Friday, 3 July 2015

There are only few PCs connected to ZyWALL 110, but the number of active sessions is almost at the limit.

Scenario

When I logged in to the device, I found that the number of active sessions was almost at the limit,






But when I go to the monitor page, only three client on the ZW110,



How to check where do these session come from?

Step

1.SSH/console access to device.
2. Use this CLI to dump the conntrack on the ZW
     Router> debug system show conntrack
3.Check the IP address to find out who keep create conntrack through ZW.
4.When you found which specific IP address keeps flooding the network, power off the PC and then monitor the ZW again.


We saw this kind of contrack kept showing in the ZyWALL

tcp      6 115 SYN_SENT src=10.10.10.23 dst=AA.AA.AA.AA sport=22372 dport=80 packets=1 bytes=985 [UNREPLIED] src=XX.XX.XX.XX dst=OO.OO.OO.OO sport=80 dport=22372 packets=0 bytes=0 mark=0 use=2
So we power off that PC (10.10.10.23) then the session on the ZW decrease from 79878 to 217 directly.

How to configure ownCloud for remote access via myZyXELcloud?

Scenario

How to configure ownCloud for remote access via myZyXELcloud?


Step

  • Topology


  • Install ownCloud and myZyXELcloud-Agent from the Package Management.
  • Log into the NAS by  using a  web browser



  • Select the administrator logo to  access advanced setting  of the ownCloud and myZyXELcloud-Agent package.



  • Click System Setting > Firmware/Packages > Package.
  • Click Retrieve List From Internet, select ownCloud and myZyXELcloud-Agent packages from the list. Click theInstall/Upgrade button.




  • After installing  myZyXELcloud-Agent, click Application > myZyXELcloud-Agent to configure an account.


  • Click the provided myZyXELcloud-Agent link to go to the myZyXELcloud-Agent login page. Enter your account information or use your  Facebook or Google account to log into the NSA520/540.

What is the effect of default user session limit in N-4100 (Hotspot) and how/when to adjust it?

Model Number: ZyXEL N-4100

Problem 

Sometimes network traffic drop constantly or even unable to access website while browsing, no matter from LAN or WLAN

Solution

It is caused by default user session limit of N4100, which is 128
You can adjust it according to your network utilization policy to match specific needs
Said symptom is that N4100 has running out of sessions, the ping ICMP packets will not get response from 8.8.8.8.
If similiar phenomenon happens, please adjust user session, it can ease the symptom





Procedure

The N4100 is at factory default setting
GW------------------N4100---------[Ethernet or WLAN]----------------PC
To browse websites and ping 8.8.8.8 at the same time, found ping lost very often while doing quick web browse
(switch website before page completely loading)
I can see ping loss and web page loading fail very often, sometimes the website will even become unavailable.
To ease the symptom you just need to idle the device for a moment




Sunday, 31 May 2015

What is the procedure to implement VLANs in GS1910 Switch (firmware V2.00) ?

Understanding how to implement VLANs on GS1910

It’s easy to implement VLANs on GS1910, Go to Configuration > VLANs
Please refer the table below
The default VLAN setting is shown in table 1-1


  1. Port VLAN: This field indicates the port belong to which VLAN, also this feature is the sameas the PVID.
     
  2. Ingress Acceptance: This field indicates the ingress rule.      
    2.1 Tagged and Untagged: This rule means that the switch received the packets which are tagged and untagged.
    2.2 Tagged only: This rule means that the switch only received packet,  which is tagged.
    2.3 Untagged only: This rule means that the  switch only received packet, which is untagged.
     
  3. Egress tagging: This field indicates the Egress rule.
    3.1 Tagged all: This rule means that the packet is always tagged
    3.2 Untagged all: This rule means that the packet is always untagged
    3.3 Untagged port VLAN: This rule means that the packet will be untagged with the Port VLAN, but other VLANs will not be affected.
     
  4. Allowed VLANs: This field indicates that this port allows specific VLANs

Example1


Port 1 and 2, which is with PVID 10. Packets that are tagged and untagged will be received.
The Egress rule for Port 1 is “untag all” which means that all of the packet will be untagged.
The Egress rule for Port 2 is “tag all” which means that all of the packet will be tagged.
Both Port 1 and 2 allow VLAN 1,3,5-7 and forbid VLAN 2,4,8-10.

Setup the IP address for VLAN 10, Go to Configuration > System > IP

Scenario
PC A belongs to VLAN 10 on switch A,  and PC B belongs to VLAN 20 on switch A
PC C belongs to VLAN 10 on switch B and PC D belong to vlan 20 on switch B
PCA is able to communicate with PC C but not PC B and D.
PCB is able to communicate to PC D, but not PC A and PC C

The topology is below;

Both GS1910 have the same configuration.


Verification
PC A ping PC C

c:\>ping 10.10.10.2

Pinging 10.10.10.2 with 32 bytes of data:
Reply from 10.10.10.2: bytes=32 time=1ms TTL=64
Reply from 10.10.10.2: bytes=32 time<1ms TTL=64
Reply from 10.10.10.2: bytes=32 time<1ms TTL=64
Reply from 10.10.10.2: bytes=32 time<1ms TTL=64

PC B ping PC D
 
c:\>ping 10.10.20.2

Pinging 10.10.20.2 with 32 bytes of data:
Reply from 10.10.20.2: bytes=32 time=1ms TTL=64
Reply from 10.10.20.2: bytes=32 time<1ms TTL=64
Reply from 10.10.20.2: bytes=32 time<1ms TTL=64
Reply from 10.10.20.2: bytes=32 time<1ms TTL=64

To use the command “show mad address-table” to confirm that the MAC address is listed on the correct VLAN and port.
GS1910-1
GS1910-1# show mac address-table
Type    VID  MAC Address        Ports
Dynamic 10   0c:4d:e9:a4:ed:a4  GigabitEthernet 1/3
Dynamic 10   d8:50:e6:11:05:93  GigabitEthernet 1/1
Dynamic 20   00:23:54:2e:98:b9  GigabitEthernet 1/3
Dynamic 20   fc:4d:d4:35:5a:d2  GigabitEthernet 1/2

GS1910-2
GS1910-2# show mac address-table
Type    VID  MAC Address        Ports
Dynamic 10   0c:4d:e9:a4:ed:a4  GigabitEthernet 1/1
Dynamic 10   d8:50:e6:11:05:93  GigabitEthernet 1/3
Dynamic 20   00:23:54:2e:98:b9  GigabitEthernet 1/2
Dynamic 20   fc:4d:d4:35:5a:d2  GigabitEthernet 1/3

What is the procedure to block "Spotify" on ZyXEL USG-100 ?

SCENARIO DESCRIPTION:

Spotify is a popular software for music sharing in our country. In the USG's App-Patrol function, there is no related information to block Spotify. And on the USG20/20W we do not have App-Patrol,

What is the procdure to block Spotify?

SCENARIO DESCRIPTION:

Spotify is a popular software for music sharing in our country. In the USG's App-Patrol function, there is no related information to block Spotify. And on the USG20/20W we do not have App-Patrol,
What is the procdure to block Spotify?

Method 2. Create a custom IDP to block DNS query packet if this packet includes the Spotify signature.
The Spotify's software signature is "|73||70||6F||74||69||66||79|", please create a new IDP rule as shown below.

After create a custom IDP rule, please remember to modify the Activation, Log, Action settings in the profile tab.
Create a IDP policy then apply the IDP profile.

VERIFICATION:

When configuring the IP address of the USG as the DNS server, the Spotify software will get the 0.0.0.0 IP address as the Spotify URL. If you have configured a public DNS server, you will see the log message in the Monitor page.

Sunday, 24 May 2015

WAN Load balancing on ZyXEL USG-60/ USG-60W

1.1 Application Scenario

The company has two WAN connections for sharing outbound internet traffic . WAN1 uses a static IP address, and WAN2 uses a PPPoE connection. Since WAN1 ISP is also the company's VOIP provider, the network administrator wants VoIP traffic primarily sent out over WAN1. In case WAN1 is down, the VoIP can still go out over WAN2 PPPoE connection. The network administrator also wants HTTP traffic sent over WAN2 PPPoE connection primarily. In case WAN2 PPPoE is down, LAN users can still surf internet over WAN1. For all other types of traffic, administrator needs the WAN connection to share the outbound traffic load, performing load balancing.


1.2 Configuration Guide

Goal to achieve:

1) VoIP traffic goes out primarily through WAN1. In case WAN1 is down, it will go out via WAN2 PPPoE connection.

2) HTTP traffic goes out primarily through WAN2 PPPoE connection. In case WAN2 PPPoE is down, it will go out via WAN1.

3) All other traffic goes out via WAN trunk performing Load balancing with Least Load Balancing algorithm.


USG configuration:
Step 1. Configure a PPPoE account on WAN2 interface.
          (1) Go to CONFIGURATION > Object > ISP Account, add a PPPoE account:


          (2) Go to CONFIGURATION > Network > Interface > PPP, add a new PPP interface, which is                 based on WAN2 interface,




Step-2: Go to CONFIGURATION > Network>Interface>Trunk. Add WAN Trunks.

            (1) Add WAN trunks for VoIP traffic - Set WAN1 as Active mode, while setting WAN_ppp                     as Passive mode.




                (2) Add WAN trunk for HTTP traffic- Set WAN2_ppp as Active mode, while setting                                 WAN1 as Passive mode.

       
                (3) Use SYSTEM_DEFAULT_WAN_TRUNK to perform load balancing for all other                               traffic.


Step-3. Go to CONFIGURATION > Network > Routing > Policy Route, add policy routes for VoIP               and HTTP traffic.

(1) Add a policy route for VoIP traffic:

Source: LAN1_subnet
Destination: Any
Service: SIP
Next Hop: select the newly created WAN trunk WAN_Trunk_VoIP
     

Please note that to make sure this policy route applies to all VoIP traffic, including both the SIP signaling and RTP (voice data), we need to enable SIP ALG.

Go to CONFIGURATION > Network > ALG, enable SIP ALG.



(2)  Add a policy route for HTTP traffic:

Source: LAN1_subnet
Destination: Any
Service: HTTP
Next Hop: select the newly created WAN trunk WAN_Trunk_HTTP.


(3) For all other traffic, use SYSTEM_DEFAULT_WAN_TRUNK to perform load balancing. Go to CONFIGURATION >Network> Interface >Trunk. Click on Show Advance Settings.


Make sure Default SNAT is enabled. Select SYSTEM_DEFAULT_WAN_TRUNK in Default Selection.



General Wireless FaQ............................


What is a Wireless LAN?

Wireless LANs provide all the functionality of wired LANs, without the need for physical connections (wires). Data is modulated onto a radio frequency carrier and transmitted through the ether. Typical bit-rates are 11Mbps and 54Mbps, although in practice data throughput is half of this. Wireless LANs can be formed simply by equipping PC's with wireless NICs. If connectivity to a wired LAN is required an Access Point (AP) is used as a bridging device. AP's are typically located close to the centre of the wireless client population.

What are the advantages of Wireless LAN? 

Mobility: Wireless LAN systems can provide LAN users with access to real-time information anywhere in their organization. This mobility supports productivity and service opportunities not possible with wired networks.

Installation Speed and Simplicity: Installing a wireless LAN system can be fast and easy and can eliminate the need to pull cable through walls and ceilings.

Installation Flexibility: Wireless technology allows the network to go where wire cannot go. Reduced Cost-of-Ownership: While the initial investment required for wireless LAN hardware can be higher than the cost of wired LAN hardware, overall installation expenses and life-cycle costs can be significantly lower. Long-term cost benefits are greatest in dynamic environments requiring frequent moves and changes.

Scalability: Wireless LAN systems can be configured in a variety of topologies to meet the needs of specific applications and installations. Configurations are easily changed and range from peer-to-peer networks suitable for a small number of users to full infrastructure networks of thousands of users that enable roaming over a broad area.

What is the disadvantage of Wireless LAN? 

The speed of Wireless LAN is still relatively slower than wired LAN. The setup cost of Wireless LAN is relative high because the equipment cost including access point and PCMCIA Wireless LAN card is higher than hubs and CAT 5 cables.


What is an Access Point? 

The AP (access point also known as a base station) is the wireless server that with an antenna and a wired Ethernet connection that broadcasts information using radio signals. AP typically acts as a bridge for the clients. It can pass information to wireless LAN cards that have been installed in computers or laptops allowing those computers to connect to the campus network and the Internet without wires.

Is it possible to use wireless products from a variety of vendors? 

Yes. As long as the products comply with the same IEEE 802.11 standard. The Wi-Fi logo is used to define 802.11b compatible products. Wi-Fi5 is a compatibility standard for 802.11a products running in the 5GHz band.

What is Wi-Fi? 

The Wi-Fi logo signifies that a product is interoperable with wireless networking equipment from other vendors. A Wi-Fi logo product has been tested and certified by the Wireless Ethernet Compatibility Alliance (WECA). The Socket Wireless LAN Card is Wi-Fi certified, and that means that it will work (interoperate) with any brand of Access Point that is also Wi-Fi certified.

What types of devices use the 2.4GHz Band? 

Various spread spectrum radio communication applications use the 2.4 GHz band. This includes WLAN systems (not necessarily of the type IEEE 802.11b), cordless phones, wireless medical telemetry equipment and Bluetooth™ short-range wireless applications, which include connecting printers to computers and connecting modems or hands-free kits to mobile phones.

Does the 802.11 interfere with Bluetooth device? 

Any time devices are operated in the same frequency band; there is the potential for interference. Both the 802.11b/g and Bluetooth devices occupy the same2.4-to-2.483-GHz unlicensed frequency range-the same band. But a Bluetooth device would not interfere with other 802.11 devices much more than another 802.11 device would interfere. While more collisions are possible with the introduction of a Bluetooth device, they are also possible with the introduction of another 802.11 device, or a new 2.4 GHz cordless phone for that matter. But, Bluetooth devices are usually low-power, so the effects that a Bluetooth device may have on an 802.11 network, if any, aren't far-reaching.

Can radio signals pass through wall? 

Transmitting through a wall is possible depending upon the material used in its construction. In general, metals and substances with high water content do not allow radio waves to pass through. Metals reflect radio waves and concrete attenuates radio waves. The amount of attenuation suffered in passing through concrete will be a function of its thickness and amount of metal re-enforcement used.

What are potential factors that may causes interference among WLAN products?

Factors of interference:
(1) Obstacles: walls, ceilings, furniture… etc.
(2) Building Materials: metal door, aluminum studs.
(3) Electrical devices: microwaves, monitors, electric motors.

Solution:
(1) Minimizing the number of walls and ceilings
(2) Antenna is positioned for best reception
(3) Keep WLAN products away from electrical devices, eg: microwaves, monitors, electric motors,…, etc.
(4) Add additional APs if necessary.

What's the difference between a WLAN and a WWAN? 

WLANs are generally privately owned, wireless systems that are deployed in a corporation, warehouse, hospital, or educational campus setting. Data rates are high and there are no per-packet charges for data transmission. WWANs are generally publicly shared data networks designed to provide coverage in metropolitan areas and along traffic corridors. WWANs are owned by a service provider or carrier. Data rates are low and charges are based on usage. Specialized applications are characteristically designed around short, burst messaging.

What is Ad Hoc mode? 

A wireless network consists of a number of stations without using an access point or any connection to a wired network.

What is Infrastructure mode? 

Infrastructure mode implies connectivity to a wired communications infrastructure. If such connectivity is required the Access Points must be used to connect to the wired LAN backbone. Wireless clients have their configurations set for "infrastructure mode" in order to utilize access points relaying.

How many Access Points are required in a given area? 

This depends on the surrounding terrain, the diameter of the client population, and the number of clients. If an area is large with dispersed pockets of populations then extension points can be used for extend coverage.

What is Direct-Sequence Spread Spectrum Technology – (DSSS)? 

DSSS spreads its signal continuously over a wide frequency band. DSSS maps the information bearing bit-pattern at the sending station into a higher data rate bit sequence using a "chipping" code. The chipping code (also known as processing gain) introduces redundancy which allows data recovery if certain bit errors occur during transmission. The FCC rules the minimum processing gain should be 10, typical systems use processing gains of 20. IEEE 802.11b specifies the use of DSSS.


What is Frequency-hopping Spread Spectrum Technology – (FHSS)? 

FHSS uses a narrowband carrier which hops through a predefined sequence of several frequencies at a specific rate. This avoids problems with fixed channel narrowband noise and simple jamming. Both transmitter and receiver must have their hopping sequences synchronized to create the effect of a single "logical channel". To an unsynchronized receiver an FHSS transmission appears to be short-duration impulse noise. 802.11 may use FHSS or DSSS.

Do I need the same kind of antenna on both sides of a link? 

No. Provided the antenna is optimally designed for 2.4GHz or 5GHz operation. WLAN NICs often include an internal antenna which may provide sufficient reception.


Why the 2.4 GHZ Frequency range? 

This frequency range has been set aside by the FCC, and is generally labeled the ISM band. A few years ago Apple and several other large corporations requested that the FCC allow the development of wireless networks within this frequency range. What we have today is a protocol and system that allows for unlicensed use of radios within a prescribed power level. The ISM band is populated by Industrial, Scientific and Medical devices that are all low power devices, but can interfere with each other.

What is Server Set ID (SSID)? 

SSID is a configurable identification that allows clients to communicate to the appropriate base station. With proper configuration, only clients that are configured with the same SSID can communicate with base stations having the same SSID. SSID from a security point of view acts as a simple single shared password between base stations and clients.


What is an ESSID? 

ESSID stands for Extended Service Set Identifier and identifies the wireless LAN. The ESSID of the mobile device must match the ESSID of the AP to communicate with the AP. The ESSID is a 32-character maximum string and is case-sensitive.

What is WEP? 

Wired Equivalent Privacy. WEP is a security mechanism defined within the 802.11 standard and designed to make the security of the wireless medium equal to that of a cable (wire). WEP data encryption was designed to prevent access to the network by "intruders" and to prevent the capture of wireless LAN traffic through eavesdropping. WEP allows the administrator to define a set of respective "Keys" for each wireless network user based on a "Key String" passed through the WEP encryption algorithm. Access is denied by anyone who does not have an assigned key. Note, WEP has shown to have fundamental flaws in its key generation processing.

What is WPA-PSK?

WPA-PSK (Wi-Fi Protected Access Pre-Shared Key) can be used if user do not have a Radius server but still want to benefit from it. Because WPA-PSK only requires a single password to be entered on wireless AP/gateway and wireless client. As long as the passwords match, a client will be granted access to the WLAN.

What is a WEP key? 

A WEP key is a user defined string of characters used to encrypt and decrypt data.

Will 128-bit WEP communicate with 64-bit WEP? 

No. 128-bit WEP will not communicate with 64-bit WEP. Although 128 bit WEP also uses a 24 bit Initialization Vector, but it uses a 104 bit as secret key. Users need to use the same encryption level in order to make a connection.