Introduction
NCC Overview
The Zyxel Nebula Control Center (NCC) is a cloud-based network management system that allows you to remotely manage and monitor Zyxel Nebula Mobile Routers, Access Points, Ethernet Switches, and Security Appliances. A Nebula Mobile Router is an LTE or NR cellular 5G indoor or outdoor router that can be managed by Nebula. You need to set up a myZyxel account in order to log into the NCC and manage your Nebula Devices, as discussed in Access the NCC Portal.
NCC feature support includes:
System accounts with different privilege levels
Site Administrator: manage one site, which is a network that contains Nebula Devices
Organization Administrator: manage one or more organizations, which are sets of sites
Multi-tenant management
Inventory and license management
Alerts to view events, such as when a device goes down
Graphically monitor individual devices
Securely manage Nebula Devices by using the Network Configuration Protocol (NETCONF) over TLS
*NCC supports IPv4 address only.
The following table describes the supported Nebula Devices.
Supported Nebula Devices 
category
Included Zyxel Devices
Hybrid Mobile Routers
LTE/NR Indoor/Outdoor Models
Security Router
SCR 50AXE
Security Gateways
NSG Series
Hybrid Security Firewalls
ZyWALL ATP / USG FLEX / USG20(W)-VPN Series
*The following Nebula Devices do NOT have a P1 port:
USG FLEX 50
USG FLEX 100 rev 2.0
ATP100 rev 2.0
Hybrid Switches
NSW / GS / XGS / XS Series
Hybrid APs (Access Point)
NAP / NWA / WAC / WAX Series
*To view the list of Nebula Devices that can be managed through NCC, go to Help > Device function table.
A hybrid device can operate in either standalone or Nebula cloud management mode. When the hybrid device is in standalone mode, it can be configured and managed by the Web Configurator. When the hybrid device is in Nebula cloud management mode, it can be managed and provisioned by the Zyxel Nebula Control Center (NCC).
MSP (Managed Services Provider) Portal
If you have an MSP license (as discussed in Overview), use the MSP menus for cross-organization management and branding.
A Managed Service Provider (MSP) network is a group of organizations that belong to the same organization administrator. With MSP, you can:
View the organization summary and transfer licenses
Copy the settings from a source organization to a destination organization
Create administrators or groups of administrators (teams) and view their login details
Assign administrators to multiple organizations
Upload/replace/remove the dashboard logo on NCC
Set the support contact details
Configure MSP alerts to monitor Nebula Devices for unexpected events (for example, online/offline events)
Sites, Organizations, and Groups
To manage by how Nebula Devices are deployed, use the Site-wide, Organization-wide and Group-wide menus.
In the NCC, a site is a group of Nebula-managed devices in the same network. An organization is a group of sites. A group is a collection of two or more organizations. To use the NCC to manage your Nebula Devices, each Nebula Device should be assigned to a site and the site must belong to an organization.
A site can have multiple Nebula Devices, but can only belong to one organization.
A site can be managed by more than one site or organization administrator.
An organization can contain multiple sites and can be managed by more than one organization administrator.
A myZyxel.com account can be an organization administrator and/or site administrator in the NCC (see Administrators).
A site administrator can manage more than one site.
Mobile Router, Security Appliance, Switches, and Access Points
To manage by Nebula Device type, use the Security Router, Mobile Router, Firewall, Security Gateway, Switch or Access Point menus.
In the following example, Nebula managed devices, such as the NAP102 or the NSW100-28P, are deployed in two separate networks (Site A and Site B). With the NCC organization administrator account, you can remotely manage and monitor all Nebula Devices even when they are located at different places.
NCC Example Network Topology
License Concept
The following section describes license concepts in NCC. Licenses unlock additional features in NCC. This means you purchase a license, assign the license to a Nebula Device, and you can then use the service in the site or organization that the Nebula Device is in.
Summary of NCC Licenses
There are three categories of licenses in NCC:
Organization: These licenses unlock advanced features for sites and organizations.
Security Service: These licenses unlock advanced security features on a Security Appliance/Firewall device.
MSP: This license unlocks the MSP menu for an NCC user account.
The following table gives a summary of all licenses in NCC at the time of writing.
Licenses Summary 
License
Category
Assign to
Description
Nebula Professional Pack
Organization
Any NCC-managed devices
Unlocks all advanced features within the Nebula Device’s organization.
For details on Pro features, see Organization License Tiers.
Nebula Plus Pack
Organization
Any NCC-managed devices
Unlocks certain advanced features within the Nebula Device’s organization.
*Upgrade to Nebula Professional Pack to get all the advanced features.
For details on Plus features, see Organization License Tiers.
MSP
MSP
NCC user account
Unlocks the MSP menu and MSP features for an NCC user account.
MSP Trial
MSP
NCC user account
Unlocks the MSP menu and MSP features but is available only once per NCC account for 30 days. Go to More > My devices & services > Services: Activate trial for MSP.
*An MSP Trial license may not be transferred to a different account. A deactivated trial license ends the service and cannot be re-claimed.
Organization Trial
Organization
Organization
Available when creating a new organization. Unlocks all Nebula Professional Pack and Nebula Security Pack (NSS) features in the organization for 30 days. There are no restrictions on the allowed number of Nebula Devices or sites.
*Each Nebula user account can create 10 new organizations with trial licenses every 90 days.
Nebula Security Pack (Nebula Security Service)
Security Service
Nebula Security Gateway (NSG) devices
Unlocks security services, such as anti-virus and anti-malware.
You can use these security services within the NSG’s site.
UTM Security Pack
Security Service
USG FLEX devices
Unlocks security services, such as anti-malware, content filtering, URL threat filter, IP reputation, sandboxing, IPS (Intrusion Prevention System), application patrol, SecuReporter, CDR (Collaborative Detection & Response), and security profile sync (see Security Profile Sync for more information), on a Security Firewall.
You can then use these security services within the Security Firewall’s site.
Gold Security Pack
Organization and Security Service
ATP devices
Unlocks security services, such as content filtering, application patrol, DNS/URL threat filter, IPS (Intrusion Prevention System), Reputation filter, anti-malware with hybrid mode, sandboxing, CDR (Collaborative Detection & Response), security profile sync, Secure WiFi, SecuReporter, and all advanced features of a Nebula Professional Pack license.
For details on Pro features, see Organization License Tiers.
Gold Security Pack
Organization and Security Service
USG FLEX devices except USG20-VPN / USG20W-VPN / USG FLEX 50
Unlocks security services, such as content filtering, application patrol, DNS/URL threat filter, IPS (Intrusion Prevention System), Reputation filter, anti-malware, sandboxing, CDR (Collaborative Detection & Response), security profile sync, Secure WiFi, SecuReporter, and all advanced features of a Nebula Professional Pack license.
Secure WiFi
Security Service
USG FLEX devices except USG FLEX 50
Unlocks the Remote AP feature.
Content Filter Pack
Security Service
USG VPN devices
Unlocks security services, such as content filtering, SecuReporter, and security profile sync on USG FLEX 50 / USG20-VPN / USG20W-VPN devices.
Connect & Protect (CNP)
Security Service
NWA1123-ACv3, WAC500, WAC500H
Unlocks security services, such as threat protection using DNS and IP reputation filters.
Connect & Protect Plus (CNP+)
Security Service
NWA110AX, NWA210AX, WAX510D, WAX610D, WAX630S, WAX650S
Unlocks security services, such as application visibility and threat protection using DNS and IP reputation filters.
SCR Pro Pack
Organization and Security Service
SCR 50AXE
Unlocks security services, such as web filtering, Ransomware Prevention Premium, and all advanced features within the Nebula Device’s organization.
For details on Pro features, see Organization License Tiers.
Organization License Tiers
NCC features the following license tiers for organizations: Base, Plus, Professional.
The Base tier is free and included with every organization.
The Plus and Professional tier licenses unlock additional features within the organization. From a Plus tier license, upgrade to a Professional tier license to unlock all the additional features. These features are marked in the user interface with a diamond icon (). Hover the mouse over the licensed features to view the license type.
The feature differences between the license tiers are listed below:
NCC License Tier Differences 
Feature
Base
Plus
Professional
Location
Notes
Group-wide menu (Monitor – Overview, Inventory, Change log, and Configure – Settings, Org-to-Org VPN, and Administrators)
No
No
Yes
Group-wide
To create a group, you must be an NCC admin and the owner of two or more Professional organizations.
Organization change logs
No
No
Yes
Organization-wide > Organization-wide manage > Change log
 
Login IPv4 address ranges for an organization
No
No
Yes
Organization-wide > Organization-wide manage > Organization settings
 
Number of admin accounts
5
8
Unlimited
Organization-wide > Administrators
 
Number of cloud authentication accounts
50
100
Unlimited
Organization-wide > Organization-wide manage > Cloud authentication
 
Cloud authentication users with VLAN attribute
No
No
Yes
Organization-wide > Organization-wide manage > Cloud authentication (Account type: User)
 
Cloud Authentication DPPSK account type
No
No
Yes
Organization-wide > Organization-wide manage > Cloud authentication (Account type: DPPSK)
 
New site configuration clone
No
No
Yes
Organization-wide > Create site
 
Site-wide settings sync
No
No
Yes
Organization-wide > Organization-wide manage > Configuration management
 
Switch settings clone
No
No
Yes
Organization-wide > Organization-wide manage > Configuration management
 
Site/Switch configuration backup and restore
No
No
Yes
Organization-wide > Organization-wide manage > Configuration management
 
Configuration templates
No
No
Yes
Organization-wide > Organization-wide manage > Configuration templates
At the time of writing, gateway and mobile router configuration templates are not available
Add client to block list/allow list
No
No
Yes
Site-wide > Clients
 
WiFi aid
No
No
Yes
Site-wide > Clients
 
Connection log
No
No
Yes
Site-wide > Clients
 
Site-wide topology
No
Yes
Yes
Site-wide > Topology
 
Summary report email & schedule
No
Yes
Yes
Site-wide > Summary report
Site-wide > Monitor > Access point / Switch / Security gateway / Firewall > Summary report
 
Time period for summary reports
24 hours
7 days
365 days
Site-wide > Summary report
Site-wide > Monitor > Access point / Switch / Security gateway / Firewall > Summary report
 
Time period for device monitoring statistics
24 hours
7 days
365 days
Site-wide > Devices > Access point / Switches / Security router / Security gateway / Firewall > [Select Access Points / Switches]
 
Time period for client monitoring statistics
24 hours
7 days
365 days
Site-wide > Clients > [Select client]
 
Time period for device event log access
24 hours
7 days
365 days
Site-wide > Monitor > Site features logs
 
Export data to CSV/XML file
No
No
Yes
All monitoring pages with tables
 
Open API
No
No
Yes
All monitoring information
 
API access (for example, DPPSK third-party integration)
No
No
Yes
Site-wide > Configure > Site settings
 
Smart email alerts
No
Yes
Yes
Site-wide > Configure > Alert settings
 
Per-device firmware upgrade schedules
No
Yes
Yes
Site-wide > Configure > Firmware management
 
Org-wide firmware upgrade
No
Yes
Yes
Organization-wide > Organization-wide manage > Firmware management
 
Priority support requests from NCC portal or Nebula app
Yes
No
Yes
Help center > Support request
 
Web chat with tech support directly from NCC portal
No
No
Yes
Website footer
 
Maximum uploaded photos from phone through NCC app
1
1
5
Site-wide > Devices > [select Nebula Device for example, Access points] > Photo
 
Remote CLI access
No
No
Yes
Site-wide > Devices > Access Points / Security gateway / Firewall [Select AP] Live tools
 
Wireless health monitor and report
No
No
Yes
Site-wide > Monitor > Access points > Wireless health
 
Programmable SSID/PSK
No
No
Yes
Site-wide > Configure > WiFi SSID settings
 
Dynamic Personal Pre-Shared Key (DPPSK)
No
No
Yes
Site-wide > Configure > Access points > SSID advanced settings
 
Vouchers as WiFi authentication credentials
No
Yes
Yes
Site-wide > Monitor > Access points > Vouchers
Site-wide > Configure > Site settings
Site-wide > Configure > Access points > SSID advanced settings
Site-wide > Configure > Access points > Captive portal customization > [portal theme]
 
Facebook WiFi
Configure in NCC
No
Yes
Site-wide > Configure > Access points > SSID advanced settings
 
RADIUS accounting for captive portal
No
No
Yes
Site-wide > Configure > Access points > SSID advanced settings
 
Customize RADIUS NAS ID
No
No
Yes
Site-wide > Configure > Access points > SSID advanced settings
 
Customize portal redirect URL parameter
No
No
Yes
Site-wide > Configure > Access points > Captive portal customization
 
Smart steering per AP
No
No
Yes
Site-wide > Configure > Access points > Radio settings > [Edit the selected Access Point]
 
Bandwidth Management by VLAN interface
No
No
Yes
Site-wide > Configure > Access points > Traffic shaping
Currently supported on NWA1123ACv3, WAC500, WAC500H, NWA110AX, NWA210AX, WAX510D, WAX610D, WAX630S, WAX650S
AP traffic log
No
No
Yes
Site-wide > Configure > Site settings
 
IPTV report
No
No
Yes
Site-wide > Monitor > Switches > IPTV report
 
Advanced IGMP
No
No
Yes
Site-wide > Configure > Switches > Advanced IGMP
 
Switch Surveillance Monitoring with ONVIF
No
No
Yes
Site-wide > Monitor > Switches > Surveillance
Currently only supported on GS1350 series switches
Extended PoE range
Yes
Yes
Yes
Site-wide > Configure > Switches > Switch ports > [select port]
Currently only supported on GS1350 series switches
Automatic PoE device recovery
No
Yes
Yes
Site-wide > Configure > Switches > Switch ports > [select port]
 
Port bandwidth control
Yes
Yes
Yes
Site-wide > Configure > Switches > Switch ports > [edit the selected port]
 
Vendor ID-based VLAN
No
Yes
Yes
Site-wide > Configure > Switches > Switch settings
 
IP interface and static route
No
No
Yes
Site-wide > Configure > Switches > IP & routing
 
Remote SSH in Live tools
No
No
Yes
Site-wide > Devices > Switches: Switch Details > Live tools > Remote access
 
IP Source Guard
No
No
Yes
Site-wide > Configure > Switches > Switch settings
 
Nebula cloud authentication
Yes
Yes
Yes
Site-wide > Configure > Switches > Authentication
 
Time period for security service (AV/App Patrol/CF/IDP/NSS) analysis report
24 hours
7 days
365 days
Site-wide > Monitor > Security gateway > NSS analysis report
Requires Nebula Security Gateway (NSG) Nebula Security Service (NSS) – Security Pack (SP) license
Traffic log archiving
No
No
Yes
Site-wide > Monitor > Firewall > SecuReporter
 
VPN topology with traffic usage
No
No
Yes
Organization-wide > Organization-wide manage > VPN Orchestrator
 
Smart VPN
No
No
Yes
Organization-wide > Organization-wide manage > VPN Orchestrator
 
VPN provision script email
No
No
Yes
Site-wide > Configure > Security gateway / Firewall > Remote access VPN (L2TP/IPSec)
 
Collaborative Detection & Response (CDR) with automatic respond action
No
No
Yes
Site-wide > Configure > Collaborative detection & response
Requires Security Firewall UTM Security Pack license
Smart mesh with manual select of mesh controller (root) and automatic fall back to auto mode
Yes
Yes
Yes
Site-wide > Devices > Access points
Currently supported on NWA110AX, NWA210AX, WAX510D, WAX610D, WAX630S, WAX650S, NWA1123ACv3, WAC500, and WAC500H APs
Traffic logs to SecuReporter
No
No
Yes
Site-wide > Configure > Site settings
Also available for Gold Security Pack, UTM Security Pack, and Content Filter Pack
Cellular IP Passthrough
No
No
Yes
Site-wide > Devices > Mobile Router > Configuration
Currently only supported on NR7101 and LTE7461
Remote configurator in Live tools
No
No
Yes
Site-wide > Devices > Mobile Router > Live tools > Remote configurator
Requires LTE or NR cellular 5G indoor or outdoor router running the latest firmware
Organization License Grace Period
If a Professional or Plus license expires while assigned to a Nebula Device or you add an unlicensed Nebula Device to the organization, you have a 15-day grace period during which the organization’s license remains active. During the grace period, you must perform one of the following actions:
Assign a valid Plus or Professional license to the unlicensed Nebula Device.
Remove the unlicensed Nebula Device from the organization.
If the expired Nebula Device is still in the organization after the grace period elapses, the organization automatically downgrades to the Base tier.
The grace period status can be any of the following:
Near Expiring: Any Nebula Devices with licenses expiring within 15 days before the grace period has started.
License Expired: Any Nebula Devices with expired licenses after the grace period.
Insufficient Licenses: Any Nebula Devices that are unlicensed, or lower tier licensed Nebula Devices added during the grace period.
General License Information
License Validity
Each license has a validity period, for example: 6 months, 1 year, 2 years. After being activated, a license also has an expiry date, which is calculated as Activation Date + Validity Period. For example, if a 1-year license is activated on January 1st 2022, then its expiry date is January 1st 2023.
*A license cannot be deactivated. An activated license continues counting towards its expiry date, even if its licensed service is deactivated.
Bundled and Renewal Licenses
A bundled license is a license that is included when you purchase a Nebula Device. The bundled license is automatically assigned to the purchased Nebula Device when you add the Nebula Device to NCC.
A renewal license is a license purchased separately from a Nebula Device as a license key, from Zyxel or a third-party reseller. To assign a renewal license to a Nebula Device, go to Organization-wide > License & inventory > License and then click +Add. See License & Inventory Licenses Screen for more information.