide

99

Introduction to IEEE 802.1Q Tagged VLAN

A tagged VLAN uses an explicit tag (VLAN ID) in the MAC header to identify the VLAN membership

of a frame across bridges - they are not confined to the switch on which they were created. The

VLANs can be created statically by hand or dynamically through GVRP. The VLAN ID associates a

frame with a specific VLAN and provides the information that switches need to process the frame

across the network. A tagged frame is four bytes longer than an untagged frame and contains two

bytes of TPID (Tag Protocol Identifier), residing within the type/length field of the Ethernet frame)

and two bytes of TCI (Tag Control Information), starts after the source address field of the Ethernet

frame).

The CFI (Canonical Format Indicator) is a single-bit flag, always set to zero for Ethernet switches. If

a frame received at an Ethernet port has a CFI set to 1, then that frame should not be forwarded as

it is to an untagged port. The remaining twelve bits define the VLAN ID, giving a possible maximum

number of 4,096 VLANs. Note that user priority and VLAN ID are independent of each other. A

frame with VID (VLAN Identifier) of null (0) is called a priority frame, meaning that only the priority

level is significant and the default VID of the ingress port is given as the VID of the frame. Of the

4096 possible VIDs, a VID of 0 is used to identify priority frames and value 4095 (FFF) is reserved,

so the maximum possible VLAN configurations are 4,094.

Multicast

IP packets are transmitted in either one of two ways - Unicast (1 sender - 1 recipient) or Broadcast

(1 sender - everybody on the network). Multicast delivers IP packets to a group of hosts on the

network - not everybody and not just 1.

Internet Group Multicast Protocol (IGMP) is a network-layer protocol used to establish membership

in a Multicast group - it is not used to carry user data. IGMP version 2 (RFC 2236) is an

improvement over version 1 (RFC 1112) but IGMP version 1 is still in wide use. If you would like to

read more detailed information about interoperability between IGMP version 2 and version 1, please

see sections 4 and 5 of RFC 2236. The class D IP address is used to identify host groups and can be

in the range 224.0.0.0 to 239.255.255.255. The address 224.0.0.0 is not assigned to any group

and is used by IP multicast computers. The address 224.0.0.1 is used for query messages and is

assigned to the permanent group of all IP hosts (including gateways). All hosts must join the

224.0.0.1 group in order to participate in IGMP. The address 224.0.0.2 is assigned to the multicast

routers group.

At start up, the Device queries all directly connected networks to gather group membership. After

that, the Device periodically updates this information.

DNS Server Address Assignment

Use Domain Name System (DNS) to map a domain name to its corresponding IP address and vice

versa, for instance, the IP address of www.zyxel.com is 204.217.0.2. The DNS server is extremely

important because without it, you must know the IP address of a computer before you can access

it.

The Device can get the DNS server addresses in the following ways.

TPID

2 Bytes

User Priority

3 Bits

CFI

1 Bit

VLAN ID

12 Bits

Chapter 6 Broadband

VMG4380-B10A / VMG4325-B10A User’s Guide

100

1

The ISP tells you the DNS server addresses, usually in the form of an information sheet, when you

sign up. If your ISP gives you DNS server addresses, manually enter them in the DNS server fields.

2

If your ISP dynamically assigns the DNS server IP addresses (along with the Device’s WAN IP

address), set the DNS server fields to get the DNS server address from the ISP.

IPv6 Addressing

The 128-bit IPv6 address is written as eight 16-bit hexadecimal blocks separated by colons (:). This

is an example IPv6 address

2001:0db8:1a2b:0015:0000:0000:1a2f:0000

.

IPv6 addresses can be abbreviated in two ways:

•

Leading zeros in a block can be omitted. So

2001:0db8:1a2b:0015:0000:0000:1a2f:0000

can

be written as

2001:db8:1a2b:15:0:0:1a2f:0

.

•

Any number of consecutive blocks of zeros can be replaced by a double colon. A double colon can

only appear once in an IPv6 address. So

2001:0db8:0000:0000:1a2f:0000:0000:0015

can be

written as

2001:0db8::1a2f:0000:0000:0015

,

2001:0db8:0000:0000:1a2f::0015

,

2001:db8::1a2f:0:0:15

or

2001:db8:0:0:1a2f::15

.

IPv6 Prefix and Prefix Length

Similar to an IPv4 subnet mask, IPv6 uses an address prefix to represent the network address. An

IPv6 prefix length specifies how many most significant bits (start from the left) in the address

compose the network address. The prefix length is written as “/x” where x is a number. For

example,

2001:db8:1a2b:15::1a2f:0/32

means that the first 32 bits (

2001:db8

) is the subnet prefix.