Reset the Nebula Password

If you forget your Nebula portal login password and need to reset it, do the following:

1 In the Nebula portal Sign In page, click Forgot Password.

2 Enter your Zyxel Account’s email address, and then click Send.

A reset password email has been sent notification appears.

3 Click the link in the Request Password Reset to Login Zyxel email.

4 The following screen appears. Click Reset Password.

5 Enter the New Password. Use a minimum of 8 characters, including 0–9 a–z A–Z `~!@#$%&*(_+-={}|[];'"./<> ?). Then click Continue.

6 You will be transferred to the myZyxel portal. Click Update password.

Maintain Firmware

This section shows you how to update and maintain a Nebula Device’s firmware.

1 Go to the Site-wide > Configure > Firmware management > Overview screen. Under Settings, you can set different times to upgrade firmware for your Access Points, Switches, Security Routers, Firewalls, Security Gateways, and Broadband Routers in your site. Select the day and time of the week when NCC will detect if any new firmware is available. NCC will send out a reminder email to the administrator for the available updates. If the administrator does NOT perform the update, after the set period of time is over, NCC will automatically upgrade the firmware for the Nebula Devices in the site. Or select Upgrade now to upgrade immediately.

2 You can set different times to upgrade firmware for your Nebula Devices to overwrite the site-wide Settings by going to the Site-wide > Configure > Firmware management > Devices screen. Or select Upgrade now to upgrade immediately.

3 If you do not want to upgrade the firmware immediately, you can click +Schedule Upgrade to create a schedule for your Nebula Device.

• Select Follow device type settings to upgrade the Nebula Device according to the site-wide schedule configured for all Nebula Devices in the site.

• Select Auto upgrade at every Week/Month on Sunday–Saturday at hh:mm to set up a routine schedule for upgrades.

• Select Upgrade at to set up a specific date and time for a one time upgrade. This option can be enabled only when the selected Nebula Devices have a new firmware available.

Due to network bandwidth and number of Nebula Devices per site, not all Nebula Devices may get the firmware upgrade on the specified date/time.

• Select Upgrade now to immediately install the firmware. Then select the Firmware type (Stable or Latest (default)).

When a firmware is officially released by Zyxel, it is the Latest firmware. For example, V6 is the Latest firmware. When the next firmware, V7, is released by Zyxel, V7 becomes the Latest firmware, and V6 will be classified as General Availability. Your Nebula Device firmware can be upgraded to V7 to use the new features. Zyxel will select a previous version (for example, V3) as a Stable release if no major issues have been reported by users.

The Upgrade at and Upgrade now options can be enabled only when the selected Nebula Devices have a new firmware available.

4 Click Add to save the settings.

13 Go to Site-wide > Devices > Access points to check the Nebula AP’s Smart Mesh uplink band (Uplink) and the signal strength (Uplink signal). The Mesh link should use the 6 GHz Smart Mesh uplink band and a signal strength better than –75 dBm. See How to Position Multiple Nebula Devices (for Nebula Access Points only) for selecting the best position to minimize signal interference for multiple Nebula APs.

14 Configure an SSID for the Nebula AP. See Change the Default SSID and Password for more information on configuring an SSID.

Configure Nebula Identify Federation Service (NID FS)

An Identity Federation Service (IFS) is a system that integrates multiple Identity Providers (IdPs), so that users just use one identity to access multiple services. NID FS (Nebula IDentity Federation Service) is IFS implemented by Nebula.

Users log into services as usual and are authenticated through NID FS by the IdP (Identity Provider) to receive access to those services. This is the work flow.

User – accesses –> Service, such as SSL VPN and Captive Portal – redirect user for authentication –> Identity Federation Service (IFS) – request to authenticate user –> IdP – returns identity –> IFS – forwards identity (signed token) –> Service –> allows or denies access –> User.

To use Nebula Identify Federation Service (NID FS), you must have a Nebula Professional Pack (standard or trial) license.

If the Nebula Professional license expires and reverts to a Nebula Base license, then all NID FS settings are kept, but you cannot enter the Organization-wide > Organization-wide manage > Nebula identity federation service page in NCC until you buy a Nebula Professional Pack license.

Users should already have an account with an IdP, such as Google Workspace or Microsoft Entra ID.

Configuration Overview

This is what you have to do.

• Create identity provider profiles for existing Identity Providers (IdPs) in Organization-wide > Organization-wide manage > Nebula identity federation service > Identity provider.

• Apply NID FS as the authentication method for the required services, such as Captive Portal (Site-wide > Configure > Firewall > Captive portal) and SSL VPN (Site-wide > Configure > Firewall > Remote access VPN).

• Set privileges in user policies in Organization-wide > Organization-wide manage > Nebula identity federation service > User privileges > Add to define which users authorized by what IdP can access which services.

• NID FS accordingly denies or allows users access to the services.

NCC and Microsoft Entra ID

This tutorial shows you how to configure OIDC and claims on NCC and Microsoft Entra ID.

See the related Microsoft documentation for the latest menu information.

Configure OIDC on NCC and Microsoft Entra ID

Set the user’s email address to allow authentication through OIDC.

1 Go to Organization-wide > Organization-wide manage > Nebula identity federation service > Identity provider. In the configured Identity Provider, copy the Redirect URL. You will need this later.

2 Next, register an application in Microsoft Entra ID. Sign in and go to App registrations > New registration > + New registration. Enter a name for your application. Under Supported account types, select the account types that should be allowed to access the Nebula identity federation service. Under Redirect URI, select Web as the platform. Paste the Redirect URL copied from NCC. Click Register. Now, record the following values in the application detail page:

• Application (client ID)

• Directory (tenant ID).

3 Next, create an OIDC Client Secret in Microsoft Entra ID. Go to Manage > Certificates & secrets. Click + New client secret. Enter a value for the secret. Select an appropriate expiration period. Now, copy and safely store the client secret value.

4 Configure the Identity Provider in NCC. Go to Create Identity Provider in NCC as shown above and enter the following details:

• Issuer URL: https://login.microsoftonline.com/<tenant_id>/v2.0

• Client ID: <Application (client) ID>

• Client Secret: <Client Secret Value>

Click Save to complete the Identity Provider configuration.