User manual APPLE AIRPORT NETWORKS - FOR WINDOWS V4.2

AirPort Networks for Windows For Windows XP and Windows 2000 1 Contents Chapter 1 5 6 6 7 7 8 8 9 9 10 11 11 12 13 17 18 18 19 25 41 54 55 57 65 65 68 69 70 Getting Started How AirPort Works How Wireless Internet Access Is Provided Configuring AirPort Extreme Base Station and AirPort Express for Internet Access AirPort Setup Assistant AirPort Admin Utility Extending the Range of Your AirPort Network AirTunes Printing via an AirPort Extreme Base Station or AirPort Express Sharing Your Computer's Internet Connection AirPort Security Security for AirPort Networks at Home Security for AirPort Networks in Business and Education Wi-Fi Protected Access AirPort Network Designs Using the AirPort Setup Assistant Using AirPort Admin Utility Setting Up the AirPort Network Configuring and Sharing Internet Access Setting Advanced Options Solving Problems More Information About AirPort Using AirPort Express Behind the Scenes Basic Networking Using the AirPort Extreme Base Station Using AirPort Express Items That Can Cause Interference With AirPort Chapter 2 Chapter 3 Chapter 4 Chapter 5 3 1 Getting Started 1 With this version of the AirPort software you can set up and manage an AirPort network using Microsoft Windows, and wirelessly share a single Internet connection with multiple computers. Instead of using cables to create a network, AirPort uses wireless local area network (WLAN) technology to provide wireless communication between computers. Through a wireless network you can access the Internet, share files, play multiplayer games, and more. If you have an AirPort Express and use AirPort 4.0 or later, you can play iTunes music through remote speakers using AirTunes. Using AirPort technology, you can: · Create a wireless network in your home or school using an AirPort Extreme Base Station or AirPort Express, then connect to the Internet and share the connection among several computers simultaneously. An entire family, business, or classroom can be on the Internet at the same time. · Create a wireless connection between a single computer and a standard computer network. Wireless computers can then have access to an entire network without being connected using a cable. · Connect multiple computers in a wireless "ad-hoc" network so that you can share files or play network games. · Connect a USB printer to the base station and all of the computers on the AirPort network can print to it. · If you are using AirPort Express, connect it to your stereo or powered speakers and use AirTunes to play iTunes music. You can set up an AirPort Extreme Base Station or an AirPort Express and connect to the Internet without wires in minutes. But since the AirPort Base Stations are flexible powerful networking devices, you can also create an AirPort network that does much more. 5 If you want to design an AirPort network that provides Internet access to non-wireless computers via Ethernet, or take advantage of some of the base station's more advanced features, use this document to design and implement your network. Note: This version of AirPort Admin Utility is compatible with Windows XP (with Service Pack 2 or later) and Windows 2000. The instructions and screen images in this book are for Windows XP. If you are using Windows 2000, the images on your screen may look slightly different. How AirPort Works In a wired network, sharing files and information between computers requires the computers to be connected by cables. With AirPort, the data is transferred between computers using radio waves through a wireless network. You can create a wireless network using an AirPort Extreme Base Station or an AirPort Express, and all wireless communication goes through the base station to the Internet or to other computers on the network. You can also incorporate AirPort technology into an existing Ethernet network by connecting an AirPort Extreme Base Station or AirPort Express to the network. This allows non-AirPort computers to communicate with AirPort computers. If you are setting up an AirPort Extreme Base Station, you can connect Ethernet computers to the base station LAN port (G). The typical indoor range for an AirPort connection is up to 150 feet (45 meters). Range in a wireless network may vary with site conditions. How Wireless Internet Access Is Provided Wireless Internet access requires an 802.11b or 802.11g wireless adapter, an AirPort Extreme Base Station or AirPort Express, and an account with an Internet service provider (fees may apply). Some Internet service providers (ISPs) are not currently compatible with AirPort. Some cable modem and DSL providers may not be compatible with AirPort. Contact your service provider for more information. AirPort technology is similar to cordless telephone technology. The handset of the cordless phone makes a wireless connection to the base, which is connected to the telephone system. Likewise, with AirPort, your computer does not establish a wireless connection with your ISP directly. You set up a wireless connection from the computer to a base station that is connected to the Internet by a wire, such as a DSL or telephone line. 6 Chapter 1 Getting Started Use AirPort to provide wireless Internet access and share a single Internet connection among multiple computers in the following ways: · Connect the AirPort Extreme Base Station or AirPort Express to a DSL or cable modem. (If the AirPort Extreme Base Station has an internal modem, you can connect it to a telephone line.) The AirPort Extreme Base Station or AirPort Express receives content from the Internet, such as webpages and email, via its Internet connection and then sends it to wireless-equipped computers, using the wireless network. · Connect the AirPort Extreme Base Station or AirPort Express to an existing network that already has Internet access, such as in a school or small office. Wireless computers connect wirelessly to the base station and receive network and Internet content. Configuring AirPort Extreme Base Station and AirPort Express for Internet Access Like your computer, the AirPort Extreme Base Station or AirPort Express must be set up with the appropriate hardware and Internet Protocol (IP) networking information to connect to the Internet. To provide the Internet configuration information to your AirPort Extreme Base Station or AirPort Express, you can use the AirPort Setup Assistant. The AirPort Setup Assistant asks a series of questions to determine how the base station's Internet connection and other interfaces should be set up. To set up more complex configurations, you use AirPort Admin Utility. For more information about the AirPort Setup Assistant and AirPort Admin Utility, see the following sections. AirPort Setup Assistant Use the AirPort Setup Assistant to enter the settings your AirPort Extreme Base Station or AirPort Express needs to connect to the Internet. Enter the settings you received from your ISP for Ethernet, PPP over Ethernet (PPPoE), or the internal modem if your base station has one. You can also give your AirPort network a name and password. You can use the AirPort Setup Assistant to set up a base station as a wireless bridge and extend the range of your existing AirPort Extreme or AirPort Express network. If you are using an AirPort Express, you can create a new wireless network or join an existing wireless network. If you connect AirPort Express to your stereo or powered speakers, you can set up your AirPort Express to play iTunes music using AirTunes. See Chapter 4, "Using AirPort Express," on page 57 for more information. Chapter 1 Getting Started 7 To use the AirPort Setup Assistant, you need an AirPort Express or an AirPort Extreme Base Station, the AirPort Setup Assistant (on the CD that came with AirPort Express or the AirPort Extreme Base Station), Windows XP with SP2 or later or Windows 2000, and AirPort 4.0 or later. To play music using AirTunes, you need iTunes 4.6 or later. AirPort Admin Utility The AirPort Admin Utility is a convenient way to make quick adjustments to your base station configuration. Use AirPort Admin Utility to: · Set up an AirPort Extreme Base Station or AirPort Express to provide Internet access to computers that connect to the base station · Change settings, such as the phone number for your ISP if your base station has a modem, Internet setup or your ISP account settings · Configure advanced base station settings, such as channel frequency, security options, closed networks, DHCP lease time, access control, WAN privacy, power controls, port mapping, renaming a USB printer, or, if your base station has a modem, remote dial-in For instructions on using AirPort Admin Utility, see "Using the AirPort Setup Assistant" on page 18. Extending the Range of Your AirPort Network You can extend the range of your network by setting up wireless connections between multiple base stations in your network, known as a Wireless Distribution System (WDS), or connecting multiple AirPort Extreme Base Stations via Ethernet to create a roaming network. If your base station has an antenna port, you can also extend the range of your wireless network by connecting an Apple-certified external antenna to the antenna port. For more information on setting up a WDS or a roaming network, see "Connecting Additional Base Stations to Your AirPort Network" on page 42. Note: If you are using AirPort Express to extend the range of your AirPort Extreme or AirPort Express network, see Chapter 4, "Using AirPort Express," on page 57. Some models of the AirPort Extreme Base Station can receive power through the Ethernet WAN port when connected to 802.3af-compliant Power Sourcing Equipment (PSE) with a CAT 5 Ethernet cable. A PSE is a line-powered Ethernet device, like a switch or a hub, that supplies power to Powered Devices (PDs) over the Ethernet cable. Powering the base station using a PSE is known as Power over Ethernet (PoE). 8 Chapter 1 Getting Started If your base station can receive power over Ethernet, the base station and the mounting bracket conform to UL Standard 2043, "Fire Test for Heat and Visible Smoke Release for Discrete Products and Their Accessories Installed in Air-Handling Spaces," for placement in the air-handling space above suspended ceilings. Using Power over Ethernet allows you to install a base station in places away from a standard electrical outlet. For more information about using PoE, see the documentation that came with your base station. To use the base station in an air-handling space above suspended ceilings, you must connect the Ethernet WAN port to an 802.3af-compliant PSE with a plenum-rated Ethernet cable. You cannot use the AC power adapter to power a base station installed in an air-handling space. When the base station receives power over Ethernet, the USB port is disabled. Do not connect an external antenna to a base station mounted in an air-handling space unless the antenna conforms to UL Standard 2043. Some external antennas are not compliant. AirTunes If you are using AirPort Express, and you have connected it to your stereo or powered speakers, you can play iTunes music on the stereo using AirTunes. AirTunes is an encoding technology that allows for CD-quality transmission of iTunes music over the air. You can stream music from your iTunes library to AirPort Express, and AirPort Express plays the music on your stereo through cables connected to the analog and optical digital audio stereo mini-jack. The music is buffered to help ensure smooth playback without skips or jumps. Anything you play in iTunes--MP3 files, AAC files, audio books, even Dolby surroundsound--you can play using AirTunes. To use AirTunes, you need an AirPort Express connected to your stereo or powered speakers, AirPort 4.0 or later, and iTunes 4.6 or later. Printing via an AirPort Extreme Base Station or AirPort Express If you have a USB printer connected to the AirPort Extreme Base Station or AirPort Express, computers on the network can print to the printer by setting it up in Windows XP or Windows 2000. For detailed instructions on setting up a printer connected to the base station, see "Connecting a USB Printer to the AirPort Extreme Base Station or AirPort Express" on page 53. Note: If your AirPort Extreme Base Station supports PoE, and is receiving power from an 802.3af-compliant PSE, do not connect a printer to it. Chapter 1 Getting Started 9 Sharing Your Computer's Internet Connection If you have a wireless card installed in your computer and you are connected to the Internet, you can share your Internet connection with other computers. This is sometimes called using your computer as a software access point. You can share your Internet connection as long as your computer is connected to the Internet. If your computer goes to sleep or is restarted, or if you lose your Internet connection, you need to restart Internet sharing. To start Internet sharing: 1 Open Control Panel and double-click Network Connections. 2 Click the network connection you want to share and click Properties. 3 Click "Change settings of this connection" under Network Tasks. 4 Click Advanced and then select "Allow other network users to connect through this computer's Internet connection." Note: If your Internet connection and your local network use the same port (built-in Ethernet, for example), contact your ISP before you turn on Internet sharing. In some cases (if you use a cable modem, for example) you might unintentionally affect the network settings of other ISP customers, and your ISP might terminate your service to prevent you from disrupting its network. 10 Chapter 1 Getting Started 2 AirPort Security 2 This chapter provides an overview of the security features available with the AirPort Extreme Base Station and AirPort Express. Apple has designed the AirPort Extreme Base Station and AirPort Express to provide multiple levels of security, so you can enjoy peace of mind when you access the Internet, manage online financial transactions, or send and receive email. The AirPort Extreme Base Station also includes a slot for inserting a lock to deter theft. For information and instructions for setting up these security features, see "Setting Up the AirPort Network" on page 19. Security for AirPort Networks at Home Network attacks can occur through wireless as well as wired networks. Apple gives you ways to protect your entire AirPort network as well as the data that travels over it. Firewall You can separate your wireless network from the outside world with firewall protection. The AirPort Extreme Base Station and AirPort Express have a built-in firewall that creates a barrier between your network and the Internet, protecting data from Internetbased IP attacks. The firewall is automatically turned on when you set up the base station to share a single Internet connection. For computers with a cable or DSL modem, AirPort can actually be safer than a wired connection. Closed Network Creating a closed network helps keep the network name and the very existence of your network private. The network will not show up in a scan of available networks, so prospective users of your network must know the network name and password to access it. 11 Password Protection and Encryption AirPort uses password protection and encryption to deliver a level of security comparable to that of traditional wired networks. Users can be required to enter a password to log in to the AirPort network. When transmitting data and passwords, the base station uses up to 128-bit encryption, through either Wi-Fi Protected AccessTM (WPA), Wi-Fi Protected Access 2 (WPA2), or Wireless Equivalent Privacy (WEP), to scramble data and help keep it safe. Note: WPA security features are available only to AirPort Extreme Base Stations; AirPort Express; AirPort and AirPort Extreme clients using Mac OS X 10.3 or later and AirPort 3.3 or later; and wireless Windows XP and Windows 2000 clients using other 802.11 wireless adapters that support WPA. WPA2 security requires firmware version 5.6 or later for the AirPort Extreme Base Station and firmware version 6.2 or later for AirPort Express. To see if your Windows XP or Windows 2000 supports WPA2, check the documentation that came with the computer. Macintosh computers require an AirPort Extreme wireless card using AirPort 4.2 or later. If you're using AirPort in conjunction with an America Online account, you can use AOL parental controls to further restrict access. The settings you configure are used for all clients connected to the base station. Security for AirPort Networks in Business and Education Businesses, schools, colleges, universities, and private homes want to restrict network communications to authorized users and keep data safe from prying eyes, so AirPort hardware and software provide a robust suite of security mechanisms. Transmitter Power Control Because radio waves travel in all directions, they can extend outside the confines of a specific building. The Transmitter Power setting in AirPort Admin Utility lets you adjust the transmission range of your base station's network. Only users within the network vicinity have access to the network. MAC Filtering Every AirPort and wireless card has a unique MAC address. For AirPort and AirPort Extreme Cards, the MAC address is sometimes referred to as the AirPort ID. Support for MAC (Media Access Control) filtering lets administrators set up a list of MAC addresses and restrict access to the network to only those users whose MAC addresses are in the access control list. 12 Chapter 2 AirPort Security RADIUS Support The Remote Authentication Dial-In User Service (RADIUS) makes securing a large network easy. RADIUS is an access control protocol that allows a system administrator to create a central list of the computers that can access the network. Placing this list on a centralized server allows many base stations to access the list and makes it easy to update. If the MAC address of a user's computer or wireless card (which is unique to each 802.11 wireless card) is not on your approved MAC address list, the user cannot join your network. LEAP Support The Lightweight Extensible Authentication Protocol (LEAP) is a security protocol used by Cisco access points to dynamically assign a different WEP key to each user. AirPort Extreme is compatible with Cisco's LEAP security protocol, enabling users to join Ciscohosted wireless networks using LEAP. Wi-Fi Protected Access There has been increasing concern about the vulnerabilities of WEP. In response, the Wi-Fi Alliance, in conjunction with the IEEE, has developed enhanced, interoperable security standards called Wi-Fi Protected Access (WPA) and Wi-Fi Protected Access 2 (WPA2). WPA and WPA2 use specifications that bring together standards-based, interoperable security mechanisms that strongly increase the level of data protection and access control for wireless LANs. WPA and WPA2 provide wireless LAN users with a high level of assurance that their data remains protected and that only authorized network users can access the network. A wireless network that uses WPA or WPA2 requires that all computers that access the wireless network have WPA or WPA2 support. When used in Enterprise mode, WPA requires user authentication. The main standardsbased technologies that comprise WPA include Temporal Key Integrity Protocol (TKIP), 802.1X, Message Integrity Check (MIC), and Extensible Authentication Protocol (EAP). TKIP provides enhanced data encryptions, including the frequency with which keys are used to encrypt the wireless connection. 802.1X and EAP provide the ability to authenticate individual users on the wireless network. 802.1X is a port-based network access control method for wired as well as wireless networks. The IEEE adopted 802.1X as a standard in August 2001. Chapter 2 AirPort Security 13 The Message Integrity Check (MIC) is designed to prevent an attacker from capturing data packets, altering them, and resending them. The MIC provides a strong mathematical function in which the receiver and the transmitter each compute and then compare the MIC. If they do not match, the data is assumed to have been tampered with and the packet is dropped. If multiple MIC failures occur, the network may initiate counter-measures The EAP protocol Transport Layer Security, known as TLS, presents a user's credentials in the form of digital certificates. A user's digital certificates can comprise user names and passwords, smart cards, secure IDs, or any other identity credentials that the IT administrator is comfortable using. WPA uses a wide variety of standards-based EAP implementations, including EAP-Transport Layer Security (EAP-TLS), EAP-Tunnel Transport Layer Security (EAP-TTLS), and Protected Extensible Authentication Protocol (PEAP). In addition to TKIP, WPA2 supports the AES-CCMP encryption protocol. Based on the very secure AES national standard cipher, combined with sophisticated cryptographic techniques, AES-CCMP was specifically designed for wireless networks. Migrating from WEP to WPA2 requires new firmware for the AirPort Extreme Base Station (version 5.6 or later), and for AirPort Express (version 6.2 or later). Devices using WPA2 mode are not backward compatible with WEP. WPA and WPA2 have two modes: · Enterprise mode, which uses a separate server, such as a RADIUS server, for user authentication · Personal mode, which relies on the capabilities of TKIP or AES-CCMP without requiring an authentication server WPA and WPA2 Enterprise WPA is a subset of the draft IEEE 802.11i standard and effectively addresses the Wireless Local Area Network (WLAN) security requirements for the enterprise. WPA2 is a full implementation of the ratified IEEE 802.11i standard. In an enterprise with IT resources, WPA should be used in conjunction with an authentication server such as RADIUS to provide centralized access control and management. With this implementation in place, the need for add-on solutions such as Virtual Private Networks (VPN) may be eliminated, at least for securing wireless connections in a network. 14 Chapter 2 AirPort Security WPA and WPA2 Personal For home or small office/home office (SO/HO) networks, WPA and WPA2 runs in Personal mode, taking into account that the typical household or small office does not have an authentication server. Instead of authenticating with a RADIUS server, users manually enter a password (or Pre-Shared Key) to log in to the wireless network. When a user enters the password correctly, the base station starts the encryption process using TKIP or AES-CCMP. TKIP or AES-CCMP takes the original password and derive encryption keys mathematically from the network password. The encryption key is regularly changed and rotated so that the same encryption key is never used twice. This all happens behind the scenes. Other than entering the network password, the user isn't required to do anything to make WPA or WPA2 Personal work in the home. Chapter 2 AirPort Security 15 3 AirPort Network Designs 3 This chapter provides overview information and instructions for the types of AirPort networks you can set up using AirPort Admin Utility. Use this chapter to design and set up your AirPort Extreme or AirPort Express network. If you are using AirPort Express, you'll find additional information in Chapter 4, "Using AirPort Express," on page 57 to help set up your AirPort Express network. Configuring your base station to implement a network design involves three steps: Step 1: Setting Up the AirPort Network Computers communicate with the AirPort Extreme Base Station or AirPort Express over the AirPort wireless network. When you set up the AirPort network created by the base station, you can name the wireless network, assign a password needed to join the wireless network, and set other options. Step 2: Configuring and Sharing Internet Access When computers access the Internet via the AirPort network, the base station connects to the Internet and transmits information to the computers over the network. You provide the base station with settings appropriate for your ISP and configure how the base station shares this connection with other computers. Step 3: Setting Advanced Options You can set up the base station as a bridge between your AirPort network and an Ethernet network, set advanced security options, set up a Wireless Distribution System (WDS) to extend the AirPort wireless network, and fine-tune other AirPort settings. For specific instructions on all these steps, refer to the sections later in this chapter. 17 Using the AirPort Setup Assistant To set up and configure your computer or base station to use AirPort for wireless networking and Internet access, you can use the AirPort Setup Assistant. 1 Open the AirPort Setup Assistant, located in Start > All Programs > AirPort. 2 Follow the onscreen instructions and enter the settings from your ISP or network administrator for the type of network you want to set up. Using AirPort Admin Utility To modify the base station configuration, or adjust advanced settings, open the configuration with AirPort Admin Utility. Before opening the base station configuration, join the network created by the base station. m To join the wireless network created by the base station: Hold the pointer over the wireless connection icon in the Windows task bar until you see your AirPort network name (SSID), and choose it from the list if there are multiple networks available. If you can't join the AirPort network, right-click the wireless connection icon and choose View Available Wireless Networks. Select your network and click Connect. 18 Chapter 3 AirPort Network Designs The network name (or SSID) of a new AirPort Base Station is "Apple Network xxxxxx," where xxxxxx is the last six characters of the AirPort ID (also known as the MAC address), located on the label on the bottom of the AirPort Extreme Base Station, and on the power adapter side of AirPort Express. To open your base station's configuration: 1 Open AirPort Admin Utility, located in Start > All Programs > AirPort. 2 Select your base station in the Base Station Chooser, and click Configure. 3 Enter the base station password, if necessary. The default base station password is public. If you don't see your base station in the Base Station Chooser window: 1 Make sure that you have joined the AirPort network created by your base station. 2 Make sure your network and TCP/IP settings are configured properly: a Right-click the wireless connection icon that displays the AirPort network, and choose Status. b Click Properties, select Internet Protocol (TCP/IP), and then click Properties. c Make sure "Obtain an IP address automatically" is selected. If you can't open the base station's configuration: 1 Make sure your network and TCP/IP settings are configured properly. 2 Make sure you entered the base station password correctly. The default password is public. If you have forgotten the base station password, you can reset it to public by resetting the base station. To temporarily reset the base station password to public, use the straightened end of a paper clip to press and hold the reset button for one second. To reset the base station to the default settings, press and hold the reset button for five full seconds. If you are on an Ethernet network that has other base stations, or you are using Ethernet to connect to the base station: AirPort Admin Utility scans the Ethernet network to create the list of base stations in the Base Station Chooser. As a result, when you open AirPort Admin Utility, you may see base stations that you cannot configure. Setting Up the AirPort Network The first step in configuring your base station is setting up the AirPort network it will create. You can use the AirPort Setup Assistant to set up an AirPort network. Open the AirPort Setup Assistant, located in Start > All Programs > AirPort, and follow the onscreen instructions. To change settings, or set advanced options, use AirPort Admin Utility. Chapter 3 AirPort Network Designs 19 m To join the network for the base station you want to set up, use the instructions on the previous page. To join the wireless network you can also: 1 Open Control Panel from the Start menu and click Network Connections. 2 Right-click the Wireless Network Connection icon and choose View Available Networks. 3 Select the network of the base station you want to configure, and then click Connect. 4 Open AirPort Admin Utility and select the base station from the list. If you don't see the base station you want to configure, click Rescan to scan for available base stations, then select the base station. 5 If you are prompted for a password, enter it, then click Configure. When AirPort Admin Utility opens, it displays a summary of the base station's current settings. To enter or change settings, click the tabs to open the panes. 6 In the AirPort pane, enter a base station name and password, a name for your AirPort network, and other information. (See the following sections for descriptions of the fields in the AirPort pane.) Naming the Base Station Give the base station an easily identifiable name. This makes it easy for administrators to locate a specific base station on an Ethernet network with multiple base stations. The optional Contact and Location fields may also be helpful if you have more than one base station on your network. 20 Chapter 3 AirPort Network Designs Changing the Base Station Password The base station password protects the base station configuration so that only the administrator can modify it. The default password is public. It is a good idea to change the base station password to prevent unauthorized changes to the base station. Naming the AirPort Wireless Network Give your AirPort network a name. This name appears in the wireless connection icon on the wireless-equipped computers that are in range of your AirPort network. Password-Protecting Your Network To password-protect your network, you can choose from a number of wireless security options. In the AirPort pane of AirPort Admin Utility. Click Wireless Security and choose one of the following options: · Off Choosing this option turns off all password protection for the network. Any computer with a wireless adapter or card can join the network, unless the network is set up to use access control. See "Setting Up Access Control" on page 50. · 40-bit or 128-bit WEP Choose one of these options and enter a password to protect your network with a Wireless Equivalent Protection (WEP) password. Your AirPort Extreme Base Station and AirPort Express support 40-bit and 128-bit encryption. Choose "40-bit WEP" from the Encryption Type pop-up menu for maximum compatibility, or choose "128-bit WEP," which provides more WEP security. If you choose 128-bit encryption, only computers with 128-bit encryption-capable wireless networking cards will be able to join your network. If you choose 40-bit encryption, computers with 40-bit and 128-bit encryption-capable wireless networking cards will be able to join your wireless network, but they will join with only 40-bit encryption. Chapter 3 AirPort Network Designs 21 · WPA for home/small office Choose this option to protect your network with Wi-Fi Protected Access. You can use a password between 8 and 63 ASCII characters or a Pre-Shared Key of exactly 64 hexadecimal characters. Use the Encryption Type pop-up menu to determine which type of encryption your network will use. Choose WPA and WPA2 if computers using WPA and WPA2 will join the network. · WPA for Enterprise Choose this option if you are setting up a network that includes an authentication server, such as a RADIUS server, with individual user accounts. Enter the IP address and port number for the primary and secondary server, and enter a "shared secret," which is the password for the server. Use the Encryption Type pop-up menu to determine which type of encryption your network will use. Choose WPA and WPA2 if computers using WPA and WPA2 will join the network. For more information about and instructions for setting up WPA and WPA2 on your network, see "Using Wi-Fi Protected Access" on page 48. Joining a 128-Bit Encrypted Wireless Network If you want to join a wireless network that requires 128-bit encryption, you have two options for entering a password, depending on the password scheme the network administrator has set up. If you were given a password that is 13 characters, enter it exactly. Thirteen-character passwords are usually case-sensitive. Example: password12345 If you were given a password that is 26 characters, enter it exactly. Twenty-six-character passwords may be case-sensitive. Example: $12345678901234567890abcdef If you need additional information on your 128-bit password, contact your network administrator. Joining a WPA or WPA2 Personal Network If you want to join a wireless network that is protected by WPA or WPA2 Personal, you must enter either an ASCII password of 8 to 63 ASCII characters, or a hexadecimal password of exactly 64 hexadecimal characters (also known as a Pre-Shared Key). Check with your system administrator to find out which to use. 22 Chapter 3 AirPort Network Designs Joining a WPA or WPA2 Enterprise Network If you are joining a WPA or WPA2 Enterprise network, you were probably given a configuration file that contains network settings specific to the network you want to join. Double-click the configuration file to open it. If prompted, enter the user name and password you were given for the network, and if necessary, choose the network from the wireless connection icon. Some authentication protocols, such as TLS, require a digital certificate to authenticate the user before joining the network. Check with your network administrator for more information about digital certificates and joining a WPA or WPA2 Enterprise network. Changing the Channel The "channel" is the radio frequency over which your base station communicates. If you use only one base station (for example, at home), you probably won't need to change the channel frequency. If you set up multiple base stations in a school or office, use different channel frequencies for base stations that are within approximately 150 feet of each other. Adjacent base stations should have at least three channels between their channel frequencies. So if base station A is set to channel 1, base station B should be set to channel 4 or higher. Most wireless-equipped computers automatically tune to the channel frequency your base station is using when they join the network. If you change the channel frequency, client computers shouldn't need to make any changes. Creating a Closed Network The closed network option hides the name of the network created by the AirPort Extreme Base Station. Users must enter the exact network name and password to join the AirPort network. To create a closed network, select the "Create a closed network" checkbox in the AirPort pane of AirPort Admin Utility. Note: Using the closed network option can interfere with AirPort's automatic channel selection feature. To join a closed network, users of client computers must follow these steps: 1 Right-click the wireless connection icon, choose View Available Wireless Networks, and then click Advanced. 2 Enter the name and password of the network you want to join. Chapter 3 AirPort Network Designs 23 Choosing the Network Mode Choose 802.11b/g Compatible from the Mode pop-up menu if computers with either 802.11b wireless cards or 802.11g wireless cards will join the network. Each client computer will transmit at its highest available speed. Choose 802.11g Only if only computers with 802.11g wireless cards will join the network. The transmission rate of the network will be at 802.11g speed, up to 54 megabits per second. Computers with 802.11b wireless cards will not be able to join this network. Choose 802.11b Only if computers with 802.11b wireless cards will join the network. The transmission rate of the network will be at 802.11b speed, up to 11 megabits per second. Computers with 802.11g cards will be able to join this network, but will join at 802.11b speed. Setting Wireless Options You can set the multicast rate of the network, enable interference robustness, and adjust the transmitter power of the base station. These settings can reduce the range of the base station, and should not be modified without good reason. Setting the Multicast Rate Use the "Multicast rate" pop-up menu to set the multicast rate. Increase the rate to improve the performance of certain types of network activity, like video or audio streaming. The increase in performance may affect the range of the wireless network. Enabling Interference Robustness Select "Enable interference robustness" when the base station is in an environment with other 2.4 GHz devices that can interfere with your network. Devices that can cause interference include cordless telephones, some television repeaters, and microwave ovens. For more examples of devices that can cause interference, see "Items That Can Cause Interference With AirPort" on page 70. Adjusting Transmitter Power Use the Transmitter Power slider to reduce the power the base station uses and limit the range of the base station. This may be useful in areas where many base stations are in close proximity to each other. Client computers will need to be closer to the base station in order to join the network it creates. Choose a percentage setting from the Transmitter Power slider. The larger the percentage, the greater the network range. To set more advanced security options, see "Keeping Your Network Secure" on page 48. 24 Chapter 3 AirPort Network Designs Setting Base Station Options Click Base Station Options to adjust WAN Ethernet port settings. You can select to enable SNMP access, remote configuration or remote printer access. You can also turn off the Ethernet WAN port on an AirPort Extreme Base Station or the Ethernet port an AirPort Express. Click Logging/NTP to set up base station logging and the IP address of a syslog host computer. You can also choose the Network Time Protocol (NTP) server. The NTP server is necessary to ensure the base station date and time are set automatically, and the base station log messages are correct. Configuring and Sharing Internet Access The next step is setting up your base station's Internet connection and sharing its Internet access with client computers. The following sections tell you what to do, depending on how your base station connects to the Internet. You're Using a DSL or Cable Modem In most cases, you can set up this network design with the AirPort Setup Assistant. You only need to use AirPort Admin Utility to adjust optional advanced base station settings. What It Looks Like AirPort Extreme Base Station Cable/DSL modem To the Internet Chapter 3 AirPort Network Designs 25 How It Works · The AirPort Extreme Base Station connects to the Internet through its Ethernet WAN ( ) connection to your DSL or cable modem. The AirPort Express connects through its Ethernet port. · Wireless computers or computers connected to the AirPort Extreme Base Station's Ethernet LAN port (G) connect to the Internet through the base station. · Wireless computers and Ethernet computers communicate with one another through the base station. Important: Connect Ethernet computers that are not connected to the Internet to the AirPort Extreme Base Station LAN port (G) only. Since the base station can provide network services, you must set it up carefully to avoid interfering with other services on your Ethernet network. What You Need for a DSL or Cable Modem Connection Components Internet account with cable modem or DSL service provider AirPort Extreme Base Station or AirPort Express Optional Ethernet hub Check Comments Does your service provider use a You can get this information static IP or DHCP configuration? from your service provider. Place the base station near your DSL or cable modem. If you want to add more than one computer to your AirPort Extreme network using Ethernet, you need an Ethernet hub. Check What to Do If you are using the AirPort Setup Assistant to set up the AirPort Extreme Base Station or AirPort Express for Internet access: 1 Open the AirPort Setup Assistant, located in Start > All Programs > AirPort. 2 Follow the onscreen instructions and enter the settings for your service provider. To set up a base station using AirPort Admin Utility: 1 Make sure that your DSL or cable modem is connected to the Ethernet WAN port ( ) on your AirPort Extreme Base Station or to the Ethernet port on your AirPort Express. Important: If you are using a cable modem, turn the power off on the modem after connecting it to the base station, wait a few minutes, and then turn it back on. 2 Open AirPort Admin Utility, select your base station, and click Configure. 3 Click Internet. Choose Ethernet or "PPP over Ethernet (PPPoE)" from the "Connect using" pop-up menu, depending on which one your service provider requires. If your service provider gave you PPPoE connection software, such as EnterNet, choose PPPoE. 26 Chapter 3 AirPort Network Designs Note: If you connect to the Internet through a router using PPPoE and your base station is connected to the router via Ethernet, you do not need to use PPPoE on your base station. Choose Ethernet from the "Connect using" pop-up menu in the Internet pane, and deselect the "Distribute IP addresses" checkbox in the Network pane. Contact your service provider if you aren't sure which one to select. 4 If you chose Ethernet from the "Connect using" pop-up menu, choose Manually or Using DHCP from the Configure pop-up menu, depending on how your service provider provides IP addresses. If your provider gave you an IP address and other numbers with your subscription, use that information to configure the base station IP address manually. If you aren't sure, ask your service provider. If your service provider asks you for the MAC address of your base station, use the address of the Ethernet WAN port ( ), printed on the label on the bottom of the AirPort Extreme Base Station. If you are using AirPort Express, use the Ethernet port address, printed on the power adapter side of AirPort Express. If you configure TCP/IP manually, choose Manually from the Configure pop-up menu and enter your own IP address information in the fields below the Configure pop-up menu. Contact your service provider for the information you should enter in these fields. Chapter 3 AirPort Network Designs 27 If you configure TCP/IP using DHCP, choose Using DHCP from the Configure pop-up menu. Your IP addresses are delivered by your service provider's DHCP server. Your service provider may require you to enter information in these fields. 5 If you chose "PPP over Ethernet (PPPoE)" from the "Connect using" pop-up menu, enter the PPPoE settings your service provider gave you. Leave the Service Name field blank unless your service provider requires a service name. Contact your ISP for the information to enter in the "DNS servers" and "Domain name" fields. Contact your service provider for the information you should enter in these fields. 28 Chapter 3 AirPort Network Designs 6 Click the Network tab and configure how the base station will share its Internet access with wireless and Ethernet computers. · To share a single Internet connection with wireless computers, make sure "Distribute IP addresses" and "Share a single IP address (using DHCP & NAT)" are selected. If you have been given a range of public IP addresses by your ISP, you can select the "Share a range of IP addresses (using only DHCP)" option. · If you want to connect an Ethernet printer to the AirPort Extreme Base Station or use AppleTalk between wired and wireless computers, make sure the devices are connected to the Ethernet LAN port (G) on the AirPort Extreme Base Station. · Computers connected to the Ethernet LAN port (G) share Internet access and a single IP address (using NAT). · Enabling NAT lets you share a single Internet connection among several computers. Enabling DHCP lets the base station dynamically and automatically assign IP addresses to client computers, which simplifies each computer's TCP/IP configuration. By default, the base station allows devices and computers using Ethernet and wireless computers to communicate with one another using non-IP protocols. Note: If you are using an AirPort Extreme Base Station that supports Power over Ethernet (PoE), the "Share a single IP address (using DHCP & NAT)" option is not selected by default, and the base station is set up to act as a bridge. · If you want people joining your AirPort network to be greeted with a personal message, type it in the Message field. Chapter 3 AirPort Network Designs 29 · If your AirPort Extreme Base Station has an internal modem, click the Dial-In tab to enable users to dial in to the AirPort Extreme Base Station from a computer modem over a standard phone line. Dialing in to your base station gives you access to your home network and the Internet through your home network Internet service provider (ISP). To set up your base station for PPP dial-in: a Connect a phone line to the modem port (W) on your base station. b Click Dial-In and enter the user name and password, and set other options. Because you set the base station to answer incoming calls, consider using a dedicated phone line for your base station. Other calls coming in on the same line could cause the base station modem to disconnect. You cannot enable PPP dial-in if the base station is set up to use a PPP connection to your Internet service provider. With PPP dial-in enabled, the AirPort Extreme Base Station is set to share a single IP address (using DHCP and NAT) only; it cannot share a range of IP addresses (using only DHCP). Note: If you dial in to your AirPort Extreme Base Station from a V.90 modem, the best speed you can expect is the V.34 speed of 33600 bits per second (bps). This is a limitation of the V.90 standard and is not caused by a problem with your modem or base station. 7 If you want to adjust optional advanced settings, go to "Setting Advanced Options" on page 41. If you are finished changing settings, click the Update button. Your computer transfers the new settings to the base station. When the transfer is complete, the base station restarts and its new settings are active. Setting Up Client Computers Make sure you have installed the wireless adapter in your computer and the software necessary to set up the adapter. To configure TCP/IP on client computers: 1 Open Control Panel from the Start menu and double-click Network Connections. 2 Double-click Wireless Network Connection. 3 In the General pane, click Internet Protocol (TCP/IP), and then click Properties. 4 Do one of the following: 30 Chapter 3 AirPort Network Designs · If you selected the "Distribute IP addresses" checkbox, and either "Share a single IP address (using DHCP & NAT)" or "Share a range of IP addresses (using only DHCP)" in the Network pane of AirPort Admin Utility, select "Obtain an IP address automatically." · If you selected "Share a range of IP addresses (using only DHCP)" when you set up the base station's network, you can provide Internet access to client computers by setting the client IP addresses manually. Select "Use the following IP address." When you configure clients manually for a base station that provides NAT service, use IP addresses in the range 10.0.1.2 to 10.0.1.200, 172.16.1.2 to 172.16.1.200, or 192.168.1.2 to 192.168.1.200. Chapter 3 AirPort Network Designs 31 In the "Subnet mask" field, enter 255.255.255.0. In the "Default gateway" field, enter 10.0.1.1, 172.16.1.1, or 192.168.1.1, depending on which addressing scheme you used. Enter the same name server address and search domain information that you entered in the base station configuration. You're Using an Existing Ethernet Network You can use the AirPort Setup Assistant to set up the base station for Internet access through an existing Ethernet network. Use AirPort Admin Utility if you need to adjust optional advanced base station settings. What It Looks Like AirPort Extreme Base Station To the Internet via an Ethernet network Ethernet hub How It Works · The base station uses your Ethernet network to communicate with the Internet through the Ethernet WAN port ( ) on an AirPort Extreme Base Station, or through the Ethernet port on an AirPort Express. · AirPort and Ethernet clients access the Internet and the Ethernet network through the AirPort Extreme Base Station or AirPort Express. 32 Chapter 3 AirPort Network Designs What You Need for an Ethernet Connection Components AirPort Extreme Base Station or AirPort Express Ethernet hub If you want to add more than one computer to your AirPort Extreme network using Ethernet, you need an Ethernet hub. If you use an Ethernet hub, make sure you connect the cable from your Ethernet network to the hub's uplink port. Do not connect the AirPort Extreme Base Station to the uplink port. Check Comments Ethernet cables What to Do If you are using the AirPort Setup Assistant to set up a base station on an existing Ethernet network: 1 Open the AirPort Setup Assistant, located in Start > All Programs > AirPort. 2 Follow the onscreen instructions and enter the account information you were given by your service provider or network administrator. To set up your base station using AirPort Admin Utility: 1 Open AirPort Admin Utility. 2 Select your base station and click Configure. 3 Click Internet and choose Ethernet from the "Connect using" pop-up menu. 4 Choose Manually or Using DHCP from the Configure pop-up menu, depending on how IP addresses are provided on your Ethernet network. If you aren't sure, ask your service provider or network administrator. Chapter 3 AirPort Network Designs 33 If your addresses are provided manually, choose Manually from the Configure pop-up menu. Enter your IP address information in the fields below the Configure pop-up menu. Contact your network administrator for the information you should enter in these fields. If your IP address is provided by DHCP, choose Using DHCP from the Configure pop-up menu. 34 Chapter 3 AirPort Network Designs 5 Click the Network tab and select how the base station will share its Internet access with AirPort and Ethernet computers. · If you want to use the base station to share a single IP address, click the "Distribute IP addresses" checkbox and the "Share a single IP address (using DHCP & NAT)" button. · If you want to share a range of public IP addresses, click the "Share a range of IP addresses (using only DHCP)" button. · If you don't want the base station to provide IP addresses (using DHCP or NAT) to AirPort computers, see "Using the AirPort Extreme Base Station or AirPort Express as a Bridge" on page 41. Important: Since the base station can provide network services, you must set it up carefully to avoid interfering with other services on your Ethernet network. · If you want to use the parental controls you have set up with your America Online (AOL) account, click the Access Control tab and select the "Enable AOL Parental Control Filter (AOL only)" checkbox. This will copy the parental controls to your base station. For more information, contact AOL. · If your AirPort Extreme Base Station has an internal modem, click the Dial-In tab to enable users to dial in to the AirPort Extreme Base Station from a computer modem over a standard phone line. Dialing in to your base station gives you access to your home network and the Internet through your home network Internet service provider (ISP). To set up your base station for PPP dial-in: a Connect a phone line to the modem port (W) on your base station. b Click Dial-In and enter the user name and password, and set other options. Chapter 3 AirPort Network Designs 35 Because you set the base station to answer incoming calls, consider using a dedicated phone line for your base station. Other calls coming in on the same line could cause the AirPort Extreme Base Station modem to disconnect. With PPP dial-in enabled, the base station is set to share a single IP address (using DHCP and NAT) only; it cannot share a range of IP addresses (using only DHCP). Note: If you dial in to your base station from a V.90 modem, the best speed you can expect is the V.34 speed of 33600 bits per second (bps). This is a limitation of the V.90 standard and is not caused by a problem with your modem or base station. 6 If you want to adjust optional advanced settings, go to "Setting Advanced Options" on page 41. If you are finished changing settings, click the Update button. Your computer transfers the new settings to the base station. When the transfer is complete, the base station restarts and its new settings are active. Setting Up Client Computers To set up client computers to access the wireless network, see "Setting Up Client Computers" on page 30. You're Using a Dial-Up Internet Service Provider (ISP) If your AirPort Extreme Base Station came with an internal modem, you can set up its connection to the Internet with the AirPort Setup Assistant. You only need to use AirPort Admin Utility to adjust optional advanced base station settings, such as port mapping, advanced security options, or controlling access to your AirPort network. What It Looks Like AirPort Extreme Base Station Phone jack (to the Internet) 36 Chapter 3 AirPort Network Designs How It Works · The base station connects to your ISP and the Internet using its internal modem. · Computers using wireless adapters or computers connected to the base station's Ethernet LAN port (G) can connect to the Internet through the AirPort Extreme Base Station. · Wireless computers and Ethernet computers communicate with each other through the base station using networking protocols, such as TCP/IP. What You Need for a Dial-Up Connection Components Working dial-up ISP account using standard PPP Check Make sure you have the following: · ISP phone number · Account name and password · DNS address · Other information your ISP may provide Comments You can get this information (except the account password) from the Dial-up connection settings in Control Panel, or from your ISP. AirPort Extreme Base Station with an internal modem Optional Ethernet hub Place the base station near a phone jack and power outlet. If you want to add more than one computer to your AirPort Extreme network using Ethernet, you need an Ethernet hub. What to Do If you are using the AirPort Setup Assistant to configure the AirPort Extreme Base Station for Internet access: 1 Open the AirPort Setup Assistant, located in Start > All Programs > AirPort. 2 Follow the onscreen instructions and enter the phone number and other account information for your ISP. Chapter 3 AirPort Network Designs 37 To set up a base station using AirPort Admin Utility: 1 Open AirPort Admin Utility, located in Start > All Programs > AirPort. Select your base station and click Configure. 2 Click Internet and choose Modem (V.90) from the "Connect using" pop-up menu if you are connecting to an ISP. Enter the phone number and other account information. The "DNS servers" and "Domain name" information may be optional; check with your ISP. Contact your ISP for the information you should enter in these fields. If you have difficulty connecting, you can try to connect at a slower modem speed by choosing Modem (V.34) from the "Connect using" pop-up menu. 38 Chapter 3 AirPort Network Designs 3 Click Network and configure how the base station will share its Internet access with wireless and Ethernet computers. Select the "Distribute IP addresses" checkbox and the "Share a single IP address (using DHCP & NAT)" button. By default, wireless and Ethernet client computers share a single IP address using Network Address Translation (NAT). When Modem is selected in the "Connect using" pop-up menu in the Internet pane, both the Ethernet LAN port (G) and the Ethernet WAN port ( ) are bridged, and both can share a single IP address using NAT. Note: If you are using an AirPort Extreme Base Station that supports Power over Ethernet (PoE), the "Share a single IP address (using DHCP & NAT)" option is not selected by default, and the base station is set up to act as a bridge. Important: If you are connecting to the Internet by Ethernet or PPPoE, only the Ethernet LAN port (G) is bridged. Enabling NAT lets you share a single Internet connection among several computers. Enabling DHCP lets the base station dynamically and automatically assign IP addresses to client computers, which simplifies each computer's TCP/IP configuration. Bridging allows devices and computers using Ethernet and computers using a wireless connection to communicate with one another. 4 If you want to adjust optional advanced settings, go to "Setting Advanced Options" on page 41. If you are finished changing settings, click the Update button. Your computer transfers the new settings to the base station. When the transfer is complete, the base station restarts and its new settings are active. Chapter 3 AirPort Network Designs 39 Setting Up Client Computers To set up client computers to connect to the wireless network, see "Setting Up Client Computers" on page 30. You're Using Base Stations Powered Over Ethernet on an Existing Network If your AirPort Extreme Base Station supports it, you can connect multiple base stations to 802.3af-compliant Power Sourcing Equipment (PSE), and deliver both power and the network and Internet connection over the same cable. See the documentation that came with your base station to make sure the base station supports Power over Ethernet (PoE). If your base station supports PoE, the base station and the mounting bracket conform to UL Standard 2043 for placement in the air-handling space above suspended ceilings. Using PoE allows you to install a base station in places away from a standard electrical outlet. To use the base station in an air-handling space above suspended ceilings, you must connect the Ethernet WAN port to an 802.3af-compliant PSE with a plenum-rated Ethernet cable. You cannot use the AC power adapter to power a base station installed in an air-handling space. Do not connect an external antenna to a base station mounted in an air-handling space. What It Looks Like AirPort Extreme Base Stations AC power outlet To Network 802.3af-compliant Power Sourcing Equipment (PSE) Plenum-rated Ethernet cables 40 Chapter 3 AirPort Network Designs How It Works · The AirPort Extreme Base Station uses your Ethernet network to communicate with the Internet and receives power through the Ethernet WAN port ( ). · AirPort clients access the Internet and the Ethernet network through the AirPort Extreme Base Station. Note: An AirPort Extreme Base Station that supports PoE is set up by default to act as a bridge, and the "Share a single IP address (using DHCP & NAT)" option is not selected. Use the Network pane of AirPort Admin Utility if you want to select the "Share a single IP address (using DHCP & NAT)" option. What You Need for a Power Over Ethernet (PoE) Connection Components AirPort Extreme Base Station or multiple base stations that support PoE 802.3af-compliant Power Sourcing Equipment (PSE) Plenum-rated Ethernet cables If you are mounting the base station in the air-handling space above a suspended ceiling, you need to use plenum-rated Ethernet cables. Check Comments What to Do Follow the instructions in the previous section, "You're Using an Existing Ethernet Network" on page 32, to set up the AirPort network. Setting Advanced Options Use AirPort Admin Utility to adjust optional advanced base station settings. Using the AirPort Extreme Base Station or AirPort Express as a Bridge You can turn off the base station's Internet sharing features (which provide IP addresses to AirPort computers using DHCP or NAT) to allow bridging between the network's wireless and wired computers. With bridging turned on, AirPort computers have access to all services on the Ethernet network, and the base station does not provide Internet sharing services. Using the base station as a bridge can be a way to address incompatibilities between the base station's Internet sharing features and your ISP's connection method. To use the base station as a bridge, all AirPort and Ethernet computers need to have IP addresses set manually and use the same subnet mask. Chapter 3 AirPort Network Designs 41 To set up the base station as a bridge: 1 Open AirPort Admin Utility and open your base station's configuration. 2 Click Network. 3 Deselect the "Distribute IP addresses" checkbox. Connecting Additional Base Stations to Your AirPort Network You can connect additional AirPort Extreme or AirPort Express Base Stations to extend the range of your wireless network. You can connect the base stations wirelessly or, if you are using AirPort Extreme Base Stations, using Ethernet. A network with base stations connected using Ethernet is known as a roaming network. Connecting base stations wirelessly creates what is known as a Wireless Distribution System (WDS). Setting Up Roaming Multiple AirPort Extreme Base Stations can be set up to create a single wireless network. Client computers can move from base station to base station with no interruption in service (a process known as roaming). To set up roaming: 1 Connect all of the AirPort Extreme Base Stations to the same subnet on your Ethernet network. 2 Give each base station a unique name. 3 Give each base station the same network name and password. 4 Set up the base stations as bridges, following the instructions in the previous section. If you want one AirPort Extreme Base Station to assign IP addresses using DHCP, also do the following: 1 Set up one base station to act as the DHCP server. 2 Set up the other base stations as bridges, following the instructions in the previous section. 42 Chapter 3 AirPort Network Designs The base station acting as a DHCP server can receive its IP address from the DHCP server on the Ethernet network. DHCP server AirPort network AirPort network AirPort network Ethernet LAN To the Internet Setting Up a Wireless Distribution System (WDS) When you connect base stations wirelessly in a WDS, you set up each base station as either a main base station, a remote base station, or a relay base station. Note: If you are setting up AirPort Express to extend the range of your network using WDS, use the AirPort Setup Assistant that came with your AirPort Express. See "Extending the Range of an Existing AirPort Extreme or AirPort Express Network" on page 61. Relay base station Remote base station Remote base station Main base station connected to the Internet To the Internet Remote base station Chapter 3 AirPort Network Designs 43 A main base station is connected to the Internet and shares its connection with remote and relay base stations. A remote base station shares the main base station's Internet connection. A relay base station shares the main base station's Internet connection and transfers the connection to other remote or relay base stations. All three base station configurations (main, remote, and relay) can also share the main base station's Internet connection with client computers wirelessly, or with Ethernet if the client computers are connected to the base station or Ethernet. When you set up base stations in a WDS, you need to know the AirPort ID of each base station. The AirPort ID is also known as the MAC address and is printed on the label on the bottom of the base station next to the AirPort ( ) symbol. To make it easier to set up a WDS, place all of the base stations on a table and plug them in to a power supply. As part of the WDS setup process, you might consider giving all the base stations unique names, to make them easier to identify in the future. To set up the main base station to share its Internet connection with other base stations: 1 Connect to the wireless network created by the base station you want to set up as the main base station. 2 Open AirPort Admin Utility, select the main base station, and click Configure. Enter the base station password. 3 Click WDS. 4 Select the "Enable this base station as a WDS" checkbox, and choose "main base station" from the pop-up menu. 5 Click Add and enter the MAC address of a base station you want to set up as a remote base station. You can also enter a description for the base station, the base station name, or its location. 44 Chapter 3 AirPort Network Designs Select a base station and click Remove to remove the base station from the list. 6 Select "Allow wireless clients on this base station" if you would like wireless client computers as well as base stations to share the connection. If you don't select the "Allow wireless clients on this base station" checkbox, and later want to change the settings on the base station, you must connect to the base station's LAN port with an Ethernet cable. You will not be able to connect to the base station wirelessly. 7 Click Update to send the new settings to the base stations in the WDS. After you click Update, you can give each base station a name and password, and choose how the base station receives IP addresses. To set up an additional remote base station to connect to the main base station: If you want to add additional remote or relay base stations to the WDS after setting up the main and remote base stations, use the AirPort Admin Utility again. Remote base stations need to be on the same channel as the main base station. Before setting up additional remote base stations, find the channel of the main base station in the AirPort pane of AirPort Admin Utility. 1 Right-click the wireless connection icon and choose View Available Wireless Networks. Choose the wireless network created by the base station you want to set up as a remote base station. 2 Open AirPort Admin Utility, select the remote base station, and click Configure. Enter the base station password, if necessary. 3 Enter the same network password as the main base station, if necessary. Chapter 3 AirPort Network Designs 45 4 Click AirPort and choose the same channel as the main base station from the Channel pop-up menu. 5 Click WDS and select the "Enable this base station as a WDS" checkbox, and choose "remote base station" from the pop-up menu. 6 Enter the MAC address of the main base station in the Main AirPort ID field. The MAC address is also referred to as the AirPort ID and is printed on the label on the bottom of the base station, next to the AirPort ( ) symbol. Select "Allow wireless clients on this base station" if you would like wireless client computers as well as base stations to share the connection. If you don't select the "Allow wireless clients on this base station" checkbox, and later want to change the settings on the base station, you must connect to the base station's LAN port with an Ethernet cable. You will not be able to connect to the base station wirelessly. 7 Click Update to transfer the settings to the base station. Important: You need to repeat these steps for each remote base station you include in the WDS. To set up a relay base station to connect to the main base station and share its connection with additional remote base stations: If you want to set up a relay base station in the WDS to share its connection with other remote base stations and wireless clients, use AirPort Admin Utility again. When you set up a relay base station, you also need to set up at least one additional remote base station to share the relay's connection. To set up a relay base station, first set up the base station as a remote base station by following the instructions on page 45. 46 Chapter 3 AirPort Network Designs Relay and remote base stations need to be on the same channel as the main base station. Before setting up a relay or remote base station, find the channel of the main base station in the AirPort pane of AirPort Admin Utility. 1 Right-click the wireless connection icon and choose View Available Wireless Networks. Choose the wireless network created by the base station you want to set up as a relay base station. 2 Open AirPort Admin Utility, select the relay base station, and click Configure. If the base station is using the default password of public, you will not be prompted for a password. 3 Enter the same network password as the main base station, if necessary. 4 Click WDS and select the "Enable this base station as a WDS" checkbox, and choose "relay base station" from the pop-up menu. 5 Enter the MAC address of the main base station in the Main AirPort ID field. The MAC address is also referred to as the AirPort ID and is printed on the label on the bottom of the base station, next to the AirPort ( ) symbol. 6 Click Add and enter the MAC address of each base station you want to set up as a remote base station for this relay base station. You need to set up at least one additional remote base station to share the relay's connection. Select a base station and click Remove to remove the base station from the list. 7 Click Update to transfer the new WDS settings to the relay and remote base stations. Important: You need to repeat these steps for each remote base station you include in the WDS. Chapter 3 AirPort Network Designs 47 Extending the Range of Your AirPort Network In addition to adding additional base stations to your network, you can attach an Apple-certified external antenna to some models of base stations to extend your network's range. You can attach an omnidirectional antenna to broaden the range of the network in all directions, or you can add a unidirectional antenna to extend the network further in one direction. External antennas are available from your Apple-authorized dealer, Apple retail stores, or the Apple Store at www.apple.com/store. Note: After attaching an external antenna, you must unplug the base station's power adapter and then plug it back in. Controlling the Range of Your AirPort Network You can also shorten the range of your AirPort network. This might be useful if you want to control access to the network by restricting the range to a single room, for example. To shorten the range of your AirPort network: 1 Open AirPort Admin Utility. 2 Select your base station and click Configure. 3 Click AirPort. 4 Adjust the Transmitter Power slider. The lower the power, the shorter the range. Keeping Your Network Secure Your network is protected by the password you assign to it. However, you can take additional steps to help keep your network secure. Networks managed by Simple Network Management Protocol (SNMP) may be vulnerable to denial-of-service attacks. SNMP is a network management protocol that can be turned on and off in AirPort Admin Utility. Similarly, if you configure your base station over the WAN port, it may be possible for unauthorized users to change network settings. When remote configuration is enabled, the base station name and IP address are published over the WAN port. Turning off remote configuration may provide additional security. To help protect your network and base station: 1 Open AirPort Admin Utility, select your base station, and click Configure. 2 Click AirPort, and then click Base Station Options. 3 Deselect "Enable WAN Port Configuration" and "Enable SNMP." Using Wi-Fi Protected Access AirPort 4.2 or later supports WPA and WPA2 security standards for wireless networks. 48 Chapter 3 AirPort Network Designs Note: WPA2 requires firmware version 6.2 for AirPort Express and firmware version 5.6 for the AirPort Extreme Base Station. To see if your Windows XP or Windows 2000 computer supports WPA2, check the documentation that came with your computer. AirPort 4.2 and later supports two modes of WPA and WPA2: Enterprise mode, which uses an authentication server for user authentication, and Personal mode, which relies on the capabilities of TKIP for WPA and AES-CCMP for WPA2, without requiring an authentication server. Enterprise mode is designed for a larger network in which an IT professional is most likely setting up and managing the network. Setting up a WPA or WPA2 Enterprise network requires setting up an authentication server, such as a RADIUS server, to manage and validate network users' credentials, such as user names, passwords, and user certificates. See the documentation that came with the server to set it up. Personal mode is for the home or small office network and can be set up and managed by most users. Personal mode does not require a separate authentication server. Users of the network usually need only enter a user name and password to join the network. Note: If you change an existing WDS network from WEP to WPA, you will need to reset all base stations and set up your WDS again. For information about resetting a base station, see the documentation that came with your AirPort Express or AirPort Extreme base station. To set up a WPA or WPA2 Personal network: 1 Open AirPort Admin Utility, select your base station, and click Configure. 2 Click AirPort, and then click Wireless Security. 3 Choose "WPA for home/small office" from the Network Security Level pop-up menu. 4 Choose which type of encryption your network will use from the Encryption Type popup menu. Choose "WPA and WPA2" if you want to allow computers with either WPA or WPA2 compatible wireless cards to access your network. If you choose WPA2 Only, only computers with WPA2 compatible wireless cards can join the network. 5 Click Set Pre-Shared Key if you have not yet set up your network with a Pre-Shared Key, or click Change Pre-Shared Key if you are changing one you have already set up. 6 Choose Plain Text from the Format pop-up menu and enter an 8 to 63 ASCII character Pre-Shared Key, or choose Hex from the Format pop-up menu and enter a 64 hexadecimal character Pre-Shared Key. To set up a WPA or WPA2 Enterprise network: 1 Open AirPort Admin Utility, select your base station, and click Configure. Chapter 3 AirPort Network Designs 49 2 Click AirPort, and then click Network Security. 3 Choose "WPA for enterprise" from the Network Security Level pop-up menu. 4 Choose which type of encryption your network will use from the Encryption Type popup menu. 5 Enter the IP address, port, and shared secret (or password) of the primary and the optional secondary RADIUS authentication servers. Setting Up Access Control Access control lets you specify which computers can send or receive information through the base station to the wired network. Each wireless computer has a unique ID (also known as the MAC address). You can restrict access by creating an access control list that includes only the MAC addresses for computers you want to access your wired network. To find the MAC address of your computer's wireless card, open Control Panel from the Start menu and right-click Wireless Network Connection. Click Configure and then click About. To set up the access control list: 1 Open AirPort Admin Utility, select your base station, and click Configure. 2 Click Access Control. 3 Click Add and enter the MAC address and an optional description for the computers that will access the network. Select a MAC address and click Remove to remove it from the list. Important: Access control prevents computers that aren't on the access control list from accessing the wired network connected to the base station. It does not prevent computers from joining the AirPort wireless network. For information on how to prevent unauthorized computers from joining the AirPort network, see "Setting Up the AirPort Network" on page 19. Access control is not compatible with WPA Enterprise mode. You can use either access control or WPA Enterprise in a network, but you can't use both. Using a RADIUS Server Using a RADIUS (Remote Authentication Dial-In User Service) server on your network lets you authenticate MAC addresses on a separate computer, so that each base station on the network doesn't need to store the MAC addresses of computers that have access to the network. Instead, all the addresses are stored on a server that is accessed through a specific IP address. To set up authentication using a RADIUS server: 1 On the server, enter the MAC addresses of the computers that will access the network. See the documentation that came with the RADIUS server to set it up properly. 50 Chapter 3 AirPort Network Designs