Toshiba Ikwb16aw Manual

							51
IEEE 802.1x Advanced Mode
This function is not able to work at the time of WLAN connection of IK-W\
B16A-W.
Enable  this  function  if  your  network  environment  uses  IEEE  802.1x,  which  is  a  port-based  network 
access  control.  The  network  devices,  intermediary  switch/access  point/hub,  and  RADIUS  server  must 
support and enable 802.1x settings.
The  802.1x  standard  is  designed  to  enhance  the  security  of  local  area  networks,  which  provides 
authentication to network devices (clients) attached to a network port (wired or wireless). If all certificates 
between client and server are verified, a point-to-point connection will be enabled; if authentication fails, 
access  on  that  port  will  be  prohibited.  802.1x  utilizes  an  existing  protocol,  the  Extensible Authentication 
Protocol (EAP), to facilitate communication.
■ The components of a protected network with 802.1x authentication:
1. Supplicant: A client end user (camera), which requests authentication. 
2. Authenticator  (an  access  point  or  a  switch): A  “go  between”  which  restricts  unauthorized  end  users 
from communicating with the authentication server. 
3. Authentication server (usually a RADIUS server): Checks the client certificate and decides whether to 
accept the end user’s access request.
■ The  Network  Camera  support  two  types  of  EAP  methods  to  perform  authentication:  EAP-PEAP  and 
EAP-TLS. 
Please follow the steps below to enable 802.1x settings:
1.  Before  connecting  the  Network  Camera  to  the  protected  network  with  802.1x,  please  apply  a  digital  certificate from a Certificate Authority (ie. MIS of your company) which can be validated by a RADIUS 
server.
2.  Connect  the  Network  Camera  to  a  PC  or  notebook  outside  of  the  protected  LAN.  Open  the  configuration  page  of  the  Network  Camera  as  shown  below.  Select  EAP-PEAP  or EAP-TLS  as  the 
EAP  method.  In  the  following  blanks,  enter  your  ID  and  password  issued  by  the  CA,  then  upload 
related certificate(s).
Supplicant
(IK-WB16A) Authenticator
(Network Switch) Authentication Server
(RADIUS Server)                    
						

							52
3. When all settings are complete, move the Network Camera to the protected LAN by connecting it to an 802.1x enabled switch. The devices will then start the authentication automatically.
● The authentication process for 802.1x:
1. The  Certificate Authority  (CA)  provides  the  required  signed  certificates  to  the  Network  Camera  (the 
supplicant) and the RADIUS Server  (the authentication server).
2. A  Network  Camera   requests  access  to the  protected  LAN  using  802.1X   via a  switch   (the  authenticator).    The  client  offers  its  identity  and  client  certificate,  which  is  then  forwarded  by  the switch   to  the  RADIUS  Server,  which  uses  an  algorithm  to  authenticate  the Network  Camera   and  returns an acceptance or rejection back to the switch. 
3. The switch also forwards the RADIUS Server’s certificate to the Network Camera. 4. Assuming  all  certificates  are  validated,   the switch   then  changes  the  Network  Camera’s  state  to 
authorized and  is allowed access to the protected network via a pre-configured port.
TOSHIBA 
IK-WB16A RADIUS Server
Certificate Authority
(CA)
Protected LAN
Certificate
11
2
3
4
Network Switch
Certificate
NOTE                    
						

							53
QoS (Quality of Service) Advanced Mode
Quality of Service refers to a resource reservation control mechanism, w\
hich guarantees a certain quality 
to  different  services  on  the  network.  Quality  of  service  guarantees  are  important  if  the  network  capacity 
is  insufficient,  especially  for  real-time  streaming  multimedia  applications.  Quality  can  be  defined  as,  for 
instance, a maintained level of bit rate, low latency, no packet dropping, etc.
The following are the main benefits of a QoS-aware network:
■ The ability to prioritize traffic and guarantee a certain level of performance to the data flow. 
■ The  ability  to  control  the  amount  of  bandwidth  each  application  may  use,  and  thus  provide  higher 
reliability and stability on the network.
Requirements for QoS
To utilize QoS in a network environment, the following requirements must \
be met:
■ All network switches and routers in the network must include support for\
 QoS. 
■ The network video devices used in the network must be QoS-enabled.
QoS models
CoS (the VLAN 802.1p model)
IEEE802.1p  defines  a  QoS  model  at  OSI  Layer  2  (Data  Link  Layer),  which  is  called  CoS,  Class  of 
Service.  It  adds  a  3-bit  value  to  the  VLAN  MAC  header,  which  indicates  prioritization  from  0~7  (Eight 
different classes of service are available). The priority is set up on the network switches, which then use 
different queuing disciplines to forward the packets.
Below is the setting column for CoS. Enter the  VLAN ID of your switch (0~4095) and choose the priority 
for each application (0~7).
If you assign Video the highest level, the switch will handle video packets first.
● The VLAN Switch (802.1p) is required.  The web browsing may fail if the CoS setting is incorrect.
●  Class  of  Service  technologies  do  not  guarantee  a  level  of  service  in  terms  of  bandwidth  and  delivery 
time; they offer a "best-effort." Users can think of CoS as "coarsely-grained" traffic control and QoS as "finely-grained" traffic control.
● Though CoS is simple to manage, it lacks scalability and does not offer end-to-end guarantees since it 
is based on L2 protocol.
NO TE 
						

							54
QoS/DSCP (the DiffServ model)
DSCP-ECN  defines  QoS  at  Layer  3  (Network  Layer).  The  Differentiated  Services  (DiffServ)  model  is 
based  on  packet  marking  and  router  queuing  disciplines.  The  marking  is  done  by  adding  a  field  to  the 
IP  header,  called  the  DSCP  (Differentiated  Services  Codepoint).  This  is  a  6-bit  field  that  provides  64 
different class IDs. It gives an indication of how a given packet is to be forwarded, known as the Per Hop 
Behavior  (PHB).  The  PHB  describes  a  particular  service  level  in  terms  of  bandwidth,  queueing  theory, 
and dropping (discarding the packet) decisions. Routers at each network node classify packets according 
to their DSCP value and give them a particular forwarding treatment; for example, how much bandwidth 
to reserve for it.
Below are the setting options of DSCP (DiffServ Codepoint). Specify the DSCP value for each application 
(0~63).
HTTP Advanced Mode
To  utilize  HTTP  authentication,  make  sure  that  your  have  set  a  password  for  the  Network  Camera  first; 
please refer to Security on page 38 for details.
Authentication:  Depending  on  your  network  security  requirements,  the  Network  Camera  provides  two 
types of security settings for an HTTP transaction: basic and digest. 
If basic  authentication  is  selected,  the  password  is  sent  in  plain  text  format  and  there  can  be  potential 
risks of being intercepted. If  digest authentication is selected, user credentials are encrypted using MD5 
algorithm and thus provide better protection against unauthorized access\
es. 
						

							55
HTTP port / Secondary HTTP port: By default, the HTTP port is set to 80 and the secondary HTTP port is 
set to 8080. They can also be assigned to another port number between 1025 and 65535.\
 If the ports are 
incorrectly assigned, the following warning messages will be displayed:
To access the Network Camera on the LAN, both the HTTP port and secondary HTTP port can be used 
to access the Network Camera. For example, when the HTTP port is set to 80 and the secondary HTTP 
port is set to 8080, refer to the list below for the Network Camera’s IP address.
Access  name  for  stream  1  ~  5:  This  Network  camera  supports  multiple  streams  simultaneously.  The 
access name is used to differentiate the streaming source. Users can click  Configuration > Audio and 
Video > Video Settings  to set up the video quality of linked streams. 
HTTPS
By  default,  the  HTTPS  port  is  set  to  443.  It can  also  be  assigned  to  another  port  number  between  1025 
and 65535.
Two way audio
By  default,  the  two  way  audio  port  is  set  to  5060. Also,  it  can  also  be  assigned  to  another  port  number 
between 1025 and 65535.
The Network Camera supports two way audio communication so that operators can transmit and receive 
audio  simultaneously.  By  using  the  Network  Camera’s  built-in  or  external  microphone  and  an  external 
speaker, you can communicate with people around the Network Camera.
In LAN
http://192.168.4.160  or  
http://192.168.4.160:8080 
						

							56
Note  that  as  JPEG  only  transmits  a  series  of  JPEG  images  to  the  client,  to  enable  the  two-way  audio 
function,  make  sure  the  video  mode  is  set  to  “MPEG-4”  on  the Audio  and  Video  Settings  page  and  the 
media  option  is  set  to  “Video  and Audio”  on  the  Client  Settings  page.  Please  refer  to  Client  Settings  on 
page 33 and Audio and Video Settings on page 64.Click 
  to  enable  audio  transmission  to  the  Network  Camera;  click   to  adjust  the  volume  of 
microphone; click 
 to turn off the audio. To stop talking, click  again.
FTP
The FTP server allows the user to save recorded video clips. You can utilize TOSHIBA Installation Wizard  
to upgrade the firmware via FTP server. By default, the FTP port is set to 21. It also can be assigned to 
another port number between 1025 and 65535.
Audio transmitted from operators Audio transmitted to operators
Mute
 
Audio  is being  transmi tted  to  the  Ne twork  Camer a
Mic Volume  Talk Button 
2010/01/15 17:08:56  
						

							57
RTSP Streaming
To  utilize  RTSP  streaming  authentication,  make  sure  that  you  have  set  a  password  for  the  Network 
Camera first; please refer to Security on page 38 for details.
Authentication:  Depending  on  your  network  security  requirements,  the  Network  Camera  provides  three 
types of security settings for streaming via RTSP protocol: disable, basic, and digest. 
If basic  authentication  is  selected,  the  password  is  sent  in  plain  text  format,  but  there  can  be  potential 
risks  of  it  being  intercepted.  If  digest  authentication  is  selected,  user  credentials  are  encrypted  using 
MD5 algorithm, thus providing better protection against unauthorized acc\
ess. 
Access  name  for  stream  1  ~  5:  This  Network  camera  supports  multiple  streams  simultaneously.  The 
access name is used to differentiate the streaming source. 
If  you  want  to  use  an  RTSP  player  to  access  the  Network  Camera,  you  have  to  set  the  video  mode  to 
MPEG-4 and use the following RTSP URL command to request transmission of the streaming data.
rtsp://:/
For example, when the access name for  stream 3 is set to live.sdp:
1. Launch an RTSP player.
2. Choose File > Open URL. A URL dialog box will pop up.
3. Type the above URL command in the text box. 
4. The live video will be displayed in your player.
RTSP port /RTP port for video, audio/ RTCP port for video, audio 
■  RTSP  (Real-Time  Streaming  Protocol)  controls  the  delivery  of  streaming  media.  By  default,  the  port  number is set to 554.
■  The  RTP  (Real-time  Transport  Protocol)  is  used  to  deliver  video  and  audio  data  to  the  clients.  By  default, the RTP port for video is set to 5556 and the RTP port for audio is set to 5558.
■ The  RTCP  (Real-time Transport  Control  Protocol)  allows  the  Network  Camera  to  transmit  the  data  by  monitoring the Internet traffic volume. By default, the RTCP port for video is set to 5557 and the RTCP 
port for audio is set to 5559.
The  ports  can  be  changed  to  values  between  1025  and  65535. The  RTP  port  must  be  an  even  number 
and the RTCP port is the RTP port number plus one, and thus is always an odd number. When the RTP 
port changes, the RTCP port will change accordingly.
rtsp://xxx.xxx.xxx.xxx:554/live3.sdp 
						

							58
If the RTP ports are incorrectly assigned, the following warning message will be d\
isplayed:
Multicast  settings  for  stream  1  ~  5:  Click  the  items  to  display  the  detailed  configuration  information. 
Select the Always multicast option to enable multicast for stream 1 ~ 5.
Unicast video transmission delivers a stream through point-to-point transmission; multicast, on the other 
hand, sends a stream to the multicast group address and allows multiple clients to acquire the stream at 
the same time by requesting a copy from the multicast group address. Therefore, enabling multicast can 
effectively save Internet bandwith.
The ports can be changed to values between 1025 and 65535. The multicast RTP port must be an even 
number  and  the  multicast  RTCP  port  number  is  the  multicast  RTP  port  number  plus  one,  and  thus  is 
always odd. When the multicast RTP port changes, the multicast RTCP port will change accordingly.
If  the  multicast  RTP  video  ports  are  incorrectly  assigned,  the  following  warning  message  will  be 
displayed:
Multicast  TTL  [1~255]:  The  multicast  TTL  (Time  To  Live)  is  the  value  that  tells  the  router  the  range  a 
packet can be forwarded. 
						

							59
Wireless LAN (IK-WB16A-W only)
SSID  (Service  Set  Identifier):  This  is  the  name  that  identifies  a  wireless  network. Access  Points  and 
wireless  clients  attempting  to  connect  to  a  specific  WLAN  (Wireless  Local Area  Network)  must  use  the 
same  SSID.  The  default  setting  is  “default”.  Note:  The  maximum  length  for  an  SSID  is  32  single-byte 
characters and cannot consist of “, , or blank spaces.
Wireless mode: Click on the pull-down menu to select from the following options:
■ Infrastructure: Connect the Network Camera to the WLAN via an Access Point. (default setting)
■ Ad-Hoc: Connect the Network Camera directly to a host equipped with a wireless adapter in a peer-to-peer environment.
Channel: While in infrastructure mode, the channel is selected automatically to match the channel setting 
of the selected Access Point. In Ad-Hoc mode, the channel must be manually set to the same channel for 
each wireless adapter. The default channel setting depends on the installed region.
Security:  Select  the  data  encrypt  method.  There  are  four  types,  including:  none,  WEP,  WPA-PSK,  and 
WPA2-PSK.
1. None: No data encryption. 
						

							60
2. WEP  (Wired  Equivalent  Privacy):  This  allows  communication  only  with  other  devices  with  identical 
WEP settings.
■ Authentication Mode: Choose one of the following modes. The default setting is “Open”. Open – Communicates the key across the network.
Shared – Allows communication only with other devices with identical WEP settings.
■ Key length: The administrator can set the key length to 64 or 128 bits. The default setting is “64 bits”.
■ Key format: Hexadecimal or ASCII. The fault setting is “HEX”. HEX digits consist of the numbers 0~9 and the letters A-F.
ASCII is a code for representing English letters as numbers from 0-127 except “,  , and the space 
character which are reserved.
■ Network Key: Enter a key in either hexadecimal or ASCII format. You can select different key lengths, the acceptable input lengths are as follows:
64-bit key length: 10 Hex digits or 5 characters.
128-bit key length: 26 Hex digits or 13 characters.
NO TE
●  When  22(“),  3C()  are  input  as  network  keys,  the  key  format  cannot  be  changed  to ASCII 
format.