NETWORK SETTINGS. Cradlepoint ARC CBA850

PDF

Dokument

Annons

CRADLEPOINT

CBA850 | USER MANUAL Firmware version 5.4.0

6 NETWORK SETTINGS

The Network Settings tab provides access to seven submenu options for administering the following functions/tasks. These functions are all related to controlling the

LAN (Local Area Networks), the networks you set up with the CBA850.

• Content Filtering

• DHCP Server

• DNS

• Firewall

• Local Networks

• MAC Filter/Logging

• Routing

CRADLEPOINT, INC. PLEASE VISIT HTTP://KNOWLEDGEBASE.CRADLEPOINT.COM/ FOR MORE HELP AND RESOURCES PAGE 49

CRADLEPOINT

CBA850 | USER MANUAL Firmware version 5.4.0

Content Filtering

You have two main options for filtering content in a network created by your router.

1. Network WebFilter Rules: Create a list of websites that will be either disallowed or allowed. Customize the filter settings for each network. (These rules will not block HTTPS websites.)

2. OpenDNS Content Filtering: Allows several options for filtering rules using OpenDNS, a third party service.

Network WebFilter Rules

Network WebFilter Rules allow you to control access from your network to external domains or websites. Rules are assigned to a specific LAN network (or all networks). The highest priority rule will have precedence when there is a conflict. Addresses can be added by URL/Domain name or by IP address.

Exceptions to existing rules can be created by adding another rule with higher priority. For example, if access to espn.go.com is desired but go.com is blocked with a priority of 50, the addition of an “Allow” rule for espn.go.com with a priority of 51 or greater will allow access.

When creating rules keep in mind that some sites use multiple domains, so each domain may need a rule added to produce the desired behavior.

CRADLEPOINT, INC. PLEASE VISIT HTTP://KNOWLEDGEBASE.CRADLEPOINT.COM/ FOR MORE HELP AND RESOURCES PAGE 50

CRADLEPOINT

CBA850 | USER MANUAL Firmware version 5.4.0

Click Add or Edit to open the

Filter Rule Editor.

• Assigned Network: Select either “All Networks” or one of your LAN networks from the dropdown list.

• Domain/URL/IP: Enter the Domain Name or URL

(address) of the website you wish to control access for, e.g. www.google.com. To make sure the full domain is blocked, enter the most inclusive domain (e.g.

google.com will effectively block www.google.com as well as

maps.google.com and images.google.com).

Alternatively you can use an IP address, e.g. 8.8.8.8, or address range written in CIDR notation, e.g. 8.8.8.0/24.

• Filter Action: Select Block or Allow.

• Rule Priority: Higher number rules overrule lower number rules.

• Enabled: A rule can be enabled or disabled by selecting or deselecting the checkbox.

Click

Submit to save your rule changes.

CRADLEPOINT, INC. PLEASE VISIT HTTP://KNOWLEDGEBASE.CRADLEPOINT.COM/ FOR MORE HELP AND RESOURCES PAGE 51

CRADLEPOINT

CBA850 | USER MANUAL Firmware version 5.4.0

Default Filter Settings

Use Default Network Filter Settings together with Network

WebFilter Rules to control website access. All of your networks are set to allow website access by default. Select a network and click Edit to change the default filter settings.

Default Action: Select from the following dropdown options:

• Allow Access (default)

• Block Access

When a network is set to

Allow Access, it will allow access to sites not specifically blocked in the WebFilter Rules.

When a network is set to Block Access, it will block access to sites not specifically allowed in the WebFilter Rules.

Filter URLs by IP Address: (Default: No) Changing this option to “Yes” will cause the router to perform a DNS lookup on URL entries, and the IP addresses will be appended to the appropriate block/allow list. This can have the side effect of being very strict; sites that are hosted across many domains may need every domain added to the list for full functionality.

CRADLEPOINT, INC. PLEASE VISIT HTTP://KNOWLEDGEBASE.CRADLEPOINT.COM/ FOR MORE HELP AND RESOURCES PAGE 52

CRADLEPOINT

CBA850 | USER MANUAL Firmware version 5.4.0

Cloud Based Filtering/Security

Select a third-party

Cloud Provider from the dropdown list.

• Disabled

• Umbrella by OpenDNS

UMBRELLA BY OPENDNS

Umbrella by OpenDNS is a cloudbased web filtering and security solution that protects you online by filtering websites. Go to http://www.opendns.com/businesssecurity/ for information about

Umbrella.

Enter your Umbrella account information in order to use these content filtering settings.

OpenDNS ISP Filter Bypass

Algorithm: It is possible that your

Internet Service Provider (ISP) uses the port that OpenDNS is configured to access, port 53, which will prevent OpenDNS filtering. If OpenDNS does not appear to be working correctly, enabling this will attempt to bypass those ports when using an OpenDNS content filtering level.

CRADLEPOINT, INC. PLEASE VISIT HTTP://KNOWLEDGEBASE.CRADLEPOINT.COM/ FOR MORE HELP AND RESOURCES PAGE 53

CRADLEPOINT

CBA850 | USER MANUAL Firmware version 5.4.0

DHCP Server

DHCP stands for Dynamic Host Configuration Protocol. The built-in DHCP server automatically assigns IP addresses to the computers and other devices on each local area network (LAN). In this section you can view a list of assigned IP addresses and reserve IP addresses for particular devices.

Active Leases: A list of devices that have been provided DHCP leases. The DHCP server automatically assigns these leases. This list will not include any devices that have static IP addresses on the network. Select a device and click

Reserve to add the device and its IP address to the list of Reservations.

Reservations: This is a list of devices with reserved IP addresses. This reservation is almost the same as when a device has a static IP address except that the device must still request an IP address from the router. The router will provide the device the same IP address every time. DHCP reservations are helpful for server computers on the local network that are hosting applications such as Web and FTP. Servers on your network should either use a static IP address or a reservation.

While you have the option to manually input the information to reserve an IP address (Hostname, Hardware Addr, IP Addr), it is much simpler to select a device under the

Active Leases section and click “Reserve.” The selected device’s information will automatically be added under Reservations.

CRADLEPOINT, INC. PLEASE VISIT HTTP://KNOWLEDGEBASE.CRADLEPOINT.COM/ FOR MORE HELP AND RESOURCES PAGE 54

CRADLEPOINT

CBA850 | USER MANUAL Firmware version 5.4.0

DNS

DNS, or Domain Name System, is a naming system that translates between domain names (www.Cradlepoint.com, for example) and

Internet IP addresses (206.207.82.197). A DNS server acts as an Internet phone book, translating between names that make sense to people and the more complex numerical identifiers. The DNS page for the CBA850 has these distinct functions:

• DNS Settings: By default your router is set to automatically acquire DNS servers through your Internet provider (Automatic).

DNS Settings allows you to specify DNS servers of your choosing instead (Static).

• Dynamic DNS Configuration: Allows you to host a server (Web, FTP, etc.) using a domain name that you have purchased

(www.yourname.com) with your dynamically assigned IP address.

• Known Hosts Configuration: Allows you to map a name (printer, scanner, laptop, etc.) to an IP address of a device on the network.

DNS Settings

You have the option to choose specific DNS servers for your network instead of using the DNS servers assigned by your Internet provider. The default DNS servers are usually adequate. You may want to assign

DNS servers if the default DNS servers are performing poorly or if you have a local DNS server on your network.

Automatic Config: Automatic or Static (default:

Automatic). Switching to “Static” enables you to set specific DNS servers in the Primary DNS and Secondary DNS fields.

Primary DNS and Secondary DNS: If you choose to specify your DNS servers, enter the IP addresses of the servers you want as your primary and secondary DNS servers in these fields. The DNS server settings will be pre-populated with public DNS server IP addresses. You can override the IP address with any other DNS server IP address of your choice. For example, Google Public DNS servers have the IP addresses 8.8.8.8 and 8.8.4.4 while 4.2.2.2 and 4.2.2.3 are servers from Level 3 Communications.

Force All DNS Requests To Router: Enabling this will redirect all DNS requests from LAN clients to the router's DNS server. This will allow the router even more control over IP addresses even when clients have their own DNS servers statically set.

CRADLEPOINT, INC. PLEASE VISIT HTTP://KNOWLEDGEBASE.CRADLEPOINT.COM/ FOR MORE HELP AND RESOURCES PAGE 55

CRADLEPOINT

CBA850 | USER MANUAL Firmware version 5.4.0

Dynamic DNS Configuration

The Dynamic DNS feature allows you to host a server (Web, FTP, etc.) using a domain name that you have purchased

(www.yourname.com) with your dynamically assigned IP address. Most broadband Internet Service Providers assign dynamic

(changing) IP addresses. When you use a Dynamic DNS service provider, you can enter your host name to connect to your server, no matter what your IP address is.

Enable Dynamic DNS: Enable this option only if you have purchased your own domain name and registered with a Dynamic DNS service provider.

Server Type. Select a Dynamic DNS service provider from the pull-down list:

• www.DynDNS.org

• www.DNSomatic.com

• www.ChangeIP.com

• www.NO-IP.com

• Custom Server (DynDNS clone)

Custom Server Address. Only available if you select Custom Server from the Server Address dropdown list. Enter your custom dynamic DNS server address here. The server must support the

Dynamic DNS protocol. See www.dyndns.org for details. Example: myserver.mydomain.net.

Use HTTPS: Use the more secure HTTPS protocol. This is recommended, but could be disabled if not compatible with the server.

Host name: Enter your host name, fully qualified. For example: myhost.mydomain.net.

User name: Enter the user name or key provided by the Dynamic DNS service provider. If the Dynamic DNS provider supplies only a key, enter that key for both the User name and Password fields.

Password: Enter the password or key provided by the Dynamic DNS service provider.

CRADLEPOINT, INC. PLEASE VISIT HTTP://KNOWLEDGEBASE.CRADLEPOINT.COM/ FOR MORE HELP AND RESOURCES PAGE 56

CRADLEPOINT

CBA850 | USER MANUAL Firmware version 5.4.0

Advanced Dynamic DNS Settings

Update period (hours). (Default: 576) The time between periodic updates to the Dynamic DNS if your dynamic IP address has not changed. The timeout period is entered in hours so valid values are from 1 to 8760.

Override External IP. The external IP is usually configured automatically during connection. However, in situations where the unit is within a private network behind a firewall or router, the network's external IP address will have to be manually configured in this field.

You may find out what your external IP address is by going to http://myip.dnsomatic.com/ in a web browser.

Known Hosts Configuration

The Known Hosts Configuration feature allows you to map a name (printer, scanner, laptop, etc.) to an IP address of a device on the network. This assigns a new hostname that can be used to conveniently identify a device within the network, such as an office printer.

Click

Add to name a device in your network.

Fill in the following fields:

• Hostname: Choose a name that is meaningful to you. No spaces are allowed in this field.

• IP address: The address of the device within your network.

EXAMPLE: a personal laptop with IP address 192.168.0.164 could be assigned the name “MyLaptop”.

Since the assigned name is mapped to an IP address, the device’s IP address should not change. To ensure that the device keeps the same

IP address, go to Network Settings

→ DHCP Server and reserve the

IP address for the device by selecting the device in the Active Leases list and clicking “Reserve”.

CRADLEPOINT, INC. PLEASE VISIT HTTP://KNOWLEDGEBASE.CRADLEPOINT.COM/ FOR MORE HELP AND RESOURCES PAGE 57

CRADLEPOINT

CBA850 | USER MANUAL Firmware version 5.4.0

Firewall

The router automatically provides a firewall. Unless you configure the router to the contrary, the router does not respond to unsolicited incoming requests on any port, thereby making your LAN invisible to cyber attackers.

However, some network applications cannot run with a tight firewall. Those applications need to selectively open ports in the firewall to function correctly. The options on this page control ways of opening the firewall to address the needs of specific types of applications.

Port Forwarding Rules

A port forwarding rule allows traffic from the

Internet to reach a computer on the inside of your network. For example, a port forwarding rule might be used to run a Web server.

Exercise caution when adding new rules as they impact the security of your network.

Click Add to create a new port forwarding rule, or select an existing rule and click

Edit.

Add/Edit Port Forwarding Rule

• Name: Name your rule.

• Use Port Range: Changes the selection options to allow you to input a range of ports (if desired).

• Internet Port(s): The port number(s) as you want it defined on the Internet. Typically these will be the same as the local port numbers, but they do not have to be. These numbers will be mapped to the local port numbers.

• Local Computer: Select the IP address of an attached device from the dropdown menu, or manually input the IP address of a device.

CRADLEPOINT, INC. PLEASE VISIT HTTP://KNOWLEDGEBASE.CRADLEPOINT.COM/ FOR MORE HELP AND RESOURCES PAGE 58

CRADLEPOINT

CBA850 | USER MANUAL Firmware version 5.4.0

• Local Port(s): The port number(s) that corresponds to the service (Web server, FTP, etc.) on a local computer or device. For example, you might input “80” in the

Local Port(s) field to open a port for a Web server on a computer within your network.

The

Internet Port(s) field could then also be 80, or you could choose another port number that will be used across the

Internet to access your Web server. If you choose a number other than 80 for the Internet Port, connections to that number will be mapped to 80—and therefore the Web server—within your network.

• Protocol: Select from the following options in the dropdown menu: o

TCP o

UDP o

TCP & UDP

• Click Submit to save your completed port forwarding rule.

Network Prefix Translation (Advanced)

Network Prefix Translation is used in IPv6 networks to translate one IPv6 prefix to another. IPv6 prefix translation is an experimental specification ( RFC 6296 ) trying to achieve address independence similar to NAT in IPv4. Unlike NAT, however, NPT is stateless and preserves the IPv6 principle that each device has a routable public address. However, it still breaks any protocol embedding IPv6 addresses (e.g. IPsec) and is generally not recommended for use by the IETF. NPT can help to keep internal network ranges consistent across various IPv6 providers, but it cannot be used effectively in all situations.

The primary purpose for Cradlepoint’s NPT implementation is for failover/failback and load balancing setups. LAN clients can potentially retain the original IPv6 lease information and may experience a more seamless transition when WAN connectivity changes than if not utilizing NPT.

Mode:

• None – No translation is performed

• Load Balance Only –

(Default) Only translate networks when actively load balancing

• First – Use the first IPv6 prefix found

CRADLEPOINT, INC. PLEASE VISIT HTTP://KNOWLEDGEBASE.CRADLEPOINT.COM/ FOR MORE HELP AND RESOURCES PAGE 59

CRADLEPOINT

CBA850 | USER MANUAL Firmware version 5.4.0

• Static – Always use a static IPv6 translation (input the prefix here)

Transitioning from short prefix to a longer prefix (such as from /48 to /64) is not without problems, as some of the LANs may lose

IPv6 connectivity.

IP Filter Rules (Advanced)

An "Incoming" IP filter rule restricts remote access to computers on your local network.

"Outgoing" filter rules prevent computers on your local network from initiating communication to the address range specified in the rule.

This feature is especially useful when combined with port forwarding and/or DMZ to restrict remote access to a specified host or network range. For example, in order to host a server you might have opened ports with a port forwarding rule that could expose your

LAN to cyberattacks. With an incoming IP filter rule, you can restrict the access to your

LAN to only known devices.

• Name: Name your rule

• Enabled: Selected by default

• Log: When checked each packet matching this filter rule will be logged in the System Logs

• Action: “Allow” or “Deny”

• Protocol: Any, ICMP, TCP, UDP,

GRE, ESP, or SCTP

CRADLEPOINT, INC. PLEASE VISIT HTTP://KNOWLEDGEBASE.CRADLEPOINT.COM/ FOR MORE HELP AND RESOURCES PAGE 60

CRADLEPOINT

CBA850 | USER MANUAL Firmware version 5.4.0

IP Source/IP Destination

• IP Negation: Match on any IP address that is NOT in the specified IP network range.

• Network IP: Optional field to specify a matching network IP address for this rule to match against.

• Netmask: Use this to define a subnet size this rule will match against.

• Port Negation: Match on any port that is NOT in the specified port range.

• Port(s): Use for a single port or a range of ports. Fill in the left side for a single port.

Use Network IP, Netmask, and Port(s) to specify the ports and addresses for which the rule applies. You can specify a range of ports or a single port. Similarly, the netmask can be used to define either a range of addresses (i.e. 255.255.255.0) or a single address (255.255.255.255).

If you leave these values blank, then all IP addresses and ports will be included. IP Source and IP Destination options can be used to differentiate between the directions that packets go. You could permit packets to come from particular IP addresses but then not allow packets to return to those addresses.

Example of an IP Filter Rule: Suppose you have opened a port in your firewall in order to run a server. Someone, Johnny, is abusing that opening, so you would like to restrict his access. Create a rule that will deny Johnny’s IP address.

Add IP Filter Rule

• Name: No more Johnny

• Enabled: Selected

• Action: Deny

• Protocol: Any

IP Source

• Network IP: 172.22.24.160 (Johnny’s IP address)

• Netmask: 255.255.255.255 (This netmask restricts the rule to one single address).

• Port(s): 80

CRADLEPOINT, INC. PLEASE VISIT HTTP://KNOWLEDGEBASE.CRADLEPOINT.COM/ FOR MORE HELP AND RESOURCES PAGE 61

CRADLEPOINT

CBA850 | USER MANUAL Firmware version 5.4.0

DMZ: DeMilitarized Zone (Advanced)

A DMZ host is effectively not firewalled in the sense that any computer on the Internet may attempt to remotely access network services at the DMZ IP address. Typical uses involve running a public Web server or sharing files.

Input the IP Address of a single device in your network to create a DeMilitarized Zone for that device. To ensure that the IP address of the selected device remains consistent, go to the “Reservations” section under Network Settings

→ DHCP Server and reserve the IP address for the device.

As with port forwarding, use caution when enabling the DMZ feature as it can threaten the security of your network. Only use DMZ as a last resort.

Application Gateways

(Advanced)

Enabling an application gateway makes pinholes through the firewall. This may be required for some applications to function, or for an application to improve functionality or add features.

Exercise caution in enabling application gateways as they impact the security of

your network.

Enable any of the following types of application gateways:

• PPTP: For virtual private network access using Point to Point Tunneling Protocol. This is enabled by default.

• SIP: For Voice over IP using Session Initiation Protocol.

• TFTP: Enables file transfer using Trivial File Transfer Protocol.

CRADLEPOINT, INC. PLEASE VISIT HTTP://KNOWLEDGEBASE.CRADLEPOINT.COM/ FOR MORE HELP AND RESOURCES PAGE 62

CRADLEPOINT

CBA850 | USER MANUAL Firmware version 5.4.0

• FTP: To allow normal mode when using File Transfer Protocol. This is not needed for passive mode. This is enabled by default.

• IRC: For Direct Client to Client (DCC) transfer when using Internet Relay Chat. You may wish to forward TCP port 113 for incoming identd (RFC 1413) requests.

Firewall Options (Advanced)

Anti-Spoof: Anti-Spoof checks help protect against malicious users faking the source address in packets they transmit in order to either hide themselves or to impersonate someone else. Once the user has spoofed their address they can launch a network attack without revealing the true source of the attack or attempt to gain access to network services that are restricted to certain addresses.

Remote Administration Access Control (Advanced)

Enable Remote Administration Access

Control: Selecting this option allows you to make remote administration tools available to only the specified IP addresses. Access from all other IP addresses will be blocked.

This option only filters IP addresses: you must enable Remote Management separately (System Settings

→

Administration).

The services affected by this include remote

HTTP, HTTPS, SNMP, and SSH configuration tools. This does not restrict access to LAN-based administration, i.e. devices within your network still have administration access. The individual remote administration services can be enabled under System Settings

→ Administration --> Remote Management.

CRADLEPOINT, INC. PLEASE VISIT HTTP://KNOWLEDGEBASE.CRADLEPOINT.COM/ FOR MORE HELP AND RESOURCES PAGE 63

CRADLEPOINT

CBA850 | USER MANUAL Firmware version 5.4.0

REMOTE ADMINISTRATION ACCESS CONTROL EDITOR

IP Address: The IP address that will be allowed to access administrative services through the WAN.

Netmask (Optional): The netmask allows you to specify what IP address sets will be allowed access. If this field is left empty a netmask of 255.255.255.255 will be used, which means that only the single specified IP address would have remote administration access.

CRADLEPOINT, INC. PLEASE VISIT HTTP://KNOWLEDGEBASE.CRADLEPOINT.COM/ FOR MORE HELP AND RESOURCES PAGE 64

CRADLEPOINT

CBA850 | USER MANUAL Firmware version 5.4.0

Local Networks

This section is used to configure the settings for networks created by your router. The user can set up multiple networks on the CBA850, each with its own unique configuration and its own selection of interfaces. Each local network can be attached to either (or both) of the following types of interfaces:

• Ethernet

• VLAN

CRADLEPOINT, INC. PLEASE VISIT HTTP://KNOWLEDGEBASE.CRADLEPOINT.COM/ FOR MORE HELP AND RESOURCES PAGE 65

CRADLEPOINT

CBA850 | USER MANUAL Firmware version 5.4.0

Local IP Networks

Local IP Networks displays the following information for each network:

• Network Name and IP

address/Netmask (along the top bar)

• Enabled (Yes/No)

• DHCP Mode (e.g. DHCP Server mode)

• Schedule (Enabled/Disabled – See the Schedule tab in the Local

Network Editor)

• IPv4 Routing Mode (NAT, Standard, IP Passthrough, Disabled)

• IPv6 Addressing Mode (SLAAC Only, SLAAC with DHCP, Disable SLAAC and DHCP)

• Access Control (Admin Access, UPnP Gateway, LAN Isolation)

• Attached Interfaces (Ethernet port, VLAN)

Click

Add to configure a new network, or select an existing network and click Edit to view configuration options.

CRADLEPOINT, INC. PLEASE VISIT HTTP://KNOWLEDGEBASE.CRADLEPOINT.COM/ FOR MORE HELP AND RESOURCES PAGE 66

CRADLEPOINT

CBA850 | USER MANUAL Firmware version 5.4.0

Local Network Editor

Click

Add or select a network and click Edit to open the Local Network Editor to make configure a LAN. The Local Network Editor contains the following tabs:

• General Settings

• IPv4 Settings

• IPv6 Settings

• Interfaces

• Access Control

• IPv4 DHCP

• IPv6 Addressing

• Schedule

GENERAL SETTINGS

Enabled: Push to manually disable a network.

Also, some settings could cause a network to be automatically disabled: click here to re-enable the network.

Name: This primarily helps to identify this network during other administration tasks.

Hostname: [Default: cp (for Cradlepoint)] The hostname is the DNS name associated with the router's local area network IP address.

NOTE: You can access the router’s administration pages by typing the hostname into your browser, so if you change “cp” to another hostname, you can access the administration pages through the new hostname.

CRADLEPOINT, INC. PLEASE VISIT HTTP://KNOWLEDGEBASE.CRADLEPOINT.COM/ FOR MORE HELP AND RESOURCES PAGE 67

CRADLEPOINT

CBA850 | USER MANUAL Firmware version 5.4.0

IPV4 SETTINGS

IP Address: This is the address used by the router for local area network communication. Changes to this parameter may require a restart to computers on this network.

Each network must have a distinct IP address. Most users will want an address from one of the following private IP ranges:

• 10.0.0.1 - 10.255.255.1

• 172.16.0.1 - 172.31.255.1

• 192.168.0.1 - 192.168.255.1

NOTE: The final number does not have to be 1, but it is a simple, logical convention for routers that leaves higher numbers free for other devices.

Netmask: (Default: 255.255.255.0) Controls how many IP addresses can be used in this network. The default value allows for 254 IP addresses.

IPv4 Routing Mode: (Default: NAT) Each network can use a unique routing mode to connect to the Internet and other local networks. NAT is desirable for most configurations. Select from the following options in the dropdown list:

• NAT: Network Address Translation hides private IP addresses behind the router's IP address. This is the simplest and most common choice for users, because NAT does the translation work for you.

• Standard: NAT-less routing. If you select Standard, you must separately configure your IP addresses so that they will be publically accessible. Typically you will not select this option unless you have a specific reason to bypass NAT.

• IP Passthrough: IP Passthrough passes the IP address given by a cellular modem (WAN) through the router to Ethernet

(LAN). The easiest way to enable IP Passthrough mode is with the IP Passthrough Setup Wizard (see Getting Started

→

IP Passthrough Setup).

• Disabled: Disable this network.

CRADLEPOINT, INC. PLEASE VISIT HTTP://KNOWLEDGEBASE.CRADLEPOINT.COM/ FOR MORE HELP AND RESOURCES PAGE 68

CRADLEPOINT

CBA850 | USER MANUAL Firmware version 5.4.0

IPV6 SETTINGS

IPv6 must be enabled through the WAN initially: go to Internet

→ Connection Manager to enable IPv6.

IPv6 Address Source: By default, this is set to

Delegated, which means the IPv6 address range for the LAN is passed through from the WAN side.

Change this to

Static to input your own IPv6 address range here, or select None to explicitly disable IPv6 LAN connectivity.

CRADLEPOINT, INC. PLEASE VISIT HTTP://KNOWLEDGEBASE.CRADLEPOINT.COM/ FOR MORE HELP AND RESOURCES PAGE 69

CRADLEPOINT

CBA850 | USER MANUAL Firmware version 5.4.0

INTERFACES

Select network interfaces to attach to this network. Choose from the Ethernet ports and VLAN interfaces. Double-click on an interface shown on the left in the Available section to move them to the Selected section on the right (or highlight an interface and click the “+” button). To deselect an interface, double-click on an interface in the Selected section (or highlight the interface and click the “–“ button).

If you want more interface options, you must configure additional interfaces separately. See the LOCAL NETWORK INTERFACES section below (on this same administration page: NETWORK SETTINGS

→ LOCAL NETWORKS).

CRADLEPOINT, INC. PLEASE VISIT HTTP://KNOWLEDGEBASE.CRADLEPOINT.COM/ FOR MORE HELP AND RESOURCES PAGE 70

CRADLEPOINT

CBA850 | USER MANUAL Firmware version 5.4.0

ACCESS CONTROL

Tune the access control settings of this network to match the intended use. Simply select or deselect any of the following:

• LAN Isolation: When checked, this network will NOT be allowed to communicate with other local networks.

• UPnP Gateway: Select the UPnP

(Universal Plug and Play) option if you want to enable the UPnP Gateway service for computers on this network.

• Admin Access: When enabled, users may access these administration pages on this network.

CRADLEPOINT, INC. PLEASE VISIT HTTP://KNOWLEDGEBASE.CRADLEPOINT.COM/ FOR MORE HELP AND RESOURCES PAGE 71

CRADLEPOINT

CBA850 | USER MANUAL Firmware version 5.4.0

IPV4 DHCP

Changing settings for the IPv4 DHCP server is optional. The default selections are almost always sufficient.

DHCP Server: (Default: Enabled) When the

DHCP server is enabled, users of your network will be able to automatically connect to the Internet without any special configuration.

It is recommended that you

leave this enabled. Disabling the DHCP server is only recommended if you have another DHCP server on your network and it is configured properly.

Range Start and Range End: These designate the range of values in the reserved pool of IP addresses for the DHCP server. Values within this range will be given to any DHCP enabled computers on your network. The default values are almost always sufficient (default: 72 to 200, as in

192.168.0.72 to 192.168.0.200).

Example: The router uses an IP address of

192.168.0.1 for its primary network by default. A computer designated as a Web server has a static IP address of 192.168.0.3. Another computer is designated as an FTP server with a static IP address of 192.168.0.4. The starting IP address for the DHCP server needs to be 192.168.0.5 or higher.

Lease Time: (Default: 720 minutes [12 hours]) Specifies how long DHCP-enabled computers will wait before requesting a new

DHCP lease. Smaller values are better suited to busy environments.

CRADLEPOINT, INC. PLEASE VISIT HTTP://KNOWLEDGEBASE.CRADLEPOINT.COM/ FOR MORE HELP AND RESOURCES PAGE 72

CRADLEPOINT

CBA850 | USER MANUAL Firmware version 5.4.0

Custom Options: Input a custom DHCP option by first clicking the Custom Options field to enable it and then clicking “Add” at the top of the table that appears. There are close to 200 possible DHCP options available. One of the more common uses is to assign a

VoIP phone server using option 66 (Server name).

• Option: Select an option from the dropdown list or manually enter the number of an option. A complete list of options is available from IANA.

• Value: Generally this field should be a string, IP address, or numeric value. Some fields can accept both IP addresses and hostnames – in these cases you may need to wrap this value in quotes. For example, option 66 (Server name) requires quotes around IP addresses.

DHCP Relay: Communicates with a DHCP server and acts as a proxy for DHCP broadcast messages that must be routed to remote segments. This is accomplished by converting broadcast

DHCP messages to unicast messages to communicate between clients and servers.

DHCP Server Address: An optional DHCP server address if more than one DHCP server is located on the network. This field is only available when

DHCP Relay is enabled.

CRADLEPOINT, INC. PLEASE VISIT HTTP://KNOWLEDGEBASE.CRADLEPOINT.COM/ FOR MORE HELP AND RESOURCES PAGE 73

CRADLEPOINT

CBA850 | USER MANUAL Firmware version 5.4.0

IPV6 ADDRESSING

Address Configuration Mode

SLAAC Only – SLAAC stands for stateless address autoconfiguration. The router regularly generates a router advertisement that includes network prefix and routing information, allowing clients to autogenerate an address and start communicating on the network. Clients utilize neighbor discovery protocols to ensure multiple clients on the subnet have not chosen an identical address.

SLAAC with DHCP – (Default) IPv6 DHCP provides an additional client configuration method and is regularly combined with SLAAC to provide DNS servers (a shortcoming in the original SLAAC specification) and additional options not supported by SLAAC. By defaulting to SLAAC with DHCPv6, all IPv6-capable clients on the network should be configurable with IPv6 connectivity.

• DHCP Range Start: The beginning of the range that will be used for IPV6 DHCP addresses. The IPv6 range will always start at 1.

• DHCP Range End: The ending IP address in the DHCP Server range is the end of the reserved pool of IP addresses that will be given to any DHCP-enabled computers on your network.

• IPv6 DHCP Lease Time: This specifies how long DHCP-enabled computers will wait before requesting a new DHCP lease.

Disable SLAAC and DHCP – Disable both IPv6 address configuration modes.

CRADLEPOINT, INC. PLEASE VISIT HTTP://KNOWLEDGEBASE.CRADLEPOINT.COM/ FOR MORE HELP AND RESOURCES PAGE 74

CRADLEPOINT

CBA850 | USER MANUAL Firmware version 5.4.0

SCHEDULE

Set up a schedule for this network interface. This allows an interface to be enabled or disabled during specific hours of a day. For example, use this to limit the network to business hours.

Schedule Service: (Default:

Disabled.) Select to enable. This will open a configurable chart for setting the schedule.

Each hour of the week is represented by a black or gray square. Black represents disabled, while gray represents enabled.

Hover over a square to reveal the hour it represents. Click on the squares to toggle between black and gray.

In the example shown, the network is enabled from 8-5 on Monday through Friday, but disabled at all other times.

CRADLEPOINT, INC. PLEASE VISIT HTTP://KNOWLEDGEBASE.CRADLEPOINT.COM/ FOR MORE HELP AND RESOURCES PAGE 75

CRADLEPOINT

CBA850 | USER MANUAL Firmware version 5.4.0

Local Network Interfaces

Each LAN type—Ethernet and VLAN—has a separate section with configuration options. Unless the default configuration is sufficient,

YOU MUST CONFIGURE EACH INTERFACE SEPARATELY

in order to create the desired interface options for a network. You can then select these interfaces to add to a network in the Local Network Editor (see above).

Select from the following tabs:

• Ethernet Port Configuration

• VLAN Interfaces

Ethernet Port Configuration

Ethernet Port Configuration provides controls for your router’s Ethernet ports. While default settings will be sufficient in most circumstances, you have the ability to control the Link Speed. Additional controls for WAN ports are available in Internet

→

Ethernet Settings.

Link Speed: Default setting is Auto. The Auto setting is preferred in most cases.

• Auto

• 10Mbps - Half Duplex

• 10Mbps - Full Duplex

• 100Mbps - Half Duplex

• 100Mbps - Full Duplex

• 1000Mbps - Full Duplex

CRADLEPOINT, INC. PLEASE VISIT HTTP://KNOWLEDGEBASE.CRADLEPOINT.COM/ FOR MORE HELP AND RESOURCES PAGE 76

CRADLEPOINT

CBA850 | USER MANUAL Firmware version 5.4.0

ETHERNET PORT GROUP EDITOR

A Port Group represents a logical grouping of Ethernet ports. Any computers physically connected to ports in a group will be allowed to freely communicate with each other.

NOTE: You must separately ensure that this logical interface is attached to a

Local IP Network in the top panel of this page.

Port Group ID: The Group ID field provides a reference to this port group to be used in other parts of the router configuration.

For example, this ID is referenced in the Local IP Networks configuration to attach this group of Ethernet ports to a network configuration. Use a simple short text phrase to describe a group, such as "main", "guestport", etc.

CRADLEPOINT, INC. PLEASE VISIT HTTP://KNOWLEDGEBASE.CRADLEPOINT.COM/ FOR MORE HELP AND RESOURCES PAGE 77

CRADLEPOINT

CBA850 | USER MANUAL Firmware version 5.4.0

VLAN INTERFACES

A virtual local area network, or VLAN, functions as any other physical LAN, but it enables computers and other devices to be grouped together even if they are not physically attached to the same network switch.

To enable a VLAN, select a VID (virtual LAN ID) and an Ethernet port group through which users can access the VLAN. Then go back up to the Local Network Editor to attach your new VLAN to a network. To use a VLAN, the VID must be shared with another router or similar device so that multiple physical networks have access to the one virtual network.

Click Add to create a new VLAN interface.

VLAN EDITOR

VID: An integer value that is the Virtual LAN ID.

Ethernet Group: Select the LAN port with which you want to associate the

VLAN ID from a dropdown list.

Click

Submit to save your configured VLAN.

CRADLEPOINT, INC. PLEASE VISIT HTTP://KNOWLEDGEBASE.CRADLEPOINT.COM/ FOR MORE HELP AND RESOURCES PAGE 78

CRADLEPOINT

CBA850 | USER MANUAL Firmware version 5.4.0

MAC Filter–Logging

A MAC (Media Access Control) address is a unique identifier for a computer or other device. This page allows you to manage clients by

MAC address. You can filter clients by MAC addresses and/or keep a log of devices connected to your router.

Filter Configuration

The MAC Filter allows you to create a list of devices that have either exclusive access (whitelist) or no access (blacklist) to your

LAN.

Enabled: Click to allow MAC

Filter options.

Whitelist: Select either

“Whitelist” or “Blacklist” from a dropdown menu. In "Whitelist" mode, the router will restrict access to all computers except those contained in the "MAC Filter List" panel. In “Blacklist” mode, listed devices are completely blocked.

MAC Filter List (Whitelist or Blacklist): Add devices to either your whitelist or blacklist simply by inputting each device’s MAC address.

NOTE: Use caution when using the MAC Filter to avoid accidentally blocking yourself from accessing the router.

CRADLEPOINT, INC. PLEASE VISIT HTTP://KNOWLEDGEBASE.CRADLEPOINT.COM/ FOR MORE HELP AND RESOURCES PAGE 79

CRADLEPOINT

CBA850 | USER MANUAL Firmware version 5.4.0

MAC Logging Configuration

Enable MAC Logging: Enabling MAC

Logging will cause the router to log

MAC addresses that are connected to the router. MAC addresses that you do not want to have logged

(addresses that you expect to be connected) should be added to the

“Ignored MAC Addresses” list.

You can configure the router to send an alert if a connected device has a

MAC address that the router doesn’t recognize. Go to System Settings

→ Device Alerts to set up these email alerts.

Ignored MAC Addresses: This is the list of MAC addresses that will not produce an alert or a log entry when they are connected to the router. These should be MAC addresses that you expect to be connected to the router.

To add MAC addresses to this list, simply select devices shown in the MAC Address Log and click “Ignore.” You can also add addresses manually.

MAC Address Log: This shows the last 64 MAC addresses that have connected to the router, as well as which interface was used to connect. The time/date that is logged is the time of the first connection. The page may need to be refreshed to show the most recent log entries.

Double-clicking on entries from this list will add them to the

Ignored MAC Addresses list.

CRADLEPOINT, INC. PLEASE VISIT HTTP://KNOWLEDGEBASE.CRADLEPOINT.COM/ FOR MORE HELP AND RESOURCES PAGE 80

CRADLEPOINT

CBA850 | USER MANUAL Firmware version 5.4.0

Routing

Add a new static route to the IP routing table or edit/remove an existing route.

Static routes are used in networks with more than one layer, such as when there is a network within a network so that packet destinations are hidden behind an additional router. Adding a static route is a way of telling the router about an additional step that packets will need to take to reach their destination.

Click

Add to create a new static route.

IP/Network Address: The IP address of the target network or host.

Netmask: The Netmask, along with the IP address, defines the network the computer belongs to and which other IP addresses the computer can see in the same LAN. An IP address of 192.168.0.1 along with a Netmask of 255.255.255.0 defines a network with 256 available IP addresses from 192.168.0.0 to 192.168.0.255.

NOTE: 255.255.255.255 is used to signify only the host that was entered in the IP/Network Address field.

Gateway: Specifies the next hop to be taken if this route is used. A gateway of 0.0.0.0 implies there is no next hop, and the IP address matched is directly connected to the router on the interface specified: LAN or WAN.

Allow Network Access: (Default: Deselected.) Some static routes will need an IP Filter Rule via the Firewall to allow packets through the route without being blocked.

Selecting this option automatically creates this IP Filter

Rule. If the

IP/Network Address falls outside the LAN IP range, you probably need to select this option.

CRADLEPOINT, INC. PLEASE VISIT HTTP://KNOWLEDGEBASE.CRADLEPOINT.COM/ FOR MORE HELP AND RESOURCES PAGE 81

Hej! Jag är en AI-chattbot som är särskilt tränad för att hjälpa dig med Cradlepoint ARC CBA850 Produktmanual. Jag har noggrant granskat dokumentet och kan hjälpa dig att hitta den exakta information du behöver eller förklara innehållet på ett tydligt och enkelt sätt. Oavsett om du letar efter vägledning om specifika funktioner, felsökningssteg eller allmän användning, tveka inte att ställa dina frågor. Ju mer detaljer du ger om dina bekymmer eller behov, desto mer exakt och effektivt kan jag hjälpa dig!

Assistent skriver

Assistenten är inte tillgänglig. Försök igen senare.

Innehållsförteckning

Det ser ut som att du har kommit till ett dokument som är skrivet på flera språk, inklusive ett som inte är ditt modersmål. Du kan använda följande länkar för att tillfälligt dölja sidor utan det språk du föredrar.