Home

Vigor 3100 Series Router User`s Guide

1. 7 2 2 1 Adjusting Protocol Encapsulation cccccssccsccceeceeeseeecaeeeeceeesseeeeeeeseaaeeeeeeeaeeeesessaseeees 7 2 2 2 IRPPOEPISPOBseuede ient dep Prdsure E E secede seen petsenensgiesesdascudaocaveneiencsansts 8 PAPAS AmO E125 RR RR 9 x dud M 10 2 3 Selecting Correct Annex TYP cccccccccccccsesseeeceeecseeeeeseeeeeeeeseeeeeseeeeeeeessseeeseeeeeeeeessaaaseeeeeeees 11 EA ERE olii NETT DTE cct 12 29 OA VINO COMMON AO E t ooo TEE 13 Advanced Web Configuration ccssscccssseecssseecessescensesceseeseeneesenneesensessoaes 15 SMETA C O T T M 15 3 1 1 Basics of Internet Protocol IP N twork ccccccsseeeceessceeseseeecseeeecseseessseeessaaeess 15 OU IPPEPISOEIPPPOR ee ee nC ee ee ee 16 eo T me rn ee ee 18 ONE aiias rr 20 SN feo Bc PSY 1 016 T c m 21 cam pee ee ene ee E ee ee ee 22 3 2 1 BASICS Ol LAN 22 3 2 2 General SEUD esitas nnne nenin ninaa nent aAA niis s nsns a sans sess aaa 24 SEC UI OUTS NITET E m 26 cor nur 29 cron 31 SR Fe OIE OCG OI MR ERE 31 Big DMZ WA OS aee IPT m 33 SB Bo OSI FONG eer aE cuv ee sectenete E A A E A 35 SEN Pe IO WW AN E E E E ms 3
2. BRO E0 MAC BOREa IAM wa Ld Q 4 O HAG owe ka Que OL 12 B 3S FUD http 172 16 2 179 cextsrv v E 8 msn Jn PRB ANES HBR O19 2g Hotmail d Mesenger f I MSN Microsoft Certificate Services vigor Welcome You use this web site to request a certificate for your web browser e mail client or other secure program Once you acquire a certificate you will be able to securely identify yourself to other people over the web sign your e mail messages encrypt your e mail messages and more depending upon the type of certificate you request Select a task O Request a certificate Check on a pending certificate 2 In Choose file to download click CA Certificate Current and Base 64 encoded and Download CA certificate to save the cer file e Microsoft Certificate Services Microsoft Internet Explorer SEO CEQ RAC BEREA IAM HAW ay O O DAG sa ka Que 2 2 E33 ED d htp4 172 16 2 179 certscvicericarc asp wBss a msn v 8 PHBH DR K HAHAE G19 0 Hotmal d Mesenger Q ef MSN Microsoft Certificate Services vigor Retrieve The CA Certificate Or Certificate Revocation List Install this CA certification path to allow your computer to trust certificates issued from this
3. ANY AUTH TCP 113 BGP TCP 179 E BOOTPCLIENT UDP 68 BOOTPSERVER UDP 67 CU SEEME HI TCP UDP 24032 CU SEEME LO TCP UDP 7648 DNS TCP UDP 53 FINGER TCP 79 v Note In the Basic configuration we only care about the service type The source destination address will be replaced with any when you press OK Choose one of the items from the left box and click ADD gt gt The selected one will be shown on the right box To remove the selected on from the right box simply choose the one again and click Remove Advanced button Click this button to open advanced configuration for each index number You can insert move edit or delete select rule 1n this page Applications Quality of Service Quality of Service Glass Index 1 Destination Address 1 Empty 3 E 2 NO Status Source Address DiffServ CodePoint Service Type Inset new Rule before 4 Rule Number Move selected Rule select an Index Number to H Rule Number Edit selected Rule Delete selected Rule Cancel For inserting a rule click Insert to open the following page Vigor3100 Series User s Guide 59 Applications Quality of Service Quality of Service Destination dress DiffServ CodePoint Service Type ACT Source Address m 2 Note Please choose setup the Service Type first SrcEdit allows you to edit source address information DestEdit allows you to edit destination address
4. 2 3 Selecting Correct Annex Type After finishing Quick Start Wizard please go to Internet Access and choose DSL Settings for choosing correct annex type for your router Internet Access gt gt DSL Setting DSL Setting AdaptiveRate MaxRate 2312 MinRate FixedRate 3312 AnnexT ype A W Terminal Type Use the drop down list of Annex Type for choosing A or B according to the annex type of your router If you do not choose the correct one you will not access into Internet This is very important Vigor3100 Series User s Guide 11 2 4 Online Status Now check the online status for your router The online status shows the system status WAN status ADSL Information and other status related to this router within one page If you select PPPoE or PPPoA as the protocol you will find out a button of Dial PPPoE or Dial PPPoE in the Online Status web page 12 Online status for PPPoA Online Status System Status LAN Status System Uptime 1 52 54 Primary DNS 194 109 6 66 Secondary DNS 194 98 0 1 IP Address TK Packets RX Packets 192 158 1 1 920 B42 WAN Status GW IP Addr Dial PPPoA Mode IP Address TX Packets TX Rate RX Packets RX Rate Up Time mm pois 0 0 0 0 00 00 a0 ADSL Information ADSL Firmware Version R3 0 1 ATM Statistics TX Blocks RX Blocks Corrected Blocks Uncorrected Blocks 0 0 0 ADSL Status Mode State Up Speed Down Speed SNR Margin Loop Att 4 8901 2 HAN
5. YPN Router 210 135 240 108 Remote Network 192 168 1 0 d I Dial In 192 168 1 6 for IPSec V b 210 135 240 210 for P PPTP or L2TP 192 168 1 2 192 168 1 3 Settings in VPN Router in the enterprise office 1 Goto Remote Access Control to enable the necessary VPN service 2 Then for using PPP based services such as PPTP L2TP or ISDN you have to set general settings in PPP General Setup PPP General Setup PPP MP Protocol IP Address Assignment for Dial In Users Dial In REP PAP ar CHAP Start IP Address 182 158 1 200 Authenticatian np E x MPPE Optional MPPE Mutual Authentication P amp P O ves 9 No For using IPSec based service such as IPSec or L2TP with IPSec Policy you have to set general settings in IPSec General Setup such as the pre shared key that both parties have known 94 Vigor3100 Series User s Guide VPN IKE IPSec General Setup Dial in Set up for Remote Dial in users and Dynamic IP Client LAM ta LAN IKE Authentication Method Pre Shared Key IPSec Security Method Medium AH Data will be authentic but will nat be encrypted High ESP pes v3pEs MAES Data will be encrypted and authentic Go to Remote Dial In Users Click on one index number to edit a profile 4 Set Dial In settings to as shown below to allow the remote user dial in to build VPN connection If an I
6. E Private Subnet Router IP Address 192 168 1 1 a UG 192 168 1 10 192 168 1 11 192 168 1 12 192 168 1 13 22 Vigor3100 Series User s Guide In some special case you may have a public IP subnet from your ISP such as 220 135 240 0 24 This means that you can set up a public subnet or call second subnet that each host is equipped with a public IP address As a part of the public subnet the Vigor router will serve for IP routing to help hosts in the public subnet to communicate with other public hosts or servers outside Therefore the router should be set as the gateway for public hosts Internet Public IP Address 220 135 240 207 Private Subnet Router IP Address 192 168 1 1 Public Subnet amp 192 168 1 22 192 168 1 11 wy 220 135 240 210 220 135 240 209 What is Routing Information Protocol RIP Vigor router will exchange routing information with neighboring routers using the RIP to accomplish IP routing This allows users to change the information of the router such as IP address and the routers will automatically inform for each other What is Static Route When you have several subnets in your LAN sometimes a more effective and quicker way for connection is the Static routes function rather than other method You may simply set rules to forward data from one specified subnet to another specified subnet without the presence of RIP What are Virtual LANs and Rate Control You can group lo
7. 104 Vigor3100 Series User s Guide Select Advanced request Microsoft Certificate Services vigor Choose Request Type Please select the type of request you would like to make User certificate request Advanced request Select Submit a certificate request a base64 encoded PKCS 10 file or a renewal request using a base64 encoded PKCS 7 file Microsoft Certificate Services vigo Advanced Certificate Requests You can request a certificate for yourself another user or a computer using one of the following methods Note that the policy of the certification authority CA will determine the certificates that you can obtain Submit a certificate request to this CA using a form Submit a certificate request using a base64 encoded PKCS 10 file or a renewal request using a base64 encoded PKCS 7 file O Request a certificate for a smart card on behalf of another user using the Smart Card Enrollment Station You must have an enrollment agent certificate to submit a request for another user Import the X509 Local Certificate Requet text file Select Router Offline request or IPSec Offline request below Microsoft Certificate Services vigor Submit A Saved Request Paste a base64 encoded PKCS 10 certificate request or PKCS 7 renewal request generated by an external application such as a web server into the request field to submit the request to the certification authority CA Sa
8. PPP Authentication PAP CHAP YJ Compression 9 on O off IKE Authentication Method Pre Shared Key Digital Signature x 509 IPSec Security Method Medium AH High ESP Index 1 15 in Schedule Setup IL 4L 3L Callback Function CBCP Require Remote to Callback Provide ISDN Number to Remote Specify a name for the profile of the LAN to LAN connection Check here to activate this profile Specify the allowed call direction of this LAN to LAN profile Both initiator responder Dial Out initiator only Dial In responder only Always On Check to enable router always keep VPN connection Idle Timeout The default value is 300 seconds If the connection has been idled over the value the router will drop the connection This function is to help the router to determine the status of IPSec VPN connection especially useful in the case of abnormal VPN IPSec tunnel disruption For details please refer to the note below Check to enable the transmission of PING packets to a specified IP address Enter the IP address of the remote host that located at the other end of the VPN tunnel Enable PING to Keep Alive is used to handle abnormal IPSec VPN connection disruption It will help to provide the state of a VPN connection for router s judgment of redial Vigor3100 Series User s Guide ISDN PPTP IPSec Tunnel L2TP User Name Password PPP Authentication VJ compression Normally if any o
9. defense Enable PortScan detection 46 Check the box to activate the DoS Defense Functionality Check the box to activate the SYN flood defense function Once detecting the Threshold of the TCP SYN packets from the Internet has exceeded the defined value the Vigor router will start to randomly discard the subsequent TCP SYN packets for a period defined in Timeout The goal for this is prevent the TCP SYN packets attempt to exhaust the limited resource of Vigor router By default the threshold and timeout values are set to 50 packets per second and 10 seconds respectively Check the box to activate the UDP flood defense function Once detecting the Threshold of the UDP packets from the Internet has exceeded the defined value the Vigor router will start to randomly discard the subsequent UDP packets for a period defined in Timeout The default setting for threshold and timeout are 150 packets per second and 10 seconds respectively Check the box to activate the ICMP flood defense function Similar to the UDP flood defense function once if the Threshold of ICMP packets from Internet has exceeded the defined value the router will discard the ICMP echo requests coming from the Internet The default setting for threshold and timeout are 50 packets per second and 10 seconds respectively Port Scan attacks the Vigor router by sending lots of packets to many ports in an attempt to find ignorant services would respond Check the box t
10. 1 4 Multi PVCs This router allows you to create multi PVC s for different data transferring for using Simply go to Internet Access and select Multi PVC Setup page Vigor3100 Series User s Guide Internet Access gt gt Multi PVCs Setup Rlulti P Cs Channel Enable ale E eh Enable VPI VCI QoS Type Protocol Encapsulation 3 1 5 DSL Settings Tennant x g QoS Type Protocol Encapsulation UBR PPPoE VC MUX ov UBR 1483 Route IP LLC v UU SUIS i S Clear Cancel Type in the primary IP address for the router If necessary type Type in the value provided by your ISP Type in the value provided by your ISP Select a proper QoS type for the channel Oos Type Select a proper protocol for this channel Protocol PPPoE Choose a proper type for this channel The types will be different according to the protocol setting that you choose Encapsulation 1483 Route IP LLC w Encapsulation 1483 Bridged IP LLC 1483 Route IP LLCO YE ML ow 1483 Bridged IP C Mux 1483 Routed IP seC MuxilPaA 1483 Bridged IP PaE WO NL LLC SNAP DSL is one technology that dramatically increases the digital capacity of ordinary telephone lines the local loops into the home or office The speed of DSL is based on the distance between the customer and telco central office Vigor3100 Series User s Guide 21 Internet Access DSL Setting DSL Setting m Ada
11. 5 3 Ty B 11 qp 4 ee 12 qo E n TTT u 13 nmm M 6 T T 14 pes T T Tong m 15 Eu 5j 8 ng ig 16 nm E zz 116 1 32 gt gt Next gt gt Status v Active x Inactive Set to Factory Default Click to clear all indexes Name Indicate the name of the LAN to LAN profile The symbol represents that the profile is empty Status Indicate the status of individual profiles The symbol V and X represent the profile to be active and inactive respectively Click each index to edit each profile and you will get the following page Each LAN to LAN profile includes 4 subgroups If the fields gray out it means you may leave it untouched The following explanations will guide you to fill all the necessary fields Vigor3100 Series User s Guide 67 68 VPN and Remote Access gt gt LAN to LAN Profile Index 1 1 Common Settings Profile Name Enable this profile 2 Dial Out Settings Type of Server I am calling 9 ISDN O PPTP O IPSec Tunnel OL2TP with IPSec Policy Dial Number for ISDN or Server IP Host Name for YPN such as5551234 draytek com or 123 45 67 89 J Profile Name Enable this profile Call Direction Always On or Idle Timeout Enable PING to keep alive PING to the IP Call Direction Both O Dial Out O Dial In CJ Always on Idle Timeout 300 second s Enable PING to keep alive PING to the IP Link Type B4kbps Username Password
12. From 172 16 0 0 to 172 31 255 255 From 192 168 0 0 to 192 168 255 255 What are Public IP Address and Private IP Address As the router plays a role to manage and further protect its LAN it interconnects groups of host PCs Each of them has a private IP address assigned by the built in DHCP server of the Vigor router The router itself will also use the default private IP address 192 168 1 1 to communicate with the local hosts Meanwhile Vigor router will communicate with other network devices through a public IP address When the data flow passing through the Network Address Translation NAT function of the router will dedicate to translate public private addresses and the packets will be delivered to the correct host PC in the local area network Thus all the host PCs can share a common Internet connection Get Your Public IP Address from ISP To acquire a public IP address from your ISP for Vigor router as a customer premises equipment there are three common protocols Point to Point Protocol over Ethernet PPPoE PPPoA and MPoA Multi PVC is provided for more advanced setup of the above In ADSL deployment the PPP Point to Point style authentication and authorization is required for bridging customer premises equipment CPE Point to Point Protocol over Ethernet PPPoE connects a network of hosts via an access device to a remote access concentrator or aggregation concentrator This implementation provides users with significant eas
13. Mode State Up Speed Down Speed SNR Margin Loop Att 991 2 HANDSHAKE E E 0 0 0 0 2 2 4 Routed IP Click 1483 Routed IP as the protocol Type in all the information that your ISP provides for this protocol Quick Start Wizard 2 Connect to Internet vh 8 VCI 35 Protocol Encapsulation 1483 Routed IP LLC v Fixed IP 9vYes ONo Dynamic IP IP Address 192 168 1 100 Subnet Mask 255 255 255 0 Default Gateway 192 168 1 1 7 Primary DNS Second DNS After finishing the settings in this page click Next to see the following page Vigor3100 Series User s Guide 4 Please confirm your settings VPI B VI cle Protocol Encapsulation 1483 Route LLC Fixed IP Yes IP Address 192 168 1 100 Subnet Mask 255 255 255 0 Default Gateway 192 168 1 1 Primary DNS Secondary DNS Click Finish The online status of this protocol will be shown as below Online Status System Status System Uptime 0 0 14 LAN Status Primary DNS 194 109 6 66 Secondary DNS 194 98 0 1 IP Address TX Packets RX Packets 192 168 1 1 109 88 WAN Status GW IP Addr Mode IP Address TX Packets TX Rate RX Packets RX Rate Lp Time ees meg 00 00 00 ADSL Information ADSL Firmware Version R3 0 1 ATM Statistics TX Blocks RX Blocks Corrected Blocks Uncorrected Blocks 0 ADSL Status Mode State Up Speed Down Speed SNR Margin Loop Att 3 981 2 HANDSHAKE 0 0 0 0
14. OzDrayTek email amp ddress Requesting GENERATE IMPORT REFRESH X509 Local Certificate Request HIIBdqjCCARMCAQAwOTELMAKGAIUEBhMCVFcCXEDAOBGNVBAOTBO RyYYEXIUZWsxIDAe BagkaqhkicSw BCOEWEXByzXMzQGRyYEXlOZWsuYZzStMIGIfIMADGCSqGcSIb3DQEBAQITA A4GMADCBiQKBgQDQYB7wmzFfFhN23 IeQnGc 03XkrrhgFbz97aPJ6 c gksBeriwa5wo hXJ4bpS8S8cUFSdloA CGGiM tcBOckdczdPFFvIZXcP3353uxa2Fj86aeTjS9sWc ELxwhIio x G ATCTwvO f zpxroCcwlJTjLSj30 BnS9v5 0S5iGcve3aclylcEcmlU7jdqgeoIDAQAEB oackwIwYJEozIhvcHAQOkKOMRowGDAWBGNVHREEDzAMNcGgtkcmFS5dcvVvrLmNvbTANBgkdq hkiGOw BAQUFLAOBogQBuIUx4MflS8xeLON7nz30cEVC4h572hhm MEXkcdgemb elWrIN Yo6x QghizfnaRX4rdLj6ywBoSavdHHr c tllLgVaudcoxxcHjiLfLmS9StlIFWidsdiwuwsoci wUVXnhWUxaga goglo6tYscriStwsr51pU UNGSnj6je c gEQ7PBqHuzf6tN6EA ngiro0 4 Connect to CA server via web browser Follow the instruction to submit the request Below we take a Windows 2000 CA server for example Select Request a Certificate Microsoft Certificate Services vigor Welcome You use this web site to request a certificate for your web browser e mail client or other secure program Once you acquire a certificate you will be able to securely identify yourself to other people over the web sign your e mail messages encrypt your e mail messages and more depending upon the type of certificate you request Select a task O Retrieve the CA certificate or certificate revocation list Request a certificate O Check on a pending certificate
15. Settings Multi P C channel Channel 2 w Encapsulation 1483 Routed IP LLC v ISDN Dial Backup Setup Mone v Dial Backup Mode RIP Protocol Enahle RIP Bridge Mode J Enable Bridge Made W AN IP Network Settings Q Obtain an IP address automatically Router Name f Domain Name n 9 Specify an IP address WAN IP Alias IP Address 182 168 1 100 255 255 255 0 132 158 1 1 Subnet Mask Gateway IP Address Required for some ISPs Default MAC Address O Specify a MAC Address MAC Address DNS Server IP Address Primary IP Address Secondary IP Address MPoA RFC1483 2684 Click Enable for activating this function If you click Disable this function will be closed and all the settings that you adjusted in this page will be invalid Set up the DSL parameters required by your ISP These are vital for building DSL connection to your ISP Multi PVC channel The selections displayed here are determined by the page of Internet Access Multi PVCs Select M PVCs Channel means no selection will be chosen Encapsulating Type Drop down the list to choose the type VPI Type in the value provided by ISP VCI Type in the value provided by ISP Routing Information Protocol is abbreviated as RIP RFC1058 specifying how routers exchange routing tables information Click Enable RIP for activating this function If you choose Bridged IP as the protocol you can check this box to This gr
16. Time hh mm Specify the starting time of the schedule Duration Time hh mm Specify the duration or period for the schedule Action Specify which action Call Schedule should apply during the period of the schedule Force On Force the connection to be always on Force Down Force the connection to be always down Enable Dial On Demand Specify the connection to be dial on demand and the value of idle timeout should be specified in Idle Timeout field Disable Dial On Demand Specify the connection to be up when it has traffic on the line Once there is no traffic over idle timeout the connection will be down and never up again during the schedule Idle Timeout Specify the duration or period for the schedule How often Specify how often the schedule will be applied Once The schedule will be applied just once Weekdays Specify which days in one week should perform the schedule Example Suppose you want to control the PPPoE Internet access connection to be always on Force On from 9 00 to 18 00 for whole week office hour Other time the Internet access connection should be disconnected Force Down Office n 12 1 S ou 21 S Hour A f 3 E 3 Force On x sj r Mon Sun 9 00 am to 6 00 pm Make sure the PPPoE connection and Time Setup is working properly Configure the PPPoE always on from 9 00 to 18 00 for whole week Configure the Force Down from 18 00 to next day 9 00 for whole week pe e er Ta Assign these two profi
17. certification authority tis not necessary to manually install the CA certification path if you request and install a certificate from this certification authority because the CA certification path will be installed for you automatically Choose file to download CA Certificate SETRTTRTOTNE Previous vigor ODER encoded or Base 64 encoded Download CA certificate Download CA certification path Download latest certificate revocation list 3 Back to Vigor router go to Trusted CA Certificate Click IMPORT button and browse the file to import the certificate cer file into Vigor router When finished click refresh and you will find the below illustration X509 Trusted CA Certificate Configuration Name Subject Status Modify Trusted CA 1 C US CN vigor Not Yet Valid Trusted CA 2 Trusted CA 3 IMPORT REFRESH 4 You may review the detail information of the certificate by clicking View button Vigor3100 Series User s Guide 107 108 Certificate Mama Issuer Subject Certificate Detail Information Trusted CA 1 eS DIE s waar fC USsfcN vIgar Subject Alternative Name valid Fram Valid To Me oi ER E rng aes cs S DES ei TT xn s daos fal rs ao Vigor3100 Series User s Guide Trouble Shooting This section will guide you to solve abnormal situations if you cannot access into the Internet after installing the router and finishing the web configuration Please follow below se
18. configuration file C C nan Click Restore to upload the file Click Backup to download current running configurations as a file 2 Click Browse button to choose the correct configuration file for uploading to the router Vigor3100 Series User s Guide 79 80 9 Click Restore button and wait for few seconds the following picture will tell you that the restoration procedure is successful 3 8 4 Syslog Mail Alert SysLog function is provided to help users to monitor router There is no bother to directly get into the Web Configurator of the router or borrow debug equipments system Maintenance gt gt SysLog Mail Alert Setup syslog Access Setup Enable Destination Port 514 Mail Alert Setup Cl Enable SMTP Server Mail Ta Return Path ss Enable Click Enable to activate this function Syslog Server IP The IP address of the Syslog server Destination Port Assign a port for the Syslog protocol SMTP Server The IP address of the SMTP server Mail To Assign a mail address for sending mails out Return Path Assign a path for receiving the mail from outside Click OK to save these settings For viewing the Syslog please do the following l 2 Just set your monitor PC s IP address in the field of Server IP Address Install the Router Tools in the Utility within provided CD After installation click on the Router Tools gt gt Syslog f
19. from three different DDNS service providers Basically Vigor routers are compatible with the DDNS services supplied by most popular DDNS service providers such as www dyndns org www no ip com www dtdns com www changeip com www dynamic nameserver com You should visit their websites to register your own domain name for the router Enable the Function and Add a Dynamic DNS Account l Assume you have a registered domain name from the DDNS provider say hostname dyndns org and an account with username fest and password fest 2 Inthe DDNS setup menu check Enable Dynamic DNS Setup Vigor3100 Series User s Guide 51 52 Applications gt gt Dynamic DNS Setup Dynamic DNS Setup v Enable Dynamic DNS Setup Force Update Accounts Index Domain Name Active 1 M ES par a 3 x 3 Select Index number to add an account for the router Check Enable Dynamic DNS Account and choose correct Service Provider dyndns org type the registered hostname hostname and domain name suffix dyndns org in the Domain Name block The following two blocks should be typed your account Login Name fest and Password test Applications gt gt Dynamic DNS Setup gt gt Dynamic DNS Account Setup Index 1 Enable Dynamic DNS Account Service Provider dyndns org www dyndns org v Service Type Domain Name chrono HD EN he Login Name IchronoEB53 max 23 characters Password sesse max 23 characte
20. function Any ICMP packets with more fragment bit set are dropped Check the box to enforce the Vigor router to defense the Land attacks The Land attack combines the SYN attack technology with IP spoofing A Land attack occurs when an attacker sends spoofed SYN packets with the identical source and destination addresses as well as the port number to victims Check the box to activate the Block Unknown Protocol function 47 Protocol Individual IP packet has a protocol field in the datagram header to indicate the protocol type running over the upper layer However the protocol types greater than 100 are reserved and undefined at this time Therefore the router should have ability to detect and reject this kind of packets Warning Messages We provide Syslog function for user to retrieve message from Vigor router The user as a Syslog Server shall receive the report sending from Vigor router which is a Syslog Client Refer to Chapter 13 System Maintenance Syslog Access Setup for detail information All the warning messages related to DoS defense will be sent to user and user can review it through Syslog daemon Look for the keyword DoS in the message followed by a name to indicate what kind of attacks 1s detected SysLog Access Setup v Enable Server IP Address 192 158 1 115 Destination Port 514 bi DrayTek Syslog Controls 192 168 1 1 WAN Status o gt Z 2 Getway IP Fixed TX Packets RX Rate vigor 3100 se
21. information If you click one of the button you will see the following dialog ANY v E http 192 168 1 17 doc QosIpEdt htm Microsoft Internet Explorer Address Type Any Address Any Address single Address End IP Address Range Address Subnet Address Start IP Address Subnet Mask From the Address Type drop down list please choose one of the selections as the address type And type in Start IP Address and End IP Address and Subnet Mask In addition the service type can also be edited Simply click Add Edd Delete button to access into the following page Service Type Service Name Service Type Port Configuration Type Single O Range Port Number 0 H Please type in the service name select Service type TCP UDP and both Next choose either one of the port configuration type Single or Range and type in the range for the Port Number 3 6 VPN and Remote Access A Virtual Private Network VPN is the extension of a private network that encompasses links across shared or public networks like the Internet In short by VPN technology you can send data between two computers across a shared or public network in a manner that emulates the properties of a point to point private link 3 6 1 Remote Access Control Enable the necessary VPN service as you need If you intend to run a VPN server inside your LAN you should disable the VPN service of Vigor Router to allow VPN tunnel pass through a
22. single host in the LAN Regular web surfing and other such Internet activities from other clients will continue to work without inappropriate interruption DMZ Host allows a defined internal user to be totally exposed to the Internet which usually helps some special applications such as Netmeeting or Internet Games etc Vigor3100 Series User s Guide 39 Destined to 220 135 240 207 Inte rnet Protocol ANY Port ANY ee 9j 192 168 1 22 DMZ FTP server Web Server 192 168 1 11 192 168 1 12 192 168 1 13 Port 21 Port 80 The inherent security properties of NAT are somewhat bypassed if you set up DMZ host We suggest you to add additional filter rules or a secondary firewall Click DMZ Host to open the following page NAT gt DMZ Host Setup DMZ Host Setup Enable Private IP d L Choos e PC Enable Check to enable the DMZ Host function Private IP Enter the private IP address of the DMZ host or click Choose PC to select one Choose PC Click this button and then a window will automatically pop up as depicted below The window consists of a list of private IP addresses of all hosts in your LAN network Select one private IP address in the list to be the DMZ host ma F hpa E 132 158 1 11 34 Vigor3100 Series User s Guide If you previously have set up WAN Alias in Internet Access gt gt PPPoE PPPoA or Internet Access 2MP o0A you will fin
23. the file Backup Click Backup to download current running configurations as a file 2 Click Backup button to get into the following dialog Click Save button to open another dialog for saving configuration as a file 78 Vigor3100 Series User s Guide File Download 8 You are downloading the File we canFig cFg From 192 168 1 1 Would you like ta open the file or save it to your computer Always ask before opening this type of File 3 In Save As dialog the default filename is config cfg You could give it another name by yourself my Documents a E My Computer My Recent Emy Network Places Documents Kfhpvs con Lite 9 4nnex A 3 mmm Beso LL MwSnap30D I3 TeleDanmark Tools b e 8 config 2 vekz 232 config 1 Mu Documents i vzk6 250 config 1 Mu Computer File name contig vi My Network Save as type Configuration File t 4 Click Save button the configuration will download automatically to your computer as a file named config cfg The above example is using Windows platform for demonstrating examples The Mac or Linux platform will appear different windows but the backup function is still available Restore Configuration l Goto System Maintenance gt gt Configuration Backup The following windows will be popped up as shown below System Maintenance gt gt Configuration Backup Configuration Backup Restoration Restoration Select a
24. users can share one PPPoE or PPPoA connection for accessing the Internet Your service provider will provide you information about user name password and authentication mode If your ISP provides you the PPPoE or PPPoA connection please select PPPoE or PPPoA for this router The following page will be shown 3 Set PPPoE PPPoA ISP Name User Name Password Confirm Password Always On Idle Timeout 180 Seconds ISP Name Assign a specific name for ISP requirement User Name Assign a specific valid user name provided by the ISP Password Assign a valid password provided by the ISP Confirm Password Retype the password Always On Check this box to allow the router connecting to Internet forever Idle Timeout Type in the value unit is second as the idle timeout of the connection Click Next for viewing summary of such connection 4 Please confirm your settings VPI O VCI 43 Protocol Encapsulation PPPoE LLC Fixed IP No Primary DNS Secondary DNS Always On Yes Vigor3100 Series User s Guide Click Finish The online status of this protocol will be shown as below Online Status System Status System Uptime 1 52 54 ILAN Status Primary DNS 194 109 6 66 Secondary DNS 194 98 0 1 IP Address TX Packets RX Packets 192 168 1 1 920 842 WAN Status GW IP Addr Dial PPPoA Mode IP Address TX Packets TX Rate RX Packets RX Rate Up Time eem NER 0 0 0 0 00 00 00 ADSL Information ADSL Fi
25. you should further specify the remote peer IP Address IKE Authentication Method and IPSec Security Method for this Dial Out connection Type of Server I am calling O ISDN OPPTP 9 IPSec Tunnel OL2TP with IPSec Policy Dial Number for ISDN or Server IP Host Name for VPN such as5551234 draytek com or 123 45 67 89 220 135 240 128 Link Type Username Password PPP Authentication VJ Compression On _ Off IKE Authentication Method 9 Pre Shared Key IKE Pre Shared Key CO O Digital Signature x 509 IPSec Security Method Medium AH O High ESP Scheduler 1 15 EN Callback Function CBCP Require Remote to Callback Provide ISDN Number to Remote 2 as If a PPP based service is selected you should further specify the remote peer IP Address Username Password PPP Authentication and VJ Compression for this Dial Out Vigor3100 Series User s Guide 9 connection Type of Server I am calling O ISDN 9 PPTP O IPSec Tunnel OL2TP with IPSec Policy Dial Number for ISDN or Server IP Host Name for VPN such as5551234 draytek com or 123 45 67 89 220 135 240 128 Link Type Username draytek hq Password III PPP Authentication PAP CHAP YJ Compression on O off IKE Authentication Method Pre Shared Key Digital Signature x 509 IPSec Security Method Medium AH High ESP Scheduler 1 15
26. 1 Basics for Firewall While the broadband users demand more bandwidth for multimedia interactive applications or distance learning security has been always the most concerned The firewall of the Vigor router helps to protect your local network against attack from unauthorized outsiders It also restricts users in the local network from accessing the Internet Furthermore it can filter out specific packets that trigger the router to build an unwanted outgoing connection The most basic security concept is to set user name and password while you install your router The administrator login will prevent unauthorized access to the router configuration from your router Quick Start Wizard 1 Enter login password Please enter an alpha numeric string as your Password Max 23 characters If you did not set password during installation you can go to System Maintenance to set up your password system Maintenance gt gt Administrator Password Setup Administrator Password Firewall Facilities The users on the LAN are provided with secured protection by the following firewall facilities User configurable IP filter Call Filter Data Filter Stateful Packet Inspection SPI tracks packets and denies unsolicited incoming data Selectable Denial of Service DoS Distributed DoS DDoS attacks protection URL Content Filter Vigor3100 Series User s Guide n 38 IP Filters Depending on whether there is an existin
27. 2 Sun 4 1 12 Time Setup Quse Browser Time Use Internet Time Client Time Protocol MTF RFC 13D05 Serwer IP Address pool ntp org Time Zone GMT Greenwich Mean Time Dublin v Automatically Update Interval 30 sec w Current System Time Click Inquire Time to get the current time Use Browser Time Select this option to use the browser time from the remote administrator PC host as router s system time Use Internet Time Select to inquire time information from Time Server on the Internet using assigned protocol Time Protocol Select a time protocol Server IP Address Type the IP address of the time sever Time Zone Select the time zone where the router is located Automatically Update Interval Select a time interval for updating from the NTP server Click OK to save these settings Vigor3100 Series User s Guide 81 82 3 8 6 Management The port number used to send receive SIP message for building a session The default value is 5060 and this must match with the peer Registrar when making VoIP calls system Maintenance gt gt Management Management Setup Management Access Control Management Port Setup Default Ports Telnet 23 HTTP 80 HTTPS Enable remote firmware upgrade FTP 453 FIP 21 LJ Allow management fram the Internet 9 User Define Parts Disable PING from the Internet Telnet Port 3 HTTF Port Access List List IP Subnet Mask HTTPS Port 43 2 SNMP Setup hal 8 F En
28. 5 240 210 Headdquarter nterne Remote Branch 192 168 1 0 Office 192 168 2 0 i 9 9 Mail Serva 192 168 2 21 192 168 2 22 d 192 168 1 2 I Marketing Dpt 192 168 3 0 Settings in Router A in headquarter 1 Goto VPN and Remote Access and select Remote Access Control to enable the necessary VPN service 2 Then For using PPP based services such as PPTP L2TP or ISDN you have to set general settings in PPP General Setup PPP General Setup PPP MP Protocol IP Address Assignment for Dial In Users Dial In PPP PAP or CHAP Start IP Address 182 158 1 200 Authenticatian ico PUE MPPE Optional MPPE w Mutual Authentication PAP O ves 9 No For using IPSec based service such as IPSec or L2TP with IPSec Policy you have to set general settings in IPSec General Setup such as the pre shared key that both parties have known Vigor3100 Series User s Guide 87 VPN IKE IPSec General Setup Dial in Set up for Remote Dial in users and Dynamic IP Client LAN to LAMY IKE Authentication Method Pre Shared Key Re type Pre Shared Key IPSec Security Method v Medium AH Data will be authentic but will not be encrypted High ESP DES 3DES Data will be encrypted and authentic v AES 3 Goto LAN to LAN Click on one index number to edit a profile 4 Set Common Settings as shown below You should enable both of VPN connections because any one of the partie
29. 5 255 2355 0 via 192 168 1 2 IFO C 192 168 1 0 55 255 255 0 is directly connected IFO a 211 100 88 0 amp 55 255 255 0 via 192 168 1 5 IFO Disable Static Route 1 Click the Index Number that you want to disable from the Static Route Configuration page 2 Select Inactive Disable from the drop down menu and then click the OK button to disable the route LAN gt gt Static Route Setup Index No 2 Status Action Destination IP Address Subnet Mask Inactive Disable E Gateway IP Address Network Interface LAM 3 2 4 VLAN Virtual LAN function provides you a very convenient way to manage hosts by grouping them based on the physical port You can also manage the in out rate of each port Go to LAN page and select VLAN The following page will appear Click Enable to invoke VLAN function Vigor3100 Series User s Guide 29 LAN gt VLAN Configuration VLAN Configuration Enablae P1 P P3 P4 VLARNU VLANT VLAN YLANG To add or remove a VLAN please refer to the following example 1 If VLAN 0 is consisted of hosts linked to P1 and P2 and VLAN 1 is consisted of hosts linked to P3 and P4 Internet m i EF 192 168 1 13 192 168 1 12 192 168 1 11 192 168 1 10 2 After checking the box to enable VLAN function you will check the table according to the needs as shown below LAN gt gt VLAN Configuration VLAN Configuration Enable VLANU VLANT1 VLAN2 VLAN3 OOO NO
30. 7 3 4 1 Basics for Fir walll ccccccccssccccsscecceseeceeeceeeeeseeeeeseseeseueessaeeessaeeeseaeeeseueesaueessuseessaeeeees 37 SE 2 General SG I cca EE E E T DEDE EP 40 et PUNO 6 UD cece ac RR Tr 41 Vigor3100 Series User s Guide iii 3 44 IM BIOCKINO PN OTT A 44 Su 9 T58 BIOCKIPIG zeunicisdiemosedittiqububranenidutremqntit nite Samuswoa nad RN ce buon eU dA UN ETE EE 44 34 6 DOS DEI MNT TT TTE 45 3 4 7 URL Content FIG s cosessciritutidaevpn i VimmexefvVxS tU ibi bHUICE rU tata TOFU tad que rifeaca bim d UP HRaTI DES 48 3 4 8 Web Content Filter ss onecidiveni tutis ne qerdmexu vu dsUYbutu sum Sar I PIpII UI FUUR Freins tU tEpM D TAT DUR 50 Dv POON ei TT 51 S SUME Ie 51 Sue ASCHOCIUIO orea a cue cen pipivesbos uvis rapI Dub dada Pn EI M mU NEP m UM E 53 SEOUMISDIEG ME 54 SE NEL m 55 2 OU I Eee Re TTE UNO 57 36 VPN and i e mire NEED E 60 3 6 1 Remote Access COntrOl iivicccssasivevnieveevardandorntaenstsinduaseuda ea nd aa Tra a OE KL Fa od nne 60 3 6 2 PPP General Setup ccccccccccssseeeeecesssesseneeeeecesccesseeceeeessececeseneeeeescccceesseneeeessencoeses 61 3 6 3 IPSec General Setup sseeessseissssssseseseeeseeeeennnn nennen nnne nnn nnn aaa aa 62 3 6 4 IPSec Peer Identity 1 ssseeeeessssesseseseseeee nennen
31. 9 6 66 Displays the model name of the router Displays the firmware version of the router Displays the date and time of the current firmware build Displays the MAC address of the LAN Interface Displays the IP address of the LAN interface Displays the subnet mask address of the LAN interface Displays the current status of DHCP server of the LAN interface Displays the MAC address of the WAN Interface Displays the IP address of the WAN interface T1 Default Gateway Displays the assigned IP address of the default gateway DNS Displays the assigned IP address of the primary DNS 3 8 2 Administrator Password This page allows you to set new password System Maintenance gt gt Administrator Password Setup Administrator Password Old Password Type in the old password The factory default setting for password is blank New Password Type in new password in this filed Retype New Password Type in the new password again When you click OK the login window will appear Please use the new password to access into the web configurator again 3 8 3 Configuration Backup Backup the Configuration Follow the steps below to backup your configuration 1 Goto System Maintenance gt gt Configuration Backup The following windows will be popped up as shown below system Maintenance gt gt Configuration Backup Contiguration Backup Restoration Restoration Select a configuration file Sd Click Restore to upload
32. AQKBFhFwcmVzcOBkcemF5dGVrLmNvbTELMAKG A1UEBhHCVFexEDAOBgNVBAOTBORyYX1UZWswgZ8wDQYJEoZIhvcNAQEBBOADgYDA MIGJAOGBANBgHvCZkVBWE338h5CcbTdeT76GoVvb3to8nr56CSwF6vEXBrnA6Ffhun zixQXi12WgAIYalz iwES5yRi1xlO08UMBGhdw eze7FrYWPxp5OPlb4QvHCEjWjH8bQoD sJOB7988DOnGugLCUlOMtENLTSGfZ nT3nUaS7doaXLVwRyZTuOp5AgMBAAGjggL4 MIICSDAWBEgNVHREEDzAMggtkcmFS5dGVrLmNwvbTAdBgNVHOA4EFgQOUunRLVGQOYc ZUM RjkwaDVoFVhyqdswVAYDVROjBEOwSA4AUzQjEORhRacl621 7mzzH94TO280yhIaQf MB xCzAJBgNVBAYTAIVTMO4wDAYDVOODEwV2aWdvcoIQF93ZC3N6YoFGR4xqhbHB FDCB gYDVRO fBIH2MIHzMIG30IGDoIGxhoGubGRhceDovLySDTji2aldvcigxESxD 6 You may review the detail information of the certificate by clicking View button Certificate Information Mame Local Issuer MTSU ess Er Subject femallAddress pressi draytek com C TW O DrayTek Subject Alternative Name valid From Aug 20 23 16 53 2005 GMT valid To ue SIG 2 Sy denn SS 8 HB RR Le P T DhNS draytek cam 4 7 Request a CA Certificate and Set as Trusted on Windows CA Server LA Server A LA Server B e User imports the CA certificate as trusted CA certificate to Vigor Router via web GUI Internet User retrieves the CA certificate of CA Server B and saves it 106 Vigor3100 Series User s Guide 1 Use web browser connecting to the CA server that you would like to retrieve its CA certificate Click Retrive the CA certificate or certificate recoring list 3 Microsoft Certificate Services Microsoft Internet Explorer
33. After specifying keywords the Vigor router will decline the connection request to the website whose URL string matched to any user defined keyword It should be noticed that the more simplified the blocking keyword list the more efficiently the Vigor router perform Check the box to deny any web surfing activity using IP address such as http 202 6 3 2 The reason for this is to prevent someone dodges the URL Access Control You must clear your browser cache first so that the URL content filtering facility operates properly on a web page that you visited before 49 50 Enable Restrict Web Feature Enable Excepting Subnets Time Schedule 3 4 8 Web Content Filter Check the box to activate the function Java Check the checkbox to activate the Block Java object function The Vigor router will discard the Java objects from the Internet ActiveX Check the box to activate the Block ActiveX object function Any ActiveX object from the Internet will be refused Compressed file Check the box to activate the Block Compressed file function to prevent someone from downloading any compressed file The following list shows the types of compressed files that can be blocked by the Vigor router Zip rar arj ace cab sit Executable file Check the box to reject any downloading behavior of the executable file from the Internet exe com scr pif bas bat inf reg Cookie Check the box to filter out the cookie tr
34. AwOQOTELMAKGAIUEBhMCVFcCXEDAOBGQNVBAOTBO RyYYEXIUZWsxIDAe BagkaqhkicSw BCOEWEZXByzxXMzQOGRyYEXlOzWsuYzStMIGTfMADOGCSqGSIb3DQEBAQUA A4GNADCBiQKBgOQDQYB7wmzFfFhN23 IeQnG 03Xkrr hgqFbz5 7aPJ6 c gksBerlwa5wo hXJdbp8S8cUFSdloACGGiM tcBOckdcZdPFFwvIXcP32s3uxazFj8aeTjsSWrELxwhIio x G A7CTwvO f zpxroCwlJTjL3j30 Bn5v5 085i1Ccve3aGlylicEcmU7jdqegoIDAGQAB oackuwlIwYJEKozIhvcHAOkKOMROwGDAWBGNVHREEDzAMGgcgtkcmFS5dcoVvrLmMvbTAMNBgkdaq hkiGOw OBAQUFLAOBOQBuIWx42Mfl8xeLON7nz30cKVvVC4hn5742hhm MEKcgembB eWrIN Yo6xQghizfnaREX4rdLj6ywBoSavdNHHr c tllLgwvau cxxcHjiLrfLmStIFWidsiwsoci wVvuwvEXnhWUxzgay golo6tYs Stusr 51pU UNGSnj6je c dqEQ7PBgHugf6tN56EA dgAr Q 3 7 2 Trusted CA Certificate Trusted CA certificate lists three sets of trusted CA certificate Certificate Management gt gt Trusted CA Certificate X509 Trusted CA Certificate Configuration Name Subject Status Modify Trusted C 1 Trusted CA 2 Trusted CA 3 z zs IMPORT REFRESH To import a pre saved trusted CA certificate please click IMPORT to open the following window Use Browse to find out the saved text file Then click Import The one you imported will be listed on the Trusted CA Certificate window X50U Trusted CA Certificate Import Microsoft Internet Explorer Import X509 Trusted CA Certificate Select a trusted CA certificate file Click Import to upload the certification For v
35. Bol JL b Callback Function CBCP Require Remote to Callback Provide ISDN Number to Remote 6 Set Dial In settings to as shown below to allow Router A dial in to build VPN connection If an IPSec based service is selected you may further specify the remote peer IP Address IKE Authentication Method and IPSec Security Method for this Dial In connection Otherwise it will apply the settings defined in IPSec General Setup above Allowed Dial In Type Orson PPTP v IPSec Tunnel L2TP with IPSec Policy V SpecifyISDN CLID orRemote VPN Gateway Peer ISDN Number orPeer VPN Server IP 220 135 240 128 or Peer ID Username Password VJ Compression On Off IKE Authentication Method Pre Shared Key IKE Pre Shared Key ewes C Digital Signature x 509 IPSec Security Method v Medium AH High ESP Moes Mapes Maes Callback Function CBCP Enable Callback Function Use the Following Number to Callback Callback Number Callback Budget minute s If a PPP based service is selected you should further specify the remote peer IP Address Username Password and VJ Compression for this Dial In connection 02 Vigor3100 Series User s Guide T Allowed Dial In Type CIISDN Username draytek hq v PPTP Password esse iPSec Tunnel VJ Compression on O off CIL2TP with IPSec Policy ice to Have IK
36. DSHAKE 0 0 0 0 0 0 Online status for Routed IP Online Status system Status System Uptime 0 0 14 LAN Status Primary DNS 194 109 6 66 Secondary DNS 194 98 0 1 IP Address TX Packets RX Packets 192 168 1 1 109 88 WAN Status GW IP Addr Mode IP Address TX Packets TX Rate RX Packets RX Rate UpTime fea paa BE a i AA ADSL Information ADSL Firmware Version R3 0 1 ATM Statistics TX Blocks RX Blocks Corrected Blocks Uncorrected Blocks n n n n ADSL Status Mode State Up Speed Down Speed SNR Margin Loop Att G 991 2 HANDSHAKE O D 0 0 0 0 Primary DNS Displays the assigned IP address of the primary DNS Secondary DNS Displays the assigned IP address of the secondary DNS IP Address in LAN Displays the IP address of the LAN interface TX Packets Displays the total transmitted packets at the LAN interface RX Packets Displays the total number of received packets at the LAN interface GW IP Addr Displays the assigned IP address of the default gateway IP Address in WAN Displays the IP address of the WAN interface TX Rate Displays the speed of transmitted packets at the WAN interface RX Rate Displays the speed of received packets at the WAN interface Up Time Displays the total system uptime of the interface ADSL Information Displays the firmware version of this router Vigor3100 Series User s Guide 2 5 Saving Configuration Each time you click OK on the web page for saving the configuration you can find message
37. Dray Tek Vigor 3100 Series Router User s Guide Version 1 01 Date 2006 3 27 Copyright 2006 All rights reserved This publication contains information that is protected by copyright No part may be reproduced transmitted transcribed stored in a retrieval system or translated into any language without written permission from the copyright holders The scope of delivery and other details are subject to change without prior notice Microsoft is a registered trademark of Microsoft Corp Windows Windows 95 98 Me NT 2000 XP and Explorer are trademarks of Microsoft Corp Apple and Mac OS are registered trademarks of Apple Computer Inc Other products may be trademarks or registered trademarks of their respective manufacturers ii Vigor3100 Series User s Guide Table of Contents 1 xui mre 1 1 1 LED Indicators and Connectors ccccccceeseccceccseseceeeeeeseeceeeceeseeceeeceeeseceessueceeessaaseceeessageeeess 1 UG LED Te OT cue MT e E Ea EE E NE AE E NEES 1 1 1 2 Connector Explanation eeeeeeississsseseseseesseeeeenn nnne nennen nenne nnns n nnn nnns n nnn 2 12 Hardware Installation PORRO E 2 Dee ASSIS COnnec ions es A apu dd ted SUPR DS 3 Configuring Basic Settings leeec eese esser lese rennen nene n n nnn nnns 5 2 Changing FASS WW OVO OT TEE 5 2 2 Quick Start Wizard NT T
38. E Authentication Method Pre Shared Key IKE Pre Shared Key SpecifyISDN CLID orRemote VPN Gateway Peer ISDN Number orPeer VPN Server IP Digital Signature X 509 111 or Peer ID IPSec Security Method Medium AH High ESP DES 3DES AES Callback Function CBCP Enable Callback Function Use the Following Number to Callback Callback Number Callback Budget 0 minute s At last set the remote network IP subnet in TCP IP Network Settings so that Router B can direct the packets destined to the remote network to Router A via the VPN connection 4 TCP IP Network Settings My WAN IP 00 RIP Direction TRE Both Remote Gateway IF 0 0 0 0 RIP Version For NAT operation treat remote sub net as Remote Network IP 192 165 1 0 Private IP Remote Network Mask 255 255 255 0 wap Change default route to this YPN tunnel Profile Index 1 Pemote Network Network IP 192 168 3 0 08 Add Remove Netmask 255 255 255 255 32 Modify Vigor3100 Series User s Guide 93 4 2 Create a remote dial in user connection between the teleworker and headquarter The other common case is that you as a teleworker may want to connect to the enterprise network securely According to the network structure as shown in the below illustration you may follow the steps to create a Remote User Profile and install Smart VPN Client on the remote host
39. Guide 39 36 NAT gt gt Open Ports Setup gt gt Edit Open Ports Setup Index Mo 1 Enable Open Ports Protocal Start Port End Port Protocal Start Port End Port 1 4500 4700 6 4500 4700 45 LIBE OPE J ULL JUL oO However if you previously have set up WAN Alias in Internet Access PPPoE PPPoA or Internet Access 2 MP04A you will find that WAN IP appeared for your selection NAT gt gt Open Ports Setup gt gt Edit Open Ports Setup Index Mo 1 Enable Open Parts Comment F2P Emule WAN IP 220 155 240 247 Local Computer 492 158 1 Choose PC Protocol Start Port End Port Protocol Start Port End Port il 4500 4700 M 4500 4700 LAP LAP quu EMI LLL Enable Open Ports Check to enable this entry Comment Make a name for the defined network application service Local Computer Enter the private IP address of the local host or click Choose PC to select one Choose PC Click this button and subsequently a window having a list of private IP addresses of local hosts will automatically pop up Select the appropriate IP address of the local host in the list Protocol Specify the transport layer protocol It could be TCP UDP or none for selection Start Port Specify the starting port number of the service offered by the local host End Port Specify the ending port number of the service offered by the local host Vigor3100 Series User s Guide 3 4 Firewall 3 4
40. Identifier It is a 16 bit field inside ATM cell s header that indicates the cell s next destination as it travels through the network A virtual channel is a logical connection between two end devices on the network Select an IP mode for this WAN interface There are several available modes for Internet access such as PPPoE PPPoA Bridged IP and Routed IP Click Yes to specify a fixed IP for the router Otherwise click No Dynamic IP to allow the router choosing a dynamic IP If you choose No the following IP Address Subnet Mask and Default Gateway will not be changed Assign a private IP address for the protocol that you select Assign a subnet mask value for the protocol of Routed IP and Bridged IP Assign a private IP address to the gateway for the protocol of Routed IP and Bridged IP Primary DNS Assign a private IP address to the primary DNS Second DNS Assign a private IP address to the secondary DNS 2 2 2 PPPoE PPPoA PPPoE stands for Point to Point Protocol over Ethernet It relies on two widely accepted standards PPP and Ethernet It connects users through an Ethernet to the Internet with a common broadband medium such as a single DSL line wireless device or cable modem All the users over the Ethernet can share a common connection And the PPPoA stands for Point to Point Protocol over ATM PPPoA uses the PPP dial up protocol with ATM as the transport PPPoE or PPPoA is used for most of DSL modem users All local
41. Idle Timeout settings will be ignored Action Specify the action for each protocol Allow Allow the client to access into the application through the specified protocol Disallow Forbid the client to access into the application through the specified protocol Disallow upload Forbid the client to access into the application through the specified protocol for downloading Yet uploading is allowed 3 4 6 DoS Defense As a sub functionality of IP Filter Firewall there are 15 types of detect defense function in the DoS Defense setup The DoS Defense functionality is disabled for default Click Firewall and click DoS Defense to open the setup page Vigor3100 Series User s Guide 45 Firewall gt gt DoS defense Setup Dos defense Setup Enable DoS Defense Enable SYN flood defense Enable UDP flood defense Enable ICMP flood defense Enable Port Scan detection Block IP options Block Land Black Smurf LJ Block trace route Black SYM fragment Black Fraggle Attack Threshold E packets sec Timeout ho sec Threshold pe packets sec Timeout ho sec Threshold E packets sec Timeout ho sec Threshald hso packets sec Cl Block TCP flag scan Black Tear Drap Black Ping af Death Black ICMP fragment Black unknawnPratacnl disi a Enable Dos Defense Enable SYN flood defense Enable UDP flood defense Enable ICMP flood
42. N or Server IP Host Name for VPN such as5551234 draytek com or 123 45 67 89 1220 135 240 210 Link Type Username draytek hq Password eeccee PPP Authentication PAP CHAP YJ Compression 9 on O off IKE Authentication Method Pre Shared Key Digital Signature X 509 IPSec Security Method Medium AH High ESP Scheduler 1 15 C a l Callback Function CBCP Require Remote to Callback Provide ISDN Number to Remote 6 Set Dial In settings to as shown below to allow Router B dial in to build VPN connection If an IPSec based service is selected you may further specify the remote peer IP Address IKE Authentication Method and IPSec Security Method for this Dial In connection Otherwise it will apply the settings defined in IPSec General Setup above Allowed Dial In Type CISDN PPTP v IPSec Tunnel L2TP with IPSec Policy v SpecifyISDN CLID orRemote VPN Gateway Peer ISDN Number orPeer VPN Server IP 220 135 240 210 or Peer ID Username Password VJ Compression On Off IKE Authentication Method Pre Shared Key IKE Pre Shared Key eese Digital Signature x 509 IPSec Security Method v Medium AH High ESP Moies Mapes Maes Callback Function CBCP Enable Callback Function Use the Following Number to Callback Callback Number minute s Ca
43. OBS 10 ISI DI 6 3 Toremove VLAN uncheck the needed box and click OK to save the results 30 Vigor3100 Series User s Guide 3 3 NAT Usually the router serves as an NAT Network Address Translation router NAT is a mechanism that one or more private IP addresses can be mapped into a single public one Public IP address is usually assigned by your ISP for which you may get charged Private IP addresses are recognized only among internal hosts When the outgoing packets destined to some public server on the Internet reach the NAT router the router will change its source address into the public IP address of the router select the available public port and then forward it At the same time the router shall list an entry 1n a table to memorize this address port mapping relationship When the public server response the incoming traffic of course is destined to the router s public IP address and the router will do the inversion based on its table Therefore the internal host can communicate with external host smoothly The benefit of the NAT includes Save cost on applying public IP address and apply efficient usage of IP address NAT allows the internal IP addresses of local hosts to be translated into one public IP address thus you can have only one IP address on behalf of the entire internal hosts Enhance security of the internal network by obscuring the IP address There are many attacks aiming victims based on the IP a
44. PSec based service is selected you may further specify the remote peer IP Address IKE Authentication Method and IPSec Security Method for this Dial In connection Otherwise it will apply the settings defined in IPSec General Setup above User account and Authentication v Enable this account Username Idle Timeout 300 second s Password 00000008 Allowed Dial In Type IKE Authentication Method CISDN Pre Shared Key LPeTP ES al MiPsec Tunnel C Digital Signature x 509 L2TP with IPSec Policy v Specify Remote Node R IPSec Security Method Remote Client IP or Peer ISDN Number l v Medium AH 210 135 240 210 High ESP or Peer ID Moes Mapes Maes Local ID optional Callback Function Check to enable Callback function Specify the callback number Callback Number Check to enable Callback Budget Control Callback Budget minute s If a PPP based service is selected you should further specify the remote peer IP Address Username Password and VJ Compression for this Dial In connection Vigor3100 Series User s Guide 9 User account and Authentication v Enable this account Idle Timeout 300 second s Allowed Dial In Type CISDN v PPTP IPSec Tunnel L2TP with IPSec Policy v Specify Remote Node Remote Client IP or Peer ISDN Number 210 135 240 210 or Peer ID Username draytek_usert Password eeccecce IKE Authentic
45. Viewing Routing Table Displays the routing table for your reference Current Running Routing Table Refresh Key C connected S static R RIP default private Te 0 0 0 0 0 0 0 0 via 192 168 1 1 IFO C 192 168 1 0 255 255 255 0 is directly connected IFO Add Static Routers to Private and Public Networks Here is an example of setting Static Route in Main Router so that user A and B locating in different subnet can talk to each other via the router Assuming the Internet access has been configured and the router works properly use the Main Router to surf the Internet create a private subnet 192 168 10 0 using an internal Router A 192 168 1 2 create a public subnet 211 100 88 0 via an internal Router B 192 168 1 3 have set Main Router 192 168 1 1 as the default gateway for the Router A 192 168 1 2 Before setting Static Route user A cannot talk to user B for Router A can only forward recognized packets to its default gateway Main Router Vigor3100 Series User s Guide 27 Internet Router C Set Static 192 168 1 1 Route Router A 192 168 1 2 Gateway 192 168 1 1 Router B 192 168 1 3 ER private subnet nl ui T ell public subnet 192 168 10 0 24 d 211 10 88 0 24 d User A UsrB Go to LAN page and click General Setup select 1st Subnet as the RIP Protocol Control Then click the OK button Note There are two reasons that we hav
46. able SNMP Agent Get Community public Set Community private Manager Host IP Trap Community public IN ru Notification Host IP B Trap Timeout 0 seconds Enable remote firmware upgrade Chick the checkbox to allow remote firmware upgrade through FTP File Transfer Protocol Allow management from the Internet Enable the checkbox to allow system administrators to login from the Internet By default it is not allowed Disable PING from the Internet Check the checkbox to reject all PING packets from the Access List Default Ports User Defined Ports Enable SNMP Agent Get Community Set Community Internet For security issue this function is enabled by default You could specify that the system administrator can only login from a specific host or network defined in the list A maximum of three IPs subnet masks is allowed List IP Indicate an IP address allowed to login to the router Subnet Mask Represent a subnet mask allowed to login to the router Check to use standard port numbers for the Telnet and HTTP servers Check to specify user defined port numbers for the Telnet and HTTP servers Check it to enable this function Set the name for getting community by typing a proper character The default setting is public Set community by typing a proper name The default setting is private Vigor3100 Series User s Guide Manager Host IP Set one host as the manager to execute SNMP function Please
47. agnostics View ARP Cache Table Ethernet ARP Cache Table Clear Refresh IP Address Mac Address 192 1658 1 11 nd u E A 6 2 D5 4 1 Refresh Click it to reload the page Clear Click it to clear the whole table 3 9 5 DHCP Table The facility provides information on IP address assignments This information is helpful in diagnosing network problems such as IP address conflicts etc Click Diagnostics and click DHCP Table to open the web page Vigor3100 Series User s Guide 85 86 Diagnostics gt gt View DHCP Assigned IP Addresses DHCP IP Assignment Table DHCP server Running Index IP Address 1 192 168 1 1 192 166 2011 Refresh Mic Address 00 50 7F d00 00 00 OO OF i 6 24 D5 a1 Leased Time ROUTER IF 22 15 6 46 3550 HOST ID draytek niki Refresh Click it to reload the page 3 9 6 NAT Sessions Table Click Diagnostics and click NAT Sessions Table to open the setup page Vigor3100 Series User s Guide 4 Application and Examples 4 1 Create a LAN to LAN connection between remote office and headquarter The most common case is that you may want to connect to network securely such as the remote branch office and headquarter According to the network structure as shown in the below illustration you may follow the steps to create a LAN to LAN profile These two networks LANs should NOT have the same network address Router A Router B 220 135 240 208 l t t 20 13
48. all applications receive the service levels required and sufficient bandwidth to meet performance expectations 1s indeed one important aspect of modern enterprise network One reason for QoS is that numerous TCP based applications tend to continually increase their transmission rate and consume all available bandwidth which 1s called TCP slow start If other applications are not protected by QoS it will detract much from their performance in the overcrowded network Another reason is due to congestions at network intersections where speeds of interconnected circuits mismatch or traffic aggregates packets will queue up and traffic can be throttled back to a lower speed If there s no defined priority to specify which packets should be discarded or in another term dropped from an overflowing queue packets of sensitive applications mentioned above might be the ones to drop off How this will affect application performance There are two components within Primary configuration of QoS deployment Classification Identifying low latency or crucial applications and marking them for high priority service level enforcement throughout the network Scheduling Based on classification of service level to assign packets to queues and associated service types The basic QoS implementation in Vigor routers is to classify and schedule packets based on the service type information in the IP header For instance to ensure the connection with the h
49. anage the local digital certificates and set trusted CA certificates Remember to adjust the time of Vigor router before using the certificate so that you can get the correct valid period of certificate 74 Vigor3100 Series User s Guide 3 7 1 Local Certificate Certificate Management gt gt Local Certificate X509 Local Certificate Configuration Mame Subject Status Modify GENERATE IMPORT REFRESH SO9 Local Certificate Generate Click this button to open Generate Certificate Request window Generate Certificate Request Subject Alternative Name Type Domain Name fa Domain Name Subject Name Country C State ST Location L Orginization O Orginization Unit OU Common Name CN Email E Key Type Key Size Generate Type in all the information that the window request Then click Generate again Import Click this button to import a saved file as the certification information Refresh Click this button to refresh the information listed below View Click this button to view the detailed settings for certificate request Vigor3100 Series User s Guide 75 After clicking Generate the generated information will be displayed on the window below oO Ee aie Se ee Segara Name Subject Status Modify Local C TW O DrayTek emailladdress Requesting GENERATE IMPORT REFRESH X509 Local Certificate Request HIIBqjCCARMCAQ
50. ansmission from inside to outside world to protect the local user s privacy Proxy Check the box to reject any proxy transmission To control efficiently the limited bandwidth usage it will be of great value to provide the blocking mechanism that filters out the multimedia files downloading from web pages Accordingly files with the following extensions will be blocked by the Vigor router mov mp3 rm ra au wmv wav asf mpg mpeg avi ram Four entries are available for users to specify some specific IP addresses or subnets so that they can be free from the URL Access Control To enable an entry click on the empty checkbox named as ACT in front of the appropriate entry Specify what time should perform the URL content filtering facility Click Firewall and click Web Content Filter to open the setup page For this section please refer to Web Content Filter user s guide Vigor3100 Series User s Guide Firewall Web Content Filter Setup CPA Content Portal Authority Web Content Filter Setup Select a CPA server asia sur cpa com v Powered by Activate Free Trial and Purchase Subscription Test a site to verify whether it is categorized p gt SurfControl Enable Web Content Filter Groups Categories Tick categories to block Untick to unblock Child Protection E Chat C Criminal C Drugs Alcohol Select All C Gambling Cl Hacking Hate speech Clear All O Sex O violence CO Weapons Leisure Advert
51. anually set up port mappings or use other similar methods The screenshots below show examples of this facility Address e Network Connections IP Broadband Connection on Router Status EE Broadband Network Tasks General x hinet s Create a new connection e Disconnected 9 Set up a home or small ps WAN Miniport PPPOE Internet Gateway office network Status Connected Dial up Duration 00 19 06 seca FOU Speed 100 0 Mbps i Network Troubleshooter SA Disconnected Y Z L DrayTek ISDN PPP T Internet Internet Gateway My Computer Other Places Internet Gateway aj a j G Control Panel IP Broadband Connection on m Router u My Network Places iav Picks L My Documents Sent 404 fad ig My Computer Hecerved 1 115 BRE LAN or High Speed Internet Local Area Connection Details ordi Enabied jd Realtek RTL8139 810x Family Network Connections System Folder Close The UPnP facility on the router enables UPnP aware applications such as MSN Messenger to discover what are behind a NAT router The application will also learn the external IP address and configure port mappings on the router Subsequently such a facility forwards packets from the external ports of the router to the internal ports used by the application T IP Broadband Connection on Router Properties EJ x Advanced Settings POA T General Services Connect to the Internet using Select the services runn
52. art Wizard If your Vigor3100 can be under an environment with high speed NAT the configuration provide here can help you to deploy and use the router quickly There are two phases of quick setup one is protocol encapsulation configuration and the other is LAN configuration 2 2 1 Adjusting Protocol Encapsulation In the Quick Start Wizard you can configure the router to access the Internet with different protocol modes such as PPPoE PPPoA Bridged IP or Routed IP The router supports the Ethernet WAN interface for Internet access Quick Start Wizard 2 Connect to Internet Fixed IP IP Address Subnet Mask Default Gateway Primary DNS Second DNS Protocol Encapsulation Auto detect PPPoA VC MUK v FETTE TALES PPPoE VC MUK PPPoA LLC SNAP PPPnaA VC MLM 1483 Bridged IP LLC 1483 Routed IP LLC 1483 Bridged IP SseC hilux 1483 Routed IP SC hux IPoA Now you have to select an appropriate WAN connection type for connecting to the Internet through this router according to the settings that your ISP provided VPI VCI Protocol Encapsulation Fixed IP IP Address Subnet Mask Default Gateway Vigor3100 Series User s Guide Stands for Virtual Path Identifier It is an 8 bit header inside each ATM cell that indicates where the cell should be routed The ATM is a method of sending data in small packets of fixed sizes It is used for transferring data to client computers Stands for Virtual Channel
53. ary DNS Server IP address 194 98 0 1 to this field The default DNS Server IP address can be found via Online Status LAN Status Primary DNS 194 109 6 66 Secondary DNS 194 98 0 1 IP Address TX Packets RX Packets 192 168 1 1 2792 2674 If both the Primary IP and Secondary IP Address fields are left empty the router will assign its own IP address to local users as a DNS proxy server and maintain a DNS cache If the IP address of a domain name is already in the DNS cache the router will resolve the domain name immediately Otherwise the router forwards the DNS query packet to the external DNS server by establishing a WAN e g DSL Cable connection There are two common scenarios of LAN settings that stated in Chapter 4 For the configuration examples please refer to that chapter to get more information for your necessity 3 2 3 Static Route Go to LAN to open setting page and choose Static Route Vigor3100 Series User s Guide LAN gt gt Static Route Setup Static Route Confiquration View Routing Table Index Destination Address Status Index Destination Address Status a TTT T b TTT T id TTT T rn TTT T 3 DE T B TEF li 4 TTT T Hs TET F 5 qa n 10 TTT T Status v Active Inactive Empty Index The number 1 to 10 under Index allows you to open next page to setup static route Destination Address Displays the destination address of the static route Status Displays the status of the static route
54. atically C Use the following IP address IP address Subnet mask C Use the folowing DNS server addresses Preferred DNS server EC Altemate DHS server aaa For MacOs 1 Double click on the current used MacOs on the desktop 2 Open the Application folder and get into Network 3 On the Network screen select Using DHCP from the drop down list of Configure IPv4 eo Network mao g Show All Displays Sound Network Startup Disk Location Automatic Show Built in Ethernet He HJ TCP IP PPPoE AppleTalk Proxies Ethernet Configure IPv4 Using DHCP HH IP Address 192 168 1 10 Renew DHCP Lease Subnet Mask 255 255 255 0 DHCP Client ID If required Router 192 168 1 1 DNS Servers Optional Search Domains Optional IPv6 Address fe80 0000 0000 0000 020a 95ff fe8d 72e4 Configure IPv6 f id Click the lock to prevent further changes Assist me Apply Now Vigor3100 Series User s Guide 111 5 3 Pinging the Router from Y our Computer The default gateway IP address of the router is 192 168 1 1 For some reason you might need to use ping command to check the link status of the router The most important thing is that the computer will receive a reply from 192 168 1 1 If not please check the IP address of your computer We suggest you setting the network connection as get IP automatically Please refer to the section 4 2 Please follo
55. ation Method Pre Shared Key Digital Signature x 509 IPSec Security Method Medium AH High ESP DES 3DES AES Local ID optional Callback Function Settings in the remote host Check to enable Callback function Specify the callback number Callback Number Check to enable Callback Budget Control Callback Budget minute s 1 For Win98 ME you may use Dial up Networking to create the PPTP tunnel to Vigor router For Win2000 XP please use Network and Dial up connections or Smart VPN Client complimentary software to help you create PPTP L2TP and L2TP over IPSec tunnel You can find it in CD ROM in the package or go to www draytek com download center Install as instructed 2 Configure button Reboot the host Smart FPN Client 3 2 2 WinXP Step D After successful installation for the first time user you should click on the Step 0 BEH This step will add the PrehibitIpsec registry value to computer in order En configure a L2ZTP IPSec connection using a pre shared key or a LATP connection For more infomation please read the article O240262 in the Microsoft Knowledgement Base Configure Step 1 Dial to ISP IF vou have already gotten a public IP you can skip this step Step 2 Connect to YPN Server Status Ma connection ISP 4 VPM 3 In Step 2 Connect to VPN Server click Insert button to add a new entry If an IPSec based service 1s selected as shown belo
56. brackets to set the Vigor router on the rack as shown below After the bracket installation the Vigor3100 chassis can be installed in a rack by using four screws for each side of the rack Vigor3100 Series User s Guide Configuring Basic Settings For use the router properly it is necessary for you to change the password of web configuration for security and adjust primary basic settings This chapter explains how to setup a password for an administrator and how to adjust basic settings for accessing Internet successfully Be aware that only the administrator can change the router configuration 2 Changing Password To change the password for this device you have to access into the web browse with default password first l Make sure your computer connects to the router correctly Q Notice You may either simply set up your computer to get IP dynamically from the router or set up the IP address of the computer to be the same subnet as the default IP address of Vigor router 192 168 1 1 For the detailed information please refer to the later section Trouble Shooting of this guide 2 Open a web browser on your PC and type http 192 168 1 1 A pop up window will open to ask for username and password Please type default values both username and password are Null on the window for the first time accessing and click OK for next screen Connect to 192 168 1 1 Login ka the Router Web Configurator User name C Pa
57. cal hosts by physical ports and create up to 4 virtual LANs To manage the communication between different groups please set up rules in Virtual LAN VLAN function and the rate of each Vigor3100 Series User s Guide 23 24 Internet ow 2 o s g 192 168 1 13 192 168 142 192 168 1 11 192 168 1 10 3 2 2 General Setup n m This page provides you the general settings for LAN Click LAN to open the LAN settings page and choose General Setup LAN gt gt General Setup Ethernet TCP IP and DHCP Setup For MAT Usage 1st IP Address ist Subnet Mask 2nd IP Address 2nd Subnet Mask LAN IP Network Configuration i 255 255 255 0 For IP Routing Usage Enable 9 Disable 2 2nd Subnet DHCP Server i DHCP Server Configuration Enable Server Disable Server Relay Agent O 1st Subnet 2nd Subnet 192 168 1 10 amp 182 158 1 1 32 158 1 1 Start IP Address IP Pool Counts 32 168 2 1 Gateway IP Address DHCP Server IP Address for Relay Agent DNS Server IP Address 95 255 455 0 RIP Protocol Control Disable w C Force DNS manual setting Primary IP Address Secondary IP Address Ist IP Address Ist Subnet Mask For IP Routing Usage 2 IP Address 2 d Subnet Mask 2 DHCP Server Type in private IP address for connecting to a local private network Default 192 168 1 1 Type in an address code that determines th
58. cation algorithm 3DES without Authentication Use triple DES encryption algorithm and not apply any authentication scheme 3DES with Authentication Use triple DES encryption algorithm and apply MD5 or SHA 1 authentication algorithm AES without Authentication Use AES encryption algorithm and not apply any authentication scheme AES with Authentication Use AES encryption algorithm and apply MD5 or SHA 1 authentication algorithm Specify mode proposal and key life of each IKE phase Gateway etc The window of Advance setup is as show below E IKE advanced settings Microsoft Internet Explorer IKE advanced settings IKE phase 1 mode Main mode O Aggressive mode IKE phase 1 proposal DES_MD5_G1 DES_SHA1_G1DES_MD5_G1 3DES_MD5_G2 v IKE phase 2 proposal HMAC SHAT HMAC MD5 v IKE phase 1 key lifetime 28800 900 86400 IKE phase 2 key lifetime 3600 600 86400 Perfect Forward Secret 9 Disable O Enable Local ID IKE phase 1 mode Select from Main mode and Aggressive mode The ultimate outcome is to exchange security proposals to create a protected secure channel Main mode is more secure than Aggressive mode since more exchanges are done in a secure channel to set up the IPSec session However the Aggressive mode is faster The default value in Vigor router is Main mode IKE phase 1 proposal To propose the local available authentication schemes and encryption algorithms to the VPN peers and g
59. cify the corresponding security methods on the right side Uncheck the checkbox This means the connection type you select above will apply the authentication methods and security methods in the general settings This field is applicable when you select PPTP or L2TP w or w out IPSec policy above This field is also applicable if you select ISDN This field is applicable when you select PPTP or L2TP w or w out IPSec policy above This field is also applicable if you select ISDN IKE Authentication Method This group of fields is applicable for IPSec Tunnels and L2TP IPSec Security Method with IPSec Policy when you specify the IP address of the remote node The only exception is Digital Signature X 509 can be set when you select IPSec tunnel either w or w o specify the IP address of the remote node Pre Shared Key Input 1 63 characters as pre shared key Digital Signature X 509 Select one predefined in the X 509 Peer ID Profiles This group of fields is a must for IPSec Tunnels and L2TP with IPSec Policy when you specify the remote node Medium Authentication Header AH means data will be authenticated but not be encrypted By default this option is active High Encapsulating Security Payload ESP means payload Vigor3100 Series User s Guide data will be encrypted and authenticated You may select encryption algorithm from Data Encryption Standard DES Triple DES 3DES and AES Local ID Specify a local ID t
60. ctions to check your basic installation stage by stage Checking if the hardware status is OK or not Checking if the Network Connection Settings on your computer is OK or not Pinging the Router from your computer V NW V WV Checking if the ISP Settings are OK or not gt Backing to factory default setting if necessary If all above stages are done and the router still cannot run normally it is the time for you to contact with your dealer for advanced help 5 1 Checking If the Hardware Status Is OK or Not Follow the steps below to verify the hardware status 1 Check the power line and WLAN LAN cable connections Refer to 2 1 Hardware Installation on quick start guide for details 2 Turn on the router Make sure the ACT LED blink once per second and the correspondent LAN LED is bright Dray Tek id be Sane Fr Vigor3 100 un 6666 mueren on 66 0606 3 If not it means that there is something wrong with the hardware status Simply execute the hardware installation again And then try again 5 2 Checking If the Network Connection Settings on Your Computer Is OK or Not Sometimes the link failure occurs due to the wrong network connection settings After trying the above section if the link is stilled failed please do the steps listed below to make sure the network connection settings is OK Vigor3100 Series User s Guide 109 110 For Windows The example is based on Windows XP As to th
61. d data filters in Filter Setup and even link them in a serial manner Each filter set is composed by 7 filter rules which can be further defined After that in General Setup you may specify one set for call filter and one set for data filter to execute first Vigor3100 Series User s Guide 43 General Setup Call Filter 9 Enable Start Filter Set Set amp v Disable Data Filter 9 Enable Start Filter Jet Sets Y Disable Log Flag None v getup Set to Factory Default Comments Comments Default Call Filter Default Data Filter C Enable stateful packet inspection O Apply IP filter to VPN incoming packets CO Drop non http connection on TCP po Accept incoming fragmented UDP pgcke ee a Filter Set1 Comments Default Call Filter Filter Set 1 Rule 1 Filter Rule Active Comments Block NetBios Check to enable the Filter Rule Pass or Block Branch to Other Filter Set L Block Immediately None w n D s L1 Direction IN M Protocol TCP UDP v o IP Address Subnet Mask Operator Start Port End Port 8 Source Jany 255 255 255 255 82 w 137 139 Li Destination any 255 255 255 255 22 w Keep State Fragments Dont Care 3 4 4 IM Blocking IM Blocking means instant messenger blocking Click Firewall and click IM Blocking to open the setup page You will see a list of common IM such as MSN Yahoo ICQ AQL applications Check Enable IM Bloc
62. d them in Aux WAN IP list for your selection NAT gt gt DMZ Host Setup DMZ Host Setup Index Enable Aux WAN IP Private IP 1 O 220 135 240 247 Il 3 3 3 Open Ports Open Ports allows you to open a range of ports for the traffic of special applications Common application of Open Ports includes P2P application e g BT KaZaA Gnutella WinMX eMule and others Internet Camera etc Ensure that you keep the application involved up to date to avoid falling victim to any security exploits Click Open Ports to open the following page NAT gt gt Open Forts Setup Open Ports Setup Index Comment Aux WARK IP Local IP Address Status M IB p ge IP Im RE e UII akc EXON NO MMC a Mew Dro ees Index Indicate the relative number for the particular entry that you want to offer service in a local host You should click the appropriate index number to edit or clear the corresponding entry Comment Specify the name for the defined network service Aux WAN IP Display the private IP address of the local host that you specify in WAN Alias Local IP Address Display the private IP address of the local host offering the service Status Display the state for the corresponding entry X or V is to represent the Inactive or Active state To add or edit port settings click one index number on the page The index entry setup page will pop up In each index entry you can specify 10 port ranges for diverse services Vigor3100 Series User s
63. ddress Since the attacker cannot be aware of any private IP addresses the NAT function can protect the internal network On NAT page you will see the private IP address defined in RFC 1918 Usually we use the 192 168 1 0 24 subnet for the router As stated before the NAT facility can map one or more IP addresses and or service ports into different specified services In other words the NAT function can be achieved by using port mapping methods 3 3 1 Port Redirection Port Redirection is usually set up for server related service inside the local network LAN such as web servers FTP servers E mail servers etc Most of the case you need a public IP address for each server and this public IP address domain name are recognized by all users Since the server is actually located inside the LAN the network well protected by NAT of the router and identified by its private IP address port the goal of Port Redirection function is to forward all access request with public IP address from external users to the mapping private IP address port of the server Vigor3100 Series User s Guide 3l Destined to Internet 220 135 240 207 2 A 192 168 1 22 DMZ Port 213 FTP server Web Server 192 168 1 11 192 168 1 12 192 168 1 13 Port 21 Port 80 The port redirection can only apply to incoming traffic The server users inside the LAN can not access public IP address of the server The correct route is to access the server using the l
64. e Utility System Maintenance gt gt Firmware Upgrade Firmware Upgrade Current Firmware Version we 6 0 RC5 Firmware Upgrade Procedures Click OK to start the TFTP server Open the Firmware Upgrade Utility or other 3 party TFTP client software Check that the firmware filename is correct Click Upgrade on the Firmware Upgrade Utility to start the upgrade After the upgrade is compelete the TFTP server will automatically stop running tog CP L Do you want to upgrade firmware 7 Vigor3100 Series User s Guide 83 3 9 Diagnostics Diagnostic Tools provide a useful way to view or diagnose the status of you Vigor router 3 9 1 WAN Connection Click Diagnostics and click WAN Connection to open the web page Diagnostics gt gt WAN Connection PPPoE PPPOA Diagnostics Refresh Internet Access gt gt Dial ISDN B Channel Bi B2 Activity Idle Idle Drop Connection gt gt Drop B1 gt gt Drop B2 Broadband Access Mode Status Internet Access gt gt Dial PPPoE PPPoA WAR IP Address sires Drop Connection gt gt Drop PPPoE PPPoA Refresh To obtain the latest information click here to reload the page Broadband Access Mode Status Display the broadband access mode and status If the broadband connection is active it will show Internet access mode is 9 enabled If the connection is idle it will show WAN IP Address The WAN IP address for the active connection Dial PPPoE or PPPoA C
65. e Vigor router not to forward any trace route packets Check the box to activate the Block SYN fragment function The Vigor router will drop any packets having SYN flag and more fragment bit set Check the box to activate the Block fraggle Attack function Any broadcast UDP packets received from the Internet is blocked Activating the DoS DDoS defense functionality might block some legal packets For example when you activate the fraggle attack defense all broadcast UDP packets coming from the Internet are blocked Therefore the RIP packets from the Internet might be dropped Check the box to activate the Block TCP flag scan function Any TCP packet with anomaly flag setting is dropped Those scanning activities include no flag scan FIN without ACK scan SYN FINscan Xmas scan and full Xmas scan Check the box to activate the Block Tear Drop function Many machines may crash when receiving ICMP datagrams packets that exceed the maximum length To avoid this type of attack the Vigor router is designed to be capable of discarding any fragmented ICMP packets with a length greater than 1024 octets Check the box to activate the Block Ping of Death function This attack involves the perpetrator sending overlapping packets to the target hosts so that those target hosts will hang once they re construct the packets The Vigor routers will block any packets realizing this attacking activity Check the box to activate the Block ICMP fragment
66. e examples for other operation systems please refer to the similar steps or find support notes in www draytek com 1 Goto Control Panel and then double click on Network Connections Jetwork Connections 2 Right click on Local Area Connection and click on Properties Disable Status Repair Bridge Connections Create Sharkcut Rename Properties 3 Select Internet Protocol TCP IP and then click Properties eth Properties General Authentication Advanced Connect using BS ASUSTek Broadcom 440 10 100 Ir This connection uses the following items les Client For Microsoft Networks x File and Printer Sharing For Microsoft Networks dal aos Packet Scheduler Internet Protocol TECPIF Install Uninstall Description Transmission Control PratacalzIntermet Protocol The default wide area network protocol that provides communication across diverse interconnected networks Show icon in notification area when connected Notify me when this connection has limited or no connectivity Vigor3100 Series User s Guide 4 Select Obtain an IP address automatically and Obtain DNS server address automatically Internet Protocol TCP IP Properties General Alternate Configuration fou can get IP settings assigned automatically if your network supports thi capability Othenwise you need to ask your network administrator for the appropriate IP settings Obtain an IP address autom
67. e its defense mechanism to mitigate in a real time manner The below shows the attack types that DoS DDoS defense function can detect 1 SYN flood attack 9 Smurf attack 2 UDP flood attack 10 SYN fragment 3 ICMP flood attack 11 ICMP fragment 4 TCP Flag scan 12 Tear drop attack 5 Trace route 13 Fraggle attack 6 IP options 14 Ping of Death attack 7 Unknown protocol 15 TCP UDP port scan 8 Land attack Content Filtering To provide an appropriate cyberspace to users Vigor router equips with URL Content Filter not only to limit illegal traffic from to the inappropriate web sites but also prohibit other web feature where malicious code may conceal Once a user type in or click on an URL with objectionable keywords URL keyword blocking facility will decline the HTTP request to that web page thus can limit user s access to the website You may imagine URL Content Filter as a well trained convenience store clerk who won t sell adult magazines to teenagers At office URL Content Filter can also provide a job related only environment hence to increase the employee work efficiency How can URL Content Filter work better than traditional firewall in the field of filtering Because it checks the URL strings or some of HTTP data hiding in the payload of TCP packets while legacy firewall inspects packets based on the fields of TCP IP headers only On the other hand Vigor router can prevent user from accidentally downloading malicious c
68. e of use Meanwhile it provides access control billing and type of service according to user requirement Vigor3100 Series User s Guide 15 When a router begins to connect to your ISP a serial of discovery process will occur to ask for a connection Then a session will be created Your user ID and password is authenticated via PAP or CHAP with RADIUS authentication system And your IP address DNS server and other related information will usually be assigned by your ISP 3 1 2 PPPoE PPPoA PPPoA included in RFC 1483 can be operated in either Logical Link Control Subnetwork Access Protocol or VC Mux mode As a CPE device Vigor router encapsulates the PPP session based for transport across the ADSL loop and your ISP s Digital Subscriber Line Access Pultiplexer SDLAM To choose PPPoE or PPPoA as the accessing protocol of the internet please select PPPoE PPPoA from the Internet Access menu The following web page will be shown PPPoE PPPoA Client Mode PPPoE PPPoA Client Enable Disable ISP Access Setup DSL Modem Settings To Multi P c channel Channel 1 VPI PPP Authentication VCI Encapsulating Type Protocol PPPoE Pass through For Wired LAN ISDN Dial Backup Setup Dial Backup Mode PPPoE PPPoA Client DSL Modem Settings eu 4 Mane O Always On YC MUX PPPoE ow Idle Timeout 180 second s IP Address From ISP WAM IP Alias Fixed IP Yes ONo Dynamic IP 182 158 1 1 0D Requ
69. e size of the network Default 255 255 255 0 24 Click Enable to invoke this function The default setting is Disable Type in secondary IP address for connecting to a subnet Default 192 168 2 1 24 An address code that determines the size of the network Default 255 255 255 0 24 You can configure the router to serve as a DHCP server for the 2nd subnet Vigor3100 Series User s Guide RIP Protocol Control DHCP Server Configuration Vigor3100 Series User s Guide E Router Web Configurator Microsoft Internet Explorer 2nd DHCP Server Start IP Address IP Pool Counts D max 10 Index Matched MAC Address given IP Address MAC Address k Start IP Address Enter a value of the IP address pool for the DHCP server to start with when issuing IP addresses If the 2nd IP address of your router is 220 135 240 1 the starting IP address must be 220 135 240 2 or greater but smaller than 220 135 240 254 IP Pool Counts Enter the number of IP addresses in the pool The maximum is 10 For example if you type 3 and the 2nd IP address of your router is 220 135 240 1 the range of IP address by the DHCP server will be from 220 135 240 2 to 220 135 240 11 MAC Address Enter the MAC Address of the host one by one and click Add to create a list of hosts to be assigned deleted or edited IP address from above pool Set a list of MAC Address for 2 DHCP server will help router to assign the corr
70. e to apply RIP Protocol Control on Ist Subnet The first 1s that the LAN interface can exchange RIP packets with the neighboring routers via the Ist subnet 192 168 1 0 24 The second 1s that those hosts on the internal private subnets ex 192 168 10 0 24 can access the Internet via the router and continuously exchange of IP routing information with different subnets Click the LAN Static Route and click on the Index Number 1 Please add a static route as shown below which regulates all packets destined to 192 168 10 0 will be forwarded to 192 168 1 2 Click OK LAN gt Static Route Setup Index No 1 i m Status A ctian Destination IP Address Subnet Mask Gateway IP Address Network Interface Return to Static Route Setup page Click on another Index Number to add another static route as show below which regulates all packets destined to 211 100 88 0 will be forwarded to 192 168 1 3 Vigor3100 Series User s Guide LAN gt gt Static Route Setup durus Status ction Active Add w Destination IP Address 211 100 88 0 Subnet Mask 295 255 255 0 Gateway IP Address 32 158 1 3 Network Interface LAM 4 Goto Diagnostics and choose Routing Table to verify current routing table Diagnostics gt gt View Routing Table Current Running Routing Table Refresh Key C connected 5 static R RIP default private Ne 0 0 0 0 0 0 0 0 wia 192 158 1 1 IFO a 192 168 10 07 amp 5
71. eadquarter a teleworker may enforce an index of QoS Control to reserve bandwidth for HTTPS connection while using lots of application at the same time One more larger scale implementation of QoS network is to apply DSCP Differentiated Service Code Point and IP Precedence disciplines at Layer 3 Compared with legacy IP Precedence that uses Type of Service ToS field in the IP header to define 8 service classes DSCP is a successor creating 64 classes possible with backward IP Precedence compatibility In a QoS enabled network or Differentiated Service DiffServ or DS framework a DS domain owner should sign a Service License Agreement SLA with other DS domain owners to define the service level provided toward traffic from different domains Then each DS node in these domains will perform the priority treatment This 1s called per hop behavior PHB The definition of PHB includes Expedited Forwarding EF Assured Forwarding AF and Best Effort BE AF defines the four classes of delivery or forwarding classes and three levels of drop precedence in each class Vigor routers as edge routers of DS domain shall check the marked DSCP value in the IP header of bypassing traffic thus to allocate certain amount of resource execute appropriate policing classification or scheduling The core routers in the backbone will do the same checking before executing treatments in order to ensure service level consistency throughout the whole QoS enabled netw
72. ec Tunnel COL2TP over IPSec PPTP Encryption Q Mo encryption O Maximum strength encryption Use default gateway on remote network 4 Click Connect button to build connection When the connection is successful you will find a green light on the right down corner 4 3 QoS Setting Example Assume a teleworker sometimes works at home and takes care of children When working time he would use Vigor router at home to connect to the server in the headquater office downtown via either HTTPS or VPN to check email and access internal database Meanwhile children may chat on VoIP or Skype in the restroom 1 Make sure the QoS Control on the left corner is checked And select BOTH in Direction QoS Control Setup Enable the QoS Control 2 Enter the Class Name of Index 1 In this index she will set reserve bandwidth for Email using protocol POP3 and SMTP Click Basic button on the right 3 Select POP3 and SMTP on the left column and add to right column Click OK to exit ANY POP3 TCP 110 SMTP TCP 25 BGP TCP 179 BOOTPCLIENT UDP 68 BOOTPSERVER UDP E7 CL SEEME HI TCP UDP 24032 CL SEEME LO TCP UDP 7648 DNS TCP UDP 53 FINGER TCP 78 4 Enter the Class Name of Index 2 In this index she will set reserve bandwidth for 98 Vigor3100 Series User s Guide HTTPS And click Basic button on the right 5 Select HTTPS in the list on the left column and click on ADD to add to right column Click OK to ex
73. ect IP address of the correct subnet to the correct host So those hosts in 2 subnet won t get an IP address belonging to 1 subnet Disable deactivates the RIP protocol It will lead to a stoppage of the exchange of routing information between routers Default PIP Protocol Control Disable 1st Subnet 2nd subnet Ist Subnet Select the router to change the RIP information of the Ist subnet with neighboring routers 2nd Subnet Select the router to change the RIP information of the 2nd subnet with neighboring routers DHCP stands for Dynamic Host Configuration Protocol The router by factory default acts a DHCP server for your network so it automatically dispatch related IP settings to any local user configured as a DHCP client It is highly recommended that you leave the router enabled as a DHCP server if you do not have a DHCP server for your network If you want to use another DHCP server in the network other than the Vigor Router s you can let Relay Agent help you to redirect the DHCP request to the specified location Enable Server Let the router assign IP address to every host in the 25 LAN Disable Server Let you manually assign IP address to every host in the LAN Relay Agent 1 subnet 2 subnet Specify which subnet that DHCP server 1s located the relay agent should redirect the DHCP request to Start IP Address Enter a value of the IP address pool for the DHCP server to start with when issuin
74. ect to Internet all the time you can check Always On ISP Name Type in the ISP Name provided by ISP in this field Username Type in the username provided by ISP in this field Password Type in the password provided by ISP in this field PPP Authentication Select PAP only or PAP or CHAP for PPP Always On Check this box if you want the router keeping connecting to Internet forever Idle Timeout Set the timeout for breaking down the Internet after passing through the time without any action IP Address From ISP Usually ISP dynamically assigns IP address to you each time you connect to it and request In some case your ISP provides service to always assign you the same IP address whenever you request In this case you can fill in this IP address in the Fixed IP field Please contact your ISP before you want to use this function Fixed IP Click Yes to use this function and type in a fixed IP address in the box WAN IP Alias If you have multiple public IP addresses and would like to utilize them on the WAN interface please use WAN IP Alias You can set up to 8 public IP addresses other than the current one you are using E WAN IP Alias Microsoft Internet Explorer WAN IP Alias Multi NAT Index Enable Aux WAN IP Join NAT IP Pool oon Anon OOCL v By checking the checkbox Join NAT IP Pool data from NAT hosts will be round robin forwarded on a session basis Vigor3100 Series User s Guide 17 Inter
75. een the Start Port and the End Port including the Start Port and the End Port If the End Port is empty the port number is not equal to the value of the Start Port Otherwise this port number is not between the Start Port and the End Port including the Start Port and End Port gt Specify the port number is larger than the Start Port includes the Start Port lt Specify the port number is less than the Start Port includes the Start Port Keep State This function should work along with Direction Protocol IP address Subnet Mask Operator Start Port and End Port settings It is used for Data Filter only Keep State is in the same nature of modern term Stateful Packet Inspection It tracks packets and accept the packets with appropriate characteristics showing its state is legal as the protocol defines It will deny unsolicited incoming data You may select protocols from any TCP UDP TCP UDP ICMP and IGMP Fragments Specify the action for fragmented packets And it is used for Data Filter only Don t care No action will be taken towards fragmented packets Unfragmented Apply the rule to unfragmented packets Fragmented Apply the rule to fragmented packets Too Short Apply the rule only to packets that are too short to contain a complete header Example As stated before all the traffic will be separated and arbitrated using on of two IP filters call filter or data filter You may preset 12 call filters an
76. er LAN to LAN connection or Remote User Dial In connection here you may edit a table of peer certificate for selection As shown below the router provides 32 entries of digital certificates for peer dial in users VPN and Remote Access gt gt IPSec Peer Identity X509 Peer ID Accounts Set to Factory Default Index Name Index Name 1 TTT J PER 2 m 10 277 3 777 1i 777 4 955 12 777 5 32 13 TTT b TTF 14 TT f ST 15 RER B BS 16 RR zz 1 16 17 32 gt m Next gt gt Click each index to edit one peer digital certificate There are three security levels of digital signature authentication Fill each necessary field to authenticate the remote peer The following explanation will guide you to fill all the necessary fields Vigor3100 Series User s Guide 63 VPN and Remote Access gt gt IPSec Peer Identity Profile Index 1 Profile Name draytek user Accept Any Peer ID Q Accept Subject Alternative Name Tvpe IP Address v IP Accept Subject Name Country C State ST Location L5 Hsinchu Orginization O Draytek Orginizatian Unit COLI Marketing Common Mame CN Il Email E saerviceiadraytek com Profile Name Type in a name in this file Accept Any Peer ID Click to accept any peer regardless of its identity Accept Subject Alternative Name Click to check one specific field of digital signature to accept the peer with matching value The field can be IP Address Domain o
77. es will be dropped Pass If No Further Match A packet matching the rule and that does not match further rules will be passed through Branch to other Filter If the packet matches the filter rule the next filter rule will branch Set to the specified filter set Select next filter rule to branch from the drop down menu Log Check this box to enable the log function Use the Telnet command log f to view the logs Direction Set the direction of packet flow It is for Data Filter only For the Call Filter this setting is not available since Call Filter is only applied to outgoing traffic Protocol Specify the protocol s which this filter rule will apply to IP Address Specify a source and destination IP address for this filter rule to apply to Place the symbol before a specific IP Address will prevent this rule from being applied to that IP address To apply the rule to all IP address enter any or leave the field blank Vigor3100 Series User s Guide Subnet Mask Select the Subnet Mask for the IP Address column for this filter rule to apply from the drop down menu Operator Start Port The operator column specifies the port number settings If the Start and End Port Port is empty the Start Port and the End Port column will be ignored The filter rule will filter out any port number Ifthe End Port is empty the filter rule will set the port number to be the value of the Start Port Otherwise the port number ranges betw
78. et general settings in PPP General Setup PPP General Setup PPP MP Protocol IP Address Assignment for Dial In Users Dial In PPP PAP or CHAP Start IP Address 192 166 2 200 Authentication eo bal MPPE Optional MPPE Mutual Authentication PAP Yes 9 No For using IPSec based service such as IPSec or L2TP with IPSec Policy you have to set general settings in IPSec General Setup such as the pre shared key that both parties have known 90 Vigor3100 Series User s Guide VPN IKE IPSec General Setup Dial in Set up for Remate Dial in users and Dynamic IP Client LAN to LAND IKE Authentication Method Pre Shared Key Re tvpe Pre Shared Key IPSec Security Method Medium AH Data will be authentic but will nat be encrypted High ESP DES 3DES Data will be encrypted and authentic v AES 3 Goto LAN to LAN Click on one index number to edit a profile 4 Set Common Settings as shown below You should enable both of VPN connections because any one of the parties may start the VPN connection 1 Common Settings Profile Name Branch 1 Enable this profile Call Direction Bath Dial Out Dial In LJ Always on Idle Timeout Bo second s JEnable PING to keep alive PING to the IP i 9 Set Dial Out Settings as shown below to dial to connect to Router B aggressively with the selected Dial Out method If an IPSec based service is selected
79. et its feedback to find a match Two combinations are available for Aggressive mode and nine for Main mode We suggest you select the combination that covers the most schemes IKE phase 2 proposal To propose the local available algorithms to the VPN peers and get its feedback to find a match Three combinations are available for both modes We suggest you select the combination that covers the most algorithms IKE phase 1 key lifetime For security reason the lifetime of key should be defined The default value is 28800 seconds You Vigor3100 Series User s Guide may specify a value in between 900 and 86400 seconds IKE phase 2 key lifetime For security reason the lifetime of key should be defined The default value is 3600 seconds You may specify a value in between 600 and 86400 seconds Perfect Forward Secret PFS The IKE Phase 1 key will be reused to avoid the computation complexity in phase 2 The default value is inactive this function Local ID In Aggressive mode Local ID is on behalf of the IP address while identity authenticating with remote VPN server For Main mode the length of the ID is limited to 47 characters Callback Function for I models The callback function provides a callback service as a part 3 Dial In Settings Allowed Dial In Type v ISDN v PPTP v IPSec Tunnel of PPP suite only for the ISDN dial in user The router owner will be charged the connection fee by the telecom Require Remote to Callbac
80. et the settings wrapped inside the red rectangles to fit the request of IP routing usage Internet Public IP Address 220 135 240 1 Private Subnet k Public Subnet Router IP Address 192 168 1 1 2 amp 192 168 1 22 192 168 1 11 220 135 240 2 220 135 240 3 102 Vigor3100 Series User s Guide 4 6 Request a certificate from a CA server on Windows CA Server GA Server A LA Server B e User imports the certificate as local certificate to Vigor Router via web GUI b a D User requests a certificate issued by CA Server A and saves it l Goto Certificate Management and choose Local Certificate Certificate Management gt gt Local Certificate X509 Local Certificate Configuration Mame Subject Status Modify GENERATE IMPORT REFRESH x59 Local Certificate Vigor3100 Series User s Guide 103 2 Youcanclick GENERATE button to start to edit a certificate request Enter the information in the certificate request Generate Certificate Request Subject Alternative Name Type Domain Name Domain Name Subject Name Country C State ST Location L Orginization O Orginization Unit OU Common Name CN Email E Key Type Key Size Generate 3 Copy and save the X509 Local Certificate Requet as a text file and save it for later use X509 Local Certificate Configuration Name Subject Status Modify Local C TW
81. g IP addresses If the Ist IP address of your router is 192 168 1 1 the starting IP address must be 192 168 1 2 or greater but smaller than 192 168 1 254 IP Pool Counts Enter the maximum number of PCs that you want the DHCP server to assign IP addresses to The default is 50 and the maximum is 253 Gateway IP Address Enter a value of the gateway IP address for the DHCP server The value is usually as same as the 1st IP address of the router which means the router is the default gateway DHCP Server IP Address for Relay Agent Set the IP address of the DHCP server you are going to use so the Relay Agent can help to forward the DHCP request to the DHCP server DNS Server DNS stands for Domain Name System Every Internet host must Configuration have a unique IP address also they may have a human friendly easy to remember name such as www yahoo com The DNS server converts the user friendly name into its equivalent IP address Force DNS manual setting Primary IP Address You must specify a DNS server IP address here because your ISP should provide you with usually more than one DNS Server If your ISP does not provide it the router will automatically apply default DNS Server IP address 194 109 6 66 to this field Secondary IP Address You can specify secondary DNS server IP address here because your ISP often provides you more than one DNS Server If your ISP does not provide it the router will automatically apply default second
82. g Internet connection or in other words the WAN link status is up or down the IP filter architecture categorizes traffic into two Call Filter and Data Filter e Call Filter When there is no existing Internet connection Call Filter is applied to all traffic all of which should be outgoing It will check packets according to the filter rules If legal the packet will pass Then the router shall initiate a call to build the Internet connection and send the packet to Internet Data Filter When there is an existing Internet connection Data Filter is applied to incoming and outgoing traffic It will check packets according to the filter rules If legal the packet will pass the router The following illustrations are flow charts explaining how router will treat incoming traffic and outgoing traffic respectively Outgoing Traffic Stateful Packet Inspection SPI Stateful inspection is a firewall architecture that works at the network layer Unlike legacy static packet filtering which examines a packet based on the information in its header stateful inspection builds up a state machine to track each connection traversing all interfaces of the firewall and makes sure they are valid The stateful firewall of Vigor router not just examine the header information also monitor the state of the connection Vigor3100 Series User s Guide Instant Messenger IM and Peer to Peer P2P Application Blocking As the popularity of all k
83. he limitation of Enable this account Vigor3100 Series User s Guide 65 66 ISDN PPTP IPSec Tunnel L2TP Specify Remote Node User Name Password the timer the router will drop this connection By default the Idle Timeout is set to 300 seconds Allow the remote ISDN dial in connection You can further set up Callback function below You should set the User Name and Password of remote dial in user below Allow the remote dial 1n user to make a PPTP VPN connection through the Internet You should set the User Name and Password of remote dial in user below Allow the remote dial in user to trigger a IPSec VPN connection through Internet Allow the remote dial in user to make a L2TP VPN connection through the Internet You can select to use L2TP alone or with IPSec Select from below None Do not apply the IPSec policy Accordingly the VPN connection employed the L2TP without IPSec policy can be viewed as one pure L2TP connection Nice to Have Apply the IPSec policy first if it is applicable during negotiation Otherwise the dial in VPN connection becomes one pure L2TP connection Must Specify the IPSec policy to be definitely applied on the L2TP connection Check the checkbox You can specify the IP address of the remote dial in user or peer ID should be the same as the ID you set in the Local ID of IKE advanced settings window Enter Peer ISDN number if you select ISDN above Also you should further spe
84. iewing each trusted CA certificate click View to open the certificate detail information window If you want to delete a CA certificate choose the one and click Delete to remove all the certificate information 76 Vigor3100 Series User s Guide lt Certificate Information Microsoft Internet Explorer Certificate Mame Issuer Subject Certificate Detail Information Trusted C45 Subject Alternative Name Valid From Valid To 3 8 System Maintenance For the system setup there are several items that you have to know the way of configuration Status Administrator Password Configuration Backup Syslog Time setup Reboot System Firmware Upgrade 3 8 1 System Status The System Status provides basic network settings of Vigor router It includes LAN and WAN interface information Also you could get the current running firmware version or firmware related information from this presentation system Status Model Name Firmware Version Build Date Time LAN MAC Address ist IP Address ist Subnet Mask DHCP Server Model Name Firmware Version Build Date amp Time MAC Address 1 IP Address 1 Subnet Mask DHCP Server MAC Address IP Address Vigor3100 Series User s Guide Vigor3100 series v2 5 0 RCS Thu Sep 29 15 2 33 84 2005 WAN t 0 50 7F 00 0 MAC Address 0 50 7F 00 0 1 192 168 1 1 Connection tates 255 255 255 0 IP Address A Yes Default Gateway DAS 194 10
85. igns every local NATed host an IP address of 192 168 1 x starting from 192 168 1 10 Vigor3100 Series User s Guide 99 Internet Public IP Address 220 135 240 207 Private Subnet Router IP Address 192 168 1 1 ee 99 192 168 1 22 192 168 1 11 192 168 1 12 192 168 1 13 C e Eee You can just set the settings wrapped inside the red rectangles to fit the request of NAT usage LAN gt gt General Setup Ethernet TCP IP and DHCP Setup LAN IP Network Configuration DHCP Server Configuration For NAT Usage Enable Server Disable Server 1st IP Address 132 168 1 1 Relay Agent O 1st Subnet 2nd Subnet ist Subnet Mask 755 255 755 0 Start IP Address 192 165 1 10 AEE aE IF Pool Counts so 2nd IP Address 132 158 2 1 Gateway IP Address 192 158 1 1 2nd Subnet Mask 255 255 255 0 DHCP Serwer IP Address O E r DUCE for Relay Agent DAS Server IP Address C Force DNS manual setting RIP Protocol Control Secondary IP Address To use another DHCP server in the network rather than the built in one of Vigor Router you have to change the settings as show below 100 Vigor3100 Series User s Guide Internet Public IP Address 220 135 240 207 Private Subnet Router IP Address 192 168 1 1 192 168 1 22 192 168 1 11 192 168 3 22 Houter 192 168 3 11 You can just set the settings wrapped inside the red rectangles to fit the request of NAT usage LAN gt gt General Setup Ethe
86. ilter Filter Rule Active Comments Black NetBios E E O c 6 O m Next Filter Set Filter Rule Click a button numbered 1 7 to edit the filter rule Click the button will open Edit Filter Rule web page For the detailed information refer to the following page Active Enable or disable the filter rule Vigor3100 Series User s Guide 4 Comment Enter filter set comments description Maximum length is 23 character long Next Filter Set Set the link to the next filter set to be executed after the current filter set Do not make many filter sets a loop To edit Filter Rule click the Filter Rule index button to enter the Filter Rule setup page Firewall gt gt Edit Filter Rule gt gt Edit Filter Rule Filter Set 1 Rule 1 Comments Black NetBios Check to enable the Filter Rule Pass or Black Branch to Other Filter Set Block Immediately w Lag Direction IM Protocol TCP UDP IP Address Subnet Mask Operator Start Port End Port Comments Enter filter set comments description Maximum length is 14 character long Check to enable the Check this box to enable the filter rule Filter Rule Pass or Block Specifies the action to be taken when packets match the rule Block Immediately Packets matching the rule will be dropped immediately Pass Immediately Packets matching the rule will be passed immediately Block If No Further Match A packet matching the rule and that does not match further rul
87. inds of instant messenger application arises communication cannot become much easier Nevertheless while some industry may leverage this as a great tool to connect with their customers some industry may take reserve attitude in order to reduce employee misusage during office hour or prevent unknown security leak It is similar situation for corporation towards peer to peer applications since file sharing can be convenient but insecure at the same time To address these needs we provide IM and P2P blocking functionality Denial of Service DoS Defense The DoS Defense functionality helps you to detect and mitigate the DoS attack The attacks are usually categorized into two types the flooding type attacks and the vulnerability attacks The flooding type attacks will attempt to exhaust all your system s resource while the vulnerability attacks will try to paralyze the system by offending the vulnerabilities of the protocol or operation system The DoS Defense function enables the Vigor router to inspect every incoming packet based on the attack signature database Any malicious packet that might duplicate itself to paralyze the host in the secure LAN will be strictly blocked and a Syslog message will be sent as warning if you set up Syslog server Also the Vigor router monitors the traffic Any abnormal traffic flow violating the pre defined parameter such as the number of thresholds is identified as an attack and the Vigor router will activat
88. ing on your network that Internet users can access J IP Broadband Connection on Router Ftp Example menmegr 192 158 28 11 1 3135 60654 UDP msnmsgr 192 168 29 11 7824 13251 UDP This connection allows you to connect to the Internet through a msnmsgr 192 158 29 11 8789 63231 TCP shared connection on another computer p Show icon in notification area when connected gum Edit date The reminder as regards concern about Firewall and UPnP Can t work with Firewall Software Enabling firewall applications on your PC may cause the UPnP function not working properly This is because these applications will block the accessing ability of some network ports Security Considerations Activating the UPnP function on your network may incur some security threats You should consider carefully these risks before activating the UPnP function Vigor3100 Series User s Guide Some Microsoft operating systems have found out the UPnP weaknesses and hence you need to ensure that you have applied the latest service packs and patches gt Non privileged users can control some router functions including removing and adding port mappings The UPnP function dynamically adds port mappings on behalf of some UPnP aware applications When the applications terminate abnormally these mappings may not be removed 3 5 5 Quality of Service Deploying QoS Quality of Service management to guarantee that
89. ing requirement for residential SOHO Small Office and Home Office and business users the Vigor3100 series are G SHDSL enabled integrated access device G SHDSL is going to be a prevailing standard for business and residential SDSL Symmetrical DSL in the rapidly growing worldwide marketplace It offers data at 192Kbps to 2 3Mbps over a single pair The Vigor3100 series provide exceptional bandwidth for Internet access The available bandwidth also depends on the Internet Service Provider Embedded with sophistic VPN firewall security features the Vigor3100 series provides 32 dedicated virtual private data networks tunneling through public Internet Powered by hardware based DES 3DES engine all the information transmitted is well encrypted hence against any snooping without performance degraded when VPN is enabled The Vigor3100 G models are embedded 802 11g compliant wireless module which provides wireless LAN access with line rate as much as 108Mbps with Super G The Vigor3100 G models feature WPA2 802 111 wireless LAN isolation and WDS Wireless Distribution System A Virtual Private Network VPN is an extension of a private network that encompasses links across shared or public networks like an Intranet A VPN enables you to send data between two computers across a shared public Internet network in a manner that emulates the properties of a point to point private link The DrayTek Vigor3300 series VPN router supports Internet i
90. ired for some ISPs 9 Default MAC Address O Specify a MAC Address MAC Address Index 1 155 in Schedule Setup Click Enable for activating this function If you click Disable this function will be closed and all the settings that you adjusted in this page will be invalid Fixed IP Address Set up the DSL parameters required by your ISP These are vital for building DSL connection to your ISP Multi PVC channel The selections displayed here are determined by the page of Internet Access Multi PVCs Select M PVCs Channel means no selection will be chosen VPI Type in the value provided by ISP VCI Type in the value provided by ISP Encapsulating Type Drop down the list to choose the type provided by ISP Protocol Drop down the list to choose the one provided by ISP If you have already used Quick Start Wizard to set the protocol then it is not necessary for you to change any settings in this group Vigor3100 Series User s Guide PPPoE Pass through The router offers PPPoE dial up connection Besides you also can establish the PPPoE connection directly from local clients to your ISP via the Vigor router For Wired LAN If you check this box PCs on the same network can use another set of PPPoE session different with the Host PC to access into Internet ISP Access Setup Enter your allocated username password and authentication parameters according to the information provided by your ISP If you want to conn
91. isements Entertainment Food select All Cl Games O Glamour Cl Health Clear All Cl Hobbies Ol Lifestyle Motor vehicles Personals C Photo Searches Shopping O Sports O Streaming Media O Travel Business lComputing Internet Finance Job Search Career Select All C Politics Cl Real Estate Cl Reference Clear All Remote proxies Cl Search Engine C web Mail Others Cl Education Cl Hosting sites Cl kid Sites Select All News Religion Cl Sex Education Clear All Usenet news O Block all uncategorised sites Time Schedule Index 1 15 in Schedule Setup Fa Note Action and Idle Timeout settings will be ignored 3 5 Applications 3 5 1 Dynamic DNS The ISP often provides you with a dynamic IP address when you connect to the Internet via your ISP It means that the public IP address assigned to your router changes each time you access the Internet The Dynamic DNS feature lets you assign a domain name to a dynamic WAN IP address It allows the router to update its online WAN IP address mappings on the specified Dynamic DNS server Once the router is online you will be able to use the registered domain name to access the router or internal virtual servers from the Internet It is particularly helpful if you host a web server FTP server or other server behind the router Before you use the Dynamic DNS feature you have to apply for free DDNS service to the DDNS service providers The router provides up to three accounts
92. it ANY HTTPS TCP 443 AUTH TCP 113 BGPITCP 179 BOOTPCLIENT UDP E8 g BOOTPSERYERAJOP 67 CU SEEME HITCP UDP 24032 CU SEEME LOTCP UDP 7648 DNS TCP UDP 53 FINGER TCP 78 6 Check the Enable UDP Bandwidth Control on the bottom to prevent enormous UDP traffic of VoIP influent other application Enable UDP Bandwidth Control Limited bandwidth Ratio 25 6 7 If the worker has connected to the headquater using host to host VPN tunnel Please refer to Chapter 8 VPN for detail instruction he may set up an index for it Enter the Class Name of Index 3 In this index she will set reserve bandwidth for 1 VPN tunnel And click Advance button on the right Internet VPN tunnel Private network Cooperate network 192 168 1 0 192 168 2 0 8 Click edit to open a new window First check the ACT box Then click SrcEdit to set a Jane s subnet address Click DestEdit to set headquarter s subnet address Leave other fields and click OK Qos Control Setup Destination ACT Source Address DiffServ CodePoint Service Type Address 92 160 1 Ofmask 4 192 165 2 Ofmask 2 iv mask clay Note Please choose setup the Service Type first 4 4 LAN Created by Using NAT An example of default setting and the corresponding deployment are shown below The default Vigor router private IP address Subnet Mask is 192 168 1 1 255 255 255 0 The built in DHCP server is enabled so it ass
93. k Enable this to let the router to require the remote peer to callback for the connection afterwards Provide ISDN Number to Remote In the case that the remote peer requires the Vigor router to callback the local ISDN number will be provided to the remote peer Check here to allow the Vigor router to send the ISDN number to the remote router Username Password on O off VJ Compression V L2 TP with IPSec Policy None SpecifyISDN CLID orRemote VPN Gateway Peer ISDM Number orPeer VPN Server IP or Peer ID 4 TCP IP Network Settings vi IKE Authentication Method Pre Shared Key Digital Signature x 509 IPSec Security Method Medium AH High ESP DES 3DES AES Callback Function CBCP Cl Enable Callback Function Cluse the Following Number to Callback Callback Number My WAN IP 0 0 0 0 Remote Gateway IP 0 0 0 0 Remote Network IP 0 0 0 0 Remote Network Mask 255 255 255 0 More Callback Budget D minute s RIP Direction TX RX Both RIP Version Ver 2 w For NAT operation treat remote sub net as Private IP v Change default route to this VPN tunnel Allowed Dial In Type ISDN Vigor3100 Series User s Guide Determine the dial in connection with different types Allow the remote ISDN dial in connection You can further set up Callback function below You should set the User Name and Password of remote dial i
94. k a payload of each packet but not the header Transport mode is used in L2TP over IP Sec The more secure Tunnel mode encrypts both the header and the payload Tunnel mode is used in IPSec ESP can be used alone or in conjunction with AH Vigor3100 Series User s Guide VPN and Remote Access gt gt IPSec General Setup VPN IKE IPSec General Setup Dial in Set up for Remate Dial in users and Dynamic IP Client LAM to LAN IKE Authentication Method IPSec Security Method Medium AH Data will be authentic but will not be encrypted High ESP MIDES Mspes v amp ES Data will be encrypted and authentic IKE Authentication Method This usually applies to those are remote dial in user or node LAN to LAN which uses dynamic IP address and IPSec related VPN connections such as L2TP over IPSec and IPSec tunnel Pre Shared Key Currently only support Pre Shared Key authentication Pre Shared Key Specify a key for IKE authentication Re type Pre Shared Key Confirm the pre shared key IPSec Security Method Medium Authentication Header AH means data will be authenticated but not be encrypted By default this option is active High Encapsulating Security Payload ESP means payload data will be encrypted and authenticated You may select encryption algorithm from Data Encryption Standard DES Triple DES 3DES and AES 3 6 4 IPSec Peer Identity To use digital certificate for peer authentication in eith
95. k connected devices the ease of installation and configuration which is already available for directly connected PC peripherals with the existing Windows Plug and Play system For NAT routers the major feature of UPnP on the router is NAT Traversal This enables applications inside the firewall to automatically open the ports that they need to pass through a router It is more reliable than requiring a router to work out by itself which ports need to be opened Further the user does not have to manually set up port mappings or a DMZ UPnP is available on Windows XP and the router provides the associated support for MSN Messenger to allow full use of the voice video and messaging features Applications gt gt UPnP UPnP Enable UPnP Service Enable Connection control Service Enable Connection Status Service Note If you intend running UPnP service inside your LAN you should check the appropriate service above to allow control as well as the appropriate UPnP settings Enable UPNP Service Accordingly you can enable either the Connection Control Service or Connection Status Service Vigor3100 Series User s Guide 39 56 After setting Enable UPNP Service setting an icon of IP Broadband Connection on Router on Windows XP Network Connections will appear The connection status and control status will be able to be activated The NAT Traversal of UPnP enables the multimedia features of your applications to operate This has to m
96. k to clear all indexes User Display the username for the specific dial in user of the LAN to LAN profile The symbol represents that the profile is empty Status Display the access state of the specific dial in user The symbol V and X represent the specific dial in user to be active and inactive respectively Click each index to edit one remote user profile Each Dial In Type requires you to fill the different corresponding fields on the right If the fields gray out it means you may leave it untouched The following explanation will guide you to fill all the necessary fields VPN and Remote Access gt gt Remote Dial in User Index No 1 User account and Authentication v Enable this account Username r 300 second s Password Idle Timeout Allowed Dial In Type v ISDN v PPTP M IPSec Tunnel V L2TP with IPSec Policy None v Cl Specify Remote Node Remote Client IP or Peer ISDN Number or Peer ID IKE Authentication Method Pre Shared Key v Digital Signature x 509 22 IPSec Security Method v Medium AH High ESP Moies Mapes Maes Local ID optional Callback Function Cl Check to enable Callback function Specify the callback number Callback Number Check to enable Callback Budget Control Callback Budget 30 i minute s Check the box to enable this function Idle Timeout If the dial in user is idle over t
97. king and select the one s that you want to block To block selected IM applications during specific periods enter the number of the scheduler predefined in Applications gt gt Call Schedule Firewall gt gt IM Blocking Setup Instant Messenger Applications Blocking Setup 1Enable IM Blocking Black MSN Messenger Black Yahoo Messenger Black ICQ AGL Time Schedule Index 1 153 in Schedule Setup Mote Action and Idle Timeout settings will be ignored 3 4 5 P2P Blocking P2P is the short name of peer to peer Click Firewall and click P2P Blocking to open the setup page You will see a list of common P2P applications Check Enable P2P Blocking and select the one s to block To block selected P2P applications during specific periods enter the number of the scheduler predefined in Applications gt gt Call Schedule 44 Vigor3100 Series User s Guide Firewall gt gt P2P Blocking Setup Peer to Peer file sharing Applications Blocking Setup Enable P2P Blocking Protocol Applications Action Allow eDonkey eDonkey eMule Shareaza MLDonkey Disallow Disallow upload Allow FastTrack Kazaa iMesh MLDonkey Disallow BearShare Gnucleus Limewire Phex Swapper Allow cowie xalox Sh MLDank alor areaza onkey Design Allow BitTorrent BitTorrent Disallow Time Schedule Index 1 15 in Schedule Setup j F j EE Note Action and
98. le if you select ISDN This field is applicable when you select PPTP or L2TP w or w out IPSec policy above This field is also applicable if you select ISDN VJ Compression is used for TCP IP protocol header compression This field 1s applicable when you select PPTP or L2TP w or w out IPSec policy above This field is also applicable if you select ISDN IKE Authentication Method This group of fields is applicable for IPSec Tunnels and L2TP IPSec Security Method with IPSec Policy when you Specify ISDN CLID or Remote VPN Gateway Peer ISDN Number or Peer VPN Server IP The only exception is Digital Signature X 509 can be set when you select IPSec tunnel either w or w o specify the CLID or IP address of the remote node Pre Shared Key Input 1 63 characters as pre shared key Digital Signature X 509 Select one predefined in the X 509 Peer ID Profiles This group of fields is a must for IPSec Tunnels and L2TP with IPSec Policy when you specify the remote node Medium Authentication Header AH means data will be authenticated but not be encrypted By default this option is active High Encapsulating Security Payload ESP means payload data will be encrypted and authenticated You may select Vigor3100 Series User s Guide encryption algorithm from Data Encryption Standard DES Triple DES 3DES and AES Callback Function The callback function provides a callback service only for the ISDN dial in user The router
99. les to the PPPoE Internet access profile Now the PPPoE Internet connection will follow the schedule order to perform Force On or Force Down action according to the time plan that has been pre defined in the schedule profiles 3 5 3 RADIUS Remote Authentication Dial In User Service RADIUS is a security authentication client server protocol that supports authentication authorization and accounting which is widely used by Internet service providers It is the most common method of authenticating and authorizing dial up and tunneled network users The built in RADIUS client feature enables the router to assist the remote dial in user or a wireless station and the RADIUS server in performing mutual authentication It enables centralized remote access authentication for network management Vigor3100 Series User s Guide Applications gt gt RADIUS RADIUS Setup Destination Port 1812 Enable Check to enable RADIUS client feature Server IP Address Enter the IP address of RADIUS server Destination Port The UDP port number that the RADIUS server is using The default value is 1812 based on RFC 2138 Shared Secret The RADIUS server and client share a secret that 1s used to authenticate the messages sent between them Both sides must be configured to use the same shared secret Re type Shared Secret Re type the Shared Secret for confirmation 3 5 4 UPnP The UPnP Universal Plug and Play protocol 1s supported to bring to networ
100. lick it to force the router to establish a PPPoE or PPPoA connection 3 9 2 Dial out Trigger Click Diagnostics and click Dial out Trigger to open the web page Diagnostics gt gt Dial out Trigger Dial out Triggered Packet Header Refresh HEX Format 00 00 00 00 ao 00 00 00 ao ap ag O0O 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ag 00 00 00 00 00 00 00 00 00 OO 00 aa 00 00 00 00 00 00 00 00 00 00 00 00 00 ag 00 00 00 00 00 00 00 00 00 OO 00 aa aa 00 ag gag OO 00 00 po OO OO ad ao Decoded Format 0 0 0 0 gt 0 0 0 0 Pr 0 len 0 Refresh Click it to reload the page 3 9 3 Routing Table Click Diagnostics and click Routing Table to open the web page 84 Vigor3100 Series User s Guide Diagnostics gt gt View Routing Table Current Running Routing Table Refresh Kev C connected 5 static BR RIP default private us 0 0 0 0 0 0 0 0 via 192 168 1 1 IFO a 192 168 10 0 amp 55 255 255 0 via 192 168 1 2 IFO C 192 168 1 0 255 255 255 0 is directly connected IFO a 211 100 88 0 255 255 255 0 wia 192 168 1 3 IFO Refresh Click it to reload the page 3 9 4 ARP Cache Table Click Diagnostics and click ARP Cache Table to view the content of the ARP Address Resolution Protocol cache held in the router The table shows a mapping between an Ethernet hardware address MAC Address and an IP address Di
101. llback Budget If a PPP based service is selected you should further specify the remote peer IP Address Username Password and VJ Compression for this Dial In connection Vigor3100 Series User s Guide 89 Allowed Dial In Type ISDN Username draytek br v PPTP Password eeeseses IPSec Tunnel VJ Compression on O off L2TP with IPSec Policy IKE Authentication Method i Pre Shared K Cl SpecifyISDN CLID orRemote VPN Gateway eee ee ae Peer ISDN Number orPeer VPN Server IP L or Peer ID Digital Signature X 509 NENNEN IPSec Security Method Medium H High ESP DES 3DES AES Callback Function CBCP Enable Callback Function Use the Following Number to Callback Callback Number Callback Budget minute s 7 At last set the remote network IP subnet in TCP IP Network Settings so that Router A can direct the packets destined to the remote network to Router B via the VPN connection 4 TCP IP Network Settings My WAR IP RIP Direction TE RX Both 4 Remote Gateway IP 0 0 0 RIP Version EEmpLB meroa TD 182 168 20 For NAT operation treat remote sub net as Private IP Change default route to this YPN tunnel Remote Network Mask 255 255 255 More ale 5 C Settings in Router B in the remote office 1 Goto Remote Access Control to enable the necessary VPN service 2 Then for using PPP based services such as PPTP L2TP or ISDN you have to s
102. many efforts please contact your dealer for further help right away For any questions please feel free to send e mail to support draytek com Vigor3100 Series User s Guide 115 116 Vigor3100 Series User s Guide
103. n There are two phases of IKE IPSec gt Phase I negotiation of IKE parameters including encryption hash Diffie Hellman parameter values and lifetime to protect the following IKE exchange authentication of both peers using either a Pre Shared Key or Digital Signature x 509 The peer that starts the negotiation proposes all its policies to the remote peer and then remote peer tries to find a highest priority match with its policies Eventually to set up a secure tunnel for IKE Phase 2 gt Phase 2 negotiation IPSec security methods including Authentication Header AH and or Encapsulating Security Payload ESP for the following IKE exchange and mutual examination of the secure tunnel establishment Authentication Header AH provides data authentication and integrity for IP packets passed between VPN peers This is achieved by a keyed one way hash function to the packet to create a message digest This digest will be put in the AH and transmitted along with packets On the receiving side the peer will perform the same one way hash on the packet and compare the value with the one in the AH it receives Encapsulating Security Payload ESP is a security protocol that provides data confidentiality and protection with optional authentication and replay detection service Vigor supports IPSec used ESP to encrypt the data payload There are two encryption methods in IPSec Transport and Tunnel Transport mode encrypts only the data portion a
104. n user below 71 72 PPTP IPSec Tunnel L2TP Allow the remote dial in user to make a PPTP VPN connection through the Internet You should set the User Name and Password of remote dial in user below Allow the remote dial in user to trigger a IPSec VPN connection through Internet Allow the remote dial in user to make a L2TP VPN connection through the Internet You can select to use L2TP alone or with IPSec Select from below None Do not apply the IPSec policy Accordingly the VPN connection employed the L2TP without IPSec policy can be viewed as one pure L2TP connection Nice to Have Apply the IPSec policy first if it is applicable during negotiation Otherwise the dial in VPN connection becomes one pure L2TP connection Must Specify the IPSec policy to be definitely applied on the L2TP connection Specify ISDN CLID or Remote VPN Gateway You can specify the IP address of the remote User Name Password VJ Compression dial in user or peer ID should be the same with the ID setting in dial in type by checking the box Enter Peer ISDN number if you select ISDN above Also you should further specify the corresponding security methods on the right side If you uncheck the checkbox the connection type you select above will apply the authentication methods and security methods in the general settings This field is applicable when you select PPTP or L2TP w or w out IPSec policy above This field is also applicab
105. ndustry standards technology to provide customers with open interoperable VPN solutions such as X 509 DHCP over Internet Protocol Security IPSec up to 200 tunnels and Point to Point Tunneling Protocol PPTP 1 1 LED Indicators and Connectors The displays of LED indicators and connectors for the routers are different slightly For Vigor3100G Dray Tek ae QO Vigor3100G C iOS si ha Security Router PRN O wan FDX Oo o o O bot 1 1 Ld 5 For Vigor3300 Peay Tek ad QACT Oven LNK D000 j Vigor3 100 fia 600 _ LJ I G SHDSL Security Router Oprn O moooo V 1 3 7 DSL LAN PRN 1 1 1 LED Explanation LED SICH Explanation ACT The router is powered on and running properly Activity VPN The VPN tunnel is launched QoS The QoS function is active Printer The USB interface printer 1s ready Vigor3100 Series User s Guide I WLAN Blinking DSL 1 2 3 4 Off Blinking 1 1 2 Connector Explanation Interface Description The wireless LAN function is enabled Ethernet packets are transmitting over wireless LAN The G SHDSL line is connected It means that Ethernet packets are transmitting It means that a normal 100Mbps connection is through its corresponding port It means that a normal 1OMbps connection is through its corresponding port It means a full duplex connection It means a half duplex connection It means that a packet collision happens RST Fact
106. ndwidth Control Limited_bandwidth Ratio 25 86 Online Statistics Enable the QoS Control For V models the factory default for this is checked to enable Direction Define which traffic the QoS Control settings apply to IN apply to incoming traffic only OUT apply to outgoing traffic only BOTH apply to both incoming and outgoing traffic Index The group index number of QoS Control settings There are total 4 groups Class Name Define the name for the group index 58 Vigor3100 Series User s Guide Reserved Bandwidth Ratio It is reserved for the group index in the form of ratio of reserved bandwidth to upstream speed and reserved bandwidth to downstream speed Setup There are two level of settings Basic setup Reserved Bandwidth Ratio according to the traffic service type We provide a list of common service types Advance custom setting of Reserved Bandwidth Ratio based on the source address destination address DiffServ CodePoint and service type Enable UDP Bandwidth Control Check this and set the limited bandwidth ratio on the right field This is a protection of TCP application traffic since UDP application traffic such as streaming video will exhaust lots of bandwidth Limited bandwidth Ratio The ratio typed here is reserved for limited bandwidth of UDP application Basic button Click this button to open basic configuration for each index number Basic Configuration Class Index 1
107. ne of VPN peers wants to disconnect the connection it should follow a serial of packet exchange procedure to inform each other However if the remote peer disconnect without notice Vigor router will by no where to know this situation To resolve this dilemma by continuously sending PING packets to the remote host the Vigor router can know the true existence of this VPN connection and react accordingly Build ISDN dial out connection to the server You should set up Link Type and identity like User Name and Password for the authentication of remote server You can further set up Callback CBCP function below Build a PPTP VPN connection to the server through the Internet You should set the identity like User Name and Password below for the authentication of remote server Build a IPSec VPN connection to the server through Internet Build a L2TP VPN connection through the Internet You can select to use L2TP alone or with IPSec Select from below None Do not apply the IPSec policy Accordingly the VPN connection employed the L2TP without IPSec policy can be viewed as one pure L2TP connection Nice to Have Apply the IPSec policy first if it is applicable during negotiation Otherwise the dial out VPN connection becomes one pure L2TP connection Must Specify the IPSec policy to be definitely applied on the L2TP connection This field is applicable when you select PPTP or L2TP w or w out IPSec policy above This field is also a
108. nection More Add a static router to direct all traffic destined to more Remote Network IP Addresses Remote Network Mask through the VPN connection This is usually used when you find there are several subnets behind the remote VPN router RIP Direction The option specifies the direction of RIP Routing Information Protocol packets You can enable disable one of direction here Herein we provide four options TX RX Both TX Only RX Only and Disable RIP Version Select the RIP protocol version Specify Ver 2 for greatest compatibility For NAT operation treat remote sub net as While communicating with remote subnet the router can treat it as private subnet by sending packets with the router s private IP address or treat it as public subnet by sending packets with the router s public IP address 3 6 7 Connection Management You can find the summary table of all VPN connections You may disconnect any VPN connection by clicking Drop button You may also aggressively Dial out by using Dial out Tool and clicking Dial button Vigor3100 Series User s Guide T9 VPN and Remote Access gt gt Connection Management Dial out Tool VPN Connection Status Current Page 2 Refresh Seconds 10 Refresh test2 220 135 240 210 v YPN Type Remote IP Virtual Network Tx Pkts Tx Rate Rx Pkts Rx Rate UpTime Dial Refresh Seconds Refresh xxxxxxx Data is encrypted XXXXXXEX Data isn t encrypted Click thi
109. net Public IP Address 220 135 240 20 220 135 240 208 4 E 192 168 1 11 192 168 1 12 192 168 1 13 192 168 1 22 If you do not check Join NAT IP Pool you can still use these public IP addresses for other purpose such as DMZ host Open Ports Public IP Address 220 135 230 210 Public IP Address 220 1235 240 20 7 ee 9 192 168 1 22 192 168 1 11 192 168 1 12 192 168 1 13 Default MAC Address Type in MAC address for the router You can use Default MAC Address or specify another MAC address for your necessity MAC Address Type in the MAC address for the router manually Index 1 15 in You can type in four sets of time schedule for your request All the Schedule Setup schedules can be set previously in Application Schedule web page and you can use the number that you have set in that web page After finishing all the settings here please click OK to activate them 3 1 3 MPoA MPoA is a specification that enables ATM services to be integrated with existing LANs which use either Ethernet token ring or TCP IP protocols The goal of MPoA is to allow different LANs to send packets to each other via an ATM backbone 18 Vigor3100 Series User s Guide To choose MPoA as the accessing protocol of the internet please select MPoA from the Internet Access menu The following web page will be shown Internet Access gt gt MPoA RFC1483 2684 MPoA RFC1483 2684 Mode MPoA RFC1483 2684 O Enable Disable DSL Modem
110. nnne nnne nennen nnn nnn nena nnns 63 3 6 5 Remote Dial In USER T 64 30 6 LANT LAN c 67 3 6 7 Connection Managements ninnan enakane ENNE OEBE KEANNA Aei 73 3 7 Gertitcate Marnagermelll cc csinsssiwasinensisnasind E tind aa Yo Fa UR bt pam Fac ew rn wid EEES 74 SES BB ee EG GEM PRETI T TEES 75 3 7 2 Tr st d AG CF Mb CONC soca ccnienaaaicnctettaatenwaauisinesdeeaaanteneontaveautsleniamainienaaaisaaltantnetnnacmaniras 76 Duo OY SIC EE S EPIO s eptresiumpR E E E EE E E E 77 So Wes EEE 10 E E E E E E E A ee E eee DCN ANE 77 9 0 2 Administrator FaSS WO aoee E E rte aoa 78 Leo Gs aii e U1 ect a a1 6146 noa E a E O 78 9 90 2 OV SIO VG JOE cece sects acne oe see ceswecsonceace a a tesa cacao ENIM ME 80 io tone Ue Aaa UIN m T 81 SD Manageme ronisin Ena iea a ra oaeiae nii 82 9 9 7 HODOO SYSTEM saccte rcarataaeescate sonatscasuessagstemacseuseeanetacetiesseenteeaseteseaatedateestousstn seed nteeereboaesees 83 3 8 8 Firmware Upgrade TTE TD OE 83 BB TAOS e ccs eter tc ators iets cto saeesc 84 3 91 WAN COMECON M Rm 84 292 OU TOGO ETE TTE ED oT 84 ome pom ROUA TIO eee eee eee nee nee E E E E eee 84 39 4 A Cache ANG etsnssetientiu RI E AAE 85 3 95 DAGE Wall 85 3 9 6 NAT Sessions Tapie TT UEM 86 Application and Examples asnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn nnn 87 4 1 Create a LAN
111. numbers of these services servers are all the same you may need to reset the router s in order to avoid confliction For example the built in web configurator in the router is with default port 80 which may conflict with the web server in the local network http 192 168 1 13 80 Therefore you need to change the router s http port to any one other than the default port 80 to avoid conflict such as 8080 This can be set in the System Maintenance gt gt Management You then will access the admin screen of by suffixing the IP address with 8080 e g http 192 168 1 1 8080 instead of port 80 Management Setup Management Access Control anagement Port Setup Default Ports Telnet 23 HTTP 80 HTTPS Enable remote firmware upgrade FTP qus FTPL ZL LJ Allow management from the Internet 9 User Define Ports Disable PING fram the Internet Telnet Port HTTP Part Access List List IP Subnet Mask HTTPS Port 2 sd SNIP Setup S Enable SNMP Agent Manager Host IP Trap Community public il Notification Hast IP Trap Timeout seconds 3 3 2 DMZ Host As mentioned above Port Redirection can redirect incoming TCP UDP or other traffic on particular ports to the specific private IP address port of host in the LAN However other IP protocols for example Protocols 50 ESP and 51 AH do not travel on a fixed port Vigor router provides a facility DMZ Host that map ALL unsolicited data on any protocol to a
112. o activate the Port Scan detection Whenever detecting this malicious exploration behavior by monitoring the port scanning Threshold rate the Vigor router will send out a warning By default the Vigor router sets the threshold as 150 packets per second Vigor3100 Series User s Guide Block IP options Block Land Block Smurf Block trace router Block SYN fragment Block Fraggle Attack Block TCP flag scan Block Tear Drop Block Ping of Death Block ICMP Fragment Block Land Block Unknown Vigor3100 Series User s Guide Check the box to activate the Block IP options function The Vigor router will ignore any IP packets with IP option field in the datagram header The reason for limitation is IP option appears to be a vulnerability of the security for the LAN because it will carry significant information such as security TCC closed user group parameters a series of Internet addresses routing messages etc An eavesdropper outside might learn the details of your private networks Check the box to enforce the Vigor router to defense the Land attacks The Land attack combines the SYN attack technology with IP spoofing A Land attack occurs when an attacker sends spoofed SYN packets with the identical source and destination addresses as well as the port number to victims Check the box to activate the Block Smurf function The Vigor router will ignore any broadcasting ICMP echo request Check the box to enforce th
113. o be used for Dial in setting in the LAN to LAN Profile setup This item is optional Callback Function The callback function provides a callback service only for the ISDN dial in user The router owner will be charged the connection fee by the telecom Check to enable Callback function Enables the callback function Specify the callback number The option is for extra security Once enabled the router will ONLY call back to the specified Callback Number Check to enable callback budget control By default the callback function has a time restriction Once the callback budget has been exhausted the callback mechanism will be disabled automatically Callback Budget Unit minutes Specify the time budget for the dial in user The budget will be decreased automatically per callback connection 3 6 6 LAN to LAN Here you can manage LAN to LAN connections by maintaining a table of connection profiles You may set parameters including specified connection direction dial in or dial out connection peer ID connection type ISDN VPN including PPTP IPSec Tunnel and L2TP by itself or over PSec and corresponding security methods etc The router provides up to 32 profiles which also means supporting 32 VPN tunnels simultaneously The following figure shows the summary table VPN and Remote Access gt gt LAN to LAN LAN to LAN Profiles Setto Factory Default Index Name Status Index Name Status 1 pos 7 g ps 7 2 Tn 5 10 deno
114. ocal private IP address of the server or you should set up an alias in a Windows hosts file Please only redirect the ports you know you have to forward rather than forward all ports Otherwise you will compromise the firewall type security initially deployed by the NAT facility To use this function please go to NAT page and choose Port Redirection web page The Port Redirection Table provides 10 port mapping entries for the internal hosts NAT gt Configure Port Redirection Table Port Redirection Table Index Service Name 2 D O ee w Service Name Protocol Public Port 32 6 J I n L B8 BR A A n a 16 n a bL 6 n a b 5 n a 6 n a BR L bE n a B L E n a 16 n a 16 n Enter the description of the specific network service Select the transport layer protocol TCP or UDP Specify which port can be redirected to the specified Private IP and Port of the internal host Vigor3100 Series User s Guide Private IP Specify the private IP address of the internal host providing the service Private Port Specify the private port number of the service offered by the internal host Active Check this box to activate the port mapping entry you have defined Note that the router has its own built in services servers such as Telnet HTTP and FTP etc Since the common port
115. odes from web pages It s very common that malicious codes conceal in the executable objects such as ActiveX Java Applet compressed files and other executable files Once downloading these types of files from websites you may risk bringing threat to your system For example an Vigor3100 Series User s Guide 39 40 ActiveX control object is usually used for providing interactive web feature If malicious code hides inside it may occupy user s system Web Filtering We all know that the content on the Internet just like other types of media may be inappropriate sometimes As a responsible parent or employer you should protect those in your trust against the hazards With Web filtering service of the Vigor router you can protect your business from common primary threats such as productivity legal liability network and security threats For parents you can protect your children from viewing adult websites or chat rooms Once you have activated your Web Filtering service in Vigor router and chosen the categories of website you wish to restrict each URL address requested e g www bbc co uk will be checked against our server database powered by SurfControl The database covering over 70 languages and 200 countries over 1 billion Web pages divided into 40 easy to understand categories This database is updated as frequent as daily by a global team of Internet researchers The server will look up the URL and return a category to your route
116. ork Vigor3100 Series User s Guide 97 AF calss 1 low drop AF calss 2 medium drop DS domain 1 DS domain 2 Private network However each node may take different attitude toward packets with high priority marking since it may bind with the business deal of SLA among different DS domain owners It s not easy to achieve deterministic and consistent high priority QoS traffic throughout the whole network with merely Vigor router s effort For more effective QoS deployment you should check the available ADSL upstream and downstream speed in Online Status as indicated below before you configure the QoS setting ADSL Information ADSL Firmware version D 15 2 1 5 ATH Statistics TX Blocks RX Blocks Corrected Blocks Uncorrected Blocks B64834317 17414603 0 2e ADSL Status Mode State Up Speed Down Speed SNR Margin Loop Att a DMT SHO TIME 26000 2048000 32 0 2 e0 The following QoS policies will be defined in the form of ratio of upstream downstream speed We will also provide application QoS requirement as reference to help you accomplish this task The setting values will vary depending on the network condition Click on Application gt gt QoS Control The following screen will appear Applications gt gt QoS Control Setup Qos Control Setup Set to Factory Default Enable the QoS Control Direction Index Class Name Reserved bandwidth Ratio Setup 1 fen NNNM 2 B 5 B k 4 Others Ee Enable UDP Ba
117. ory Reset Restore the default settings Usage Turn on the router ACT LED is blinking Press the hole and keep for more than 5 seconds When you see the ACT LED begins to blink rapidly than usual release the button Then the router will restart with the factory default configuration Connect the G SHDSL line to access the Internet DSL LAN 1 2 3 4 Connect to the local networked devices PRN Printer Connect to the USB printer 1 2 Hardware Installation Before starting to configure the router you have to connect your devices correctly l Connect the DSL port of the router to the wall outlet with a RJ 11 to RJ 45 or RJ 45 to RJ 45 cable 2 Connect one port of 4 port switch to your computer with a RJ 45 cable 3 Connect one end of the power cord to the power port of the router Connect the other end to the wall outlet of electricity 4 Connect detachable antennas to the router for Vigor3100G 5 Power on the router 6 Check the ACT and WAN LAN LEDs to assure network connections For the detailed information of LED status please refer to section 1 1 Vigor3100 Series User s Guide Dray Tek Vigor3100G G SHDSL Security Router 1 2 1 Chassis Connections The Vigor3100 series can be mounted on a rack by using standard brackets in a 19 inch rack or optional larger brackets on 23 inch rack not included The bracket for the racks are shown below Vigor3100 Series User s Guide gt Use
118. oup allows you to obtain an IP address automatically and DSL Modem Settings provided by ISP RIP Protocol Bridge Mode invoke the function WAN IP Network Settings allows you type in IP address manually Obtain an IP address automatically Click this button to obtain the IP address automatically Router Name Type in the router name provided by ISP Domain Name Type in the domain name that you have assigned WAN IP Alias If you have multiple public IP addresses and would like to utilize them on the WAN interface please use WAN IP Alias Vigor3100 Series User s Guide 19 20 You can set up to 8 public IP addresses other than the current one you are using E WAN IP Alias Microsoft Internet Explorer WAN IP Alias Multi NAT Index Enable Aux WAN IP Join NAT IP Pool fool Anon Anon v Specify an IP address Click this radio button to specify some data IP Address Type in the private IP address Subnet Mask Type in the subnet mask Gateway IP Address Type in gateway IP address Default MAC Address Type in MAC address for the router You can use Default MAC Address or specify another MAC address for your necessity MAC Address Type in the MAC address for the router manually DNS Server IP Type in the primary IP address for the router If necessary type in Address secondary IP address for necessity in the future After finishing all the settings here please click OK to activate them 3
119. owner will be charged the connection fee by the telecom Check to enable Callback function Enables the callback function Callback number The option is for extra security Once enabled the router will ONLY call back to the specified Callback Number Callback budget By default the callback function has limitation of callback period Once the callback budget is exhausted the function will be disabled automatically Callback Budget Unit minutes Specify the time budget for the dial in user The budget will be decreased automatically per callback connection The default value 0 means no limitation of callback period My WAN IP This field is only applicable when you select PPTP or L2TP w or w out IPSec policy above The default value 1s 0 0 0 0 which means the Vigor router will get a WAN IP address from the remote router during the IPCP negotiation phase If the WAN IP address is fixed by remote side specify the fixed IP address here Remote Gateway IP This field is only applicable when you select PPTP or L2TP w or w out IPSec policy above The default value is 0 0 0 0 which means the Vigor router will get a remote Gateway IP address from the remote router during the IPCP negotiation phase If the WAN IP address is fixed by remote side specify the fixed IP address here Remote Network IP Remote Network Mask Add a static router to direct all traffic destined to this Remote Network IP Address Remote Network Mask through the VPN con
120. pplicable if you select ISDN This field is applicable when you select PPTP or L2TP w or w out IPSec policy above This field is also applicable if you select ISDN This field is applicable when you select PPTP or L2TP w or w out IPSec policy above This field is also applicable if you select ISDN PAP CHAP is the most common selection due to wild compatibility This field is applicable when you select PPTP or L2TP w or w out IPSec policy above This field is also applicable if you select ISDN VJ Compression is used for TCP IP protocol header compression Normally set to Yes to improve bandwidth utilization IKE Authentication Method This group of fields 1s applicable for IPSec Tunnels and IPSec Security Method Vigor3100 Series User s Guide L2TP with IPSec Policy Pre Shared Key Input 1 63 characters as pre shared key Digital Signature X 509 Select one predefined in the X 509 Peer ID Profiles This group of fields is a must for IPSec Tunnels and L2TP with IPSec Policy 69 70 Medium Advanced Authentication Header AH means data will be authenticated but not be encrypted By default this option 1s active High Encapsulating Security Payload ESP means payload data will be encrypted and authenticated Select from below DES without Authentication Use DES encryption algorithm and not apply any authentication scheme DES with Authentication Use DES encryption algorithm and apply MD5 or SHA 1 authenti
121. ptiveRate MaxRate MinRate 72 O FixedRate Terminal Type AnnexType AdaptiveRate Set the connection rate for the network MaxRate Select the maximum rate for this setting Use the drop down list to select the one that suits your router The default value is 2312 MinRate Select the minimum rate for this setting Use the drop down list to select the one that suits your router The default value is 72 FixedRate If you select this one only the fixed value is useful Terminal Type Determine the role of this device as a CPE or CO Annex Type Choose the correct annex type A or B for your router 3 2 LAN Local Area Network LAN is a group of subnets regulated and ruled by router The design of network structure is related to what type of public IP addresses coming from your ISP 3 2 1 Basics of LAN The most generic function of Vigor router is NAT It creates a private subnet of your own As mentioned previously the router will talk to other public hosts on the Internet by using public IP address and talking to local hosts by using its private IP address What NAT does is to translate the packets from public IP address to private IP address to forward the right packets to the right host and vice versa Besides Vigor router has a built in DHCP server that assigns private IP address to each local host See the following diagram for a briefly understanding Internet Public IP Address eee X s X ESE LSS 24 A o
122. r Your Vigor router will then decide whether to allow access to this site according to the categories you have selected Please note that this action will not introduce any delay in your Web surfing because each of multiple load balanced database servers can handle millions of requests for categorization 3 4 2 General Setup General Setup allows you to adjust settings of IP Filter and common options Here you can enable or disable the Call Filter or Data Filter Under some circumstance your filter set can be linked to work in a serial manner So here you assign the Start Filter Set only Also you can configure the Log Flag settings Enable Stateful packet inspection Apply IP filter to VPN incoming packets Drop non http connection on TCP port 80 and Accept incoming fragmented UDP packets Click Firewall and click General Setup to open the general setup page Firewall General Setup General Setup Call Filter 9 Enable Start Filter Set Set l v O Disable Data Filter 9 Enable Start Filter Set Set 2 v O Disable Log Flag None K Cl Enable stateful packet inspection Apply IP filter to VPN incoming packets Drop non http connection on TCP port 80 v Accept incoming fragmented UDP packets for some games ex CS Call Filter Check Enable to activate the Call Filter function Assign a start filter set for the Call Filter Data Filter Check Enable to activate the Data Filter function Assign a start filter set for the Da
123. r E mail Address The box under the Type will appear according to the type you select and ask you to fill in corresponding setting Accept Subject Name Click to check the specific fields of digital signature to accept the peer with matching value The field includes Country C State ST Location L Organization O Organization Unit OU Common Name CN and Email E 3 6 5 Remote Dial In User You can manage remote access by maintaining a table of remote user profile so that users can be authenticated to dial in or build the VPN connection You may set parameters including specified connection peer ID connection type ISDN VPN including PPTP IPSec Tunnel and L2TP by itself or over IPSec and corresponding security methods etc The router provides 32 access accounts for dial in users Besides you can extend the user accounts to the RADIUS server through the built in RADIUS client function The following figure shows the summary table Vigor3100 Series User s Guide VPN and Remote Access gt gt Remote Dial in User Remote Access User Accounts Setto Factory Default Index User Status Index User Status le Gay H gu TTT a FB TTT n 10 TTT 5 3 PPF 5 ii TTT 5 4 nm B 12 TT 5 J TEF 13 TES s b mum E 14 TTT H TTT 5 15 TTT 5 g TTT B 16 TTT s lt e 146 1732 gt gt 7 Next gt gt Status v Active s Inactive Set to Factory Default Clic
124. ries Dmt Bis eS E p LAN Status TX Packets RX Packets WAN IP Fixed RX Packets TX Rate Firewall Log VPN Log User Access Log CallLog WAN Log BudgetLog Network Infomation Net State Time Host Message Jan 1 00 00 42 Vigor DoS syn flood Block 10s 192 168 1 115 10605 gt 192 168 1 1 23 PR 6 tcp len 20 40 3943751 Jan 1 00 00 34 Vigor Dos cmp flood Block 10s 192 168 1 115 gt 192 168 1 1 PR 1 fiemp len 20 60 icmp 0 8 Q ADSL Status Mode State Up Speed Down Speed SNR Margin Loop Att T1 413 HANDSHAKE 0 0 3 4 7 URL Content Filter Based on the list of user defined keywords the URL Content Filter facility in Vigor router inspects the URL string in every outgoing HTTP request No matter the URL string is found full or partial matched with a keyword the Vigor router will block the associated HTTP connection For example 1f you add key words such as sex Vigor router will limit web access to web sites or web pages such as www sex com www backdoor net images sex p 386 html Or you may simply specify the full or partial URL such as www sex com or sex com Also the Vigor router will discard any request that tries to retrieve the malicious code Click Firewall and click URL Content Filter to open the setup page A8 Vigor3100 Series User s Guide Firewall gt gt URL Content Filter Content Filter Setup Enable URL Access Control Black List block
125. rmware Version R3 0 1 ATM Statistics TX Blocks RX Blocks Corrected Blocks Uncorrected Blocks 0 0 0 ADSL Status Mode State Up Speed Down Speed SNR Margin Loop Att G 991 2 HANDSHAKE 0 0 0 0 0 0 2 2 3 Bridged IP Click 1483 Bridged IP as the protocol Type in all the information that your ISP provides for this protocol Quick Start Wizard 2 Connect to Internet Protocol Encapsulation 1483 Bridged IP LLC v Fixed IP Oves QONo Dynamic IP IP Address 182 158 1 1 Subnet Mask 255 255 255 0 Default Gateway 192 165 1 1 Primary DNS Second DNS Finish After finishing the settings in this page click Next to see the following page 4 Please confirm your settings VPI LH VCI 35 Protocol Encapsulation 1483 Bridge LLC Fixed IP Yes IP Address 192 168 1 100 Subnet Mask 255 255 255 Default Gateway 192 168 1 1 Primary DNS Secondary DNS Click Finish The online status of this protocol will be shown as below Vigor3100 Series User s Guide 10 Online Status system Status System Uptime 0 0 50 LAN Status Primary DNS 194 109 6 66 Secondary DNS 194 898 0 1 IP Address TX Packets RX Packets 192 158 1 1 415 352 W AN Status GW IP Addr Mode IP Address TX Packets TX Rate RX Packets RX Rate Up Time oO 00 00 00 ADSL Information ADSL Firmware Version R3 0 15 ATK Statistics TX Blocks RX Blocks Corrected Blocks Uncorrected Blocks 0 0 0 0 ADSL Status
126. rnet TCP IP and DHCP Setup LAN IP Network Configuration For WAT Usage ist IP Address 182 158 1 1 ist Subnet Mask 455 255 255 I For IP Routing Usage Enable 9 Disable 2nd IP Address 182 158 2 1 2nd Subnet Mask 255 255 255 0 2nd Subnet DHCP Server i RIP Frotocol Control Vigor3100 Series User s Guide DHCP Server Configuration Q Enable Served Disable Server Relay Agent Q 1st Subnet 2nd Subnet 132 158 1 10 132 158 1 1 Start IP Address IP Pool Counts Gateway IP Address DHCP Server IP Address 182 168311 for Relay Agent DNS Server IP Address Force DNS manual setting Secondary IP Address fs Primary IP Address 101 4 5 LAN Created by using A Public Subnet An example of setting Vigor router for IP routing of public subnet and the corresponding deployment are shown below LAN gt gt General Setup Ethernet TCP IP and DHCP Setup LAN IP Network Confiquration DHCP Server Configuration For NAT Usage O Enable Server 9 Disable Server 1st IP Address 132 168 1 1 Relay Agent O 1st Subnet 2nd Subnet ist Subnet Mask 755 255 255 0 Start IP Address 182 158 1 10 For IP Routing Usage Enable 9 Disable IP Pool Counts nd IP Address 132 158 2 1 Gateway IP Address 192 168 1 1 2nd Subnet Mask 255 255 255 0 DHCP Server IP Address 182 158 3 11 TST PaaS for Relay Agent DAS Server IP Address C Force DNS manual setting RIP Protocol Contral Secondary IP Address You can just s
127. rom program menu fag Router Tools V2 54 G About Router Tools FF Ez Configurator Yigor2100 Series ER Firmware Uperade Utility l Uninstall Router Tools 2 5 4 Visit DrayTek Web Site From the Syslog screen select the router you want to monitor Be reminded that in Network Information select the network adapter used to connect to the router Otherwise you won t succeed in retrieving information from the router Vigor3100 Series User s Guide i DrayTek Syslog x Controls 192 168 1 1 ae WAN Status BABIA e Sron nme ma LAN Status TX Packets RX Packets WAN IP Fixed RX Packets TX Rate 961 759 Firewall Log VPN Log User AccessLog CalLos WAN Log Network Infomation NetState Om Line Routers Host Name nikt pc IP Address Mask MAC NIC Description Realtek RTL8139 Family PCI Fest Ethernet NIC HAGA log TT 2552552550 OU MIC Information MAC Address 00 0E 6 24 D5 1 Default Geteway 192 16811 IP Address 192 168 1 10 DHCP Server 192 168 1 1 Subnet Mesk 2552552550 Mix Wed Apr 06 16 59 40 2005 DNS Servers Lease Expires Sat Apr 09 16 59 40 2005 ADSL Status Mode State Up Speed Down Speed SNR Margin Loop Att aun ee Econ 3 8 5 Time and Date It allows you to specify where the time of the router should be inquired from System Maintenance gt gt Time and Date Time Information Current System Time 2000 Jan
128. rs Wildcards Backup Mx Service Provider Select the service provider for the DDNS account Service Type Select a service type Dynamic Custom Static Domain Name Type in a domain name that you applied previously Login Name Type in the login name that you set for applying domain Password Type in the password that you set for applying domain 4 Click OK button to activate the settings You will see your setting has been saved Dynamic DNS Setup Enable Dynamic DNS Setup Accounts Index Domain Name Active 1 chranani dyndns aorg v A cm x 3 E x The Wildcard and Backup MX features are not supported for all Dynamic DNS providers You could get more detailed information from their websites Disable the Function and Clear all Dynamic DNS Accounts Vigor3100 Series User s Guide In the DDNS setup menu uncheck Enable Dynamic DNS Setup and push Clear All button to disable the function and clear all accounts from the router Delete a Dynamic DNS Account In the DDNS setup menu click the Index number you want to delete and then push Clear AII button to delete the account 3 5 2 Schedule The Vigor router has a built in real time clock which can update itself manually or automatically by means of Network Time Protocols NTP As a result you can not only schedule the router to dialup to the Internet at a specified time but also restrict Internet access to certain hours so that users can connect to the Internet onl
129. s showing the system interaction with you All Rights Reserved Ready indicates the system is ready for you to input settings Settings Saved means your settings are saved once you click Finish or OK button Vigor3100 Series User s Guide 13 14 Vigor3100 Series User s Guide Advanced Web Configuration After finished basic configuration of the router you can access Internet with ease For the people who want to adjust more setting for suiting his her request please refer to this chapter for getting detailed information about the advanced configuration of this router As for other examples of application please refer to chapter 4 3 1 Internet Access 3 1 1 Basics of Internet Protocol IP Network IP means Internet Protocol Every device in an IP based Network including routers print server and host PCs needs an IP address to identify its location on the network To avoid address conflicts IP addresses are publicly registered with the Network Information Centre NIC Having a unique IP address is mandatory for those devices participated in the public network but not in the private TCP IP local area networks LANs such as host PCs under the management of a router since they do not need to be accessed by the public Hence the NIC has reserved certain addresses that will never be registered publicly These are known as private IP addresses and are listed in the following ranges 18 From 10 0 0 0 to 10 255 255 255
130. s User s Guide eoa Terminal bash 80x24 Last login Sat Jan 3 Hz 24 18 on ttvpi Welcome to Darwin VigorlB dravtekt ping 192 168 1 1 PING 192 158 1 1 192 158 1 1 56 data bytes 54 bytes from 192 158 1 1 icmp seg H ttl 255 timezH 755 ms 54 bytes from 192 158 1 1 icmp seg 1 ttl 255 time H 5627 ms 54 bytes from 192 168 1 1 icmp seqg zz ttlz255 timezH 716 ms 64 bytes from 192 158 1 1 icmn seqgz3 ttl 255 timezH 731 ms 64 bytes from 192 155 1 1 icmp seq 4 ttl 255 timezH 72 ms D 192 168 1 1 ping statistics 5 packets transmitted 5 packets received HX packet loss round trip minzavgz max B 697 B 723 H 755 ms VigoriB draytekf B 5 4 Checking If the ISP Settings are OK or Not Click Internet Access Setup group and then check whether the ISP settings are set correctly For PPPoE PPPoA Users l Check if the Enable option is selected 2 Check if all parameters of DSL Modem Settings are entered with correct values that you got from your ISP 3 Check if Username and Password are entered with correct values that you got from your ISP Internet Access gt gt PPPoE PPPoA PPPoE PPPoA Client Mode PPPoE PPPoA Client Enable O Disable ISP Access Setup ISP Name hinet DBE Modam setings Username 666237 21 hinet net Multi PVC channel Channel 1 v zd Password eecese YPI D PPP Authentication PAP or CHAP x VCI 33 n ri Always On Encapsulating Type LLC SNAP i arr m Idle Timeo
131. s button to execute dial out function Choose the time for refresh the dail information among 5 10 an 30 Click this button to refresh the whole connection status VPN and Remote Access VPN Connection Management Dial out Tool Refresh Seconds fio Refresh YPN Connection Status Current Page 1 YPN Type IPSec Tunnel AH MD5 Auth IPSec Tunnel AH MOS Auth IPSec Tunnel AH MOS Auth IPSec Tunnel AH MOS Auth Remote IP 192 1568 2 24 192 1628 2 259 192 1568 2 25 192 168 2 27 Next Virtual Network Tx Pkts Tx Rate Rx Pkts Rx Rate UpTime 192 168 22 0 24 7 0 1 2 Drop 1232 168 23 0 24 1 2 Drop 192 158 24 0 24 px Drap 132 1568 25 0 24 0 Drap XXEXXEMM Data is encrypted HEXEERMEE Data isn t encrypted 3 7 Certificate Management A digital certificate works as an electronic ID which is issued by a certification authority CA It contains information such as your name a serial number expiration dates etc and the digital signature of the certificate issuing authority so that a recipient can verify that the certificate is real Here Vigor router support digital certificates conforming to standard X 509 Any entity wants to utilize digital certificates should first request a certificate issued by a CA server It should also retrieve certificates of other trusted CA servers so it can authenticate the peer with certificates issued by those trusted CA servers Here you can manage generate and m
132. s may start the VPN connection 1 Common Settings Profile Name Branch Enable this profile Call Direction Bath Dial Out Dial In LJ Always on Idle Timeout 300 l second s LJEnable PING to keep alive PING to the IP 5 Set Dial Out Settings as shown below to dial to connect to Router B aggressively with the selected Dial Out method If an IPSec based service is selected you should further specify the remote peer IP Address IKE Authentication Method and IPSec Security Method for this Dial Out connection Type of Server I am calling O ISDN PPTP IPSec Tunnel OL2TP with IPSec Policy Dial Number for ISDN or Server IP Host Name for VPN such as5551234 draytek com or 123 45 67 89 220 135 240 210 Link Type Username Password PPP Authentication VJ Compression On Off IKE Authentication Method 9 Pre Shared Key IKE Pre Shared Key 9900000990 Digital Signature X 509 IPSec Security Method Medium AH 9 High ESP DES without Authentication Scheduler 1 15 ERO a Callback Function CBCP Require Remote to Callback Provide ISDN Number to Remote If a PPP based service is selected you should further specify the remote peer IP Address Username Password PPP Authentication and VJ Compression for this Dial Out connection 88 Vigor3100 Series User s Guide Type of Server I am calling O ISDN 9 PPTP O IPSec Tunnel OL2TP with IPSec Policy Dial Number for ISD
133. s well as the appropriate NAT settings such as DMZ or open port 60 Vigor3100 Series User s Guide VPN and Remote Access Remote Access Control Setup Remote Access Control Setup Enable PPTP YPN Service Enable IPSec YPN Service Enable LATP YPN Service Enable ISDN Dial In Note If you intend to run a UPnP service inside your LAN you should check an appropriate service above to allow control as well as the appropriate UPnP settings 3 6 2 PPP General Setup This submenu only applies to PPP related VPN connections such as PPTP L2TP L2TP over IPSec VPN and Remote Access gt gt PPP General Setup PPP General Setup PPP MP Protocol IP Address Assignment for Dial In Users Dial In PPP PAP or CHAP Start IP Address 182 158 1 200 Authentication a CU x MPPE Optional MPPE Mutual Authentication PAP O es 9 Na Dial In PPP Authentication PAP Only Select this option to force the router to authenticate dial in users with the PAP protocol PAP or CHAP Selecting this option means the router will attempt to authenticate dial in users with the CHAP protocol first If the dial in user does not support this protocol it will fall back to use the PAP protocol for authentication Dial In PPP Encryption MPPE Optional MPPE This option represents that the MPPE encryption method will be optionally employed in the router for the remote dial in user If the remote dial in user does not support the MPPE encr
134. ss Primary IP Address Secondary IP Address 5 5 Backing to Factory Default Setting If Necessary 114 Sometimes a wrong connection can be improved by returning to the default settings Try to reset the router by software or hardware Warning After pressing factory default setting you will loose all settings you did before Make sure you have recorded all useful settings before you pressing The password of factory default is null Software Reset You can reset router to factory default via Web page Go to System Maintenance gt gt Reboot System on the web page The following screen will appear Choose Using factory default configuration and click OK After few seconds the router will return all the settings to the factory settings System Maintenance gt gt Reboot System Reboot System Do You want to reboot your router Q using current configuration 9 Using factory default configuration Hardware Reset While the router is running ACT LED blinking press the RST button and hold for more than 5 seconds When you see the ACT LED blinks rapidly please release the button Then the router will restart with the default configuration Vigor3100 Series User s Guide Dray Tek LI X Char um D Co After restore the factory default setting you can configure the settings for the router again to fit your personal request 5 6 Contacting Your Dealer If the router still cannot work correctly after trying
135. ssword Remember my password 3 Now the Main Screen will pop up Vigor3100 Series User s Guide Vigor3100 Seri G SHDSL Router System Status Dray Tek www draytek com Quick Start Wizard Online Status Model Name Vigor3100 series i A Firmware Version v2 6 0 Hein Wei Build Date Time Mon Aug 29 10 41 6 24 2005 NAT cce LAN W AN Applications MAC Address D0 50 7 F 00 00 00 MAC Address D0 50 7 F 00 00 01 VPN and Remote Access 1st IP Address 192 168 1 1 Connection Wireless LAN ist Subnet Mask 255 255 255 0 IP Address one System Maintenance DHCP Server Yes Default Gateway Jas Diagnostics DNS 194 109 6 66 All Rights Reserved Wireless LAN MAC Address Frequency Domain v1 46 01 24 5 2 Firmware Version 00 08 22 00 03 3a FCC lt 4 Go to System Maintenance page and choose Administrator Password System Maintenance gt gt Administrator Password Setup Administrator Password 5 Enter the login password the default is blank on the field of Old Password Type a new one in the field of New Password and retype it on the field of Confirm Password Then click OK to continue 6 Now the password has been changed Next time use the new password to access the Web Configurator for this router Connect to 192 168 1 1 E User name Password ecce Remember my password Vigor3100 Series User s Guide 2 2 Quick St
136. ta Filter Log Flag For troubleshooting needs you can specify the filter log here None The log function is not activated Vigor3100 Series User s Guide Block All blocked packets will be logged Pass All passed packets will be logged No Match The log function will record all packets that are not matched Note that the filter log will be displayed on the Telnet terminal when you type the log f command Some on line games for example Half Life will use lots of fragmented UDP packets to transfer game data Instinctively as a secure firewall Vigor router will reject these fragmented packets to prevent attack unless you enable Accept Incoming Fragmented UDP Packets By checking this box you can play these kinds of on line games If security concern is in higher priority you cannot enable Accept Incoming Fragmented UDP Packets 3 4 3 Filter Setup Click Firewall and click Filter Setup to open the setup page Firewall gt gt Filter Setup Filter Setup Set to Factory Default Set Comments Set Comments UB Default Call Filter T 2 Default Data Filter Bg 3 fh 4 10 J ila 5 12 To edit or add a filter click on the set number to edit the individual set The following page will be shown Each filter set contains up to 7 rules Click on the rule number button to edit each rule Check Active to enable the rule Firewall gt gt Filter Setup gt gt Edit Filter Set Filter Set 1 Comments Default Call F
137. those matching keyword White List pass those matching keyword Mo ACT Keyword Keyword 00 fC s e2 DO 1 5 DD fj 7 DE E Lo Cd od Cd Note that multiple keywords are allowed to specify in the blank For example hotmail yahoo msn Prevent web access from IP address Enable Restrict Web Feature Java Activex Cookie Proxy Enable Excepting Subnets IP Address LLL Ut d LL LL z IC OIC Ma Act 1 2 3 4 Time Schedule Compressed files Executable files Multimedia files LL C Index 1 15 in Schedule Setup jJ E Mate Action and Idle Timeout settings will be ignored Enable URL Access Control Black List block those matching keyword White List pass those matching keyword Keyword Prevent web access from IP address Vigor3100 Series User s Guide Check the box to activate URL Access Control Click this button to restrict accessing into the corresponding webpage with the keywords listed on the box below Click this button to allow accessing into the corresponding webpage with the keywords listed on the box below The Vigor router provides 8 frames for users to define keywords and each frame supports multiple keywords The keyword could be a noun a partial noun or a complete URL string Multiple keywords within a frame are separated by space comma or semicolon In addition the maximal length of each frame is 32 character long
138. to LAN connection between remote office and headquarter 87 4 2 Create a remote dial in user connection between the teleworker and headquarter 94 AS QOS Seting EX GI ENERO 98 4 4 LAN Created by Using NAT ccccccsccsssccsssesussecussccususeususenseuuueeususeeuuceauueseurscensscausersesensics 99 4 5 LAN Created by using A Public Subnet eeeeeeeeessssseeeeeeeennn eene 102 4 6 Request a certificate from a CA server on Windows CA Server eeeeeessseee 103 4 7 Request a CA Certificate and Set as Trusted on Windows CA Server 106 Vigor3100 Series User s Guide Trouble STOO m 109 5 1 Checking If the Hardware Status Is OK or Not c cssessseseeeeeeeeeeeeeeeeeeeeaaaaasesseeeeeeeeeeeeees 109 5 2 Checking If the Network Connection Settings on Your Computer Is OK or Not 109 5 3 Pinging the Router from Your Computer ccccccccsseeeeeeeeeeeeaeeeseeeeeeeeeeaseeseeeeeeeeesaaseeseeeees 112 5 4 Checking If the ISP Settings are OK Or Not eeeesssseseseeeeeeeenn mms 113 5 5 Backing to Factory Default Setting If Necessary eesssseeeeeenne 114 5 6 Contacting Your Dealer ussaetiorckasivitase vea gesd asus vata citi podus e saog uid xad fux vdvitodusc cata vig des aaia 115 Vigor3100 Series User s Guide 1 Preface Target
139. type in IP address to specify certain host Trap Community Set trap community by typing a proper name The default setting is public Notification Host IP Set the IP address of the host that will receive the trap community Trap Timeout The default setting is 10 seconds 3 8 7 Reboot System The Web Configurator may be used to restart your router Click Reboot System from System Maintenance to open the following page System Maintenance gt gt Reboot System Reboot System Do You want to reboot your router Using current configuration O using factory default configuration If you want to reboot the router using the current configuration check Using current configuration and click OK To reset the router settings to default values check Using factory default configuration and click OK The router will take 5 seconds to reboot the system 3 8 8 Firmware Upgrade Before upgrading your router firmware you need to install the Router Tools The Firmware Upgrade Utility is included in the tools The following steps will guide you to upgrade firmware In the following we use an example to explain the firmware upgrade Note that this example is running over Windows OS Operating System Download the newest firmware from DrayTek s web site or FTP site The DrayTek web site is www draytek com or local DrayTek s web site and FTP site is ftp draytek com Click System Maintenance gt gt Firmware Upgrade to launch the Firmware Upgrad
140. ut 180 second s Protocol PPPoE v l IP Address From ISP WAN IP Alias Modulation Multimode _ Fixed IP O Yes No Dynamic IP PPPoE Pass through Fixed IP Address O For wired LAN a Fl For wireless LAN Required for some ISPs 9 Default MAC Address ISDN Dial Backup Setup O Specify a MAC Address Dial Backup Mode None i MAC Address l oo 50 17F 127 428 AB Scheduler 1 15 Vigor3100 Series User s Guide 113 For MPoA RFC1483 2684 Users l Check if the Enable option is selected 2 Check if all parameters of DSL Modem Settings are entered with correct values that you got from your ISP 3 Check if IP Address Subnet Mask and Gateway are set correctly or use DHCP server to obtain IP automatically by clicking Obtain an IP address automatically Internet Access MPoA RFC1483 2684 MPoA RFC1483 2684 Mode MPoA RFC1483 2684 O Enable 9 Disable WAN IP Network Settings O Obtain an IP address automatically DSL Modem Settings Biputer Name Multi P C channel Select M PVCs channel s n omain Name Rios WAN IP Alias 1483 Routed IP LLC v Specify an IP address IP Address 0 0 0 0 YPI Subnet Mask 0 0 0 0 VCI 33 Te Gat IP Add Modulation Multimode aii inu g ISDN Dial Backup Setup Required for some ISPs Default MAC Address Dial Backup Mode None vi a O Specify a MAC Address MAC Address RIP Protocol E Enable RIP 00 150 IZE 27 128 AB DNS Server IP Addre
141. ved Request BEGIN CERTIFICATE REQUEST MIIBqjCCARMCAQAwQTELMAKGA1UEBhMCVFCXxEDAO _ Base64 Encoded BgkqhkiG9SwOBCQEVEXByZXNzQGRyYX1O0ZWsuY29t Certificate Request A4GNADCBiOKBgODQYB7wmzFfFhN9 IeQnGD03Xk PKCS 10 or 7 hXAbpBSScUFSdloACGGiM tcBOckdcZdPFFvIXcP3 x GOA7CTvO fOzpxroCwlJTjL3jS0 Bn9v50951G wv lt gt Browse for a file to insert Certificate Template Administrator v Administrator Additional Attribu Authenticated Session Basic EFS EFS Recovery Agent Attributes JUser Router Offline request Subordinate Certification Authority Then you have done the request and the server now issues you a certificate Select Base 64 encoded certificate and Download CA certificate Now you should get a certificate cer file and save it 5 Back to Vigor router go to Local Certificate Click IMPORT button and browse the file to import the certificate cer file into Vigor router When finished click refresh and Vigor3100 Series User s Guide 105 you will find the below window showing BEGINE CERTIFICATE X509 Local Certificate Configuration Name Subject Status Modify Local femallAddress pressmdraytek Mot valid Yet GENERATE IMPORT REFRESH X5 9 Local Certificate MIIEl1zCCBECQgAwIBAgIEYSEIGAABAAARABTAMNBgkdqhkiGBSwUBAQUFADAdMOoSwCOYD WOO EuwTIVHZzEOMAuws ATUE A XxMFGdmlnb3IwHhcHMDUwODMwH HMxzxN UzWhcNMDewonDMu MjMxNjUzWjBBMZAwHgYJEoZIhvcH
142. w Vigor3100 Series User s Guide Dial To TEN Sese VPN Server IPIHOST Mame such as 123 45 67 89 or draytek com 132 168 1 1 Password Type of VPN COLZTP COL2TP over IPSec PPTP Encryption C Use default gateway on remote network You may further specify the method you use to get IP the security method and authentication method If the Pre Shared Key is selected it should be consistent with the one set in VPN router IPSec Folicy Setting My IP 172 16 3 100 hal Type of IPSec CO Standard IPSec Tunnel 9 Virture IP DrayTek Virture Interface Obtain an IP address automatically DHCP over IPSec C3 Specify an IP address meea a Subnet Mask Security Method Medium AH Authority Method C Certification Authority If a PPP based service is selected you should further specify the remote VPN server IP address Username Password and encryption method The User Name and Password should be consistent with the one set up in the VPN router To use default gateway on remote network means that all the packets of remote host will be directed to VPN server then forwarded to Internet This will make the remote host seem to be working in the enterprise network Vigor3100 Series User s Guide 97 Dial To TEH Session Name office VPM Server IPIHOST Namefsuch as 123 45 67 89 or draytek com 192 168 1 1 User Mame draytek_userl Password TEREFE Type of YPN 9 PPTP COL2TP IPS
143. w the steps below to ping the router correctly For Windows 1 Open the Command Prompt window from Start menu Run 2 Type command for Windows 95 98 ME or cmd for Windows NT 2000 XP The DOS command dialog will appear c Command Prompt Microsoft Windows AF Version 5 1 2600 CC Copyright 1985 2001 Microsoft Corp D Documents and Settings fae gt ping 192 168 1 1 Pinging 192 168 1 1 with 32 bytes of data Reply from 192 168 1 1 huytez 32 time lt ims TTL 255 Reply from 192 168 1 1 bytes 32 time lt ims TTL 255 Reply from 172 168 1 1 huytez 32 time lt ims TTL 255 Reply from 192 168 1 1 bytes 32 time lt ims TTL 255 Ping statistics for 1972 168 1 1 Packets Sent 4 Received 4 Lost 6 x loss Approximate round trip times in milli seconds Minimum Ams Maximum Ams Average Ams D Documents and Settings fae gt _ 3 Type ping 192 168 1 1 and press Enter It the link is OK the line of Reply from 192 168 1 1 bytes 32 time lt Ims TTL 25 will appear 4 If the line does not appear please check the IP address setting of your computer For MacOs Terminal Double click on the current used MacOs on the desktop Open the Application folder and get into Utilities Double click Terminal The Terminal window will appear Type ping 192 168 1 1 and press Enter It the link is OK the line of 64 bytes from 192 168 1 1 icmp_seq 0 tt12255 time xxxx ms will appear pom ou ox 112 Vigor3100 Serie
144. y during certain hours say business hours The schedule is also applicable to other functions You have to set your time before set schedule In System Maintenance Time Setup menu press Inquire Time button to set the Vigor router s clock to current time of your PC The clock will reset once if you power down or reset the router There is another way to set up time You can inquiry an NTP server a time server on the Internet to synchronize the router s clock This method can only be applied when the WAN connection has been built up Applications gt gt Schedule Schedule Index Status Index Status i M s M 2 M 10 w 3 M 11 w 4 x 12 x 5 M 13 M b W 14 x T W 15 x B M Status v Active s Inactive You can set up to 15 schedules Then you can apply them to your Internet Access or VPN and Remote Access LAN to LAN settings To add a schedule please click any index say Index No 1 The detailed settings of the call schedule with index 1 are shown below Index Mo 1 Enable Schedule Setup start Date yyyy mm dd 2004 v Start Time hh mm Duration Time hh rim 0 Idle Timeaut Perea vm b D for default Enable Dial On Demand How Often Disable Dial On Demand Once Weekdays Sun Man Tue Wed Thu Fi E Sat Vigor3100 Series User s Guide 99 54 Enable Schedule Setup Check to enable the schedule Start Date yyyy mm dd Specify the starting date of the schedule Start
145. yption algorithm the router will transmit no MPPE encrypted packets Otherwise the MPPE encryption scheme will be used to encrypt the data Require MPPE 40 128bits Selecting this option will force the router to encrypt packets by using the MPPE encryption algorithm In addition the remote dial in user will use 40 bit to perform encryption prior to using 128 bit for encryption In other words if 40 bit MPPE encryption method is not available then 128 bit encryption scheme will be applied to encrypt the data Maximum MPPE This option indicates that the router will use the MPPE encryption scheme with maximum bits 128 bits to encrypt the data Vigor3100 Series User s Guide 61 Mutual Authentication PAP The Mutual Authentication function is mainly used to communicate with other routers or clients who need bi directional authentication in order to provide stronger security for example Cisco routers So you should enable this function when your peer router requires mutual authentication You should further specify the User Name and Password of the mutual authentication peer Start IP Address Enter a start IP address for the dial in PPP connection You should choose an IP address from the local private network For example if the local private network is 192 168 1 0 255 255 255 0 you could choose 192 168 1 202 to be the Start IP Address 3 6 3 IPSec General Setup In IPSec General Setup there are two major parts of configuratio

Vigor 3100 Series Router User`s Guide

Contents

Download Pdf Manuals

Related Search

Related Contents