Panasonic Network Camera Management System Bbhgw700a Operating Instructions

							81 [For assistance, please call: 1-800-272-7033]Operating Instructions
Functions
MAC Clone
You can clone the MAC address of your PCs network adapter onto this product.
A MAC address is a 12-digit code assigned to a unique piece of hardware for identification. Some ISPs 
require that you register the MAC address of your PCs network adaptor, which was connected to your 
cable or DSL modem during installation.
To enable MAC address cloning, enter your adaptors MAC address in the New MAC address field, and 
click [Save].
To disable MAC address cloning and the keep the default setting, click [Cancel]. 
						

							Operating Instructions
82
3.2.5 Using IPv6 Options
This function allows you to perform detailed IPv6 settings on this product. Only modify these settings 
if essential. You may need specialist knowledge when performing these settings.
The options setup page allows you to set LAN (Home) settings and WAN (Internet) access settings. It 
is possible to set the following 3 headings: IPv6 Address(LAN)/RA, Link MTU size, and Routing.
When necessary, take the following steps to modify Options.
IPv6 Address(LAN) RA
IPv6 Address(LAN)
1.Click [IPv6 Options] on the setup page.
 See next page for details of each heading.
2.Select a setup heading at the top of the page.
3.Enter the modified data in the data entry field.
 To return to the original settings, click 
[Cancel].
4.When setup is complete, click [Save].
 The entered information is saved.
5.When [Restart] is displayed on the setup page, 
click it.
Note
When modifying IPv6 options, set the PC(s) connected to this product accordingly, then restart 
the PC(s).
IPv6 Address(LAN)Sets this products LAN IPv6 link local address. The default setting is 
fe80::254. 
						

							83 [For assistance, please call: 1-800-272-7033]Operating Instructions
Functions
RA(Router Advertisement)
Notes
 Please note that when Disable is selected, sometimes the IPv6 network of IPv4/IPv6 cameras (BB-
HCM311A etc.) cannot be set.
 The RA is disabled when the WAN side IPv6 global address is not assigned.
Link MTU size
This function allows you set the WAN side IPv6 link MTU size. Link MTU size is the maximum packet 
size that can be sent within the IPv6 network segment. 
The setup page is displayed by clicking Link MTU size.
Notes
 Data speed may be vastly reduced depending on the link MTU settings.
 Some set values may not be used depending on the connection type.
Routing
This function allows you to set dynamic routing and static routing.
The setup page is displayed by clicking Routing.
IPv6 Dynamic Routing
Note
Please note that this products LAN network information is made accessible to the WAN side when 
either Send & Receive or Receive only are selected.
RASets whether to Enable or Disable the sending of RA from this 
product to the LAN side. Usually, it is not necessary to change this 
setting. The default setting is Enable.
IPv6 connectionYou can set the IPv6 link MTU size to between 1280 and 1500 bytes. 
Do not change this setting unless necessary. The default setting is 
1500.
LANAllows you to set Send & Receive, Receive only, Send only, and 
Disable path information held by this product, for RIPng supporting 
devices on the LAN (Home) side. The default is set to Disable.
WA NWhen sending path information to the WAN (Internet) side, LAN side 
information can be seen from the outside. It is possible to select 
Send & Receive, Receive only, Send only, and Disable. The default 
is set to Disable. 
						

							Operating Instructions
84
IPv6 Static Routing
This product allows you to set 4 stable gateways, as well as automatically selecting dynamic routing. 
Therefore it is possible to build several networks working under this product, and set a flexible routing 
system.
Data Entry Field
1.Click Routing in Options.
2.Set Entry, Destination IPv6 Address, Gateway, 
I/F and Metric, in IPv6 Static Routing
.
3.Click [Save].
 The restart window indicating that setup is 
complete is displayed.
4.Click [Restart].
EntrySpecifying Enable in this heading enables the static routing setting 
set previously. Select Disable if you do not want to use static routing. 
Even if Disable is selected the entered settings will not be deleted.
Destination IPv6 
AddressEnter the IPv6 address and prefix to be routed.
GatewaySet the IPv6 address of the next router on the route after this 
product.
I/FSet the I/F where the gateway exists.
MetricSet the number of hops to be made to reach the Destination IPv6 
Address. Enter a number between 1 and 255. 
						

							85 [For assistance, please call: 1-800-272-7033]Operating Instructions
Functions
3.2.6 Using VPN (PPTP)
This product allows you to create a VPN (Virtual Private Network) using PPTP (Point-to-Point 
Tunneling Protocol). A VPN is private network that is as safe as an exclusive line and travels through 
the Internet. Using this function, camera images from PCs in far away places can be viewed safely.
See page 119 when performing these settings.
Note
When connecting a PPTP Client to the LAN side of this product, set this products PPTP Server to 
Disable.
Data Entry Field
1.Check Enable by PPTP Server.
2.Enter the User Name and Password and click 
[Save]
.
 The restart window indicating that the user 
name and password have been set is 
displayed.
3.Click [Restart].
 After the window that indicates that this 
product will restart, the top page is 
displayed.
PPTP Server
Select Enable or Disable.
Available Address 
RangeAn IP address is assigned from the PPTP server when connected. 
The maximum available address range is 4. It should not overlap the 
IP address used in DHCP (see page 
74). Factory default is set to 
192.168.0.100 - 192.168.0.103.
User Name/PasswordEnter a user name and password. 4 sets can be registered.
ISP
Internet
PPTP tunnel
PC 
(PPTP Client)PC 
(PPTP Client)This Product
(PPTP Server)
(e.g. BB-HCM311A) 
						

							Operating Instructions
86
Note
The PPTP client connecting to this products PPTP server only supports Windows XP or Windows 
2000 PPTP clients.
Options
This function allows you to set up an authentication method and encryption method.
Data Entry Field
1.Check MS-CHAP or MS-CHAPv2 are used; or 
Only MS-CHAPv2 is used, in Authentication 
Method Setup.
2.Check either None, MPPE 40 bit or MPPE 128 
bit are permitted; MPPE 40 bit or MPPE 128 bit 
are permitted; or MPPE 128 bit is permitted, in 
Encryption.
3.When setup is complete, click [Save].
4.When [Restart] is displayed on the setup page, 
click it
.
Authentication This function allows you to specify a password authentication 
method. When PPP connected, the MS-CHAP and MS-CHAPv2 use 
an encryption authentication method whereby the user name and 
password are encrypted and authenticated. The MS-CHAP 
authenticates encrypted data in one direction, from the client to this 
product only. Whereas the MS-CHAPv2 authenticates data traveling 
in both directions, so is even more secure than the MS-CHAP. Select 
MS-CHAP or MS-CHAPv2 are used; or Only MS-CHAPv2 is used. 
The default is set to MS-CHAP or MS-CHAPv2 are used.
Encryption This function allows you to specify an encryption method for the 
main body of the message. MPPE encrypts VPN connection data 
using PPTP. There are two encryption methods, which are MPPE 
128 bit (strong) and MPPE 40 bit (standard), and data security 
between this product and the PPTP connection is consolidated. 
Check either None, MPPE 40 bit or MPPE 128 bit are permitted; 
MPPE 40 bit or MPPE 128 bit are permitted; or MPPE 128 bit is 
permitted. The default is set to MPPE 40 bit or MPPE 128 bit are 
permitted. 
						

							87 [For assistance, please call: 1-800-272-7033]Operating Instructions
Functions
3.2.7 Using VPN (IPsec)
This function allows you to construct a VPN using IPsec when communicating using IPv6. A VPN is 
private network that is as safe as an exclusive line and travels through the Internet. You may need 
specialist knowledge when performing these settings.
Security Policy Database Registration
Up to 10 security policy database entries can be made.
Data Entry Field
1.Click Add under the Control heading.
 The Destination Information page is 
displayed.
2.Enter the necessary data and click [Add].
 After restart is performed, the top page will 
be displayed.
 Up to 10 databases can be registered.
3.Check Enable next to IPsec.
 Either the initiator or responder of this 
product will operate.
4.Click [Save].
5.Click [Restart].
Notes
 After adding a Security Policy Database, ensure that IPsec is set to Enable before saving.
 IPsec can only be used with IPv6.
Database Name Enter a name for the IPsec database.
PCPCThis Product This Product
IPsec Tunnel
PC PC
Internet 
						

							Operating Instructions
88
 An example of Destination IPv6 WAN address / Destination LAN network setup
IPsec Connection: Example 1
IPsec Connection: Example 2
In the example below, IPsec will not operate because the two networks are the same.
Notes
 The prefix length of the destination LAN network
When the destination is this product, set the prefix length as below.
 When viewing images from an IPv6 compatible camera (e.g. BB-HCM311A) via a destination 
router when connected using IPsec, set the cameras network (IPv6) to Enable for Access from the 
Internet. For more details see the cameras Operating Instructions.
EntrySelecting Enable, enables the entered IPsec settings. When you do 
not want to use IPsec select Disable. Even if Disable is selected the 
entered settings will not be deleted.
Pre-shared KeySets the pre-shared key. Enter between 8 and 64 alphanumeric 
characters. The secret shared key used in IPsec is created based on 
the pre-shared key, so do not let third parties know your pre-shared 
key. This is in order to maintain communication security.
Destination IPv6 WAN 
addressSets the other partys WAN IPv6 global address.
Destination LAN 
networkSet the other partys LAN network prefix and prefix length. Set a 
global prefix for the prefix. Also, make sure that this products LAN 
side network is a different network from the destinations LAN side 
network. Please note that a link local address cannot be set.
Options SetupSets detailed IPsec-related settings. (see page 89)
–Tunneling, Static v6 Connection:Set the prefix length set on LAN side prefix.
–6to4 Connection:Set the prefix length to 48.
Own LAN Network 1:
2001:1001:           ::/64Destination LAN Network 2:
2001:1002:           ::/64 Destination IPv6 WAN address
2001:1002::
Enter 2001:1002::           for the Destination IPv6 WAN address.
Enter 2001:1002:          ::, prefix length 64 for the Destination LAN network.
Own LAN Network 1:
2001:1001:           ::/64Destination LAN Network 2:
2001:1001:           ::/64
2001:1002:: 
						

							89 [For assistance, please call: 1-800-272-7033]Operating Instructions
Functions
IPsec Options Setup
It is possible to perform detailed IPsec connection settings. Usually they do not need to be modified. 
You may need specialist knowledge when performing these settings.
Basic
ID Set an ID indicating your identity. You can set an IPv6 Address or 
Domain Name. If a Domain Name is set, set the Conversion Mode to 
Aggressive.
Domain NameWhen your ID is a Domain Name, set it here.
Own LAN NetworkSelect All or Specify packet source IP addresses. When All is 
selected, the packets of all global addresses on the LAN side, are 
encapsulated using IPsec. When Specify is selected, the packets of 
specified global addresses on the LAN side, are encapsulated using 
IPsec.
LAN NetworkWhen Own LAN Network is set to Specify, set the source network 
address (prefix) of the packets to be encapsulated. 
						

							Operating Instructions
90
Phase 1 Setup
Phase 2 Setup
Notes
 When the conversion mode is set to Aggressive, both IPsec devices must have the same DH group 
set.
 When connecting an IPsec camera to the WAN side, the conversion mode must be set to Main.
Conversion ModeSet the IKE phase 1 conversion mode to Main or Aggressive. The 
key conversion procedure for Aggressive is simpler but security is 
slightly reduced.
Life TimeSet the IKE SA lifetime. The time must be set between 5 minutes and 
2400 hours.
Proposal EntrySet whether to Enable or Disable this proposal. Proposals that are 
disabled will not be proposed.
Proposal EncryptionSet the method of encryption used in phase 1. Select an encryption 
method from DES, 3DES, AES (128 bit), AES (192 bit), and AES 
(256 bit).
Proposal HashSet the authentication algorithm (hash). Select from MD5 and SHA-
1.
Proposal DH GroupSet the DH (Diffie-Hellman) group used in phase 1. Select between 1 
and 2. DH group 2 is has increased security compared to DH group 
1, but group 1 is not weak.
Life TimeSet the IPsec SA lifetime. The time must be set between 5 minutes 
and 2400 hours.
PFSSet whether to turn on PFS (Perfect Forward Security) in phase 2. 
Select from Enable DH Group 2, Enable DH Group 1, and Disable. 
When Enable Group 2 is selected, the Diffie-Hellman exchange is re-
performed in phase 2, and DH Group 2 creates a secret shared key. 
When Enable Group 1 is selected, the Diffie-Hellman exchange is re-
performed in phase 2, and DH Group 1 creates a secret shared key. 
When Disabled is selected, the secret shared key created in phase 1 
is used in phase 2. Security is increased when PFS is enabled rather 
than disabled.
Proposal EntrySet whether to Enable or Disable this proposal. Proposals that have 
Disable set will not be proposed.
Proposal EncryptionSet the method of encryption. Select from an encryption method 
from DES, 3DES, AES (128 bit), AES (192 bit), AES (256 bit) and 
NULL.
Proposal HashSet the authentication algorithm (hash). Select from MD5, SHA-1, 
and None (authentication algorithm not used).