The general form, business features, or its positioning in actual network applications

Product overview

To manage the device by building a Web environment, while also wanting to view the device's operating status and the basic function configuration wizard

Login to device and system information

To view the device port status, traffic conditions of each link, and terminal traffic usage

System monitoring

To configure WAN, LAN, VLAN, and other related functions through the Web setup page, as well as to set advanced business functions of the device, such as virtual servers and one to one NAT mapping

Network settings

To manage Internet behavior functions such as bandwidth management, URL control, and application control through the Web setup page

Internet behavior management

To implement security settings for the device and network environment through the Web setup page, such as firewall, connection limits, MAC address filtering, and ARP security

Network security

To enable IPSec VPN and L2TP VPN functions through the Web setup page

Virtual private network

To set static DNS, dynamic DNS, static routes, and other functions through the Web setup page

Advanced options

To perform maintenance management on the device through the Web setup page, such as software upgrades

System tools

1.     Connect the PC to the device's LAN interface.

2.     Configure the PC to automatically obtain an IP address.

3.     Check the proxy server settings on the PC. If the PC currently uses a proxy server to access the Internet, you must first disable the proxy service.

4.     Run the web browser. Please enter the management address displayed on the device's nameplate in the browser's address bar and press carriage return (CR).

5.     As shown in the figure below, enter the administrator username and password (both default to admin) in the pop-up window.

6.     Click the <Login> button.

Check CPU usage and memory usage

Parameter

Description

CPU usage

Current CPU usage of the device. Click the "CPU Usage" section at the top of the page to view the current and average CPU usage.

Memory usage

Current memory usage of the device. Click the "Memory Usage" section at the top of the page to view the current and average memory usage.

View the relevant information of the access terminal

Parameter

Description

Endpoints

For information related to terminal access within the local area network (LAN),

·     Real-time traffic ranking TOP 5

·     Number of onlink hosts and the number of network connections for onlink hosts

·     Onlink host information table, which includes terminal IP address, terminal name, number of network connections, access method, interface, terminal MAC address, and other information

Real-time traffic ranking TOP 5

The TOP 5 traffic usage of access terminals.

Number of onlink hosts

The number of onlink hosts within the local area network (LAN)

Number of network connections for onlink hosts

The number of sessions for all onlink hosts connecting to the network within the local area network (LAN)

Terminal IP address

The IP address of the access terminal

Terminal name

The username of the access terminal

Number of network connections

The number of sessions for the terminal connecting to the network, mainly divided into:

·     If the terminal transmits TCP packets, the page displays the number of TCP packet network connections

·     If the terminal transmits UDP packets, the page displays the number of UDP packet network connections

·     If the terminal transmits other packets, the page displays the number of other packet network connections

Access method

The method used for terminal access to the network, mainly divided into:

·     Static IP: The terminal accesses the network using a static IP address

·     DHCP Allocation: The terminal accesses the network using an IP address allocated by the device's DHCP

·     PORTAL: An authentication method where the terminal accesses the network using Portal authentication

Ports

The device interface used for terminal access to the network, such as VLAN1

Endpoint MAC address

MAC address of the access terminal

Uplink Flow Rate

Upstream traffic rate of the access terminal

Downlink Flow Rate

Downstream traffic rate of the access terminal

Onlink Duration

Duration of terminal access to the network

Traffic details

Detailed information about the traffic usage of this terminal

You can view relevant information about NetStream traffic.

Parameter

Description

NetStream traffic

To view the NetStream traffic status of the device, click on the "NetStream traffic" section at the top of the page to see the traffic information and interface status for each WAN interface.

Average upload speed in the last 5 minutes

The average upload speed for the WAN interface over the last 5 minutes, measured in bps.

Average download speed in the last 5 minutes

The average download speed for the WAN interface over the last 5 minutes, measured in bps.

Monitor period

Select the cycle for monitoring the traffic of the specified WAN interface, including: every 1 hour, every 1 day, every 1 month.

Ports

The interface through which the device accesses the wide area network (WAN).

MAC

The MAC address used by the device to access the wide area network (WAN).

Connection Type

The actual way users access the internet, with options including:

·     PPPoE: Broadband dial-up internet access method.

·     DHCP: Internet access method that automatically obtains an address from a DHCP server to connect to the wide area network (WAN).

·     Static address: Internet access method that uses a static address provided by the carrier to connect to the wide area network (WAN).

Username

The username used for authentication. This parameter is provided by the carrier. When the connection mode is set to PPPoE, this parameter must be configured.

IP address

The IP address through which the device accesses the wide area network (WAN).

Subnet mask

The mask or mask length of the IP address.

Gateway

The gateway address through which the device accesses the wide area network (WAN).

DNS1 and DNS2

The DNS server addresses for the device accessing the wide area network (WAN). DNS1 is prioritized for domain name resolution; if resolution fails, DNS2 will be used for domain name resolution.

MTU

The size of the MTU (Maximum Transmission Unit) allowed for the device interface. Measured in bytes.

Status

The connection status of the device interface to the wide area network (WAN), mainly categorized as:

·     Onlink: This interface is connected to the wide area network (WAN).

·     Offlink: This interface is not connected to the wide area network (WAN).

Connection Time

The duration for which this interface has been connected to the wide area network (WAN).

In the “system time” section, you can view the system time and run time; in the “product model” section, you can find information such as the product model, serial number, Boot ROM version, hardware version, and software version.

Item

Description

System time

Display the device's system time

Uptime

Display the device's run time

Switch model

Display product model information

Serial number

Display the device's serial number information

Boot ROM version

Display the device's Boot ROM version information; click "Show more..." to view

Hardware Version

Display the device's hardware version information; click "Show more..." to view

Software version

Display the device's software version information

In the "Port Status" section, click the port icon to access the WAN or LAN configuration page.

·     WAN configuration interface:

·     LAN configuration interface:

Item

Description

Port Status

The current usage status of the WAN and LAN ports. In the "Port Status" section, click the port icon to access the WAN or LAN configuration page.

You can view the usage rate of memory space on Flash.

Parameter

Description

Storage media

Current usage status of the device's memory space. In the lower right section of the page, you can view the usage rate of the storage media.

On the quick navigation page, click the link corresponding to the function as needed.

Parameter

Description

Network access configuration

The configuration function for the device to access the internet mainly includes:

·     Connect to the Internet: Click "Connect to the Internet," and the page will automatically go to the connect to the internet page.

·     Local Area Network (LAN) settings: Click "Local Area Network (LAN) Settings," and the page will automatically go to the LAN settings page.

·     NAT configuration: Click "NAT Configuration," and the page will automatically go to the LAN settings page.

Internet access

The function of internet behavior management for the device mainly includes:

·     URL control: Click "URL Control," and the page will automatically go to the URL control page for internet behavior management.

·     Bandwidth limiting: Click "Bandwidth Limiting," and the page will automatically go to the IP bandwidth management page.

·     Connection limit: Click "Connection Limit," and the page will automatically go to the connection limit page.

·     Traffic measurement ranking: Click "Traffic Measurement Ranking," and the page will automatically go to the traffic ranking page.

Access security

The security functions for user access networks mainly include:

·     ARP security: Click "ARP Security," and the page will automatically go to the ARP security page.

·     Firewall: Click "Firewall," and the page will automatically go to the firewall page.

·     VPN settings: Click "VPN Settings," and the page will automatically go to the IPsec VPN page.

·     MAC address filtering: Click "MAC Address Filtering," and the page will automatically go to the MAC address filtering page.

Device Maintenance

The operational maintenance functions of the device mainly include:

·     Configuration management: Click the "Configuration Management" link, and the page will automatically go to the configuration management page.

·     System upgrade: Click the "System Upgrade" link, and the page will automatically go to the system upgrade page.

·     Restart: Click the "Restart" link, and the page will automatically go to the restart page.

·     Remote management: Click the "Remote Management" link, and the page will automatically go to the remote management page.

·     Network diagnosis: Click the "Network Diagnosis" link, and the page will automatically go to the network diagnosis page.

·     User FAQ: Click the "User FAQ" link, and the page will automatically go to the user FAQ page.

Port status: Click the port icon to enter the WAN or LAN configuration page.

Link traffic: You can view the traffic information for each link through the list.

Item

Description

Port Status

The current usage status of the WAN and LAN ports. Click the port icon to enter the WAN or LAN configuration page.

Link

Layer 3 interfaces on the device, such as WAN and VLAN interfaces.

Tx Speed

The message sending rate for this link.

Rx Speed

The message receiving rate for this link.

Total Sent

The total message size sent on this link. Unit is Mb.

Total Received

The total message size received on this link. Unit is Mb.

Select the “Enable Traffic Ranking” option to activate the user traffic ranking function.

Configure terminal speed limits:

1.     Click the speed limit icon in the operation column corresponding to the specified terminal IP address to open the terminal speed limit configuration dialog box, where you can set upload and download bandwidth as well as parameters for canceling the speed limit.

2.     Click Apply.

Configure terminal blacklisting:

1.     Click the blacklisting icon in the operation column corresponding to the specified terminal IP address to open the terminal speed limit configuration dialog box, where you can set the blacklisting duration and parameters for permanent blacklisting.

2.     Click Apply.

Item

Description

Traffic ranking

Whether to enable the traffic ranking function. If this function is enabled, the page will display the traffic information of the connected terminals.

Terminal IP address

IP address of the connected terminal

Terminal name

Username of the connected terminal

Network connection count (TCP/UDP/Other)

Number of sessions for the terminal's network connections. This mainly includes:

·     If the terminal transmits TCP packets, the page displays the number of TCP packet network connections.

·     If the terminal transmits UDP packets, the page displays the number of UDP packet network connections.

·     If the terminal transmits other packets, the page displays the number of other packet network connections.

Access method

Methods used for terminal access to the network, mainly divided into:

·     Fixed IP: The terminal accesses the network using a fixed IP address.

·     DHCP allocation: The terminal accesses the network using an IP address allocated by the device's DHCP.

·     PORTAL: An authentication method where the terminal accesses the network using Portal authentication.

Ports

Device interface used for terminal access to the network, such as VLAN1.

Endpoint MAC address

MAC address of the connected terminal

Uplink Flow Rate

Uplink traffic rate of the connected terminal

Downlink Flow Rate

Downlink traffic rate of the connected terminal

Total traffic for the day

Total transport stream (TS) traffic of the connected terminal for the day

Onlink Duration

Duration of the terminal's access to the network

Task

Operations on the terminal IP address, mainly include:

·     Speed limit: Apply speed limit to the terminal.

¡     Upload bandwidth: Set the upload bandwidth for the terminal.

¡     Download bandwidth: Set the download bandwidth for the terminal.

¡     Cancel speed limit: Selecting this will cancel the speed limit applied to the terminal.

·     Blacklist: Add the terminal to the denylist management list and prohibit its access to the Internet.

¡     Blacklist duration: Set the blacklist duration for the terminal.

¡     Permanent blacklist: Permanently blacklist the terminal.

Configure the interface mode of the device's WAN/LAN ports:

1.     Click the button under the WAN/LAN interface to switchover.

2.     Click Apply.

Interface Mode

Configure the switchover of the interface mode and set the WAN/LAN ports supported by the device.

PPPoE

PPPoE is a protocol that establishes a point-to-point connection over Ethernet, commonly used for authentication and dial-up connection in broadband access environments.

When accessing the wide area network (WAN) using PPPoE, users need to provide specific account and password information. The router performs the dial-up connection for the user, enabling access to the Internet.

PPPoE is suitable for home broadband access, catering to home users, small businesses, and other network environments that require dial-up connections. Users can dial up using a broadband modulation and demodulation (Modem) device (such as an ADSL Modem) to connect their home local area network (LAN) to the Internet.

DHCP

DHCP is a network connection method that dynamically allocates IP addresses. When a device connects to the network, it sends a request to the DHCP server, which dynamically assigns IP addresses, subnet masks, gateways, and DNS server parameters, allowing the device to quickly connect to the network and obtain the necessary IP profile.

DHCP is suitable for large local area networks (LAN) or enterprise network environments. By automatically allocating IP addresses through the DHCP server in the network, it facilitates the management of IP address distribution for numerous devices and reduces the workload of manually configuring IP addresses.

Fixed IP address

A fixed address refers to a manually configured static IP address, including the subnet mask, gateway, and DNS server parameters. These configurations do not change based on the device's connection status.

The fixed address method requires manually configuring a fixed IP address for network devices to ensure they always use the same IP address. This method is typically suitable for network devices that require long-term stable IP address allocation and do not need frequent changes for stable access.

The WAN port connects to the wide area network (WAN) via PPPoE.

The WAN port connects to the wide area network (WAN) via DHCP.

The WAN port connects to the wide area network (WAN) via a fixed address.

Parameter

Description

Link

Link number for device access to the wide area network (WAN)

WAN ports

Interface for device access to the wide area network (WAN)

Connection Mode

The actual way users access the internet, options include:

·     PPPoE: Broadband dial-up internet access

·     DHCP: Automatically obtain an address from the DHCP server to access the wide area network (WAN)

·     Fixed Address: Access the wide area network (WAN) using a fixed address provided by the carrier

Internet Account

Username used for authentication. This parameter is provided by the carrier. This parameter can be configured when the connection mode is set to PPPoE

Internet Password

Password used for authentication. This parameter is provided by the carrier. This parameter can be configured when the connection mode is set to PPPoE

LCP Active Detection

Detecting abnormal states of the PPPoE link, options include:

·     Yes: Enable this function to check the link state every 20 seconds

·     No: Disable this function to check the link state every 2 minutes

This parameter can be configured when the connection mode is set to PPPoE

Onlink Mode

The current onlink mode only supports "Always Onlink." When the connection mode is set to PPPoE, this option is enabled by default and cannot be canceled

Dial-Up Method

Dial-up method for PPPoE connection, options include:

·     Automatic Dial-Up: After configuration, click the <OK> button at the bottom of the dialog box to complete the dial-up automatically

·     Manual Dial-Up: After configuration, you need to click the <Dial> button at the bottom of the dialog box to complete the dial-up

This parameter can be configured when the connection mode is set to PPPoE

host-uniq

When the internet access method is PPPoE, the current device will act as a PPPoE client to send a call message to the PPPoE server. The call message can be set to carry the host-uniq field to uniquely identify the sending PPPoE client. The PPPoE server must carry the host-uniq field in the response message, with the same content as the host-uniq field in the request message. This parameter is used to set whether the PPPoE client call message carries the host-uniq field

·     Carry host-uniq field: The PPPoE client call message carries the host-uniq field

·     Do not carry host-uniq field: The PPPoE client call message does not carry the host-uniq field

This parameter can be configured when the connection mode is set to PPPoE. In some scenarios, the PPPoE server may require the PPPoE client to send a call message that carries the host-uniq field, so it is recommended to select the "Carry host-uniq field" option

Server Name

PPPoE Server Name, provided by the carrier, default is empty. This parameter can be configured when the connection mode is set to PPPoE

Service Name

Service name of the PPPoE server, provided by the carrier, default is empty. This parameter can be configured when the connection mode is set to PPPoE

IP address

Fixed IP address for device access to the wide area network (WAN), only A, B, C class IP addresses are allowed. This parameter must be configured when the connection mode is set to fixed address

Subnet mask

IP address mask or mask length, for example, 255.255.255.0. This parameter must be configured when the connection mode is set to fixed address

Gateway

Gateway address for device access to the wide area network (WAN), only A, B, C class IP addresses are allowed. This parameter must be configured when the connection mode is set to fixed address

DNS1 and DNS2

DNS server addresses for device access to the wide area network (WAN). Preferably use DNS1 for domain name resolution; if resolution fails, use DNS2 for domain name resolution

Network Upstream Bandwidth

Actual upstream bandwidth value of the link, please consult the local carrier for confirmation

Network Downstream Bandwidth

Actual downstream bandwidth value of the link, please consult the local carrier for confirmation

Host name

The machine name that the device needs to advertise to the DHCP server. This parameter can be configured when the connection mode is set to DHCP

NAT Address Translation

Set whether multiple devices in the local area network (LAN) share the same public IP address. When "Enable" is selected, you can choose as needed:

·     If the device has only one public IP address, do not select "Use Address Pool Translation"

·     If the device has multiple public IP addresses, select "Use Address Pool Translation," and choose an already created NAT address pool. To add a new address pool, click the <Add Address Pool> button on the right to create a new address pool

Link Detection Results

Detection results of the link state for a specified IP address or domain name, mainly divided into:

·     Success: Indicates successful detection of the link state for the specified IP address or domain name

·     Failure: Indicates unsuccessful detection of the link state for the specified IP address or domain name

·     Not Enabled: Indicates that the link detection function is not enabled

TCP MSS

Maximum length of TCP segments for device interfaces, default is 1280

MTU

Size of MTU (Maximum Transmission Unit) allowed through the device interface

Link Detection

Determine the link state to the specified IP address or domain name, improving link reliability. When configuring this parameter, you can choose as needed:

·     If you need to use ICMP packets to detect link state, select "ICMP Detection"

·     If you need to use DNS packets to detect link state, select "DNS Detection"

·     If you need to use NTP packets to detect link state, select "NTP Detection"

·     If you do not need to detect link state, select "Disable"

Detection Address

IP address or domain name for link detection. This parameter must be configured when link detection is set to ICMP Detection, DNS Detection, or NTP Detection

Detection Interval

Time interval for link detection. This parameter must be configured when link detection is set to ICMP Detection, DNS Detection, or NTP Detection

Number of Detections

Number of detection attempts for link detection. This parameter can be configured when link detection is set to ICMP Detection, DNS Detection, or NTP Detection

Is it a Dedicated Link

Select whether to set the current link as a dedicated link. Dedicated links typically cannot access the external network, such as medical dedicated links, police dedicated links, etc.

·     Yes: Set the current link as a dedicated link. After setting the dedicated link, users need to manually configure static routes

·     No: Do not set the current link as a dedicated link

MAC

MAC address used for device access to the wide area network (WAN)

Task

You can edit this configuration

Average Load Sharing

Each link shares the load equally

WAN ports belong to the same carrier, and each link has the same bandwidth

Bandwidth Ratio Load Sharing

Each link shares the load according to its ratio

WAN ports belong to the same carrier, and each link has different bandwidths

Carrier-Based Load Sharing

Load sharing based on traffic access to the destination address

WAN ports belong to different carriers, and each carrier provides links with the same bandwidth

Advanced Multi-Link Load Sharing

Load sharing based on traffic access to the destination address

WAN ports belong to different carriers, and each carrier provides links with different bandwidths

Link Backup

One link serves as the primary link, while others serve as backup links to maintain network stability

If network stability is a high priority, you can set up backup links.

1.     Set up multi-WAN access mode with the same carrier:

2.     Select "Average Load Sharing" or "Bandwidth Ratio Load Sharing" mode

3.     Click <Apply> button to complete the configuration

1.     Set up multi-WAN access mode with different carriers:

2.     Select "Carrier-Based Load Sharing" or "Multi-Link Advanced Load Sharing" mode

3.     Click <Apply> button to complete the configuration

1.     Set up link backup:

2.     Select the primary link and backup link

3.     Click <Apply> button to complete the configuration

Item

Description

Multiple WANs belong to the same carrier

When a device has multiple WAN ports connected to the same carrier link, you can select the load sharing mode as needed:

·     If the bandwidth of each link is consistent, it is recommended to select "Average Load Sharing."

·     If the bandwidth of each link is inconsistent, it is recommended to select "Bandwidth Ratio Load Sharing" and set the allocation bandwidth ratio for the links.

After setting, you need to click the "Apply" button to make the configuration take effect.

Multiple WANs belong to different carriers

When a device has multiple WAN ports connected to different carrier links, you can select the load sharing mode as needed:

·     If the bandwidth of the links provided by each carrier is consistent, it is recommended to select "Carrier-Based Load Sharing" and choose the corresponding carrier for each WAN port and the default link.

·     If the bandwidth of the links provided by each carrier is inconsistent, it is recommended to select "Advanced Multi-Link Load Sharing," set the allocation bandwidth ratio for the links, and choose the corresponding carrier for each WAN port and the default link.

After setting, you need to click the "Apply" button to make the configuration take effect.

Link Backup

When accessing multiple WANs, one link is the primary link, while the others are backup links to maintain network stability. When configuring this parameter, first select "Primary Link (please choose the WAN interface as the primary link)" and the corresponding "Link n," then select the backup link "Link m." Note that n and m cannot be the same; otherwise, link backup cannot be achieved.

If the selected primary link has the link probing function enabled (configured in the external network settings - WAN configuration), the system will change the actual effective primary link based on the probing results. If the selected primary link does not have the link probing function enabled, the system will change the actual effective primary link based on the physical status of the interface.

Allocation Bandwidth Ratio of Links

Set the default bandwidth ratio for each link. When setting this parameter, ensure that at least one link has a bandwidth ratio that is not 0.

When the multi-WAN strategy is set to "Bandwidth Ratio Load Sharing" or "Advanced Multi-Link Load Sharing," this parameter needs to be set.

Note: The input range for this parameter is integers from 0 to 100.

Parameter

Description

Enable the Save Previous Hop Function

Whether to enable the Save Previous Hop Function. If this function is enabled, in multi-WAN scenarios, messages entering and leaving the local area network (LAN) will be forwarded through the same WAN interface.

This page provides you with the following main functions:

·     Display information about the VLANs allowed through the port

·     Set the VLANs allowed through the port

Set the VLANs allowed through the port

Item

Description

Port name

LAN interface that needs VLAN segmentation

PVID

Default VLAN for this port

Permitted VLANs

All VLANs allowed through this LAN port

VLANs to be selected

All VLANs that have been created on the device. When configuring this parameter, select the VLAN numbers below the "VLANs to be selected" check box, or directly check the "VLANs to be selected" check box to select all VLANs, then click the right orientation button below "VLANs to be selected" to add the port to the selected VLANs

Selected VLANs

The VLANs to which this port has been assigned. When configuring this parameter, select the VLAN numbers below the "Selected VLANs" check box, or directly check the "Selected VLANs" check box to select all VLANs, then click the left orientation button below "Selected VLANs" to remove the port from the joined VLANs

Task

This configuration can be edited

This page provides you with the following main functions:

·     Display detailed information of the added VLANs

·     Adding a VLAN

·     Delete the added VLANs

·     Modify the added VLANs

Add VLAN:

1.     Click<the add>button to open the VLAN dialog box, and set parameters such as VLAN ID, IP address, subnet mask, etc.

2.     Click<the confirm>button to complete the configuration

Delete added VLANs:

1.     Select the radio box in front of the VLAN you want to delete

2.     Click<the delete>button to open the confirmation dialog box, then click<the confirm>button to complete the configuration

Modify added VLANs:

1.     Click the edit icon in the action column corresponding to the VLAN you want to modify, open the modify VLAN dialog box, and change the relevant configuration items

2.     Click Apply.

Item

Description

Port name

The name of this VLAN interface

VLAN ID

The ID number of this VLAN interface

Connection mode

The method for the device to obtain an IP address, options include:

·     DHCP: The device obtains an IP address from the DHCP server. When selecting this option, a DHCP server must exist in the network environment.

·     Static address: Manually create the IP address, subnet mask, and other information for the VLAN interface.

IP address of the interface.

The IP address of this VLAN interface

Subnet mask

The mask or mask length of this IP address, for example 255.255.255.0

TCP MSS

The maximum segment length value for TCP packets on this VLAN interface, default is 1280

MTU

The size of the MTU value allowed for this VLAN interface

Enabling the DHCP service

Whether to enable the DHCP service function. If this function is enabled, the device will dynamically assign IP addresses to clients connected to the device (such as computers connected to the device). The DHCP service function is disabled by default.

ARP protection for DHCP allocated addresses (dynamic binding)

Whether to enable ARP protection for DHCP allocated addresses (dynamic binding). If this function is enabled, the device will bind the client's MAC address to dynamically allocated IP addresses. ARP protection for DHCP allocated addresses (dynamic binding) is disabled by default.

Starting address of the address pool

The starting IP address of the DHCP server's address pool

Ending address of the address pool

The ending IP address of the DHCP server's address pool; the ending address cannot be less than the starting address.

Excluded addresses

IP addresses that the device cannot assign to clients. For example: gateway address

Gateway

The gateway address corresponding to the address pool. If the gateway address is not configured, it may cause network connectivity issues.

Client domain name

The domain name suffix assigned by the device to the client. Allowed characters for the client domain name include letters [a-z, A-Z], digits, and symbols - and ., and cannot start or end with the symbol ..

·     When containing the symbol ., the length of characters before and after the symbol cannot exceed 63 characters. If multiple symbols . exist, they cannot be entered consecutively, for example ..

·     When not including the symbol ., the value can be between 1-63 characters.

DNS1 and DNS2

The DNS server addresses carried by the DHCP server when assigning IP addresses. DNS1 is used first for domain name resolution. If resolution fails, DNS2 will be used for domain name resolution.

Address lease

The lease period for the IP address assigned by the DHCP server to the client. When the lease period expires, the DHCP server will reclaim the IP address, and the client must reapply to the router (the client generally will apply automatically).

Task

This configuration can be edited and deleted.

This page provides you with the following main functions:

·     Display detailed information of added DHCP static binding relationships

·     Add DHCP static binding relationships

·     Delete DHCP static binding relationships

·     Modify added DHCP static binding relationships

·     Import static DHCP address table

Add DHCP static binding relationships:

1.     Click the <Add> button to open the new DHCP static binding relationship dialog box, and set parameters such as interface, client MAC address, and client IP.

2.     Click the <OK> button to complete the configuration.

Delete added DHCP static binding relationships:

1.     Select the radio box in front of the DHCP static binding relationships you want to delete.

2.     Click the <Delete> button to open the confirmation dialog box, then click the <OK> button to complete the configuration.

Modify added DHCP static binding relationships:

1.     Click the edit icon in the operation column corresponding to the DHCP static binding relationship you want to modify, which opens the DHCP static binding relationship dialog box to modify the relevant configuration items.

2.     Click Apply.

Import static DHCP address table:

1.     Click the import icon on the interface to open the import static DHCP address table dialog box. Click the <Upload File> button to select the static DHCP address table to import.

2.     Click the <OK> button to complete the configuration.

Item

Description

No.

Static DHCP policy number

Ports

The VLAN interface created on the device. This policy binds the IP address and MAC address obtained from a specific interface.

Client MAC

The MAC address of the client. Addresses consisting entirely of 0s or Fs are not supported here.

Client IP Addresses

The IP address assigned to the client.

Subnet mask

The mask or mask length for this IP address. For example, 255.255.255.0.

Description

A description of the policy, allowing for a simple explanation for easier use.

Task

This configuration can be edited and deleted.

This page provides you with the following main functions:

·     Display detailed information allocated by the device's DHCP

·     One-click reclaim IP address

·     Static allocation of IP address

One-click reclaim IP address:

1.     Select the IP address you want to reclaim from the list

2.     Click the <One-click reclaim> button, a confirmation prompt dialog box will pop up. Click the <Confirm> button to complete the configuration

Static allocation of IP address:

1.     Select the IP address you want to statically allocate from the list

2.     Click the <Static allocation> button, a confirmation prompt dialog box will pop up. Click the <Confirm> button to complete the configuration

Parameter

Description

Number

Number of DHCP Allocation Information

DHCP

VLAN Interface with DHCP Service Enabled on the Device

Client IP Addresses

Client's IP Address

Client Name

Client's Host Name

Client MAC

MAC address of the client.

Validity Time

Lease Duration of the IP Address Assigned by the DHCP Server to the Client. Once the lease expires, the DHCP server will reclaim the IP address, and the client must reapply to the router (the client usually requests automatically).

One-Click Reclaim

Reclaim the IP Address Assigned by the DHCP Server. To configure this parameter, select the IP addresses to be reclaimed from the list, click the <One-Click Reclaim> button, and in the confirmation prompt that appears, click the <Acknowledge> button to confirm the reclamation of the selected IP addresses.

Static allocation

Statically Bind the IP Address Dynamically Assigned by the DHCP Server. To configure this parameter, select the client IP to be statically bound from the list, click the <Static Allocation> button, and in the confirmation prompt that appears, click the <Acknowledge> button to confirm setting the DHCP dynamically assigned IP address to static allocation.

This page provides you with the following main functions:

·     Display detailed information about device ports.

·     Editing port settings

Modify port configuration:

1.     Click the edit icon in the operation column corresponding to the port you want to modify, which will open the modify port dialog box to adjust the related configuration items.

2.     Click Apply.

Item

Description

Physical port

Physical ports of the device, such as WAN1, LAN1

Port name

Physical port names of the device

Port type

Port types of the device, mainly divided into:

·     WAN: Interface for accessing the wide area network

·     LAN: Interface for accessing the local area network

Port mode

Operating modes of the port, mainly divided into:

·     Autonegotiation: Duplex and rate states are determined by autonegotiation between this port and the peer port

·     Full duplex: The port can receive and transmit packets simultaneously

·     Half duplex: The port can either send or receive packets at the same time

Transmission baud rate

Port rates, including autonegotiation, 10Mbps, 100Mbps, 1Gbps, 2.5Gbps (supported by some device ports)

MAC

MAC address of the port

Broadcast storm suppression

Function to suppress the propagation of a large number of broadcast packets within the local area network, which can prevent network congestion and ensure the normal operation of network services. The suppression level can be selected as needed: "No suppression," "Low," "Medium," "High"

Admin Status

Operating states of the port, mainly divided into:

·     Enabled: The device enables this port

·     Disabled: The device disables this port

When the port type is LAN, this parameter cannot be modified and defaults to enabled state

This page provides you with the following main functions:

·     Display detailed information of added virtual servers

·     Enable NAT DMZ server

·     Adding a NAT port mapping

·     Delete added NAT port mappings

·     Modify added NAT port mappings

Enable NAT DMZ server:

1.     Select the "Enable" option and set the host address parameter

2.     Click<Apply> button to complete the configuration

Add NAT port mapping:

1.     Click<Add> button to open the Add NAT Port Mapping dialog box, and set parameters such as protocol type, external address, external port, etc.

2.     Click<OK> button to complete the configuration

Delete added NAT port mapping:

1.     Select the radio box in front of the NAT port mapping you want to delete

2.     Click<Delete> button to open the confirmation prompt dialog box, then click<OK> button to complete the configuration

Modify added NAT port mapping:

1.     Click the edit icon in the operation column corresponding to the NAT port mapping you want to modify, open the Modify NAT Port dialog box, and modify the relevant configuration items

2.     Click Apply.

Parameter

Description

NAT DMZ Service

The virtual server function can enhance the security of the local area network (LAN). When configuring this parameter, you can select as needed:

·     If this function is enabled, when the device receives a request from the external network, it first checks the virtual service list. If there is a match, it forwards the request to the corresponding IP address; if no match is found, it forwards the request to the DMZ host.

·     If the NAT DMZ service is disabled: when an external request does not match the virtual service list, the request message is discarded directly.

Host Address

IP address of the DMZ host

Protocol

Transmission protocol used by the internal host. When configuring this parameter, you can select as needed:

·     If the internal host uses the TCP transmission protocol, select “TCP”.

·     If the internal host uses the UDP transmission protocol, select “UDP”.

·     If the internal host uses both TCP and UDP transmission protocols, select “TCP+UDP”.

External Address

The public network address on the device can be set in two ways:

·     Current interface IP address: the IP address of the device's WAN port.

·     Other addresses: other public IP addresses on the device.

Ports

You can directly use the WAN interface IP address as the external address when selecting the interface.

External port

Mapping the internal host to the external address, the open ports on the external address can be configured as needed:

·     If the service provided to the outside is FTP, select “FTP”.

·     If the service provided to the outside is TELNET, select “TELNET”.

·     If the service provided to the outside is other, enter the range of port numbers used by the service. When configuring this parameter, the starting port number cannot be greater than the ending port number.

Internal Address

IP address of the internal host, which needs to provide specified services to the outside.

Internal port

The actual open service ports on the internal host.

Enabling state.

The execution actions of this policy are mainly divided into:

·     Enabled: indicates that this policy is enabled and takes effect immediately after configuration.

·     Not enabled: indicates that this policy is not currently enabled.

Description

Description information for the policy can provide a brief description, making it easier to use.

Task

You can edit and delete this configuration.

This page provides you with the following main functions:

·     Display details of added one to one mappings

·     Enable one to one mapping

·     Add NAT one to one mapping

·     Delete added NAT one to one mappings

·     Modify added NAT one to one mappings

Select the "Enable" option to activate the one to one mapping function

Add NAT one to one mapping:

1.     Click<Add> button to open the add NAT one to one mapping dialog box, and set the internal address, external address, interface, and other parameter information

2.     Click<OK> button to complete the configuration

Delete added NAT one to one mapping:

1.     Select the radio box in front of the NAT one to one mapping you want to delete

2.     Click<Delete> button to open the confirmation prompt dialog box, then click<OK> button to complete the configuration

Modify added NAT one to one mapping:

1.     Click the edit icon in the operation column corresponding to the NAT one to one mapping you want to modify to open the modify application dialog box, and change the relevant configuration items

2.     Click Apply.

Parameter

Description

Internal Address

IP address of the internal network host. This host needs to provide specified services externally.

External Address

Public IP address of the device.

Ports

The WAN port of the device mapped by the internal network host for external access. The packets are mapped through this interface. If this parameter is not set, it will apply to all WAN ports.

Status

The execution actions of this policy are mainly divided into:

·     Enabled: Indicates that this policy is enabled, and it takes effect immediately after configuration.

·     Not Enabled: Indicates that this policy is not currently enabled.

Description

Description information of the policy, allowing for a simple description of the policy for convenience.

This page provides you with the following main functions:

·     Display detailed information of the added address pool

·     Add NAT address pool

·     Delete added NAT address pool

·     Modify added NAT address pool

Add NAT address pool:

1.     Click<Add> button to open the Add NAT Address Pool dialog box, and set the address pool name, IP address, and other parameter information

2.     Click<OK> button to complete the configuration

Delete added NAT address pool:

1.     Select the radio box in front of the NAT address pool you want to delete

2.     Click<Delete> button to open the confirmation prompt dialog box, then click<OK> button to complete the configuration

Modify added NAT address pool:

1.     Click the edit icon in the operation column corresponding to the NAT address pool you want to modify, open the Modify Application dialog box, and change the relevant configuration items

2.     Click Apply.

Parameter

Description

Address Pool Name

The name of the public IP address pool used for NAT conversion, which can consist of Chinese characters, digits, letters, and underscores.

IP address

The public IP address provided by the carrier. When configuring this parameter, after entering the IP address, you need to click the “>” button on the right side of the configuration item (CI) to submit the address pool content.

IP Range

Public IP address range. If the carrier provides multiple public IP addresses, this item must be configured. When configuring this parameter, after entering the starting and ending IP addresses, you need to click the “>” button on the right side of the configuration item (CI) to submit the address pool content. The number of IP addresses within a single IP address range cannot exceed 256, and unreasonable IP addresses cannot exist.

Set up NAT hairpinning:

1.     Enable the NAT hairpinning function and set the current NAT hairpinning effective interface.

2.     Click the <Apply> button to complete the configuration.

Parameter

Description

NAT hairpin

Select whether to enable the NAT hairpin

·     Select the “Available Interfaces”

·     Select one or more interfaces from the available interfaces list, and click the “>” button below the “Available Interfaces”

·     If you want to cancel a selected interface, check this interface in the selected interfaces list, and click the “<” button below the “Available Interfaces”

Once the settings are complete, click the <OK> button to apply the configuration.

Set NAT ALG:

1.     Enable the NAT ALG function for the specified protocol.

2.     Click<Apply>button to complete the configuration.

Parameter

Description

NAT ALG

To ensure that the data connections of certain application layer protocols can be correctly established after port mapping or one to one mapping, you need to enable the NAT ALG function for the specified protocol.

When configuring this parameter, you can select as needed:

·     If the message uses the SIP protocol, select "Enable SIP."

·     If the message uses the FTP protocol, select "Enable FTP."

·     If the message uses the H323 protocol, select "Enable H323."

·     If the message uses the TFTP protocol, select "Enable TFTP."

·     If the message uses the RTSP protocol, select "Enable RTSP."

·     If the message uses the PPTP protocol, select "Enable PPTP."

After the settings are complete, you need to click the "Apply" button to make the configuration take effect.

Set the custom protocol port number:

1.     Set the custom SIP port number

2.     Click<Apply>button to complete the configuration.

Parameter

Description

Custom Protocol Port Number

When setting up a SIP server, if the SIP protocol port number used is not 5060, you need to customize the SIP protocol port number.

The input range for the SIP port number is 1-65535, and you can enter up to 7 port numbers, separated by commas, such as: 2000,3000,4000.

Set up network connection:

1.     Configure parameters such as the current number of network connections, total number of network connections, and select the interface to clear network connections.

2.     Click the <Apply> button to complete the setup.

Parameter

Description

Network Connections

Current Number of Network Connections: The total number of network connections established by the current device

Total Network Connections: The total number of network connections that the device can create, which is the total number of sessions. When the set value is less than the current number of established network connections, it will affect the establishment of new connections.

Select the interface to clear network connections: The interface from which network connections need to be cleared. If there is a network attack affecting business operations or changes to firewall rules, policy-based routing (PBR), NAT configurations, etc., that have not taken effect immediately, you can try to clear the network connections. When configuring this parameter, please exercise caution as clearing network connections may impact the normal operation of existing services.

Activate the power supply function of the device's PoE port

Parameter

Description

Overall system PoE power supply usage rate

Percentage of the current used power supply compared to the overall system's maximum power supply

Max Power

Overall system maximum power supply

Current power usage

Current power supply used by the overall system

Current remaining power

Current unused power supply of the overall system

Current Power

Current power supply used by PoE ports

Port Status

Power supply status of PoE ports, including:

·     Port Down-PoE power supply: On

·     Port Down-PoE power supply: Off

·     Port Up-PoE power supply: On

·     Port Up-PoE power supply: On (Power supply abnormal: total power overload/port power overload).

·     Port Up-PoE power supply: Off

PoE Switch

Turn on or off the power supply function of PoE ports

Enable the device's IPv6 function

Item

Description

Power switch

Whether to enable the IPv6

For the configuration to take effect, click Apply.

The WAN port does not enable the IPv6 access to external networks function.

The WAN port obtains the IPv6 address automatically.

The WAN port obtains the IPv6 address by manual entry.

Item

Description

Link

The link number for the device connecting to the wide area network (WAN).

Ports

The interface for the device connecting to the wide area network (WAN).

Connection Mode

The method for the device's WAN port to obtain an IPv6 address, including:

·     Not Enabled: Indicates that this WAN port does not enable IPv6 access to the external network.

·     Automatically Obtain: Automatically obtains the public IPv6 address for WAN access from the DHCPv6 server.

¡     NAT66 Address Translation: Select whether to enable this function based on actual needs. This function can be enabled when there is a need to hide the internal network's IPv6 address in an IPv6 network.

·     Fixed Address: Manually enter the IPv6 address, IPv6 prefix length, gateway address, and other information.

¡     IPv6 Address: The fixed IPv6 address for WAN access.

¡     IPv6 Prefix Length: The prefix length of the IPv6 address, with a value range of 48-64.

¡     Gateway Address: The IPv6 gateway address for WAN access.

¡     DNS1 and DNS2: Enter the DNS server addresses for WAN access. Note that the device prioritizes using DNS1 for domain name resolution. If that fails, it will use DNS2 for domain name resolution.

¡     NAT66 Address Translation: Select whether to enable this function based on actual needs. This function can be enabled when there is a need to hide the internal network's IPv6 address in an IPv6 network.

Link-local address

Link-specific IPv6 address used for communication within the same link.

Task

This configuration can be edited.

Do not configure IPv6 VLAN

Allocate IPv6 addresses using both DHCPv6 and SLAAC methods

Allocate IPv6 addresses through the DHCPv6 server

Automatically configure IPv6 addresses based on the device's link-layer address and the prefix information published by the router

Generate the interface's IPv6 address after obtaining the prefix from the specified WAN interface

Item

Description

VLAN ID

The ID number of this VLAN interface.

Address allocation method

The method for the device to obtain an IPv6 address, options include:

·     None: No IPv6 address configuration.

·     Automatic: Allocate IPv6 addresses using both DHCPv6 and SLAAC methods.

¡     IPv6 Address: The IPv6 address assigned to this VLAN interface.

¡     IPv6 Prefix Length: The prefix length of the IPv6 address, ranging from 48 to 64.

¡     DNS1 and DNS2: Input the DNS server addresses for accessing the wide area network (WAN). Note that the device prioritizes using DNS1 for domain name resolution. If resolution fails, it will use DNS2 for domain name resolution.

¡     Address Lease: The lease time for the IPv6 address.

·     DHCPv6: The device obtains an IP address from the DHCPv6 server. When selecting this option, a DHCPv6 server must exist in the network environment for dynamic allocation of IPv6 addresses.

¡     IPv6 Address: The IPv6 address assigned to this VLAN interface.

¡     IPv6 Prefix Length: The prefix length of the IPv6 address, ranging from 48 to 64.

¡     DNS1 and DNS2: Input the DNS server addresses for accessing the wide area network (WAN). Note that the device prioritizes using DNS1 for domain name resolution. If resolution fails, it will use DNS2 for domain name resolution.

¡     Address Lease: The lease time for the IPv6 address.

·     SLAAC: Automatically configures the IPv6 address based on the device's link-layer address and the prefix information published by the router.

¡     IPv6 Address: The IPv6 address assigned to this VLAN interface.

¡     IPv6 Prefix Length: The prefix length of the IPv6 address, ranging from 48 to 64.

¡     DNS1 and DNS2: Input the DNS server addresses for accessing the wide area network (WAN). Note that the device prioritizes using DNS1 for domain name resolution. If resolution fails, it will use DNS2 for domain name resolution.

¡     Address Lease: The lease time for the IPv6 address.

·     DHCPv6-PD: Generates the interface's IPv6 address after obtaining a prefix from the specified WAN interface.

¡     Subnet Prefix Name: The identifying name of the subnet, which can specify from which WAN interface to obtain the prefix, defaulting to all interfaces.

¡     Subnet Prefix Length: Specifies the length of the subnet mask to define the subnet range, ranging from 48 to 64.

¡     Subnet ID: Specifies the identifier (ID) of a specific subnet.

¡     DNS1 and DNS2: Input the DNS server addresses for accessing the wide area network (WAN). Note that the device prioritizes using DNS1 for domain name resolution. If resolution fails, it will use DNS2 for domain name resolution.

¡     Address Lease: The lease time for the IPv6 address.

Link-local address

Dedicated IPv6 addresses for communication within the same network link.

Task

You can edit and delete this configuration.

This page provides you with the following main functions:

·     Display detailed information about the added DHCPv6 static binding relationships

·     Add a DHCPv6 static binding relationship

·     Delete a DHCPv6 static binding relationship

·     Modify an added DHCPv6 static binding relationship

Add a DHCPv6 static binding relationship:

1.     Click the < Add > button to pop up the Add DHCPv6 dialog box, and set the parameters for the interface, IPv6 suffix, and DUID

2.     Click the < Acknowledge > button to complete the configuration

Delete an added DHCPv6 static binding relationship:

1.     Select the radio box in front of the DHCPv6 static binding relationship you want to delete

2.     Click the < Delete > button to pop up the confirmation prompt dialog box, then click the < Acknowledge > button to complete the configuration

Modify an added DHCPv6 static binding relationship:

1.     Click the edit icon in the operation column corresponding to the DHCPv6 static binding relationship you want to modify, which will pop up the DHCP static binding relationship dialog box, and modify the relevant configuration items

2.     Click Apply.

Item

Description

No.

The ID number of the VLAN interface.

Ports

The VLAN interfaces created on the device.

IPv6 suffix

The interface identifier that generates the IPv6 address together with the IPv6 prefix, which is the IPv6 suffix.

DUID

The client's unique identifier (DHCP Unique Identifier) used to distinguish different devices.

Display the details of the device allocated by DHCP

Item

Description

No.

Number of DHCPv6 allocation information.

DHCPv6 service

VLAN interface on the device where DHCPv6 service is enabled.

IPv6 address.

IPv6 address allocated to the client device.

DUID

Unique identifier of the client, used to distinguish different devices.

Validity Time

Remaining valid time of the address lease, in seconds.

This page provides you with the following main functions:

·     Display details of the added address groups

·     Add address groups

·     Delete added address groups

·     Modify added address groups

Add address group:

1.     Click the <Add> button to open the Add Address Group dialog box. Enter the name, description, IP address, and other parameter information for the address group.

2.     Click the <OK> button to complete the configuration.

Delete added address groups:

1.     Select the radio box in front of the address group you want to delete.

2.     Click the <Delete> button to open the confirmation dialog, then click the <OK> button to complete the configuration.

Modify added address groups:

1.     Click the edit icon in the operation column corresponding to the address group you want to modify, which will open the modify address group dialog box to change the relevant configuration items.

2.     Click Apply.

Parameter

Description

Address Group Name

A name for a set of user host names or IP addresses. When configuring this parameter, the name can indicate the characteristics of the addresses in this address group. The address group name cannot be named 'any' (case-sensitive).

Description

Description of the address group, providing a simple description for easier use.

IP address

A single IP address to be added to the address group. When configuring this parameter, after entering the IP address, click the “>” button on the right side of the configuration item (CI) to submit the configured address pool content.

IP Range

A range of IP addresses to be added to the address group. When configuring this parameter, after entering the starting and ending IP addresses, click the “>” button on the right side of the configuration item (CI) to submit the configured address pool content.

Excluded addresses

IP addresses that need to be excluded from the address group. When configuring this parameter, after entering the exclusion address, click the “>” button on the right side of the configuration item (CI) to submit the configured address pool content.

Task

This configuration can be edited, deleted, and viewed in detail.

This page provides you with the following main functions:

·     Display detailed information of the added time groups

·     Add time groups

·     Delete added time groups

·     Modify added time groups

Add time groups:

3.     Click the <Add> button to open the New Time Group dialog box, and enter the name and effective time of the time group.

4.     Click the <OK> button to complete the configuration.

Delete added time groups:

1.     Select the radio box in front of the time groups you want to delete

2.     Click the <Delete> button to open the confirmation prompt dialog box, then click the <OK> button to complete the configuration.

Modify added time groups:

1.     Click the edit icon in the corresponding operation column of the time group you want to modify, pop up the modify time group dialog box, and change the relevant configuration items (CIs)

2.     Click Apply.

Time Group Name

The name for a specific time period. When configuring this parameter, the name can help users understand the characteristics of the time period. The time group name cannot be named 'any' (case-sensitive).

Effective At

The effective time for this time group can be set in two ways:

·     Periodic Effectiveness: Effective on a weekly cycle. When configuring this parameter, select the specific days of the week on which it should be effective, and enter the specific effective times for each day below. Click the <+> button, then click the <Confirm> button to complete the configuration for this time period.

·     Non-Periodic Effectiveness: Effective within a specified time range. When configuring this parameter, select the start and end dates for effectiveness, and enter the specific start and end times below. Click the <+> button, then click the <Confirm> button to complete the configuration for this time period.

Task

This configuration can be edited or deleted.

This page provides you with the following main functions:

·     Display detailed information about the added IP traffic control

·     Add IP traffic control

·     Delete added IP traffic control

·     Modify added IP traffic control

Add IP traffic control policy:

1.     Click<Add> button to pop up the add IP traffic control policy dialog box, and set parameters such as application interface, user range, traffic limit, and restriction time period.

2.     Click<OK> button to complete the configuration.

Delete added IP traffic control:

1.     Select the radio box in front of the IP traffic control you want to delete.

2.     Click<Delete> button to pop up a confirmation prompt dialog box, then click<OK> button to complete the configuration.

Modify added IP traffic control:

1.     Click the edit icon in the operation column corresponding to the IP traffic control you want to modify, which will pop up the modify IP traffic control dialog box to change the relevant configuration items.

2.     Click Apply.

Parameter

Description

Application Interface

The source interface of the message, where the rules control the data packets received from a specific interface.

User

The address group that the rules need to control. When configuring this parameter, you must select an existing address group. To add a new address group, you can create it by clicking the <Add Address Group> button on the right.

Upload Bandwidth

The maximum upload bandwidth value for users within the address group. The unit is Mbps. Before configuring this parameter, you need to set the current link's upload bandwidth based on the actual upstream bandwidth provided by the carrier.

Download Bandwidth

The maximum download bandwidth value for users within the address group. The unit is Mbps. Before configuring this parameter, you need to set the current link's download bandwidth based on the actual upstream bandwidth provided by the carrier.

Traffic Allocation

The method of traffic allocation: mainly divided into:

·     Shared: All computers in the specified address group share the given bandwidth.

·     Exclusive: Each computer in the specified address group occupies the given bandwidth (i.e., traffic upper limit) individually.

Flexible Sharing

When the user's actual traffic bandwidth exceeds the configured bandwidth limit, the maximum percentage of the current link's upstream and downstream bandwidth that can be shared. When the traffic allocation is set to shared, this parameter can be configured as needed.

Restriction Time Period

The effective time period for IP speed limiting. When configuring this parameter, you can choose:

·     All Time Periods

·     Select an existing time group. To add a new time group, you can create it by clicking the <Add Time Group> button on the right.

Task

You can edit and delete this rule.

This page provides you with the following main functions:

·     Enable URL denylist and allowlist mode

·     Configure custom URL categories

·     Delete added URL categories

·     Import custom URL list

Enable URL denylist and allowlist mode:

1.     Select the “URL denylist mode” or “URL allowlist mode” option

2.     Click the <OK> button to complete the configuration

Configure custom URL categories:

1.     Set the custom URL category name, address group, and time group

2.     Click the details icon corresponding to the new URL category to open the set URL keywords dialog box. Configure the URL keywords

3.     Click the <OK> button to complete the configuration

Delete added URL categories:

1.     Select the URL category to delete and click the <Delete> button

2.     A confirmation dialog box will pop up. Click the <OK> button to complete the configuration

1.     Import custom URL list

2.     Click the import icon corresponding to the new URL category to open the import custom URL list dialog box. Click the <Upload File> button and select the custom URL list to import

3.     Click the <OK> button to complete the configuration

Parameter

Description

URL Allowlist

If this function is enabled, the device allows specified users to access designated URLs within the custom URL category during specified time periods; URLs not in the category cannot be accessed.

URL Denylist

If this function is enabled, the device prohibits specified users from accessing designated URLs within the custom URL category during specified time periods; URLs not in the category can be accessed normally.

No.

Number of the URL Control Policy

URL Categories

URL Keyword Dialog Box. Enter the corresponding URL, click the <+> button on the right, and the URL will be added successfully. Click the <OK> button to complete adding the URL keyword.

Configure address groups

IP address group that the policy needs to control.

Configure time range groups

Effective time of the policy

Task

You can perform the following operations on this policy:

·     Delete: Remove this policy

·     Details: Set URL keywords

·     Import: If there are too many custom URL category policies, you can first export the custom URL list in CSV format, fill in the policy, and then import it back into the device.

·     Export: Export the custom URL list in CSV format

URL Keyword

Keywords for the policy's URLs. Click the details icon in the operation column corresponding to the URL control policy, and in the pop-up set URL keywords dialog box, you can set the URL keywords. The range is 1-63 characters, and you can enter letters, digits, and special characters (excluding / \'"<>;&amp;`: and spaces). Letters are case-insensitive.

If the keyword does not include the wildcard *, the URL control policy will perform an exact match based on the keyword, such as www.baidu.com; if the keyword includes the wildcard *, the URL control policy will perform a fuzzy match based on the keyword, such as *.baidu.com, www.baidu*, or *baidu*; if the keyword is set to *.*, it matches all URLs.

Select the “Enable URL Filtering Log” option to activate the URL filtering log auditing function.

Click the <Clear Logs> button, and in the confirmation prompt, click the <Yes> button to clear all application audit logs.

Parameter

Description

No.

Log Information Number

Username/IP Address

Username or IP address that triggered the application control rule

Target URL

URL prohibited from access in the filtering rule

URL Category

Category to which the target URL belongs, e.g., search portal

Date and Time

Date and specific time when the log was generated

Use License Upon Login

Total number of logs generated

Actions

Execution actions of the application control policy on the messages that need control, mainly divided into:

·     Block: Indicates that the policy denies the message from passing and logs the action

·     Allow: Indicates that the policy permits the message to pass and logs the action

Set up the audit server:

1.     Enable the function to send audit logs to the server, and set the audit server address and port number.

2.     Click the <Apply> button to complete the configuration.

Parameter

Description

Audit server

Specify the server that will

Audit Server Address

The IP address or domain name of the server for the audit logs.

Port

The

This page provides you with the following main functions:

·     Enable or disable the firewall

·     Set default filtering rules

·     Add security rules

·     Delete security rules

·     Modify existing security rules

·     Display information about created security rules

Select the “Enable Firewall” radio box to enable the firewall function

In the default filtering rule configuration item, set the default filtering rules, click the <Apply> button to save the configuration

Add security rules:

1.     Click the <Add> button to open the create security rules page and configure parameters such as interface, orientation, and precedence

2.     Click Apply.

Delete security rules:

1.     Select the security rules you want to delete

2.     Click the <Delete> button to open the prompt dialog box

3.     Click Apply.

Modify security rules:

1.     Click the edit icon in the operation column of the security rule you want to modify to open the modify security rule dialog box and change the relevant parameters

2.     Click Apply.

Parameter

Description

Enable Firewall

Whether to enable the firewall function. If this function is enabled, the device will operate according to the configured firewall and rules.

The default is off.

Default Filtering Rules

The handling method for packets that do not match any rules, meaning the action the device takes on a packet when it does not match any rules, is mainly divided into:

·     Allow: Allow the packet to pass through the firewall.

·     Deny: Prevent the packet from passing through the firewall.

After setting is complete, you need to click the “Apply” button to make the configuration effective.

The default state is to allow.

Ports

The source interface of the packet, meaning the rules control the data packets received from a specific interface.

Direction

Display the direction of security rules, including inbound and outbound directions.

·     When the “Interface” parameter is selected as the WAN interface, the direction of security rules is inbound, meaning it controls traffic entering the device from the public network side.

·     When the “Interface” parameter is selected as the VLAN interface, the direction of security rules is outbound, meaning it controls traffic entering the device from the internal network side.

Protocol

Protocol type of the packets. Options include:

·     If you need to control packets of a specific transport layer protocol, select “TCP” or “UDP.”

·     If you need to control ICMP protocol packets like Ping or Tracert, select “ICMP.”

·     If you need to control packets of all protocols, select “All Protocols.”

Source Address Group

The range of source IP addresses that the rule needs to control. When configuring this parameter, you must select an already created address group. If you need to add a new address group, you can create a new address group by clicking the right-side < Add Address Group > button.

Destination Address Group

The range of destination IP addresses that the rule needs to control. When configuring this parameter, you must select an already created address group. If you need to add a new address group, you can create a new address group by clicking the right-side < Add Address Group > button.

Dest Port Range

The range of destination port numbers that the rule needs to control. When configuring this parameter, the starting port number cannot be greater than the ending port number.

Rule Effective Time

The effective time of the rule. When configuring this parameter, you must select an already created time group. If you need to add a new time group, you can create a new time group by clicking the right-side < Add Time Group > button.

Actions

The action the rule takes on the packets that need to be controlled is mainly divided into:

·     Allow: Indicates that the rule allows the packet to pass.

·     Deny: Indicates that the rule denies the packet from passing.

Priority

The precedence of the rule. There are two ways to set it:

·     Automatic: The system automatically assigns precedence to the rule, allocating it sequentially based on the configuration order in increments of 5.

·     Custom: The user customizes the precedence of the rule; the smaller the value, the higher the precedence.

Description

The description information of the rule, which can provide a simple description of the rule for easier use.

Task

You can edit, delete, or copy this rule.

This page provides you with the following main functions:

·     Enable or disable network connection limit

·     Add network connection limit rules

·     Delete network connection limit rules

·     Modify added network limit rules

·     Display information related to added network connection limit rules

Add network connection limit rules:

1.     Click the <Add> button to open the new network connection limit rule dialog box and configure the relevant parameters

2.     Click the <Apply> button to complete the configuration

Delete network connection limit rules:

1.     Select the network connection limit rules to delete, click the <Delete> button, and a confirmation prompt dialog box will appear

2.     Click Apply.

Modify network connection limit rules:

1.     Click the edit icon in the operation column corresponding to the network connection limit rule you want to modify, open the modify network connection limit rule dialog box, and change the relevant configuration items

2.     Click Apply.

Parameter

Description

Enable Network Connection Limit

Whether to enable the network connection limit function. If this function is enabled, the device will operate according to the configured network connection limit rules, which are disabled by default.

Connection Limit Address Group

IP address range that needs to be controlled by the rules

Maximum Total Connections per IP

Maximum number of network connections allowed per IP address

Maximum TCP Connections per IP

Maximum TCP network connections allowed per IP address

Maximum UDP Connections per IP

Maximum UDP network connections allowed per IP address

Description

Description of the rules, providing a simple description for ease of use

This page provides you with the following main functions:

·     Enable or disable VLAN network connection limit

·     Add VLAN network connection limit rules

·     Delete VLAN network connection limit rules

·     Edit the added VLAN network limit rules

·     Display information related to the added VLAN network connection limit rules

Add VLAN network connection limit rules:

1.     Click the <Add> button to open the new VLAN network connection limit rules dialog box and configure the relevant parameters

2.     Click the <Apply> button to complete the configuration

Delete VLAN network connection limit rules:

1.     Select the VLAN network connection limit rules you want to delete, and click the <Delete> button to open the confirmation prompt dialog box

2.     Click Apply.

Edit VLAN network connection limit rules:

1.     Click the edit icon in the operation column of the VLAN network connection limit rule you want to modify, open the edit VLAN network connection limit rules dialog box, and modify the relevant configuration items

2.     Click Apply.

Parameter

Description

Enable VLAN Network Connection Limit

Whether to enable the VLAN network connection limit function. If this function is enabled, the device will operate according to the configured VLAN network connection limit rules. By default, the VLAN network connection limit function is turned off.

VLAN Interface

The VLAN interfaces that need to be controlled by the rules

Total Connection Upper Limit

The maximum number of network connections allowed for the specified VLAN interface, to prevent individual VLANs from consuming excessive resources

TCP Connection Upper Limit

The maximum number of TCP network connections allowed to be initiated by the specified VLAN interface

UDP Connection Upper Limit

The maximum number of UDP network connections allowed to be initiated by the specified VLAN interface

Description

Description of the rules, allowing for a simple description of the rules for ease of use

Set MAC address filtering:

1.     Select the "allowlist" or "denylist" option in the "Filtering Method" column for the specified interface, and select the "Enable" option in the "On and Off" column.

2.     Click the <Apply> button to complete the configuration.

Parameter

Description

Port

Interface for Matching MAC Address Filtering Policy

Filtering Method

The method for the device to filter MAC addresses is mainly divided into:

·     Allowlist: Only allows source MAC addresses within the allowlist to access the internet, while others are denied access.

·     Denylist: Only prohibits source MAC addresses within the denylist from accessing the internet, while others are allowed access.

Enable and Disable

Whether to enable the MAC address filtering function:

·     If this function is enabled, the device will control the access of internal LAN computers to the internet based on the MAC addresses in the MAC address list.

·     If this function is not enabled, all computers in the local area network can access the internet without restrictions.

This page provides you with the following main functions:

·     Display detailed information of MAC addresses added to the allowlist

·     Add a single MAC address to the allowlist

·     Batch add MAC addresses to the allowlist

·     Add MAC addresses from the ARP entry to the allowlist

·     Export all MAC addresses currently added to the allowlist

·     Delete MAC addresses that have been added to the allowlist

·     Modify MAC addresses that have been added to the allowlist

Add a single MAC address to the allowlist:

1.     Click the <Add> button to open the Add Source MAC Address dialog box, then enter the MAC address and description you want to add.

2.     In the dialog box that opens, click OK.

Batch add MAC addresses to the allowlist:

1.     Click the <Export> button and select the “Export Template” menu item.

2.     Open the downloaded template, add the source MAC addresses to be filtered, and save it locally.

3.     Click the <Import> button to open the Import Source MAC Address dialog box.

4.     Click the <Upload File> button to open the dialog box for selecting the file to load, and select the edited template.

5.     Click the <OK> button to complete the batch addition of MAC addresses to the allowlist.

Import MAC addresses from ARP entries:

1.     Click the <Import from ARP Entries> button to open the Import ARP MAC Table dialog box.

2.     Select the MAC addresses to import and then click the <Import> button, which opens a confirmation dialog box.

3.     In the dialog box that opens, click OK.

Export all MAC addresses currently added to the allowlist:

1.     Select all entries

2.     Click the <Export> button and select the “Export All Data of Selected Filtering Mode” menu item.

Delete MAC addresses that have been added to the allowlist:

1.     Click the radio box in front of the MAC address you want to delete

2.     Click the <Delete> button, which opens a confirmation dialog box. Click the <OK> button to complete the configuration.

Modify MAC addresses that have been added to the allowlist:

1.     Select the edit icon in the operation column corresponding to the MAC address you want to modify, which opens the Edit Source MAC Address dialog box to modify the relevant configuration items.

2.     Click Apply.

Parameter

Description

No.

Policy number for MAC denylist and allowlist management

Type

Categories of MAC address filtering policies, mainly divided into:

·     Allowlist: Only source MAC addresses within the allowlist are allowed to access the external network; all others are prohibited from access

·     Denylist: Only source MAC addresses within the denylist are prohibited from accessing the external network; all others are allowed access

MAC

MAC addresses that the policy needs to control. This does not support MAC addresses of all 0s or all Fs

Description

Description information for the policy, allowing for a simple description of the policy for ease of use

Task

Allows editing and deletion of the added policies

In the "ARP Learning Management" column of the specified interface, set whether to allow the interface to learn dynamic ARP entries.

Parameter

Description

Port

Interfaces, such as WAN1, VLAN1

Port type

The interface types of the device are mainly divided into WAN and LAN ports

ARP Learning Management

The learning function of dynamic ARP entries is mainly divided into:

·     Enabled: Allows the interface to learn dynamic ARP entries

·     Disabled: Does not allow the interface to learn dynamic ARP entries

When the device has learned all valid user ARP entries under a certain interface, it is recommended to disable the dynamic ARP entry learning function. Dynamic ARP entries are temporarily generated when DHCP assigns IP addresses, and these entries will appear on the dynamic ARP management page, unaffected by the on-off control of the interface's ARP learning management.

This page provides you with the following main functions:

·     Display dynamic ARP information for a specified interface

·     Delete specified dynamic ARP

·     Scan for dynamic ARP within a specified interface and IP address range

·     Stabilize dynamic ARP

Delete specified dynamic ARP:

1.     Select the specified option in the dynamic ARP list, click the <delete> button, and a confirmation dialog box will pop up

2.     Click Apply.

Scan for dynamic ARP within a specified interface and IP address range:

1.     Click the <scan> button to open the scan dialog box, select the specified interface, and enter the specified IP address range

2.     Click Apply.

Stabilize the specified dynamic ARP:

1.     Select the specified option in the dynamic ARP list

2.     Click the <stabilize> button to complete the configuration

Parameter

Description

IP address

The IP address in this dynamic ARP information

MAC

The MAC address in this dynamic ARP information

Type

The type of this dynamic ARP information, mainly divided into:

·     Unbound: Indicates that this entry is a dynamically learned ARP entry

·     Dynamic binding: Indicates that this entry was automatically bound while providing ARP protection for a DHCP-assigned address

VLAN

The VLAN to which this dynamic ARP information belongs

Ports

The interface to which this dynamic ARP information belongs

Task

This dynamic ARP information can be edited

This page provides you with the following main functions:

·     Display static ARP information

·     Add static ARP entries

·     Delete static ARP entries

·     Import static ARP entries

·     Export static ARP entries

·     Modify ARP entries

Add static ARP entries:

1.     Click the <Add> button to open the Add ARP Entry dialog box, then enter the IP address and MAC address

2.     Click Apply.

Delete static ARP entries:

3.     Select the static ARP entries you want to delete, then click the <Delete> button to open the confirmation prompt dialog box

4.     Click Apply.

Import static ARP entries:

1.     Click the <Import> button to open the Import ARP Entry dialog box, then click the <Upload File> button to upload ARP entries

2.     Click Apply.

Modify ARP entries:

1.     Click the edit icon in the operation column corresponding to the ARP entry you want to modify to open the Modify ARP Entry dialog box, then enter the configuration items you need to modify

2.     Click Apply.

Item

Description

IP address

The IP address in this static ARP information

MAC

The MAC address in this static ARP information. Full 0 or full F MAC addresses are not supported here.

Type

The type of this static ARP information, which is static, indicating that the device's IP address is bound to the MAC address, forming a static ARP entry.

Description

Description information for the ARP entry, allowing for a simple description of the entry for easier use.

Task

You can edit or delete this static ARP information.

1.     Set ARP message validity check and free ARP

2.     Click<Apply>button to complete the configuration

Parameter

Description

ARP Packet Validity Check

ARP packet validity is verified by setting rules, mainly divided into:

·     Discard ARP packets with an invalid sender MAC address (the LAN port discards invalid ARP packets by default): When the source MAC address in the received ARP packet is all zeros, multicast, or a broadcast MAC address, the device will not learn this ARP packet and will discard it directly.

·     Discard ARP packets where the source MAC address in the packet header does not match the sender MAC address in the packet: When the source MAC address in the received ARP packet does not match the Layer 2 source MAC address of the packet, the device will not learn this ARP packet and will discard it directly.

·     ARP Packet Learning Suppression: When the device sends an ARP request packet and receives multiple different ARP response packets, the device will only learn the first ARP response packet received.

Gratuitous ARP

A special ARP packet that carries both the sender IP address and target IP address as the local IP address, with the source MAC address being the local MAC address and the destination MAC address being the broadcast address. It is mainly divided into:

·     Send Gratuitous ARP packet upon detecting ARP spoofing: When the device detects ARP spoofing (for example, when the source IP address is the device's interface IP address but the source MAC address is not the device's interface MAC address), it will actively send a Gratuitous ARP packet.

·     Active sending of Gratuitous ARP packets within the LAN: Additionally, input the sending interval for Gratuitous ARP packets in the "Sending Interval" configuration item.

·     Active sending of Gratuitous ARP packets on the WAN port: Additionally, input the sending interval for Gratuitous ARP packets in the "Sending Interval" configuration item. When the WAN port is connected to the internet via a static address/DHCP, it actively sends Gratuitous ARP packets; when connected via PPPoE, sending Gratuitous ARP packets is not supported.