If you want to

See

Get to know the product's general appearance, functionality, or role in real networks

Product introduction

Manage devices by setting up a Web environment, monitor the running status of the device, or use the setup wizard for a basic feature

System information,Device login

Quickly configure WAN and LAN port settings from the Web page of the device

Fast configuration

Configure features related to WAN or LAN ports from the Web page of the device, or configure advanced features, such as port mapping and one-to-one NAT mapping

Network

Configure bandwidth management and network behavior management features from the Web page of the device

Network behaviors

Configure device and network security settings from the Web page of the device, such as firewall, connection limit, MAC address filter, and ARP attack prevention

Network security

Configure portal authentication settings from the Web page of the device

Authentication

Configure IPsec VPN or L2TP VPN settings from the Web page of the device

Virtual network

Configure static DNS, dynamic DNS, or static routing from the Web page of the device

Advanced settings

Perform device maintenance operations from the Web page of the device, such as software upgrade or remote management

System tool

Configure wireless AC settings from the Web page of the device

Wireless AC

Product

Description

SR6602-I/SR6602-IE

·     Provides 12 GE copper ports and 20 10-GE fiber ports.

·     Supports one FIP expansion slot and various types of interface subcards.

View CPU usage and memory usage

PPPoE

PPPoE is a protocol for establishing point-to-point connections over Ethernet. It is typically used for authentication and dial-up connections in broadband access environments.

When accessing a WAN through PPPoE, a user must provide the specific account and password information. Then, the router uses this information to establish a dial-up connection for the user to access the Internet.

PPPoE is suitable for home broadband access. It is applicable to households and small businesses that require dial-up connections. Users can connect their home LANs to the Internet through broadband modems such as Asymmetric Digital Subscriber Line (ADSL) modems.

DHCP

DHCP is a network connection mode that dynamically allocates IP addresses. When a device connects to the network, it sends requests to the DHCP server. The server then dynamically allocates network parameters such as IP address, subnet mask, gateway, and DNS server, which allow the device to quickly connect to the network and obtain the necessary IP configuration.

DHCP is suitable for large LANs or enterprise networks. DHCP automatically allocates IP addresses through the DHCP server in the network. DHCP facilitates IP address allocation for numerous devices and reduces the workload of manual IP configuration.

Static IP

In this mode, you must manually configure a static IP address, subnet mask, gateway, DNS server, and other network parameters to a device. These settings do not change with the connection status of the device.

In this mode, you must manually configure a fixed IP address for a network device, ensuring that the device always uses the same IP address. This mode is typically suitable for network devices that require stable, long-term IP address allocations and do not need frequent changes for stable access.

Select a scenario.

Access the WAN in the PPPoE mode.

Access the WAN in the DHCP mode.

Access the WAN in the static IP mode.

Scenario Selection

Select the scenario for the device to access the WAN. When configuring this parameter, select a scenario as needed.

·     If you lease only one service provider network, select Single WAN.

·     If you lease two service provider networks, select Dual WANs.

The configuration procedure is the same for both scenarios.

Line1 or Line2

Select the physical interface WANx for accessing the WAN.

Link mode

Link mode used to access the WAN. Options include:

·     PPPoE—The interface accesses the WAN through broadband dialup.

·     DHCP—The interface automatically obtains an IP address from the DHCP server to access the WAN.

·     Static IP—The interface uses a fixed IP address provided by a service provider to access the WAN.

User name

Username for authentication. This parameter is provided by a service provider. You can configure this parameter when the link mode is PPPoE.

Password

Password for authentication. This parameter is provided by a service provider. You can configure this parameter when the link mode is PPPoE.

IP address

When the link mode is static IP, you can enter only a class A, B, or C IP address. This parameter is required when the link mode is static IP.

IP mask

Mask or mask length for the IP address, for example, 255.255.255.0. This parameter is required when the link mode is static IP.

Gateway Address

Gateway address used to access the WAN. You can enter only a class A, B, or C IP address. This parameter is required when the link mode is static IP.

DNS1 and DNS2

DNS server addresses for accessing the WAN. DNS server DNS1 is preferentially used. If DNS server DNS1 fails to resolve a domain name, DNS server DNS2 is used.

NAT

Specify whether to enable NAT. With NAT enabled, multiple devices on the LAN share one public IP.

On the LAN settings page, configure the local IP address, IP mask, and other parameters as needed.

Local IP Address

IP address used by the device in the LAN.

IP Mask

Mask or mask length for the IP address, for example, 255.255.255.0.

DHCP Server

Specify whether to enable the DHCP server. With the DHCP server enabled, the device acts as the DHCP server and allocates IP addresses to hosts in the LAN.

IP Distribution Range

Start IP address and end IP address of the IP addresses to be allocated.

Gateway Address

Gateway address that the device allocates to hosts in the LAN.

DNS

DNS server IP address that the device allocates to clients.

4.     View the installed licenses.

5.     Install a license online.

6.     Configure later or complete the configuration.

If you are not to install licenses or update the signature library now, click Configure Later to skip the configuration and access the next web page.

If you have completed license setup, click Finish to proceed to the next web page.

Parameter

Description

Test

Test whether the license management platform specified by the domain name can provide online automatic license installation.

·     If the LED is gray, it indicates that the platform is being tested.

·     If the LED is red, it indicates that the platform cannot provide online automatic license installation.

·     If the LED is green, it indicates that the platform cannot provide online automatic license installation.

Configure wireless AC settings. Specify the radio band management mode, SSID name, forwarding mode, authentication mode, and other parameters.

Parameter

Description

Radio band management mode for wireless services

Select the band management mode. Options include Merge and Separate.

To use the same SSID for the 2.4GHz and 5GHz bands, select Merge. To use different SSIDs for the 2.4GHz and 5GHz bands, select Separate.

SSID-1 name

Specify the SSID name that can be detected by wireless clients through scanning. If you select the Merge mode, you can specify only one SSID. If you select the Separate mode, specify the 2.4G SSID and the 5G SSID.

An SSID name is a case-sensitive string of 1 to 31 characters. Only Chinese characters, letters, digits, spaces, and special characters ~!@#$%^&*()_+-={}|[]:;’<>,./ are supported. One Chinese character is three characters long.

Forwarding mode

Select the forwarding mode:

·     Centralized forwarding—APs pass through client data traffic to the AC and the AC forwards client data traffic.

·     Local forwarding—APs forward client data traffic directly.

Authentication mode

Select the authentication mode:

·     None—Allows users to access the wireless network directly without entering any password. In this mode, authentication parameters are not required.

·     Static PSK authentication—Requires users to enter the correct password to access the wireless network.

Security mode

Select the security mode. Options include WPA, WPA2, WPA or WPA2, and WPA3-SAE, with an ascending security performance.

Cipher suite

Select the cipher suite based on the selected security mode:

·     In WPA security mode, the default cipher suite is TKIP. You can change it to CCMP or TKIP or CCMP as needed.

·     In WPA2 security mode, the default cipher suite is CCMP. You can change it to TKIP or TKIP or CCMP as needed.

·     In WPA or WPA2 security mode, the default cipher suite is TKIP or CCMP. You can change it to TKIP or CCMP as needed.

·     In WPA3-SAE mode, the default cipher suite is GCMP. You cannot change the default cipher suite. Select the WPA3-SAE mode:

¡     In mandatory mode, WPA3-incapable clients cannot access the wireless network.

¡     In optional mode, both WPA3-capable and WPA3-incapable clients can access the wireless network.

PSK

Passphrase indicates entering a password in string format. Rawkey indicates entering a password in hexadecimal format.

Single-WAN Scenario

The device connects to the WAN by using a single WAN interface.

Select this scenario if your network service is provided by only one service provider.

Multi-WAN Scenario

The device connects to the WAN by using multiple WAN interfaces.

Select this scenario if your network service is provided by two service providers.

To configure the single-WAN scenario or multi-WAN scenario for the device:

1.     Select the single-WAN Scenario or multi-WAN Scenario as needed.

2.     Select interfaces for accessing the WAN.

3.     Click Apply

Scenario

Select the single-WAN scenario or multi-WAN scenario as needed.

Single-WAN Scenario

The device uses a single WAN interface to access the WAN. In the single-WAN scenario, select the interface for accessing the WAN from the Line1 list.

Multi-WAN Scenario

The device uses multiple WAN interfaces to access the WAN. In the multi-WAN scenario, select the interfaces for accessing the WAN from the Line1, Line2, Line3, and Line4 lists.

PPPoE

PPPoE is a protocol for establishing point-to-point connections over Ethernet. It is typically used for authentication and dial-up connections in broadband access environments.

When accessing a WAN through PPPoE, a user must provide the specific account and password information. Then, the router uses this information to establish a dial-up connection for the user to access the Internet.

PPPoE is suitable for home broadband access. It is applicable to households and small businesses that require dial-up connections. Users can connect their home LANs to the Internet through broadband modems such as Asymmetric Digital Subscriber Line (ADSL) modems.

DHCP

DHCP is a network connection mode that dynamically allocates IP addresses. When a device connects to the network, it sends requests to the DHCP server. The server then dynamically allocates network parameters such as IP address, subnet mask, gateway, and DNS server, which allow the device to quickly connect to the network and obtain the necessary IP configuration.

DHCP is suitable for large LANs or enterprise networks. DHCP automatically allocates IP addresses through the DHCP server in the network. DHCP facilitates IP address allocation for numerous devices and reduces the workload of manual IP configuration.

Fixed IP

In this mode, you must manually configure a static IP address, subnet mask, gateway, DNS server, and other network parameters to a device. These settings do not change with the connection status of the device.

In this mode, you must manually configure a fixed IP address for a network device, ensuring that the device always uses the same IP address. This mode is typically suitable for network devices that require stable, long-term IP address allocations and do not need frequent changes for stable access.

Configure the WAN interface to access the WAN in the PPPoE mode.

Configure the WAN interface to access the WAN in the DHCP mode.

Configure the WAN interface to access the WAN in the fixed IP mode.

Line

Sequence number of the line accessing the WAN.

WAN Interface

WAN interface for accessing the WAN.

Connection Mode

Connection mode used to access the WAN. Options include:

·     PPPoE—The interface accesses the WAN through broadband dialup.

·     DHCP—The interface automatically obtains an IP address from the DHCP server to access the WAN.

·     Fixed IP—The interface uses a fixed IP address provided by a service provider to access the WAN.

User ID

Username for authentication. This parameter is provided by a service provider. You can configure this parameter when the connection mode is PPPoE.

User Password

Password for authentication. This parameter is provided by a service provider. You can configure this parameter when the connection mode is PPPoE.

Online Mode

Only the Always Online option is supported in the current software version. When the connection mode is PPPoE, this option is selected by default and cannot be cleared.

IP Address

When the connection mode is fixed IP, you can enter only a class A, B, or C IP address. You must configure this parameter when the connection mode is fixed IP.

Subnet Mask

Mask or mask length for the IP address, for example, 255.255.255.0. You must configure this parameter when the connection mode is fixed IP.

Gateway

Gateway address used to access the WAN. You can enter only a class A, B, or C IP address. You must configure this parameter when the connection mode is fixed IP.

DNS1 and DNS2

DNS server addresses for accessing the WAN. DNS server DNS1 is preferentially used. If DNS server DNS1 fails to resolve a domain name, DNS server DNS2 is used.

NAT

Specify whether multiple devices on the LAN share one public IP. If you select On, perform one of the following tasks as needed:

·     If only one public IP exists, do not select Use Address Pool for Translation.

·     If multiple public IPs exist, select Use Address Pool for Translation, and select an existing NAT address pool. To add an address pool, click Add Address Pool on the right.

TCP MSS

Maximum segment size (MSS) of TCP packets for the interface.

MTU

Maximum transmission unit (MTU) for the interface.

Link Detection

This feature improves the link availability by detecting the link status to the specified IP address or domain name. Select one of the following options as needed:

·     To detect the link status, select Enable.

·     To disable link detection, select Disable.

Detection Address

IP address for link detection. When link detection is enabled, you must configure this parameter.

Detection Interval

Link detection interval. When link detection is enabled, you must configure this parameter.

MAC

MAC address for accessing the WAN.

Actions

Edit configuration.

Average load sharing

Each link shares the load equally.

The WAN interfaces belong to the same service provider and each link has the same bandwidth.

Bandwidth proportion-based load sharing

Each link shares the load proportionally.

The WAN interfaces belong to the same service provider but each link has different bandwidth.

Service provider-based load sharing

Each link shares the load equally.

The WAN interfaces belong to different service providers, and each service provider provides the same link bandwidth.

Multilink advanced load sharing

Each link shares the load proportionally.

WAN interfaces belong to different service providers, and each service provider provides links with different bandwidth.

Link backup

Select one link as the main link and use the other links as backup links to ensure network stability.

If you require high network stability, set up backup links.

When multiple WANs belong to the same service provider, perform the following tasks:

1.     Select Average load sharing or Bandwidth proportion-based load sharing.

2.     Click Apply

When multiple WANs belong to different service providers, perform the following tasks:

1.     Select Service provider-based load sharing or Multilink advanced load sharing.

2.     Click Apply.

To configure link backup:

1.     Select the main link and the backup link

2.     Click Apply.

When multiple WANs belong to the same service provider, the following parameters are available:

·     Average load sharing

·     Bandwidth proportion-based load sharing

1.     When multiple WAN interfaces of the device access the same service provider line, you can select a load sharing mode as needed:

¡     If all links have the same bandwidth, select Average load sharing.

¡     If the links have different bandwidth values, select Bandwidth proportion-based load sharing, and allocate the link bandwidth ratios.

2.     Click Apply to make the configuration take effect.

When multiple WANs belong to different service providers, the following parameters are available:

·     Service provider-based load sharing

·     Multilink advanced load sharing

1.     When multiple WAN interfaces of the device access different service provider lines, you can select a load sharing mode as needed:

¡     If all service providers provide the same bandwidth, select Service provider-based load sharing, and select the service provider and default link for each WAN interface.

¡     If service providers provide different bandwidth values, select Multilink advanced load sharing, allocate the link bandwidth ratios, and select the service provider and default link for each WAN interface.

2.     Click Apply to make the configuration take effect.

Link backup

When you access the WAN through multiple WAN interfaces, select one link as the main link and use the other links as backup links to ensure network stability. To configure link backup, first select the Main link (please select the WAN interface for the main link) option and the corresponding Linen. Then, select the Backup link (please select the WAN interface for the backup link) option, and select the corresponding Linem. To implement link backup, make sure n and m are different.

If the selected main link has link detection enabled on the WAN Settings > WAN Settings page, the system will change the actual main link that takes effect according to the link detection result. If the selected main link does not have link detection enabled, the system will change the actual main link that takes effect according to the physical state of the corresponding interface.

Allocate Link Bandwidth Ratio

Set the default link bandwidth ratio for each link. When configuring this parameter, make sure the bandwidth ratio is not 0 for at least one link.

You must configure this parameter after you select bandwidth proportion-based load sharing or multilink advanced load sharing for the multi-WAN policy.

NOTE:

Enter an integer in the range of 0 to 100 for this parameter.

Configure last hop holding for the WAN interface.

Enable last hop holding

Specify whether to enable last hop holding. With this feature enabled in the multi-WAN scenario, packets entering the LAN and the corresponding return packets leaving the LAN will be forwarded through the same WAN interface.

On this page, you can perform the following operations:

·     Display detailed information of the added LANs.

·     Add LANs.

·     Delete the existing LANs.

·     Edit the existing LANs.

To add a LAN:

1.     Click Add. In the Add LAN dialog box that opens, set the VLAN ID, IP address, subnet mask, and other parameters as needed.

2.     Click Apply.

To delete existing LANs:

3.     Select the LANs you want to delete.

4.     Click Delete. Then, click OK in the confirmation dialog box that opens.

To edit an existing LAN:

5.     Click the Edit icon in the Actions column for the LAN you want to edit. In the dialog box that opens, edit the relevant parameters as needed.

6.     Click Apply.

Interface Name

Name of the VLAN interface.

VLAN ID

ID of the VLAN interface.

IP Address

IP address of the VLAN interface.

Subnet Mask

Subnet mask or mask length for the IP address, for example, 255.255.255.0

TCP MSS

MSS of TCP packets for the VLAN interface.

MTU

MTU value allowed by this VLAN interface.

Enable DHCP

Specify whether to enable the DHCP server. If you enable this feature, the device will dynamically assign IP addresses to clients (such as computers) connected to the device. By default, the DHCP server is disabled.

Start Address of Pool

Start IP address of the DHCP server address pool.

End Address of Pool

End IP address of the DHCP server address pool, which cannot be lower than the start IP address of the pool.

Excluded Address

IP address that cannot be allocated to clients, for example, gateway address.

Gateway Address

Gateway address for the address pool. If you do not configure a gateway address, the network might be interrupted.

DNS Server 1 and DNS Server 2

When the DHCP server assigns an IP address, it can also assign DNS server addresses, among which DNS server 1 is preferentially used for domain name resolution. If DNS server 1 fails to resolve a domain name, DNS server 2 is used.

Address Lease

Lease duration of the IP address that the DHCP server assigns to the client. After the lease duration expires, the DHCP server will reclaim the IP address, and the client must re-apply for an IP address from the router (clients typically re-apply automatically).

Actions

Edit or delete configuration.

On this page, you can perform the following operations:

·     Display information about VLANs that a port permits.

·     Configure the VLANs that a port permits.

Configure the VLANs that a port permits.

Port Name

LAN interface to be assigned to VLANs.

PVID

Default VLAN for this port.

Permitted VLANs

All VLANs permitted by the LAN interface.

Available VLANs

All VLANs created on the device. When configuring this parameter, select VLAN IDs from the available VLAN list or click the available VLAN list option to select all VLANs. Then, click the right arrow button to add the port to the selected VLANs.

Selected VLANs

VLANs to which this interface has been assigned When configuring this parameter, select VLAN IDs from the selected VLAN list or click the selected VLAN list option to select all VLANs. Then, click the left arrow button to remove the port from the selected VLANs.

Actions

Edit configuration.

On this page, you can perform the following operations:

·     Display detailed information about the existing static DHCP bindings.

·     Add static DHCP bindings.

·     Delete static DHCP bindings.

·     Edit existing static DHCP bindings.

To add a static DHCP binding:

1.     Click Add. In the Add Static DHCP Binding dialog box that opens, configure the interface, client MAC address, client IP, and other parameters as needed.

2.     Click Apply.

To delete an existing static DHCP binding:

1.     Select the static DHCP bindings you want to delete.

2.     Click Delete. Then, click OK in the confirmation dialog box that opens.

To edit an existing static DHCP binding:

1.     Click the Edit icon in the Actions column for the static DHCP binding you want to edit. In the dialog box that opens, edit the relevant configuration items as needed.

2.     Click Apply.

Serial Number

Number of a static DHCP policy.

Interface

VLAN interface created on the device. The policy binds the IP address and MAC address obtained from a specific interface.

Client MAC

MAC address of a client. The MAC address cannot be all-0s or all-Fs.

Client IP

IP address assigned to the client.

Subnet Mask

Subnet mask or mask length for the IP address, for example, 255.255.255.0

Description

Description of the policy.

Actions

Edit or delete configuration.

Display detailed information about the allocated DHCP bindings on the device.

DHCP Server Interface

VLAN interface with DHCP enabled on the device.

DHCP Client IP

IP address of a client.

DHCP Client MAC

MAC address of a client.

Lease Expiration Time

Lease duration of the IP address that the DHCP server assigns to the client. After the lease duration expires, the DHCP server will reclaim the IP address, and the client must re-apply for an IP address from the router (clients typically re-apply automatically).

On this page, you can perform the following operations:

·     Display detailed port information on the device.

·     Edit port settings.

To edit port settings:

1.     Click the Edit icon in the Actions column for the port you want to edit. In the dialog box that opens, edit the relevant configuration items as needed.

2.     Click Apply.

Physical Interface

Physical interface of the device. For example, WAN1 or LAN1.

Port Type

Specify a port type. Options include:

·     WAN: Interface for accessing a WAN.

·     LAN: Interface for accessing a LAN.

Duplex Mode

Operating mode of the port. Options include:

·     Auto: Both the duplex mode and speed of the port are determined by autonegotiation between this port and the remote port.

·     Full Duplex: The port can receive data packets while sending data packets.

·     Half Duplex: The port can only send or receive packets at the same time.

Speed

Speed of the port. Options include Auto, 10Mbps, 100Mbps, and 1Gbps.

MAC Address

MAC address of the port.

Physical Status

Operating state of the port. Options include:

·     Up: The port is brought up.

·     Down: The port is shut down.

When the port type is LAN, you cannot edit this parameter, and the port is up by default.

Fiber/Copper Mode

Operating mode of the port. Options include:

·     Fiber Port: The port operates as a fiber port.

·     Copper Port: The port operates as copper port.

Actions

Edit configuration.

On this page, you can perform the following operations:

·     Display detailed information about the existing port mappings.

·     Add NAT port mappings.

·     Delete existing NAT port mappings.

·     Edit existing NAT port mappings.

To add a NAT port mapping:

1.     Click Add. In the Add NAT Port Mapping dialog box that opens, configure the protocol type, global IP address, global port number, and other parameters.

2.     Click Apply.

To delete existing NAT port mappings:

1.     Select the NAT port mappings to be deleted.

2.     Click Delete. In the dialog box that opens, click Yes.

To edit an existing NAT port mapping:

1.     Click the Edit icon in the Actions column for the target NAT port mapping. In the Edit NAT Port Mapping dialog box that opens, edit the settings as required.

2.     Click Apply.

Interface

You can use the IP address of the selected WAN interface as the global IP address.

Protocol Type

Transport layer protocol used by the internal host. Options include:

·     TCP.

·     UDP.

·     TCP+UDP.

Global IP Address

Public IP address type. Options include:

·     Current IP Address—IP address of the selected WAN interface.

·     Other IP Addresses—Another public IP address of the device.

Global Port Number

Open ports for the public IP address. Options include:

·     FTP—Select this option when the internal host provides FTP services.

·     Telnet—Select this option when the internal host provides Telnet services.

·     User-Defined Ports—Select this option when the internal host provides services other than FTP and Telnet, and enter the port number range used by the services. Make sure the start port number is not larger than the end port number.

Local IP Address

IP address of the internal host that provides specific services.

Local Port Number

Open service ports on the internal host.

Actions

Edit or delete configuration.

On this page, you can perform the following operations:

·     Display detailed information about the existing one-to-one mappings.

·     Enable the one-to-one mapping feature.

·     Add one-to-one mappings.

·     Delete existing one-to-one mappings.

·     Edit existing one-to-one mappings.

To enable the one-to-one mapping feature, select Enable for the One-to-one Mappings field.

To add a one-to-one NAT mapping:

1.     Click Add. In the Add NAT One-to-One Mapping dialog box that opens, configure the local IP address, global IP address, and other parameters.

2.     Click Apply.

To delete existing one-to-one NAT mappings:

1.     Select the one-to-one mappings to be deleted.

2.     Click Delete. In the dialog box that opens, click Yes.

To edit an existing one-to-one NAT mapping:

1.     Click the Edit icon in the Actions column for the target one-to-one mapping. In the Edit NAT One-to-One Mapping dialog box that opens, edit the settings as required.

2.     Click Apply.

Local IP Address

IP address of the internal host that provides specific services.

Global IP Address

Public IP address of the device.

Specify Permitted Destination IP Addresses

Destination IP address range that can be accessed by the internal host.

·     If you select this option and configure an address range, the device performs address translation on only packets with destination IP addresses within the address range.

·     If you do not select this option, the device performs address translation on all packets from the internal network to the external network.

Actions

Edit configuration.

To configure NAT hairpin:

1.     Select Enable NAT Hairpin.

2.     Click Apply.

Parameter

Description

NAT Hairpin

Select whether to enable NAT hairpin, and then click Apply to have the configuration take effect. If you enable NAT hairpin, both internal and external users can access internal servers by using public IP addresses.

To configure NAT ALG:

1.     Enable NAT ALG for protocols as required.

2.     Click Apply.

NAT ALG

To make sure data connections of certain application layer protocols can still be correctly established after address translation, enable NAT ALG for the protocols.

Options include:

·     Enable NAT ALG for DNS.

·     Enable NAT ALG for FTP.

·     Enable NAT ALG for H.323.

·     Enable NAT ALG for ICMP-Error Packets.

·     Enable NAT ALG for ILS.

·     Enable NAT ALG for MGCP.

·     Enable NAT ALG for NBT.

·     Enable NAT ALG for PPTP.

·     Enable NAT ALG for RTSP.

·     Enable NAT ALG for RSH.

·     Enable NAT ALG for SCCP.

·     Enable NAT ALG for SIP.

·     Enable NAT ALG for SQLNET.

·     Enable NAT ALG for TFTP.

·     Enable NAT ALG for XDMCP.

For the configuration to take effect, click Apply.

On this page, you can perform the following operations:

·     Display user group details.

·     Add a user group.

·     Delete user groups.

·     Edit a user group.

To add a user group:

1.     Click Add. The Add User Group dialog box opens. Configure the name, description, IP address, and other parameters for the user group.

2.     Click OK.

To delete user groups:

1.     Select the user groups to be deleted.

2.     Click the Delete button. Then, click OK in the confirmation dialog box that opens.

To edit a user group:

1.     Click the edit icon in the Actions column for the user group to be edited. The Edit User Group dialog box opens. Edit related parameters.

2.     Click Apply.

Parameter

Description

User Group Name

Name of the address group. The name can be used to indicate the characteristics of addresses in the user group. The name cannot be the word any (case insensitive)

User Group Content

IP addresses or hostnames added to the user group.

Description

Description of the user group.

Hostname

Enter a hostname to add the host to the user group.

IP Address

Enter an IP address to add it to the user group. After you enter an IP address, click the →→ icon on the right to submit it.

IP Address Range

Enter an IP address range to add it to the user group. After you enter a start address and an end address, click the →→ icon on the right to submit the IP address range.

Exclude IP Address

IP addresses to be excluded. After you enter an excluded IP address, click the →→ icon on the right to submit it.

Actions

You can edit, delete, and view the details of a user group.

On this page, you can perform the following operations:

·     Display time range group details.

·     Add a time range group.

·     Delete time range groups.

·     Edit a time range group.

To add a time range group:

1.     Click Add. The Add Time Range Group dialog box opens. Configure the name, time range, and other parameters for the time range group.

2.     Click Apply.

To delete time range groups:

1.     Select the time range groups to be deleted.

2.     Click the Delete button. Then, click OK in the confirmation dialog box that opens.

To edit a time range group:

1.     Click the edit icon in the Actions column for the time range group to be edited. The Edit Time Range Group dialog box opens. Edit related parameters.

2.     Click Apply.

Time Range Group Name

Name of the time range group. The name can be used to indicate the characteristics of time ranges in the time range group. The name cannot be the word any (case insensitive)

Time Ranges

Active time of the time range group. You can configure the following time ranges:

·     Periodic: This type of time range begins and ends on a recurring basis. Select days of the week, enter the start time and end time, and click the plus sign.

·     Absolute: This type of time range begins on a specific date and ends on a specific date. Select the start and end dates, enter the start time and end time, and click the plus sign.

Used

Indicates whether the time range group has been used by a policy:

·     Yes.

·     No.

Actions

You can edit or delete the time range group.

On this page, you can perform the following operations:

·     Display time range group details.

·     Add a bandwidth policy.

·     Delete bandwidth policies.

·     Edit a bandwidth policy.

To add a bandwidth policy:

1.     Click Add. The Bandwidth Policy dialog box opens. Configure the application interface, user range, bandwidth limit, restricted period, and other parameters for the bandwidth policy.

2.     Click Apply.

To delete bandwidth policies:

1.     Select the bandwidth policies to be deleted.

2.     Click the Delete button. Then, click OK in the confirmation dialog box that opens.

To edit a bandwidth policy:

1.     Click the edit icon in the Actions column for the bandwidth policy to be edited. The Edit Bandwidth Policy dialog box opens. Edit related parameters.

2.     Click Apply.

Parameter

Description

Application Interface

Interface on which packets are received.

User Range

User group to be limited. You can select an existing user group. You can also create a user group by clicking Add User Group on the right.

Upload Bandwidth

Maximum upload bandwidth for users in the user group. The unit is Mbps. You must configure this parameter according to the actual uplink bandwidth provided by your ISP.

Download Bandwidth

Maximum download bandwidth for users in the user group. The unit is Mbps. You must configure this parameter according to the actual downlink bandwidth provided by your ISP.

Bandwidth Assignment

You can select either of the following bandwidth assignment methods:

·     Shared: All addresses in the user group share the specified bandwidth.

·     Exclusive: Each address in the user group exclusively uses the specified bandwidth.

Restricted Period

Time when the bandwidth policy is in effect. Options include:

·     All Time Ranges

·     Select Existing Time Range Group You can also create a time range group by clicking Add Time Range Group on the right.

Actions

You can edit or delete the bandwidth policy.

On this page, you can perform the following operations:

·     Set the output bandwidth for each WAN interface.

·     Add a bandwidth guarantee policy.

·     Delete bandwidth guarantee policies.

·     Edit a bandwidth guarantee policy.

To set the output bandwidth for each WAN interface:

1.     Enter the output bandwidth for each WAN interface.

2.     Click Apply.

To add a bandwidth guarantee policy:

1.     Click Add. The Create Bandwidth Guarantee Policy dialog box opens. Configure the policy name, application Interface, and other parameters for the bandwidth guarantee policy.

2.     Click Add. The Create Match Rule dialog box opens. Configure the queue type, guaranteed bandwidth, and match criteria, and then click Apply.

3.     Click Apply on the Create Bandwidth Guarantee Policy dialog box.

To delete bandwidth guarantee policies:

1.     Select the bandwidth guarantee policies to be deleted.

2.     Click the Delete button. Then, click OK in the confirmation dialog box that opens.

To edit a bandwidth guarantee policy:

1.     Click the edit icon in the Actions column for the bandwidth guarantee policy to be edited. The Edit Bandwidth Guarantee Policy dialog box opens. Edit related parameters.

2.     Click Apply.

Parameter

Description

Policy Name

Name of the bandwidth guarantee policy.

Application Interface

Interface to apply the bandwidth guarantee policy.

Queue Type

Queue for matching traffic. EF has a higher forwarding priority than AF.

Guaranteed Bandwidth

Total bandwidth guaranteed for all matching users.

Protocol

Protocol name.

Protocol Type

Protocol number.

Local Subnet/Mask

Source subnet/mask used to match the source IP address of packets.

Local Port

Source port range used to match the source port of packets.

Destination Subnet/Mask

Destination subnet/mask used to match the destination IP address of packets.

Peer Port

Destination port range used to match the destination port of packets.

Actions

You can edit or delete the bandwidth policy.

To configure global control:

1.     Select Enable Network Behaviors.

2.     Click Apply.

Parameter

Description

Global control

Select whether to enable network behavior management. After you enable this feature, the device will work based on the configured network behavior management policy.

On this page, you can perform the following operations:

·     Display network behavior management policy details.

·     Add a network behavior management policy.

·     Delete network behavior management policies.

·     Edit a network behavior management policy.

To add a network behavior management policy:

1.     Click Add. The Create Network Behavior Management Policy dialog box opens. Configure the policy name, user range, restricted period, and other parameters for the network behavior management policy.

2.     Click OK.

To delete network behavior management policies:

1.     Select the network behavior management policies to be deleted.

2.     Click the Delete button. Then, click OK in the confirmation dialog box that opens.

To edit a network behavior management policy:

1.     Click the edit icon in the Actions column for the network behavior management policy to edited. Edit related parameters.

2.     Click Apply.

Parameter

Description

Policy Name

Name of the network behavior management policy.

User Range

Address group to be controlled. You can select an existing user group. You can also create a user group by clicking Add User Group on the right.

Time Range

Time when the network behavior management policy is in effect. You can select all time ranges or select an existing time range group. You can also create a time range group by clicking Add Time Range Group on the right.

Application Control

Select network applications and select an action to take on the applications. The following actions are available:

·     Block: Block access to the applications.

·     No Blocking or Rate Limit: Do not limit access to the applications.

·     Rate Limit: Rate limit access to the applications. You can set the maximum uplink bandwidth and maximum downlink bandwidth per user.

Application Control Logs

Log network behaviors. When a packet matches a network behavior management policy, an application control log is generated.

Actions

You can edit or delete a network behavior management policy.

Configure signature library update

·     Perform a local update.

·     Perform an online update.

Parameter

Description

Perform a local update.

Updates a signature library on the device by using a locally stored signature file.

Perform an online update.

If the device can access the signature library service area on the company's website, you can use this method update the signature library.

To configure application traffic ranking:

1.     Select On for the Application traffic ranking option.

To configure user traffic ranking:

1.     On the interface list, you can click the On/Off button for an interface to disable or enable traffic ranking for static IP users and DHCP users on the interface.

To add an intranet segment:

1.     Click the edit icon in the Actions column for an interface to open the Add intranet segment page. Configure IP addresses.

2.     Click OK.

Parameter

Description

Application traffic ranking

Choose to whether enable application traffic ranking. If this function is enabled, the page displays the traffic ranking information for applications.

User traffic ranking

Choose to whether enable user traffic ranking. If this function is enabled,  the page displays the traffic statistics for connected endpoints.

Interface Name

Interface an endpoint uses to access the network, for example VLAN1.

Intranet Segment

The system performs traffic statistics and ranking only for IP addresses within the intranet segment. The default intranet segment is the network segment directly connected to the interface. To ensure network connectivity, you must correctly configure the intranet segment. If the intranet segment changes, edit it in time.

Actions

Click the edit icon to add an intranet segment for the VLAN interface.

Display user traffic ranking details, including endpoint IP address, endpoint name, and username.

Parameter

Description

Endpoint IP

IP address of the connected endpoint.

Endpoint Name

Name of the connected endpoint.

Username

Username of the connected endpoint.

Access Method

The following access methods are available:

·     Static IP: An endpoint uses a statically assigned IP address to access the network.

·     DHCP: An endpoint uses a DHCP-assigned IP address to access the network.

·     Portal: An endpoint uses portal authentication to access the network.

·     PPPoE: An endpoint uses PPPoE to access the network.

·     L2TP: An endpoint uses L2TP to access the network.

Interface

Interface an endpoint uses to access the network, for example VLAN1.

Endpoint MAC Address

MAC address of the connected endpoint.

Uplink Rate

Rate of the uplink traffic of the endpoint.

Downlink Rate

Rate of the downlink traffic of the endpoint.

Online Duration

Amount of time the endpoint is online.

Actions

Click the rate limit icon to configure the upload bandwidth and download bandwidth for an interface.

Display application traffic ranking details, including application type, uplink rate, and downlink rate.

Parameter

Description

Application Type

Type of the application.

Uplink Rate

Real-time rate of the traffic from the endpoint to the application.

Downlink Rate

Real-time rate of the traffic from the application to the endpoint.

Today’s Uplink Traffic

Size of the traffic from the endpoint to the application on the current day.

Today’s Downlink Traffic

Size of the traffic from the application to the endpoint on the current day.

Today’s Total Traffic

Total size of the traffic from the application to the endpoint and the traffic from the endpoint to the application on the current day.

Actions

Click the Details icon in the Actions column for an interface to enter the details page. This page displays the application traffic information.

On this page, you can perform the following operations:

·     Add a firewall rule.

·     Delete firewall rules.

·     Edit a firewall rule.

·     Display firewall rules.

To add a firewall rule:

1.     Click Add. The Add Firewall Rule page opens. Configure the interface, protocol, priority, and other parameters.

2.     Click Apply.

To delete firewall rules:

1.     Select the firewall rules to be deleted.

2.     Click the Delete button. The confirmation dialog box opens.

3.     Click Apply.

To edit a firewall rule:

1.     Click the edit icon in the Actions column for the firewall rule to be edited. The Edit Firewall Rule dialog box opens. Edit related parameters.

2.     Click Apply.

Interface

Interface on which packets are received.

Protocol

Protocol type of packets.

·     To control transport layer packets, select TCP or UDP.

·     To control ICMP packets such as ping and tracert packets, select ICMP.

·     To control all packets, select All.

Source IP Address/Mask

Enter the source IP address/mask used to match packets. If you enter any, packets with any source IP address are matched.

Destination IP Address/Mask

Enter the destination IP address/mask used to match packets. If you enter any, packets with any destination IP address are matched.

Destination Port

Enter a destination port or destination port range used to match packets. For example, you can enter 80 to match HTTP packets.

Time Range

Time when the firewall rule is in effect. You can select an existing time range group.

Security Action

Select the action to take on matching packets. Options include:

·     Permit.

·     Deny.

Priority

Configure a priority for the firewall rule. The following methods are available:

·     Auto-Assigned: The system automatically assigns a priority to the rule. The priorities of rules are assigned in the rule creation order at a step of 5. A rule created earlier has a higher priority.

·     User-Defined: Specify a user-defined priority for the rule. The smaller the number, the higher the priority.

Description

Enter a description for the rule.

On this page, you can perform the following operations:

·     Display the existing attack defense policies.

·     Add attack defense policies.

·     Delete attack defense policies.

·     Edit existing attack defense policies.

To add an attack defense policy:

1.     Click Add. In the Add Attack Defense Configuration dialog box that opens, select an interface and attack defense types.

2.     Click Apply.

To delete attack defense policies:

1.     Select the attack defense policies to be deleted, and then click Delete.

2.     In the dialog box that opens, click Yes.

To edit an existing attack defense policy:

1.     Click the Edit icon in the Actions column for the target attack defense policy. In the Edit Attack Defense Configuration dialog box that opens, edit the settings as required.

2.     Click Apply.

Interface

Interface that receives the attack packets. The attack defense policy takes effect on the specified interface.

Attack Defense

Attack defense types. Options include:

·     Single-Packet Attack Defense—Protects the system from malformed packet attacks. Options include:

¡     Fraggle attack defense—Protects the device from fraggle attacks. For a fraggle attack, the attacker sends UDP packets in which the source IP address is the victim's IP address to the subnet broadcast address. Each host on the subnet returns a reply to the victim, which causes network congestion or host crashes.

¡     Land attack defense—Protects the device from Land attacks. For a Land attack, the attacker sends the victim TCP SYN packets, which contain the victim's IP address as the source and destination IP addresses. After receiving such packets, the victim suffers from internal response storms, consuming a large number of CPU resources.

¡     WinNuke attack defense—Protects the device from WinNuke attacks. For a WinNuke attack, the attacker exploits the Out-of-Band (OOB) vulnerabilities in NetBIOS to launch an attack to the victim, causing host crashes or blue screen.

¡     TCP flag attack defense—Protects the device from TCP flag attacks. For a TCP flag attack, the attacker sends TCP packets with unconventional TCP flags to the target host to probe its operating system type. If the operating system fails to process such packets correctly, the host crashes.

¡     ICMP destination unreachable message attack defense—Protects the device from ICMP destination unreachable message attacks. For an ICMP destination unreachable message attack, the attacker sends ICMP destination unreachable packets in order to cut off network connections of the target host.

¡     ICMP redirect message attack defense—Protects the device from ICMP redirect message attacks. For an ICMP redirect message attack, the attacker sends ICMP redirect messages to modify the victim's routing table. As a result, the victim cannot forward IP packets correctly.

¡     Smurf attack defense—Protects the device from smurf attacks. For a smurf attack, the attacker broadcasts an ICMP echo request to a subnet. The source IP address in the request is the victim's IP address. Every receiver on the subnet will send an ICMP echo reply to the victim, causing network congestion or system crashes.

¡     Source routing option attack defense—Protects the device from source route option attacks. For a source route option attack, the attacker exploits the source route option in the IP header to probe the network topology.

¡     Record route option attack defense—Protects the device from record route option attacks. For a record route option attack, the attacker exploits the record route option in the IP header to probe the network topology.

¡     Large ICMP packet attack defense—Protects the device from large ICMP packet attacks. For a large ICMP packet attack, the attacker sends large ICMP packets to the target to make it crash.

·     Abnormal Flow Attack Defense—Protects the system from forged requests that affect normal services. Options include:

¡     Scanning attack defense—Protects hosts from IP sweep and port scan attacks that probe the network topology and open service ports for further intrusion.

¡     SYN flood attack defense—Sets the enabling status of SYN flood attack defense and threshold for triggering SYN flood attack defense. For a SYN flood attack, the attacker sends the target a large number of SYN packets that consume the connection resources of the target. As a result, the target cannot establish new connections.

¡     UDP flood attack defense—Sets the enabling status of UDP flood attack defense and threshold for triggering UDP flood attack defense. For a UDP flood attack, the attacker sends the target a large number of UDP packets, making the target too busy to process normal services.

¡     ICMP flood attack defense—Sets the enabling status of ICMP flood attack defense and threshold for triggering ICMP flood attack defense. For an ICMP flood attack, the attacker sends the target a large number of ICMP requests, making the target too busy to process normal packets.

View statistics about single-packet attack defense and abnormal flow attack defense separately, and export the statistics to an Excel file.

No.

Attack number.

Attack Type

Type of the attack, which is one of the detailed single-packet attack types or abnormal flow attack types.

Total Attack Times

Total number of times that the device suffered from the attack. This field is displayed when you view single-packet attack defense statistics.

Last Occurred At

Most recent time when the device suffered from the attack.

Attacked Interface/Security Zone

Interface or security zone attacked on the device.

Attacked IP

IP address of the attacker.

Details

Detailed information about the attack, including the attack number, attack type, source address, destination address, defense action, date, and time.

Record blacklist information.

On this page, you can perform the following operations:

·     Enable or disable network connection limit.

·     Add a network connection limit rule.

·     Delete network connection limit rules.

·     Edit a network connection limit rule.

·     Display network connection limit rule information.

To add a network connection limit rule:

7.     Click Add. In the dialog box that opens, configure the parameters as needed.

8.     Click Apply.

To delete network connection limit rules:

1.     Select one or multiple network connection limit rules, and click Delete.

2.     In the dialog box that opens, click OK.

To edit a network connection limit rule:

1.     Click the Edit icon in the Operation column for a network connection limit rule. In the dialog box that opens, edit the parameters as needed.

2.     Click Apply.

Enable Network Connection Limit/Disable Network Connection Limit

Specify whether to enable the network connection limit feature. If you enable this feature, the device will operate based on the configured network connection limit rule. By default, this feature is disabled.

Connection limit address range

Start and end IP addresses of an IP address range to which the rule applies.

Per-IP connection upper limit

Total maximum number of network connections sourced from each IP address.

Per-IP TCP connection upper limit

Total maximum number of TCP connections sourced from each IP address.

Per-IP UDP connection upper limit

Total maximum number of UDP connections sourced from each IP address.

Description

Description of the rule.

On this page, you can performs the following operations:

·     Enable or disable VLAN-based network connection limit.

·     Add a VLAN-based network connection limit rule.

·     Delete VLAN-based network connection limit rules.

·     Edit a VLAN-based network connection limit rule.

·     Display VLAN-based network connection limit rule information.

To add a VLAN-based network connection limit rule:

1.     Click Add. In the dialog box that opens, configure the parameters as needed.

2.     Click Apply.

To delete VLAN-based network connection limit rules:

1.     Select one or multiple VLAN-based network connection limit rules, and click Delete.

2.     In the dialog box that opens, click OK.

To edit a VLAN-based network connection limit rule:

1.     Click the Edit icon in the Operation column for a VLAN-based network connection limit rule. In the dialog box that opens, edit the parameters as needed.

2.     Click Apply.

Enable/Disable VLAN-based network connection limit

Specify whether to enable the VLAN-based network connection limit feature. If you enable this feature, the device will operate based on the configured VLAN-based network connection limit rule. By default, this feature is disabled.

VLAN interface

VLAN interface to which the rule applies.

Per-IP connection upper limit

Total maximum number of network connections sourced from the specified VLAN interface.

Per-IP TCP connection upper limit

Total maximum number of TCP connections sourced from the specified VLAN interface.

Per-IP UDP connection upper limit

Total maximum number of UDP connections sourced from the specified VLAN interface.

Description

Description of the rule.

To configure MAC filter settings:

1.     Select Whitelist or Blacklist in the Filter Mode column, and select Enable in the Status column.

2.     Click Apply.

Interface

Interface to which the MAC address filter policy applies.

Filter Mode

MAC address filter mode. Options are:

·     Whitelist: In whitelist filter mode, the device permits only the packets with the MAC addresses on the whitelist to access the external network.

·     Blacklist: In blacklist filter mode, the device denies only the packets with the blacklisted MAC addresses from accessing the external network.

Status

Whether to enable the MAC address filter feature.

·     If you enable this feature, the device will control Internet access for hosts based on the MAC addresses in the MAC address list.

·     If you disable this feature, all hosts in the LAN can access the Internet.

On this page, you can perform the following operations:

·     Display detailed information about MAC addresses added to the whitelist.

·     Add a MAC address to the whitelist.

·     Delete MAC addresses from the whitelist.

·     Edit a MAC address in the whitelist.

To add a MAC address to the whitelist:

1.     Click Add. In the dialog box that opens, enter the MAC address and description.

2.     Click Apply.

To delete MAC addresses from the whitelist:

1.     Select one or multiple MAC addresses.

2.     Click Delete. In the dialog box that opens, click Yes.

To edit a MAC address in the whitelist:

1.     Click the Edit icon in the Operation column for a MAC address. In the dialog box that opens, edit the parameters as needed.

2.     Click Apply.

No.

Sequence number of the MAC blacklist and whitelist management policy.

Filter Mode

Type of the MAC address filter policy. Options are:

·     Whitelist: With whitelist configured, the device permits only the packets with the MAC addresses on the whitelist to access the external network.

·     Blacklist: With blacklist configured, the device denies only the packets with the blacklisted MAC addresses from accessing the external network.

MAC Address

MAC address to which the policy applies. All-0 or all-F MAC addresses are not supported.

Description

Description of the policy.

Actions

Allow you to edit or delete an existing policy.

Turn on or off the dynamic ARP learning feature in the ARP Learning column for an interface.

Port

Interface, for example, Vlan-interface1.

Port Type

Type of the interface.

ARP Learning

Dynamic ARP learning enabling status. Options include:

·     Open—Dynamic ARP learning is enabled on the interface.

·     Close—Dynamic ARP learning is disabled on the interface.

As a best practice, disable dynamic ARP learning for an interface that has learned the ARP entries for all legitimate users. When DHCP allocates IP addresses, temporary dynamic ARP entries are generated and displayed on the Dynamic ARP Management page. The ARP Learning switch does not take effect on such entries.

On this page, you can perform the following operations:

·     Display dynamic ARP entries for the specified interface.

·     Delete dynamic ARP entries.

·     Scan IP addresses within the specified address range on an interface and automatically create dynamic ARP entries for them.

·     Convert dynamic ARP entries to static ones.

To delete dynamic ARP entries:

1.     Select the dynamic ARP entries to be deleted, and then click Delete.

2.     In the dialog box that opens, click Yes.

To scan IP addresses within the specified address range on an interface and automatically create dynamic ARP entries for them:

1.     Click Scan. In the SCAN ARP dialog box that opens, select an interface and specify an address range.

2.     Click Apply.

IP Address

IP address in the dynamic ARP entry.

MAC Address

MAC address in the dynamic ARP entry.

Type

Type of the dynamic ARP entry. The value is fixed at Dynamic, which indicates that the ARP entry is dynamically learned or generated during IP allocation through DHCP.

VLAN

VLAN to which the ARP entry belongs.

Interface

Interface to which the ARP entry belongs.

Actions

Edit configuration.