Configuration Guide for 802.1X VLAN Assignment and MAB - TP-Link

Configuration Guide
For 802.1X VLAN Assignment and MAB
T2600G-28TS _v2_170323 or Above
T2600G-52TS_v2_1703023 or Above
T2600G-28MPS_v2_170928 or Above
1910012315 REV1.0.0
December 2017
CONTENTS
1Overview������������������������������������������������������������������������������������������������������������������������������������������������������������������� 1
2
Example for VLAN Assignment ����������������������������������������������������������������������������������������������������������������������� 3
2.1
Network Requirements������������������������������������������������������������������������������������������������������������������������������������������������������� 3
2.3
RADIUS Server Introduction�������������������������������������������������������������������������������������������������������������������������������������������� 4
2.2
Configuration Scheme�������������������������������������������������������������������������������������������������������������������������������������������������������� 3
2.4Configuration���������������������������������������������������������������������������������������������������������������������������������������������������������������������������� 4
2.4.1 Build a RADIUS Server���������������������������������������������������������������������������������������������������������������������������������������� 4
2.4.2 Configure VLAN Assignment on the Switch������������������������������������������������������������������������������������������ 7
3
2.5
2.4.3 Set Up Authentication on 802.1X Client Software��������������������������������������������������������������������������� 11
Verify the Configuration Result����������������������������������������������������������������������������������������������������������������������������������� 13
Example for MAB �������������������������������������������������������������������������������������������������������������������������������������������������15
3.1
3.2
Network Requirements���������������������������������������������������������������������������������������������������������������������������������������������������� 15
Configuration Scheme����������������������������������������������������������������������������������������������������������������������������������������������������� 15
3.3Configuration������������������������������������������������������������������������������������������������������������������������������������������������������������������������� 16
3.3.1 Build a RADIUS Server������������������������������������������������������������������������������������������������������������������������������������� 16
3.4
3.3.2 Configure MAB on the Switch��������������������������������������������������������������������������������������������������������������������� 19
Verify the Configuration Result����������������������������������������������������������������������������������������������������������������������������������� 22
Overview
1
Overview
802.1X authentication is a network access control method which safeguards network
security. If the client passes the RADIUS server authentication then the client can access
the LAN. Otherwise, the client cannot access the LAN.
VLAN Assignment and MAB are two important features of 802.1X authentication, and act
as safety controls.
VLAN Assignment
VLAN Assignment allows the RADIUS server to send the VLAN configuration to the port
dynamically. VLAN Assignment is used together with 802.1X authentication. After the
port is authenticated, the RADIUS server assigns the VLAN based on the username of
the client connecting to the port. The username-to-VLAN mappings must already be
stored in the RADIUS server database.
The figure below shows the typical topology of VLAN Assignment. VLAN Assignment
is port-based. With VLAN Assignment enabled, the RADIUS server will send the VLAN
configuration when the port is authenticated. VLAN IDs are assigned based on switch
ports.
If the assigned VLAN is nonexistent on the switch, the switch will create the related
VLAN automatically, add the authenticated port to the VLAN and change the PVID
based on the assigned VLAN.
If the assigned VLAN exists on the switch, the switch will directly add the
authenticated port to the related VLAN and change the PVID instead of creating a
new VLAN.
If no VLAN is supplied by the RADIUS server or if 802.1X authentication is disabled,
the port will be still in its original VLAN.
Username1- password1- VLAN1
RADIUS Server
Username2- password2- VLAN2
Username3- password3- VLAN3
...
Switch
Department VLAN 1
Enable VLAN Assignment on the related ports.
Department VLAN 2
Clients
Username1- password1
Department VLAN 3
Clients
Username2 - password2
Clients
Username3 - password3
Configuration Guide
1
Overview
MAB
MAB (MAC Authentication Bypass) uses the MAC address of a device to determine
whether the client can get access to the network. After checking the MAC addresses
of the clients that you want to access the network, add these MAC addresses into the
database of the RADIUS server. With MAB enabled on th port, the switch will learn the
MAC address of the device automatically and send the authentication server a RADIUS
access request frame with the client’s MAC address as the username and password. If
the authorization succeeds, the RADIUS server grants the client access to the network.
Thus devices can be authenticated without any client software installed. And MAB can
be used to authenticate devices without 802.1X capability like IP phones.
MAB interacts with the other features:
802.1X authentication— MAB takes effect only if 802.1X authentication is enabled on
the port.
VLAN Assignment— MAB can be used on a port with VLAN Assignment enabled. That
is, if a client has an authorized MAC address identity, the switch assigns the client to a
specific VLAN if VLAN Assignment is configured on the corresponding port.
Configuration Guide
2
Example for VLAN Assignment
2
Example for VLAN Assignment
2.1 Network Requirements
To enhance network security, a company requires that the employees can access the
network normally only when their computers pass the authentication successfully.
At the same time, to reduce the workload of the configuration, it is required that the
ten authenticated computers can be automatically assigned to the VLANs of their
departments. The network topology is shown as below.
RADIUS Server
192.168.0.253/24
Internet
Gi1/0/1
Router
Gi1/0/2
Switch
Gi1/0/3-13
Department VLAN
...
Client
Client
2.2 Configuration Scheme
802.1X Authentication is commonly used in solving authentication and security
problems for LAN ports. VLAN Assignment can assign multiple clients to different VLANs
depending on their authentication information. Thus configure 802.1X Authentication
and VLAN Assignment to meet the requirement.
The configuration is briefly summarized in the following outlines:
1) Build a RADIUS Server.
2) Configure 802.1X and VLAN Assignment on the switch.
3) Start the authentication on 802.1X client software.
Configuration Guide
3
Example for VLAN Assignment
2.3 RADIUS Server Introduction
A RADIUS server receives user authentication requests, authenticates the user, and then
returns authentication results to the authenticator (the switch).
This guide takes FreeRADIUS.net as an example to build a RADIUS server.
FreeRADIUS.net installation file can be downloaded from http://freeradius.net/index.html.
Run the file and follow the wizard to install the FreeRADIUS.net on a local computer.
After installing FreeRADIUS.net on the computer, some configurations files should be
modified to satisfy the 802.1X authentication requirements:
Modify the clients.conf to add RADIUS client (the switch) information.
Modify the users.conf to add user authentication information.
2.4 Configuration
Configuration Guidelines:
VLAN Assignment takes effect only when the control type is Port Based. Set the
control type as Port Based on the ports connected to clients.
802.1X authentication and Port Security cannot be enabled at the same time. Before
enabling 802.1X authentication, make sure that Port Security is disabled.
Keep 802.1X authentication disabled on ports connected to the authentication
server, the internet and the management computer, which ensures the traffic will not
be blocked for the switch.
Demonstrated with T2600G-28TS acting as the authenticator, FreeRADIUS.net acting as
the RADIUS server and TP-Link 802.1X Client Software, the following sections provide
configuration procedures. The configuration procedures on the switch will be given in
two ways: using the GUI and using the CLI.
2.4.1 Build a RADIUS Server
For the network administrator, the first thing is to build a RADIUS server, and put the
user information for employees into the RADIUS server. The network administrator
can set different username and password for each employee or set a public username
and password shared by all the employees in the same department. The setting of the
username and password depends on the actual demands.
to load the following window. Choose Start FreeRADIUS.net
1) Right click the icon
Service to start the RADIUS server.
Configuration Guide
4
Example for VLAN Assignment
2) Right click the icon
and choose Edit Radius Clients.conf to add an entry for the
RADIUS client (T2600G-28TS).
To avoid the format error of the adding code, use Notepad++ to edit configuration
files.
One client section means a RADIUS client. You can choose one of the client sections
and edit the following attributes. Or you can add a new client section to meet your
requirements.
The clients.conf can be modified in three aspects:
Configuration Guide
5
Example for VLAN Assignment
The IP address of network segment of the authenticator (T2600G-28TS). After
the installation is completed, the default configuration file contains the commonly
used network segment. Thus you can keep it as default in most cases.
The secret which is the shared key between the RADIUS server and the switch.
The RADIUS server and the switch use the key string to encrypt passwords and
exchange responses.
The shortname which is used as an alias for the fully qualified domain name, or the
IP address. A value can be filled in optionally for the shortname.
According to the network topology, add the following code and save the file.
Note:
The secret can be any string, up to 32 characters in length.
3) Right click the icon
assigned to.
and choose Edit Users to add a user which the VLAN will be
Configuration Guide
6
Example for VLAN Assignment
The user information can be modified in four aspects:
User-name and User-Password, which is the authentication information of the
clients. You can replace rfc3580 with the username which you want and replace
demo with the new password. Or you can ignore the default user information and
add new user information which has identical format in the next line.
Tunnel-Type, which indicates the tunneling protocol to be used. To configure
VLAN Assignment, specify this value as VLAN.
Tunnel-Medium-Type, which indicates the transport medium to use when creating
a tunnel for tunneling protocols. To configure VLAN Assignment, specify this value
as IEEE-802.
Tunnel-Private-Group-Id, which indicates the group ID for a particular tunneled
session, that is the assigned VLAN ID.
According to the network topology, add the following codes and save the file.
Note:
• More than one entry which indicates username-to-VLAN mapping can be added in this
file or use a database to store the entries.
• The user-name can be up to 253 characters in length.
4) Click Restart FreeRaDIUS.net Service to restart FreeRaDIUS.net.
2.4.2 Configure VLAN Assignment on the Switch
Using the GUI
1) Choose the menu Network Security > AAA > Global Config to load the following
page. In the Global Config section, enable AAA function and click Apply.
Configuration Guide
7
Example for VLAN Assignment
2) Choose the menu Network Security > AAA > Dot1x List to load the following page.
In the Authentication Dot1x Method List section, select an existing RADIUS server
group for authentication from the Pri1 drop-down list and click Apply.
3) Choose the menu Network Security > AAA > RADIUS Config to load the following
page. Enter the IP address of the RADIUS server and the shared key which is predefined in the Radius Clients.conf.
4) Choose the menu Network Security > 802.1X > Global Config to load the following
page. In the Global Config section, enable 802.1X and VLAN Assignment globally and
click Apply.
5) Choose the menu Network Security > 802.1X > Port Config to load the following
page. Select the port 1/0/3-13 which you want to deploy 802.1X VLAN Assignment
and set the status for port1/0/3-13 as Enable. Set the control type as Port Based
for port1/0/3-13. Set the status for port 1/0/1 and port 1/0/2 as Disable so that the
RADIUS server and the internet will not be blocked for the switch.
Configuration Guide
8
Example for VLAN Assignment
Using the CLI
1) Enable AAA globally and configure the RADIUS parameters.
T2600G-28TS#configure
T2600G-28TS(config)#aaa enable
T2600G-28TS(config)#aaa authentication dot1x default radius
T2600G-28TS(config)#radius -server host 192.168.0.253 auth-port 1812 key 123456
2) Globally enable 802.1X authentication and set the authentication protocol. Enable
VLAN Assignment.
T2600G-28TS(config)#dot1x system-auth-control
T2600G-28TS(config)#dot1x auth-method eap
T2600G-28TS(config)#dot1x vlan-assignment
3) Disable 802.1X authentication on port 1/0/1and port 1/0/2. Enable 802.1X
authentication on port 1/0/3, set the mode as Auto, and set the control type as PortBased.
T2600G-28TS(config)#interface range gigabitEthernet 1/0/1-2
T2600G-28TS(config-if-range)#no dot1x
T2600G-28TS(config-if-range)#exit
T2600G-28TS(config)#interface range gigabitEthernet 1/0/3-13
T2600G-28TS(config-if-range)#dot1x
T2600G-28TS(config-if-range)#dot1x port-method port-based
T2600G-28TS(config-if-range)#dot1x port-control auto
T2600G-28TS(config-if-range)#exit
Configuration Guide
9
Example for VLAN Assignment
4) Verify the configurations.
Verify the global configurations of 802.1X authentication:
T2600G-28TS#show dot1x global
802.1X State:
Enabled
Authentication Method:
EAP
Handshake State:
Enabled
Guest VLAN State:
Disabled
Guest VLAN ID:
N/A
802.1X Accounting State:
Disabled
802.1X VLAN Assignment State:
Enabled
Quiet-period State:
Disabled
Quiet-period Timer:
10 sec.
Max Retry-times For RADIUS Packet:
Supplicant Timeout:
3
3 sec.
Verify the configurations of 802.1X authentication on the port:
T2600G-28TS#show dot1x interface
Port
State MAB State GuestVLAN PortControl PortMethod Authorized LAG
----
------
------------ ------------ -------------- -------------- ------------- -----
Gi1/0/1 disabled disabled disabled
auto
mac-based authorized
N/A
Gi1/0/2 disabled disabled disabled
auto
mac-based authorized
N/A
Gi1/0/3 enabled disabled disabled
auto
port-based unauthorized N/A
Gi1/0/4 enabled disabled disabled
auto
port-based unauthorized N/A
...
Verify the configurations of RADIUS:
T2600G-28TS#show aaa global
AAA global status:
Enable
Module
Login List
Enable List
Console
default
default
Telnet
default
default
Ssh
default
default
Http
default
default
Configuration Guide
10
Example for VLAN Assignment
T2600G-28TS#show aaa authentication dot1x
Methodlist
pri1
pri2
pri3
pri4
default
radius
--
--
--
T2600G-28TS#show aaa group radius
192.168.0.253
2.4.3 Set Up Authentication on 802.1X Client Software
Before the employee can access the internet, the employee should input the
authentication information on the 802.1X Client Software. The authentication information
is the username and password which is set by the network administrator in the RADIUS
server.
1) On the computer to be authorized, download the TP-Link 802.1X Client Software
installation file from http://www.tp-link.com/en/download-center.html. Run the
file and follow the wizard to install the 802.1X client software. After completing
installation, double click the icon
following screen will appear.
to run the TP-Link 802.1X Client Software. The
2) Enter the username and password. In this example, enter “tplink” as the username
and “admin1” as the password , which is set in the RADIUS server, then click Connect.
Configuration Guide
11
Example for VLAN Assignment
Then the 802.1X client software will automatically register to the RADIUS server and
get the authority to the internet from the RADIUS server.
When passing the authentication, the following screen will appear.
Configuration Guide
12
Example for VLAN Assignment
2.5 Verify the Configuration Result
After all the configurations are completed, you can follow the steps below to verify
whether 802.1X VLAN Assignment works. Taking port 3 for a example, you can check
the switch by using GUI and CLI.
Using the GUI
1) Choose the menu Network Security > 802.1X > Port Config to check whether the
port 1/0/3 passes the 802.1X authentication successfully. After passing the 802.1X
authentication successfully, the Authorized state will change from Unauthorized to
Authorized.
A
e
zd
h
u
.o
itr
2) Choose the menu VLAN > 802.1Q VLAN > Global Config to check whether the port
1/0/3 is assigned to the corresponding VLAN.
Configuration Guide
13
Example for VLAN Assignment
Using the CLI
1) Verify the 802.1X authorization states on the port:
T2600G-28TS#show dot1x interface
Port
State
MAB State GuestVLAN PortControl PortMethod Authorized LAG
----
-----
----------
---------
------------- ------------- ------------- -----
Gi1/0/1 disabled disabled
disabled
auto
mac-based
authorized N/A
Gi1/0/2 disabled disabled
disabled
auto
mac-based
authorized N/A
Gi1/0/3 enabled disabled
disabled
auto
port-based
authorized N/A
...
2) Verify the VLAN information:
T2600G-28TS#show vlan
VLAN Name
Status
Ports
-----
-------------------- --------- ----------------------------------------
1
System-VLAN
active
Gi1/0/1, Gi1/0/2, Gi1/0/4, Gi1/0/5,
Gi1/0/6, Gi1/0/7, Gi1/0/8, Gi1/0/9,
Gi1/0/10, Gi1/0/11, Gi1/0/12, Gi1/0/13,
Gi1/0/14, Gi1/0/15, Gi1/0/16, Gi1/0/17,
Gi1/0/18, Gi1/0/19, Gi1/0/20, Gi1/0/21,
Gi1/0/22, Gi1/0/23, Gi1/0/24, Gi1/0/25,
Gi1/0/26, Gi1/0/27, Gi1/0/28
5
N/A
active
Primary Secondary Type
------- ---------
Gi1/0/3
Ports
------------------ ----------------------------------------
The port has been assigned to the related VLAN. That means 802.1X VLAN Assignment
works.
Configuration Guide
14
Example for MAB
3
Example for MAB
3.1 Network Requirements
The network administrator wants to restrict the authority of a device to access the
network resources. The device should be authenticated before getting access to the
internet. For convenience, it is better that the authentication process can be performed
automatically. The network topology is shown as below.
RADIUS Server
192.168.0.253/24
Internet
Gi1/0/2
Switch
Gi1/0/1
Gi1/0/3
Client
3.2 Configuration Scheme
MAB uses the MAC address of a device to determine whether the device can get access
to the network. Thus MAB can be used to authenticate devices without 802.1X Client
Software.
The configuration is briefly summarized in two steps:
1) Build a RADIUS Server.
2) Configure MAB on TP-Link switch.
Configuration Guide
15
Example for MAB
3.3 Configuration
Configuration Guidelines:
MAB uses the MAC address of the client as the username and password. Please
check the MAC addresses of the clients that you want to access the network in
advance.
MAB takes effect only when 802.1X Authentication is enabled. Enable 802.1X
Authentication on the ports connected to clients.
MAB takes effect only when Guest VLAN is disabled. Ensure that Guest VLAN is
disabled when configuring MAB.
802.1X authentication and Port Security cannot be enabled at the same time. Before
enabling 802.1X authentication, make sure that Port Security is disabled.
Keep 802.1X authentication disabled on ports connected to the authentication
server, the internet and the management computer, which ensures they will not be
blocked from accessing the switch.
Demonstrated with T2600G-28TS acting as the authenticator, FreeRADIUS.net acting
as the RADIUS server, the following sections provide configuration procedures. The
configuration procedures on the switch will be given in two ways: using the GUI and using
the CLI.
3.3.1 Build a RADIUS Server
1) Go to http://freeradius.net/index.html to download the FreeRADIUS.net and follow
the wizard to install it.
to load the following page. Choose Start FreeRADIUS.net
2) Right click the icon
Service to start the RADIUS server.
Configuration Guide
16
Example for MAB
3) Right click the icon
and choose Edit Radius Clients.conf to add an entry for our
RADIUS client (T2600G-28TS).
To avoid the format errors when adding code, use Notepad++ to edit configuration
files.
One client section means a RADIUS client. You can choose one of the section clients
and edit the following attributes. Or you can add a new client section to meet your
requirements. The Clients.conf should be modified in three aspects:
The IP address of network segment of the authenticator (T2600G-28TS). After
the installation is completed, the default configuration file contains the commonly
used network segment. Thus you can keep it as default in most cases.
The secret which is the shared key between the RADIUS server and the switch.
The RADIUS server and the switch use the key string to encrypt passwords and
exchange responses.
The shortname which is used as an alias for the fully qualified domain name, or
the IP address of the RADIUS client. A value can be filled in optionally for the short
name.
According to the network topology, add the following codes and save the file.
Configuration Guide
17
Example for MAB
4) The MAC addresses of users should be stored in a database which can be accessed
by the RADIUS server during the MAB attempt. This guide takes the internal database
on the RADIUS server itself as an example.
Right Click the icon
and choose Edit Users to add an MAB user.
Configuration Guide
18
Example for MAB
MAB uses the MAC address as the username and password. You can replace
rfc3580 and demo with the allowed MAC address. Or you can ignore the default user
information and add the MAC address in the next line.
Add the following codes and save the file:
Note:
• The format of the MAC address should be 12 hexadecimal digits, all lowercase and no
punctuation. Because MAB uses the MAC address as the username and password,
you should apply this format to make sure the RADIUS server can differentiate MAB
requests from other type of request for network access.
• If you choose other RADIUS server in MAB, please ensure that the MAC address of the
allowed client should be configured as username and password.
5) Click Restart FreeRaDIUS.net Service to restart FreeRaDIUS.net.
3.3.2 Configure MAB on the Switch
Using the GUI
1) Choose the menu Network Security > AAA > Global Config, enable AAA function on
the switch and click Apply.
2) Choose the menu Network Security > AAA > Dot1x List, select an existing RADIUS
server group for authentication from the Pri1 drop-down list and click Apply.
Configuration Guide
19
Example for MAB
3) Choose the menu Network Security > AAA > RADIUS Config, and enter
192.168.0.253 which is the IP address of the RADIUS server. Enter the shared key
between the RADIUS server and the switch. The RADIUS server and the switch use
the key string to encrypt passwords and exchange responses.
4) Choose the menu Network Security > 802.1X > Global Config, enable 802.1X globally
and click Apply.
5) Choose the menu Network Security > 802.1X > Port Config to load the following
page. Select port 1/0/3 and set the status as Enable and set Control Type as Port
Based. Enable MAB for port 1/0/3. Set the status for port 1/0/1 and port 1/0/2 as
Disable so that the RADIUS server and the internet will not be blocked for the switch.
Using the CLI
1) Enable AAA globally.
Configuration Guide
20
Example for MAB
T2600G-28TS#configure
T2600G-28TS(config)#aaa enable
T2600G-28TS(config)#aaa authentication dot1x default radius
T2600G-28TS(config)#radius -server host 192.168.0.253 auth-port 1812 key 123456
2) Globally enable 802.1X authentication and set the authentication protocol.
T2600G-28TS(config)#dot1x system-auth-control
T2600G-28TS(config)#dot1x auth-method eap
3) Disable 802.1X authentication on port 1/0/1and port 1/10/2. Enable 802.1X
authentication and MAB on port 1/0/3, set the mode as Auto, and set the control type
as Port Based.
T2600G-28TS(config)#interface range gigabitEthernet 1/0/1-2
T2600G-28TS(config-if-range)#no dot1x
T2600G-28TS(config-if-range)#exit
T2600G-28TS(config)#interface gigabitEthernet 1/0/3
T2600G-28TS(config-if)#dot1x
T2600G-28TS(config-if)#dot1x port-method port-based
T2600G-28TS(config-if)#dot1x port-control auto
T2600G-28TS(config-if)#dot1x mab
T2600G-28TS(config-if)#exit
4) Verify the configurations.
Verify the global configurations of 802.1X authentication:
T2600G-28TS#show dot1x global
802.1X State:
Enabled
Authentication Method:
EAP
Handshake State:
Enabled
Guest VLAN State:
Disabled
Guest VLAN ID:
N/A
802.1X Accounting State:
Disabled
802.1X VLAN Assignment State:
Disabled
Quiet-period State:
Disabled
Quiet-period Timer:
10 sec.
Max Retry-times For RADIUS Packet: 3
Configuration Guide
21
Example for MAB
Supplicant Timeout:
3 sec.
Verify the configurations of 802.1X authentication on the port:
T2600G-28TS#show dot1x interface
Port
State
----
-----
MAB State GuestVLAN PortControl PortMethod Authorized LAG
---------
-----------
--------------
----------- ------------- -----
Gi1/0/1 disabled disabled disabled
auto
mac-based
authorized
N/A
Gi1/0/2 disabled disabled disabled
auto
mac-based
authorized
N/A
Gi1/0/3 enabled enabled disabled
auto
port-based unauthorized
N/A
...
Verify the configurations of RADIUS:
T2600G-28TS#show aaa global
AAA global status:
Enable
Module
Login List
Enable List
Console
default
default
Telnet
default
default
Ssh
default
default
Http
default
default
T2600G-28TS#show aaa authentication dot1x
Methodlist
pri1
pri2
pri3
pri4
default
radius
--
--
--
T2600G-28TS#show aaa group radius
192.168.0.253
3.4 Verify the Configuration Result
After all configurations are completed, you can follow the steps below to test whether
MAB works.
Using the GUI
1) Choose the menu Network Security > 802.1X > Port Config to check whether the
port 1/0/3 has passed the authentication successfully.
Configuration Guide
22
Example for MAB
The port authentication state changes from Unauthorized to Authorized, that is, the
port has passed the authentication.
2) Open a web browser and browse a website to check whether the PC can get access
to the internet.
Using the CLI
1) Verify the 802.1X authorization states on the port:
T2600G-28TS#show dot1x interface
Port
State
MAB State GuestVLAN PortControl PortMethod Authorized LAG
----
-------
------------ ------------ ------------
--------------- ------------
-----
Gi1/0/1 disabled disabled disabled
auto
mac-based
authorized
N/A
Gi1/0/2 disabled disabled disabled
auto
mac-based
authorized
N/A
Gi1/0/3 enabled enabled disabled
auto
port-based
authorized
N/A
...
2) Open a web browser and browse a website and to check whether the PC can get
access to the internet.
Configuration Guide
23
COPYRIGHT & TRADEMARKS
Specifications are subject to change without notice.
is a registered
trademark of TP-Link Technologies Co., Ltd. Other brands and product names are
trademarks or registered trademarks of their respective holders.
No part of the specifications may be reproduced in any form or by any means or used
to make any derivative such as translation, transformation, or adaptation without
permission from TP-Link Technologies Co., Ltd. Copyright © 2017 TP-Link Technologies
Co., Ltd.. All rights reserved.