Home

Vigor2830: Manual

Contents

1. Password aa 4 20 characters Do not set the same as the username Confirm Password sooo Personal Information First Name Mary Last Name Ted Company Name Tech Ltd E Please note that a valid E mail address is required to receive the Subscription Code You will need this code to activate your account Tel 0 Country SWITZERLAND v Career Supervisor v 4 Choose proper selection for your computer and click Continue Create an account Please enter personal profile Dray Tek Gasreement Personal Information Sdcomptetion How did you find out about this website Internet e What kind of anti virus do you use Antivir vv would like to subscribe to the MyVigor e letter would like to receive DrayTek product news akan a mail server for receiving the 427 Vigor2830 Series User s Guide 5 Now you have created an account successfully Click START Create an account Please enter personal profile Completion EFAsreement A confirmation email has been sent to mary_ted tech com Please click on the activation link in the email Personal Information to activate your account E rreferences AR 6 Check to see the confirmation email with the title of New Account Confirmation Letter from myvigor draytek com wkk This is an automated message trom myvigor draytek con Thank you Mary for creating an account Please click on the activation link
2. Vigor2830 Series User s Guide 3 5 4 DoS Defense As a sub functionality of IP Filter Firewall there are 15 types of detect defense function in the DoS Defense setup The DoS Defense functionality is disabled for default Click Firewall and click DoS Defense to open the setup page Firewall gt gt DoS defense Setup Dos defense Setup Enable DoS Defense Select All Enable SYN flood defense Enable UDP flood defense Enable ICMP flood defense Enable Port Scan detection Block IP options Block Land Block Smurf Block trace route Block SYM fragment Block Fraggle Attack Threshald packets sec Timeout SEC Threshold packets sec Timeout SEC Threshald packets f sec Timeout SEC Threshold 000 packets sec Block TCP flag scan Black Tear Drop Black Ping of Death Block ICMP fragment Black Unassigned Numbers Enable na defense function to prevent the attacks from hacker or crackers Available settings are explained as follows Item Enable Dos Defense Select All Enable SYN flood defense Enable UDP flood defense Vigor2830 Series User s Guide Description Check the box to activate the DoS Defense Functionality Click this button to select all the items listed below Check the box to activate the SYN flood defense function Once detecting the Threshold of the TCP SYN packets from the Internet has exceeded the defined value the Vigor router will start to randomly discard the su
3. ccccccccceessscceeceeeseceeeceeeeceeeseeeeeeeeseeeeeeeesaanseeess 448 5 6 Backing to Factory Default Setting If Necessary eneen nenene nnne 449 5 7 Contacting Dray Tek cccccccccccccccssssssesssseseeeeeeeeeeeseeeeeeeaeeseeeeeeeeeeeeeeeeeeeseaaaaaaesaeeeeeeeeeeeeseeees 450 Appendix l VLAN Applications on Vigor Router cccssecesseeseenseenseeessensseseeeeees 451 Appendix 4 eg 2 or bt 0 lel e 459 Dr ay Tek xi Vigor2830 Series User s Guide Introduction Vigor2830 series is an ADSL2 router It integrates IP layer QoS NAT session bandwidth management to help users control works well with large bandwidth By adopting hardware based VPN platform and hardware encryption of AES DES 3DES the router increases the performance of VPN greatly and offers several protocols such as IPSec PPTP L2TP with up to 32 VPN tunnels The object based design used in SPI Stateful Packet Inspection firewall allows users to set firewall policy with ease CSM Content Security Management provides users control and management in IM Instant Messenger and P2P Peer to Peer more efficiency than before By the way DoS DDoS prevention and URL Web content filter strengthen the security outside and control inside Object based firewall is flexible and allows your network be safe In addition Vigor2830 series supports USB interface for connecting USB printer to share printer or USB storage device for sharing fil
4. lt body stats 1 gt lt script lanquage javascript gt window location http www draytek com lt script gt lt body gt Open User Management gt gt User Profile to create a new user profle User Management gt User Profile User Profile Table Profile FEB E E s e ANP Pee Pe Setto Factory Default Name Profile admin 47 Dial In User 1 Name 393 Vigor2830 Series User s Guide 3 Click any link e g 3 to access into the following page Type a User Name and a Password Then click OK User Management gt gt User Profile Profile Index 3 Enable this account Username Password Contirm Password Idle Timeout mints O Unlimited Max User Login oh O Unlimited External Server Authentication Pop Browser Tracking Window Authentication Web Alert Tool Telnet Landing Page a Index 1 15 in Schedule Setup E O Enable Time Quota o min Jo Je min C Enable Data Quota p CCo me Reset quota to default when scheduling time expired O Enable Default Time Quota bo min Default Data Quota O MB 4 Open System Maintenance gt gt Login Page Greeting Check the box to enable this function Type a brief description e g Just for Carrie in the field of Login Page Title which will be shown on the heading of the login dialog Next click OK System Maintenance gt Login Page Greeting Login Page Greeting Enable Login Page Title Just for Carrie 31 char
5. cous Dr ay Tek 445 Vigor2830 Series User s Guide For Mac OS 1 Double click on the current used Mac OS on the desktop 2 Open the Application folder and get into Network 3 On the Network screen select Using DHCP from the drop down list of Configure IPv4 e660 Network lt wae Gg Show All Displays Sound Network Startup Disk Location Automatic ES Show Built in Ethernet KA PPPoE AppleTalk Proxies Ethernet Configure Pv4 Using DHCP Ke IP Address 192 168 1 10 Renew DHCP Lease Subnet Mask 255 255 255 0 DHCP Client ID If required Router 192 168 1 1 DNS Servers Optional Search Domains Optional IPv6 Address fe80 0000 0000 0000 020a 95ff fe8d 72e4 Configure IPv6 re Click the lock to prevent further changes Assistme Apply Now 4 Vigor2830 Series User s Guide 446 Dr ay Te k 5 3 Pinging the Router from Your Computer The default gateway IP address of the router is 192 168 1 1 For some reason you might need to use ping command to check the link status of the router The most important thing is that the computer will receive a reply from 192 168 1 1 If not please check the IP address of your computer We suggest you setting the network connection as get IP automatically Please refer to the section 5 2 Please follow the steps below to ping the router correctly For Windows L Ds 4 Open the Command Prompt window fro
6. Each item is explained as follows Item Description Name Display the name of the profile that you create URL Display the URL Active Display current status active or inactive of such profile Click number link under Index filed to set detailed configuration Web Access Control gt gt SSL Web Proxy Profile Index 1 Name IEL Host IP Address Access Method Note URL format must be entered as http ip port directory or http Domain_name directory where Domain_name is a FOON Available settings are explained as follows Item Description Name Type name of the profile The length of the name is limited to 15 characters Dray Te k 317 Vigor2830 Series User s Guide URL Type the address function variation or IP address or path of the proxy server Host IP Address If you type function variation as URL you have to type corresponding IP address in this filed Such field must match with URL setting Access Method There are three modes for you to choose Disable the profile will be inactive If you choose Disable all the web proxy profile appeared under VPN remote dial in web page will disappear Secured Port Redirection such technique applies private port mapping to random WAN port There are two restrictions for proxy web server for such selection 1 it is only used for WAN to LAN access the web server must be configured behind vigor router 2 web server gateway must be indicated to vigo
7. L Specify Remote Node Remote Client IP or Peer ISDN Number orPeerp o Netbios Naming Packet Pass Block Dray Tek 103 Username Password IKE Authentication Method Pre Shared Key C Digital Signature x 509 IPSec Security Method Medium AH High ESP DES 3DES AES Local ID optional Cancel Vigor2830 Series User s Guide If a PPP based service is selected you should further specify the remote peer IP Address Username Password and VJ Compression for this Dial In connection VPN and Remote Access gt gt Remote Dial in User Index No 1 User account and Authentication earns 299 C Enable this account Idle Timeout second s Allowed Dial In Type IKE Authentication Method Pre Shared Key LI IPSec Tunnel C Digital Signature X 509 C L2TP with IPSec Policy CO Specify Remote Node Remote Client IP or Peer ISDN Number IPSec Security Method High ESP DES v 3DES v AES or Peer D O me Local ID foptional fe Netbios Naming Packet Pass Block op Settings in the remote host 1 For Win98 ME you may use Dial up Networking to create the PPTP tunnel to Vigor router For Win2000 XP please use Network and Dial up connections or Smart VPN Client complimentary software to help you create PPTP L2TP and L2TP over IPSec tunnel You can find it in CD ROM in the package or go to www DrayTek com download center Install as instructed 2
8. Must Specify the IPSec policy to be definitely applied on the L2TP connection 249 Vigor2830 Series User s Guide Item Subnet IKE Authentication Method Vigor2830 Series User s Guide Description SSL Tunnel Allow the remote dial in user to make an SSL VPN connection through Internet Specify Remote Node Check the checkbox to specify the IP address of the remote dial in user or peer ID used in IKE aggressive mode If you uncheck the checkbox the connection type you select above will apply the authentication methods and security methods in the general settings Netbios Naming Packet Pass Click it to have an inquiry for data transmission between the hosts located on both sides of VPN Tunnel while connecting Block When there is conflict occurred between the hosts on both sides of VPN Tunnel in connecting such function can block data transmission of Netbios Naming Packet inside the tunnel Multicast via VPN Some programs might send multicast packets via VPN connection Pass Click this button to let multicast packets pass through the router Block This is default setting Click this button to let multicast packets be blocked by the router Chose one of the subnet selections for such VPN profile Assign Static IP Address Please type a static IP address for the subnet you specified User Name This field is applicable when you select PPTP or L2TP with or w
9. Ve a a F F j P d J i a co ras gt lt s lt ee y i A k i 4 l h es 4 F g Y 4 w A S y aa f Y P l W f EO i 4 t gt ADSL2 Security Firewall fg ap Your reliable networking solutions partner User s Guide V2 31 Vigor2830 Series User s Guide ii Dr ay Te k Vigor2830 Series ADSL2 Security Firewall User s Guide Version 2 3 Firmware Version V3 6 7 Date June 16 2014 Dray Te k ili Vigor2830 Series User s Guide Copyright Information Copyright Declarations Trademarks 2014 All rights reserved This publication contains information that is protected by copyright No part may be reproduced transmitted transcribed stored in a retrieval system or translated into any language without written permission from the copyright holders The following trademarks are used in this document Microsoft is a registered trademark of Microsoft Corp Windows Windows 95 98 Me NT 2000 XP Vista and Explorer are trademarks of Microsoft Corp Apple and Mac OS are registered trademarks of Apple Inc Other products may be trademarks or registered trademarks of their respective manufacturers Safety Instructions and Approval Safety Instructions Warranty Be a Registered Owner Firmware amp Tools Updates Vigor2830 Series User s Guide Read the installation guide thoroughly before you set up the router The router is a
10. Dest Dest Dest Dest Src IP Start Src IP End IP IP Port Port Start End Start End Any WAMI 192 168 1 16 192 168 131 Any Any Any Any Down Any WANI z202 211 100 11 192 168 1 100 192 168 1 100 Any Any Any Any Down Any WANI Down Any WANI Down Any WANI Down Any WANI Down Ary WANI Down Any WAR 1 Down Any WAN 1 Down J Any WANI Down lt lt 1 10 11 20 21 30 31 40 41 50 gt gt Next gt gt Interface Address Move Move Index Enable Protocol Interface Down 1 2 3 4 5 6 i 8 9 10 wizard Mode most frequently used settings in three pages Advance Mode all settings in one page 7 Now you bind some specific computers to some WAN IP alias for outgoing traffic Dr ay Tek 439 Vigor2830 Series User s Guide 4 17 How to setup Load Balance for Packets The following figure shows a simple application of load balance WAN1 and WAN2 can be used to access into Internet The PC in LANI can send the data to the remote PC through the specified WANI g e Remote PC Internet Remote PC 203 65 1 35 139 75 244 8 WAN1 Gateway 168 95 98 254 WAN2 Gateway 27 244 84 241 MY LAN1 Any IP address bz NAT l Load Balance Route Policy l Einar 2 From the following web page simply click index number 1 Vigor2830 Series User s Guide 440 Dr ay Te k Load Balance Route Policy o Load Balance Route Policy Set to Factory Default Src g Dest Dest IP
11. Firewall gt gt Edit Filter Set gt gt Edit Filter Rule Filter Set 1 Rule 1 Advance Setting Codepage ANSI 252 Latin v Window size 65535 Session timeout 1440 Minute DrayTek Banner Strict Security Checking CAPP Enforcement Codepage This function is used to compare the characters among different languages Choose correct codepage can help the system obtaining correct ASCH after decoding data from URL and enhance the correctness of URL Content Filter The default value for this setting is ANSI 1252 Latin I If you do not choose any codepage no decoding job of URL will be processed Please use the drop down list to choose a codepage If you do not have any idea of choosing suitable codepage please open Syslog From Codepage Information of Setup dialog you will see the recommended codepage listed on the dialog box 155 Vigor2830 Series User s Guide Dray Tek P Syslog Utility EEEE EE SSS Toul felun Tele Remon Seep Codepage information Recovery Metedak Inbannibon Hel Shake Comdigege Ter Sepet Windows Vieron 30 ooo RECOMMENDED CODER AGE FA LAMA Trdina hae Dags Dia iene Pap Os a SL Cen Dd eet PD SS by ek Ye Oe Oe Oe Window size It determines the size of TCP protocol O 65535 The more the value is the better the performance will be However if the network is not stable small value will be proper Session timeou
12. 2 no w 2 0 3 3 0 w 13 oo 4 70 X 14 yo 5 oo w 15 oy ial G uo w 1b 3 0 4 f eel w Ti eae 8 no w 18 oral 9 ao w 19 0 10 no H 20 aad H lt lt 1 20 21 40 gt gt Next gt gt Status v Active x Inactive 7 Empty Each item is explained as follows Item Description Set to Factory Default Clear all of the settings and return to factory default settings Viewing IPv6 Routing Displays the routing table for your reference Table Index The number 1 to 40 under Index allows you to open next page to set up static route Destination Address Displays the destination address of the static route Status Displays the status of the static route Click any underline of index number to get the following page LAN gt Static Route Setup Index No 1 C Enable Network Interface LAM Available settings are explained as follows Item Description Dr ay Tek 115 Vigor2830 Series User s Guide Enable Click it to enable this profile Destination IPv6 Address Type the IP address with the prefix length for this entry Prefix Len Gateway IPv6 Address Type the gateway address for this entry Network Interface Use the drop down list to specify an interface for this static route Add Static Routes to Private and Public Networks based on IPv4 Here is an example of setting Static Route in Main Router so that user A and B locating in different subnet can talk to each other
13. 3 Choose any index number e g Index 1 in this case to configure the SMS Provider setting In the following page type the username and password and set the quota that the router can send the message out Object Settings gt SMS Mail Service Object Profile Index 1 Profile Name Service Provider kotsms com tw TV Username abc5026 Quota Sending Interval seconds Dray Te k 385 Vigor2830 Series User s Guide 4 After finished the settings click OK to return to previous page Now you have finished the configuration of the SMS Provider profile setting Object Settings gt gt SMS Mail Service Object SMS Provider Mail Server Setto Factory Default SMS Provider Local Number kotsms com tw TW E a sms e com q W kotsms com tw TW kotsms com tw TW kotsms com tw TW kotsms com tw TW kotsms com tw TW kotsms com tw TW Custom 1 Custom 2 5 Open Object Settings gt gt Notification Object to configure the event conditions of the notification Object Settings gt Notification Object Setto Factory Default Profile Name Settings PAP e Fee 6 Choose any index number e g Index 1 in this case to configure conditions for sending the SMS In the following page type the name of the profile and check the Disconnected and Reconnected boxes for WAN to work in concert with the topic of this paper Object Settings gt Notification Object Profile Index 1 Profile Name
14. Bandwidth Management gt Quality of Service Service Type Edit Service Type TCR v e Fort Configuration Type Single Range Port Number bo bo Available settings are explained as follows Item Description Service Name Type in a new service for your request Service Type Choose the type TCP UDP or TCP UDP or other for the new service Port Configuration Type Click Single or Range as the Type If you select Range you have to type in the starting port number and the end porting number on the boxes below Port Number Type in the starting port number and the end porting number here if you choose Range as the type 221 Vigor2830 Series User s Guide 4 By the way you can set up to 10 service types If you want to edit delete an existed service type please select the radio button of that one and click Edit Edit for modification Retag the Packets for Identification Packets coming from LAN IP can be retagged through QoS setting When the packets sent out through WAN interface all the them will be tagged with certain header and that will be easily to be identified by server on ISP For example in the following illustration the VoIP packets in LAN go into Vigor router without any header However when they go forward to the Server on ISP through Vigor router all of the packets are tagged with AF configured in Bandwidth gt gt QoS gt gt Class automatically QoS Class 1 VoIP QoS Clas
15. DMZ Host Setup WAN1 WAN2 WAN3 WAN 2 Index Enable Aux WAN IP Private IP ile tb ye i aiee hala Fe 192 168 1 10 2 dl 172 16 3 200 After finishing all the settings here please click OK to save the configuration Dr ay Tek 137 Vigor2830 Series User s Guide 3 4 3 Open Ports Open Ports allows you to open a range of ports for the traffic of special applications Common application of Open Ports includes P2P application e g BT KaZaA Gnutella WinMX eMule and others Internet Camera etc Ensure that you keep the application involved up to date to avoid falling victim to any security exploits Click Open Ports to open the following page NAT gt Open Ports Open Ports Setup Setto Factory Default Comment WAN Interface Local IP Address Status ud 1 2 J 4 5 G f 8 oF HD OTK OK TKD KOE KEK X lt lt 1 10 11 20 gt gt a ib w Mr Note The configured ports in the Management and SSL VPN weblUls will be used by the router and not be sent to the local computer defined here Available settings are explained as follows Item Description Index Indicate the relative number for the particular entry that you want to offer service in a local host You should click the appropriate index number to edit or clear the corresponding entry Comment Display the name for the defined network service WAN Interface Display the WAN interface of the profile Local IP Address Display the private IP
16. Security Method Medium H Authority Method Certification Authority If a PPP based service is selected you should further specify the remote VPN server IP address Username Password and encryption method The User Name and Password should be consistent with the one set up in the VPN router To use default gateway on remote network means that all the packets of remote host will be directed to VPN server then forwarded to Internet This will make the remote host seem to be working in the enterprise network 407 Vigor2830 Series User s Guide Dial To FEH Session Name office YPN Server IF HOST Namefsuch as 123 45 67 89 or draytek com 192 165 1 1 User Mame draytek_userl Password aa Type of YPN PPTP LET IPSec Tunnel COL2TP over IPSec PPTP Encryption O Mo encryption O Maximum strength encryption Use default gateway on remote network 4 Click Connect button to build connection When the connection is successful you will find a green light on the right down corner 4 9 QoS Setting Example Assume a teleworker sometimes works at home and takes care of children When working time he would use Vigor router at home to connect to the server in the headquarter office downtown via either HTTPS or VPN to check email and access internal database Meanwhile children may chat on Skype in the restroom 1 Goto Bandwidth Management gt gt Quality of Service Bandwidth Management gt
17. To set a new profile please do the steps listed below 1 Click the SMS Provider tab and click the number e g 1 under Index column for configuration in details Object Settings gt gt SMS Mail Service Object SMS Provider Mail Server Index Profile Name i Z 3 Dr ay Tek 189 Vigor2830 Series User s Guide 2 The configuration page will be shown as follows Object Settings gt SMS Mail Service Object Profile Index 1 Profile Mame Line_ down Service Provider kotsms com tw Tv Username line Password Quota Sending Interval seconds Available settings are explained as follows Item Description Profile Name Type a name for such SMS profile Service Provider Use the drop down list to specify the service provider which offers SMS service Username Type a user name that the sender can use to register to selected SMS provider Password Type a password that the sender can use to register to selected SMS provider Quota Type the number of the credit that you purchase from the service provider chosen above Note that one credit equals to one SMS text message on the standard route Sending Interval To avoid quota being exhausted soon type time interval for sending the SMS 3 After finishing all the settings here please click OK to save the configuration Object Settings gt SMS Mail Service Object SMS Provider Mail Server Setto Factory Default Index Profile Name SMS
18. Allow auto adjustment to make the best utilization of available bandwidth Limitation List Index Start IP Tx limit Fe limit Shared Specific Limitation Each Shared Ta Limit Kbps R amp Limit Kbps smar Bandwidth Limit For any LAN IP Not in Limitation List whose session number exceeds Tx Limit 200 Rx Limit B00 Note For TYR a setting of 0 means unlimited bandwidth Time Schedule Index 1 15 in Schedule Setup iz Note Action and Idle Timeout settings will be ignored LOK _ To activate the function of limit bandwidth simply click Enable and set the default upstream and downstream limit Available settings are explained as follows Item Description Bandwidth Limit Enable Click this button to activate the function of limit bandwidth IP Routed Subnet Check this box to apply the bandwidth limit to the second subnet specified in LAN gt gt General Setup Disable Click this button to close the function of limit bandwidth Default TX limit Define the default speed of the upstream for each computer in LAN Default RX limit Define the default speed of the Vigor2830 Series User s Guide 212 Dr ay Te k downstream for each computer in LAN Allow auto adjustment Check this box to make the best utilization of available bandwidth Limitation List Display a list of specific limitations that you set on this web page Specific Limitation Start IP
19. Allow management from LAN Enable the checkbox to allow system administrators to access from LAN There are several servers provided by the system to allow you managing the router from Internet Check the box es to specify Apply To Choose the subnet s for the administrator to access You could specify that the system administrator can only login from a specific host or network defined in the list A maximum of three Ps subnet masks is allowed List IP Indicate an IP address allowed to login to the router Subnet Mask Represent a subnet mask allowed to login to the router User Defined Ports Check to specify user defined port numbers for the Telnet HTTP and FTP servers Default Ports Check to use standard port numbers for the Telnet and HTTP servers No respond to External Device Check the box to make Vigor2830 not being detected by other router and not being displayed as an external device IPv 6 Management Setup Allow management from the Internet C Telnet Server Port 23 C HTTP Server Port 80 L Enable PING from the Internet Access List List IPve Address Prefix Length a Doo o E E Note Telnt Http server port is the same as IPy4 Available settings are explained as follows Vigor2830 Series User s Guide 82 Dray Tek Item Description Management Access Enable the checkbox to allow system administrators to login Control from the Internet There are several
20. GigaLAN 1 2 3 4 Off Blinking Right LED Green Off Left LED Green On Off Blinking WAN2 Giga i Vigor2830 Series User s Guide Explanation The router is powered on and running normally The router is powered off USB device is connected and ready for use The data is transmitting The profile s of CSM Content Security Management for IM P2P URL Web Content Filter application can be enabled from Firewall gt gt General Setup Such profile must be established under CSM menu Wireless access point is ready It will blink slowly while wireless traffic goes through If ACT and WLAN LEDs blink quickly and simultaneously when WPS is working and it will return to normal condition after two minutes You need to setup WPS within 2 minutes The router is ready to access Internet through DSL link Slowly The DSL connection is ready Quickly The connection is tranning The WAN2 connection is ready It will blink while transmitting data A PSTN phone call comes in and out However when the phone call is disconnected the LED will be off There is no PSTN phone call The phone connected to this port is off hook The phone connected to this port is on hook A phone call comes The port is connected The port is disconnected The data is transmitting The port is connected with 1000Mbps The port is connected with 10 100Mbps when left LED is on The port is connecte
21. However if open another new tab again in the same browser the browser will open default page based on the default setting Vigor2830 Series User s Guide 392 Dray Tek 4 6 How to Customize Your Login Page Login page can be customized to fit the request of the administrator l 2 Dray Tek Vigor2830 S ries lt Open User Management gt gt General Setup Set User Based as the Mode and click OK to save teh settings Dray ADSL2 Security Firewall Of VB RG Wizards Online Status WAN LAN Load Balance Route Policy NAT Firewall User Management Objects Setting CSM Bandwidth Management Applications VPN and Remote Access Certificate Management VolP Wireless LAN SSL VPN USB Application System Maintenance Diagnostics External Devices User Management gt gt General Setup General Setup Mode Rule Based Rule Based User Based Display IP king window Off Web Authentication HTTPS Notice 1 User Management will refer to active rules in Data Filter as whitelists and blacklists in user based firewall mode 2 Users match the above lists will not be required for authentication The firewall rules policy will still valid 3 Otherwise authentication required for users not matched the above lists The firewall rules designated in the user profile s policy will still valid Landing Page Max 255 characters Preview Setto Factory Default
22. LOGIN Auth Code O AYi GXZ lf vou cannot read the word click here Forget password Don t have a MyViger Account Create an account now If you are having difficulty logging in contact cur customer service Customer Service 888 3 597 2727 oF email to webmastenm draytek com 3 Click the link of Create an account now 4 Check to confirm that you accept the Agreement and click Accept Dray Tek Create an account Please enter personal profile 1 Agreement pr erson al Information Draytek provides My igor myvigor draytek com service according to this agreement Ahen you use MyVvigor service it means that you have read understand and agree to accept the items listed in this agreement Draytek can modify or change the content of the items without any reasons tt is Epre ferences suggested for you to notice the medications or changes at any time If you still use MyVigor service after knowing the modifications and changes of this service it means you have read understand and agree to accept the modifications and changes If you do not agree the content of this agreement please stop using MyVigor service completion 2 Registration To use this service you have to agree the following conditions a Provide your complete and correct information according to the registration steps of this service a Tee Seeveeeseed 423 Vigor2830 Series User s Guide gt MW
23. Routing Information Protocol is abbreviated as RIP RFC1058 specifying how routers exchange routing tables information Click Enable RIP for activating this function If you choose Bridged IP as the protocol you can check this box to invoke the function The router will work as a bridge modem This group allows you to obtain an IP address automatically and allows you type in IP address manually WAN IP Alias If you have multiple public IP addresses and would like to utilize them on the WAN interface please use WAN IP Alias You can set up to 8 public IP addresses other than the current one you are using Notice that this setting is available for WAN1 only Type the additional WAN IP address and check the Enable box Then click OK to exit the dialog 78 Dray Tek Dray Tek PETTE RHR a 192 168 1 SidocAvipalias htm WANI IP Alias Multi NAT Index Enable Aux WAN IP Join NAT IP Pool CI a d d O d d d Obtain an IP address automatically Click this button to obtain the IP address automatically Router Name Type in the router name provided by ISP Domain Name Type in the domain name that you have assigned DHCP Client Identifier for some ISP Enable Check the box to specify username and password as the DHCP client identifier for some ISP Username Type a name as username The maximum length of the user name you can set is 63 characters Password Type a password Th
24. Type of Server I am calling PPTP Build a PPTP VPN connection to the server through the Internet You should set the identity like User Name and Password below for the authentication of remote server IPSec Tunnel Build an IPSec VPN connection to the server through Internet L2TP with IPSec Policy Build a L2TP VPN connection through the Internet You can select to use L2TP alone or with IPSec Select from below None Do not apply the IPSec policy Accordingly the VPN connection employed the L2TP without IPSec policy can be viewed as one pure L2TP connection Nice to Have Apply the IPSec policy first if it is applicable during negotiation Otherwise the dial out VPN connection becomes one pure L2TP connection Must Specify the IPSec policy to be definitely applied on the L2TP connection User Name This field is applicable when you select PPTP or L2TP with or without IPSec policy above The maximum length for username is 49 characters Password This field is applicable when you select PPTP or L2TP with or without IPSec policy above The maximum length for password is 15 characters PPP Authentication This field is applicable when you select PPTP or L2TP with or without PSec policy above PAP CHAP MS CHAP MS CHAPvz2 is the most common selection due to wild compatibility VJ compression This field is applicable when you select PPTP or L2TP with or without IPSec policy above VJ 255 Vigor2830 S
25. Vigorif draytekt ping 192 165 1 1 PING 192 168 1 1 192 168 1 1 56 dota bytes 64 bytes from 192 165 14 14 temp seg h thl 455 tinesh 755 is 64 bytes from 192 160 1 1 icmp seg 1 ttl 255 timesB 697 me 64 bytes from 192 168 1 1 icm p_seg 4 ttl 255 times6 716 M 64 bytes from 192 168 171 icmp seg 3 thl lt 255 timesh 731 me from 192 166 1 1 temposeg 4 thl 255 timesh 72 ME 192 168 1 1 ping statistics F pockets troansiitted 5 packets recerved 8 packet loss FourMd trip win ava mas B97 fA 7425 8755 M Vigori draytek jj 5 4 Checking If the ISP Settings are OK or Not Open WAN gt gt Internet Access page and then check whether the ISP settings are set correctly Click Details Page of WAN1 WAN2 to review the settings that you configured previously WAN gt Internet Access Internet Access Index Display Name Physical Mode WAMI ADSL PPPoE PPPoA Wt Details Page WARS Ethernet Static or Dynamic IP w Details Page wans Js 5 5 Problems for 3G Network Connection When you have trouble in using 3G network transmission please check the following Check if USB LED lights on or off You have to wait about 15 seconds after inserting 3G USB Modem into your Vigor2830 Later the USB LED will light on which means the installation of USB Modem is successful If the USB LED does not light on please remove and reinsert the modem again If it still fails restart Vigor2830 USB LED lights on bu
26. 192 168 1 1 A pop up window will open to ask for username and password Please type admin admin as the Username Password and click Login Go to System Maintenance page and choose Admin Setting 17 Vigor2830 Series User s Guide System Maintenance gt gt Admin Setting Administrator Password New Password ee Max 23 characters allowed Confirm Password fo O O Max 23 characters allowed Mote Passward can contain only a z 4 2 0 9 e gt QM 4 Administrator Local User Cl Local User Local User List Index User Mare 4 Enter the login password the default is blank on the field of Old Password Type New Password Then click OK to continue 5 Now the password has been changed Next time use the new password to access the Web user interface for this router Username Password Copyright DrayTek Corp All Rights Reserved Dray Tek Vigor2830 Series User s Guide 18 Dr ay Te k 1 6 Online Status Online Status BE L 1 6 1 Physical Connection Such page displays the physical connection status such as LAN connection status WAN connection status ADSL information and so on Physical Connection for IPv4 Protocol Online Status Physical Connection System Uptime 4 7 53 IPv4 IPv6 LAN Status Primary DNS 5 5 5 8 Secondary DNS 6 8 4 4 IP Address TX Packets RX Packets 192 165 1 1 53964 729498 WAN 1 Status gt gt Dial PPPoE
27. Define the start IP address for limit bandwidth End IP Define the end IP address for limit bandwidth Each Shared Select Each to make each IP within the range of Start IP and End IP having the same speed defined in TX limit and RX limit fields select Shared to make all the IPs within the range of Start IP and End IP share the speed defined in TX limit and RX limit fields TX limit Define the limitation for the speed of the upstream If you do not set the limit in this field the system will use the default speed for the specific limitation you set for each index RX limit Define the limitation for the speed of the downstream If you do not set the limit in this field the system will use the default speed for the specific limitation you set for each index Add Add the specific speed limitation onto the list above Update Allow you to edit the settings for the selected limitation Delete Remove the selected settings existing on the limitation list Smart Bandwidth Limit Check this box to have the bandwidth limit determined by the system automatically TX limit Define the limitation for the speed of the upstream If you do not set the limit in this field the system will use the default speed for the specific limitation you set for each index RX limit Define the limitation for the speed of the downstream If you do not set the limit in this field the system will use the default speed for the specific limita
28. Dr ay Tek 169 Vigor2830 Series User s Guide 3 7 Objects Settings For IPs in a range and service ports in a limited range usually will be applied in configuring router s settings therefore we can define them with objects and bind them with groups for using conveniently Later we can select that object group that can apply it For example all the IPs in the same department can be defined with an IP object a range of IP address Objects Setting 3 7 1 IP Object You can set up to 192 sets of IP Objects with different conditions Objects Setting gt IP Object IP Object Profiles Setto Factory Default Index Name Index Name kad iaa i Ui j ju l i ee cD CC e SFee BpREBbererrerPFeFePrpe ny ny oli a Pd fatal fal on dss g i on an i P a _k Pat aa g So i g oli ook a Pat vi Vv D w K r Available settings are explained as follows Item Description Set to Factory Default Clear all profiles Index Display the profile number that you can configure Name Display the name of the object profile Vigor2830 Series User s Guide 170 Dr ay Te k To set a new profile please do the steps listed below l Click the number e g 1 under Index column for configuration in details Objects Setting gt gt IP Object IP Object Profiles 2 The configurati
29. Dray Te k 421 Vigor2830 Series User s Guide 4 13 Creating an Account for MyVigor The website of My Vigor a server located on http myvigor draytek com provides several useful services such as Anti Spam Web Content Filter Anti Intrusion and etc to filtering the web pages for the sake of protecting your system To access into My Vigor for getting more information please create an account for My Vigor 4 13 1 Creating an Account via Vigor Router 1 Click CSM gt gt Web Content Filter Profile The following page will appear CSM gt Web Content Filter Profile Web Filter License Status Not Activated Setup Query Server auto selected Find more Setup Test Server auto selected Find more Web Content Filter Profile Table Setto Factory Default Profile Name Profile Default Name LS M Ea Or Click System Maintenance gt gt lt Activation to open the following page System Maintenance gt gt Activation Activate via interface auta selected Web Filter License Status Not Activated Authentication Message Activated Wiz Authenticate is continuously connect to the server 2000 01 01 00 04 55 Vigor2830 Series User s Guide 422 Dray Tek 2 Click the Activate link A login page for MyVigor web site will pop up automatically This service is available for MyVigor member only Please login to access MyVigor If you are not one of the members of MyVigor please create an account first
30. OWAN Z Only 2 WAMI ont Only establish YEN PY WAR dowr CAWAN Z oni Only establish YPN IWANI dowr WANA First WARS Only E Triss ee 1 WAN WAN2 WANS First While connecting the router will use WAN WAN2 WAN3 as the first channel for VPN connection If WAN fails the router will use another WAN interface instead WAN WAN2 WAN3 Only While connecting the router will use WAN WAN2 WAN3 as the only channel for VPN connection WANI only Only establish VPN if WAN2 down While connecting the router will use WAN2 for VPN connection If WAN2 fails the router will use backup WANI interface instead WAN2 only Only establish VPN if WAN1 down While connecting the router will use WAN1 for VPN connection If WAN fails the router will use backup WAN2 interface instead Netbios Naming Packet Pass click it to have an inquiry for data transmission between the hosts located on both sides of VPN Tunnel while connecting Block When there is conflict occurred between the hosts on both sides of VPN Tunnel in connecting such function can block data transmission of Netbios Naming Packet inside the tunnel Multicast via VPN Some programs might send multicast packets via VPN connection Pass Click this button to let multicast packets pass through the router Block This is default setting Click this button to let multicast packets be blocked by the router Call Direction
31. Vigor2830 Series User s Guide 168 Dr ay Te k 3 6 4 User Online Status This page displays the user s connected to the router and refreshes the connection status in an interval of several seconds User Management gt gt User Online Status Current Time 11 01 02 53 00 Refresh Seconds Page Refresh Index Profile IP Address User Last Login Time Expired Time Idle Time Action 1 admin 192 168 1 10 admin 10 31 08 50 50 Unlimited Unlimited Block Logout Total Number 1 Available settings are explained as follows Item Description Refresh Seconds Use the drop down list to choose the time interval of refreshing data flow that will be done by the system automatically Fefresh Seconds Refresh Click this link to refresh this page manually Index Display the number of the data flow Profile Display the authority of the account IP Address Display the IP address of the device User Display the users which connect to Vigor router currently You can click the link under the username to open the user profile setting page for that user Last Login Time Display the login time that such user connects to the router last time Expired Time Display the expired time of the network connection for the user Idle Time Display the idle timeout setting for such profile Action Block can prevent specified user accessing into Internet Unblock the user will be blocked Logout the user will be logged out forcefully
32. WAN gt Internet Access WAN 1 PPPoE PPPoA MPoA RFC1483 2684 IPvG Internet Access Mode Connection Type Details Page for IPv6 PPP in WAN1 WAN2 Dray Tek 89 Vigor2830 Series User s Guide During the procedure of IPv4 PPPoE connection we can get the IPv6 Link Local Address between the gateway and Vigor router through IPv6CP Later use DHCPv6 or Accept RA to acquire the IPv6 prefix address such as 2001 B010 7300 200 64 offered by the ISP In addition PCs under LAN also can have the public IPv6 address for Internet access by means of the generated prefix No need to type any other information for PPP mode WAN gt Internet Access WAN 1 PPPoE PPPoA MPoA RFC1483 2684 IPvG Internet Access Mode Connection Type PPP v Note IPv4 WAN setting should be PPPoE client Below shows an example for successful IPv6 connection based on PPPoE mode Online Status Physical Connection system Uptime 0 0 30 IPv4 IPv LAN Status IP Address 2001 5010 7300 200 21D AAFF FE7A 3E58 64 Global FE80 21D AAFF FE 7A 3E58 64 Link TA Packets RX Packets TX Bytes RX Bytes 7 B 618 D72 WAN2 IPv Status Enable Mode Up Time Yes PPP 0 00 11 IP Gateway IP 2001 8010 7300 200 21D AAFF FE A 3E5A 128 Global FE80 90 1400 242 AD52 FE80 1D AAFF FE A 3SE5A 128 Link DNS IP 2001 8000 168 1 2001 6000 168 2 TX Packets RX Packets TX Bytes RX Bytes Fi 4 544 616 Note At present the IPv6 prefix c
33. 0x321253abcde Next Click it to get into the next setting page Cancel Exit the wireless wizard without saving any changes 3 After typing the required information click Next The settings in the page limit the wireless station guest accessing into Internet but not being allowed to share the LAN network and VPN connection Wireless Wizard Guest AP Configuration Enable Disable Mame DrayTek_ Guest Rate Control Enable Upload sooo kbps Downloadsooon kbps Note The configured guest AF will not be able to access YPN connections or communicate with wireless devices connecting to the router s other 4Ps The guest AP will be configured to be not able to connect to LAN interfaces also However if the VLAN configurations were already made then the quest 4P will be able to connect to LAN ports belonging in the same VLAN group This 4P interface is by default configured for Internet access only Available settings are explained as follows Item Description Enable Disable Click it to enable or disable settings in this page Name Type the SSID name of this router SSID2 Vigor2830 Series User s Guide 56 Dr ay Tek Password The wireless mode offered by this wizard is WPA2 PSK The WPA encrypts each frame transmitted from the radio using the key which either PSK Pre Shared Key entered manually in this field below or automatically negotiated via 802 1x authentication Either 8 63 ASCII characters such as
34. 1 Optional Optional Index 1 15 in Schedule Setup EE i i aa WAN Connection Detection Mode Ping IF TTL Available settings are explained as follows Dray Tek Item 3G 4G USB Modem PPP mode Description Enable Disable Click Enable for activating this function If you click Disable this function will be closed and all the settings that you adjusted in this page will be invalid SIM PIN code Type PIN code of the SIM card that will be used to access Internet Modem Initial String Such value is used to initialize USB modem Please use the default value If you have any question please contact to your ISP APN Name APN means Access Point Name which is provided and required by some ISPs Type the name and click Apply Modem Initial String2 The initial string 1 is shared with APN In some cases user may need another initial AT command to restrict 3G band or do any special settings Modem Dial String Such value is used to dial through USB mode Please use the default value If you have any question please contact to your ISP PPP Username Type the PPP username optional 87 Vigor2830 Series User s Guide PPP Password Type the PPP password optional PPP Authentication Select PAP only or PAP or CHAP for PPP Index 1 15 in Schedule Setup You can type in four sets of time schedule for your request All the schedules can be set previously in Application gt gt Schedule
35. 200 Peer GRE IP 192 160 50 100 5 TCPAIP Network Settings My WAN IP ooo RIP Direction TRX Both Remote Gateway IP Oooo oe first subnet to remote network you have ta o Remote Network IP 152 165 10 0 Route Remote Network Mask 255 2755 755 0 265 Vigor2830 Series User s Guide 3 Later on peer side as VPN Client please type 192 168 50 100 in the field of My GRE IP and type IP address of the server 192 168 50 200 in the field of Peer GRE IP Callback Budget f minuters 4 GRE over IPSec Settings M Enable IPSec Dial Out function GRE over IPSec Logical Traffic GRE IP 92 168 50 100 Peer GRE IP 192 168 601 200 5 TCP IP Network Settings My WAN IP foo RIP Direction TURY Both Remote Gateway IP ooon From first subnet to remote network you hawe to 0 0 Ja Remote Network IP 152 168 1 0 Route Remote Network Mask 255 255 255 0 More E Change default route to this YPN tunnel Only single WAN supports this 3 JK Clear Cancel Advanced Backup After setting profiles for backup you can choose any one of them and click Advanced for more detailed configuration S http 192 168 1 1 FPN Backup Advance Settings Microsoft Internet Explorer Seles VPN Backup Advance Settings Profile Name Backupl ERO Mode Normal O Resume Member 1 first Detail Information Environment Recovers DPetection ERD Status Normal Mode ii E lt il gt Avail
36. ADSL Ethernet or USB of this interface Name Display the name of the router Mode Displays the type of WAN connection e g PPPoE Up Time Displays the total uptime of the interface IP Displays the IP address of the WAN interface GW IP Displays the IP address of the default gateway TX Packets Displays the total transmitted packets at the WAN interface TX Rate Displays the speed of transmitted octets at the WAN interface RX Packets Displays the total number of received packets at the WAN interface RX Rate Displays the speed of received octets at the WAN interface Detailed explanation for IPv6 is shown below Item LAN Status WAN IPv6 Status Vigor2830 Series User s Guide Description IP Address Displays the IPv6 address of the LAN interface TX Packets Displays the total transmitted packets at the LAN interface RX Packets Displays the total received packets at the LAN interface TX Bytes Displays the speed of transmitted octets at the LAN interface RX Bytes Displays the speed of received octets at the LAN interface Enable No in red means such interface is available but not enabled Yes in green means such interface is enabled No in red means such interface is not available Mode Displays the type of WAN connection e g TSPC 20 Dray Tek Item Description Up Time Displays the total uptime of the interface IP Displays the IP address of the
37. Action Profile Pass w 141 60000 Mone Edit nooooooo ok _Cancel_ Available settings are explained as follows Item Filter Vigor2830 Series User s Guide Description Select Pass or Block for the packets that do not match with the filter rules Me Dray Tek Dray Tek Sessions Control Quality of Service Load Balance Policy User Management APP Enforcement URL Content Filter Filter The number typed here is the total sessions of the packets that do not match the filter rule configured in this page The default setting is 60000 Choose one of the QoS rules to be applied as firewall rule For detailed information of setting QoS please refer to the related section later Choose the WAN interface for applying Load Balance Policy Auto Select Auto Select Such item is available only when Rule Based is selected in User Management gt gt General Setup The general firewall rule will be applied to the user user group all users specified here User Object Create New User User Group Create Mew Group ALL Note When there is no user profile or group profile existed Create New User or Create New Group item will appear for you to click to create a new one Select an APP Enforcement profile for global IM P2P application blocking If there is no profile for you to select please choose Create New from the drop down list in this page to create a new profile All
38. After successful installation for the first time user you should click on the Step 0 Configure button Reboot the host Smart FPN Client 3 2 2 WinXP See Step This step will add the ProhibitlpSec registry value to computer in order to configure a LeTPIPSec connection using 4 pre shared key or a L2TP connection For more information please read the article O 40262 in the Microsoft Knowledgement Base Configure Step 1 Dial to ISP IF vou have already gotten a public IP you can skip this step Step 2 Connect to YPN Server Insert Remove Status Mo connection PPTP ISP amp VPN 3 InStep 2 Connect to VPN Server click Insert button to add a new entry If an I PSec based service is selected as shown below Vigor2830 Series User s Guide 406 Dr ay Te k Dray Tek Dial To TEHN Say VPN Server IP HOST Nametsuch as 123 45 67 89 or draytek com 192 165 1 1 User Name Type of YPM OL2TP CL2TP over IPSec PPTP Encryption C Use default gateway on remote network You may further specify the method you use to get IP the security method and authentication method If the Pre Shared Key is selected it should be consistent with the one set in VPN router IPSec Policy Sethng My IP 172 16 3 100 Type oF IPSec Standard IPSec Tunnel Virture IP DrayTek virture Interface Obtain an IP address automatically DHCP over IPSec Specify an IP address ic a eee Subnet Mask
39. Authentication Check this box to activate this function while using e mail application User Name Type the user name for authentication Password Type the password for authentication Enable E mail Alert Check the box to send alert message to the e mail box while the router detecting the item s you specify here Click OK to save these settings For viewing the Syslog please do the following L 2 Dray Tek Just set your monitor PC s IP address in the field of Server IP Address Install the Router Tools in the Utility within provided CD After installation click on the Router Tools gt gt Syslog from program menu fy Router Tools 2 5 1 2 About Router Tools bi Firmware Uperade Utility fF Sysloe i gt Uninstall Router Tools 3 5 1 Visit DrayTek Web Site From the Syslog screen select the router you want to monitor Be reminded that in Network Information select the network adapter used to connect to the router Otherwise you won t succeed in retrieving information from the router 347 Vigor2830 Series User s Guide ee ie Dray Tek ee a ee WAN Information 172 16 3 130 TX Rate RX Rate Fi Log Filter Keyword Apply to sid Tool Setup Telnet Read out Setup Codepase Information Recovery Network Information Net State Firewall Host Name carrie 0c7cb251 NIC Description Atheros 4R8121 4R8113 4R8114 PCI E Ethernet Controller Pack
40. Available settings are explained as follows Item Description Enable Click this to enable this entry Phone Number The speed dial number of this index This can be any number you choose using digits 0 9 and Vigor2830 Series User s Guide 276 Dr ay Te k Display Name The Caller ID that you want to be displayed on your friend s screen This let your friend can easily know who s calling without memorizing lots of SIP URL Address SIP URL Enter your friend s SIP Address Dial Out Account Choose one of the SIP accounts for this profile to dial out It is useful for both sides caller and callee that registered to different SIP Registrar servers If caller and callee do not use the same SIP server sometimes the VoIP phone call connection may not succeed By using the specified dial out account the successful connection can be assured Loop through Choose PSTN to enable loop through function Backup Phone Number When the VoIP phone is obstructs or the Internet breaks down for some reasons the backup phone will be dialed out to replace the VoIP phone number At this time the phone call will be changed from VoIP phone into PSTN call according to the loop through direction chosen Note that during the phone switch the blare of phone will appear for a short time And when the VoIP phone is switched into the PSTN phone the telecom co might charge you for the connection fee Please type in backup phone number for this Vo
41. Connection Type DHCP vb Client DHCP Client Configuration Identity Association Prefix Delegation Non temporary Address IAID Identity Association ID 11570169 Available settings are explained as follows Item Description Identify Association Choose Prefix Delegation or Non temporary Address as the identify association IAID Type a number as IAID After finishing all the settings here please click OK to save the configuration Dr ay Tek 93 Vigor2830 Series User s Guide Details Page for IPv6 Static IPv6 in WAN1 WAN2 This type allows you to setup static IPv6 address for WAN interface WAN gt Internet Access WAN 1 PPPoE PPPoA MPoA RFC1463 2604 IPvb Internet Access Mode Connection Type Static IPvb Address configuration IPve Address Prefix Length rs aa Current IPv Address Table Index IPwh iddress Prefix Length Static IPvo Gateway configuration IPvo Gateway Address BO Available settings are explained as follows Item Description Static IPv6 Address IPv6 Address Type the IPv6 Static IP Address configuration Prefix Length Type the fixed value for prefix length Add Click it to add a new entry Delete Click it to remove an existed entry Current IPv6 Address Display current interface IPv6 address Table Static IPv6 Gateway IPv6 Gateway Address Type your IPv6 gateway address Configuration here After finishing all the settings here please click OK to save the
42. Delete Click this button to delete the selected VPN TRUNK profile The corresponding members LAN to LAN profiles grouped in the deleted VPN TRUNK profile will be released and that profiles in LAN to LAN will be displayed in black Time for activating VPN TRUNK VPN Backup mechanism profile VPN TRUNK VPN Backup mechanism will be activated automatically after the initial connection of single VPN Tunnel off line The content in Member 1 2 within VPN TRUNK VPN Backup mechanism backup profile is similar to dial out profile configured in LAN to LAN web page VPN TRUNK VPN Backup mechanism backup profile will process and handle everything unless it is off line once it is activated Vigor2830 Series User s Guide 264 Dr ay Te k How can you set a VPN TRUNK VPN Backup mechanism profile l First of all go to VPN and Remote Access gt gt LAN to LAN Set two or more LAN to LAN profiles first that will be used for Member1 and Member2 If you do not set enough LAN to LAN profiles you cannot operate VPN TRUNK VPN Backup mechanism profile management well Access into VPN and Remote Access gt gt VPN TRUNK Management Set one group of VPN TRUNK VPN Backup mechanism backup profile by choosing Enable radio button type a name for such profile e g 071023 choose one of the LAN to LAN profiles from Member1 drop down list choose one of the LAN to LAN profiles from Member2 drop down list and click Add at last General Se
43. Enable Line Name Mode Up Time Yes DSL PPPOE 00 00 00 IP GW IP TX Packets TX Rate Bps RX Packets RX Rate Bps 0 0 0 D WAN Status Enable Line Name Mode Up Time Yes Ethernet Static IP 4 07 44 IP GW IP TX Packets TX Rate Bps RX Packets RX Rate Bps 172 16 1 1 29011 351 125630 1230 WAN 3 Status Enable Line Name Mode Up Time Signal ves USE was 00 00 0d IP GW IF TX Packets TX Rate Bps RX Packets RX Rate Bps 0 0 D D Physical Connection for IPv6 Protocol Online Status Physical Connection System Uptime 4 3 42 IPw4 IPwo LAN Status IP Address FESO 250 7FFF FEEA 7FECS 64 LINK TX Packets RX Packets TX Bytes RX Bytes 2 O 156 O WAN IPvb Status Enable Mode Up Time Offline ae Gateway IP Detailed explanation for IPv4 is shown below Dr ay Te k 19 Vigor2830 Series User s Guide Item LAN Status WANI1 WAN2 WAN3 Status Description Primary DNS Displays the primary DNS server address for WAN interface Secondary DNS Displays the secondary DNS server address for WAN interface IP Address Displays the IP address of the LAN interface TX Packets Displays the total transmitted packets at the LAN interface RX Packets Displays the total received packets at the LAN interface Enable Yes in red means such interface is available but not enabled Yes in green means such interface is enabled Line Displays the physical connection VDSL
44. Kleas Other P2P Applications unlel Ares Vigor2830 Series User s Guide VWagaa ezPeer PP365 POCO Clubbox Pando Huntmine KU wo 19s DrayTek Dray Tek Below shows the items which are categorized under IM CSM gt APP Enforcement Profile Profile Index 1 Profile Name IM P P PROTOCOL OTHERS Select All Clear All Support List Activity Application Yahoo AIM lt v5 9 Lagin Message File Transfer Game ConferencelVideao Voice Other Activities IM Application AIMG SY OQ TM iChat Jabber GoogleTalk Googlechat Fire GaduGadu Paltalk Skype kubano next POC CPPS65 4resChat Pa A Gizmo SIP RTF IKC ILavya La ava Ice spc I TelTel TeamSpeak ie MobileMSMN EaiduHi Fetion RaidCall I LIME Web IM more than one address eMessenger WebMSN meebo eBuddy ILovelM WWebIM URLs ICQ Java ICQ Hash qoowy IMhaha getMessenger IMUnitive Wablet mabber MSN2G0 KoollM MessengerFx MessengerAdictos WebyahoolIM The items categorized under OTHERS CSM gt gt APP Enforcement Profile Profile Index 1 Profile Name oOo IM P2P PROTOCOL OTHERS Select All Clear All Support List Tunneling Sacks4 5 PoPHet HTTP Proxy Reply Tor VAN SoattEther MS TEREDO Skytire Hamachi HTTP Tunnel Ping Tunnel Tiny VP RealTunnel DynaPass UltravPH Freel WupefUltrasurt Hotspot Shield MPS TSP TT Hants PPStream FeiDian UUSee MSPlayer PAST SopCast UDLives TUPI layer My See FlashVided Silverlight Sl
45. LAN 2 a T LAN 3 a _ gt LAN 4 a F o Dray Te k 377 Vigor2830 Series User s Guide ll Tag Based VLAN By identifying the tagged message Vigor2830 can divide the LAN Port into several VLAN groups Such LAN port with tagged information will accept the packets only with VLAN ID number For example Vigor2830 can divide the internal departments of a company into four different groups by using VigorSwitch 2240 Each group uses different network segment and does not link for each other VigorSwitch 2240 Trunk Port 23 and Vigor2830 LAN Port 4 are connected with network cable See the following graphic for an example LAN Port 4 VigorSwitch Trunk Port 23 G2240 pow WLANS o R amp D Dept LAN4 192 168 7 x VLAN ee ee Sales Dept LAN 192 168 5 x VLAN ee Se Finance Dept LAN2 192 168 3 x VLANO _ ea HR Dept LAN 192 168 1 x Group 0 VLANO Human Resource LAN Port 4 IP 192 168 1 0 24 Group 1 VLAN1 Finance Dept LAN Port 4 IP 192 168 3 0 24 Group 2 VLAN2 Sales Dept LAN Port 4 IP 192 168 5 0 24 Group 3 VLAN3 R amp D LAN Port 4 IP 192 168 7 0 24 Configuration for Vigor2830 1 Inthe page of LAN gt gt VLAN Configuration check the box of Enable to enable the function of VLAN Configuration 2 To activate the function of VLAN Tag for VLANO setting check the box of Enable and type the value 7 for VID setting Then check P4 and set LAN as the Subnet 3 To activate the function
46. Non privileged users can control some router functions including removing and adding port mappings The UPnP function dynamically adds port mappings on behalf of some UPnP aware applications When the applications terminate abnormally these mappings may not be removed Vigor2830 Series User s Guide 236 Dr ay Tek 3 10 7 IGMP IGMP is the abbreviation of Internet Group Management Protocol It is a communication protocol which is mainly used for managing the membership of Internet Protocol multicast groups Applications gt gt IGMP IGMP L JEnable IGMP Proxy WANT w IGMP Proxy is to act as a multicast proxy for hosts on the LAN side Enable IGMP Proxy if you will access any multicast group But this function take no affect when Bridge Mode is enabled L JEnable IGMP Snooping Enable IGMP Snooping multicast traffic is only forwarded to ports that have members of that group Disable IGMP snooping multicast traffic is treated in the same manner as broadcast traffic Refresh Working Multicast Groups index Group P P P P Available settings are explained as follows Item Description Enable IGMP Proxy Check this box to enable this function The application of multicast will be executed through WAN port In addition such function is available in NAT mode Enable IGMP Snooping Check this box to enable this function Multicast traffic will be forwarded to ports that have members of that group Dis
47. Specify the allowed call direction of this LAN to LAN profile Both initiator responder Dial Out initiator only Dial In responder only Always On Check to enable router always keep VPN connection Idle Timeout The default value is 300 seconds If the connection has been idled over the value the router will drop the connection a Dray Tek Dray Tek Dial Out Settings Enable PING to keep alive This function is to help the router to determine the status of IPSec VPN connection especially useful in the case of abnormal VPN IPSec tunnel disruption For details please refer to the note below Check to enable the transmission of PING packets to a specified IP address Enable PING to keep alive is used to handle abnormal IPSec VPN connection disruption It will help to provide the state of a VPN connection for router s judgment of redial Normally if any one of VPN peers wants to disconnect the connection it should follow a serial of packet exchange procedure to inform each other However if the remote peer disconnect without notice Vigor router will by no where to know this situation To resolve this dilemma by continuously sending PING packets to the remote host the Vigor router can know the true existence of this VPN connection and react accordingly This is independent of DPD dead peer detection PING to the IP Enter the IP address of the remote host that located at the other end of the VPN tunnel
48. Then click Next Quick Start Wizard WAN Interface WAN Interface WANS Physical Mode Ethernet Physical Type Auto negotiation Auto negotiation TOM half duplex TOM full duplex 100M half duplex TOON Tull duplex On the next page as shown below please select the appropriate Internet access type according to the information from your ISP For example you should select PPPoE mode if the ISP provides you PPPoE interface Then click Next for next step Quick Stan Wizard Connect to Internet WAN 2 Select one of the following Internet Access types provided by your ISP PPPoE PPTP L2TP Static IP DHCP PPPoE PPPoE stands for Point to Point Protocol over Ethernet It relies on two widely accepted standards PPP and Ethernet It connects users through an Ethernet to the Internet with a common broadband medium such as a single DSL line wireless device or cable modem All the users over the Ethernet can share a common connection PPPoE is used for most of DSL modem users All local users can share one PPPoE connection for accessing the Internet Your service provider will provide you information about user name password and authentication mode Dr ay Tek 29 Vigor2830 Series User s Guide 1 Choose WAN2 as the WAN Interface and click the Next button The following page will be open for you to specify Internet Access Type Quick Start Wizard Connect to Internet WAN 2 Select one of the followin
49. VLAN2 Sales Dept LAN Port 3 Port 4 IP 192 168 5 0 24 Configuration 1 Inthe page of LAN gt gt VLAN Configuration check the box of Enable to enable the function of VLAN Configuration 2 For VLANO setting check P1 and set LAN1 as the Subnet 3 For VLANI setting check P2 and set LAN2 as the Subnet 4 For VLAN2 setting check P3 and P4 and set LAN3 as the Subnet Dray Tek 375 Vigor2830 Series User s Guide LAN gt VLAN Configuration VLAN Configuration Enable Wireless LAN SSID1 SSID2 SSIDS SSID4 Subnet Enable Nao NS w M1 w LAN 1 M1 w M1 w M1 w OOOoOoOooOs Hooooownas HoooowoaoSs HoooowoagsE Hoooooao ma o n e n a a sl lll Permit untagged device in Pl to access router 1 Tag based WYLAN only applied for LAN Ports 2 The checked Wireless LAN SSID will not has WLAN tagging function but regarded as joining WYLAN group 3 The set VLAN ID VID must be unique and not duplicate OK clear _Cancel_ 5 Inthe page of LAN gt gt General Setup check the Status box of LAN2 and LAN3 and enable the function of DHCP LAN gt General Setup General Setup Index Status DHCP IP Address LAN 1 V 192 168 1 1 LAN 2 192 168 3 1 LAN 3 192 168 5 1 LAN 4 O 192 168 7 1 IF Routed Subnet O 192 168 0 1 Advanced You can configure DHCP options here Force router to use ONS server IP address settings specified in After finishing the above configuration the equipment con
50. WAN3 Disable 100000Kbps 100000Kbps 25 25 25 25 Inactive Status Setup Class Rule Index Name Rule Service Type Class 1 VoIP Edit Class 2 HTTP Edit Edit Class 3 Mail Edit Enable the First Priority for VoIP SIP RTP SIP UDP Port 5960 Default 5060 Available settings are explained as follows Item Description General Setup Index Display the WAN interface number that you can edit Dray Tek Status Display the current QoS status of this WAN Bandwidth Display the inbound and outbound bandwidth setting for the WAN interface Direction Display which direction that such function will influence Class 1 Class2 Class 3 Others Display the bandwidth percentage for each class UDP Bandwidth Control Display the UDP bandwidth control is enabled or not Online Statistics Display an online statistics for quality of service for your reference Setup Allow to configure general QoS setting for WAN interface Class Rule Index Display the class number that you can edit Name Display the name of the class Rule Allow to configure detailed settings for the selected Class Service Type Allow to configure detailed settings for the service type 215 Vigor2830 Series User s Guide Item Description Enable the First Priority When this feature is enabled the VoIP SIP RTP packets will for VoIP SIP RTP be sent with highest priority SIP UDP Port Set a port number used for SIP This page displays the QoS setti
51. Wireless LAN ONIOFF WPS ACT WLAN Line O USB DSL Phonet Factory e Q i Reset CSM WAN2 Phone2 3 If not it means that there is something wrong with the hardware status Simply back to 1 3 Hardware Installation to execute the hardware installation again And then try again Dr ay Tek 443 Vigor2830 Series User s Guide 5 2 Checking If the Network Connection Settings on Your Computer Is OK or Not Sometimes the link failure occurs due to the wrong network connection settings After trying the above section if the link is stilled failed please do the steps listed below to make sure the network connection settings is OK For Windows The example is based on Windows 7 Professional Edition As to the El examples for other operation systems please refer to the similar steps or find support notes in www DrayTek com 1 Open All Programs gt gt Getting Started gt gt Control Panel Click Network and Sharing Center pa UTILS gt Java us Network and sharing Center Personalization E Recove ry 2 Inthe following window click Change adapter settings SE Network and Sharing Center E Js us Control Panel All Control Panel terns Network and Sharing Center Control Panel Home View your basic network information and set up connecti Change adapter settings A ET ange advanced sharing WITH PRO SYR Metwork 28 settings This computer View your active networks be Network 28 Work network
52. a Received C tp Packets View Wireless Networks 5 Try to open a new tab in the same browser for IE 7 0 FireFox and above or open a new web browser 6 The first connection session will be redirected to DrayTek Website specified in step 2 automatically Dr ay Tek 391 Vigor2830 Series User s Guide About DrayTek Your reliable networking solutions partner Ei Products Dual WAN SSL VPN Appliance D S o E E SPX MHE English ca Partners Contact Us Vigor2950 Support Education Categories Product Quick Finder DrayTek at info Security gt Accessories gt ADSL2 2 Router 2009 in Taipei gt ADSL2 Security Firewall gt Broadband Router m April 22 24 2009 gt Dual WAN Security Router gt Dual WAN SSL VPN series i What s New Taipei Taiwan gt G SHDSL Security Router gt IP Sharing gt DrayTek Mobile Office Tour big DrayTek Mobile Office Tour gt MSAN IP DSLAM gt Multi WAN Security Router success in the Netherlands Mar 16 20 2009 gt Network Management System gt Network Switch gt DrayTek Great Hit at CeBIT in the Netherlands gt Powerline HomePlug gt Unified Threat Management 2009 gt USB ISDN TA gt VolP Phone Adapter gt DrayTek at EXPO COMM Solutions gt Wireless Networking gt SOHO Networking gt Enterprise Networking gt For Broadband Providers Mexico 2009 Awards gt DrayTek Vigor2820n professional ADSL2 2 Router in Brazil
53. gt gt DMZ Host Setup DMZ Host Setup WAN1 WAN2 WAN3 WAN4 WAN5 WAN 1 Private IP Private IP 192 168 1 11 MAC Address of the True IP DMZ Host Note When a True IP DMZ host is turned on it will force the router s WAN connection to be always on DMZ Host for WAN2 and WAN3 is slightly different with WAN Active True IP selection is available for WAN only See the following figure NAT gt DMZ Host Setup DMZ Host Setup WAN WAN WANS WAN Enable Private IP D mo If you previously have set up WAN Alias for PPPoE or Static or Dynamic IP mode in WAN2 interface you will find them in Aux WAN IP for your selection Vigor2830 Series User s Guide 136 Dr ay Te k NAT gt DMZ Host Setup DMZ Host Setup WANT WAN WANS WAN 2 Index Enable Aux WARK IP Private IP Available settings are explained as follows Item Description Enable Check to enable the DMZ Host function Private IP Enter the private IP address of the DMZ host or click Choose PC to select one Choose PC Click this button and then a window will automatically pop up as depicted below The window consists of a list of private IP addresses of all hosts in your LAN network Select one private IP address in the list to be the DMZ host ETET Ses 132 168 110 13 168 118 When you have selected one private IP from the above dialog the IP address will be shown on the following screen Click OK to save the setting
54. gt gt Phone 1 Tone Settings Region User Defined Caller ID Type FSK_ETSI Low Freg High Freq Toni T off 1 Ton T off 2 Hz Hz msec msec msec msec Volume Gain DTMF Mic Gain 1 10 DTMF Mode and a Payload Type RFC2833 Speaker Gain 1 10 96 127 MISC Dial Tone Power Level 1 50 Ring Frequency 10 SOHZ Call Waiting Tone Power Level 1 30 Available settings are explained as follows Dray Tek Item Region Description Select the proper region which you are located The common settings of Caller ID Type Dial tone Ringing tone Busy tone and Congestion tone will be shown automatically on the page If you cannot find out a suitable Vigor2830 Series User s Guide Volume Gain MISC DTMF Vigor2830 Series User s Guide one please choose User Defined and fill out the corresponding values for dial tone ringing tone busy tone congestion tone by yourself for VoIP phone Advance Settings gt gt Phone Tone Settings Region User Defined User Defined o Portugal Volume GAustralia a n slovenia Mic Gain Czech Speaker Slovakia Hungary MISC Switzerland 7 __ France Dial Tone UK CCA Ring Freq China Taiwan Also you can specify each field for your necessity It is recommended for you to use the default settings for VoIP communication Mic Gain 1 10 Speaker Gain 1 10 Adjust the volume of microphone and speaker by entering number from 1 10
55. sagao l l l 5 Note 1 Set O0 means default value 2 PCRimax ADSL Up Speed 53 B Available settings are explained as follows Item Description QoS Type Select a proper QoS type for the channel according to the information that your ISP provides Vigor2830 Series User s Guide 100 Dr ay Tek PCR SCR MBS It represents Peak Cell Rate The default setting is 0 It represents Sustainable Cell Rate The value of SCR must be smaller than PCR It represents Maximum Burst Size The range of the value is 10 to 50 After finishing all the settings here please click OK to save the configuration Port based Bridge General page lets you set the first PVC As to set the second PVC line please click the Port based Bridge tab to open Bridge configuration page WAN gt Multi PVCs Multi PVCs General Channel 1 a a ih 5 Enable i N p N gN O Fort based Bridge PVC to PVC Binding Add Tag Pi P2 P3 P4 Service Type Mormal Jil Mormal Mormal Mormal Mormal GMP Mormal Mote 1 Channel 1 to 2 are reserved for Nat Route use GMP 2 P1 is reserved for Nat Route use _ Available settings are explained as follows Item Enable P1 to P4 Service Type Dray Tek Description Check this box to enable that channel Only channel 3 to 8 can be set in this page for channel to 2 are reserved for NAT using It means the LAN port 1 to 4 Check
56. 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Decoded Format 0 0 0 0 gt 0 0 0 0 Pr 0 len O 0 Available settings are explained as follows Item Description Decoded Format It shows the source IP address local destination IP remote address the protocol and length of the package Refresh Click it to reload the page Dray Te k 357 Vigor2830 Series User s Guide 3 18 2 Routing Table Click Diagnostics and click Routing Table to open the web page Diagnostics gt gt View Routing Table Current Running Routing Table IPv6 Routing Table Refresh private C connected 5 static R RIP default 0 0 0 0 0 0 0 0 via 172 16 1 1 WANZ 192 168 1 0 255 255 255 0 directly connected LANI 172 16 0 0 255 255 0 0 directly connected WANZ Or Diagnostics gt gt View Routing Table IPv6 Routing Table Refresh Interface Flags Metric Next Hop LAM U 256 LAM U 256 Current Running Routing Table Destination FESO 64 FFOO 8 Available settings are explained as follows Item Description Refresh Click it to reload the page Vigor2830 Series User s Guide 358 Dray Tek 3 18 3 ARP Cache Table Click Diagnostics and click ARP Cache Table to
57. 1 Enable Display Name Physical Mode Physical Type Line Speed Kbps DownLink Uplink VLAN Tag insertion Tag value Priority Active Mode Backup Type Only if acting as backup for multiple WANG Note Line Speed only used for load Disable Please configure Internet Access setting first Oo o 4095 p o Load Balance WAN 1 LIWaAn 2 LIWAN 3 When any of selected WAN disconnect O when all of selected WAN disconnect balance mode according to Line Speed Available settings are explained as follows Item Enable Display Name Physical Mode Physical Type Line Speed Vigor2830 Series User s Guide Description Choose Yes to invoke the settings for this WAN interface Choose No to disable the settings for this WAN interface Type the description for such WAN interface Display the physical mode of such WAN interface In such WAN interface no type can be selected If your choose According to Line Speed as the Load Balance Mode please type the line speed for downloading and uploading for such WAN interface The unit is kbps 66 Dray Tek VLAN Tag insertion Enable Enable the function of VLAN with tag The router will add specific VLAN number to all packets on the WAN while sending them out Please type the tag value and specify the priority for the packets sending by WANI1 Disable Disable the function of VLAN with tag Tag value Type the value as the VLAN ID num
58. 2 Enable Display Name Physical Mode Physical Type Line Speed Kbps Downlink UpLink VLAN Tag insertion Tag value Priority Active Mode Backup Type Only if acting as backup for multiple WAM Ethernet Auto negotiation Disable Please configure Internet Access setting first 7 0 4095 ojos Load Balance IWAN 1 WAN 2 Wan 3 When any of selected WAN disconnect OWhen all of selected WAN disconnect Note Line Speed only used for load balance mode according to Line Speed Available settings are explained as follows Item Enable Display Name Physical Mode Physical type Line Speed VLAN Tag insertion Vigor2830 Series User s Guide Description Choose Yes to invoke the settings for this WAN interface Choose No to disable the settings for this WAN interface Type the description for such WAN interface Display the physical mode of such WAN interface You can change the physical type for WAN2 or choose Auto negotiation for determined by the system Physical Type Auto ne gotiation o TUM half duplex 10M1 full duplex 100M1 half duplex 100M1 full duplex If your choose According to Line Speed as the Load Balance Mode please type the line speed for downloading and uploading for such WAN interface The unit is kbps Enable Enable the function of VLAN with tag The router will add specific VLAN number to all packets on the WAN while sending them out P
59. 2 g0 00 00 00 00 00 USB2 CONNECTED FE80 2 SD5C CAb6 5428 3CAT 00 26 2d fe aAs 4 LAN STALE FFO2 1 Fr0A 673C 33 33 ff 0a 67 3c LAN CONNECTED FE80 213 CEFF FE0A 673C 90 13 ce a 67 3c LAN STALE FFO2 1 FFBO B00C 33 33 ff bO0 bO0 Oc LAN CONNECTED PRAD 90 1000 242 ADS 0o 060 00 060 00 00 USB2 CONNECTED i lFRFOZ 16 33 33 00 00 00 16 LAN CONNECTED Wal Available settings are explained as follows 359 Vigor2830 Series User s Guide Dray Tek Item Description Refresh Click it to reload the page 3 18 5 DHCP Table The facility provides information on IP address assignments This information is helpful in diagnosing network problems such as IP address conflicts etc Click Diagnostics and click DHCP Table to open the web page Diagnostics gt gt View DHCP Assigned IP Addresses DHCP IP Assignment Table DHCP v6 IP Assignment Table Refresh 192 168 1 1 255 255 255 0 DHCP server On MAC Address Leased Time HOST ID E0 CB 4E DA 48 75 10 10 54 970 carrie OcTcb251 00 1D AA 00 00 00 Or Diagnostics gt gt View DHCP Assigned IP Addresses DHCP IP Assignment Table DHCP v6 IP Assignment Table Refresh DHCPy6 server binding client Index IP76 Address MAC Address Leased Time Each item 1s explained as follows Item Description Index It displays the connection item number IP Address It displays the IP address assigned by this router for specified PC MAC Address It displays the MAC
60. 3 Icons of network connection will be shown on the window Right click on Local Area Connection and click on Properties Local 4rea Connection Local Mehwork 28 ioe sabl Intel R PROS1000 E elif Local 4rea Conner Diagnose Vig See o Network cable un scar Se aT TAR Win32 Adapt W Bridge Connections AN Create Shortcut Ay Rename E Properties Vigor2830 Series User s Guide 444 Dr ay Te k 4 Select Internet Protocol Version 4 TCP IP and then click Properties Local Area Connection Properties A Networking Sharing Connect using E Intel R PRO 7000 MT Network Connection This connection uses the following tema JE Client for Microsoft Networks ia Privacyware Filter Driver w tos Packet Scheduler E ial File and Printer Sharing for Microsoft Networks rik n a Link Layer Topology Discovery Responder rt aan m 5 Select Obtain an IP address automatically and Obtain DNS server address automatically Finally click OK Internet Protocol Version 4 TCP 1Pv4 Properties 21x General Alternate Configuration You can get IF settings assigned automatically iF your network supports this capability Otherwise you need to ask your network administrator For the appropriate IP settings f Obtain an IP address automatically Ose Che Ponowing IF address f Obtain DNS server address automatically Use the Following DNS server addresses ig 2 Advanced
61. Alert for more detailed information Advance Setting Click Edit to open the following window However it is strongly recommended to use the default settings here Firewall gt gt General Setup Advance Setting Codepage JAN SIC 252 Latin w Window size 65535 Session timeout 1440 Minute Codepage This function is used to compare the characters among different languages Choose correct codepage can help the system obtaining correct ASCH after decoding data from URL and enhance the correctness of URL Content Filter The default value for this setting is ANSI 1252 Latin I If you do not choose any codepage no decoding job of URL will be processed Please use the drop down list to choose a codepage If you do not have any idea of choosing suitable codepage please open Syslog From Codepage Information of Setup dialog you will see the recommended codepage listed on the dialog box Dray Tek P Syslog Utility EALE ae WAN bioan Fels i gt ee 181 1 z Te Rate R Blab St T ty Piik loH Sebio Tele Eemien deiin Codepage Infoematon Recovery Hetheiak lnfonnabon Hel iia al inme To Bch Windown Vernon 501 2500 RECOM Ti COE AGE wat GA ANGL a Tadi Binal hone Das x Dial Caen e MDD a AD Cel ede PT Ye De ie Bie Oe Window size It determines the size of TCP protocol Vigor2830 Series User s Guide 148 Dr ay Tek O 65535 The more the value is the better the performance will be However if t
62. Any Src IP Start Src IP End rt Destination IP Any Dest IP Start Dest IP End rt Available settings are explained as follows Item Description Source IP Any Any IP can be treated as the source IP Src IP Start Type the source IP start for the specified WAN interface Src IP End Type the source IP end for the specified WAN interface If this field is blank it means that all the source IPs inside the LAN will be passed through the WAN interface Destination IP Any Any IP can be treated as the destination IP Dest IP Start Type the destination IP start for the specified WAN interface Dest IP End Type the destination IP end for the specified WAN interface If this field is blank it means that all the destination IPs will be passed through the WAN interface 3 Click Next to get the following page Dr ay Tek 127 Vigor2830 Series User s Guide Load Balance Route Policy Index 1 Interface Load Balance Route Policy directs the packets to the interface below Interface LAM LAN IP Routed Subnet q Available settings are explained as follows Item Description Interface Use the drop down list to choose a WAN or LAN interface or VPN profile Packets match with the above criteria will be transferred to the interface chosen here 4 After specifying the interface click Next to get the following page Load Balance Route Policy Index 1 NAT or Routing Based on the settin
63. Available settings are explained as follows Item Network Configuration Vigor2830 Series User s Guide Description Enable Disable Click Enable to enable such configuration Click Disable to disable such configuration For Routing Usage Click this radio button to invoke this M2 Dray Tek Dray Tek DHCP Server Configuration function IP Address Type in private IP address for connecting to a local private network Default 192 168 1 1 Subnet Mask Type in an address code that determines the size of the network Default 255 255 255 0 24 RIP Protocol Control Disable Deactivate the RIP protocol It will lead to a stoppage of the exchange of routing information between routers Default Enable Activate the RIP protocol DHCP stands for Dynamic Host Configuration Protocol The router by factory default acts a DHCP server for your network so it automatically dispatch related IP settings to any local user configured as a DHCP client It is highly recommended that you leave the router enabled as a DHCP server if you do not have a DHCP server for your network If you want to use another DHCP server in the network other than the Vigor Router s you can let Relay Agent help you to redirect the DHCP request to the specified location Start IP Address Enter a value of the IP address pool for the DHCP server to start with when issuing IP addresses If the Ist IP address of your router is 192 168
64. B LAN User Group 1 Password wug456 Password lug123 Nina s PE Diana s PE he Amy s PC Ta Za ed Not controlled by user Management LAN User Group 2 Password lug456 Note Filter rules configured under Firewall usually are applied to the host the one that the router installed only With user management the rules can be applied to every user connected to the router with customized profiles Note If Transparency Mode is selected in Firewall gt gt General Setup User Management cannot be used any more Please uncheck Transparency Mode first if you want to utilize user management to handle users in LAN WAN or WLAN Dray Te k 161 Vigor2830 Series User s Guide ser Management 3 6 1 General Setup General Setup can determine the standard rule based or user based for the users controlled by User Management The mode standard selected here will influence the contents of the filter rule s applied to every user User Management gt gt General Setup General Setup Mode Fule Based Display IP Address on tracking window Of Web Authentication HTTPS Notice User Management will refer to active rules in Data Filter as whitelists and blacklists In User based firewall mode Users match the above lists will not be required for authentication The firewall rules policy will still valid Otherwise authentication required for users not matched the above lists The firewall rules
65. Corrected SSH didn t work with Macintosh while it can work on Windows and Linux Corrected VigorACS SI couldn t show Network information when DNS Filter was enabled for Vigor2830 Corrected Some error on External Device Status page Corrected Remove Mhaha getMessenger IMUnitive Wablet from WebIM on CSM gt gt APP Enforcement Profile Vigor2830 Series User s Guide 460 Dr ay Tek
66. DES 3DES AES 7 Atlast set the remote network IP subnet in TCP IP Network Settings so that Router B can direct the packets destined to the remote network to Router A via the VPN connection 4 TCP IP Network Settings My WAN IP 0 0 0 0 RIP Direction Remote Gateway IP hood From first subnet to remote network you have to 0 0 do Remote Network IP 192 168 1 0 Remote Network Mask 255 255 255 0 i Haesiienrorns iP 192 165 11 l Change default route to this YPN tunnel Only single WAN supports this Local Network Mask 755 255 255 0 lore Dr ay Tek 403 Vigor2830 Series User s Guide 4 8 Create a Remote Dial in User Connection Between the Teleworker and Headquarter The other common case is that you as a teleworker may want to connect to the enterprise network securely According to the network structure as shown in the below illustration you may follow the steps to create a Remote User Profile and install Smart VPN Client on the remote host VPN Router Internet 210 135 240 208 Remote Network 192 168 1 0 Settings in VPN Router in the enterprise office 1 Goto VPN and Remote Access and select Remote Access Control to enable the necessary VPN service and click OK 2 Then for using PPP based services such as PPTP L2TP you have to set general settings in PPP General Setup VPN and Remote Access gt gt PPP General Setup PPP General Setup PPP MP Protocol IP Address Assignment fo
67. Description Enable Disable Click Enable for activating this function If you click Disable this function will be closed and all the settings that you adjusted in this page will be invalid DSL Modem Settings Set up the DSL parameters required by your ISP These are vital for building DSL connection to your ISP Multi PVC channel The selections displayed here are determined by the page of Internet Access gt gt Multi PVCs Select M PVCs Channel means no selection will be chosen VPI Type in the value provided by ISP VCI Type in the value provided by ISP Encapsulating Drop down the list to choose the type provided by ISP Modulation Default setting is Multimode Choose the one that fits the requirement of your router Dr ay Tek 77 Vigor2830 Series User s Guide WAN Connection Detection RIP Protocol Bridge Mode WAN IP Network Settings Vigor2830 Series User s Guide Modulation Mlultimode I 71 412 5 Lite 5 OMT ADSLATS Soe 3 ADSL annex hy ADSLA 6 9972 5 ADSL2 annex NM Multimode Such function allows you to verify whether network connection is alive or not through ARP Detect or Ping Detect Mode Choose ARP Detect or Ping Detect for the system to execute for WAN detection Ping IP If you choose Ping Detect as detection mode you have to type IP address in this field for pinging TTL Time to Live Displays value for your reference TTL value is set by telnet command
68. General Setup first Dr ay Tek 233 Vigor2830 Series User s Guide Click any index number link to open the following page Applications gt gt Active Directory LDAP gt gt Server Profiles Index No 1 Hame Common Name Identifier Base Distinguished Name ou People dc ms dc draytek dc cam Additional Filter gidhumber 500 Note Please type in your additional filter for BaseDN search request For example 1 For OpenLDAP fgidNumber 5005 2 For 4D msNPAllowDialin TRUE Group Distinguished Name cn vpn ou Group dc ms dc draytek de Available settings are explained as follows Item Description Name Type a name for such profile The length of the use name is limited to 19 characters Common Name Type or edit the common name identifier for the LDAP server Identifier The common name identifier for most LDAP server is cn Base Distinguished Type or edit the distinguished name used to look up entries on Name Group the LDAP server ESE i i Sometimes you may forget the Distinguished Name since it s too long Then you may click the I button to list all the account information on the AD LDAP Server to assist you finish the setup Additional Filter This is an optional setting After finished the above settings click OK to save and exit this page A new profile will be created For detailed information about LDAP application refer to section 4 14 How to Implement the AD LDAP Authentication for User
69. IP Address TX rate Kbps RX rate Kbps Sessions Action 1 197 166 1 10 CARRIE OCYCB251 0 0 2 Block Current Peak Speed Current Peak Speed Current Peak WANT O 0 Auto O 0 Auta gt WAN 172 16 3 102 1 334 Auto T TBB f Auto WANS O 0 Auto O 0 Auta Total 1 334 Auto 7 786 7 Auta 56 260 Note 1 Click Block to prevent specified PC from surfing Internet for 5 minutes 2 The IP blocked by the router will be shown in red and the session column will display the remaining time that the specified IP will be blocked 3 Kbps shared bandwidth residual bandwidth used Current Peak are average Dray Te k 363 Vigor2830 Series User s Guide Available settings are explained as follows Item Description Enable Data Flow Monitor Refresh Seconds Refresh Index IP Address TX rate kbps RX rate kbps Sessions Action Current Peak Speed Vigor2830 Series User s Guide Check this box to enable this function Use the drop down list to choose the time interval of refreshing data flow that will be done by the system automatically Refresh Seconds Click this link to refresh this page manually Display the number of the data flow Display the IP address of the monitored device Display the transmission speed of the monitored device Display the receiving speed of the monitored device Display the session number that you specified in Limit Session web page Bl
70. Internet at any time Now it is the time to register your Vigor router to MyVigor website for getting more service Please follow the steps below to finish the router registration 1 Please login the web configuration interface of Vigor router by typing admin admin as User Name Password aE jf p Username Password Copyright DrayTek Corp All Rights Reserved D r ay Te k 2 Click Support Area gt gt Production Registration from the home page Product Registration Logout All Rights Reserved Dr ay Tek 59 Vigor2830 Series User s Guide 3 A Login page will be shown on the screen Please type the account and password that you created previously And click Login If not please refer to section 4 13 Creating an Account for MyVigor Please take a moment to register Membership Registration entitles you to upgrade firmware for your purchased product and receive news about upcoming products and services UserName james_fae Auth Code t xxhdd Ifyou cannot read the word click here Forgotten password Don t have a MyVYigor Account 7 Create an account now lf you are having difficulty logging in contact aur customer service Customer Senmice 88613 507 2727 or 4 The following page will be displayed after you logging in MyVigor From this page please click Add or Product Registration Dray Tek Search My Information D About Us Welcome james_fae Product Last
71. LAN Profile is disabled or under Dial InfCall Direction at present No Status Name Member Active Type Members Active Type General Setup Status Enable Disable profleame OOOO Memberi Please select a L N to L N Dial Out profile w Member Please select a LAN to LaW Dial Out profile w Active Mode Backup Add Vigor2830 Series User s Guide 262 Dr ay Te k Available settings are explained as follows Item Description Backup Profile List Set to Factory Default Click to clear all VPN TRUNK VPN Backup mechanism profile No The order of VPN TRUNK VPN Backup mechanism profile Status v means such profile is enabled x means such profile is disabled Name Display the name of VPN TRUNK VPN Backup mechanism profile Member Display the dial out profile selected from the Member drop down list below Active Yes means normal condition No means the state might be disabled or that profile currently is set with Dial in mode for call direction in LAN to LAN Type Display the connection type for that profile such as IPSec PPTP L2TP L2TP over IPSec NICE L2TP over IPSec MUST and so on Memberz2 Display the dial out profile selected from the Member2 drop down list below Advanced This button is available only when LAN to LAN profile or more is created 3 http 192 168 1 1 YPN Backup Advance Settings Microsoft Internet Explorer VPN Backup Advance Sett
72. Local Address Remote Address Service Type CodePoint 10 Inactive Any Any ANY undefined Dray Tek 409 Vigor2830 Series User s Guide 5 For this index the user will set reserved bandwidth e g 25 for E mail using protocol POP3 and SMTP Bandwidth Management gt Quality of Service WAN General Setup Enable the QoS Control BOTH WAN Inbound Bandwidth 10000 Kbps WAN Outbound Bandwidth 10000 Kbps Class Name Reserved bandwidth Ratio E mail Others Enable UDP Bandwidth Control Limited_bandwidth Ratio Yo C Outbound TCP ACK Prioritize OK Cancel 6 Return to previous page Enter the Name of Index Class 2 by clicking Edit link In this index the user will set reserved bandwidth for HTTPS And click OK Bandwidth Management gt gt Quality of Service Class Index 2 Name Status Local Address Remote Address DiffServ CodePoint Any Any ANY ANY Service Type 7 Click Setup link for WAN2 Bandwidth Management gt Quality of Service General Setup Set to Factory Default Class Class Class o Online Index Status Bandwidth Direction 777 4772 Others Bandwidth _ 1 2 3 Statistics Control WANI Enable Kbps Kbps Outbound 25 25 y 25 Inactive status Setup WAN Enable 10000Kbps 10000Kbps Both 25 25 E Active WANS Disable 10000Kbps 10000Kbps 25 25 oy Inactive Class Rule Index Service Type Class 1 it Class 2 i Edit Class 3 Vigor2830 Series User
73. M M M Station Y Set SSID and O ec Encryption WPA WPA2 PIN Code Note Such function is available for the wireless station with WPS supported It is the simplest way to build connection between wireless network clients and vigor router Users do not need to select any encryption mode and type any long encryption passphrase to setup a wireless client every time He she only needs to press a button on wireless client and WPS will connect for client and router automatically There are two methods to do network connection through WPS between AP and Stations pressing the Start PBC button or using PIN Code On the side of Vigor 2830 series which served as an AP press WPS button once on the front panel of the router or click Start PBC on web configuration interface On the side of a station with network card installed press Start PBC button of network card WLAN Card Dray Te k 303 Vigor2830 Series User s Guide If you want to use PIN code you have to know the PIN code specified in wireless client Then provide the PIN code of the wireless client you wish to connect to the vigor router PIN Code WLAN Card ccl M Definea PIN Code of Station PIN Code For WPS is supported in WPA PSK or WPA2 PSK mode if you do not choose such mode in Wireless LAN gt gt Security you will see the following message box Microsoft Internet Explorer Please click OK and go back Wireless LAN gt gt Security to ch
74. MAC VPN gt gt Create Phase2 SA for each subnet IPSec VPN gt gt Netbios Naming Packets Pass Block Firewall gt gt IPv6 Group IPv6 Object SNMP and Diagnostics gt gt Ping Diagnosis Improved Support to block Tor tunnel ver 0 2 3 25 hotspot shield with ver 3 19 telnet protocol by using putty or pietty and LINE app in 3 5 1 36 for PC version and in 4 1 1 version for mobile for APP Enforcement Improved Support block page for DNS filter Improved Add SSL VPN setting in VPN Server Wizard Improved Add Wizards menu Improved Route policy supports VPN LAN to LAN traffics Improved Add an option to force the user clicking on a button to proceed the operation under the option URL Redirect on LAN gt gt Web Portal Setup Improved Add VALN tag for WAN IPv6 packets if WAN VLAN tag is enabled Corrected Some DHCP relay issues Corrected Some SSH memory leakage issues Corrected Load Balance Route Policy didn t work with WANS in PPP mode Corrected Load Balance Route Policy cleaned all sessions when the dropped down WAN reconnected Corrected DDNS could not work when updating to freedns afraid org Corrected Could not add DHPC option 66 15 Corrected Router showed wrong Syslog messages when a VPN LAN to LAN tunnel dropped 459 Vigor2830 Series User s Guide Corrected Router dropped all DNS packets with unknown type Corrected Daylight Saving didn t work with time zone Brasilia GMT 03 00
75. Management Vigor2830 Series User s Guide 234 Dr ay Te k 3 10 6 UPnP The UPnP Universal Plug and Play protocol is supported to bring to network connected devices the ease of installation and configuration which is already available for directly connected PC peripherals with the existing Windows Plug and Play system For NAT routers the major feature of UPnP on the router is NAT Traversal This enables applications inside the firewall to automatically open the ports that they need to pass through a router It is more reliable than requiring a router to work out by itself which ports need to be opened Further the user does not have to manually set up port mappings or a DMZ UPnP is available on Windows XP and the router provide the associated support for MSN Messenger to allow full use of the voice video and messaging features Available settings are explained as follows Item Enable UPNP Service Default WAN Applications gt gt UPnP UPnP Enable UPnP Service Cl Enable Connection control Service Cl Enable Connection Status Service Default WWAN VAN WANA WANG Note If you intend running UPnP service inside your LAN you should check the appropriate service above to allow control as well as the appropriate UPnP settings Description Accordingly you can enable either the Connection Control Service or Connection Status Service function It is used to specify the WAN interface for applyi
76. PCs on the same network can use another set of PPPoE session different with the Host PC to access into Internet For Wireless LAN If you check this box PCs on the Same wireless network can use another set of PPPoE session different with the Host PC to access into Internet Note To have PPPoA Pass through please choose PPPoA protocol and check the box es here The router will behave like a modem which only serves the PPPoE client on the LAN That s the router will offer PPPoA dial up connection Such function allows you to verify whether network connection is alive or not through ARP Detect or Ping Detect Mode Choose ARP Detect or Ping Detect for the system to execute for WAN detection Ping IP If you choose Ping Detect as detection mode you have to type IP address in this field for pinging TTL Time to Live Displays value for your reference TTL value is set by telnet command Enable Bridge Mode If you choose Bridged IP as the protocol you can check this box to invoke the function The router will work as a bridge modem It means Max Transmit Unit for packet The default setting is 1442 Enter your allocated username password and authentication parameters according to the information provided by your ISP 75 Vigor2830 Series User s Guide Username Type in the valid user name maximum 63 characters provided by the ISP in this field Password Type in the password provided by ISP in t
77. Priority for VolP SIP RTP SIP UDP Port 5060 Default 5060 2 After you click the Edit link you will see the following page Now you can define the name for that Class In this case Test is used as the name of Class Index 1 Bandwidth Management gt Quality of Service Class Index 1 Name Tag packets as AF Class1 High Drop NO Status Local Address Remote Address eee Service Type CodePoint io Active Any Any ANY ANY Vigor2830 Series User s Guide 218 Dr ay Te k Available settings are explained as follows Item Description Name Display the name of such class Tag packets as Check the box to tag the packets with the header selected in the drop down list for this class NO Display the number of the rules defined for such rule Status Display if such rule is enabled Active or not Local Address Display the local IP address on LAN for the rule Remote Address Display the remote IP address on LAN WAN for the rule DiffServ CodePoint Display the levels of the data for processing with QoS control Service Type Display the service type of the data for processing with QoS control 3 For adding a new rule click Add to open the following page Bandwidth Management gt Quality of Service Rule Edit E act Ethernet Type IPv4 OIPW6 DiffServ CodePoint Note Please choose setup the Service Type first Available settings are explained as follows Item Description ACT Check this box to invok
78. Quality of Service General Setup Setto Factory Default Index Status Bandwidth Direction ee Tees CSS Others eee ak a 1 2 3 Conti Statistics WANI Enable Kbps Kbps Outbound 25 25 25 25 Inactive Status Setup WAN2 Enable 10000Kbps 10000Kbps Outbound 25 25 25 25 Inactive Status Setup WANS Disable 10000Kbps 10000Kbps 25 25 25 25 Inactive Status Setup Class Rule Index Name Rule Service Type Class 1 Edit Class 2 Edit Edit Class 3 Edit 2 Click Setup link of WAN 1 2 3 Make sure the QoS Control on the left corner is checked And select BOTH in Direction Vigor2830 Series User s Guide 408 Dr ay Tek Bandwidth Management gt gt Quality of Service WAN General Setup Enable the QoS Control OUT w in WAN Inboun OUT ith Index Class Name 3 Set Inbound Outbound bandwidth Bandwidth Management gt gt Quality of Service WAN General Setup Enable the QoS Control BOTH WAN Inbound Bandwidth 10000 Kbps WAN Outbound Bandwidth 10000 Kbps Note The rate of outbound inbound must be smaller than the real bandwidth to ensure correct calculation of QoS It is suggested to set the bandwidth value for inbound outbound as 80 85 of physical network speed provided by ISP to maximize the QoS performance 4 Return to previous page Enter the Name of Index Class 1 by clicking Edit link Type the name E mail for Class 1 Bandwidth Management gt gt Quality of Service NO Status
79. Schedule Setup i th O Enable Time Quota o min Coe min Enable Data Quota oO JL Jo me Reset quota to default when scheduling time expired Enable Default Time Quota oo min Default Data Quota o e 8 After finished above configurations click OK to save the settings Now users belong to either rd1 or shrd group can access Internet after inputting their credentials on LDAP server Vigor2830 Series User s Guide 432 Dr ay Te k 4 15 How to Implement the LDAP AD Authentication for VPN For simplifying the configuration of LDAP authentication for User Access Management we implement Group feature There is no need to pre configure user profile for each user on Vigor router anymore We only need to configure the Groups DN then the Vigor router e g Vigor 3200 series can pass the authentication to LDAP server with the pre defined Group path Below shows the configuration steps 1 2 Dray Tek Access into the web user interface of the Vigor router Open Applications gt gt Active Directory LDAP to get the following page for configuring LDAP related settings Applications gt gt Active Directory LDAP Active Directory LDAP Setto Factory Default Active Directory General Setup LDAP Profiles Enable Bind Type Server Address 172 16 2 8 Destination Port 59 Use SSL Regular ON Uid vpntest au ypnuserdc ms de dr Regular Password Note After finish
80. Services vigor Submit A Saved Request Paste a base64 encoded PKCS 10 certificate request or PKCS 7 renewal request generated by an external application such as a web server into the request field to submit the request to the certification authority CA Saved Request BEGIN CERTIFICATE REQUEST MIIBqjCCARMCAQAWQOTELMAKGALUEBhMCVFCxEDAO _ Base64 Encoded BgkqahkiG9vOBCQOQEWVEZByZXNZOGRYYX 1OZWUsuY29t Certificate Request A4GNADCBiQKEgODOYB7wmZFfFhN9 IeQnG03Xk PKCS 10 or 7 h 4bp89cUFSd Lo ACGGiM tceBOckdcZdPFFVIXcP3 x GOA CTVO EQzpxroCwlJITILS450 Bn9v50951G 4 lt gt Browse for a file to insert Certificate Template Administrator v Administrator Additional Attribu Authenticated Session Basic EFS _JEFS Recovery Agent Attributes JUser Subordinate Certification Author as cihet ertinication Autnority Then you have done the request and the server now issues you a certificate Select Base 64 encoded certificate and Download CA certificate Now you should get a certificate cer file and save it Vigor2830 Series User s Guide 418 Dr ay Te k 5 Back to Vigor router go to Local Certificate Click IMPORT button and browse the file to import the certificate cer file into Vigor router When finished click refresh and you will find the below window showing BEGINE CERTIFICATE j Certificate Management gt Local Certificate X509
81. Shared Key SSL Tunnel siz C Digital Signaturel 509 C Specify Remote Node Remote Client IP a IPsec Security Method orPeerID Mediumi Netbios Naming Packet Pass Block HighfESF DES 3DES AES Multicast via VPN OPass Block Local ID foptional Sa for some IGMP IP Camera DHCP Relay etc Subnet C Assign Static IP Address Available settings are explained as follows Dray Tek Item Description User account and Enable this account Check the box to enable this function Authentication Idle Timeout If the dial in user is idle over the limitation of the timer the router will drop this connection By default the Idle Timeout is set to 300 seconds Allowed Dial In Type PPTP Allow the remote dial in user to make a PPTP VPN connection through the Internet You should set the User Name and Password of remote dial in user below IPSec Tunnel Allow the remote dial in user to make an IPSec VPN connection through Internet L2TP with IPSec Policy Allow the remote dial in user to make a L2TP VPN connection through the Internet You can select to use L2TP alone or with IPSec Select from below None Do not apply the IPSec policy Accordingly the VPN connection employed the L2TP without IPSec policy can be viewed as one pure L2TP connection Nice to Have Apply the IPSec policy first if it is applicable during negotiation Otherwise the dial in VPN connection becomes one pure L2TP connection
82. Status Disconnected Reconnected VPN Tunnel Disconnected Reconnected Vigor2830 Series User s Guide 386 Dray Tek 7 After finished the settings click OK to return to previous page You have finished the configuration of the notification object profile setting Object Settings gt Notification Object 8 Now open Application gt gt SMS Mail Alert Service Use the drop down list to choose SMS Provider and the Notify Profile specify the time of sending SMS Then type the phone number in the field of Recipient the one who will receive the SMS Application gt gt SMS Mail Alert Service SMS Provider Mail Server Setto Factory Default Index SMS Provider Recipient Notify Profile Schedule 1 15 1 1 Local Number 09123456 1 WAN_Notfy J gt F od linia m 3r 1 Local Number 1 WAN Notif S PPF EPEE T WAN Notif e O 1 Local Number WAN Notify a 8 O 1 Local Number 1 WAN_ Notify iz 90 1 Local Numbe 10 O OK Cancel 9 Click OK to save the settings Later if one of the WAN connections fails in your router the system will send out SMS to the phone number specified If the router has only one WAN interface the system will send out SMS to the phone number while reconnecting the WAN interface successfully Dray Te k 387 Vigor2830 Series User s Guide 10 Configure the settings as the following figure Choose one of the SMS profiles In this example the profile For war
83. Type Group Service Type Group Table Setto Factory Default Group Name Group Name 17 Ea e e a a a a a a a a a a eB WA Ja ji e P e e e P e e a e u u fosc e a a s a a E a e e a a EE Available settings are explained as follows Item Description Set to Factory Default Clear all profiles Index Display the profile number that you can configure Name Display the name of the group profile To set a new profile please do the steps listed below 1 Click the number e g 1 under Group column for configuration in details Objects Setting gt gt Service Type Group Service Type Group Table Group Name ae Dray Te k 181 Vigor2830 Series User s Guide 2 The configuration page will be shown as follows Objects Setting gt Service Type Group Setup Profile Index 1 Name Available Service Type Objects Selected Service Type Objects 1 SIP 2 RIP Available settings are explained as follows Item Description Name Type a name for this profile Available Service All the available service objects that you have added on Type Objects Objects Setting gt gt Service Type Object will be shown in this box Selected Service Type Click gt gt button to add the selected IP objects in this box Objects 3 After finishing all the settings here please click OK to save the configuration Objects Setting gt Service Type Group Service Type Group Table Setto
84. Type RSA Key Size 1024 Bit 3 Copy and save the X509 Local Certificate Requet as a text file and save it for later use Certificate Management gt gt Local Certificate X509 Local Certificate Configuration Name Subject Status Modify Local C TW O Draytek emailAddress Requesting GENERATE IMPORT REFRESH X509 Local Certificate Request MHIIBQjICCARNC AGAWOTELNARKGALIUEBHNCYFcREDAOBGNVBAOTBORYYZ1LOZUsxIDie BokqhkiG9OwOBCQEWEXByZxNzOGRYyYYXLOZWsuY2 StNIGEMAOGCS AGS IbSDOEBAOUA L4GNADCBiQKBg DPioahu gF OaYBiceSOERSD VknIdHbloiktScTdaLUDaFk6s8da 3uwDeQytoV1ILBJ 22 IDFOx4X6ipTevl87 twwTsgq41qgZ60k rGhuVTKd3j6PlernkP aus4t23cwBanD4usSchVms yD ISHLAIAxVYPUpNEVIroT2 RZ KRMAaHEWpVpwIDAQAB oCkwdJwY dJKoZ ThvcNs QOkONRowGD AWBGNVHREEDzaNgqgtkemF 5dGVrLyNvbTanbgkq hkiGSwOBAOuUF AAOBGOAUSBRUGt AW LHHONG6G HwToemitHObew Xvg t7 kF lzTJivh uRLq4CiEi6nV 4hMRytexZpEZ6sMarSgRRErs6Ro0s8IJx0145560xCZ N1Gh9VO9T1 ISFqkjIJINihip4TCjecSNNZjmOo5UU BcesTG SCcBCyejqu fo AIGFajB Gviw 4 Connect to CA server via web browser Follow the instruction to submit the request Below we take a Windows 2000 CA server for example Select Request a Certificate Microsoft Certificate Services vigor Welcome You use this web site to request a certificate for your web browser e mail client or other secure program Once you acquire a certificate you will be able to securely identify yourself to other people over the we
85. User Ela lE l R l e s e REP eee Pi lt lt 1 32 33 64 65 96 97 128 129 160 161 192 193 200 gt gt Next gt gt To set the user profile please click any index number link to open the following page Notice that profile 1 admin and profile 2 System Reservation are factory default settings Profile 2 is reserved for future use User Management gt gt User Profile Profile Index 3 Enable this account User Name Password Confirm Password Idle Timeout mints O Unlimited Max User Login bo oooO O Unlimited External Server Authentication Pop Browser Tracking Window Authentication Web Alert Tool Telnet Landing Page L Indes 1 15 in Schedule Setup e Eo Enable Time Quota 0 min JEje min Enable Data Quota O Jo me Reset quota to default when scheduling time expired C Enable Default Time Quota lo min Default Data Quota o MB Dr ay Tek 163 Vigor2830 Series User s Guide Available settings are explained as follows Item Description Enable this account Check this box to enable such user profile User Name Type a name for such user profile e g LAN_User_Group_l WLAN_User_Group_A WLAN_User_Group_B etc When a user tries to access Internet through this router an authentication step must be performed first The user has to type the User Name specified here to pass the authentication When the user passes the authentication he she can access Internet via this
86. VPM Environment Site to Site YPN LAN to LANn i Index 3 Profile Name VPN Serl Username serveril Allowed Service PPTP IPSec Peer IP YVPH Client IP Peer ID Remote Network IP 0 0 0 0 Remote Network Mask 255 255 255 0 Click Back to modify changes if necessary Otherwise click Finish to save the current settings and proceed to the following action Go to the YPN Connection Management Do another VPN Server Wizard setup View more detailed configurations Available settings are explained as follows Item Description Go to the VPN Click this radio button to access VPN and Remote Connection Access gt gt Connection Management for viewing VPN Management Connection status Do another VPN Click this radio button to set another profile of VPN Server Server Wizard Setup through VPN Server Wizard View more detailed Click this radio button to access VPN and Remote configuration Access gt gt LAN to LAN for viewing detailed configuration Vigor2830 Series User s Guide 54 Dr ay Tek 2 5 Wireless Wizard The wireless wizard allows you to configure settings specified for a host AP for home use or internal use for a company and specified for a guest AP for any wireless clients accessing into Internet Note This wizard is available for n model only Follow the steps listed below 1 Open Wireless Wizard CURT 2 The screen of wireless wizard will be shown as follows This page will be used f
87. WAN interface Gateway IP Displays the IP address of the default gateway Note The words in green mean that the WAN connection of that interface is ready for accessing Internet the words in red mean that the WAN connection of that interface is not ready for accessing Internet 1 6 2 Virtual WAN Such page displays the virtual WAN connection information Virtual WAN are used by TR 069 management VoIP service and so on The field of Application will list the purpose of such WAN connection Online Status Virtual WAN WAN 5 Status Enable Line Yes ADSL IP GW IP WAN 6 Status Enable Line Wes ADSL IP GW IP WAN 7 Status Enable Line Wes ADSL IP GW IP 1 7 Saving Configuration Name TX Packets O Name TX Packets 0 Name TX Packets 0 Mode TX Rate Bps T Mode TX Rate Bps 0 Mode TX Rate Bps 0 System Uptime 69 20 Up Time 00 00 0d RX Packets 0 Up Time 00 00 00 RX Packets T Up Time 00 00 00 RX Packets E Application Management RX Rate Bps a Application Management RX Rate Bps Application Management RX Rate Bps Each time you click OK on the web page for saving the configuration you can find messages showing the system interaction with you Ready indicates the system is ready for you to input settings Settings Saved means your settings are saved once you click Finish or OK button Dray Tek 21 Vigor2830 Series User s Gui
88. Wake by MAC Address he MAC Address P Address IP Address The IP addresses that have been configured in Firewall gt gt Bind IP to MAC will be shown in this drop down list Choose the IP address from the drop down list that you want to wake up MAC Address Type any one of the MAC address of the bound PCs Wake Up Click this button to wake up the selected IP See the following figure The result will be shown on the box Vigor2830 Series User s Guide 238 Dr ay Tek Application gt gt Wake on LAN Wake on LAN Note Wake on LAN cooperate with Bind IP to MAC function only binded PCs can wake up through IF Wake by MAC Address IP Address mac address YY YL Result Send command to client done 3 10 9 SMS Mail Alert Service The function of SMS Short Message Service Mail Alert is that Vigor router sends a message to user s mobile or e mail box through specified service provider to assist the user knowing the real time abnormal situations Vigor router allows you to set up to 10 SMS profiles which will be sent out according to different conditions SMS Provider This page allows you to specify SMS provider who will get the SMS what the content is and when the SMS will be sent Application gt gt SMS Mail Alert Service SMS Provider Mail Server Setto Factory Default Index SMS Provider Recipient Notify Profile schedule 1 15 1 a 40 A Do i i 5O a 6 E en TO tte Scestme2 aml a
89. When there is an existing Internet connection Data Filter is applied to incoming and outgoing traffic It will check packets according to the filter rules If legal the packet will pass the router The following illustrations are flow charts explaining how router will treat incoming traffic and outgoing traffic respectively Outgoing Traffic Dr ay Tek 143 Vigor2830 Series User s Guide Stateful Packet Inspection SPI Stateful inspection is a firewall architecture that works at the network layer Unlike legacy static packet filtering which examines a packet based on the information in its header stateful inspection builds up a state machine to track each connection traversing all interfaces of the firewall and makes sure they are valid The stateful firewall of Vigor router not just examine the header information also monitor the state of the connection Denial of Service DoS Defense The DoS Defense functionality helps you to detect and mitigate the DoS attack The attacks are usually categorized into two types the flooding type attacks and the vulnerability attacks The flooding type attacks will attempt to exhaust all your system s resource while the vulnerability attacks will try to paralyze the system by offending the vulnerabilities of the protocol or operation system The DoS Defense function enables the Vigor router to inspect every incoming packet based on the attack signature database Any malicious packet that mi
90. a Js Ja Doo O 10 E O I Available settings are explained as follows Item Description Index Check the box to enable such profile SMS Provider Use the drop down list to choose SMS service provider You can click SMS Provider link to define the SMS server Dr ay Tek 239 Vigor2830 Series User s Guide Recipient Notify Schedule Type the name of the one who will receive the SMS Use the drop down list to choose a message profile The recipient will get the content stated in the message profile You can click the Notify Profile link to define the content of the SMS Type the schedule number that the SMS will be sent out You can click the Schedule 1 15 link to define the schedule After finishing all the settings here please click OK to save the configuration Mail Server This page allows you to specify Mail Server profile who will get the notification e mail what the content is and when the message will be sent Application gt SMS Mail Alert Service SM5 Provider Index 1 M 2M 30 4 5 6O 7 rr 8 O 90 10 LJ 2 4 Pri 3 5 FF 6 77 fi 9 B Tr 4 Mail Server Setto Factory Default Mail Service 1 Mail_Notify 1 Mail Notify Mail Notify Recipient Notify Profile schedule 1 15 It i Fo fF PF a fF Available settings are explained as follows Item Index Mail Service Recipient Notify Vigor2830 Series User s Gui
91. a Port Port End Start Start End Interface Src IP Address Start Move Move Index Enable Protocol Interface Up Down Any Down Any Any Any Any Any Any Any Any Any lt lt 1 10 14 20 21 30 31 40 41 50 gt gt Next gt gt S e Ico IN I en e feo Wizard Mode most frequently used settings in three pages Advance Mode all settings in one page 3 In the following page check Enable set Dest IP Start and Dest IP End with 203 65 1 35 and 203 65 1 35 choose WAN as the Interface click default gateway do not check Auto Failover To The Other WAN Load Balance Route Policy Index 1 Protocol Any source IP Any Src IF Start Src IP End rt Destination IP An Dest IP Start Dest IP End 203 65 1 35 ev 203 65 1 35 ony Destination Port Dest Port Start Dest Port End rt Send to if Criteria Matched Interface Interface Address E ET Gateway IP Default Gatewa Specific Gateway More Options O Auto Failover to the Other WAN EET E i wh ea Force Routing 4 After finished the above settings click OK to save the configuration Dray Te k 441 Vigor2830 Series User s Guide Load Balance Route Policy Load Balance Route Policy Index Enable Protocol Interface bd Pct 4 2 6 f 8 I Ary Any Ary Ary Any Any Any Any Any Ary WAN 1 WAN 1 ANI LANI WAN 1 WAR 1 ANI ANI ANI ANI o Setto Factory Default Interface Des
92. activating WCF feature or getting a new license for web content filter you have to click Activate to satisfy your request Be aware that service provider matching with Vigor router currently offers a period of time for trial version for users to experiment If you want to purchase a formal edition simply contact with the channel partner or your dealer Click CSM and click Web Content Filter Profile to open the profile setting page The default setting for Setup Query Server Setup Test Server is auto selected You can choose another server for your necessity by clicking Find more to open http myvigor draytek com for searching another qualified and suitable one Note 1 Web Content Filter WCF is not a built in service of Vigor router but a service powered by Commtouch If you want to use such service trial or formal edition you have to perform the procedure of activation first For the service of formal edition please contact with your dealer distributor for detailed information Note 2 Commtouch is merged by Cyren and Global View services will be continued to deliver powerful cloud based information security solutions Refer to http www prnewswire com news releases commtouch is now cyren 239025151 html Vigor2830 Series User s Guide 204 Dr ay Te k CSM gt gt Web Content Filter Profile ww Web Filter License Status Not Activated Setup Query Server Setup Test Server Activate auto selected Find more auto select
93. an inquiry for data transmission between the hosts located on both sides of VPN Tunnel while connecting Block When there is conflict occurred between the hosts on both sides of VPN Tunnel in connecting such function can block data transmission of Netbios Naming Packet inside the tunnel Multicast via VPN Some programs might send multicast packets via VPN connection Pass Click this button to let multicast packets pass through the router Block This is default setting Click this button to let multicast packets be blocked by the router Chose one of the subnet selections for such VPN profile Subnet LAM 1 LAM 1 LAN 2 LAN 3 LAM 4 Assign Static IP Address Please type a static IP address for the subnet you specified This field is applicable when you select PPTP or L2TP with or without IPSec policy above This field is applicable when you select PPTP or L2TP with or without IPSec policy above Check this box to make the authentication with mOTP function PIN Code Type the code for authentication e g 1234 Secret Use the 32 digit secret number generated by mOTP in the mobile phone e g e759bb6f0e94c7ab4fe6 This group of fields is applicable for IPSec Tunnels and L2TP with IPSec Policy when you specify the IP address of the remote node The only exception is Digital Signature X 509 can be set when you select IPSec tunnel either with or without specify the IP address of t
94. as follows Object Settings gt SMS Mail Service Object Profile Index 1 Profile Name ail_ notify SMTP Server 92 165 1 95 SMTP Port Sender Address carrie gdraytek com Use SSL Authentication Username Password Sending Interval seconds Available settings are explained as follows Item Description Profile Name Type a name for such mail service profile SMTP Server Type the IP address of the mail server SMTP Port Type the port number for SMTP server Sender Address Type the e mail address of the sender Use SSL Check this box to use port 465 for SMTP server for some e mail server uses https as the transmission method Authentication The mail server must be authenticated with the correct username and password to have the right of sending message out Check the box to enable the function Username Type a name for authentication Password Type a password for authentication Sending Interval Define the interval for the system to send the SMS out Dr ay Tek 193 Vigor2830 Series User s Guide 3 After finishing all the settings here please click OK to save the configuration Object Settings gt SMS Mail Service Object SMS Provider Mail Server Setto Factory Default Index Profile Name ale Mail_Notity 2 3 3 7 11 Notification Object This page allows you to set ten profiles which will be applied in Application gt gt SMS Mail Alert Service You can set an object with differe
95. ask you to choose right name of the printer that you installed onto the router Such step can make correct driver loaded onto your PC When you finish the selection click Next Add Biter gh z S Add Printer Install the printer driwer _ Choose your printer from the list Click Windows Update to see more models To install the driver from an installation CD click Have Disk anon Lal brother L DrayTek Cal Brother DCP 128C Epson Cal Brother DCP 129C Pairs Brother Dcp 130C zi E This driver is digitally signed Windows Update Have Disk Tell me why driver signing is important Next Cancel 9 Type a name for the chosen printer Click Next E gam Add Printer Type a printer name Printer name This printer will be installed with the Brother DCP 116C driver Next Cancel Vigor2830 Series User s Guide 12 Dr ay Te k 10 Choose Do not share this printer and click Next Printer Sharing If you want to share this printer you must provide a share name You can use the suggested name or type a new one The share name will be visible to other network users f Do not share this printer Share this printer so that others on your network can find and use it Share name Location Comment Cancel 11 Then in the following dialog click Finish cre Add Printer gl i i i ri O gam Add Printer You ve successfully a
96. at the same time Separate the Wireless and the Wired LAN WLAN Isolation enables you to isolate your wireless LAN from wired LAN for either quarantine or limit access reasons To isolate means neither of the parties can access each other To elaborate an example for business use you may set up a wireless LAN for visitors only so they can connect to Internet without hassle of the confidential information leakage For a more flexible deployment you may add filters of MAC addresses to isolate users access from wired LAN Manage Wireless Stations Station List will display all the station in your wireless network and the status of their connection Below shows the menu items for Wireless LAN Wireless LAN Vigor2830 Series User s Guide 296 Dr ay Te k 3 14 2 General Setup By clicking the General Settings a new web page will appear so that you could configure the SSID and the wireless channel Please refer to the following figure for more information Wireless LAN gt gt General Setup General Setting IEEE 8027 11 Enable Wireless LAN Mode Mixed i1b iig iini Channel Channel 2437MHz Enable Hide SSID SSID Isolate Member Isolate WPM 1 2 3 Pod 4 Po Note Enabling the Isolate Member configuration will forbid the wireless cients associated to the same SSID from connecting to each other The isolate YPN configuration will isolate the wireless traffic from VPN connections and thus wireless clients will
97. authentic but will not be encrypted High ESP MoeS Mapes Maes Data will be encrypted and authentic Available settings are explained as follows Item Description IKE Authentication This usually applies to those are remote dial in user or node Method LAN to LAN which uses dynamic IP address and IPSec related VPN connections such as L2TP over IPSec and IPSec tunnel Pre Shared Key Currently only support Pre Shared Key authentication Pre Shared Key Specify a key for IKE authentication Vigor2830 Series User s Guide 244 Dr ay Te k Confirm Pre Shared Key Retype the characters to confirm the pre shared key IPSec Security Method Medium Authentication Header AH means data will be authenticated but not be encrypted By default this option is active High Encapsulating Security Payload ESP means payload data will be encrypted and authenticated You may select encryption algorithm from Data Encryption Standard DES Triple DES 3DES and AES Dr ay Te k 245 Vigor2830 Series User s Guide 3 11 4 IPSec Peer Identity To use digital certificate for peer authentication in either LAN to LAN connection or Remote User Dial In connection here you may edit a table of peer certificate for selection As shown below the router provides 32 entries of digital certificates for peer dial in users VPN and Remote Access gt gt IPSec Peer Identity X09 Peer ID Accounts Setto Factory Default Index Name Status I
98. below to actrvate your account Link Activate my Account 7 Click the Activate my Account link to enable the account that you created The following screen will be shown to verify the register process is finished Please click Login Register Search for this site Register Confirm The Confirm message of New Owner Mary maybe timeout Please try agam or contact to draytek_com Vigor2830 Series User s Guide 428 Dray Te k 8 When you see the following page please type in the account and password that you just created in the fields of UserName and Password Then type the code in the box of Auth Code according to the value displayed on the right side of it This service is available for MyVigor member only Please login to access MyVigor lf you are not one of the members of MyVigor please create an account first LOGIN Auth Code T4he1C lf you cannot read the word click here Forget password Don t have a My idor Account 7 Create an account now If you are having difficulty logging in contact our customer service Customer Service 886 3 597 2727 oF email to webmasten draytek com Now click Login Your account has been activated You can access into MyVigor server to activate the service e g WCF that you want Dr ay Tek 429 Vigor2830 Series User s Guide 4 14 How to Implement the LDAP AD Authentication for User Management For simplifying the configuration of LDAP authentication for User
99. by returning to the default settings Try to reset the router by software or hardware Such function is available in Admin Mode only Warning After pressing factory default setting you will loose all settings you did before Make sure you have recorded all useful settings before you pressing The password of factory default is null Software Reset You can reset the router to factory default via Web page Such function is available in Admin Mode only Go to System Maintenance and choose Reboot System on the web page The following screen will appear Choose Using factory default configuration and click Reboot Now After few seconds the router will return all the settings to the factory settings Dray Tek 449 Vigor2830 Series User s Guide System Maintenance gt gt Reboot System Reboot System Do you want to reboot your router Using current configuration Using factory default configuration Auto Reboot Time Schedule Index 1 15 in Schedule Setup Note Action and Idle Timeout settings will be ignored Hardware Reset While the router is running ACT LED blinking press the Factory Reset button and hold for more than 5 seconds When you see the ACT LED blinks rapidly please release the button Then the router will restart with the default configuration Factory ACT WLAN Line Oo O USB DSL Phonet Reset CSM WAN2 Phone2 After restore the facto
100. can only contain the folowing characters A z a z 0 9 _ m f4 and space Click OK to save the configuration Make sure the FTP service is running properly Please open a browser and type ftp 192 168 1 1 Use the account user1 to login Log On As Either the server does not allow anonyrnous logins or the e mail address was not accepted FTF server 192 168 1 1 User name Password After vou log on you can add this server to vaur Favorites and return to it easily FTP does not encrypt or encode passwords or data before sending them to the server To protect the security of your passwords and data use Web Folders CW eboay instead Learn more about using Web Folders Log on anonymously Save password Cancel When the following screen appears it means the FTP service is running properly 383 Vigor2830 Series User s Guide File Edit View Favorites Tools Help sack g gt a pe Search gt Folders EBk ftp 192 168 1 1 Other Places L FinalbataEn opkg install tempstorage iTunesSetu wlc 1 1 5 wi 5 Internet Explorer 4 My Documents l a a Shared Documents ET AT A 115 bmp 12 Always Air supply lost Crystal t My Network Places Open mp3 inlove mpS Flower mp3 7 Return to USB Application gt gt USB Disk Status The information for FTP server will be shown as below USB Application gt gt USB Disk Status USB Mass Storage Device Status Connection Status Disk C
101. complicated electronic unit that may be repaired only be authorized and qualified personnel Do not try to open or repair the router yourself Do not place the router in a damp or humid place e g a bathroom The router should be used in a sheltered area within a temperature range of 5 to 40 Celsius Do not expose the router to direct sunlight or other heat sources The housing and electronic components may be damaged by direct sunlight or heat sources Do not deploy the cable for LAN connection outdoor to prevent electronic shock hazards Keep the package out of reach of children When you want to dispose of the router please follow local regulations on conservation of the environment We warrant to the original end user purchaser that the router will be free from any defects in workmanship or materials for a period of two 2 years from the date of purchase from the dealer Please keep your purchase receipt in a safe place as it serves as proof of date of purchase During the warranty period and upon proof of purchase should the product have indications of failure due to faulty workmanship and or materials we will at our discretion repair or replace the defective products or components without charge for either parts or labor to whatever extent we deem necessary tore store the product to proper operating condition Any replacement will consist of a new or re manufactured functionally equivalent product of eq
102. configuration Vigor2830 Series User s Guide 94 Dr ay Te k Details Page for IPv6 6in4 Static Tunnel in WAN1 WAN2 This type allows you to setup 6in4 Static Tunnel for WAN interface Such mode allows the router to access Pv6 network through IPv4 network However 6in4 offers a prefix outside of 2002 0 16 So you can use a fixed endpoint rather than any cast endpoint The mode has more reliability WAN gt Internet Access oO WAN 1 PPPoE PPPoA MPoA RFC1483 2684 IPvo Internet Access Mode Connection Type bind Static Tunnel 6ind Static Tunnel Remote Endpoint IPv4 Address Po bind IPve Address Po i 64 default 64 LAN Routed Prefix Po i 64 default 64 Tunnel TTL 255 fdefault 255 Available settings are explained as follows Item Description Remote Endpoint IPv4 Type the static IPv4 address for the remote server Address 6in4 IPv6 Address Type the static IPv6 address for IPv4 tunnel with the value for prefix length LAN Routed Prefix Type the static IPv6 address for LAN routing with the value for prefix length Tunnel TTL Type the number for the data lifetime in tunnel After finished the above settings click OK to save the settings Dr ay Tek 95 Vigor2830 Series User s Guide Below shows an example for successful IPv6 connection based on 6in4 Static Tunnel mode Online Status Physical Connection System Uptime Oday 0 4 16 IPv4 IPv6 LAN Status IP Address 2001 4DD0 FFO0 83E4 21
103. connection please choose WAN3 1 Choose WAN3 as WAN Interface Quick Start Wizard WAN Interface WAN Interface Display Name Physical Mode 2 Then click Next for viewing summary of such connection Quick Start Wizard Connect to Internet WAN 3 Internet Access aalt US6 ModemiPPP mode 36 46 USB Modem PPP mode Modem Initial String AT amp FEOV1T 51860286015020 Default ATRFEOVIN 180280 150 0 Available settings are explained as follows Item Description Internet Access Choose one of the selections as the protocol of accessing the internet 3G 4G USB Modem SIM Pin code Type PIN code of the SIM card that will be PPP mode used to access Internet The maximum length of the pin code you can set is 15 characters Modem Initial String Such value is used to initialize USB modem Please use the default value If you have any Vigor2830 Series User s Guide 38 Dr ay Te k question please contact to your ISP The maximum length of the string you can set is 47 characters APN Name APN means Access Point Name which is provided and required by some ISPs Type the name and click Apply 4G USB Modem SIM Pin code Type PIN code of the SIM card that will be DHCP mode used to access Internet Network Mode Force Vigor router to connect Internet with the mode specified here If you choose 4G 3G 2G as network mode the router will choose a suitable one according to the actual wireless signal au
104. connection status Vigor2830 Series User s Guide 70 Dr ay Tek Backup Type If you choose Backup as the Active Mode Backup WAN will be changed into Backup Type You have to specify which role the WAN interface should play if you want to backup multiple WANs However ignore this setting if you want to backup a single WAN Active Mode Backup vi Ewan 1 Owan 2 CIWAN 3 pare eeh as backup for When any of selected WAN disconnect multiple WAN when all of selected WAN disconnect When any of selected WAN disconnect Such backup WAN will be activated when any master WAN interface disconnects When all of selected WAN disconnect Such backup WAN will be activated only when all master WAN interfaces disconnect After finishing all the settings here please click OK to save the configuration 3 1 3 Internet Access For the router supports multi WAN function the users can set different WAN settings for WANI WAN2 WAN3 for Internet Access Due to different Physical Mode for WAN interface the Access Mode for these connections also varies Refer to the following figures WAN gt Internet Access Internet Access Index Display Name Physical Mode Access Mode WAN ADSL PPPoE PPPoA Details Page None WANS Ethernet POP AE PPPoA Details Page MPoA RFC 1403 4664 WANS USB Note Only one WAN can support IPve WAN gt Internet Access Internet Access Index Display Name Physical Mode A
105. dynamically assigns IP address to you each time you connect to it and request In some case 85 Vigor2830 Series User s Guide your ISP provides service to always assign you the same IP address whenever you request In this case you can fill in this IP address in the Fixed IP field Please contact your ISP before you want to use this function Click Yes to use this function and type in a fixed IP address in the box Fixed IP Address Type a fixed IP address WAN IP Network Obtain an IP address automatically Click this button to Settings obtain the IP address automatically Specify an IP address Click this radio button to specify some data IP Address Type the IP address Subnet Mask Type the subnet mask After finishing all the settings here please click OK to activate them Vigor2830 Series User s Guide 86 Dr ay Tek Details Page for 3G 4G USB Modem PPP in WAN3 To use PPP for 3G USB Modem as the accessing protocol of the internet please choose Internet Access from WAN menu Then select PPP mode for WAN2 The following web page will be shown WAN gt Internet Access WAN 3 36 46 USE Modem PPP mode SIM PIN code Modem Initial String APN Name Modem Initial Stringz Modem Dial String PPP Username PPP Password PPP Authentication OEnable bDisable AT amp PFEOVIAT amp D2EC1 SO 0 Default ATRFEOVI 180280 150 0 Se Scie Default STOT 994 COMA ATOT 777 TO SCOMA ATDT 98
106. each of the Gigabit LAN ports can be isolated from each other for example to feed different companies or departments but keeping their local traffic completely separated Configuring port based VLAN for wireless and non wireless clients 1 All the wire network clients are categorized to group VLANO in subnet 192 168 1 0 24 LANI 2 All the wireless network clients are categorized to group VLANI in subnet 192 168 2 0 24 LAN2 3 Open LAN gt gt VLAN Configuration Check the boxes according to the statement in step 1 and Step 2 Dr ay Te k 119 Vigor2830 Series User s Guide LAN gt VLAN Configuration VLAN Configuration Enable Wireless LAN SSID1 SSID SSIDS SSID4 Subnet Enable Oooooooog OoooooooswsS noooooons ee ee E N N N S Permit untagged device in Pl to access router 1 For each WLAN row f enable is checked for the WYLAN Tag then the corresponding VIO will be applied to wired LAN traffic 2 Wireless LON traffic is always untagged but will still be a member of the VLAN group selected 3 Each VID must be unique ok Clear _Cancel_ 4 Click OK Open LAN gt gt General Setup If you want to let the clients in both groups communicate with each other simply activate Inter LAN Routing by checking the box between LANI and LAN2 LAN gt General Setup General Setup Index Status DHCP IP Address LAN 1 iV 192 168 1 1 LAN 2 192 168 2 1 LAN 3 192 168 3 1 LAN 4 192 168 4 1 IP
107. gt Service Type Object Setup Profile Index 1 Mame Protocol Source Port Destination Port CP k s rt Cancel I 4 II 4 Clear Available settings are explained as follows Item Name Protocol Source Destination Port Description Type a name for this profile Specify the protocol s which this profile will apply to Source Port and the Destination Port column are available for TCP UDP protocol It can be ignored for other protocols The filter rule will filter out any port number when the first and last value are the same it indicates one port when the first and last values are different it indicates a range for the port and available for this profile when the first and last value are the same it indicates all the ports except the port defined here when the first and last values are different it indicates that all the ports except the range defined here are available for this service type gt the port number greater than this value is available lt the port number less than this value is available for this profile 3 After finishing all the settings here please click OK to save the configuration Service Type Object Profiles Index foe ie Vigor2830 Series User s Guide Name SIP RTP 80 Dray Tek 3 7 6 Service Type Group This page allows you to bind several service types into one group Objects Setting gt gt Service
108. ii i i3 id 15 16 Note User Accounts need to be added into User Group to enable SSL Portal Login Click each index to edit one remote user profile Dr ay Tek 321 Vigor2830 Series User s Guide Web Access Control gt gt Remote Dial in User Index No 1 User account and Authentication C Enable this account Idle Timeout second s Allowed Dial In Type PPTP IPsec Tunnel L2TP with IPsec Policy SSL Tunnel C Specify Remote Node Password Max 19 char fe Enable Mobile One Time Passwords mOTP pINCode IKE Authentication Method Pre Shared Key _ SS C Digital Signaturef 5095 Remote Client IP Netbios Naming Packet Pass Block Multicast via VPN OPass Block for some IGMP IP Camera DHCP Relay etc None IPsec Security Method MediumtAH High ESF DES 3DES AES Local ID optional DOi L Assign Static IP Address 0 0 0 0 Available settings are explained as follows Item Description User account and Authentication Enable this account Check the box to enable this function Idle Timeout If the dial in user is idle over the limitation of the timer the router will drop this connection By default the Idle Timeout 1s set to 300 seconds Allowed Dial In Type PPTP Allow the remote dial in user to make a PPTP VPN connection through the Internet You should set the User Name and Password of remote dial in user below IPSec Tunnel Allow the remote di
109. list to select Standard TCP IP Port Then click Next m Add Printer Choose a printer port A printer port is a type of connection that allows your computer to exchange information with a printer Use an existing port vera Printer Port gs Type of port ext Cancel Vigor2830 Series User s Guide 10 Dr ay Tek 6 In the following dialog type 192 168 1 1 router s LAN IP in the field of Hostname or IP Address and type 192 168 1 1 as the Port name Then click Next G aan Add Printer Type a printer hostname or IF address Device type TCR AP Dewice Hostname ar IP address 192 168 1 1 Port name 192 168 1 1 Query the printer and automatically select the driwer to use eresi 7 Click Standard and choose Generic Network Card aay Add Printer Additional port information required The device is not found on the network Be sure that The device is turned on The network is connected The device is properly configured The address on the previous page is correct see e Pree Tr you think the address is not correct click Back to return to the previous page Then correct the address and perform another search on the network Ifyou are sure the address is correct select the device type below Device Type f Standard Generic Network Card Custom Settings Mext Cancel Dr ay Te k 11 Vigor2830 Series User s Guide 8 Now your system will
110. max Welcome Message and Bulletin Max 511 characters Preview lt hi gt s lt b gt lt font color red gt Welcome Message lt font gt lt b gt lt hi gt lt p gt This welcome message is displayed in the Login page of the router Replace this text With your own message lt p gt lt ol gt lt li gt The welcome message can be written in HTML 30 lists such as this one can be created lt 1i gt lt 1i gt 0ther markup tags such as p font or img can be usged lt 1li gt lt ol gt Examples of Welcome Message and Bulletin lt hi gt lt b gt lt font color red gt Welcome Message lt font gt lt b gt lt h1 gt lt p gt Message lt p gt 5 Open anew tab in the same browser for IE 7 0 FireFox and above or open a new web browser 6 Try to access into the web user interface e g 192 168 1 1 of Vigor router Please note Just for Carrie is displayed as a heading on the login dialog box Vigor2830 Series User s Guide 394 Dr ay Te k r igor Login Page Windows Internet Explorer http 192 168 1 5 p Just for Carrie Username Password Copyright DrayTek Corp All Rights Reserved Dray Tek Welcome Message This welcome message is displayed in the Login page of the router Replace this text with your own message 1 The welcome message can be written in HTML so lists such as this one can be created 2 Other markup tags such as p font or img can be used 7 After typing the user
111. not be able to access the VPN network Under this setting Associated Schedule Profiles i iz Note Only schedule profiles that have the action Force Down are applied to the WLAN all other actions are ignored Valid settings are profile indexes 1 to 15 Available settings are explained as follows Item Description Enable Wireless LAN Check the box to enable wireless function Mode At present the router can connect to 11n Only 11g Only 11b Only Mixed 11b 11g Mixed 11a 11n Mixed 11g 11n and Mixed 11b 11g 11n stations simultaneously Simply choose Mixed 11b 11g 11n mode Mixed 11b l1g 11n Mixed 11b 11g 11n oy 110 Only qin Only 2 4 GHz Mixedil1b 119 Mixed 11g 11n Mizedi11a 117 5 GHZ Mixedi11b 11g 11r Mixed 1b 1a 11n or In which 802 11b g operates on 2 4G band 802 11a operates on 5G band and 802 11n operates on either 2 4G or 5G band Channel Means the channel of frequency of the wireless LAN The Dray Tek default channel is 6 You may switch channel 1f the selected 297 Vigor2830 Series User s Guide channel is under serious interference If you have no idea of choosing the frequency please select Auto to let system determine for you Auto Channel 1 2412MHz Channel 2 241 MHz Channel 3 2422hMH2 Channel 4 2427 MHz Channel 5 2452hMH2 Channelb 2437 MHz Channel 7 2442 MHz Channel 5 2447 WiHz Channel 9 2452MHz Channel 1
112. o Huawei Huawei E153 ooo o Huawei Huawei E1550 o o o o o ooo o Huawei Huawei E1606 ooo o lt Oe Huawei Huawei E172 Huawei Huawei E173 Huawei Huawei 17500 ooo o Huawei Huawei E1756C ooo o Huawei Huawei E176e oS o Huawei Huawei E88 o o ooo o Huawei Huawei E2200 Huawei Huawei C806 o o o o ooo o Y lt lt I ei n L L p 3 17 System Maintenance For the system setup there are several items that you have to know the way of configuration Status TR 069 Admin Password User Password Login Page Greeting Configuration Backup Syslog Mail Alert Time and Date SNMP Management Reboot System Firmware Upgrade and Activation Below shows the menu items for System Maintenance System Maintenance Vigor2830 Series User s Guide 334 Dr ay Te k 3 17 1 System Status The System Status provides basic network settings of Vigor router It includes LAN and WAN interface information Also you could get the current running firmware version or firmware related information from this presentation System Status Model Name Vigor2830Vn Firmware Version 3 6 7 db Build Date Time Mar 24 2014 15 47 36 MAC Address IP Address Subnet Mask DHCP Server LANI 00 50 rF 64 FE 18 192 168 1 1 255 255 255 0 Oh LAN OU SO YF 64 FB 18 192 168 2 1 255 255 255 0 Oh LAMS 0d 50 7F 6 FB 18 192 168 3 1 255 255 255 0 aN LAM4 00 50 r7F 6 FB 18 192 168 4 1 255 255 255 0 aN IF Routed Subnet O0 SO YF 64 F
113. of VLAN Tag for VLAN setting check the box of Enable and type the value 8 for VID setting Then check P4 and set LAN2 as the Subnet 4 To activate the function of VLAN Tag for VLAN2 setting check the box of Enable and type the value 9 for VID setting Then check P4 and set LAN3 as the Subnet Vigor2830 Series User s Guide 378 Dray Tek 5 To activate the function of VLAN Tag for VLAN3 setting check the box of Enable and type the value 10 for VID setting Then check P4 and set LAN4 as the Subnet LAN gt VLAN Configuration VLAN Configuration Enable Wireless LAN P4 SSID1 SSID2 SSID3 SSID4 Subnet Enable E LAN 1 w LAN 2 w LAN 3 w LAN 4 4 LAM 1 w LAN 1 w LAN 1 w LAN 1 w fbb bb ebi Hooooooos bje je eje ejet o0 00ARAA KR HOooOoOooose OOOO AS i al el al ll al Permit untagged device in Pl to access router 1 Tag based VLAN only applied for LAN Parts 2 The checked Wireless LAN SSID will not has VLAN tagging function but regarded as joining WLAN group 3 The set WYLAN ID VID must be unique and not duplicate ok J clear Cancel 6 Inthe page of LAN gt gt General Setup check the Status box of LAN2 LAN3 and LAN4 and enable the function of DHCP LAN gt General Setup General Setup Index Status DHCP IP Address LAN 1 Y 192 168 1 1 Details Page LAN 2 192 168 3 1 Details Fage LAN 3 192 168 5 1 Details Page LAN 4 192 168 7 1 Details Page IP Routed Subnet C 192 168 0 1 Detai
114. of security management APP Enforcement Filter As the popularity of all kinds of instant messenger application arises communication cannot become much easier Nevertheless while some industry may leverage this as a great tool to connect with their customers some industry may take reserve attitude in order to reduce employee misusage during office hour or prevent unknown security leak It is similar situation for corporation towards peer to peer applications since file sharing can be convenient but insecure at the same time To address these needs we provide CSM functionality URL Content Filter To provide an appropriate cyberspace to users Vigor router equips with URL Content Filter not only to limit illegal traffic from to the inappropriate web sites but also prohibit other web feature where malicious code may conceal Once a user type in or click on an URL with objectionable keywords URL keyword blocking facility will decline the HTTP request to that web page thus can limit user s access to the website You may imagine URL Content Filter as a well trained convenience store clerk who won t sell adult magazines to teenagers At office URL Content Filter can also provide a job related only environment hence to increase the employee work efficiency How can URL Content Filter work better than traditional firewall in the field of filtering Because it checks the URL strings or some of HTTP data hiding in the payload of TCP packets while le
115. one specific field of digital signature to Alternative Name accept the peer with matching value The field can be IP Address Domain or E mail Address The box under the Type will appear according to the type you select and ask you to fill in corresponding setting Accept Subject Name Click to check the specific fields of digital signature to accept the peer with matching value The field includes Country C State ST Location L Organization O Organization Unit OU Common Name CN and Email E Dr ay Tek 247 Vigor2830 Series User s Guide 3 11 5 Remote Dial in User You can manage remote access by maintaining a table of remote user profile so that users can be authenticated to dial in via VPN connection You may set parameters including specified connection peer ID connection type VPN connection including PPTP IPSec Tunnel and L2TP by itself or over IPSec and corresponding security methods etc The router provides 32 access accounts for dial in users Besides you can extend the user accounts to the RADIUS server through the built in RADIUS client function The following figure shows the summary table VPN and Remote Access gt gt Remote Dial in User Remote Access User Accounts Index SS i gt ie e es a h h h F User fre Active ee ee N N a a ek Set to Factory Default Status Index User Active Status 17 7 O 18 2 O 19 777 oO 20 777
116. packets to the target hosts so that those target hosts will hang once they re construct the packets The Vigor routers will block any packets realizing this attacking activity Block ICMP Fragment Check the box to activate the Block ICMP fragment function Any ICMP packets with more fragment bit set are dropped Block Unassigned Check the box to activate the Block Unknown Protocol Numbers function Individual IP packet has a protocol field in the datagram header to indicate the protocol type running over the upper layer However the protocol types greater than 100 are reserved and undefined at this time Therefore the router should have ability to detect and reject this kind of packets Warning Messages We provide Syslog function for user to retrieve message from Vigor router The user as a Syslog Server shall receive the report sending from Vigor router which is a Syslog Client All the warning messages related to DoS Defense will be sent to user and user can review it through Syslog daemon Look for the keyword DoS in the message followed by a name to indicate what kind of attacks is detected Synem Maimenance r Syslog Maill Alen Setup Syslog i Mail dion Setup SysLog Access Sam Mall Wen Seip Enable il Enable Send ateu mniail Server iP fuddrace SMTP Server Dastination Port Fid Mal To Enabla syag message Raburn Path i Firewall Lig CI duthenteabon E VPM Log Weer Marig E arrg Call Lag Enable E Mail Alert E
117. public subnet or call second subnet that each host is equipped with a public IP address As a part of the public subnet the Vigor router will serve for IP routing to help hosts in the public subnet to communicate with other public hosts or servers outside Therefore the router should be set as the gateway for public hosts Dr ay Tek 103 Vigor2830 Series User s Guide Internet Public IP Address cz 220 135 240 207 Private Subn Router IP a What is Routing Information Protocol RIP Vigor router will exchange routing information with neighboring routers using the RIP to accomplish IP routing This allows users to change the information of the router such as IP address and the routers will automatically inform for each other What is Static Route When you have several subnets in your LAN sometimes a more effective and quicker way for connection is the Static routes function rather than other method You may simply set rules to forward data from one specified subnet to another specified subnet without the presence of RIP What are Virtual LANs and Rate Control You can group local hosts by physical ports and create up to 4 virtual LANs To manage the communication between different groups please set up rules in Virtual LAN VLAN function and the rate of each Internet Vigor2830 Series User s Guide 104 Dr ay Tek 3 2 2 General Setup This page provides you the general settings for LAN Click LAN to open the LA
118. purchase DrayTek s prepared Commtouch GlobalView WCF package from retailing outlets Activation Date 2 Web Content Filter fragFINN License Activation Agreement Date 4 I have read and accept the above Agreement Please check this box Note The activation date is brought out by the server automatically and cannot be changed Commtouch is the web content filter based on Commtouch operated in the worldwide There is a 30 day trial period After trial you can purchase DrayTek s prepared Commtouch GlobalView WCF package from retailing outlets BPjM is WCF for German Speaking users The fragfINN is whitelist for German Speaking users The BPjM is ideal for your family to provide more Internet security for youngsters The fragFINN is designed for protecting kids from inadequate web sites More info is available at http www draytek de jugendschutz 4 Setting confirmation page will be displayed as follows please click Next Service Activation Wizard Please confirm your settings Sevice Type Trial version Sevice Activated Web Content Filter Commtouch Please click Back to re select service type you to activate 5 Wait for a moment till the following page appears Dr ay Tek 41 Vigor2830 Series User s Guide Service Activation Wizard Connection Succeeded Please check the following item s to enable services on your router Enable Web Content Filter Finish When
119. quota Default Time Quota Type the value for the time manually Default Data Quota Type the value for the data manually After finishing all the settings here please click OK to save the configuration 3 6 3 User Group This page allows you to bind several user profiles into one group These groups will be used in Firewall gt gt General Setup as part of filter rules User Group Table Setto Factory Default Index Name Index Name a So Pa Pe IP Pa PR PR PR PR PRO i ee FRERBREBEFE PRP Peep e Please click any index number link to open the following page Dr ay Tek 167 Vigor2830 Series User s Guide User Management gt gt User Group Profile Index 1 Available User Objects Selected User Objects Max 32 Objects 1 admin 2 System Reservation J LAM User Group 1 4 VVLAN User Group A S VWVLAM User Group GB EE Available settings are explained as follows Item Description Name Type a name for this user group Available User Objects You can gather user profiles objects from User Profile page within one user group All the available user objects that you have created will be shown in this box Notice that user object Admin and Dial In User are factory settings User defined profiles will be numbered with 3 4 5 and so on erent Ore NIC ts Click button to add the selected user objects in this box After finishing all the settings here please click OK to save the configuration
120. router However the accessing operation will be restricted with the conditions configured in this user profile Password Type a password for such profile e g lug 23 wug123 wug456 etc When a user tries to access Internet through this router an authentication step must be performed first The user has to type the password specified here to pass the authentication When the user passes the authentication he she can access Internet via this router with the limitation configured in this user profile Confirm Password Type the password again for confirmation Idle Timeout If the user is idle over the limitation of the timer the network connection will be stopped for such user By default the Idle Timeout is set to 10 minutes Max User Login Such profile can be used by many users You can set the limitation for the number of users accessing Internet with the conditions of such profile The default setting is O which means no limitation in the number of users Policy It is available only when User Based mode selected in User Management gt gt General Setup Default 2 Default Create Mew Polic Default If you choose such item the filter rules pre configured in Firewall can be adopted for such user profile Create New Policy If you choose such item the following page will be popped up for you to define another filter rule as a new policy Vigor2830 Series User s Guide 164 Dr ay Te k Dray Tek Item E
121. rules Next Filter Set Set the link to the next filter set to be executed after the current filter run Do not make a loop with many filter sets Vigor2830 Series User s Guide 150 Dr ay Te k To edit Filter Rule click the Filter Rule index button to enter the Filter Rule setup page Firewall gt Edit Filter Set gt gt Edit Filter Rule Filter Set 3 Rule 1 C Check to enable the Filter Rule Comments Index 1 15 in Schedule Setup 1 Clear sessions when schedule ON C Enable Direction Source JP Destination IP Service Type Fragments Application Filter Branch to Other Filter Set Sessions Control MAC Bind IP Quality of Service Load Balance policy User Management APP Enforcement URL Content Filter Web Content Filter Advance Setting LAN RT VPN gt WAN w ny Edit b I ny Edit Edit n T s Dont Care kd Action Profile Syslog m Fass Immediately o 60000 Non Strict None Auto Select Edit dite 3 2 3 a r i i i mD pat Available settings are explained as follows Item Check to enable the Filter Rule Comments Index 1 15 Clear sessions when schedule ON Direction Dray Tek Description Check this box to enable the filter rule Enter filter set comments description Maximum length is 14 character long Set PCs on LAN to work at certain time interval only You may choose up to 4 schedules out of
122. secure tunnel for IKE Phase 2 gt Phase 2 negotiation IPSec security methods including Authentication Header AH or Encapsulating Security Payload ESP for the following IKE exchange and mutual examination of the secure tunnel establishment There are two encapsulation methods used in IPSec Transport and Tunnel The Transport mode will add the AH ESP payload and use original IP header to encapsulate the data payload only It can just apply to local packet e g L2TP over IPSec The Tunnel mode will not only add the AH ESP payload but also use a new IP header Tunneled IP header to encapsulate the whole original IP packet Authentication Header AH provides data authentication and integrity for IP packets passed between VPN peers This is achieved by a keyed one way hash function to the packet to create a message digest This digest will be put in the AH and transmitted along with packets On the receiving side the peer will perform the same one way hash on the packet and compare the value with the one in the AH it receives Encapsulating Security Payload ESP is a security protocol that provides data confidentiality and protection with optional authentication and replay detection service VPN and Remote Access gt gt IPSec General Setup VPN IKE IPSec General Setup Dial in Set up for Remote Dial in users and Dynamic IP Client LAN to LAN IKE Authentication Method Pre Shared Key IPSec Security Method Medium AH Data will be
123. security mode is Mixed WPA WPA2 PSK Default Pre Shared Key PSK is provided and stated on the label pasted on the bottom of the router For the wireless client who wants to access into Internet through such router please input the default PSK value for connection By clicking the Security Settings a new web page will appear so that you could configure the settings of WPA and WEP Wireless LAN gt Security Settings SSID 1 SSID 2 SSID 3 SSID 4 Mode MixediWPAtv PAZVP SK vv WPA Encryption Mode TEIP for WPALES for WiPA2 pre shared Key PSK m Type 8 63 ASCII character or 64 Hexadecimal digits leading by Ox far example cfgs0laz2 of Ox655abed m gm Encryption Mode Note Please configure the RADIUS Server if 802 1 is used For 64 bit WEP key configurations please insert 5 ASCII characters or 10 Hexadecimal digits leading by Ox Examples are ABS12 or Ox414233531352 For 128 bit WEP key configurations please insert 13 ASCII characters or 26 Hexadecimal digits leading by Ox Available settings are explained as follows Dray Tek 299 Vigor2830 Series User s Guide Item Mode WPA Vigor2830 Series User s Guide Description There are several modes provided for you to choose Disable J Disable Note You should also set RADIUS Server simultaneously if 802 1x mode is selected Disable Turn off the encryption mechanism WEP lt Accepts only WEP clients and the encr
124. servers provided by the system to allow you managing the router from Internet Check the box es to specify Enable PING from the Internet Check the checkbox to enable all PING packets from the Internet For security issue this function is disabled by default Access List You could specify that the system administrator can only login from a specific host or network defined in the list A maximum of three Ps subnet masks is allowed IPv6 Address Prefix Length Indicate the IP address es allowed to login to the router 3 17 11 Reboot System The Web user interface may be used to restart your router Click Reboot System from System Maintenance to open the following page System Maintenance gt gt Reboot System Reboot System Do you want to reboot your router Using current configuration Using factory default configuration Auto Reboot Time Schedule Index 1 15 in Schedule Setup Note Action and Idle Timeout settings will be ignored Index 1 15 in Schedule Setup You can type in four sets of time schedule for performing system reboot All the schedules can be set previously in Applications gt gt Schedule web page and you can use the number that you have set in that web page If you want to reboot the router using the current configuration check Using current configuration and click OK To reset the router settings to default values check Using factory default configuration and click O
125. such page appears you can enable or disable these services for your necessity Then click Finish Note The service will be activated and applied as the default rule configured in Firewall gt gt General Setup 6 Now the web page will display the service that you have activated according to your selection s The valid time for the free trial of these services is one month Service Activation Wizard Server Enabled DrayTek Service Activation Service Name Start Date Expire Date Status Web Content filter 2011 09 21 e011 10 22 Commtouch Please check if the license fits with the service provider of your signature To ensure normal operation for your router Update your signature again is recommended Copyright OrayTek Corp All Rights Reserved Vigor2830 Series User s Guide 42 Dr ay Te k Later if you need to extend the license valid time for the same service you can also use the Service Activation Wizard again to reach your goal by clicking the radio button of Formal edition with license Key and clicking Next Service Activation Wizard Select the service type that you want to activate This wizard is used for activating Web Content Filter Please choose the edition you need Formal edition with license key Service Activation Wizard Select the service type that you want to activate Please choose the item you want to use WCF service Web Content Filter Commtouch Commtou
126. the 15 schedules pre defined in Applications gt gt Schedule setup The default setting of this field is blank and the function will always work Check this box to clear the sessions when the above schedule profiles are applied Set the direction of packet flow It is for Data Filter only For the Call Filter this setting is not available since Call Filter is only applied to outgoing traffic 151 Vigor2830 Series User s Guide Source Destination IP Service Type Vigor2830 Series User s Guide LAN RTAVPN gt WAN LAMRTAPN gt WAM WAN gt LANVR TAY PN LANMRTYPN gt LAMER TA PN Note RT means routing domain for 2nd subnet or other LAN Click Edit to access into the following dialog to choose the source destination IP or IP ranges 3 IP Address Edit Microsoft Internet Explorer IP Address Edit Address Type Start IP Address End IP Address Subnet Mask Invert Selection IP Group or IP Object or IP Object or IP Object Group and Obje cts v None None vi None 1 RD Department 2 Financial Dept 3 HR Department Close To set the IP address manually please choose Any Address Single Address Range Address Subnet Address as the Address Type and type them in this dialog In addition if you want to use the IP range from defined groups or objects please choose Group and Objects as the Address Type Group and Objects Any Address sin
127. the URL Content Filter Profile Vigor2830 Series User s Guide 200 Dr ay Tek Administration Message You can type the message manually for your necessity Default Message You can type the message manually for your necessity or click this button to get the default message which will be displayed on the field of Administration Message You can set eight profiles as URL content filter Simply click the index number under Profile to open the following web page CSM gt gt URL Content Filter Profile Profile Index 1 Priority Both Pass Log 1 URL Access Control Enable URL Access Control Prevent web access from IP address Action Group Object Selections OO E 2 Web Feature Enable Restrict Web Feature Action LJ Cookie L Proxy File Extension Profile Available settings are explained as follows Item Description Profile Name Type a name for the CSM profile Priority It determines the action that this router will apply Both Pass The router will let all the packages that match with the conditions specified in URL Access Control and Web Feature below passing through When you choose this setting both configuration set in this page for URL Access Control and Web Feature will be inactive Both Block The router will block all the packages that match with the conditions specified in URL Access Control and Web Feature below When you choose this setting both configuration set in this page fo
128. the box to designate the LAN port for channel 3 to 8 Normally service type is used for the service of video stream e g IPTV It can divide the packets from remote control and from video stream into different PVC Such feature is used for specific application Please choose Normal as the Service Type Normal It means that the PVC can accept all packets IGMP It means that such PVC can accept IGMP packets only Such type just meets a specific environment on some ISPs Data and IGMP packets will be transmitted and received with different PVC 101 Vigor2830 Series User s Guide Click Clear to remove all the configurations in this page if you do not satisfy it When you finish the configuration please click OK to save and exit this page Or click Cancel to abort the configuration and exit this page PVC to PVC Binding Add Tag This feature can direct certain services such as Internet IPTV and so on from other channels into a single channel WAN gt Multi PVCs Multi PVCs General ATM QoS Port based Bridge PVC to PVC Binding Add Tag Channel PVC Binding Add Tag Priority 1 Disable m Hf o 3 Disable E oe o 3 Ob o 4 i ob o 5 Op o 6 ob o 7 i o 8 oe o Note Multiple channels may use the same channel link through the P C Binding configuration PYCO ta PYCO Binding only supports PPPoE and MPo4 1483 Bridge mode Available settings are explained as follows Item Description PVC Binding
129. the hosts in LAN must follow the standard configured in the APP Enforcement profile selected here For detailed information refer to the section of APP Enforcement profile setup For troubleshooting needs you can specify to record information for IM P2P by checking the Log box It will be sent to Syslog server Please refer to section Syslog Mail Alert for more detailed information Select one of the URL Content Filter profile settings created in CSM gt gt URL Content Filter for applying with 147 Vigor2830 Series User s Guide this router Please set at least one profile for choosing in CSM gt gt URL Content Filter web page first Or choose Create New from the drop down list in this page to create a new profile For troubleshooting needs you can specify to record information for URL Content Filter by checking the Log box It will be sent to Syslog server Please refer to section Syslog Mail Alert for more detailed information Web Content Filter Select one of the Web Content Filter profile settings created in CSM gt gt Web Content Filter for applying with this router Please set at least one profile for anti virus in CSM gt gt Web Content Filter web page first Or choose Create New from the drop down list in this page to create a new profile For troubleshooting needs you can specify to record information for Web Content Filter by checking the Log box It will be sent to Syslog server Please refer to section Syslog Mail
130. the profile Vigor2830 Series User s Guide 132 Dr ay Te k Protocol Public Port Private IP Status Display the transport layer protocol TCP or UDP Display the port number which will be redirected to the specified Private IP and Port of the internal host Display the IP address of the internal host providing the Service Display if the profile 1s enabled v or not x Press any number under Index to access into next page for configuring port redirection NAT gt gt Port Redirection Index No 1 Enable Mode Service Name Protocol WAR IP Public Port Private IP Private Port Note In Range Mode the End IP will be calculated automatically once the Public Port and Start IP have been entered Available settings are explained as follows Item Enable Mode Service Name Protocol WAN IP Public Port Dray Tek Description Check this box to enable such port redirection setting Two options Single and Range are provided here for you to choose To set a range for the specific service select Range In Range mode if the public port start port and end port and the starting IP of private IP had been entered the system will calculate and display the ending IP of private IP automatically Enter the description of the specific network service Select the transport layer protocol TCP or UDP Select the WAN IP used for port redirection There are eight WAN IP alias that can be selected
131. the router will be unable to monitor the External Device device properly Click the Clear button to Clear the off line information and account information Available settings are explained as follows Item Description External Device Auto Check this box to detect the external device automatically Discovery and display on this page Dray Te k 369 Vigor2830 Series User s Guide This page is left blank Vigor2830 Series User s Guide 370 Dr ay Te k Application and Examples 4 1 How to Configure Multiple Services with PVC to PVC Binding The router supports a new feature that single PVC can offer more than one service The following illustration shows how to bind the functions of NAT and Bridge processed with one PVC Triple Play by PVC to PVC Binding CPE Side ISP CO Side WW PPPoE Server 192 168 225 1 s9 r C _ a ein jane DHCP Server 192 168 226 1 IPTV Setop Box 192 168 226 91 From the above figure Setop Box and DHCP server can reach for each other through WANS with Bridge mode LAN PC in P1 beneath Vigor router can reach to PPPoE Server through WAN with NAT Both NAT and Bridge are built through the same Channel 1 Follow the steps listed below to configure the settings 1 Log into the web user interface of Vigor router 2 Open WAN gt gt Internet Access Only PPPoE and MPoA 1483 Bridge can support PVC to PVC Binding feature you have to choose PPPoE PPOA as the Access Mode for WA
132. the screen size for such application Samba Path If you choose Samba you have to specify the path of the Samba service 3 Enter the required information 4 After finished the above settings click OK to save the configuration Web Access Control gt gt SSL Application SSL Applications Profiles Setto Factory Default Host Address Service 192 168 1 54 5900 YHE i 2 zi 4 Vigor2830 Series User s Guide 320 Dr ay Tek 3 15 4 User Account With SSL VPN Vigor2830 series let teleworkers have convenient and simple remote access to central site VPN The teleworkers do not need to install any VPN software manually From regular web browser you can establish VPN connection back to your main office even in a guest network or web cafe The SSL technology is the same as the encryption that you use for secure web sites such as your online bank The SSL VPN can be operated in either full tunnel mode or proxy mode Now Vigor2830 series allows up to 10 simultaneous incoming users For SSL VPN identity authentication and power management are implemented through deploying user accounts Therefore the user account for SSL VPN must be set together with remote dial in user web page Such menu item will guide to access into VPN and Remote Access gt gt Remote Dial in user Web Access Control gt gt Remote Dial in User Remote Access User Accounts Setto Factory Default Status Index Status 1 2 d 4 5 G f a g
133. through the WAN interface Interface Use the drop down list to choose a WAN or LAN interface or VPN profile Packets match with the above criteria will be transferred to the interface chosen here Gateway IP Specific gateway is used only when you want to forward the packets to the desired gateway Usually Default Gateway is selected in default Auto Failover To The Other WAN Check this button to lead the data passing through other WAN automatically when the selected WAN interface is down Packet Forwarding to WAN via Choose Force NAT or Force Routing 130 DrayTek 3 When you finish the configuration please click OK to save and exit this page Load Balance Route Policy a Load Balance Route Policy Set to Factory Default Src Src Dest Dest Dest Dest Index Enable Protocol Interface e IP IP IP IP Port Port Move Ba Start End Start End Start End P 41 Any WANI Any Any Any Any Any Any Down 2 Any WANI UP Down 3 4 NAT Usually the router serves as an NAT Network Address Translation router NAT is a mechanism that one or more private IP addresses can be mapped into a single public one Public IP address is usually assigned by your ISP for which you may get charged Private IP addresses are recognized only among internal hosts When the outgoing packets destined to some public server on the Internet reach the NAT router the router will change its source address into the public IP address of the router s
134. to identify its location on the network To avoid address conflicts IP addresses are publicly registered with the Network Information Centre NIC Having a unique IP address is mandatory for those devices participated in the public network but not in the private TCP IP local area networks LANs such as host PCs under the management of a router since they do not need to be accessed by the public Hence the NIC has reserved certain addresses that will never be registered publicly These are known as private IP addresses and are listed in the following ranges From 10 0 0 0 to 10 255 255 255 From 172 16 0 0 to 172 31 255 255 From 192 168 0 0 to 192 168 255 255 63 Vigor2830 Series User s Guide What are Public IP Address and Private IP Address As the router plays a role to manage and further protect its LAN it interconnects groups of host PCs Each of them has a private IP address assigned by the built in DHCP server of the Vigor router The router itself will also use the default private IP address 192 168 1 1 to communicate with the local hosts Meanwhile Vigor router will communicate with other network devices through a public IP address When the data flow passing through the Network Address Translation NAT function of the router will dedicate to translate public private addresses and the packets will be delivered to the correct host PC in the local area network Thus all the host PCs can share a common Internet connection Get Yo
135. via the router Assuming the Internet access has been configured and the router works properly use the Main Router to surf the Internet create a private subnet 192 168 10 0 using an internal Router A 192 168 1 2 create a public subnet 211 100 88 0 via an internal Router B 192 168 1 3 have set Main Router 192 168 1 1 as the default gateway for the Router A 192 168 1 2 Before setting Static Route user A cannot talk to user B for Router A can only forward recognized packets to its default gateway Main Router Internet Set Static Route Router C Router 192 168 1 2 Gateway 192 168 1 1 E Vigor2830 Series User s Guide 116 Dr ay Te k 1 Goto LAN page and click General Setup select Ist Subnet as the RIP Protocol Control Then click the OK button Note There are two reasons that we have to apply RIP Protocol Control on Ist Subnet The first is that the LAN interface can exchange RIP packets with the neighboring routers via the Ist subnet 192 168 1 0 24 The second is that those hosts on the internal private subnets ex 192 168 10 0 24 can access the Internet via the router and continuously exchange of IP routing information with different subnets 2 Click the LAN Static Route and click on the Index Number 1 Check the Enable box Please add a static route as shown below which regulates all packets destined to 192 168 10 0 will be forwarded to 192 168 1 2 Click OK LAN gt Static Route
136. you have set in that web page Time quota means the total connection time allowed by the router for the user with such profile Check the box to enable the function of time quota The first box displays the remaining time of the network connection The second box allows to type the number of time unit is minute which is available for the user using such profile to access Internet Click this box to set and increase the time quota for such profile had Click this box to decrease the time quota for such profile Note A dialog will be popped up to notify how many time remained when a user accesses into Internet through Vigor router successfully InternetAccess Saks Michael you are now connected Time remaining online 00 32 41 Time used 01 12 54 When the time is up all the connection jobs including network IM social media facebook and etc will be terminated Data Quota means the total amount for data transmission allowed for the user The unit is MB Click this box to set and increase the data quota for 6 Dray Tek Item Description such profile Click this box to decrease the data quota for such profile Reset quota to default Set default time quota and data quota for such profile when scheduling time When the scheduling time is up the router will use the expired default quota settings automatically Enable Check it to use the default setting for time quota and data
137. 0 2457 MHz Channel 11 2462 1Hz Channel 12 2467 MHz Channel 13 247 2M1Hz Channel Hide SSID Check it to prevent from wireless sniffing and make it harder for unauthorized clients or STAs to join your wireless LAN Depending on the wireless utility the user may only see the information except SSID or just cannot see any thing about Vigor wireless router while site surveying The system allows you to set four sets of SSID for different usage In default the first set of SSID will be enabled You can hide it for your necessity SSID Means the identification of the wireless LAN SSID can be any text numbers or various special characters The default SSID is DrayTek We suggest you to change it Isolate VPN Check this box to make the wireless clients stations with different VPN not accessing for each other Member Check this box to make the wireless clients stations with the same SSID not accessing for each other Schedule Set the wireless LAN to work at certain time interval only You may choose up to 4 schedules out of the 15 schedules pre defined in Applications gt gt Schedule setup The default setting of this field is blank and the function will always work Vigor2830 Series User s Guide 298 Dr ay Tek 3 14 3 Security This page allows you to set security with different modes for SSID 1 2 3 and 4 respectively After configuring the correct settings please click OK to save and invoke it The default
138. 0 3 8 3 Web Content Filter Prot scaissaiscvesscsniseioesieuntuisesaraitssniinussiuimausgsatewntegsinsuedaesdananiganveuniauienrs 204 O FDN S FO r EERE E E E E E E E eee 208 Sie WOW AP PRE SUDDO LIG breues eai aE EES ia ee ee eee 209 3 9 Bandwidth Management cccccssssceccesseecceeseecceeueecneuseeessageeecsaseeeseaseeessaueesssaseeessegeeesss 210 Vit SONS LIM eesis r E esac temeaseesenps RE ET E a a 210 3 9 2 Band WOI EN oo secgacanaedgseatseccec nia E eT R ana arRo aei 212 20S CAIN Or SIVO ee e a EN 214 AOADA a a a 223 eV Oe EONA CDN eae E E EE 223 TO CAN DN e E E A E te oct ogee ieqaigueeesasees 226 3103 CMOS sonuni e enn r latin O a i E ETa E AS AEREN 228 STOA RADIU gt een eee E E ce ee ee ere ere 231 3 10 5 Active Directory LDAP cccccccsecccceeseeeccesseeeseaeeeceauseecseaeeessaseeseseeessaseeessensessseass 232 SOO UPAR acces cts ng ere en es ccc pnscg hee we caa de tite E A 235 Oy ONIE ea ee ee een ee E 237 3 10 93 Wake n LAN eee eee ee E ee ee ene ene ee eee ee 238 Vigor2830 Series User s Guide viii Dr ay Tek 3 10 9 SMS Mail Alert SQrviCe ccccccccccecccceccecececceccccecuccecucaecucececeesececauaecauauceuaeeeeaeceeecneceees 239 3 11 VPN and Remote ACCESS vi ivsissinssavacsapesneoseussuadseuanecndiauvacsdumsadeusiemesinsehseuaninyanadeteevbandeaiaueans 241 Onl lal Remote ACCESS CONTO Dursasana E E E E A 242 Oo ge PPF Oena eUD a a EEE EEE 242 OAs IP SEC GOO al SED erein E E E 244 3 11 4 IPSec Peer ldent
139. 0 Series User s Guide 7 At last set the remote network IP subnet in TCP IP Network Settings so that Router A can direct the packets destined to the remote network to Router B via the VPN connection 4 TCP IP Network Settings My WAN IP 0 0 0 0 RIP Direction From first subnet to remote network you have to do Remote Network IP 192 168 2 0 Remote Network Mask 255 255 255 0 192 168 1 1 Change default route to this YPN tunnel Only single WAN supports this 4 Remote Gateway IP Local Network IP Local Network Mask 255 255 255 0 More Settings in Router B in the remote office Z 1 Goto VPN and Remote Access and select Remote Access Control to enable the necessary VPN service and click OK 2 Then for using PPP based services such as PPTP L2TP you have to set general settings in PPP General Setup VPN and Remote Access gt gt PPP General Setup PPP General Setup PPP MP Protocol LDAP Server Profiles for PPP Authentication arnt a Authentication Sass lot T ARME CAEN M Mote Please select PAP Only in Dial In PPP Dial In PPP Authentication f you want to use AD LDAF for Encryption MPPE OPUONALMEEE h PPP Authentication Mutual Authentication PAP ves No Password IP Address Assignment for Dial In Users When DHCP Disable set Assigned IP start LAN 1 can 2 wan 3 LAN 4 For using IPSec based service such as IPSec or L2TP with IPSec Policy you have to set general se
140. 012345678 or 64 Hexadecimal digits leading by Ox such as 0x321253abcde Rate Control It controls the data transmission rate through wireless connection Upload Check Enable and type the transmitting rate for data upload Default value is 30 000 kbps Download Type the transmitting rate for data download Default value is 30 000 kbps Next Click it to get into the next setting page Cancel Exit the wireless wizard without saving any changes 4 After typing the required information click Next 5 The following page will display the configuration summary for wireless setting Wireless Wizard Configuration Summary Basic Wireless Settings Mode Mixed i11b 11g 1in Channel channel 6 2437 MHZ Host AP Configurations Name OrayTek Password 1235679996 Guest AP Configurations Status Disabled Name OrayTek Guest Password Rate Control Disabled Click Finish to complete the wireless settings configuration Dr ay Tek 57 Vigor2830 Series User s Guide 2 6 VoIP Wizard Vigor router offers a quick method to configure settings for VoIP application Follow the steps listed below Note This wizard is available for V model only 1 Open VoIP Wizard Wizards 2 The screen of VoIP Wizard will be shown as follows VoIP Wizard Set VoIP service provider domain VoIP service provider draytel arg v draytel arg 63 char max SIP Port s060 Set Account quickly Phone 1 default
141. 0Vn 3 6 7 _db Mar 24 2014 15 47 36 WAN LAN Load Balance Route Policy NAT Firewall User Management Objects Setting CSM Bandwidth Management Applications VPN and Remote Access Certificate Management VolP Wireless LAN SSL VPN USB Application System Maintenance Diagnostics External Devices Subnet Mask 255 255 255 0 255 255 255 0 255 255 255 0 255 255 255 0 255 255 255 0 IP Address 192 168 1 1 192 168 2 1 192 168 3 1 192 168 4 1 192 168 0 1 MAC Address 00 50 7F 6A4 FB 00 50 7F 6A4 FB 00 50 7F 64 FB 00 SO0 7F 64 FB O00 SO0 7F 64 FB DHCP Server DNS 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 LANA LAN2 LANS LAN4 IP Routed Subnet Firmware Version a 2 0 7 MAC Address 00 50 7F 64 FB 18 Frequency Domain FCC IP Address Connection PPPoE MAC Address 00 50 7F 64 FB 19 O00 50 7F 64 FB 1A4 00 S50 7F 64 FB 1B Link Status Disconnected Disconnected Disconnected Default Gateway Internet Access Mode Address LAN FE80 250 7FFF FE6A4 FB18 64 Port Profile Req In Out Scope Link Product Registration Quick Start Wizard offers user an easy method to quick setup the connection mode for the router Moreover if you want to adjust more settings for different WAN modes please go to WAN group asics of Internet Protocol IP Network IP means Internet Protocol Every device in an IP based Network including routers print server and host PCs needs an IP address
142. 1 1 the starting IP address must be 192 168 1 2 or greater but smaller than 192 168 1 254 IP Pool Counts Enter the maximum number of PCs that you want the DHCP server to assign IP addresses to The default is 50 and the maximum is 253 Lease Time Enter the time to determine how long the IP address assigned by DHCP server can be used Use LAN Port Specify an IP for IP Route Subnet If it is enabled DHCP server will assign IP address automatically for the clients coming from P1 and or P2 Please check the box of P1 and P2 Use MAC Address Check such box to specify MAC address MAC Address Enter the MAC Address of the host one by one and click Add to create a list of hosts to be assigned deleted or edited IP address from above pool Set a list of MAC Address for 2 DHCP server will help router to assign the correct IP address of the correct subnet to the correct host So those hosts in 2 subnet won t get an IP address belonging to 1 subnet Add Type the MAC address in the boxes and click this button to add Delete Click it to delete the selected MAC address Edit Click it to edit the selected MAC address Cancel Click it to cancel the job of adding deleting and 113 Vigor2830 Series User s Guide editing After finishing all the settings here please click OK to save the configuration 3 2 3 Static Route Go to LAN to open setting page and choose Static Route The router offers IPv4 a
143. 14 Select LPR on Protocol type p1 number 1 as Queue Name Then click OK Next please refer to the red rectangle for choosing the correct protocol and LPR name mer properties Remove device z Fort Settings Port Marne 192 168 1 1 l Printer Name or IP Address 192 168 1 1 Frotocol C Raw cm LPR Raw Settings Port Wurmber LPR Settings Queue Mame LPR Byte Counting Enabled SAWP Status Enabled Community Name public SMMP Device Index p Cancel The printer can be used for printing now Most of the printers with different manufacturers are compatible with vigor router Dr ay Tek 15 Vigor2830 Series User s Guide Note 1 Some printers with the fax scanning or other additional functions are not supported If you do not know whether your printer is supported or not please visit www DrayTek com to find out the printer list Open Support gt FAQ find out the link of Printer Server and click it then click the What types of printers are compatible with Vigor router link D Ti k MyVigor Register E newsletter DrayTek HQ Media Center Global English i About DrayTek Products Supports Solutions Multi Media Demo Contact Us FAQ I Application You are here Home Supports FAQ Applicatiof Notes Printer Server Basic ee Printer Server WAN IPv6 Triple Play 2 How do I configure LPR printing on Windows7 Dual WAN 3 How do I configure LPR printing on My
144. 2 168 0 26 Alfa 192 168 0 26 Bentley 192 168 0 27 Audi 192 168 0 28 BMW 192 468 0 29 Gintra Modp Backup Mode mh Statues Buick 192 168 0 30 1 Cadillac 192 168 0 34 a Chrysler 192 168 0 32 ol Type Remote Citroen 192 168 0 33 Rx Ry Daihatsu 192 168 0 34 a Ferrari 192 168 0 35 Data is er Data isnt Fiat 192 1658 0 36 Backup Mode This filed displays the profile name saved in VPN TRUNK Management with Index number and VPN Server IP address The VPN connection built by Backup Mode supports VPN backup function General Mode Alfa 192 168 0 26 i VpnBackup j 192 168 2 103 192 168 2 103 VpenBackup VonBackup 192 168 2 203 Dial Click this button to execute dial out function Backup Mode Refresh Seconds Choose the time for refresh the dial information among 5 10 and 30 Refresh Click this button to refresh the whole connection Status Dr ay Tek 267 Vigor2830 Series User s Guide 3 12 Certificate Management A digital certificate works as an electronic ID which is issued by a certification authority CA It contains information such as your name a serial number expiration dates etc and the digital signature of the certificate issuing authority so that a recipient can verify that the certificate is real Here Vigor router support digital certificates conforming to standard X 509 Any entity wants to utilize digital certifi
145. 2 3 4 5 6 7 gt 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 Default Disable Disable 2830 VID7 Disable Disable 2830 VID8 Disable Disable 2830 VID9 1 Disable Disable Disable Disable Disable Disable 2830 VID10 10 Disable Disable 1802 1x Trunk Distr IMSTP Mirroring multicast Alarm IDHCP Snooping LLDP Disable Hsave Restore Export import Opiagnostics VLAN Name 2830 VID7 Port Members 15 23 VLAN Name 2830 VID8 Port Members 16 23 VLAN Name 2830 VID9 Port Members 17 23 VLAN Name 2830 VID10 Port Members 18 23 3 Open Vlan gt gt Ports and set the VID value with role for each Port Port 15 VID 7 Role Access Port 16 VID 8 Role Access Port 17 VID 9 Role Access Port 18 VID 10 Role Access Port 23 VID 1 Role Trunk Port 23 is set with Trunk in this example and will transfer the packets with VLAN Tag information That is packets with VID 7 8 9 and 10 will be transferred to Vigor2830 by Port 23 and VID information will be retained Vigor2830 Series User s Guide 380 Dray Tek Dray Tek Auto Logout OFF s z 5 TA All vij 50 access m u uisanie mi E system 6 v a All v 86 Access 0 Disable EPort 7 E All 86 Access 0 Disable Evian 8 7 g All v 86 Trunk 0 Disable Vian Mode r i Tag based Group E All v 84 Access 0 Disable Port based Group 10 a All v 84 Acce
146. 26 777 C 11 LJ as 2T A 12 27 d n 28 C 13 LJ ae 29 C an 14 le O 30 277 o _ 15 Ei d men 3 C 16 72 O sa 32 O soi XXXXXX This Dial out profile has already joined for VPN Backup Mechanism XXXXXX This Dial out profile does not join for VPN TRUNK The following shows profiles joined into VPN Backup mechanism VPN and Remote Access gt gt LAN to LAN LAN to LAN Profiles View All Trunk ame Activate Members Status XXXXXX This Dial out profile has already joined for VPN Backup Mechanism Available settings are explained as follows Item Description View All Click it to display the LAN to LAN profiles Trunk Click it to display the Trunk profiles Set to Factory Default Click to clear all indexes Vigor2830 Series User s Guide 252 Dr ay Te k Name Indicate the name of the LAN to LAN profile The symbol represents that the profile is empty Active Check the box to enable the selected profile Status Indicate the status of individual profiles The symbol V and X represent the profile to be active and inactive respectively To edit each profile 1 Click each index to edit each profile and you will get the following page Each LAN to LAN profile includes 4 subgroups If the fields gray out it means you may leave it untouched The following explanations will guide you to fill all the necessary fields For the web page is too
147. 2TP Static IP DHCP 2 Click DHCP as the Internet Access type Simply click Next to continue Quick Start Wizard DHCP Client Mode WAN 2 If your ISP requires you to enter a specific host name or specific MAC address please enter it in Host Name Kaptionaly MAC oo En rF oo Joo 02 optionaly Available settings are explained as follows Item Description Host Name Type the name of the host MAC Some Cable service providers specify a specific MAC address for access authentication In such cases you need to enter the MAC address Back Click it to return to previous setting page Next Click it to get into the next setting page Vigor2830 Series User s Guide 36 Dr ay Tek Cancel Click it to give up the quick start wizard 3 After finished the settings above click Next for viewing summary of such connection Quick Start Wizard Please confirm your settings WAN Interface WAKE Physical Mode Ethernet Physical Type Auto negotiation Internet Access DHCP Click Back to modify changes if necessary Otherwise click Finish to sawe the current settings and restart the Vigor router 4 Click Finish A page of Quick Start Wizard Setup OK will appear Then the system status of this protocol will be shown Quick Start Wizard Setup OK 5 Now you can enjoy surfing on the Internet Dr ay Tek 37 Vigor2830 Series User s Guide 2 1 3 For WAN3 USB To use 3G USB modem for network
148. 302 AS ee ee eer ee ee ee 303 aaa OWD a ene ee eee ere ee eee eee eee 306 Oe Mes PON ING SG FLING a A E ena custaceatecana 309 3 149 WMM OIC FAO eases seramcietsceclacacinccto cane T N casio cacalecsdaeunalee 311 SA OAP DIECI acc rovasaneveiesencestrianszosntncciazsneubatatuaysaratsdasatetsadtsniaGimaiuorsanieancue iret siutaseriinbes 312 Es WO ONY E tose te sera E ueastetssonesoe scum seed sinzadasucanateesaeqetovsscssacecnecess 314 3 14 11 Bandwidth Manageme n cccccccccssseceeeseeeeceeeeeeeseeeeeeseaseeessaeeeeesaeeessaneeessageeeenaaes 315 AT O EYEN ace setae os seinen E A E E 316 3 15 1 General Setup aips Enn nna Eaei NEENA Ea Oaa Ea AAAA EEEE 316 SoLo EWED FTO y res a E E EE ee 317 J13 Oe PO NOUN pesee E AEE E 318 STA UST ACCOUN e a A E A E teas 321 SPs hop US EEE 6 E E re EE E ee E E 325 J190 Onine User StalUS ecnin ETE E cna cbaniesenetcaees 327 216 USB Applicat ssersrenrun neee eee eee ene ee en eee eee 328 J161 USB Ce Mel alll HIG xc seaatenaaccnauascomnetairascenmmud sep i EET N AAE a R RR SE ARE 328 3 16 2 USB USer Manage Mem iiencicicdeerccascapcnewddasnsdedaceenswasdeasduinesetuededadedeeveoinawaeiadeendvobdaendavends 329 a10 o EGE A ON Cl ainanannniece nein atnammasdedtoinsunnes E 332 316 4 USB Device taS enn eee eee ee eee ee eee 333 216 9 Modem SUpport Sisia Ea Ta a E Ra 334 3 17 SV SUS INTIMA eo MGING Ce od aranesccessacdeesacsuaeceseseheansstegsasaraetdora isdebeacaxsedecpasaeieuseuesnectases nectaetece ee 334 my I
149. 80 to avoid conflict such as 8080 This can be set in the System Maintenance gt gt Management Setup You then will access the admin screen of by suffixing the IP address with 8080 e g http 192 168 1 1 8080 instead of port 80 System Maintenance gt gt Management IPvd Management Setup IPvi Management Setup Router Name fs Management Port Setup User Define Ports Default Ports C Default Disable Auto Logout Telnet Port Default 23 HTTP Port so Default 80 Internet Access Control ae a Default 443 o efault OI Allow management from the Internet aT Gener FTP Port Default 21 HTTPS Server SSH Port Default 22 Telnet Server TROGY Server SSH Server Disable PING from the Internet External Device Control No respond to External Device LAN Access Control Allow management from LAN FIP Server HTTP Server 3 4 2 DMZ Host As mentioned above Port Redirection can redirect incoming TCP UDP or other traffic on particular ports to the specific private IP address port of host in the LAN However other IP protocols for example Protocols 50 ESP and 51 AH do not travel on a fixed port Vigor router provides a facility DMZ Host that maps ALL unsolicited data on any protocol to a single host in the LAN Regular web surfing and other such Internet activities from other clients will continue to work without inappropriate interruption DMZ Host allows a defined internal user to be totally exposed to the Int
150. Access Management we implement Group feature There is no need to pre configure user profile for each user on Vigor router anymore We only need to configure the Groups DN then the Vigor router e g Vigor 3200 series can pass the authentication to LDAP server with the pre defined Group path Below shows the configuration steps 1 Access into the web user interface of the Vigor router 2 Open Applications gt gt Active Directory LDAP to get the following page for configuring LDAP related settings Applications gt Active Directory LDAP Active Directory LDAP Setto Factory Default Active Directory General Setup LDAP Profiles Enable Bind Type Server Address 72 16 2 8 Destination Port 59 Use SSL Regular CH UWid ypntest ou VvaAnuserdcHms dcHdr Regular Password Note After finishing the configuration of the LDAP profiles they will be listed in the page of VPN and Remote Access gt gt PPP General Setup If you want to use the profiles for WPN authentication check the boxes under PPTP LDAP Profiles in VPN and Remote Access gt gt PPP General Setup first There are three types of bind type supported Simple Mode Just simply do the bind authentication without any search action Anonymous Perform a search action first with Anonymous account then do the bind authentication Regular Mode Mostly it is the same with anonymous mode The different is that the server will firstly ch
151. Add When you choose this mode the OP number will be added with the prefix number for calling out through the specific VoIP interface Strip When you choose this mode the OP number will be deleted by the prefix number for calling out through the specific VoIP interface Take the above picture Prefix Table Setup web page as an example the OP number of 886 will be deleted completely for the prefix number is set with SS6 Replace When you choose this mode the OP number will be replaced by the prefix number for calling out through the specific VoIP interface Take the above picture Prefix Table Setup web page as an example the prefix number of 03 will be replaced by 8863 For example dial number of 031111111 will be changed to 88631111111 and sent to SIP server 278 Dray Tek Mode Replace Mone Add Strip OP Number The front number you type here is the first part of the account number that you want to execute special function according to the chosen mode by using the prefix number Min Len Set the minimal length of the dial number for applying the prefix number settings Take the above picture Prefix Table Setup web page as an example 1f the dial number is between 7 and 9 that number can apply the prefix number settings here Max Len Set the maximum length of the dial number for applying the prefix number settings Route Choose the one that you want to enable the prefix number settings from
152. Address configuratiion IPve Address Prefix Length CC ET Current IPv6 Address Table Index IPs iddress Prefix Length 1 FESO 250 7FFF FEEA 7EC8 64 It provides 2 daemons for LAN side IPv6 address configuration One is RADVD stateless and the other is DHCP v6 Server Stateful Available settings are explained as follows Item Description RADVD Configuration Enable Click it to enable RADVD server The router advertisement daemon radvd sends Router Advertisement messages specified by RFC 2461 to a local Ethernet LAN periodically and when requested by a node sending a Router Solicitation message These messages are required for IPv6 stateless auto configuration Disable Click it to disable RADVD server Advertisement Lifetime The lifetime associated with the default router in units of seconds It s used to control the lifetime of the prefix The maximum value corresponds to 18 2 hours A lifetime of O indicates that the router is not a default router and should not appear on the default router Dr ay Tek 109 Vigor2830 Series User s Guide DHCPv6 Server Configuration DNS Server IPv6 Address Static Pv6 Address configuration Current IPv6 Address Table list Enable Server Click it to enable DHCPV6 server DHCPv6 Server could assign IPv6 address to PC according to the Start End IPv6 address configuration Disable Server Click it to disable DHCPvV6 server Start IPv6 Address End IPv6 Ad
153. Available settings are explained as follows Item WAN IP Subnet Mask Gateway Primary DNS Secondary DNS Back Next Cancel Vigor2830 Series User s Guide Description Type the IP address Type the subnet mask Type the IP address of gateway Type in the primary IP address for the router Type in secondary IP address for necessity in the future Click it to return to previous setting page Click it to get into the next setting page Click it to give up the quick start wizard 34 Dray Tek 3 Please type in the IP address information originally provided by your ISP Then click Next for next step Quick Start Wizard Please confirm your settings WAR Interface WANE Physical Mode Ethernet Physical Type Auto negotiation Internet Access Static IP Click Back to modify changes if necessary Otherwise click Finish to save the current settings and restart the Wigor router 4 Click Finish A page of Quick Start Wizard Setup OK will appear Then the system status of this protocol will be shown Quick Start Wizard Setup OK 5 Now you can enjoy surfing on the Internet Dr ay Tek 35 Vigor2830 Series User s Guide DHCP 1 Choose WAN2 as WAN Interface and click the Next button The following page will be open for you to specify Internet Access Type Quick Start Wizard Connect to Internet WAN 2 Select one of the following Internet Access types provided by your ISP PPPoE PPTP L
154. B 18 192 168 0 1 255 255 255 0 aN Wireless LAN MAC Address Frequency Domain Firmware Version SSID OO SO F 64 FB 14 FOC CANS DrayTek Link Status MAC Address Connection IP Address Default Gateway Disconnected p0 s50 7F 6A FB 19 PPPoE Disconnected 00 S0 7F BA FB 14 Disconnected n0 S0 te oA FBE 1B Address Scape LAM FES8O 250 7FFF FE64 FB18 64 Link Port Profile Reg In Out Phonel No 0 0 Phone Ko EFAN User Mode is GFF now Available settings are explained as follows Dray Tek Item Description Model Name Display the model name of the router Firmware Version Display the firmware version of the router Build Date Time Display the date and time of the current firmware build LAN MAC Address Display the MAC address of the LAN Interface IP Address Display the IP address of the LAN interface Subnet Mask Display the subnet mask address of the LAN interface DHCP Server Display the current status of DHCP server of the LAN interface DNS Display the assigned IP address of the primary DNS 335 Vigor2830 Series User s Guide Wireless LAN MAC Address Display the MAC address of the wireless LAN Frequency Domain It can be Europe 13 usable channels USA 11 usable channels etc The available channels supported by the wireless products in different countries are various Firmware Version It indicates information about equipped WLAN miniPCi card This also helps to provide availability of
155. B Disk Users Connected Index Service IP Address Port Username Note If the write protect switch of USE disk is turned on the USB disk is in READ ONLY mode Mo data can be written to it Available settings are explained as follows Item Description Connection Status If there is no USB storage disk connected to Vigor router No Disk Connected will be shown here Disk Capacity It displays the total capacity of the USB storage disk Free Capacity It displays the free space of the USB storage disk Click Refresh at any time to get new status for free capacity Index It displays the number of the client which connecting to FTP server IP Address It displays the IP address of the user s host which connecting to the FTP server Username It displays the username that user uses to login to the FTP server When you insert USB storage disk into the Vigor router the system will start to find out such device within several seconds Dray Te k 333 Vigor2830 Series User s Guide 3 16 5 Modem Support List Such page provides the information about the brand name and model name of the USB modems which are supported by Vigor router USB Application gt Modem Support List The folowing compatibility tests listed above Vigor router models with USB modems mobiles If it is confirmed as the latest and still does not work please contact support draytek com 3 50 LTE WIMAX AnyDATA ADUSA o o Dink SS o Huawei Huawei E150 ooo
156. C s Isolate the station from LAN Available settings are explained as follows Item Description Enable Mac Address Select to enable the MAC Address filter for wireless LAN Filter identified with SSID 1 to 4 respectively All the clients expressed by MAC addresses listed in the box can be grouped under different wireless LAN For example they can be grouped under SSID 1 and SSID 2 at the same time if you check SSID 1 and SSID 2 MAC Address Filter Display all MAC addresses that are edited before Client s MAC Address Manually enter the MAC address of wireless client Apply SSID After entering the client s MAC address check the box of the SSIDs desired to insert this MAC address into their access control list Attribute s Isolate the station from LAN select to isolate the wireless connection of the wireless client of the MAC address from LAN Add Add a new MAC address into the list Vigor2830 Series User s Guide 302 Dr ay Tek Delete Delete the selected MAC address in the list Edit Edit the selected MAC address in the list Cancel Give up the access control set up OK Click it to save the access control list Clear All Clean all entries in the MAC address list 3 14 5 WPS WPS Wi Fi Protected Setup provides easy procedure to make network connection between wireless station and wireless access point vigor router with the encryption of WPA and WPA2 Wireless Card Installed Connection via WPS EP r EEEE
157. Check that the firmware filename is correct Click Upgrade on the Firmware Upgrade Utility to start the upgrade After the upgrade is compelete the TFTP server will automatically stop running Do you want to upgrade firmware Select a firmware file by clicking Browse 4 Click Upgrade to perform the firmware upgrade Dr ay Tek 415 Vigor2830 Series User s Guide 4 11 Request a certificate from a CA server on Windows CA Server CAServerA CA Server B ED User imports the certificate as local certificate to Vigor Router via Web GUI Se Q User requests a certificate issued by CA Server Aand Saves it 1 Goto Certificate Management and choose Local Certificate Certificate Management gt Local Certificate X509 Local Certificate Configuration Name Subject Status Modify _ GENERATE IMPORT _ REFRESH x509 Local Certificate Vigor2830 Series User s Guide 416 Dray Tek 2 You can click GENERATE button to start to edit a certificate request Enter the information in the certificate request Certificate Management gt gt Local Certificate Generate Certificate Request Subject Alternative Name Type Domain Name Domain Name draytek com Subject Name Country C TW State ST Location L Orginization 0 Draytek Orginization Unit OU Common Name CN Email E press draytek com Key
158. Check the box to link two or more different subnets LAN and LAN After finishing all the settings here please click OK to save the configuration To configure LAN 1 LAN 4 or IP Routed Subnet simply click Details Page to open the settings page Details Page for LAN1 LANI is the default configuration for basic host connection Vigor2830 Series User s Guide 106 Dr ay Tek LAN gt General Setup LAN 1 Ethernet TCP IP and DHCP Setup LAN 11IPv6 Setup DHCP Server Configuration Enable Server Disable Server 132 168 1 1 Enable Relay Agent 255 255 255 0 Start IP Address 192 168 1 10 IP Pool Counts 20 RIP Protocol Control Gateway IP Address 192 168 1 1 Network Configuration For MAT Usage IP Address Subnet Mask Note Disable LAN amp Enable LAN shouldn t be in Lease Time A400 5 the same subnet Retrieve IPs from inactive chents periodically DNS Server IP Address Primary IP Address Secondary IP Address Available settings are explained as follows Dray Tek Item IP Address Subnet Mask RIP Protocol Control DHCP Server Configuration Description Type in private IP address for connecting to a local private network Default 192 168 1 1 Type in an address code that determines the size of the network Default 255 255 255 0 24 Disable deactivate the RIP protocol It will lead to a stoppage of the exchange of routing information between routers Default Enable activat
159. Confirm Password fo Max 23 characters allowed Note Password can contain only a z A Z 0 9 lt gt 7 Q 10 45 Administrator Local User COl Local User Local User List Specific User Enable Admin Login Fram Wan Administrator LDAP Setting Cl Enable LOAP AD login for Admin users Enable Admin Login Fram Wan LDAP Server Profiles LDAP Profile Setup Mote Please select Admin from group select box on login UI Vigor2830 Series User s Guide 338 Dr ay Te k Available settings are explained as follows Item Description Administrator Password Old Password Type in the old password The factory default setting for password is admin New Password Type in new password in this field The length of the password is limited to 23 characters Confirm Password Type in the new password again Administrator Local User The administrator can login web user interface of Vigor router to modify all of the settings to fit the requirements This feature allows other user in LAN who can access into the web user interface with the same privilege of the administrator Local User Check the box to enable the local user configuration Local User List It displays the username of the local user User Name Give a user name for the local user Password Type the password for the local user Confirm Password Type the password again for confirmation Add After typ
160. D AAFF FE83 11B64 64 Global FE80 21D AAFF FE83 11B4 64 Link TA Packets RX Packets TA Bytes 80 1244 IWAN IPv6 Status Enable Mode Up Time 6in4 Static Tunnel 0 04 07 Gateway IP 2001 4DD0 FF10 83E4 2131 64 Global FE80 COA8 651D 128 Link TA Packets RX Packets TX Bytes RX Bytes 3 26 11 2302 Details Page for IPv6 6rd in WAN1 WAN2 This type allows you to setup 6rd for WAN interface WAN gt Internet Access ww WAN 1 PPPoE PPPoA MPoA RFC1483 2684 IPvo Internet Access Mode Connection Type Grd w 6rd Settings 6rd Mode O auto 6rd Static ord Static 6rd Settings IPv4 Border Relay Po IPv4 Mask Length OO Ord Prefix Length OO Available settings are explained as follows Item Description 6rd Mode Auto 6rd Retrieve 6rd prefix automatically from 6rd service provider The IPv4 WAN must be set as DHCP Static 6rd Set 6rd options manually IPv4 Border Relay Type the IPv4 addresses of the 6rd Border Relay for a given 6rd domain Vigor2830 Series User s Guide 96 Dr ay Te k IPv4 Mask Length Type a number of high order bits that are identical across all CE IPv4 addresses within a given 6rd domain It may be any value between 0 and 32 ord Prefix Type the 6rd IPv6 address 6rd Prefix Length Type the IPv6 prefix length for the 6rd IPv6 prefix in number of bits After finished the above settings click OK to save the settings Below shows an example for successful IPv6 connectio
161. Data transmitted through the selected channel will be redirected and transmitted via the channel configured in the field of PVC Binding Add Tag To identify the usage of PVC check this box to invoke this setting And type the number for VLAN ID number Priority To add the packet priority number for such VLAN The range is from 0 to 7 After finishing all the settings here please click OK to save the configuration Vigor2830 Series User s Guide 102 Dr ay Te k 3 2 LAN Local Area Network LAN is a group of subnets regulated and ruled by router The design of network structure is related to what type of public IP addresses coming from your ISP 3 2 1 Basics of LAN The most generic function of Vigor router is NAT It creates a private subnet of your own As mentioned previously the router will talk to other public hosts on the Internet by using public IP address and talking to local hosts by using its private IP address What NAT does is to translate the packets from public IP address to private IP address to forward the right packets to the right host and vice versa Besides Vigor router has a built in DHCP server that assigns private IP address to each local host See the following diagram for a briefly understanding Internet DHCP Server Public IP Address Private Subnet Router IP Addre In some special case you may have a public IP subnet from your ISP such as 220 135 240 0 24 This means that you can set up a
162. Dr ay Tek 185 Vigor2830 Series User s Guide 2 The configuration page will be shown as follows Objects Setting gt gt Keyword Group Setup Profile Index 1 Available Keyword Objects Selected Keyword Objects Max 16 Objects Available settings are explained as follows Item Description Name Type a name for this group Available Keyword You can gather keyword objects from Keyword Object Objects page within one keyword group All the available Keyword objects that you have created will be shown in this box Selected Keyword Objects Click button to add the selected Keyword objects in this box 3 After finishing all the settings here please click OK to save the configuration Objects Setting gt gt Keyword Group Keyword Group Table Setto Factory Default Index Name Index Name 1 night 1 2 18 3 13 4 20 De 21 6 22 Vigor2830 Series User s Guide 186 Dr ay Te k 3 7 9 File Extension Object This page allows you to set eight profiles which will be applied in CSM gt gt URL Content Filter All the files with the extension names specified in these profiles will be processed according to the chosen action Objects Setting gt File Extension Object File Extension Object Profiles Setto Factory Default Profile Name Profile Name 1 J 2 6 J i 4 8 Each item is explained as follows Item Description Set to Factory Default Clear all of the settings and return to factory defau
163. FTP Server ETP Port Default HTTP Server TRO69 Port oUbY Default HTTPS Server Telnet Server 29h Port Default TROGY Server SSH Server Disable PING from the Internet External Device Control V No respond to External Device LAN Access Control Allow management from LAN FIP Server HTTP Server HTTPS Server Telnet Server SSH Server Apply To Subnet MM Lan Meana MI LAN4 MIIP Routed Subnet Access List from the Internet List Subnet Mask Note Subnet LANI is always alowed to access all the router services regardless of LAN Access Control settings Available settings are explained as follows Item Description Router Name Type in the router name provided by ISP Default Disable The web user interface will not log out if it is enabled Auto Logout Internet Access Control Allow management from the Internet Enable the Dr ay Tek 351 Vigor2830 Series User s Guide LAN Access Control Access List from the Internet Management Port Setup External Device Control For IPv6 System Maintenance gt gt Management IPvd Management Setup Management Access Control checkbox to allow system administrators to login from the Internet There are several servers provided by the system to allow you managing the router from Internet Check the box es to specify Disable PING from the Internet Check the checkbox to reject all PING packets from the Internet For security issue this function is enabled by default
164. FTP servers E mail servers etc Most of the case you need a public IP address for each server and this public IP address domain name are recognized by all users Since the server is actually located inside the LAN the network well protected by NAT of the router and identified by its private IP address port the goal of Port Redirection function is to Dray Te k 131 Vigor2830 Series User s Guide forward all access request with public IP address from external users to the mapping private IP address port of the server internet Destined to 220 135 240 207 Port 213 The port redirection can only apply to incoming traffic To use this function please go to NAT page and choose Port Redirection web page The Port Redirection Table provides 20 port mapping entries for the internal hosts NAT gt Port Redirection Port Redirection Setto Factory Default WAN Interface All All All All All All All All All All lt lt 1 10 11 20 gt gt Next gt gt Index Service Name Protocol Public Port Private IP EA Ea eae Ea x Es 1 2 a 4 6 T a 3 10 Note The configured ports in the Management and SSL VPN weblUls willbe used by the router and not be sent to the local computer defined here Each item is explained as follows Item Description Index Display the number of the profile Service Name Display the description of the specific network service WAN Interface Display the WAN IP address used by
165. Factory Default Group Name Group Name OIP vi a m E Vigor2830 Series User s Guide 182 Dr ay Te k 3 7 7 Keyword Object You can set 200 keyword object profiles for choosing as black white list in CSM gt gt URL Web Content Filter Profile Objects Setting gt Keyword Object Keyword Object Profiles Set to Factory Default Index Name Index Name 1 17 2 18 2 13 4 20 J 1 6 22 i 23 8 24 3 23 10 26 12 28 13 23 16 32 lt lt 1 32 33 64 65 96 97 128 129 160 161 192 193 200 gt gt Next gt gt Available settings are explained as follows Item Description Set to Factory Default Clear all profiles Index Display the profile number that you can configure Name Display the name of the object profile To set a new profile please do the steps listed below 1 Click the number e g 1 under Index column for configuration in details Objects Setting gt gt Keyword Object Keyword Object Profiles Index Name i i i i i Dr ay Tek 183 Vigor2830 Series User s Guide 2 The configuration page will be shown as follows Objects Setting gt gt Keyword Object Setup Profile Index 1 Limit of Contents Max 3 Words and 63 Characters Each word should be separated by a single space You can replace a character with HEX Example Contents backdoo 7 virus keep s200ut Result 1 backdoor 2 virus 3 keep out Cancel Available settings are exp
166. II characters such as 12345 or 10 hexadecimal digitals leading by Ox such as 0x4142434445 128 Bit For 128 bits WEP key either 13 ASCII characters such as ABCDEFGHIJKLM or 26 hexadecimal digits leading by Ox such as 0x4142434445464748494A4B4C4D b4 Bit All wireless devices must support the same WEP encryption bit size and have the same key Four keys can be entered here but only one key can be selected at a time The keys can be entered in ASCII or Hexadecimal Check the key you wish to use Encryption Mode After finishing all the settings here please click OK to save the configuration Dr ay Te k 301 Vigor2830 Series User s Guide 3 14 4 Access Control In the Access Control the router may restrict wireless access to certain wireless clients only by locking their MAC address into a black or white list The user may block wireless clients by inserting their MAC addresses into a black list or only let them be able to connect by inserting their MAC addresses into a white list In the Access Control web page users may configure the white black list modes used by each SSID and the MAC addresses applied to their lists Wireless LAN gt Access Control Access Control Enable Mac Address Filter Fl SSID i J SSID 2 C ssip 3 C SSID 4 MAC Address Filter Index Attribute MAC Address Apply SSID Client s MAC Address z Apoly SSID O ssin1 O sstip2 O ssing O SSID 4 Attribute
167. IP phone setting Secure Phone ZRTP SRTP It allows users to have encrypted RTP stream with the peer side using the same protocol ZRTP SRTP Check this box to have secure call Note If the incoming or outgoing calls do not match any entry on the phonebook the router will try to make the call being protected But if the call ends up unprotected e g peer side does not support ZRTP SRTP the router will not play out a warning message Dr ay Te k 277 Vigor2830 Series User s Guide Digit Map For the convenience of user this page allows users to edit prefix number for the SIP account with adding number stripping number or replacing number It is used to help user having a quick and easy way to dial out through VoIP interface VoIP gt gt DialPlan Setup Digit Map Setup Enable 1 z 5 4 G 18 19 20 Note E O d Oo m hatch Prefix Mode OP Number Min Len M Route Move love Len Up Down st joe PsN UP Down UP Down UP Down C ue 1 The length for Min Len and Max Len fields should be between O25 2 Wildcard is supported Available settings are explained as follows Item Enable Match Prefix Mode Vigor2830 Series User s Guide Description Check this box to invoke this setting It is used to match with the number you dialed and can be modified with the OP Number by the mode add strip or replace None No action
168. IPv6 All the available IPv6 objects with the specified interface Objects chosen above will be shown in this box Selected IPv6 Objects Click gt gt button to add the selected IPv6 objects in this box 3 After finishing all the settings here please click OK to save the configuration Objects Setting gt gt IP Group IPv6 Group Table Setto Factory Default Index Mame Index Name LL v _groupi ir 2 18 ae 13 Vigor2830 Series User s Guide 178 Dr ay Tek 3 7 5 Service Type Object You can set up to 96 sets of Service Type Objects with different conditions Objects Setting gt gt Service Type Object Service Type Object Profiles Setto Factory Default Index Name Index Name kad iad DS CD Ml e a ee nn ee i ie a ee FeEEBREBYrEPrePrPFreERe e A n dy Pat fatal tad tn das E io g Vv Mr a ob wr Vv Available settings are explained as follows Item Description Set to Factory Default Clear all profiles Index Display the profile number that you can configure Name Display the name of the object profile To set a new profile please do the steps listed below 1 Click the number e g 1 under Index column for configuration in details Objects Setting gt gt Service Type Object Service Type Object Profiles Index Name m Te 2 The configuration page will be shown as follows Dr ay Tek 179 Vigor2830 Series User s Guide Objects Setting
169. Idle Timeout Scaling Virtual Network Computing YMC s Please Select Virtual Network Computing MNC Remote Desktop Protocol ROP Samba Application oC second s Available settings are explained as follows Item Enable Application Server Application Name Application Description Check the box to enable such profile Type a name for such application The length of the name is limited to 23 characters There are three types offered for you to create an application profile Please Select Please Select Virtual Network Computing VNC Remote Desktop Protocol RDP _Samba Application i Virtual Network Computing VNC It allows you to access and control a remote PC through VNC protocol Remote Desktop Protocol RDP It allows you to access and control a remote PC through RDP protocol Samba Application It allows you to access and control a 319 Vigor2830 Series User s Guide remote PC through Samba service IP Address If you choose VNC or RDP you have to type the IP address for this protocol Port If you choose VNC or RDP you have to specify the port used for this protocol The default setting is 5900 Idle Timeout If you choose VNC you have to specify the time for disconnecting the SSL VPN tunnel Scaling If you choose VNC you have to choose the percentage 100 80 60 for such application Screen Size If you choose RDP you have to choose
170. K The router will take 5 seconds to reboot the system Note When the system pops up Reboot System web page after you configure web settings please click OK to reboot your router for ensuring normal operation and preventing unexpected errors of the router in the future Dray Te k 353 Vigor2830 Series User s Guide 3 17 12 Firmware Upgrade Before upgrading your router firmware you need to install the Router Tools The Firmware Upgrade Utility is included in the tools The following web page will guide you to upgrade firmware by using an example Note that this example is running over Windows OS Operating System Download the newest firmware from DrayTek s web site or FTP site The DrayTek web site is www DrayTek com or local DrayTek s web site and FTP site is ftp DrayTek com Click System Maintenance gt gt Firmware Upgrade to launch the Firmware Upgrade Utility System Maintenance gt gt Firmware Upgrade Web Firmware Upgrade Select a firmware file Click Upgrade to upload the file TFTP Firmware Upgrade from LAN Current Firmware Yersion 3 6 7 db Firmware Upgrade Procedures o Click OK to start the TFTP server Open the Firmware Upgrade Utility or other 3 party TFTP client software Check that the firmware filename is correct o Click Upgrade on the Firmware Upgrade Utility to start the upgrade After the upgrade is compelete the TFTP server will automatically stop running Do you want
171. Local Certificate Configuration Name Subject Status Modify Local f C TWyO Draytek emailaddress Mot Valid Yet GENERATE IMPORT REFRESH X509 Local Certificate Request HITBQICCARNC ADaAWOTELMARGALIUEBRNCYFcREDAORGNVYEBAOTBORYYZ1LOZWsx ID de Bq kqnkiGSwOBCQEWESZRyzsN2OGRyYAZloeWsure StNIGLMAOGCS gc InsDOEBAOus L4AGNADCBIQERGoDPioahu gFOavRiceSoOERSD iknIdhbloiktecTALUDaFk s6d SubeQytoViLbBJ 22 IDFOx ez b6iptrevleitwwTsg41lgZ 6ok cGhuV TEd946PlernkP7 Au 4c2 3c UBAND4swsoce vrs yDIShHLAIdeVYPUpNRVYIroTa Re J RERMAHEVpYpwiDagab oCkudJwYJEoe LhvcNAgkONRowsDAWwEBGQnVHREEDs NgqqtkemF Sd6Vr Lnlvh TAN bgQkg hkiGSwOBAguF ALOBGQAUuSBRUGt4ALhHoN6 AwloemltAgbhew Evo t EF l TJinh URLQ4CiEi 6nvV4hihytex2pEf starSgRRErs 6RooeIeol45560xce NLGhoVOorl TSF qkiJNihip4sTcjecshN 2 jw Q0SVU bcesTGt Scbe yeqquy Eo kIgFa bTGviw 6 You may review the detail information of the certificate by clicking View button Name Local Issuer MUSIC h vigor Subject ferailAddress press idraytek comc Tid Draytek a pene ONS draytek com valid From Aug 30 23 08 43 2005 GMT Valid To Aug 30 23 17 47 2007 GMT Dr ay Te k 419 Vigor2830 Series User s Guide 4 12 Request a CA Certificate and Set as Trusted on Windows CA Server CAServerA CA Server B ka 2 User imports the certificate as local certificate to Vigor Router via Web GUI 1 User requests a certificate issued by CA Server A and Saves it Use web browser
172. Login Time 2011 08 24 09 39 13 Last Login From 123 110 144 220 O My Information Current Login Time 2011 08 24 23 01 15 Current Login From 114 37 142 164 X VigorAcs SI ae RowNo J5 w PageNo Vigor Series Your Device List Management Seater oes none moses T une B Registration 104001703857 Vigor 710 Vigor2710 Customer Survey 200807100001 YigorPro5300 VigorProS300 200911030001 ryan YigorPro5300 Vigor2830 Series User s Guide 60 Dr ay Te k 5 When the following page appears please type in Nickname for the router and choose the right registration date from the popup calendar it appears when you click on the box of Registration Date After adding the basic information for the router please click Submit DrayTek Pine Search co D About Us My Product Search for this site so Product al My Information cael DEVAT D VigorAcs SI Serial number 201108221 4320301 T Vigor Series Nickname Management Registration Date 08 24 2011 Product Usage Seled Registration Product Rating Select Your opinion so far No of Employees Select In total within your company Supplier f Where you bought it from Date of Purchase mmdd yyyy Internet Connection d Customer Su rey CO Cable O ADSL O VOSL C Fiber O 36 O WIMAX O LTE 6 When the following page appears your router information has been added to the database Y
173. MS Vista Utility VigorPro Alert Notice 2009 06 03 1 1 0 MS Windows XP VigorPro 100 series Utility Introduction Tools Multi MS Vista VigorPro 5500 series language VigorPro 5510 series Datasheet R amp TTE Certification Smart VPN Client 2009 05 25 3 6 3 MS Windows XP All Modules Multi MS Vista language Smart Monitor 2009 03 25 2 0 MS Windows XP Vigor2950 series 4 Click on the link of Router Tools to download the file After downloading the files please decompressed the file onto your host Dray Tek 413 Vigor2830 Series User s Guide 5 Double click on the icon of router tool The setup wizard will appear ie Setup DrayTek Router Tools 4 2 0 Welcome to the DrayTek Router Tools 4 2 0 Setup Wizard This will install DrayTek Router Tools 4 2 0 on your computer It is recommended that you close all other applications before continuing Click Next to continue or Cancel to exit Setup Jf RTsva20 lng DrayTek Router Tools 4 2 0 Setop LY DrayTek corp N gt 6 Follow the onscreen instructions to install the tool Finally click Finish to end the installation 7 From the Start menu open Programs and choose Router Tools XXX gt gt Firmware Upgrade Utility Firmware Upgrade Utility 3 5 1 Sales Time uk Sec 1 Router IP Bo A Fort Firmware File PG Password 8 Type in your router IP usually 192 168 1 1 9 Click the button to the right side of Firm
174. N and Remote Access gt gt Remote Dial In User The enabled profiles will be listed in the Available User Account on the left box To add a profile into a group simply choose the one from the left box and click the gt gt button It will be displayed in the Selected User Account on the right box For detailed information about configuring the profile setting refer to Objects Setting gt gt IP Group RADIUS The RADIUS server will do the authentication by using the username and password LDAP Active Directory If it is checked the LDAP AD server will do the authentication by using the username password information stated on the selected profiles If the above three options are enabled the system will do the authentication based on them in sequence After finishing all the settings here please click OK to save the configuration Vigor2830 Series User s Guide 326 Dr ay Tek 3 15 6 Online User Status If you have finished the configuration of SSL Web Proxy server users can find out corresponding settings when they access into DrayTek SSL VPN portal interface Dray Tek Provide SSL WFH SS Web Proxy logout INFO Main Page id a i 1 42 You have successfully logged in eon You are given the follawing privileges Welcome to DrayTek SSL VPN SSL Web Proxy SSL Tunnel Timeout ater 5 minutes Reset Copyright 2006 DrayTek Corp All Rights Reserved Next users can open SSL VPN gt gt Onl
175. N connection More Add a static route to direct all traffic destined to more Remote Network IP Addresses Remote Network Mask through the VPN connection This is usually used when you find there are several subnets behind the remote VPN router Vigor2830 Series User s Guide 260 Dr ay Tek E hitp 192 168 1 1 LAN to LAN Profile Microsoft Internet Explorer E X Profile Index 1 Pemote Network Network IP Netmask 255 255 255 255 32 M RIP Direction The option specifies the direction of RIP Routing Information Protocol packets You can enable disable one of direction here Herein we provide four options TX RX Both TX Only RX Only and Disable From first subnet to remote network you have to do If the remote network only allows you to dial in with single IP please choose NAT otherwise choose Route Change default route to this VPN tunnel Check this box to change the default route with this VPN tunnel Note that this setting is available only for one WAN interface is enabled It is not available when both WAN interfaces are enabled 2 After finishing all the settings here please click OK to save the configuration Dray Te k 261 Vigor2830 Series User s Guide 3 11 7 VPN TRUNK Management VPN trunk includes some features VPN Backup GRE over IPSec and Binding tunnel policy Features of VPN TRUNK VPN Backup Mechanism VPN TRUNK Management is a backup mechanism which can set mul
176. N settings page and choose General Setup There are four subnets provided by the router which allow users to divide groups into different subnets LAN1 LANA In addition different subnets can link for each other by configuring Inter LAN Routing At present LAN setting is fixed with NAT mode only LAN2 LAN4 can be operated under NAT or Route mode IP Routed Subnet can be operated under Route mode LAN gt General Setup General Setup Index LAN 1 LAN 2 LAN 3 LAN 4 IP Routed Subnet Status DHCP IP Address W Y 192 168 1 1 Details Page 192 158 2 1 192 ate at all 192 168 4 1 192 168 0 1 Details Page Advanced You can configure DHCP options here Force router to use DNS server IP address settings specified in LANA w Inter LAN Routing Subnet LAK 1 LAN 2 LAN 3 LAN 4 Note LAN 27374 are available when VLAN is enabled Available settings are explained as follows Item General Setup Advanced Dray Tek Description Allow to configure settings for each subnet respectively Index Display all of the LAN items Status Basically LAN1 status is enabled in default LAN 2 LAN3 LAN3 and IP Routed Subnet can be observed by checking the box of Status DHCP LANI is configured with DHCP in default If required please check the DHCP box for each LAN IP Address Display the IP address for each LAN item Such information is set in default and you can not modify it Detail
177. N1 WAN gt Internet Access Internet Access Index Display Name Physical Mode Access Mode WANI ADSL PPPoE PPPoA Details Page WANZ Ethernet Details Page IPv6 WANS USB Note Only one WAN can support IPv6 Dr ay Tek 371 Vigor2830 Series User s Guide 3 Click the Details Page of WAN to display the following page Check Enable and set Channel 1 as Multi PVC channel set 0 and 88 for VPI and VCI type the username e g pppoeuser and the password WAN gt Internet Access WAN 1 PPPoE PPPoA MPoA RFC1483 2664 Disable SP Access Setup Multi PVC channel Channel 1 w PPP Authentication PAP or CHAP Idle Timeout second s IP Address From ISP _ WAN IP Alias Fixed IP Yes No Dynamic IP Protocol PPPoE waa i oam WPI VCI Encapsulating Type LLC SNAP w Default MAC Address PPPoE Pass through 24 a O Specify a MAC Address a 4 Click OK to save the settings 5 Open WAN gt gt Multi PVCs Click the General tab to check the box of Enable for the 5 WAN WAN gt Multi PVCs Multi PVCs General ATM QoS Port based Bridge PVC to PVC Binding Add Tag Channel Enable VPI WEI Qos Type Frotocol Encapsulation CH 3 ot k 4 wl 4 a 7 IC MU 6 WAN L ho 46 7 ay 7 ww Oo E 8 ot k Note VPI VCI must be unique for each channel K Clear Cancel Note Only 5 WAN to 7 WAN can be used for PVC to PVC Binding Vigor2830
178. N55024 Class B The product conforms to the requirements of Low Voltage LVD Directive 2006 95 EC by complying with the requirements set forth in EN60950 1 This product is designed for the DSL POTS 2 4GHz 5GHz WLAN network throughout the EC region and Switzerland with restrictions in France Please see the user manual for the applicable networks on your product Regulatory Information Federal Communication Commission Interference Statement This equipment has been tested and found to comply with the limits for a Class B digital device pursuant to Part 15 of the FCC Rules These limits are designed to provide reasonable protection against harmful interference in a residential installation This equipment generates uses and can radiate radio frequency energy and if not installed and used in accordance with the instructions may cause harmful interference to radio communications However there is no guarantee that interference will not occur in a particular installation If this equipment does cause harmful interference to radio or television reception which can be determined by turning the equipment off and on the user is encouraged to try to correct the interference by one of the following measures Reorient or relocate the receiving antenna Increase the separation between the equipment and receiver Connect the equipment into an outlet on a circuit different from that to which the receiver is connected Consult the deal
179. O 21 27 o 72 d 23 7 oO 24 Oo 25 o 26 777 oO 27 27 d 28 A 29 27 d 30 d 31 2 oO 32 777 C Available settings are explained as follows Item Set to Factory Default Index User Active Status Vigor2830 Series User s Guide Description Click to clear all indexes Click the number below Index to access into the setting page of Remote Dial in User Display the username for the specific dial in user of the LAN to LAN profile The symbol represents that the profile is empty Check the box to enable the selected profile Display the access state of the specific dial in user The symbol V and X represent the specific dial in user to be active and inactive respectively 28 Dray Tek Click each index to edit one remote user profile Each Dial In Type requires you to fill the different corresponding fields on the right If the fields gray out it means you may leave it untouched The following explanation will guide you to fill all the necessary fields WPH and Remote Access gt gt Remote Dial in User Index No 1 User account and Authentication Username 797 Enable this account Password Max 19 char OOO OY Idle Timeout second s C Enable Mobile One Time Passwords mOTP Allowed Dial In Type PPTP IPsec Tunnel IKE Authentication Method L2TP with IPsec Policy Pre
180. OFF WPS button twice to enable WLAN LED on or disable WLAN LED off wireless connection Factory Reset Restore the default settings Usage Turn on the router ACT LED is blinking Press the hole and keep for more than 5 seconds When you see the ACT LED begins to blink rapidly than usual release the button Then the router will restart with the factory default configuration GigaLAN 1 4 Connecters for local network devices DSL Connecter for accessing the Internet through ADSL2 2 WAN2 Giga Connecters for remote networked devices USB Connecter for a USB device for 3G USB Modem or printer PWR Connecter for a power adapter ON OFF Power Switch Dr ay Tek 5 Vigor2830 Series User s Guide 1 1 3 For Vigor2830Vn Vigor2830Vn plus o Pray Tel ON OFFIWPS act WLAN Line oO USB OSL Phoned Factory Reset CSM WANZ Phone e j f j Wireless LAN ONIOFFIWPS ACT WLAN Line Factory Reset DSL Phonei Phone1 2 Line CSM WAN2 Phone2 Aane Sal Vigor2830Vn plus e a lef Lek Mioi Security Firewall P 2 3 4 GigaLAN 1 Vigor2830Vn ADSL Security Firewall i 4 GigalANe 7 2 m WARN Giga US BSL WAN2 Giga USB ACT Activity Blinking Off USB 5 Blinking CSM Q 5 WLAN Q 5 Blinking DSL Blinking WAN2 Blinking Line S mr Phone 1 2 S h Blinking LED on Connector Left LED Green 5
181. Provider ale Line_down kotsms com tw T Py kotsms cam tw TV 7 keoteme crore Faa ETLI Vigor2830 Series User s Guide 190 Dr ay Tek Customized SMS Service Vigor router offers several SMS service provider to offer the SMS service However if your service provider cannot be found from the service provider list simply use Index 9 and Index 10 to make customized SMS service The profile name for Index 9 and Index 10 are fixed Object Settings gt SMS Mail Service Object SMS Provider Mail Server Setto Factory Default Profile Name SMS Provider kotsms com tw TV kotsms com tw T kotsms com tw TW kotsms com tw TV kotsms com tw TV kotsms com tw T kotsms com tw TV kotsms com tw TW Custom 1 Custom 2 SerPrrertee es You can click the number e g 9 under Index column for configuration in details Object Settings gt gt SMS Mail Service Object Profile Index 9 Profile Name Please contact with your SMS provide to get the exact URL String eg bulksms vsms net 5567 eapli submission send_sms 2 2 0fusemame F atetlsertaee Boassword txtPwdet ee emsisdn e a tetDest e et amessagqe etxthMsgeee Quota Sending Interval seconds Available settings are explained as follows Item Description Profile Name Display the name of this profile It cannot be modified Service Provider Type the website of the service provider Type the URL string in the box under the filed of Service Provider Yo
182. Routed Subnet 192 168 0 1 Details Page Advanced You can configure DHCP server options here Force router to use DNS server IP address settings specified in L Inter LAN Routing Subnet LAM 1 LAN 2 LAN 3 LAN 4 Note LAN 27 374 are available when YLAN is enabled Vigor router supports up to six private IP subnets on LAN Each can be independent isolated or common able to communicate with each other This is ideal for departmental or multi occupancy applications Note As for the VLAN applications refer to Appendix I VLAN Application on Vigor Router for more detailed information Vigor2830 Series User s Guide 120 Dr ay Te k 3 2 5 Bind IP to MAC This function is used to bind the IP and MAC address in LAN to have a strengthening control in network When this function is enabled all the assigned IP and MAC address binding together cannot be changed If you modified the binding IP or MAC address it might cause you not access into the Internet Click LAN and click Bind IP to MAC to open the setup page LAN gt Bind IP to MAC Bind IP to MAC Enable Disable Strict Bind ARP Table Select All Sort Refresh IP Bind List Select All Sort IF Address Mac Address Index IP Address Mac Address 192 168 1 10 EQ CB 4E Da 46 79 Add or Update IP Address Show Comment Note IP MAC binding presets DHCP Allocations If you select Strict Bind unspecified LAN clients cannot access the Inte
183. S e estore axe eae aaiaintalee secu EEE E eraaunersterne aed 98 ZEAN ese esis E E E E lew gets oe oe atte E A E E 103 oe VEAIS O EAN era E E EE 103 ee TAIN Ms oS i e PPE E E A EE EE N E E E A A E A E E 105 Seo ia E ROU a S A N ene ee E E 114 Dr ay Tek vii Vigor2830 Series User s Guide 3 2 4 VLAN Multi Subnet 00 0 eee cece e eee e rere eee eases aaa aaaaaa nese eeeeeeeeeeseeeaaaaaaaaaaneeeeeeeees 118 eZ 5 Bind IP TO MAG cn dineseoteege eseusaeasaadenncgseceenasaioevetontgaaeseeenencioe niceangneieevabonisannsdernendoenscamanmieed 121 3 2 6 LAN PO MIMO ct sacareesce ieee aciectecrae tribaswres iaaa e iaa eae senate a iea iaa aaiae 122 227 Mired B02 E erenn EE a AEA EE A E Er E 123 3 28 WED Ponal SeU passeeren i eiie EE rei 124 3 3 Load Balance Route PoOliCy cccccccssseceecesssseeecceeeseeecceeauseeeeseuseeeecsseuseeeeessaseeeesssaseess 126 ANA Tarne E E E E E 131 SAT Porn Frc CIN COM esns a E 131 aA DUZ FOS a E 134 AS OPN FON a E ene EEE 138 Ore Porn NOG SING reenen EO 140 FFON e E E AE A AEA 143 3 5 1 Basics for FIPGW All cvccncussxsyeweasascasncrvaumsavadannensisaamnalaenetesltiuneinaaneinnwsid one ridenameniiaamenelaas 143 35 2 General SEUD eerren N ENa oran EENE OEE Eein 145 TaS Filter SeU sects scarvprtcvten Perdonesrcecerterswetraateecton aule ap niseeeawcenetepoesemsmenmcusasesmanternees asnasoesdariocedeoece 150 39A DOS DEENSE ernea EE E E EE OEE 158 3 6 User Manageme nt cccsccccccccsssececcceeseecece
184. Series User s Guide 372 Dr ay Te k 6 Click the link of the 5 WAN to configure the settings Choose IPTV as the WAN for Router borne Application check Enable In the DSL Modem Setup choose MPoA as the Protocol and select 1483 Bridged IP LLC as Encapsulation WAN gt Multi PVCs gt gt PVC Channel 5 WAN for Router borne Application f IPTV b Enable Of Disable DSL Modem Settings jf acs type Uen pvc me 1 F Encapsulation 1483 Bridged IP LLC J Add Tag VPI VCI WAN Connection Detection Mode ARP Detect TTL PPPoE PPPoA Client MPoA RFC1463 2664 ISP Access Setup Obtain an IP address automatically TOD Wama In this case we want to redirect PVC channel 5 to PVC channel 1 we have to choose 1 as PVC Binding Check the box of Add Tag and type 405 as the tag number 7 Click OK to save the settings 8 The PVC Binding and the Tag setting can also be seen in WAN gt gt Multi PVCs gt gt PVC to PVC Binding Add Tag page WAN gt Multi PVCs Multi PVCs General ATM QoS Port based Bridge PWC to PVC Binding Add Tag Channel PYC Binding Add Tag 1 jisable go 3 noe Disable Disable E s ob Note Multiple channels may use the same channel link through the PVC Binding configuration PWC to PVC Binding only supports PPPoE and MPoA 1483 Bridge mode Note Channel 1 and Channel 2 are reserved for WAN1 service UU Os Dray Te k 373 Vigor2830 Series User s Guide 9 Clic
185. Setup Index No 1 Enable Destination IP Address 192 165 10 0 Subnet Mask 255 255 255 0 Gateway IP Address 192 165 1 2 Network Interface Note WANS WANG WARN are router borne WANS 3 Return to Static Route Setup page Click on another Index Number to add another static route as show below which regulates all packets destined to 211 100 88 0 will be forwarded to 192 168 1 3 LAN gt Static Route Setup Index No Enable Destination IP Address 211 100 58 0 Subnet Mask 255 255 255 0 Gateway IF Address 192 165 1 3 Network Interface LAMI Note WANS WANG WAN are router borne WAMS 4 Go to Diagnostics and choose Routing Table to verify current routing table Diagnostics gt gt View Routing Table Current Running Routing Table IPv6 Routing Table Refresh Key C connected S static R RIP default private A 0 0 0 0 0 0 0 0 Via 172 16 1 1 WAan2 S 192 168 10 07 255 255 255 0 wia 192 168 1 2 LAN1 C 192 168 1 0 255 255 255 0 directly connected LAN1 C 172 16 0 07 255 255 0 0 directly connected WANZ 5 211 100 88 07 255 255 255 0 wia 192 168 1 3 LAN1 Note WANS WANG WAN are router borne WANs Dr ay Tek 117 Vigor2830 Series User s Guide 3 2 4 VLAN Multi Subnet Virtual LAN function provides you a very convenient way to manage hosts by grouping them based on the physical port Go to LAN page and select VLAN The following page will appear Click En
186. The larger of the number the louder the volume is Dial Tone Power Level This setting is used to adjust the loudness of the dial tone The smaller the number is the louder the dial tone is It is recommended for you to use the default setting Ring Frequency This setting is used to drive the frequency of the ring tone It is recommended for you to use the default setting Call Waiting Tone Power Level This setting is used to adjust the loudness of the call waiting tone The smaller the number is the louder the tone is It is recommended for you to use the default setting DTMF Mode There are four DTMF modes for you to choose DTMF mode InEand InEBand QutBand RF C2033 SIP INFO cisco format SIP IMFO nortel format 20 Dray Tek InBand Choose this one then the Vigor will send the DTMF tone as audio directly when you press the keypad on the phone OutBand Choose this one then the Vigor will capture the keypad number you pressed and transform it to digital form then send to the other side the receiver will generate the tone according to the digital form it receive This function is very useful when the network traffic congestion occurs and it still can remain the accuracy of DTMF tone SIP INFO Choose this one then the Vigor will capture the DTMF tone and transfer it into SIP form Then it will be sent to the remote end with SIP message Payload Type rfc2833 Type a number from 96 to 127 the de
187. UE Group Distinguished Name SS and Applications gt gt Active Directory LDAP gt gt Server Profiles Index No 2 Common Name Identifier uig Base Distinguished Name ou people dc ms dcHdraytek de co Additional Filter cn shrd ou group dc ms dc draytek Note Please type in your additional filter for BaseDN search request For example 1 For OpenLDAP gidNumber 5003 21 For AD msNPAllowDialin TRUE Group Distinguished Name SS 4 Click OK to save the settings above 5 Open User Management gt gt General Setup Select User Based as the Mode option User Management gt General Setup General Setup Mode Web Authentication HTTFS Notice User Management will refer to active rules in Data Filter as whitelists and blacklists In User based firewall mode Users match the above lists will not be required for authentication The firewall rules policy will still valid Otherwise authentication required for users not matched the above lists The firewall rules designated in the user profile s policy will still valid Landing Page Max 255 characters Preview Setto Factory Default hody stats l gt lt script langquage Javagscript gt window location http fun draytek com lt 3scripte lt r body gt Vigor2830 Series User s Guide 434 Dr ay Te k 6 Then open VPN and Remote Access gt gt PPP General Setup to check the profile s that will be authenticated with LDAP server Choo
188. User Management Profile Index 1 FTP Samba User OeEnable Disable Username Password tain 11 Characters Confirm Password fs Home Folder Po 4 Access Rule File JRead write Delete Directory Cist create Remove Note The folder name can only contain the following characters A 2 a z 0 9 _ 1 7 and space Available settings are explained as follows Item Description FTP Samba User Enable Click this button to activate this profile account for FTP service or Samba User service Later the user can use the username specified in this page to login into FTP server Disable Click this button to disable such profile Username Type the username for FTP Samba users for accessing into FTP server USB storage disk Be aware that users cannot access into USB storage disk in anonymity Later you can open FTP client software and type the username specified here for accessing into USB storage disk Note Admin could not be typed here as username for the word is specified for accessing into web pages of Vigor router only Also it is reserved for FTP firmware upgrade usage Note FTP Passive mode is not supported by Vigor Router Please disable the mode on the FTP client Password Type the password for FTP Samba users for accessing FTP server Later you can open FTP client software and type the password specified here for accessing into USB storage disk Confirm Password Type the password again
189. WAN IP Network Settings WAN IP Alias aaa Obtain an IP address al oe Ica Multi P C channel n ra E Encapsulation ee e a liaa AEA E AE e enb aeni Ea aane EF YPI O Enable VICI Username f Modulation Password S Specify an IP address WAN Connection Detection IP Address ale Subnet Mask Ping IP Gateway IP Address TTL it caine is Default MAC Address Enable RIP O Specify a MAC Address MAC Address ho IAA tas 42 59 Bridge Mode Enable Bridge Mode DNS Server IP Address Click the WAN IP Alias button to configure the other P address which is 202 2 1 100 11 Make sure Join IP NAT Pool is not checked Click OK to save the settings pae ET 3 WANRILIP Alias Google Chrome O X 192 168 1 L doc wipalias htm Q WAN1 IP Alias Multi NAT Index Enable Aux WAN IP Join NAT IP Pool L 202 211 100 11 Dr ay Tek 437 Vigor2830 Series User s Guide 4 After finished configuration for WAN1 open Load Balance Route Policy Load Balance Route Policy a Load Balance Route Policy Set to Factory Default Dest Dest Port Port Start End Interface Src IP Address Start Move Move Index Enable Protocol Interface IP End Up Down End Start Any WANI Down Any WANI Any WANI Any WANI Any WLAN 1 Any WANI Any WAN I Any WANI Any WANI LJ Any WANI lt lt 1 10 11 20 21 30 31 40 41 50 gt gt Next gt gt Seo e N ioe tem e eo I de Wizard Mode most frequently us
190. WAN Log le Dos Artick E Router DSL information E MePZ Vigor2830 Series User s Guide 160 Dr ay Tek ID DrayTek Syrop 4 4 0 i EE M AEEA 3 g 172 16 3 130 a WAH Tiformatioy till leal lvelela Pes ie Log Far LAN Inforreatean Hirai j ki Ti Packets R Pechets HAN IP Galeway F T Babe Bit Babe An bro o r i IMG Apphy bus al al ate Preval Log Defense log CHilog SFNl g Ues d cesslog Conneition log W h Llog IFPI L g Others Ca ietsledmecord Phoe calltop 4 F E Feii weber Time Bouter Tine Poet Message After finishing all the settings here please click OK to save the configuration 3 6 User Management User Management is a security feature which disallows any IP traffic except DHCP related packets from a particular host until that host has correctly supplied a valid username and password Instead of managing with IP address MAC address User Management function manages hosts with user account Network administrator can give different firewall policies or rules for different hosts with different User Management accounts This is more flexible and convenient for network management Not only offering the basic checking for Internet access User Management also provides additional firewall rules e g CSM checking for protecting hosts lt B Lisa s notebook WLAN_User_Group_A Password wugi23 PC gt Tom s PC a lt lt bh David s notebook oe A LAN WLAN User Group
191. WAN3 Settings This webpage allows you to set general setup for WAN1 WAN2 and WANS respectively WAN gt General Setup Load Balance Mode Auto Weight Physical Line Speed Kbps hode Type DownLink UpLink eee MONE Enable i ADSL ale Jo Always On ii Ethernet Auto negotiation 070 Always On i USERS 070 Always On Note Line Speed only used for load balance mode according to Line Speed Available settings are explained as follows Item Description Load Balance Mode This option is available for multiple WAN for getting enough bandwidth for each WAN port If you know the practical bandwidth for your WAN interface please choose the setting of According to Line Speed Otherwise please choose Auto Weigh to let the router reach the best load balance Load Balance Mode Auto Weight hd Auto Weight According to Line Speed Index Click the WAN interface link under Index to access into the WAN configuration page Enable V means such WAN interface is enabled and ready to be used Dr ay Tek 65 Vigor2830 Series User s Guide Physical Mode Type Line Speed Active Mode Display the physical mode and physical type of such WAN interface Display the downstream and upstream rate of such WAN interface Display whether such WAN interface is Active device or backup device Note In default each WAN port is enabled WAN1 with ADSL WANT is fixed with physical mode of ADSL WAN gt General Setup WAN
192. WANS No See ea e z o m m E WANG Ho Miulti LAN Chanrvel 3 Enable Disable LWANT No WAN Type Ethemet WANT 8 No General Settings VLAN Header Note 1 Tag value must be set between 1 4095 and unique for each channel 2 0Only one channel can be untagged equal to 0 at a time Bridge mode Note 3 P1 is reserved for NAT use and cannot be configured for bridge mode Set top box STB or the other kinds of media devices are able to attach with Port4 or Port5 of LAN Those devices that attached with Port4 or Port5 are able to access the services network directly which your ISP provided Vigor2830 Series User s Guide 458 Dr ay Te k Appendix Il Release Note Firmware Version 3 6 7 New Features None Improvement Dray Tek Improved Support Huawei E303D Vodafone K4201 SpinCom GPRS Modem Improved Support NS ANY SOA type for DNS cache Improved IPv6 firewall allows incoming packets transferred to certain ports If the firmware of the router is upgraded from 3 6 6 or before to 3 6 7 firmware all and rst will have different effects for the incoming packets 1 all gt keep routing settings in 3 6 6 or before both IPv4 and IPv6 2 rst gt block routing packets from WAN in default both IPv4 and IPv6 Improved Add some TR 069 parameters for setting WAN gt gt WAN mode Backup or Always On LAN gt gt DHCP relay enable disable DHCP relay IP address and Device hostname LAN gt gt Bind IP to
193. Windows Vista LAN 4 How do configure LPR printing on Linux boxes 5 How do I configure LPR printing on Windows2000 XP Note 2 Vigor router supports printing request from computers via LAN ports but not WAN port 1 4 Accessing Web Page 1 Make sure your PC connects to the router correctly You may either simply set up your computer to get IP dynamically from the router or set up the IP address of the computer to be the same subnet as the default IP address of Vigor router 192 168 1 1 For the detailed information please refer to the later section Trouble Shooting of the guide 2 Open a web browser on your PC and type http 192 168 1 1 The following window will be open to ask for username and password Username Password Copyright DrayTek Corp All Rights Reserved Dray Tek 3 Please type admin admin as the Username Password and click Login 9 Notice If you fail to access to the web configuration please go to Trouble Shooting for detecting and solving your problem Vigor2830 Series User s Guide 16 Dr ay Te k 4 1 5 Changing Password Now the Main Screen will appear Vigor2 830 Series ADSL2 Security Firewall Wizards Online Status WAN LAN Load Balance Route Policy NAT Firewall User Management Objects Setting CSM Bandwidth Management Applications VPN and Remote Access Certificate Management VolP Wireless LAN SSL VPN USB Application Sy
194. a C java C olb C cab C1 inf C jpg2 O tif LI mpg Cl 3gpp2 C m4p CI jcm Cl ole O gz Cl pif L jp2 C tiff L mp4 M 3g2 L ogg E js C tlb C gzip L reg 3 Type a name for such profile and check all the items of file extension that will be processed in the router 4 After finishing all the settings here please click OK to save the configuration Objects Setting gt gt File Extension Object File Extension Object Profiles Profile Vigor2830 Series User s Guide Name game 188 Profile Name Setto Factory Default Dray Tek 3 7 10 SMS Mail Service Object SMS Service Object This page allows you to set ten profiles which will be applied in Application gt gt SMS Mail Alert Service Object Settings gt gt SMS Mail Service Object SMS Provider Mail Server Setto Factory Default Profile Name SMS Provider kotsms com tw TY kotsms com tw TW kotsms com tw TW kotsms com tw TY kotsms com tw TW kotsms com tw TY kotsms com tw TY kotsms com tw TW Custom 1 SFrPRPrPrPErP ee Custom 2 Each item is explained as follows Item Description Set to Factory Default Clear all of the settings and return to factory default settings Index Display the profile number that you can configure Profile Display the name for such SMS profile SMS Provider Display the service provider which offers SMS service
195. a local private network Default 192 168 1 1 ho Dray Tek Dray Tek DHCP Server Configuration DNS Server Configuration Subnet Mask Type in an address code that determines the size of the network Default 255 255 255 0 24 DHCP stands for Dynamic Host Configuration Protocol The router by factory default acts a DHCP server for your network so it automatically dispatch related IP settings to any local user configured as a DHCP client It is highly recommended that you leave the router enabled as a DHCP server if you do not have a DHCP server for your network If you want to use another DHCP server in the network other than the Vigor Router s you can let Relay Agent help you to redirect the DHCP request to the specified location Enable Server Let the router assign IP address to every host in the LAN Disable Server Let you manually assign IP address to every host in the LAN Start IP Address Enter a value of the IP address pool for the DHCP server to start with when issuing IP addresses If the Ist IP address of your router is 192 168 1 1 the starting IP address must be 192 168 1 2 or greater but smaller than 192 168 1 254 IP Pool Counts Enter the maximum number of PCs that you want the DHCP server to assign IP addresses to The default is 50 and the maximum is 253 Gateway IP Address Enter a value of the gateway IP address for the DHCP server The value is usually as same as the 1st IP address
196. able Dynamic DNS Setup and push Clear All button to disable the function and clear all accounts from the router Delete a Dynamic DNS Account In the DDNS setup menu click the Index number you want to delete and then push Clear All button to delete the account Dr ay Te k 225 Vigor2830 Series User s Guide 3 10 2 LAN DNS The LAN DNS lets the network administrators host servers with privacy and security When the network administrators of your office set up FTP Mail or Web server inside LAN you can specify specific private IP address es to correspondent servers Thus even the remote PC is adopting public DNS as the DNS server the LAN DNS resolution on Vigor2830 series will respond the specified private IP address 140 186 223 x A private IP address mapped to the Domain Name i PET T server yourdomain com 210 139 175 223 i M Public DNS Server 192 168 1 x 4 Private IP sit Gia A i server yourdomain com Public IP 210 139 175 223 iii Wal Open Application gt gt LAN DNS to get the following page Applications gt LAN DNS LAN DNS Resolution Setto Factory Default Enable Index Profile Domain Name F i Fi 2 d 3 Fi 4 al 5 Fi 6 F i F 8 F 9 Fi 10 Available settings are explained as follows Item Description Set to Factory Default Clear all profiles and recover to factory settings Enable Check the box to enable such profile Vigor2830 Series User s Guide 226 D
197. able settings are explained as follows Item Description Profile Name List the backup profile name ERD Mode ERD means Environment Recovers Detection Normal choose this mode to make all dial out VPN TRUNK backup profiles being activated alternatively Resume when VPN connection breaks down or disconnects Member 1 will be the top priority for the system to do VPN connection Detail Information This field will display detailed information for Environment Recovers Detection Vigor2830 Series User s Guide 266 Dr ay Te k 3 11 8 Connection Management You can find the summary table of all VPN connections You may disconnect any VPN connection by clicking Drop button You may also aggressively Dial out by using Dial out Tool and clicking Dial button VPN and Remote Access gt gt Connection Management Dial out Tool Refresh Seconds General Mode SCS Cl Backup Mode VPN Connection Status Current Page 1 Page No 69 E gt Tx Tx Rate Rx Rx Rate VPN Type Remote IP Virtual Network Pkts Bps Pts Bps UpTime XXXXXXXX 1 Data is encrypted XXXXX X XX i Data isn t encrypted Available settings are explained as follows Item Description Dial out Tool General Mode This filed displays the profile configured in LAN to LAN with Index number and VPN Server IP address The VPN connection built by General Mode does not support VPN backup function Refresh Seconds Alfa 19
198. able that channel The channels that you enabled here will be shown in the Multi PVC channel drop down list on the web page of Internet Access Though you can enable eight channels in this page yet only one channel can be chosen on the web page of Internet Access Type in the value provided by your ISP Type in the value provided by your ISP Select a proper QoS type for the channel Oos Type Select a proper protocol for this channel 98 Dray Tek Protocol PPPoE PPoA PPPoE Choose a proper type for this channel The types will be different according to the protocol setting that you choose Encapsulation 1403 Route IP LLC 1483 Bridged IP LLC 1483 Route IP LLC YE Wile Wl MUK 1403 Bridged IP VC Mux 1403 Routed IP VC Mux IPoA LLCS NAF WAN link for Channel 5 6 and 7 are provided for router borne application such as TR 069 The settings must be applied and obtained from your ISP For your special request please contact with your ISP and then click WAN link of Channel 5 6 or 7 to configure your router WAN gt Multi PVCs gt gt PVC Channel 5 WAN for Router borne Application Enable Disable DSL Modem Settings VPI WCET PYE Binding Add Tag L bo goSs Type IBR Protocol PPPoA Encapsulation YC Mus WAN Connection Detection Mode Ping IF TTL PPPoE PPPoA Client ISP Access Setup ISP Name Username Password PPP Authentication Always On Idle Timeout IP Add
199. able to invoke VLAN function The multi subnet can let a small businesses have much better isolation for multi occupancy applications Tagged VLAN The tagged VLANs 802 1q can also mark data with a VLAN identifier This identifier can be carried through an onward Ethernet switch to specific ports The specific VLAN clients can also pick up this identifier as it passes to the LAN Users can set the priorities for LAN side QoS and can assign each of the VLANs to each of the different IP subnets that the router may also be operating in order to provide even more isolation This functionality is tag based multi subnet Port Based VLAN Relative to tag based VLAN which groups clients with an identifier port based VLAN uses physical ports to separate the clients into different VLAN group LAN gt VLAN Configuration VLAN Configuration Enable rr Ta Wireless LAN T ar P4 SSID1 SSID2 SSID3 SSID4 Subnet Enable m o a o N S N E m m o o o o S N eo ee ee ek ee fe ee ek Permit untagged device in P1 to access router 1 Tag based VLAN only applied for LAN Parts 2 The checked Wireless LAN SSID will not has VLAN tagging function but regarded as joining WLAN group 3 The set VLAN ID VID must be unique and not duplicate Note Such page will be different slightly in accordance with the type of the router you have and settings in this page only applied to LAN port but not WAN port Available settings are explained a
200. abling IGMP snooping will make multicast traffic treated in the same manner as broadcast traffic Refresh Click this link to renew the working multicast group status Group ID This field displays the ID port for the multicast group The available range for IGMP starts from 224 0 0 0 to 239 255 255 254 P1 to P4 It indicates the LAN port used for the multicast group After finishing all the settings here please click OK to save the configuration Dr ay Tek 237 Vigor2830 Series User s Guide 3 10 8 Wake on LAN A PC client on LAN can be woken up by the router it connects When a user wants to wake up a specified PC through the router he she must type correct MAC address of the specified PC on this web page of Wake on LAN WOL of this router In addition such PC must have installed a network card supporting WOL function By the way WOL function must be set as Enable on the BIOS setting Application gt gt Wake on LAN Wake on LAN Note Wake on LAN cooperate with Bind IP to MAC function only binded PCs can wake up through IF Wake by MAC Address IP Address mac Address TY oY YY Result J a Available settings are explained as follows Item Description Wake by Two types provide for you to wake up the binded IP If you choose Wake by MAC Address you have to type the correct MAC address of the host in MAC Address boxes If you choose Wake by IP Address you have to choose the correct IP address
201. access into next page for setting SIP account Profile Display the profile name of the account Domain Realm Display the domain name or IP address of the SIP registrar server Proxy Display the domain name or IP address of the SIP proxy server Account Name Display the account name of SIP address before Vigor2830 Series User s Guide 284 Dray Tek Codec Ring Port Status STUN Server External IP SIP PING interval Display the codec type for the account Specify which port will ring when receiving a phone call Show the status for the corresponding SIP account R means such account is registered on SIP server successfully means the account is failed to register on SIP server Type in the IP address or domain of the STUN server Type in the gateway IP address The default value is 150 sec It is useful for a Nortel server NAT Traversal Support Click any index link to access into the following page for configuring SIP account VoIP gt SIP Accounts SIP Account Index No 1 Profile Name Register via SIP Port Domain Realm Proxy Ps 11 char max C Call without Registration 68 char ma 68 char ma C Act as outbound proxy Display Name Account Number Name L Authentication ID Password Expiry Time MAT Traversal Support Call Forwarding SIP URL Time Out Ring Port Ring Pattern Prefer Codec Packet Size voice Active Detector Po 23 char max 68 char max 68 char mary 68 ch
202. activate the Block Smurf function The Vigor router will ignore any broadcasting ICMP echo request Check the box to enforce the Vigor router not to forward any trace route packets Check the box to activate the Block SYN fragment function The Vigor router will drop any packets having SYN flag and more fragment bit set Check the box to activate the Block fraggle Attack function Any broadcast UDP packets received from the Internet is blocked Activating the DoS DDoS defense functionality might block some legal packets For example when you activate the fraggle attack defense all broadcast UDP packets 159 Vigor2830 Series User s Guide coming from the Internet are blocked Therefore the RIP packets from the Internet might be dropped Block TCP flag scan Check the box to activate the Block TCP flag scan function Any TCP packet with anomaly flag setting is dropped Those scanning activities include no flag scan FIN without ACK scan SYN FINscan Xmas scan and full Xmas scan Block Tear Drop Check the box to activate the Block Tear Drop function Many machines may crash when receiving ICMP datagrams packets that exceed the maximum length To avoid this type of attack the Vigor router is designed to be capable of discarding any fragmented ICMP packets with a length greater than 1024 octets Block Ping of Death Check the box to activate the Block Ping of Death function This attack involves the perpetrator sending overlapping
203. address for the specified PC that DHCP assigned IP address for it Vigor2830 Series User s Guide 360 Dr ay Te k Leased Time It displays the leased time of the specified PC HOST ID It displays the host ID name of the specified PC Refresh Click it to reload the page 3 18 6 NAT Sessions Table Click Diagnostics and click NAT Sessions Table to open the list page Diagnostics gt gt NAT Sessions Table NAT Active Sessions Table Refresh 192 166 1 24 9 93 159 192 166 1 2aOU7 46 25 192 166 1 207 46 5 10 Available settings are explained as follows Item Description Private IP Port It indicates the source IP address and port of local PC Pseudo Port It indicates the temporary port of the router used for NAT Peer IP Port It indicates the destination IP address and port of remote host Interface It displays the representing number for different interface Refresh Click it to reload the page D ra y Te k 361 Vigor2830 Series User s Guide 3 18 7 Ping Diagnosis Click Diagnostics and click Ping Diagnosis to pen the web page Diagnostics gt gt Ping Diagnosis Ping Diagnosis ipv4 Ou1pve Note If you want to ping a LAN PC or you don t want to specify which WAN to ping through please select Unspecified Ping through Unspecified Host IP v IP Address Run Ping to Result Or Diagnostics gt gt Ping Diagnosis Ping Diagnosis ping pve Address S O Result Cle
204. address of the local host offering the Service Status Display the state for the corresponding entry X or V is to represent the Inactive or Active state To add or edit port settings click one index number on the page The index entry setup page will pop up In each index entry you can specify 10 port ranges for diverse services Vigor2830 Series User s Guide 138 Dr ay Te k NAT gt Open Ports gt Edit Open Ports Index No 1 Enable Open Ports Comment WAN Interface Local Computer Protocol 4500 nnn nn i A WAMI 192 168 1 10 Choose PC End Part Protocol Start Port End Port 4700 6 4700 Ti noon Available settings are explained as follows Item Enable Open Ports Comment WAN Interface Local Computer Protocol Start Port End Port Description Check to enable this entry Make a name for the defined network application service Choose a WAN interface for this profile Enter the private IP address of the local host or click Choose PC to select one Choose PC Click this button and subsequently a window having a list of private IP addresses of local hosts will automatically pop up Select the appropriate IP address of the local host in the list Specify the transport layer protocol It could be TCP UDP Or none for selection Specify the starting port number of the service offered by the local host Specify the ending port number of the service offered by the lo
205. al in user to make an IPSec VPN connection through Internet L2TP with IPSec Policy Allow the remote dial in user to make a L2TP VPN connection through the Internet You can select to use L2TP alone or with IPSec Select from below None Do not apply the IPSec policy Accordingly the VPN connection employed the L2TP without IPSec policy can be viewed as one pure L2TP connection Nice to Have Apply the IPSec policy first if it is applicable during negotiation Otherwise the dial in VPN connection becomes one pure L2TP connection Must Specify the IPSec policy to be definitely applied on the L2TP connection SSL Tunnel It allows the remote dial in user to make an SSL VPN Tunnel connection through Internet suitable for the application through network accessing e g Vigor2830 Series User s Guide 322 Dray Tek Item Subnet User Name Password Enable Mobile One Time Passwords mOTP IKE Authentication Method Dray Tek Description PPTP L2TP IPSec If you check this box the function of SSL Tunnel for this account will be activated immediately Specify Remote Node Check the checkbox to specify the IP address of the remote dial in user ISDN number or peer ID used in IKE aggressive mode If you uncheck the checkbox the connection type you select above will apply the authentication methods and security methods in the general settings Netbios Naming Packet Pass Click it to have
206. an be acquired via the PPPoE mode connection which is available for the areas such as Taiwan hinet the Netherlands Australia and UK Details Page for IPv6 TSPC in WAN1 WAN2 WANS3 Tunnel setup protocol client TSPC is an application which could help you to connect to IPv6 network easily Please make sure your IPv4 WAN connection is OK and apply one free account from hexago http gogonet gogo6 com page freenet6 account before you try to use TSPC for network connection TSPC would connect to tunnel broker and requests a tunnel according to the specifications inside the configuration file It gets a public IPv6 IP address and an IPv6 prefix from the tunnel broker and then monitors the state of the tunnel in background Vigor2830 Series User s Guide 90 Dr ay Tek After getting the IPv6 prefix and starting router advertisement daemon RADVD the PC behind this router can directly connect to IPv6 the Internet WAN gt Internet Access WAN 1 PPPoE PPPoA MPoA RFC1483 2684 IPvo Internet Access Mode Connection Type TSPC TSPC Configuration Available settings are explained as follows Item Description Username Type the name obtained from the broker It is suggested for you to apply another username and password for http gogonet gogo6 com page freenet6 account Password Type the password assigned with the user name Confirm Password Type the password again to make the confirmation Tunnel Broker Type t
207. and click the Next button The following page will be open for you to specify Internet Access Type Quick Start Wizard Connect to Internet WAN 2 Select one of the folowing Internet Access types provided by your ISP Static IP DHCP Dr ay Tek 31 Vigor2830 Series User s Guide 2 Click PPTP L2TP as the Internet Access Type Then click Next to continue Quick Start Wizard LTF Client Mode WAN 2 Enter the user name password WAN IP configuration and LTF server IP provided by your ISP WAN IP Configuration Obtain an IP address automatically Specify an IP address IP Address Subnet Mask fs Primary DNS fo Secand ONS L2TP Server fo Available settings are explained as follows Item Description User Name Assign a specific valid user name provided by the ISP Password Assign a valid password provided by the ISP Confirm Password Retype the password WAN IP Obtain an IP address automatically the router will get Configuration an IP address automatically from DHCP server Specify an IP address you have to type relational settings manually IP Address Type the IP address Subnet Mask Type the subnet mask Gateway Type the IP address of the gateway Primary DNS Type in the primary IP address for the router Second DNS Type in secondary IP address for necessity in the future PPTP Server L2TP Type the IP address of the server Server Back Click it to return to previous
208. and used for port redirection The default setting is All which means all the incoming data from any port will be redirected to specified range of IP address and port Specify which port can be redirected to the specified Private IP and Port of the internal host If you choose Range as the port redirection mode you will see two boxes on this field Simply type the required number on the first box The second one will be assigned automatically later 133 Vigor2830 Series User s Guide Private IP Specify the private IP address of the internal host providing the service If you choose Range as the port redirection mode you will see two boxes on this field Type a complete IP address in the first box as the starting point and the fourth digits in the second box as the end point Private Port Specify the private port number of the service offered by the internal host After finishing all the settings here please click OK to save the configuration Note that the router has its own built in services servers such as Telnet HTTP and FTP etc Since the common port numbers of these services servers are all the same you may need to reset the router in order to avoid confliction For example the built in web user interface in the router is with default port 80 which may conflict with the web server in the local network http 192 168 1 13 80 Therefore you need to change the router s http port to any one other than the default port
209. ar Available settings are explained as follows Item Description IPV4 IPV6 Choose the interface for such function Ping through Use the drop down list to choose the WAN interface that you want to ping through or choose Unspecified to be determined by the router automatically Vigor2830 Series User s Guide 362 Dr ay Tek Ping to Use the drop down list to choose the destination that you want to ping IP Address Type the IP address of the Host IP that you want to ping Ping IPv6 Address Type the IPv6 address that you want to ping Run Click this button to start the ping work The result will be displayed on the screen Clear Click this link to remove the result on the window 3 18 8 Data Flow Monitor This page displays the running procedure for the IP address monitored and refreshes the data in an interval of several seconds The IP address listed here is configured in Bandwidth Management You have to enable IP bandwidth limit and IP session limit before invoke Data Flow Monitor If not a notification dialog box will appear to remind you enabling it Limit Session Enable Disable Default Max Sessions 100 Limitation List Index Start IP End IF Click Diagnostics and click Data Flow Monitor to open the web page You can click IP Address TX rate RX rate or Session link for arranging the data display Diagnostics gt gt Data Flow Monitor Enable Data Flow Monitor Refresh Seconds Page Refresh Index
210. ar max pon sec y sec C Phonei C Phone C Single Codec Available settings are explained as follows Dray Tek Item Profile Name Register via Description Assign a name for this profile for identifying You can type similar name with the domain For example if the domain name is draytel org then you might set draytel in this field If you want to make VoIP call without register personal 285 Vigor2830 Series User s Guide information please choose None and check the box to achieve the goal Some SIP server allows user to use VoIP function without registering For such server please check the box of Call without Registration Choosing Auto is recommended The system will select a proper way for your VoIP call SIP Port Set the port number for sending receiving SIP message for building a session The default value is 5060 Your peer must set the same value in his her Registrar Domain Realm Set the domain name or IP address of the SIP Registrar server Proxy Set domain name or IP address of SIP proxy server By the time you can type port number after the domain name to specify that port as the destination of data transmission e g nat draytel org 5065 Act as Outbound Proxy Check this box to make the proxy acting as outbound proxy Display Name The caller ID that you want to be displayed on your friend s screen Account Number Name Enter your account name of SIP Address e g every text
211. as shown below to allow Router A dial in to build VPN connection If an IPSec based service is selected you may further specify the remote peer IP Address IKE Authentication Method and IPSec Security Method for this Dial In connection Otherwise it will apply the settings defined in IPSec General Setup above Vigor2830 Series User s Guide 402 Dray Tek 3 Dial In Settings Allowed Dial In Type C PPTP IFsec Tunnel Y Compression C L2TR with IPsec Policy IKE Authentication Method Specify Remote VPN Gateway Pre Shared Key Peer VPN Server IP IKE Pre Shared Key ee 220 135 240 208 C Digital Signaturef 509 or Peer ID fe Jone Local ID Alternative Subject Name First Subject Name First IPsec Security Method Medium AH High ESP DES F 3DES F AES If a PPP based service is selected you should further specify the remote peer IP Address Username Password and VJ Compression for this Dial In connection 3 Dial In Settings Allowed Dial In Type Username PPTP Password Max 11 char panee 0 e C IPsec Tunnel Y Compression on off C LATP with IPsec Policy None a IKE Authentication Method Specify Remote WPN Gateway Pre Shared Key Peer YPN Server IP ZE Pre Shared Key fo 220 135 240 208 Digital Signature 509 Local ID Alternative Subject Name First Subject Name First IPsec Security Method MediumtAH HightESP4
212. atio reserved bandwidth to upstream speed and reserved bandwidth to downstream speed Enable UDP Bandwidth Check this and set the limited bandwidth ratio on the right Control field This is a protection of TCP application traffic since UDP application traffic such as streaming video will exhaust lots of bandwidth Dr ay Tek 217 Vigor2830 Series User s Guide Outbound TCP ACK The difference in bandwidth between download and upload Prioritize are great in ADSL2 environment For the download speed might be impacted by the uploading TCP ACK you can check this box to push ACK of upload faster to speed the network traffic Limited_bandwidth Ratio The ratio typed here is reserved for limited bandwidth of UDP application Edit the Class Rule for QoS 1 The first three Class 1 to Class 3 class rules can be adjusted for your necessity To add edit or delete the class rule please click the Edit link of that one Bandwidth Management gt Quality of Service General Setup Setto Factory Default Index Status Bandwidth Direction Chins Diass Diass Others cumin i 2 3 Control Statistics WAN Enable Kbps Kbps Outbound 25 25 25 25 Inactive Status Setup WAN Enable 100000Kbps 100000Kbps Outbound 25 25 25 25 Inactive Status Setup WANS Disable 100000Kbps 100000Kbps 25 25 25 25 Inactive Status Setup Class Rule Index Name Rule Service Type Class 1 VoIP Edit Class 2 HTTP Edit Edit Class 3 Mail Edit Enable the First
213. ault setting is 1442 PPP MP Setup PPP Authentication Select PAP only or PAP or CHAP for PPP If you want to connect to Internet all the time you can check Always On Idle Timeout Set the timeout for breaking down the Internet after passing through the time without any action IP Address Assignment Usually ISP dynamically assigns IP address to you each Method IPCP time you connect to it and request In some case your ISP provides service to always assign you the same IP address whenever you request In this case you can fill in this IP address in the Fixed IP field Please contact your ISP before you want to use this function WAN IP Alias If you have multiple public IP addresses and would like to utilize them on the WAN interface please use WAN IP Alias You can set up to 8 public IP addresses other than the current one you are using Type the additional WAN IP address and check the Enable box Then click OK to exit the dialog o RAR MAS 192 169 1 Sidocivipalias htm WANI IP Alias Multi NAT Index Enable Aux WAN IP Join NAT IP Pool d a d d d O d d Fixed IP Click Yes to use this function and type in a fixed IP address in the box of Fixed IP Address Default MAC Address You can use Default MAC Address or specify another MAC address by typing on the boxes of MAC Address for the router Specify a MAC Address Type the MAC address for the router manually After finishing all the se
214. available algorithms to the VPN peers and get its feedback to find a match Three combinations are available for both modes We suggest you select the combination that covers the most algorithms IKE phase 1 Key lifetime For security reason the lifetime of key should be defined The default value is 28800 seconds You may specify a value in between 900 and 86400 seconds IKE phase 2 Key lifetime For security reason the lifetime of key should be defined The default value is 3600 seconds You may specify a value in between 600 and 86400 seconds Perfect Forward Secret PFS The IKE Phase key will be reused to avoid the computation complexity in phase 2 The default value is inactive this function Local ID In Aggressive mode Local ID is on behalf of the IP address while identity authenticating with remote VPN server The length of the ID is limited to 47 characters 257 Vigor2830 Series User s Guide 3 Dial In Settings Allowed Dial In Type PPTR IPsec Tunnel L2TP with IPsec Policy C Specify Remote VPN Gateway Peer YPN Server IP a 4 GRE over IPsec Settings C Enable IPsec Dial Out function GRE over IPsec Username ere YJ Compression on off IKE Authentication Method Pre Shared Key C Digital Signaturefx 509 Local ID Alternative Subject Name First Subject Name First IPsec Security Method Medium AH Hight ESF DES 3DES V AES 3 TCP IP Network Settings My WAN IP Remo
215. ay Tek 197 Vigor2830 Series User s Guide Below shows the items which are categorized under Protocol CSM gt APP Enforcement Profile Profile Index 1 IM P2P Select All Clear All Profle Name o PROTOCOL OTHERS Support List Action DNS FTP MMTP POPS SSH SSL TLS Oracle PostgresgL IRL SMMP MySQL Informix Available settings are explained as follows Item Profile Name Select All Clear All Support List Action Description Type a name for the CSM profile Click it to choose all of the items in this page Uncheck all the selected boxes Display the all the information name version and note about IM P2P Protocol and others applications that Vigor router supports for APPE function Block Block all the packets passing with the settings configured in this page Pass Pass all the packets with the settings configured in this page The profiles configured here can be applied in the Firewall gt gt General Setup and Firewall gt gt Filter Setup pages as the standard for the host s to follow The items categorized under P2P CSM gt APP Enforcement Profile Profile Index 1 IM P2P Select All Clear All profleName i PROTOCOL OTHERS Support List Applications SoulSeek BitTorrent SoulSeek eDonkey eMule Shareaza kaza BearShare iMesh KCeasy FilePipe BearShare Limewire Shareaza Fox Lopster Nao Winlop BitTorrent BitSpirit BitComet
216. b sign your e mail messages encrypt your e mail messages and more depending upon the type of certificate you request Select a task ORetrieve the CA certificate or certificate revocation list Request a certificate Check on a pending certificate Dray Tek 417 Vigor2830 Series User s Guide Select Advanced request Microsoft Certificate Services vigor Choose Request Type Please select the type of request you would like to make User certificate request Advanced request Select Submit a certificate request a base64 encoded PKCS 10 file or a renewal request using a base64 encoded PKCS 7 file Microsoft Cenificate Services Tite Home Advanced Certificate Requests You can request a certificate for yourself another user or a computer using one of the following methods Note that the policy of the certification authority CA will determine the certificates that you can obtain Submit a certificate request to this CA using a form Submit a certificate request using a base64 encoded PKCS 10 file or a renewal request using a base64 encoded PKCS 7 file Request a certificate for a smart card on behalf of another user using the Smart Card Enrollment Station You must have an enroliment agent certificate to submit a request for another user Import the X509 Local Certificate Requet text file Select Router Offline request or IPSec Offline request below Microsoft Certificate
217. before Authentication ID Check the box to invoke this function and enter the name or number used for SIP Authorization with SIP Registrar If this setting value is the same as Account Name it is not necessary for you to check the box and set any value in this field Password The password provided to you when you registered with a SIP service Expiry Time The time duration that your SIP Registrar server keeps your registration record Before the time expires the router will send another register request to SIP Registrar again NAT Traversal Support If the router e g broadband router you use connects to internet by other device you have to set this function for your necessity NAT Traversal Support Vigor2830 Series User s Guide 286 Dr ay Tek None Disable this function Stun Choose this option if there is Stun server provided for your router Manual Choose this option if you want to specify an external IP address as the NAT transversal support Nortel If the soft switch that you use supports Nortel solution you can choose this option Call Forwarding There are four options for you to choose Disable is to close call forwarding function Always means all the incoming calls will be forwarded into SIP URL without any reason Busy means the incoming calls will be forwarded into SIP URL only when the local system is busy No Answer means if the incoming calls do not receive any response they will be
218. ber The range is form 0 to 4095 Priority Type the packet priority number for such VLAN The range is from 0 to 7 Active Mode Choose Always On to make the WANI1 connection being activated always Always On Alw J Y 5 D n Backup Load Balance Check this box to enable auto load balance function for such WAN interface When the data traffic is large the WAN interface with the function enabled will balance the data transmission automatically among all of the WAN interfaces in connection status Backup Type If you choose Backup as the Active Mode Backup WAN will be changed into Backup Type You have to specify which role the WAN interface should play 1f you want to backup multiple WANs However ignore this setting if you want to backup a single WAN Active Mode Backup vi WAN 1 O0 WAN 2 O0 WAN 3 Backup Type oe O Only if acting as backup for When any of selected WAN disconnect multiple WAN When all of selected WAN disconnect When any of selected WAN disconnect Such backup WAN will be activated when any master WAN interface disconnects When all of selected WAN disconnect Such backup WAN will be activated only when all master WAN interfaces disconnect After finishing all the settings here please click OK to save the configuration Dr ay Te k 67 Vigor2830 Series User s Guide WAN2 with Ethernet WAN2 is fixed with physical mode of Ethernet WAN gt General Setup WAN
219. ble session number for each host in the specific range of IP addresses If you do not set the session number in this field the system will use the default session limit for the specific limitation you set for each index Add Adds the specific session limitation onto the list above Edit Allows you to edit the settings for the selected limitation Delete Remove the selected settings existing on the limitation list Administration Message Type the words which will be displayed when reaches the maximum number of Internet sessions permitted Click Default Message to display the default message on the screen Time Schedule Index 1 15 in Schedule Setup You can type in four sets of time schedule for your request All the schedules can be set previously in Application gt gt Schedule web page and you can use the number that you have set in that web page After finishing all the settings here please click OK to save the configuration Dray Te k 211 Vigor2830 Series User s Guide 3 9 2 Bandwidth Limit The downstream or upstream from FTP HTTP or some P2P applications will occupy large of bandwidth and affect the applications for other programs Please use Limit Bandwidth to make the bandwidth usage more efficient In the Bandwidth Management menu click Bandwidth Limit to open the web page Bandwidth Management gt Bandwidth Limit Bandwidth Limit Enable IP Routed Subnet Disable Default TX Limit Default RX Lirit
220. bsequent TCP SYN packets for a period defined in Timeout The goal for this is prevent the TCP SYN packets attempt to exhaust the limited resource of Vigor router By default the threshold and timeout values are set to 2000 packets per second and 10 seconds respectively That means when 2000 packets per second received they will be regarded as attack event and the session will be paused for 10 seconds Check the box to activate the UDP flood defense function Once detecting the Threshold of the UDP packets from the Internet has exceeded the defined value the Vigor router will start to randomly discard the subsequent UDP packets for a period defined in Timeout The default setting for threshold and timeout are 2000 packets per second and 10 seconds respectively That Iss DrayTek Enable ICMP flood defense Enable Port Scan detection Block IP options Block Land Block Smurf Block trace router Block SYN fragment Block Fraggle Attack Dray Tek means when 2000 packets per second received they will be regarded as attack event and the session will be paused for 10 seconds Check the box to activate the ICMP flood defense function Similar to the UDP flood defense function once if the Threshold of ICMP packets from Internet has exceeded the defined value the router will discard the ICMP echo requests coming from the Internet The default setting for threshold and timeout are 250 packets per s
221. cal host After finishing all the settings here please click OK to save the configuration Dray Tek 139 Vigor2830 Series User s Guide 3 4 4 Port Triggering Port Triggering is a variation of open ports function The key difference between open port and port triggering is Once the OK button is clicked and the configuration has taken effect open port keeps the ports opened forever Once the OK button is clicked and the configuration has taken effect port triggering will only attempt to open the ports once the triggering conditions are met The duration that these ports are opened depends on the type of protocol used The default durations are shown below and these duration values can be modified via telnet commands TCP 86400 sec UDP 180 sec IGMP 10 sec TCP WWW 60 sec TCP SYN 60 sec NAT gt gt Port Triggering Port Triggering Set to Factory Default Index Comment Triggering Protocol Triggering Port Incoming Protocol Incoming Port Status x serine eh gt eS i A A fy La k P P aA D a Available settings are explained as follows Item Description Comment Display the text which memorizes the application of this rule Triggering Protocol Display the protocol of the triggering packets Triggering Port Display the port of the triggering packets Incoming Protocol Display the protocol for the incoming data of such triggering profile Incoming Por
222. can use and install it into your PC for matching with Packet OVERDRIVE refer to the following picture of Vigor N61 wireless utility window choose Enable for TxBURST on the tab of Option igor N61 802 11n Wireless USB Adapter Utility General Setting Advance Setting Auto launch when Windows start up C Disable Radio C Remember mini status position Fragmentation Threshold a 2346 C Auto hide mini status RTS Threshold 2347 C Set mini status always on top Frequency 802 11b gn 24GH v C Enable IP Setting and Proxy Setting in Profile Ad hoc Channel p C Group Roaming Pe Power Save Mode Tx Burst WLAN type to connect Infrastructure and Ad hoc network Infrastructure network only adhoc network only C Automatically connect to non preferred networks Ta Busst Enable Note means the real transmission rate depends on the environment of the network Vigor2830 Series User s Guide 310 Dray Te k 3 14 8 WMM Configuration WMM is an abbreviation of Wi Fi Multimedia It defines the priority levels for four access categories derived from 802 1d prioritization tabs The categories are designed with specific types of traffic voice video best effort and low priority data There are four accessing categories AC_BE AC_BK AC_VI and AC_VO for WMM APSD automatic power save delivery is an enhancement over the power save mechanisms supported by Wi Fi networks It al
223. cates should first request a certificate issued by a CA server It should also retrieve certificates of other trusted CA servers so it can authenticate the peer with certificates issued by those trusted CA servers Here you can manage generate and manage the local digital certificates and set trusted CA certificates Remember to adjust the time of Vigor router before using the certificate so that you can get the correct valid period of certificate Below shows the menu items for Certificate Management Certificate Management 3 12 1 Local Certificate Certificate Management gt Local Certificate X509 Local Certificate Configuration Name Subject Status Modify Delete Delete Delete GENERATE IMPORT REFRESH Available settings are explained as follows Item Description Generate Click this button to open Generate Certificate Request window Type in all the information that the window requests Then click Generate again Import Click this button to import a saved file as the certification information Refresh Click this button to refresh the information listed below View Click this button to view the detailed settings for certificate request Delete Click this button to delete selected name with certification information GENERATE Click this button to open Generate Certificate Signing Request window Type in all the information that the window request such as certifcate name used for identifying different Vigo
224. ccess Mode WAN ADSL PPPoE PPPoA Details Page static or Dynamic IP Details Page None PPPoE WARS Ethernet WARS USE Static or Dynamic IP Note Only one WAN can support IPwW6 PPTP OTP Dr ay Tek rp Vigor2830 Series User s Guide WAN gt gt Internet Access Internet Access Index Display Name Physical Mode Access Mode WAN2 Ethernet static or Dynamic IP v Details Page WANS USB Morne 36 46 USB Modemi PFPP mode 415 USB Modem DHCP mode You can configure DHCP client options here Note Only one WAN can support IFw6 Available settings are explained as follows Item Description Index Display the WAN interface Display Name It shows the name of the WAN1 WAN2 WANS3 that entered in general setup Physical Mode It shows the physical connection for WAN1I ADSL WAN2 Ethernet WAN3 3G 4G USB Modem according to the real network connection Access Mode Use the drop down list to choose a proper access mode The details page of that mode will be popped up If not click Details Page for accessing the page to configure the settings Details Page This button will open different web page according to the access mode that you choose in WAN interface IPv6 This button will open different web page based on Physical Mode to setup IPv6 Internet Access Mode for WAN interface If IPv6 service is active on this WAN interface the color of TPv6 will b
225. cense must be activated first Otherwise DNS filter does not have any effect on packets CSM gt DNS Filter DNS Filter DNS Filter Syslog Service Cache Time hour Enable Block Page Administration Message Max 255 characters Default Message lt hodye lt center gt lt br gt lt br gt lt hbre lt p gt The requested Web page lt br gt from 51FS lt br gt to sURLS lt hbr gt that 13 categorized with CLS lt br gt has been blocked by RNAMES DNS Filter lt p gt Please contact Your system administrator for further information lt center body gt Legend WSiP Source IP WURL URL WCL Category RMAME Router Name Available settings are explained as follows Item Description DNS Filter Check Enable to enable such feature Syslog The filtering result can be recorded according to the setting selected for Syslog Vigor2830 Series User s Guide 208 Dr ay Tek None There is no log file will be recorded for this profile Pass Only the log about Pass will be recorded in Syslog Block Only the log about Block will be recorded in Syslog All All the actions Pass and Block will be recorded in Syslog Service Set the filtering conditions Specify one of the WCF profiles as Service WCF 1 Default Choose the WCF profiles to apply DNS filter Cache Time hour Set the time for DNS query Enable Block Page Check the box to enable such function After finishing all the settings
226. ch is the web content filter based on Commtouch Werated in the worldwide There is a 30 day trial period After trial you can purchase DrayTek s prepared Commtouch GlobalView WCF package from retailing outlets Enter your License key Activation Date 2010 11 02 select CII have read and accept the above Agreement Please check this box Note The activation date is brought out by the server automatically and cannot be changed Dr ay Tek 43 Vigor2830 Series User s Guide 2 3 VPN Client Wizard Such wizard is used to configure VPN settings for VPN client Such wizard will guide to set the LAN to LAN profile for VPN dial out connection from server to client step by step 1 Open VPN and Remote Access gt gt VPN Client Wizard The following page will appear VPN and Remote Access gt gt VPN Client Wizard Choose VPN Establishment Environment LAN to Lah VPN Clent Mode Selection Route Wlode Please choose a LAN to LanN Profile Index Status Name Note For a typical LAN to LAN tunnel please select Route Mode If the remote network is expecting only a single client or ip and is not configured to route the subnet and then select NAT mode If in doubt then select Route Mode Available settings are explained as follows Item Description LAN to LAN Client Choose the client mode Mode Selection Route Mode NAT Mode If the remote network only allows you to dial in with single IP please choose
227. cified Hosts In the Bandwidth Management menu click Sessions Limit to open the web page Bandwidth Management gt gt Sessions Limit Sessions Limit Enable Disable Default Max Sessions 100 Limitation List Index Start IF Max Sessions Specific Limitation startie end O Maximum Sessions Administration Message Max 256 characters Default Message You have reached the maximum number of permitted Internet sessions lt p gt Please close one or more applications to allow further Internet access lt p Contact your system administrator for further information Time Schedule Index 1 15 in Schedule Setup iz Note Action and Idle Timeout settings will be ignored To activate the function of limit session simply click Enable and set the default session limit Vigor2830 Series User s Guide 210 Dr ay Te k Available settings are explained as follows Item Description Session Limit Enable Click this button to activate the function of limit Session Disable Click this button to close the function of limit Session Default Max Session Defines the default session number used for each computer in LAN Limitation List Displays a list of specific limitations that you set on this web page Specific Limitation Start IP Defines the start IP address for limit session End IP Defines the end IP address for limit session Maximum Sessions Defines the availa
228. cked For Block IP Address this function can block incoming calls through Phone port coming from IP address Such control also can be done based on preconfigured schedules VoIP gt DialPlan Setup Call Barring Block IP Address Enable Route C Phonei Phone Indext1 15 in Schedule Setup O _ Note The incoming calls by means of IP dialing 2 g 192 168 1 145 should be blocked Dray Te k 281 Vigor2830 Series User s Guide Regional This page allows you to process incoming or outgoing phone calls by regional Default values common used in most areas will be shown on this web page You can change the number based on the region that the router 1s placed VoIP gt DialPlan Setup Enable Regional Setto Factory Default Last Call Return Miss Last Call Return In alee Last Call Return Gut 14 Call Forward All Act 72 enumbert Call Forward Deact 73 ha Call Forward Busy Act 90 hnumber Call Forward No Ans Act 7920 number Do Not Disturb Act TBE k Do Not Disturb Deact 73 ha Hide caller ID Act E at Hide caller ID Deact 8 a Call Waiting Act 56 2 Call Waiting Deact r 2 Black Anonymous Act e77 bea Block Anonymous Deact BF laa Block Unknow Domain Act 40 i aoe tad pomali a fee Block IP Calls Act 0 Block IP Calls Deact T5 ha Block Last Calls Act Oka Available settings are explained as follows Item Description Enable Re
229. connecting to the CA server that you would like to retrieve its CA certificate Click Retrive the CA certificate or certificate recoring list 2 Microsoft Certificate Services Microsoft Internet Explorer BRE RHE WAO RRB IAM HAH Os O hla Des yra ee O C Ga ED E htip172 16 2 179 certsv Brr ae mst PBS 2BEBRT ANES DO HARRE G19 a Hotmail g Messenger B HAI MSN Microsoft Certificate Services woor Welcome You use this web site to request a certificate for your web browser e mail client or other secure program Once you acquire a certificate you will be able to securely identify yourself to other people over the web sign your e mail messages encrypt your e mail messages and more depending upon the type of certificate you request ORequest a certificate Check on a pending certificate Vigor2830 Series User s Guide 420 Dray Tek 2 In Choose file to download click CA Certificate Current and Base 64 encoded and Download CA certificate to save the cer file 3 Microsoft Certificate Services Microsoft Internet Explorer BRO SHO HAW BRE IAM HAW QOG O iA wes shane Qee O O G 3 FEAE E http 172 16 2 179 certsrvicertcare asp Bez te msi v PHZ PRAT AEA OHBARAG G19 a Hotmail g Mesenger ARAI MSN Microsoft Certificate Sernices vigor Retrieve The CA Certificate Or Certificate Revocation List Install this CA certification path to a
230. ction Error Correction Mode REDUNDANCY C DND Do Not Disturb Mode Indexf 1 15 in Schedule Setup FLAC Note Action and Idle Timeout settings will be ignored Index 1 60 in Phone Book as Exception List EL ALLL E CUIR hide caller ID Call Waiting Call Transfer Available settings are explained as follows Item Hotline Session Timer T 38 Fax Function DND Do Not Disturb mode CLIR hide caller ID Vigor2830 Series User s Guide Description Check the box to enable it Type in the SIP URL in the field for dialing automatically when you pick up the phone set Check the box to enable the function In the limited time that you set in this field if there is no response the connecting call will be closed automatically Check the box to enable T 38 fax function Error Correction Mode choose a mode for error correction Set a period of peace time without disturbing by VoIP phone call During the period the one who dial in will listen busy tone yet the local user will not listen any ring tone Index 1 15 in Schedule Enter the index of schedule profiles to control when the phone will ring and when will not according to the preconfigured schedules Refer to section Application gt gt Schedule for detailed configuration Index 1 60 in Phone Book Enter the index of phone book profiles Refer to section DialPlan Phone Book for detailed configuration Check this box to h
231. d The port is disconnected The data is transmitting Dray Tek o CK Wirelens Lad OMADF FF S Factory EATI Interface Right LED The port is connected with 1000Mbps Green Off The port is connected with 10 100Mbps when left LED is on Vigor2830Vn ADSL2 Security Firewall Phone 1 2 Line A A a ae I o p OFF PWR rr 2 3 4 DSL USB GigaLAN 1 WAN2 Giga Wireless LAN ON OFF WPS Factory Reset Phone 1 2 Line GigaLAN 1 4 DSL WAN2 Giga USB PWR ON OFF Dray Tek Description Press Wireless LAN ON OFF WPS button once to wait for client device making network connection through WPS Press Wireless LAN ON OFF WPS button twice to enable WLAN LED on or disable WLAN LED off wireless connection Restore the default settings Usage Turn on the router ACT LED is blinking Press the hole and keep for more than 5 seconds When you see the ACT LED begins to blink rapidly than usual release the button Then the router will restart with the factory default configuration Connecter for analog phone s Connector for PSTN life line Connecters for local networked devices Connecter for accessing the Internet through ADSL2 2 Connecters for remote networked devices Connecter for a USB device for 3G USB Modem or printer Connecter for a power adapter Power Switch 7 Vigor2830 Series User s Guide 1 2 Hardware Installation Before starting to configure the router you hav
232. dded Brother DCP 116C Set as the default printer To check if your printer is working properly or to see troubleshooting information for the printer print a test page Print a test page Cancel Dr ay Tek 13 Vigor2830 Series User s Guide 12 The new printer has been added and displayed under Printers and Faxes Click the new printer icon and click Printer server properties C Q To Control Panel Hardware and Sound Devices and Printers Print server properties att properties for this print server Add a device Adda printer See what s printing Remove device Devices 3 Ginnie Non PnP VMware Virtual WIN PRO SVR Monitor disk SCSI Disk Device a Printers and Faxes 6 6F_Printer Adm_Printer Microsoft XPS Brother Document Writer DCP 116C 13 Edit the property of the new printer you have added by clicking Configure Port YEP Properlies MEMO UEWICE yurar Forms Forts Drivers Security Advanced I WIMTPRO SR Ports on this server Description Printer O T500 Inactrve TS Port TS00L Inactive TS Port TPM ThinPrint Print Port fo 172 16 24 24 Standard TCP IP Port bf LPRIocal Standard TCP IP Port Adm Printer 192 168 11 Standard TCP IP Port Brother DCP 116C VIRCKOSOTE APS DOCUMENT Writer w oc Add Port Delete Port Configure Port Cancel Apply Vigor2830 Series User s Guide 14 Dr ay Te k
233. de 3 16 3 File Explorer File Explorer offers an easy way for users to view and manage the content of USB storage disk connected on Vigor router USB Application gt gt File Explorer File Explorer o Name Size Delete Rename Current Path 4 Upload File Select a file O Upload Note The folder can not be deleted when itis not empty Available settings are explained as follows Item Description Click this icon to refresh files list Refresh A Click this icon to return to the upper directory Back 4 Click this icon to add a new folder Create Current Path Display current folder Upload Click this button to upload the selected file to the USB storage disk The uploaded file in the USB diskette can be shared for other user through FTP Vigor2830 Series User s Guide 332 Dr ay Te k 3 16 4 USB Device Status This page is to monitor the status for the users who accessing into FTP or Samba server USB storage disk via the Vigor router In addition the status of the USB modem or USB printer connecting to Vigor router can be checked from such page If you want to remove the storage disk from USB port in router please click Disconnect USB Disk first And then remove the USB storage disk later USB Application gt USB Device Status Disk Modem Printer Refresh USE Mass Storage Device Status Connection Status No Disk Connected Disk Capacity 0 MB Free Capacity OMB Refresh US
234. de Description Check the box to enable such profile Use the drop down list to choose mail service provider You can click Mail Service link to define the mail server Type the e mail address of the one who will receive the notification message Use the drop down list to choose a message profile The recipient will get the content stated in the message profile You can click the Notify Profile link to define the content of the mail message 0 Dray Tek Schedule Type the schedule number that the notification will be sent out You can click the Schedule 1 15 link to define the schedule After finishing all the settings here please click OK to save the configuration 3 11 VPN and Remote Access A Virtual Private Network VPN is the extension of a private network that encompasses links across shared or public networks like the Internet In short by VPN technology you can send data between two computers across a shared or public network in a manner that emulates the properties of a point to point private link Below shows the menu items for VPN and Remote Access VPN and Remote Access Dray Te k 241 Vigor2830 Series User s Guide 3 11 1 Remote Access Control Enable the necessary VPN service as you need If you intend to run a VPN server inside your LAN you should disable the VPN service of Vigor Router to allow VPN tunnel pass through as well as the appropriate NAT settings such as DMZ or open port VPN a
235. de This page is left blank Vigor2830 Series User s Guide 22 Dr ay Te k Quick Setup There are several setup wizards offered for you to configure the router simply and quickly Wizards Quick Start Wizard used for building network connection Internet access Service Activation Wizard used for activating the web content filter service VPN Client Wizard used for establishing VPN tunnel the router is treated as a VPN client VPN Server Wizard used for establishing VPN tunnel the router is treated as a VPN server Wireless Wizard used for building wireless LAN connection VoIP Wizard used for establishing VoIP profile 2 1 Quick Start Wizard If your router can be under an environment with high speed NAT the configuration provide here can help you to deploy and use the router quickly The first screen of Quick Start Wizard is entering login password After typing the password please click Next Quick Start Wizard Enter login password Please enter an alpha numeric string as your Password Max 23 characters Old Password COO New Password Coe Confirm Password Coc Next gt Finish Cancel On the next page as shown below please select the WAN interface that you use If DSL interface is used please choose WAN if Ethernet interface is used please choose WAN2 if 3G USB modem is used please choose WANS3 Then click Next for next step Dr ay Tek 23 Vigor2830 Ser
236. designated in the user protile s policy will still valid Landing Page Max 255 characters Preview Setto Factory Default lt body stats lo lt script langquage Javascript gt window Lacation http rww draytek com lt scripte lt r body gt Available settings are explained as follows Item Description Mode There are two modes offered here for you to choose Each mode will bring different filtering effect to the users involved User Based If you choose such mode the router will apply the filter rules configured in User Management gt gt User Profile to the users Rule Based If you choose such mode the router will apply the filter rules configured in Firewall gt gt General Setup and Filter Rule to the users Display IP Address on On The IP address of the user accessing into Vigor tracking window router Internet will be displayed on the tracking window Web Authentication Choose the protocol for web authentication Landing Page Type the information to be displayed on the first web page when the LAN user accessing into Internet via such router Vigor2830 Series User s Guide 162 Dr ay Te k 3 6 2 User Profile This page allows you to set customized profiles up to 200 which will be applied for users controlled under User Management Simply open User Management gt gt User Profile User Management gt gt User Profile User Profile Table Setto Factory Default Profile Name Profile Name admin Dial In
237. dress Type the start and end address for IPv6 server Primary DNS Sever Type the IPv6 address for Primary DNS server Secondary DNS Server Type another IPv6 address for DNS server if required IPv6 Address Type static IPv6 address for LAN Prefix Length Type the fixed value for prefix length Add Click it to add a new entry Delete Click it to remove an existed entry Display current used IPv6 addresses Details Page for LAN2 LAN3 LAN4 LAN gt General Setup Lan 2 Ethernet TCP IP and DHCP Setup Network Configuration OEnable Disable For NAT Usage IP Address Subnet Mask the same subnet OFor Routing Usage 192 168 214 255 255 255 0 Mote Disable LAN amp Enable LAN shouldn t be in DHCP Server Configuration Enable Server Disable Server Enable Relay Agent Start IP Address IP Pool Counts Gateway IP Address 259200 fs Lease Time Retrieve IPs fram inactive clients periodically DNS Server IP Address Primary IP Address Secondary IP Address O O Available settings are explained as follows Item Network Configuration Vigor2830 Series User s Guide Description Enable Disable Click Enable to enable such configuration Click Disable to disable such configuration For NAT Usage Click this radio button to invoke NAT function For Routing Usage Click this radio button to invoke this function IP Address Type in private IP address for connecting to
238. dware Encryption Vigor Router is equipped with a hardware AES encryption engine so it can apply the highest protection to your data without influencing user experience Complete Security Standard Selection To ensure the security and privacy of your wireless communication we provide several prevailing standards on market WEP Wired Equivalent Privacy is a legacy method to encrypt each frame transmitted via radio using either a 64 bit or 128 bit key Usually access point will preset a set of four keys and it will communicate with each station using only one out of the four keys WPA Wi Fi Protected Access the most dominating security mechanism in industry is separated into two categories WPA personal or called WPA Pre Share Key WPA PSK and WPA Enterprise or called WPA 802 1x In WPA Personal a pre defined key is used for encryption during data transmission WPA applies Temporal Key Integrity Protocol TKIP for data encryption while WPA2 applies AES The WPA Enterprise combines not only encryption but also authentication Since WEP has been proved vulnerable you may consider using WPA for the most secure connection You should select the appropriate security mechanism according to your needs No matter which security suite you select they all will enhance the over the air data protection and or privacy on your wireless network The Vigor wireless router is very flexible and can support multiple secure connections with both WEP and WPA
239. e Dr ay Tek 45 Vigor2830 Series User s Guide When you choose PPTP None Encryption or PPTP Encryption you will see the following graphic VPN and Remote Access gt gt VPN Client Wizard VPN Client PPTP None Encryption Settings Profile Name VPN Dial Out Through CO Always on Server IP Host Name for VPN e g 5551234 draytek com or 123 45 67 89 Username Password Remote Network IP Remote Network Mask 255 255 255 0 When you choose IPSec you will see the following graphic VPN and Remote Access gt gt VPN Client Wizard VPN Client IPSec Settings Profile Name YPN Dial Qut Through O Always on Server IP Host Mame for PM e g 5551234 draytek com or 123 45 67 89 IKE Authentication Method Pre Shared Key Confirm Pre Shared Key Digital Signature 5095 Peer ID Local ID Alternative Subject Name First Subject Name First IPSec Security Method Medium AH High ESP Remote Network IP Pemote Network Mask Vigor2830 Series User s Guide 46 cee WANT First v 0 0 0 255 255 255 0 ml Cancel Dray Tek Dray Tek When you choose L2TP you will see the following graphic VPN and Remote Access gt gt VPN Client Wizard VPN Client L2TP Settings Profile Name VPN Dial Out Through L Always on Server IP Host Name for VPN e g 5551234 draytek com or 123 45 67 89 Username Password Remote Network IP Remote Network Mask Cancel When you cho
240. e auto selected auto selected Activate The Activate link brings you accessing into www vigorpro com to finish the activation of the account and the router Authentication Message As for authentication information of web filter the process of authenticating will be displayed on this field for your reference Dray Te k 355 Vigor2830 Series User s Guide Below shows the successful activation of Web Content Filter System Maintenance gt gt Activation Activate via interface auto selected Web Filter License Activate Status Commtouch Start Date 2010 O07 27 Expire Date 2010 08 27 Authentication Message Activated Wiz Activated Wizard query license status Successtul 2010 07 27 05 47 13 Note If you want to use email alert or syslog please configure the SysLog Mail Alert Setup page If you change the service provider the configuration of the function will be reset Vigor2830 Series User s Guide 356 Dr ay Te k 3 18 Diagnostics Diagnostic Tools provide a useful way to view or diagnose the status of your Vigor router Below shows the menu items for Diagnostics Diagnostics 3 18 1 Dial out Triggering Click Diagnostics and click Dial out Triggering to open the web page The internet connection e g PPPoE is triggered by a package sending from the source IP address Diagnostics gt Dial out Triggering Dial out Triggered Packet Header Refresh HEX Format 00 00 00 00 00
241. e Disable Description Click Enable for activating this function If you click Disable this function will be closed and all the settings that you adjusted in this page will be invalid Keep WAN Connection Normally this function is designed for Dynamic IP environments because some ISPs will drop connections if there is no traffic within certain periods of time Check Enable PING to Keep alive box to activate this function PING to the IP If you enable the PING function please specify the IP address for the system to PING it for keeping alive PING Interval Enter the interval for the system to execute the PING operation Vigor2830 Series User s Guide 82 Dray Tek Dray Tek WAN Connection Detection MTU RIP Protocol WAN IP Network Settings Such function allows you to verify whether network connection is alive or not through ARP Detect or Ping Detect Mode Choose ARP Detect or Ping Detect for the system to execute for WAN detection Ping IP If you choose Ping Detect as detection mode you have to type IP address in this field for pinging TTL Time to Live Displays value for your reference TTL value is set by telnet command It means Max Transmit Unit for packet The default setting is 1442 Routing Information Protocol is abbreviated as RIP RFC1058 specifying how routers exchange routing tables information Click Enable RIP for activating this function This group allows
242. e Activation Wizard will be shown as follows Choose the one you need and click Next In this case we choose to activate free trail edition Service Activation Wizard Select the service type that you want to activate This wizard is used for activating Web Content Filter Please choose the edition you need Free trial edition POMP etree ense key Free trial edition it offers a period of trial for you to get acquainted with WCF function Formal edition with license key you can extend the license valid time manually Note If you activate Formal edition with license key first the free trial edition will be invalid Vigor2830 Series User s Guide 40 Dr ay Te k 3 In the following page you can activate the Web content filter services at the same time or individually When you finish the selection please click Next Service Activation Wizard Select the service type that you want to activate This product provides 30 days of free trial please choose the item s you want to use WCF service Web Content Filter BPjM BPjM is the web content filter based on service operated in Germany We recommend only users live in Germany to try the BPjM WCF service This is a free service without guarantee Activation Date Web Content Filter Commtouch License Agreement Commtouch is the web content filter based on Commtouch operated in the worldwide There is a 30 day trial period After trial you can
243. e Traditional German Samba Service Settings Click Enable to invoke samba service via the router Access Mode LAN Only Users coming from internet cannot connect to the samba server of the router LAN And WAN Both LAN and WAN users can access samba server of the router NetBios Name Service For the NetBios service of USB storage disk you have to specify a workgroup name and a host name A workgroup name must not be the same as the host name The workgroup name can have as many as 15 characters and the host name can have as many as 23 characters Both them cannot contain any of the following lt gt Workgroup Name Type a name for the workgroup Host Name Type the host name for the router After finished the above settings click OK to save the configuration 3 16 2 USB User Management This page allows you to set profiles for FTP Samba users Any user who wants to access into the USB storage disk must type the same username and password configured in this page Before adding or modifying settings in this page please insert a USB storage disk first Otherwise an error message will appear to warn you USB Application gt gt USB User Management USB User Management Setto Factory Default Index Username Home Folder Index Username Home Folder PNP Pe eS i FRarEEREBE Dray Te k 329 Vigor2830 Series User s Guide Click index number to access into configuration page USB Application gt gt USB
244. e default setting is private Set one host as the manager to execute SNMP function Please type in Pv4 address to specify certain host Set one host as the manager to execute SNMP function Please type in IPv6 address to specify certain host Set trap community by typing a proper name The default setting is public Set the IPv4 address of the host that will receive the trap community Set the IPv6 address of the host that will receive the trap community The default setting is 10 seconds Check it to enable this function USM means user based security mode Type a username which will be used for authentication Choose one of the encryption methods listed below as the authentication algorithm Type a password for authentication Choose one of the methods listed below as the privacy algorithm No Priv Type a password for privacy 0 Dray Tek 3 17 10 Management This page allows you to manage the settings for Internet Access Control Access List from the Internet Management Port Setup and External Device Control The management pages for IPv4 and IPv6 protocols are different For IPv4 System Maintenance gt gt Management IPv4 Management Setup IPv6 Management Setup Router Name Po Management Port Setup User Define Ports Default Ports C Default Disable Auto Logout Telnet Port Default HTTP Port Default Internet Access Control LJ Allow management from the Internet HTTPS Port Default
245. e executable objects such as ActiveX Java Applet compressed files and other executable files Once downloading these types of files from websites you may risk bringing threat to your system For example an ActiveX control object is usually used for providing interactive web feature If malicious code hides inside it may occupy user s system For example if you add key words such as sex Vigor router will limit web access to web 29 99 sites or web pages such as www sex com www backdoor net images sex p_386 html Or you may simply specify the full or partial URL such as www sex com or sex com Also the Vigor router will discard any request that tries to retrieve the malicious code Click CSM and click URL Content Filter Profile to open the profile setting page CSM gt gt URL Content Filter Profile Oo URL Content Filter Profile Table Setto Factory Default Profile Name Profile Name Z 3 4 Administration Message Max 255 characters Default Message lt hody gt lt center gt lt br gt lt p gt The requested Web page has been blocked by URL Content Filter lt p gt Please contact your system administrator for further information lt center gt lt body gt oK Each item is explained as follows Item Description Set to Factory Default Clear all profiles Profile Display the number of the profile which allows you to click to set different policy Name Display the name of
246. e for dial whenever you need Dr ay Te k 283 Vigor2830 Series User s Guide 3 13 2 SIP Accounts In this section you set up your own SIP settings When you apply for an account your SIP service provider will give you an Account Name or user name SIP Registrar Proxy and Domain name The last three might be the same in some case Then you can tell your folks your SIP Address as in Account Name Domain name As Vigor VoIP Router is turned on it will first register with Registrar using AuthorizationUser Domain Realm After that your call will be bypassed by SIP Proxy to the destination using AccountName Domain Realm as identity Note Selection items for Ring Port will differ according to the router you have VoIP gt SIP Accounts SIP Accounts List Index Profile DomainfRealm Proxy Account Name Codec Ring Port Status 1 G 7294 B Phone1 J Phone2 a 2 G 7294 B Phonei FPhone2 F 3 G 7294 B Phonei Phone 4 G 7294 8 IPhone Phone2 5 G 7294 B Phonei Fhone2 5 G G 7294 B8 Phonei L Phone2 T G 7294 B Phonei Fhone2 z g G 7294 8 Phoneil l Fhonez 9 G 7294 B Phonei J Phone2 10 G 7294 8 Phoneil Phone2 z 1i G 7294 B Phonei J Phone2 12 G 7294 B Phonei Phone F success registered on SIP server fail to register on SIP server NAT Traversal Setting STUN Server SIP PING Interval 150 sec Available settings are explained as follows Item Description Index Click this link to
247. e maximum length of the password you can set is 62 characters Specify an IP address Click this radio button to specify some data IP Address Type in the private IP address Subnet Mask Type in the subnet mask Gateway IP Address Type in gateway IP address Default MAC Address Type in MAC address for the router You can use Default MAC Address or specify another MAC address for your necessity Specify a MAC Address Some Cable service providers specify a specific MAC address for access authentication In such cases you need to click the Specify a MAC Address and enter the MAC address in the MAC Address field 79 Vigor2830 Series User s Guide DNS Server IP Address Type in the primary IP address for the router If necessary type in secondary IP address for necessity in the future Details Page for PPPoE in WAN2 To choose PPPoE as the accessing protocol of the Internet please select PPPoE from the WAN gt gt Internet Access gt gt WAN2 page The following web page will be shown WAN gt gt Internet Access WAN PPPoE Static or Dynamic IP PPTP L2TP IPvo Enable Disable PPP MP Setup PPP Authentication PAP or CHAP w Idle Timeout 1 secondis Service Name Optional IP Address Assignment Method IPCP ISP Access Setup Username fF Aas Password Lo Fixed IPF Yes No Dynamic IP Index 1 15 in Schedule Setup Fixed IP Address sE PEC PEC IE Defau
248. e of idle timeout should be specified in Idle Timeout field Disable Dial On Demand Specify the connection to be up when it has traffic on the line Once there is no traffic over idle timeout the connection will be down and never up again during the schedule Idle Timeout Specify the duration or period for the schedule How often Specify how often the schedule will be applied Once The schedule will be applied just once Weekdays Specify which days in one week should perform the schedule 3 Click OK button to save the settings Example Suppose you want to control the PPPoE Internet access connection to be always on Force On from 9 00 to 18 00 for whole week Other time the Internet access connection should be disconnected Force Down Office a 2 au 12 Hour f A h Force On 7 5 7 5 Mon Sun 9 00 am to 6 00 pm Make sure the PPPoE connection and Time Setup is working properly Configure the PPPoE always on from 9 00 to 18 00 for whole week Configure the Force Down from 18 00 to next day 9 00 for whole week oe I Assign these two profiles to the PPPoE Internet access profile Now the PPPoE Internet connection will follow the schedule order to perform Force On or Force Down action according to the time plan that has been pre defined in the schedule profiles Vigor2830 Series User s Guide 230 Dr ay Tek 3 10 4 RADIUS Remote Authentication Dial In User Service RADIUS is a security authe
249. e profile s of CSM Content Security Management for IM P2P URL Web Content Filter application is enabled from Firewall gt gt General Setup Such profile must be established under CSM menu Wireless access point is ready It will blink slowly while wireless traffic goes through If ACT and WLAN LEDs blink quickly and simultaneously when WPS is working and it will return to normal condition after two minutes You need to setup WPS within 2 minutes The router is ready to access Internet through DSL link Slowly The DSL connection is ready Quickly The data is transmitting The WAN2 connection is ready It will blink while transmitting data The DoS DDoS function is active It will blink while an attack is detected The VPN tunnel is active The QoS function is active The port is connected The port is disconnected The data is transmitting The port is connected with 1000Mbps The port is connected with 10 100Mbps when left LED is on The port is connected The port is disconnected The data is transmitting The port is connected with 1000Mbps The port is connected with 10 100Mbps when left LED is on Dray Tek e 2830n ONOF FANT S curity Firewall TITE EN Fi GigaLAN 1 2 3 DSL WAN2 Giga use PWR rw 5 k Interface Description Wireless LAN Press Wireless LAN ON OFF WPS button once to wait for client device ON OFF WPS making network connection through WPS Press Wireless LAN ON
250. e provided by ISP Auto detect Click this button to have the VPI and VCI to be detected by the system automatically VCI Type in the value provided by ISP Protocol There are several modes offered for you to choose for Encapsulation WANI interface Fixed IP Click Yes to enable Fixed IP feature IP Address Type the IP address if Fixed IP is enabled Subnet Mask Type the subnet mask Primary DNS Type in the primary IP address for the router Secondary DNS Type in secondary IP address for necessity in the future Back Click it to return to previous setting page Next Click it to get into the next setting page Cancel Click it to give up the quick start wizard 2 Please type in the IP address mask gateway information originally provided by your ISP Then click Next for viewing summary of such connection Quick Start Wizard Please confirm your settings WAN Interface WEAR 1 Physical Mode ADSL Physical Type Auto negotiation PT 0 VOT a3 Protocol Encapsulation 1483 Bridge LLC Fixed IP No Primary DNS 8 8 8 8 Secondary DNS 6 8 4 4 3 Click Finish A page of Quick Start Wizard Setup OK will appear Then the system status of this protocol will be shown Quick Start Wizard Setup OK H 4 Now you can enjoy surfing on the Internet Vigor2830 Series User s Guide 28 Dr ay Tek 2 1 2 For WAN2 Ethernet WAN2 is dedicated to physical mode in Ethernet If you choose WAN2 please specify physical type
251. e the RIP protocol DHCP stands for Dynamic Host Configuration Protocol The router by factory default acts a DHCP server for your network so it automatically dispatch related IP settings to any local user configured as a DHCP client It is highly recommended that you leave the router enabled as a DHCP server if you do not have a DHCP server for your network If you want to use another DHCP server in the network other than the Vigor Router s you can let Relay Agent help you to redirect the DHCP request to the specified location Enable Server Let the router assign IP address to every host in the LAN Disable Server Let you manually assign IP address to every host in the LAN Enable Relay Agent Specify which subnet that DHCP server is located the relay agent should redirect the DHCP request to Start IP Address Enter a value of the IP address pool for the DHCP server to start with when issuing IP addresses If the Ist IP address of your router is 192 168 1 1 the starting IP address must be 192 168 1 2 or greater but smaller than 192 168 1 254 IP Pool Counts Enter the maximum number of PCs that 107 Vigor2830 Series User s Guide you want the DHCP server to assign IP addresses to The default is 50 and the maximum is 253 Gateway IP Address Enter a value of the gateway IP address for the DHCP server The value is usually as same as the 1st IP address of the router which means the router is the default gatewa
252. e these settings Ethernet Type Please specify which protocol IPv4 or IPv6 will be used for this rule Local Address Click the Edit button to set the local IP address on LAN for the rule Remote Address Click the Edit button to set the remote IP address on LAN WAN for the rule Dr ay Te k 219 Vigor2830 Series User s Guide Edit It allows you to edit source address information E htip 192 168 1 1 doc QosIpEdt htm Microsoft Internet Explorer Address Type Subnet Address M Start IP Address 0 0 0 0 End IP Address Subnet Mask 0 0 0 0 Address Type Determine the address type for the source address For Single Address you have to fill in Start IP address For Range Address you have to fill in Start IP address and End IP address For Subnet Address you have to fill in Start IP address and Subnet Mask DiffServ CodePoint All the packets of data will be divided with different levels and will be processed according to the level type by the system Please assign one of the levels of the data for processing with QoS control Service Type It determines the service type of the data for processing with QoS control It can also be edited You can choose the predefined service type from the Service Type drop down list Those types are predefined in factory Simply choose the one that you want for using by current QoS 4 After finishing all the settings here please click OK to save the config
253. e to connect your devices correctly 1 Connect the ADSL interface to the external ADSL splitter with an ADSL line cable for all models For Vigor2830Vn also connect Line interface to external ADSL splitter LINE MODEM Line DSL 2 Connect one end of an Ethernet cable RJ 45 to one of the LAN ports of the router and the other end of the cable RJ 45 into the Ethernet port on your computer 3 Connect the telephone set with phone lines for using VoIP function For the model without phone ports skip this step 4 Connect one end of the power adapter to the router s power port on the rear panel and the other side into a wall outlet Power on the device by pressing down the power switch on the rear panel 6 The system starts to initiate After completing the system test the ACT LED will light up and start blinking For the hardware connection we take Vn model as an example Analog Phone Analog Phone Land line jack POTS O Cable DSL Modem k Madia Converter Power Adapter ADSL g waos dota a i Phone Ass i Adapter la o ji an ne O me E f aes Peace yale Vigpr2830V j i 6 Dray Y2 Deant kaai if pete hey 6 o Gr m r so mi pm mi ri Mi oo Ti A A i I Biel CEN WAH Phased s La a j Vigor2830 Series User s Guide 8 Dr ay Te k 1 3 Printer Installation You can install a printer onto the router for sharing printing All the PCs connected thi
254. ease click on the activation link in the email Personal Information to activate your account E Preferences START 8 Check to see the confirmation email with the title of New Account Confirmation Letter from myvigor draytek com wkk This is an automated message trom myvigor draytek com Thank you Mary for creating an account Please click on the activation link below to actrvate your account Link Activate my Account 9 Click the Activate my Account link to enable the account that you created The following screen will be shown to verify the register process is finished Please click Login Register Search for this site YY Register Confirm Thank for your register in VigerPro Web Site The Register process is completed Dr ay Tek 425 Vigor2830 Series User s Guide 10 When you see the following page please type in the account and password that you just created in the fields of UserName and Password This service is available for MyVigor member only Please login to access MyVigor If you are not one of the members of MyVigor please create an account first LOGIN Auth Code T hel T4he1C lf you cannot read the word Click here Forget password Don t have a My iger Account Y Create an account now If you are having difficulty logging in contact our customer service Customer Service B86 3 597 2727 oF email to Webmasteradraytek com 11 Now click Login Your account has been act
255. eave other fields and click OK Vigor2830 Series User s Guide 412 Dr ay Te k 4 10 Upgrade Firmware for Your Router Using Firmware Upgrade Utility Before upgrading your router firmware you need to install the Router Tools The Firmware Upgrade Utility is included in the tools 1 Goto www DrayTek com 2 Access into Support gt gt Downloads Please find out Firmware menu and click it Search the model you have and click on it to download the newly update firmware for your router About DrayTek Products Support Education Partners Contact Us Home gt Support gt Downloads Downloads Firmware Downloads Model Name Firmware Version Release Date Firmware Vigor120 series ca 26 06 2009 Driver Vigor2100 series 2 6 2 26 02 2008 Utility Vigor2104 series Fh 13 02 2008 Utility Introduction Vigor2110 series 3 3 0 25 06 2009 e Datasheet Vigor2200 X W E 2 3 11 22 09 2004 R amp TTE Certification Vigor2200Eplus 2 5 7 18 02 2009 Vigor2200USB 2 3 10 16 03 2005 3 Access into Support gt gt Downloads Please find out Utility menu and click it About DrayTek Products Education Partners Contact Us Support Home gt Support gt Utility Tools Name Release Date Version os Support Model Er Router Tools 2009 06 18 4 2 0 MS Windows All Modules i _ _ Driver Syslog Tools 2009 06 18 4 2 0 MS Windows XP All Modules
256. ebpage with the characters listed on Group Object Selections If the web pages do not match with the specified feature set here they will be processed with the categories listed on the Block restrict accessing into the corresponding webpage with the characters listed on Group Object Selections If the web pages do not match with the specified feature set here they will be processed with the categories listed on the Item Description Black White List box below box below Action Dray Tek Pass allow accessing into the corresponding webpage with the categories listed on the box below Block restrict accessing into the corresponding webpage with the categories listed on the box below 207 Vigor2830 Series User s Guide If the web pages do not match with the specified feature set here it will be processed with reverse action Log None There is no log file will be recorded for this profile Pass Only the log about Pass will be recorded in Syslog Block Only the log about Block will be recorded in Syslog All All the actions Pass and Block will be recorded in Syslog After finishing all the settings here please click OK to save the configuration 3 8 4 DNS Filter The DNS Filter monitors DNS queries on UDP port 53 and will pass the DNS query information to the WCF to help with categorizing HTTPS URL s Note For DNS filter must use the WCF service profile to filter the packets therefore WCF li
257. eck Enable Web Syslog specify the type of Syslog and choose the display mode you want Later the event of Syslog with specified type will be shown for your reference USB Application gt gt Syslog Explorer Web Syslog USB Syslog L Enable Web Syslog Export Refresh Clear Syslog Type User Display Mode Stop record when fulls e Time Message Available settings are explained as follows Item Description Enable Web Syslog Check this box to enable the function of Web Syslog Syslog Type Use the drop down list to specify a type of Syslog to be displayed User Refresh Click this link to refresh this page manually Clear Click this link to clear information on this page Display Mode There are two modes for you to choose Dray Te k 367 Vigor2830 Series User s Guide Meelis lulls Stoo record when fulls Always record the new event Stop record when fulls when the capacity of syslog is full the system will stop recording Always record the new event only the newest events will be recorded by the system Time Display the time of the event occurred Message Display the information for each event For USB Syslog This page displays the syslog recorded on the USB storage disk USB Application gt gt Syslog Explorer Web Syslog USB Syslog Folder n a File n a Page n a Log Type n a Time Log Type Message Available settings are explained as follows Item Description Time Display the ti
258. eck if you have the search authority For the regular mode you ll need to type in the Regular DN and Regular Password 3 Create LDAP server profiles Click the Active Directory LDAP tab to open the profile web page and click any one of the index number link If we have two groups RD1 and SHRD on LDAP server we can configure two LDAP server profiles with different Group Distinguished Name Vigor2830 Series User s Guide 430 Dr ay Tek Applications gt gt Active Directory LDAP gt gt Server Profiles Index No 1 Mame rd Common Name Identifier uid Base Distinguished Mame ou people de ms dc draytek dc co Additional Filter ch rdi ou group dc ms dc draytek d Note Plaase type in your additional filter for BaseON search request For example 1 For OpenLDAP fgidNumber 500 2 For 40 mshPAllowDialin TRUE Group Distinguished Name SS and Applications gt Active Directory LDAP Server Profiles Index No 2 Common Name Identifier uid Base Distinguished Name Additional Filter Note Please type in your additional filter for BaseDN search request For example 1 For OpenLDAP gidNumber 5003 21 For AD msNPAllowDialin TRUE Group Distinguished Name SS 4 Click OK to save the settings above Applications gt Active Directory LDAP Active Directory LDAP Active Directory General Setup LDAP Profiles Index Name L I rdi 2 shra 3 DrayTek i Vigo
259. ecome green Advanced This button allows you to configure DHCP client options DHCP packets can be processed by adding option number and data information when such function is enabled and configured Vigor2830 Series User s Guide 72 Dr ay Tek WAN gt gt Internet Access DHCP Client Options Status Options List Enable Interface Option Enable 4 Interface iei WAN2 WANS WANS WANG WAN Option Number DataType String Raw Byte in Hex Example of Raw Byte Data Type Input Format 2f 70 61 7468 31 Data Add Delete Note Option 61 has been given a default value You can configure option 61 Client Identifier in WAN gt gt Interface Access page If you choose to configure option 61 here the settings in WAN gt gt Interface Access Details Page will be overwritten Option 12 is reserved you cannot configure it here but you can configure it in Router Name field of WAN gt gt Interface Access Enable Disable Enable Disable the function of DHCP Option Each DHCP option is composed by an option number with data For example Option number 100 Data abcd When such function is enabled the specified values for DHCP option will be seen in DHCP reply packets Interface Specify the WAN interface s that will be overwritten by such function WANS WAN7 can be located under WAN gt gt Multi PVCs Option Number Type a number for such function Note If you choose to c
260. econd and 10 seconds respectively That means when 250 packets per second received they will be regarded as attack event and the session will be paused for 10 seconds Port Scan attacks the Vigor router by sending lots of packets to many ports in an attempt to find ignorant services would respond Check the box to activate the Port Scan detection Whenever detecting this malicious exploration behavior by monitoring the port scanning Threshold rate the Vigor router will send out a warning By default the Vigor router sets the threshold as 2000 packets per second That means when 2000 packets per second received they will be regarded as attack event Check the box to activate the Block IP options function The Vigor router will ignore any IP packets with IP option field in the datagram header The reason for limitation is IP option appears to be a vulnerability of the security for the LAN because it will carry significant information such as security TCC closed user group parameters a series of Internet addresses routing messages etc An eavesdropper outside might learn the details of your private networks Check the box to enforce the Vigor router to defense the Land attacks The Land attack combines the SYN attack technology with IP spoofing A Land attack occurs when an attacker sends spoofed SYN packets with the identical source and destination addresses as well as the port number to victims Check the box to
261. ed the use can type the URL of the router from any browser Then a login window will be popped up and ask the user to type the user name and password for authentication If succeed a Welcome Message configured in User Management gt gt General Setup will be displayed After authentication the destination URL if requested by the user will be guided automatically by the router Alert Tool If it is selected the user can open Alert Tool and type the user name and password for authentication A 165 Vigor2830 Series User s Guide Item Landing Page Index 1 15 in Schedule Setup Enable Time Quota Enable Data Quota Vigor2830 Series User s Guide Description window with remaining time of connection for such user will be displayed Next the user can access Internet through any browser on Windows Note that Alert Tool can be downloaded from DrayTek web site Telnet If it is selected the user can use Telnet command to perform the authentication job When a user tries to access into the web user interface of Vigor router series with the user name and password specified in this profile he she will be lead into the web page configured in Landing Page field in User Management gt gt General Setup Check this box to enable such function You can type in four sets of time schedule for your request All the schedules can be set previously in Application gt gt Schedule web page and you can use the number that
262. ed Find more Web Content Filter Profile Table Setto Factory Default Profile Name Profile Default gt fees oe Administration Message Max 255 characters Default Message Cache L1 L Cache lt body gt lt center gt lt hr gt lt hr gt lt br gt lt p gt The requested Web page lt hr gt from S1IP lt br gt to URL lt br gt that 13 categorized with CLs lt br gt has been blocked by RNVANES Web Content Filter lt p gt Please contact your system administrator for further information lt center gt body Legend Available settings are explained as follows Dray Tek Item Activate Setup Query Server Setup Test Server Find more Set to Factory Default Default Message Description Click it to access into MyVigor for activating WCE service It is recommended for you to use the default setting auto selected You need to specify a server for categorize searching when you type URL in browser based on the web content filter profile It is recommended for you to use the default setting auto selected Click it to open http myvigor draytek com for searching another qualified and suitable server Click this link to retrieve the factory settings You can type the message manually for your necessity or click this button to get the default message which will be displayed on the field of Administration Message 205 Vigor2830 Series User s Guide Cache None the router will check
263. ed as follows Description Type a name for such profile The length of the file is limited to 10 characters This field is used to authenticate for connection when you select PPTP or L2TP with or without IPSec policy above This field is used to authenticate for connection when you select PPTP or L2TP with or without IPSec policy above For PSec L2TP IPSec authentication you have to type a pre shared key Type the pre shared key again for confirmation Check the box of Digital Signature to invoke this function Use the drop down list to choose one of the certificates for using You have to configure one certificate at least previously in Certificate Management gt gt Local Certificate Otherwise the setting you choose here will not be effective Type the WAN IP address or VPN client IP address for the remote client Type the ID name for the remote client Please type one LAN IP address according to the real location of the remote host for building VPN connection Please type the network mask according to the real location of the remote host for building VPN connection 53 Vigor2830 Series User s Guide 3 After finishing the configuration please click Next The confirmation page will be shown as follows If there is no problem you can click one of the radio buttons listed on the page and click Finish to execute the next action VPN and Remote Access gt VPN Server Wizard Please Confirm Your Settings
264. ed in the advanced settings page of Phone Index RTP Symmetric RTP Check this box to invoke the function To make the data transmission going through on both ends of local router and remote router not misleading due to IP lost for example sending data from the public IP of remote router to the private IP of local router you can check this box to solve this problem Dynamic RTP Port Start Specifies the start port for RTP stream The default value is 10050 Dynamic RTP Port End Specifies the end port for RTP stream The default value is 15000 RTP TOS It decides the level of VoIP package Use the drop down list to choose any one of them IPF precedence 1 IP precedence 2 IP precedence 3 IP precedence 4 IP precedence 5 IPF precedence b IPF precedence AF Class Low Drop AF Class Medium Drop AF Class High Drop AP Classe Low Drop AP Class hMledcium Drop AF Classe High Drop AF Classa Low Drop AF Class Medium Crap AF Classs High Drop AP Class4 Low Drop AP Class4 Medium Drop AF Class4 High Drop EF Class Dr ay Te k 289 Vigor2830 Series User s Guide Detailed Settings for Phone Port Click the number link for Phone port you can access into the following page for configuring Phone settings VoIP gt gt Phone Settings Phone Call Feature Default SIP Account I Hotline O CL Play dial tone only when account registered L Session Timer Sec CO T 38 Fax Fun
265. ed settings in three pages Advance Mode all settings in one page 5 Click Index number 1 and 2 to configure the details After finished the settings click OK to save the settings respectively Load Balance Route Policy Index 1 W Enable Criteria Source IP O Any Src IP Start Src IP End 192 169 1 16 ew 192 168 11 31 Destination IP 3 Any Dest IP Start Dest IF End rat i Any Destination Part Dest Port Start Dest Port End rt Send to if Criteria Matched Interface WAR w Interface Address w Gateway IP Default Gateway Specific Gateway More Options O Auto Failover to the Other WAN Packet Forwarding to WAN Force NAT via Force Routing Vigor2830 Series User s Guide 438 Dr ay Te k And Load Balance Route Policy Index 2 W Enable Criteria Protocol Ary Source IP Any Src IP Start Src IF End Destination IP Any O Dest IP Start Dest IP End eC E D Any Destination Port Dest Port Start Dest Port End Loo de E Send to if Criteria Matched Interface WANA w Interface Address 2 202 211 100 11 w Gateway IP Default Gateway Specific Gateway O More Options O Auto Failover to the Other WAN Facket Forwarding to WAN Force NAT via Force Routing 6 Upon completing the above configuration you have specified the outgoing IP address es for some specific computers Load Balance Route Policy we Load Balance Route Policy Set to Factory Default
266. ee iaia daai aii eeni a aaia 16 1 5 Changing PassWord x2coesta grace tecarobacinasaencenascoautanatetases sence temeteiogsta aude tnactebectadwencs ited iecetecaaeoe 17 Fe ONNE AS a A E a 19 16 1 Physical MM CONN diesen etre csiecttceacie ee ccrictieae sesso cine eaeeteacdtitctdeeaeancngonecaeegeadecaeteanaedeacias 19 1O 2 VIIA WAIN ee E E E 21 Daf SAVING COMMUNAL Os cre cscsasascnncnosisiaxien stecacsesieen acteinoanswnaeanwelotesaewenasinestinetandaveasssesdiesioaswenanbcaste 21 TG OUD ari E seen ee E E E 23 PA EET oE TAA E A E AE E E EA 23 2 Wed FOr NANT CPO eE AE 24 Zils For WAN2 Eterne D scdunsanatnsanneadsnelactaiannideasndsiidadabnGdoathaswatdsunelaaniimawaidwsaasunissinla Seaaieemaditons 29 PFO NAN U E en e E E E 38 2 2 Service Activation WIZAMA c00sccceccceecsccseseeeceecccccesceeeeceeccccossenseceeesccsseeeeeeeesesacesseeceseees 40 PVEN OEE NE en E E cee ee 44 Oe PIN o aN VV ZN aare E E A TA E A 50 ZV MVS SS Wiza d ssir a R R E E S 55 rA olaa E EARE EIT EE A suai NE ETN AAE E E E EN 58 Zar WACOISI CMG Vigor ROUTO ennnen a E 59 Advanced Configuration iiinsis cvs cscecnad cect ssmcsnnscnuesseusnntcnsuvaucsessueusseunsesnessiceetens 63 TANWAR eee ee ee eee eee 63 3 1 1 Basics of Internet Protocol IP N tWork cccceccccseeeeeseeseeeceeseeeeseeeeeeseseessaneeessaneess 63 ey feral 1 19 2 f e 1 0 eee ee eee en eee ee eee ee ee ee 65 Oe We IMC WIL PCC S aea du ssmtecnnatanaesaesamnchac E E 71 Oe Ve IMO VS
267. ek com for an example LAN gt Web Portal Setup Profile Index 1 Disable URL Redirect fwwwarayekcom r F E a Lay yo i Mote If the User Management application is enabled it will override the Web Portal settings seen here thi lt font color red gt igor fonte lt hl gt lt he gt Reliable connectivity he gt lt he gt Robust firewall protections he gt the gt Multi site secure communication he gt OMessage Mas 255 characters Applied Interfaces Citan1 CILAN CLANS IJLAN4 Oss Clssip2 Ossis Cssipa Vigor2830 Series User s Guide 390 Dray Tek 3 Click OK to save the settings Note that do not choose Redirect to URL for this page if you have already enabled the user based mode under User Management For such case choosing Show the message will be accepted Note This feature is useful for restaurant hotel shopping store and so on Wireless clients will be redirected to the specified web sites when they open the browser through the wireless environment set by the restaurant hotel shopping store and so on It can gain the result of advertisement effectively 4 Use a Notebook or mobile device supporting Wireless function to connect Vigor2830 via Wireless LAN i Wireless Network Connection Status wale General Support Connection Status Connected Network Vigor2830 web portal log in Duration 00 03 38 Speed 54 0 Mbps Signal Strength anil Activity Sent
268. elect the available public port and then forward it At the same time the router shall list an entry in a table to memorize this address port mapping relationship When the public server response the incoming traffic of course is destined to the router s public IP address and the router will do the inversion based on its table Therefore the internal host can communicate with external host smoothly The benefit of the NAT includes Save cost on applying public IP address and apply efficient usage of IP address NAT allows the internal IP addresses of local hosts to be translated into one public IP address thus you can have only one IP address on behalf of the entire internal hosts Enhance security of the internal network by obscuring the IP address There are many attacks aiming victims based on the IP address Since the attacker cannot be aware of any private IP addresses the NAT function can protect the internal network On NAT page you will see the private IP address defined in RFC 1918 Usually we use the 192 168 1 0 24 subnet for the router As stated before the NAT facility can map one or more IP addresses and or service ports into different specified services In other words the NAT function can be achieved by using port mapping methods Below shows the menu items for NAT 3 4 1 Port Redirection Port Redirection is usually set up for server related service inside the local network LAN such as web servers
269. encryption algorithm and apply MD5 or SHA 1 authentication algorithm 3DES without Authentication Use triple DES encryption algorithm and not apply any authentication scheme 3DES with Authentication Use triple DES encryption algorithm and apply MDS or SHA 1 authentication algorithm AES without Authentication Use AES encryption algorithm and not apply any authentication scheme AES with Authentication Use AES encryption algorithm and apply MD5 or SHA 1 authentication algorithm Advanced Specify mode proposal and key life of each IKE phase Gateway etc The window of advance setup is shown as below 256 Dray Tek fe I youre miar 8 ed irew loire Reg leer ji EA E pT eE L Aat ha HE imithiniticed atte IKE phase 1 mode Select from Main mode and Aggressive mode The ultimate outcome is to exchange security proposals to create a protected secure channel Main mode is more secure than Aggressive mode since more exchanges are done in a secure channel to set up the IPSec session However the Aggressive mode is faster The default value in Vigor router is Main mode Dray Tek IKE phase 1 proposal To propose the local available authentication schemes and encryption algorithms to the VPN peers and get its feedback to find a match Two combinations are available for Aggressive mode and nine for Main mode We suggest you select the combination that covers the most schemes IKE phase 2 proposal To propose the local
270. ent you PinCode wish to connect and click Start PIN button The WPS LED on the router will blink fast when WPS is in progress It will return to normal condition after two minutes You need to setup WPS within two minutes Dray Te k 305 Vigor2830 Series User s Guide 3 14 6 WDS WDS means Wireless Distribution System It is a protocol for connecting two access points AP wirelessly Usually it can be used for the following application Provide bridge traffic between two LANs through the air Extend the coverage range of a WLAN To meet the above requirement two WDS modes are implemented in Vigor router One is Bridge the other is Repeater Below shows the function of WDS bridge interface LAN3 _ LANI LAN2 The application for the WDS Repeater mode is depicted as below Host with Host with Host with bridge Interface 1 repeater Interface bridge Interface 2 v Y me a os M ww a lya m ee ee ne es ec A eeeeses The major difference between these two modes is that while in Repeater mode the packets received from one peer AP can be repeated to another peer AP through WDS links Yet in Bridge mode packets received from a WDS link will only be forwarded to local wired or wireless hosts In other words only Repeater mode can do WDS to WDS packet forwarding Vigor2830 Series User s Guide 306 Dr ay Te k In the following examples hosts connected to Bridge 1 or 3 can communica
271. entry on the phonebook the router will try to make the call being protected But if the call ends up unprotected e g peer side does not support ZRTP SRTP the router will not play out a warning message Dr ay Te k 275 Vigor2830 Series User s Guide Phone Book In this section you can set your VoIP contacts in the phonebook It can help you to make calls quickly and easily by using speed dial Phone Number There are total 60 index entries in the phonebook for you to store all your friends and family members SIP addresses Loop through and Backup Phone Number will be displayed if you are using Vigor2830Vn for setting the phone book VoIP gt gt DialPlan Setup Phone Book Phone Display Dial Out iii Secure Index icin SIP URL Loop through Phone Status number Name Account Phone Number i Default None None x 2 Default None None x Je Default None None x 4 Default None None x 5 Default None None x 6 Default None None x 15 Default None None X 16 Default None None x ti Default None None x 16 Default None None x 19 Default None None x 20 Default None None x lt lt 120 2140 41 60 gt gt Next gt gt Status v Active x Inactive Click any index number to display the dial plan setup page VoIP gt DialPlan Setup Phone Book Index No 1 Enable Display Name Polly SIP URL 1112 fwd pulver com Dial Out Account Loop through Backup Phone Number fs Secure Phone None ZRTIP SRIP O a
272. er s Guide 2 The configuration page will be shown as follows Objects Setting gt gt IP Group Profile Index 1 Hame Administration Interface Available IP Objects Selected IP Objects 1 F Department 2 Financial Dept 3 HR Department Available settings are explained as follows Item Description Name Type a name for this profile Maximum 15 characters are allowed Interface Choose WAN LAN or Any to display all the available IP objects with the specified interface Available IP Objects All the available IP objects with the specified interface chosen above will be shown in this box Selected IP Objects Click gt gt button to add the selected IP objects in this box 3 After finishing all the settings here please click OK to save the configuration Objects Setting gt IP Group IP Group Table Setto Factory Default Index Mame Index Mame le Administration i 2 18 J 9 Vigor2830 Series User s Guide 174 Dr ay Te k 3 7 3 IPv6 Object You can set up to 64 sets of IPv6 Objects with different conditions Objects Setting gt gt IPv6 Object IPvb Object Profiles Setto Factory Default Index Name Index Name a oo oo Pe Pe PR Pe Pao Pa Pe PR PR Pe em fe et SO oe fe PS et J a FRaEB RE Bre PrP rPPreee eB Pel 33 4 gt gt Next gt gt lt z 13 Available settings are explained as follows Item Description Set to Factory Defau
273. er or an experienced radio TV technician for help This device complies with Part 15 of the FCC Rules Operation is subject to the following two conditions 1 This device may not cause harmful interference and 2 This device may accept any interference received including interference that may cause undesired operation The antenna transmitter should be kept at least 20 cm away from human body Please visit http www draytek com user SupportDLRTTECE php D ra y T e k v Vigor2830 Series User s Guide Vigor2830 Series User s Guide vi Dr ay Te k Table of Contents Introduction oie sstue see cieesevas ae ccse srs esesesdunceenstansaveswunssenstancriestvestuedianirsesesacuenadens 1 1 1 LED Indicators ANd Connectors 2 0 0 ccceeeeccccceeeceeeeeeeeeeeeeeceeeeseeceeeeesseaeseeeeeessaaeaeeeeeeesssaaaaeess 2 Medel TOP VIGOLZS 20 nieee a E E 2 1 1 2 For Vigor2830n VigOr2830Nn plus cccccceeececceeeeeeceeeeeeeceeseeeeeeeeesseeseeeseageeessaeeeeeneeeeesaaes 4 1 1 3 For Vigor2830Vn Vigor2830VN plUS ccccceccceceseeeeceeeeecseeeeeeseaseeeseaseeesseeeessaneeeeaeeeeesaags 6 1 2 Hardware Installation cccccccccssscccseeeceseeecececseeeeeseeeeceeeeeseaeeesaeeessaeeeseuseesageessueeessaeeesseaeeess 8 1 3 Printer Installation cccccccccsssecccesseeceeseeecseeececseuseeeseaseeecsaseecseaseeessageessaeeesseuseesssassesessageees 9 1 4 ACCESSING Web Page iccecctinsranseecouasanctedaeseamenndcceiadanatateswal
274. eries User s Guide Vigor2830 Series User s Guide Compression is used for TCP IP protocol header compression Normally set to Yes to improve bandwidth utilization IKE Authentication Method This group of fields is applicable for IPSec Tunnels and L2TP with IPSec Policy Pre Shared Key Input 1 63 characters as pre shared key Digital Signature X 509 Click Digital Signature to invoke this function and select one predefined Profiles set in the VPN and Remote Access gt gt IPSec Peer Identity as Peer ID Local ID Specify which one will be inspected first Alternative Subject Name First The alternative subject name configured in Certificate Management gt gt Local Certificate will be inspected first Subject Name First The subject name configured in Certificate Management gt gt Local Certificate will be inspected first Local Certificate Select one of the profiles set in Certificate Management gt gt Local Certificate IPSec Security Method This group of fields is a must for IPSec Tunnels and L2TP with IPSec Policy Medium AH Authentication Header means data will be authenticated but not be encrypted By default this option is active High ESP Encapsulating Security Payload means payload data will be encrypted and authenticated Select from below DES without Authentication Use DES encryption algorithm and not apply any authentication scheme DES with Authentication Use DES
275. ernet which usually helps some special applications such as Netmeeting or Internet Games etc Vigor2830 Series User s Guide 134 Dr ay Te k Destined to Internet 220 135 240 207 Protocol Any Port Any The security properties of NAT are somewhat bypassed if you set up DMZ host We suggest you to add additional filter rules or a secondary firewall Click DMZ Host to open the following page NAT gt gt DMZ Host Setup DMZ Host Setup WAN1 WAN WANS Private IP Choose PC MAC Address of the True IP DMZ Host foo foo foo Joo foo Note When a True IP DMZ host is turned on it will force the router s WAN connection to be always on Available settings are explained as follows Description Choose Private IP or Active True IP first Active True IP selection is available for WAN1 only WAN 1 Private IP Active True IF Private IP Enter the private IP address of the DMZ host or click Choose PC to select one Choose PC Click this button and then a window will automatically pop up as depicted below The window consists of a list of private Dray Tek 135 Vigor2830 Series User s Guide IP addresses of all hosts in your LAN network Select one private IP address in the list to be the DMZ host 3 nmo fa OX 142 168 1 10 142 168 1 15 When you have selected one private IP from the above dialog the IP address will be shown on the following screen Click OK to save the setting NAT
276. es Vigor2830 series provides two level management to simplify the configuration of network connection The user mode allows user accessing into WEB interface via simple configuration However if users want to have advanced configurations they can access into WEB interface through admin mode Firewall Block P2P Peer to Peer file sharing programs e g Kazaa WinMX etc Block Instant Messaging programs e g IRC MSN Yahoo Messenger Main Office a Q amp Q Web FTP ERP Mail a 1 lt gt Server Server Server Server USEI 3 5G modem 4 a h eri rui Gigabit Cable DSL VDSL2 f modem AN1 up to 150 Mbps DSL Line Branch Office Dr ay Tek 1 Vigor2830 Series User s Guide 1 1 LED Indicators and Connectors Before you use the Vigor router please get acquainted with the LED indicators and connectors first 1 1 1 For Vigor2830 Drey Tek ACT WOOF Dos CSM WAN2 Od Vigor2830 ADSL Securi ty Firewa lI gt O Q G USB DSL VPM Factory D O O ttt i i Remei 2 3 4 DSL USB GigaLAn amp 1 LED Status ACT Activity Blinking Off USB Blinking i Blinking WAN2 Blinking DoS Blinking VPN Qos LED on Connector Left LED GigaLAN Green 1 2 3 4 Blinking Right LED Green Off Left LED WAN 2 Giga Green Blinking Right LED Green Off Vigor2830 Series User s Guide 2 WAME Giga Explanation The router is powered on and running normally The router is po
277. ess Assignment for Dial In Users When DHCP Disable set Assigned IP start LAN 1 LAN 2 wan 3 LAN 4 For using PSec based service such as IPSec or L2TP with IPSec Policy you have to set general settings in IPSec General Setup such as the pre shared key that both parties have known Vigor2830 Series User s Guide 396 Dr ay Te k VPN and Remote Access gt IPsec General Setup VPN IKEAP Sec General Setup Dial in Set up for Remote Dial in users and Dynamic IP Client LAM to LAM IKE Authentication Method Certificate for Dial in Pre Shared Key pre shared Key eT Confirm Pre sharedkey IPsec Security Method Medium AH Data willbe authentic but will not be encrypted High ESP IDES M 3pES MAES Data willbe encrypted and authentic Go to LAN to LAN Click on one index number to edit a profile 4 Set Common Settings as shown below You should enable both of VPN connections because any one of the parties may start the VPN connection VPN and Remote Access gt gt LAH to LAN Profile Index 1 1 Common Settings Profile Name Call Direction Both Dial Gut Dial in C Enable this profile O Always on 4Idle Timeout YPN Dial Out Through WAM First Enable PING to keep alive Netbios Naming Packet Pass Block PING to the IP f Multicast via VPN OPpass Block for some IGMP IP Camera DHCP Relay etc Dray Te k 397 Vigor2830 Series User s Guide 5 Set Dial Out Settings a
278. ess type Type the end IP address if the Range Address type is selected Type the subnet mask if the Subnet Address type is selected If it is checked all the IPv6 addresses except the ones listed above will be applied later while it is chosen 3 After finishing all the settings here please click OK to save the configuration Vigor2830 Series User s Guide 176 Dray Tek 3 7 4 IPv6 Group This page allows you to bind several IPv6 objects into one IPv6 group Objects Setting gt IP Group IPv Group Table Setto Factory Default Index Name Index Name 1 17 2 18 3 13 4 20 J 21 i 23 8 24 J 23 10 26 12 8 16 32 Available settings are explained as follows Item Description Set to Factory Default Clear all profiles Index Display the profile number that you can configure Name Display the name of the group profile To set a new profile please do the steps listed below 1 Click the number e g 1 under Index column for configuration in details Objects Setting gt gt IP Group IPvo Group Table Dr ay Tek 177 Vigor2830 Series User s Guide 2 The configuration page will be shown as follows Objects Setting gt IPvo Group Profile Index 1 Name vE groupt Available IPv Objects Selected IPG Objects 1 v6_ob_1 Available settings are explained as follows Item Description Name Type a name for this profile Maximum 15 characters are allowed Available
279. et Scheduh w System NIC Information On Line Routers MAC Address ED CB 4E DA 46 79 IP Address Mask MAC IP Address 192 168 110 V 192 168 1 5 255 255 25 00 50 7F CD 0 Subnet Mask 255 255 255 0 DNS Servers B44 8 8 8 Default Geteway 192 168 1 5 DHCP Server 192 168 1 5 Lease Obtained Tue ug 27 00 04 10 2013 Lease Expires Fri Aug 30 00 04 10 2013 Refresh 3 17 8 Time and Date It allows you to specify where the time of the router should be inquired from System Maintenance gt gt Time and Date Time Information Current System Time 2013 Oct 31 Thue 53 10 Time Setup Use Browser Time Use Internet Time Time Server pool ntp org Priority Auto w Time zone GMT Greenwich Mean Time Dublin Enable Daylight Saving Automatically Update Interval 30 min Available settings are explained as follows Item Description Current System Time Click Inquire Time to get the current time Use Browser Time Select this option to use the browser time from the remote administrator PC host as router s system time Use Internet Time Select to inquire time information from Time Server on the Vigor2830 Series User s Guide 348 Dray Tek Internet using assigned protocol Time Server Type the IP address of the time server Priority Choose Auto or IPv6 First as the priority IPv6 First Time Zone Select the time zone where the router is l
280. etwork is possible through Trunk port When VLAN is being enabled on Vigor routers the LAN ports are being turned into Trunk mode automatically Therefore a VLAN supported switch like VigorSwitch G2260 P2261 or VigorSwitch G1240 is needed Tag based VLAN Switch VID 100 VID 200 gA go ag BG gA VID 100 VID 200 VID 100 VID 200 Switch Switch Vigor routers support Tag based feature both on LAN and WAN interfaces The next we ll demonstrate our web design and how to configure the settings by introducing the functionalities of Vigor router Note Broadband router Vigor2920 Vigor3200 Vigor2925 Vigo2960 Vigor3900 Modem router Vigor2850 Vigor2860 Note VLAN Packets on Vigor routers Trunk mode of LAN Trunk Port Trunk Port Trunk Port can carry the packets with VID but replace the Non VID packet as the VID of Trunk port while forwarding the packets to another switch Bridge mode of WAN P1 and P2 are doing NAT flow to access to the internet but P3 and P4 will forward the packets between WAN and LAN ports directly Web User Interface So far there are two kinds of open system on Vigor router One is DrayOS which is DrayTek owned and another is Linux like which customized by DrayTek from OpenWRT Here Vigor2830 Series User s Guide 452 Dr ay Te k DrayOS system is going to be introduced to you because it is the most stable and superfast booting system in DrayTek products If the UI style of yours is different from
281. f you choose Custom you can modify the domain that is chosen in the Domain Name field Domain Name Type in one domain name that you applied previously Use the drop down list to choose the desired domain Login Name Type in the login name that you set for applying domain Password Type in the password that you set for applying domain Wildcard and The Wildcard and Backup MX Mail Exchange features Backup MX are not supported for all Dynamic DNS providers You could get more detailed information from their websites Mail Extender If the mail server is defined with another name please type the name in this area Such mail server will be used as backup mail exchange Determine Real If a Vigor router is installed behind any NAT router you WAN IP can enable such function to locate the real WAN IP When the WAN IP used by Vigor router is private IP this function can detect the public IP used by the NAT router and use the detected IP address for DDNS update There are two methods offered for you to choose WAN IP If it is selected and the WAN IP of Vigor router is private DDNS update will take place right away Internet IP If it is selected and the WAN IP of Vigor router is private it will be converted to public IP before DDNS update takes place 4 Click OK button to activate the settings You will see your setting has been saved Disable the Function and Clear all Dynamic DNS Accounts In the DDNS setup menu uncheck En
282. fault value was 101 This setting is available for the OutBand RFC2833 mode 3 13 4 Status From this page you can find codec connection and other important call status for each port VoIP gt Status Status Refresh Seconds Rx Elapse Tx Rx Rx In Out Miss Speaker Pere Status POTEC Peep hh mm ss Pkts Pkts Losts pated Calls Calls Calls Gain Phonel IDLE 00 00 00 0 0 0 0 0 5 Fhonez IDLE 00 00 00 0 0 0 0 0 5 Log Date j Duration Inr out Miss Account ID Peer ID rm doal yyy 00 00 E 00 00 00 00 OO O0 OO0 OO o0 O0 o0 O0 o0 O0 o0 O0 o0 O0 a m A a G m D mn D m S m S ma G m HMBEXMKEN VOIP is encrypted MMBEXKEM VOIP isn t encrypted Available settings are explained as follows Item Description Refresh Seconds Specify the interval of refresh time to obtain the latest VoIP calling information The information will update immediately when the Refresh button is clicked Dr ay Te k 293 Vigor2830 Series User s Guide Port Status Codec PeerID Elapse Tx Pkts Rx Pkts Rx Losts Rx Jitter In Calls Out Calls Miss Calls Speaker Gain Log Vigor2830 Series User s Guide Fefresh Seconds It shows current connection status for Phone s ports It shows the VoIP connection status IDLE Indicates that the VoIP function 1s idle HANG UP Indicates that the connection is not established busy tone CONNECTING Indicates that the user is calli
283. figuration web page Enable Check this box to enable this policy Protocol Display the protocol used for this policy Interface Display the interface to send packets to once the policy is Interface Address matched Display the WAN IP or WAN IP alias address which is used as source IP of the outgoing packets Src IP Start Displays the IP address for the start of the source IP Src IP End Displays the IP address for the end of the source IP Dest IP Start Displays the IP address for the start of the destination IP Dest IP End Displays the IP address for the end of the destination IP Dest Port Start Displays the IP address for the start of the destination port Dest Port End Displays the IP address for the end of the destination port Move UP Move Down Use Up or Down link to move the order of the policy Vigor2830 Series User s Guide 126 Dray Tek Wizard Mode This mode will guide you to configure the common settings with several pages Advance Mode This mode allows you to modify all the settings in one page Click Index 1 to access into the following page for configuring load balance policy Here we choose Advance Mode as an example To use Wizard Mode simple do the following steps 1 Click the Wizard Mode radio button 2 Click Index 1 The setting page will appear as follows Load Balance Route Policy Index 1 Criteria Load Balance Route Policy applies to packets that meet the following criteria source IP O
284. for best More customer oriented services are planned for MyVigor site for the display DrayTek Corp near future I lt Vigor2830 Series User s Guide 426 Dr ay Te k 2 Check to confirm that you accept the Agreement and click Accept Create an account Please enter personal profile Grersonal Information E Preferences completion 1 Agreement Draytek provides Myvigor myvigor draytek com service according to this agreement When you use MyVigor service it means that you have read understand and agree to accept the items listed in this agreement Draytek can modify or change the content of the tems without any reasons tt is suggested for you to notice the medications or changes at any time If you still use MyVigor service after knowing the modifications and changes of this service it means you have read understand and agree to accept the modifications and changes If you do not agree the content of this agreement please stop using Myvigor service 2 Registration To use this service you have to agree the following conditions a Provide your complete and correct information according to the registration steps of this service 3 Type your personal information in this page and then click Continue Register Create an account Please enter personal profile Fields marked by are required Account Information UserName May sd Check Account acen ES occo
285. formation in the directory by clients The LDAP standard is established by the work team of Internet Engineering Task Force IETF As the name described LDAP is designed as an effect way to access directory service without the complexity of other directory service protocols For LDAP is defined to perform inquire and modify the information within the directory and acquire the data in the directory securely therefore users can apply LDAP to search or list the directory object inquire or manage the active directory General Setup This page allows you to enable the function and specify general settings for LDAP server Applications gt Active Directory LDAP Active Directory LDAP Setto Factory Default Active Directory General Setup LDAP Profiles Enable Bind Type Server Address Destination Port lise SSL Regular ON Regular Password Note After finishing the configuration of the LDAP profiles they will be listed in the page of VPN and Remote Access gt gt PPP General Setup If you want to use the profiles for VPN authentication check the boxes under PPTP LDAP Profiles in VPN and Remote Access gt gt PPP General Setup first Available settings are explained as follows Item Description Enable Check to enable such function Bind Type There are three types of bind type supported simple Mode w Simple Mode Anonymous Regular Mode Simple Mode Just simply do the bind authentication wit
286. forwarded to the SIP URL by the time out Disable Ls Disable Mo Answer Busy or Mo Answer SIP URL Type in the SIP URL e g aaa draytel org or abc iptel org as the site for call forwarded Time Out Set the time out for the call forwarding The default setting is 30 sec Ring Port Set Phone 1 and or Phone 2 as the default ring port s for this SIP account Ring Pattern Choose a ring tone type for the VoIP phone call Ring Pattern Prefer Codec Select one of five codecs as the default for your VoIP calls The codec used for each call will be negotiated with the peer party before each session and so may not be your default choice The default codec is G 729A B it occupies little bandwidth while maintaining good voice quality If your upstream speed is only 64Kbps do not use G711 codec It is better for you to have at least 256Kbps upstream if you would like to use G711 Dr ay Te k 287 Vigor2830 Series User s Guide G 729A B 8Kbps G 711MU 64Kbps G 711A 64Kbps G T29A B 8Kbps G_723 6 4kbps G 726 32 32kbps iLBC 15 15 20kbps iLBC_ 13 13 20kbps Single Codec If the box is checked only the selected Codec will be applied Packet Size The amount of data contained in a single packet The default value is 20 ms which means the data packet will contain 20 ms voice information Packet Size 20ms Voice Active Detector This function can detect if the voice on both sides is act
287. g Internet Access types provided by your ISP PPPoE PPTP L2TP Static IP DHCP 2 Click PPPoE as the Internet Access Type Then click Next to continue Quick Start Wizard PPPoE Client Mode WAN 2 Enter the user name and password provided by your ISF User Name S400565 iy hinet net Password Confirm Password Available settings are explained as follows Item Description User Name Type in the valid user name maximum 63 characters provided by the ISP in this field Password Type a valid password provided by the ISP Confirm Password Retype the password Back Click it to return to previous setting page Next Click it to get into the next setting page Cancel Click it to give up the quick start wizard Vigor2830 Series User s Guide 30 Dr ay Tek 3 Please manually enter the Username Password provided by your ISP Click Next for viewing summary of such connection Quick Start Wizard Please confirm your settings WAR Interface WAKE Physical Mode Ethernet Physical Type Auto negotiation Internet Access PPPoE Click Back to modify changes if necessary Otherwise click Finish to save the current settings and restart the Vigor router 4 Click Finish A page of Quick Start Wizard Setup OK will appear Then the system status of this protocol will be shown Quick Start Wizard Setup OK H 5 Now you can enjoy surfing on the Internet PPTP L2TP 1 Choose WAN2 as the WAN Interface
288. g the ID 4 No Ethernet WAN1 Hane Enable Cpi lee ipal ip BEWANG Ho Ethernet WAN1 Hone Enable py pa ipa ip 5 4 ANG Ha Ethemet WwaAN1 Hane Enable Py pe Ja JA LANT Ho Ethemet WANI None Enable Pi Pa ipa Pp Bt No Ethemet WAHL Nore Enable lpi lP pa Op 3 Setup connection of WAN 4 and bind the senace onto it 21 7ag value must be sat between 1 4095 and unique f each channel l 2 Only one channel can be untagged aqual to 0 sical Members Orpi Op Cpa lOps ops Note 3 P1 is reserged for NAT use and cannot be configured for bridge mode NO need to enable Port based Bridge a PAP ar CHAF Authentication J Always On Idle Timeout L E second s 4 Go to Application gt IGMP to bind it on PVC WAN IGMP Proxy is to act as a multicast proxy fo will access any multicast group But this fir eias come mu erat wima MNUE UT BE Ep ELA Enable IGMP Snooping Enable IGMP Snooping multicast traffic is only forwarded to ports that have members of that group Disable IGMP snooping multicast trafie is treated in the same manner as broadcast traffic Dr ay Tek 457 Vigor2830 Series User s Guide Bridge mode with VLAN Se1 0p Hox lt 7 Muhi VLAH General Channel Enable WAN Type VLAN Tan Port based Bridge 1 Yeas Ethermet WANI Nore Z Yes Ethermet WANZ Nore a No Ethermet WAN1 Nore Enable PiL Palpa ipa ips 4 No Etherneti WANI Nore Enable Pi lp leg O0 p4 OPs 5
289. gacy firewall inspects packets based on the fields of TCP IP headers only On the other hand Vigor router can prevent user from accidentally downloading malicious codes from web pages It s very common that malicious codes conceal in the executable objects such as ActiveX Java Applet compressed files and other executable files Once downloading these types of files from websites you may risk bringing threat to your system For example an ActiveX control object is usually used for providing interactive web feature If malicious code hides inside it may occupy user s system Web Content Filter We all know that the content on the Internet just like other types of media may be inappropriate sometimes As a responsible parent or employer you should protect those in your trust against the hazards With Web filtering service of the Vigor router you can protect your business from common primary threats such as productivity legal liability network and security threats For parents you can protect your children from viewing adult websites or chat rooms Once you have activated your Web Filtering service in Vigor router and chosen the categories of website you wish to restrict each URL address requested e g www bbc co uk will be checked against our server database This database is updated as frequent as daily by a global team of Internet researchers The server will look up the URL and return a category to your router Your Vigor router w
290. ght duplicate itself to paralyze the host in the secure LAN will be strictly blocked and a Syslog message will be sent as warning if you Set up Syslog server Also the Vigor router monitors the traffic Any abnormal traffic flow violating the pre defined parameter such as the number of thresholds is identified as an attack and the Vigor router will activate its defense mechanism to mitigate in a real time manner The below shows the attack types that DoS DDoS defense function can detect 1 SYN flood attack 9 SYN fragment 2 UDP flood attack 10 Fraggle attack 3 ICMP flood attack 11 TCP flag scan 4 Port Scan attack 12 Tear drop attack 5 IP options 13 Ping of Death attack 6 Land attack 14 ICMP fragment 7 Smurf attack 15 Unassigned Numbers 8 Trace route Below shows the menu items for Firewall Vigor2830 Series User s Guide 144 Dr ay Te k 3 5 2 General Setup General Setup allows you to adjust settings of IP Filter and common options Here you can enable or disable the Call Filter or Data Filter Under some circumstance your filter set can be linked to work in a serial manner So here you assign the Start Filter Set only Also you can configure the Log Flag settings Apply IP filter to VPN incoming packets and Accept incoming fragmented UDP packets Click Firewall and click General Setup to open the general setup page General Setup Page Such page allows you to enable disable Call Filter and Data Filter de
291. gional Check this box to enable this function Last Call Return Miss Sometimes people might miss some phone calls Please dial number typed in this field to know where the last phone call comes from and call back to that one Last Call Return In You have finished an incoming phone call however you want to call back again for some reason Please dial number typed in this field to call back to that one Last Call Return Out Dial the number typed in this field to call the previous outgoing phone call again Call Forward AII Act Dial the number typed in this field to forward all the incoming calls to the specified place Call Forward Deact Dial the number typed in this field to release the call forward function Call Forward Busy Act Dial the number typed in this field to forward all the incoming calls to the specified place while the phone is busy Call Forward No Dial the number typed in this field to forward all the Ans Act incoming calls to the specified place while there is no answer of the connected phone Vigor2830 Series User s Guide 282 Dr ay Te k Do Not Disturb Act Dial the number typed in this field to invoke the function of DND Do Not Distrub Deact Dial the number typed in this field to release the DND function Hide caller ID Act Dial the number typed in this field to make your phone number ID not displayed on the display panel of remote end Hide caller ID Deact Dial the number
292. gister your own domain name for the router Enable the Function and Add a Dynamic DNS Account l Dray Tek Assume you have a registered domain name from the DDNS provider say hostname dyndns org and an account with username test and password test In the DDNS setup menu check Enable Dynamic DNS Setup Applications gt gt Dynamic DNS Setup Dynamic DNS Setup Set to Factory Default C Enable Dynamic ONS Setup Auto Upodate interval 44400 Mints 1 14400 Accounts Index WAN Interface Domain Name WANI First WANI First WAL First WAL First WAN L First WAN L First i ra 3 4 5 6 Available settings are explained as follows Item Description Enable Dynamic Check this box to enable DDNS function 223 Vigor2830 Series User s Guide DNS Setup Set to Factory Default View Log Force Update Auto Update interval Index WAN Interface Domain Name Active Clear all profiles and recover to factory settings Display DDNS log status Force the router updates its information to DDNS server Set the time for the router to perform auto update for DDNS Service Click the number below Index to access into the setting page of DDNS setup to set account s Display the WAN interface used Display the domain name that you set on the setting page of DDNS setup Display if this account is active or inactive 3 Select Index number 1 to add an account for the router Check Enable Dynam
293. gle Address Range Address subnet Address Group and Objects From the IP Group drop down list choose the one that you want to apply Or use the IP Object drop down list to choose the object that you want Click Edit to access into the following dialog to choose a suitable service type 152 Dray Tek Dray Tek Fragments Filter e Service Type Edit Microsoft Internet Explorer a CI Service Type Edit Service Type Protocol Source Port Destination Port Service Group or Service Object or Service Object or Service Object To set the service type manually please choose User defined as the Service Type and type them in this dialog In addition if you want to use the service type from defined groups or objects please choose Group and Objects as the Service Type User defined User defined Group and Objects Protocol Specify the protocol s which this filter rule will apply to Source Destination Port when the first and last value are the same it indicates one port when the first and last values are different it indicates a range for the port and available for this service type when the first and last value are the same it indicates all the ports except the port defined here when the first and last values are different it indicates that all the ports except the range defined here are available for this service type gt the port number g
294. gs in the previous pages we guess you want to have Force MAT The current setting Is O Force NAT Force Routing Available settings are explained as follows Item Description Force NAT Force It determines which mechanism that the router will use to Routing forward the packet to WAN 5 After choosing the mechanism click Next to get the summary page for reference Load Balance Route Policy Index 1 Configuration Summary Criteria Source IP Any Destinatian IP 192 168 1 6 192 168 1 66 Interface WAR 1 More options Force MAT Vigor2830 Series User s Guide 128 Dr ay Te k 6 If there is no error click Finish to complete wizard setting Load Balance Route Policy Load Balance Route Policy Index Enable Protocol Interface 4 Any 2 Ary Set to Factory Default Interface Src Src Dest Dest Dest Dest IP IP IP IP Port Port Address Start End Start End Start End WANI Any Any Any Any Any amp ny WAMI UP IAIARI J tir To use Advance Mode do the following steps 1 Click the Advance Mode radio button 2 Click Index 1 to access into the following page Load Balance Route Policy Index 2 C Enable Criteria Protocal Source IP Destination IP Destination Port Any Src IP Start Src IP End rat Any Dest IP Start Dest IP End rat Any Dest Port Start Dest Port End rat Send to if Criteria Matched Interface Gateway IP More Options Defaul
295. gt USB General Settings USB General Settings General Settings Simultaneous FTP Connections 5 Maximum 6 Default Charset Default Samba Service Settings Network Neighborhood Enable Disable Access Mode LAN Only OLAN And WAN NetBios Name Service Workgroup Name WORKGROUP Note 1 If Charset is set to default only English long file name is supported 2 Multi session ftp download will be banned by Router FTP server If your ftp client hawe multi connection mechanism such as FileZilla you may limit client connections setting ta 1 ta get better performance 3 4 workgroup name must not be the same as the host name The workgroup name and the host name can have as many as 15 characters and a host name can have as many as 23 characters but both cannot contain any of the following lt a gt 7 Vigor2830 Series User s Guide 382 Dr ay Tek Dray Tek Setup a user account for the FTP service by using USB Application gt gt USB User Management Click Enable to enable FTP Samba User account Here we add a new account userl and assign authorities Read Write and List to it USB Application gt USB User Management Profile Index 1 FTP Samba User Enable Disable Username user Password Maximum 11 Characters Confirm Password Access Rule File Read Write Delete Directory List L create Remove Note The folder name
296. he address for the tunnel broker IP FQDN or an optional port number After finishing all the settings here please click OK to save the configuration Dr ay Tek 91 Vigor2830 Series User s Guide Details Page for IPv6 AICCU in WAN1 WAN2 WAN3 WAN gt gt Internet Access oO WAN 1 PPPoE PPPoA MPoA RFC1483 2684 IPvb Internet Access Mode Connection Type AICCU w AICCU Configuration Ol Always On Note If Always On is not enabled AICCU connection would only retry three times Available settings are explained as follows Item Description Always On Check this box to keep the network connection always Username Type the name obtained from the broker Please apply new account at http www sixxs net It is suggested for you to apply another username and password Password Type the password assigned with the user name Confirm Password Type the password again to make the confirmation Tunnel Broker Type the address for the tunnel broker IP FQDN or an optional port number Subnet Prefix Type the subnet prefix address getting from service provider After finishing all the settings here please click OK to save the configuration Vigor2830 Series User s Guide 92 Dr ay Tek Details Page for IPv6 DHCPv6 Client in WAN1 WAN2 DHCPv6 client mode would use DHCPV6 protocol to obtain IPv6 address from server WAN gt Internet Access WAN 1 PPPoE PPPoA MPoA RFC1483 2634 IP Internet Access Mode
297. he network is not stable small value will be proper Session timeout Setting timeout for sessions can make the best utilization of network resources After finishing all the settings here please click OK to save the configuration Dr ay Te k 149 Vigor2830 Series User s Guide 3 5 3 Filter Setup Click Firewall and click Filter Setup to open the setup page Firewall gt Filter Setup Filter Setup Setto Factory Default Set Comments Set Comments 1 Default Call Filter 2 Default Data Filter a a 4 10 ae ti 6 12 To edit or add a filter click on the set number to edit the individual set The following page will be shown Each filter set contains up to 7 rules Click on the rule number button to edit each rule Check Active to enable the rule Firewall gt gt Filter Setup gt gt Edit Filter Set Filter Set 1 Comments Filter Rule Active Comments Move Up Move Down Block NetBios Down O UP Down O UP Down O UP Down O UP Down e O UP Down L UP Next Filter Set Available settings are explained as follows Item Description Filter Rule Click a button numbered 1 7 to edit the filter rule Click the button will open Edit Filter Rule web page For the detailed information refer to the following page Active Enable or disable the filter rule Comment Enter filter set comments description Maximum length is 23 character long Move Up Down Use Up or Down link to move the order of the filter
298. he real bandwidth first QoS may not work properly if the bandwidth is not accurate 2 You can do speed test by http speedtest net or contact with your ISP for speed test program Available settings are explained as follows Item Description Enable the QoS Control The factory default for this setting is checked Please also define which traffic the QoS Control settings will apply to IN apply to incoming traffic only OUT apply to outgoing traffic only BOTH apply to both incoming and outgoing traffic Check this box and click OK then click Setup link again You will see the Online Statistics link appearing on this page WAN Inbound It allows you to set the connecting rate of data input for Bandwidth WAN2 WANS For example if your ADSL supports 1M of downstream and 256K upstream please set 1000kbps for this box The default value is 10000kbps WAN Outbound It allows you to set the connecting rate of data output for Bandwidth WAN2 WANS For example if your ADSL supports 1M of downstream and 256K upstream please set 256kbps for this box The default value is 10000kbps Note The rate of outbound inbound must be smaller than the real bandwidth to ensure correct calculation of QoS It is suggested to set the bandwidth value for inbound outbound as 80 85 of physical network speed provided by ISP to maximize the QoS performance Reserved Bandwidth It is reserved for the group index in the form of ratio of R
299. he remote node 323 Vigor2830 Series User s Guide Item Description Pre Shared Key Check the box of Pre Shared Key to invoke this function and type in the required characters 1 63 as the pre shared key Digital Signature X 509 Check the box of Digital Signature to invoke this function and Select one predefined Profiles set in the VPN and Remote Access gt gt IPSec Peer Identity IPSec Security Method This group of fields is a must for IPSec Tunnels and L2TP with IPSec Policy when you specify the remote node Check the Medium DES 3DES or AES box as the security method Medium Authentication Header AH means data will be authenticated but not be encrypted By default this option is invoked You can uncheck it to disable it High Encapsulating Security Payload ESP means payload data will be encrypted and authenticated You may select encryption algorithm from Data Encryption Standard DES Triple DES 3DES and AES Local ID Specify a local ID to be used for Dial in setting in the LAN to LAN Profile setup This item is optional and can be used only in IKE aggressive mode After finishing all the settings here please click OK to save the configuration Vigor2830 Series User s Guide 324 Dr ay Tek 3 15 5 User Group There are 10 user group profiles which can be created for authentication by LDAP server Such profiles will be used by applications such as User Management VPN and etc Web Access Contr
300. his field PPP Authentication Select PAP only or PAP or CHAP for PPP If you want to connect to Internet all the time you can check Always On Idle Timeout Set the timeout for breaking down the Internet after passing through the time without any action IP Address From ISP Usually ISP dynamically assigns IP address to you each time you connect to it and request In some case your ISP provides service to always assign you the same IP address whenever you request In this case you can fill in this IP address in the Fixed IP field Please contact your ISP before you want to use this function WAN IP Alias If you have multiple public IP addresses and would like to utilize them on the WAN interface please use WAN IP Alias You can set up to 8 public IP addresses other than the current one you are using o RRA MAES 192 168 1 SidocAvipalias htm WANI IP Alias Multi NAT Index Enable Aux WAN IP Join NAT IP Pool L C E d dl d d d d Fixed IP Click Yes to use this function and type in a fixed IP address in the box of Fixed IP Address Default MAC Address You can use Default MAC Address or specify another MAC address by typing on the boxes of MAC Address for the router Specify a MAC Address Type the MAC address for the router manually Index 1 15 in Schedule Setup You can type in four sets of time schedule for your request All the schedules can be set previously in Applicat
301. his page determines the general configuration for SSL VPN Server and SSL Tunnel Web Access Control gt gt General Setup SSL VPN General Setup Port Default 443 Server Certificate self signed Encryption Key Algorithm OHigh AES 128 bits and 3DES Default RC4 128 bits OLow DES Note The settings will act on all SSL applications Available settings are explained as follows Item Description Port Such port is set for SSL VPN server It will not affect the HTTPS Port configuration set in System Maintenance gt gt Management In general the default setting is 443 Server Certificate When the client does not set any certificate default certificate will be used for HTTPS and SSL VPN server Choose any one of the user defined certificates from the drop down list if users set several certificates previously Otherwise choose Self signed to use the router s built in default certificate The default certificate can be used in SSL VPN server and HTTPS Web Proxy Vigor2830 Series User s Guide 316 Dray Tek Encryption Key Algorithm Choose the encryption level for the data connection in SSL VPN server After finishing all the settings here please click OK to save the configuration 3 15 2 SSL Web Proxy SSL Web Proxy will allow the remote users to access the internal web sites over SSL Web Access Control gt gt SSL Web Proxy SSL Web Proxy Servers Profiles Setto Factory Default Sererrreere
302. his router serving as an access point click Disable to cancel this function It allows user to send hello message to peers Yet it is valid only when the peer also supports this function os DrayTek 3 14 7 Advanced Setting This page allows users to set advanced settings such as operation mode channel bandwidth guard interval and aggregation MSDU for wireless data transmission Wireless LAN gt Advanced Setting HT Physical Mode Operation Mode Channel Bandwidth Guard Interval Aggregation MSDUCA MSDU4 Long Preamble Packet OVERDRIVE Tx Burst Mixed Mode Green Field 20 20 40 long auto Disable Enable Disable Enable Disable Enable Available settings are explained as follows Item Operation Mode Channel Bandwidth Guard Interval Aggregation MSDU Long Preamble Packet OVERDRIVE Dray Tek Description Mixed Mode the router can transmit data with the ways supported in both 802 1 1a b g and 802 11n standards However the entire wireless transmission will be slowed down if 802 11g or 802 11b wireless client is connected Green Field to get the highest throughput please choose such mode Such mode can make the data transmission happening between 11n systems only In addition it does not have protection mechanism to avoid the conflict with neighboring devices of 802 1 1a b g 20 the router will use 20Mhz for data transmission and receivi
303. hout any search action Anonymous Perform a search action first with Anonymous account then do the bind authentication Vigor2830 Series User s Guide 232 Dr ay Te k Regular Mode Mostly it is the same with anonymous mode The different is that the server will firstly check if you have the search authority For the regular mode you ll need to type in the Regular DN and Regular Password Server Address Enter the IP address of LDAP server Destination Port Type a port number as the destination port for LDAP server Use SSL Check the box to use the port number specified for SSL Regular DN Type this setting if Regular Mode is selected as Bind Type Regular Password Specify a password if Regular Mode is selected as Bind Type After finished the above settings click OK button to save the settings Profiles You can configure eight AD LDAP profiles These profiles would be used with User Management for different purposes in management Applications gt Active Directory LDAP Active Directory LDAP Set to Factory Default Active Directory General Setup LDAP Profiles Index Name Distinguished Name 1 A 4 5 6 t a Note After finishing the configuration of the LDAP profiles they will be listed in the page of VPN and Remote Access gt gt PPP General Setup If you want to use the profiles for VPN authentication check the boxes under PPTP LOAP Profiles in VPN and Remote Access gt gt PPP
304. ia VPN connection site to Site WPN LAN to L4N w Site to Site WPN LAM to LAMY Remote Dial in User Teleworker Vigor2830 Series User s Guide 50 Dr ay Tek Please choose a This item is available when you choose Site to Site VPN LAN to LAN Profile LAN to LAN as VPN server mode There are 32 VPN profiles for users to set Status 2 Please choose a Index 1 ee Hane 777 TPY 7 TPY TPY 77 777 Try 77 777 TPY TPY Tr Try TPY Tr Tr Tr 77 Tr TP TPY T7 TPY TPY B Tr 777 faa a This item is available when you choose Remote Dial in Dial in User User Teleworker as VPN server mode There are 32 VPN Accounts tunnels for users to set Allowed Dial in Type This item is available after you choose any one of dial in user account profiles Next you have to select suitable dial in type for the VPN server profile There are several types provided here similar to VPN Client Wizard PPTP IPsec L2TP with IPsec Policy SSL Tunnel Must None w Mone Mice to Have Different Dial in Type will lead to different configuration page In addition adjustable items for each dial in type will be changed according to the VPN Server Mode Site to Site VPN and Remote Dial in User selected 2 After making the choices for the server profile please click Next You will see different Dray Tek configurations based on the selection you made Here
305. ia Vigor2830n as offering wireless connection service at its hotspot With the smart easy configuration of WLAN on Vigor2830n the free riders of Wi Fi connection at hotspot would be automatically directed to dedicated web site In a department store with Vigor2830n deployed the mobile users will be directed to its own company web site or dedicated special promotion program web page as firstly get wireless connection to the Internet The Internet surfers would have a glance at least on the dedicated web site and related contents Direct Marketing via Web Portal Log in Internet if Vigor2830n Dr ay Tek 389 Vigor2830 Series User s Guide Wireless General Setup 1 From Vigor router web configuration page select Wireless LAN gt gt General Setup 2 Check Enable Wireless LAN and set the SSID Then click OK to save the settings Vigor2 830 Series ADSL2 Security Firewall Mixed 11b 11g 11n Channel Channel 6 2437 MHz User Management Enable Hide SSID SSID Isolate Member Isolate VPN Objects Setting CSM 1 o DrayTek O O Bandwidth Management Applications 2 O DrayTek_Guest VPN and Remote Access Certificate Management 3 O VolP Wireless Portal Log in Setting 1 Open LAN gt gt Web Portal Setup 2 Click Redirect to URL and type the URL in the field below User s first HTTP request will be redirected to the URL defined here Here we take www drayt
306. ic DNS Account and choose correct Service Provider dyndns org type the registered hostname hostname and domain name suffix dyndns org in the Domain Name block The following two blocks should be typed your account Login Name test and Password test Applications gt gt Dynamic DNS Setup gt gt Dynamic DNS Account Setup Index 1 Enable Dynamic ONS Account WARK Interface Service Provider Service Type Domain Name Login Name Password O Wildcards Cl Backup Mx Mail Estender Determine Feal WARK IP WANT First dyndns org jaw dyndns org max 64 characters Po max 23 characters WANIP v AN IP nternet IF Available settings are explained as follows Item Enable Dynamic DNS Account WAN Interface Vigor2830 Series User s Guide Description Check this box to enable the current account If you did check the box you will see a check mark appeared on the Active column of the previous web page in step 2 WANI WAN2 WANS First While connecting the router will use WAN1 WAN2 WANS3 as the first channel for such account If WANI WAN2 WAN3 fails the router will use another WAN interface instead WANI WAN2 WANS Only While connecting the router will use WANI WAN2 WANS as the only channel for such account m DrayTek WANT First WAM First Service Provider Select the service provider for the DDNS account Service Type Select a service type Dynamic Custom or Static I
307. icate for this router can be saved within one file Please click Backup on the following screen to save them If you want to set encryption password for these certificates please type characters in both fields of Encrypt password and Retype password Also you can use Restore to retrieve these two settings to the router whenever you want Certificate Management gt gt Certificate Backup Certificate Backup Restoration Confirm password Click to download certificates to your local PC as a file Restoration Select 4 backup file to restore Click to upload the file 3 13 VoIP Note This function is used for V models Voice over IP network VoIP enables you to use your broadband Internet connection to make toll quality voice calls over the Internet There are many different call signaling protocols methods by which VoIP devices can talk to each other The most popular protocols are SIP MGCP Megaco and H 323 These protocols are not all compatible with each other except via a soft switch server The Vigor V models support the SIP protocol as this is an ideal and convenient deployment for the ITSP Internet Telephony Service Provider and softphone and is widely supported SIP is an end to end signaling protocol that establishes user presence and mobility in VoIP structure Every one who wants to talk using his her SIP Uniform Resource Identifier SIP Address The standard format of SIP URI is sip user pas
308. ide the caller ID on the display panel of the phone set 20 Dray Tek Call Waiting Call Transfer Default SIP Account Check this box to invoke this function A notice sound will appear to tell the user new phone call is waiting for your response Click hook flash to pick up the waiting phone call Check this box to invoke this function Click hook flash to initiate another phone call When the phone call connection succeeds hang up the phone The other two sides can communicate then You can set SIP accounts up to six groups on SIP Account page Use the drop down list to choose one of the profile names for the accounts as the default one for this phone setting Play dial tone only when account registered Check this box to invoke the function In addition you can press the Advanced button to configure tone settings volume gain MISC and DTMF mode Advanced setting is provided for fitting the telecommunication custom for the local area of the router installed Wrong tone settings might cause inconvenience for users To set the sound pattern of the phone set simply choose a proper region to let the system find out the preset tone settings and caller ID type automatically Or you can adjust tone settings manually if you choose User Defined TOn1 TOff1 TOn2 and TOff2 mean the cadence of the tone pattern TOn1 and TOn2 represent sound on TOff1 and TOff2 represent the sound off VoIP gt Phone Settings Advance Settings
309. ies User s Guide Quick Start Wizard WAN Interface WAN Interface WANT Physical Mode ADSL Physical Type WAN WAN2 and WAN3 will bring up different configuration page Refer to the following for detailed information 2 1 1 For WAN1 ADSL WANI is specified for ADSL connection Please select the appropriate Internet access type according to the information from your ISP Quick Start Wizard WAN Interface WAN Interface WANT Physical Mode ADSL Physical Type 2 1 1 1 PPPoE PPPoA PPPoE PPPoA PPPoE stands for Point to Point Protocol over Ethernet It relies on two widely accepted standards PPP and Ethernet It connects users through an Ethernet to the Internet with a common broadband medium such as a single DSL line wireless device or cable modem All the users over the Ethernet can share a common connection PPPoE is used for most of DSL modem users All local users can share one PPPoE connection for accessing the Internet Your service provider will provide you information about user name password and authentication mode Vigor2830 Series User s Guide 24 Dr ay Te k Dray Tek 1 Choose WANI as WAN Interface and click the Next button you will get the following page Choose PPPoE XXXX or PPPoA XXXXX as the protocol Quick Start Wizard Connect to Internet WAN 1 WPI VICI Protocol Encapsulation Fixed IP IP Address Auto detect PPPoA VC MIJS yves NolDynamic IF Subnet Mask Defau
310. igor2830 Series User s Guide 142 Dr ay Te k 3 5 Firewall 3 5 1 Basics for Firewall While the broadband users demand more bandwidth for multimedia interactive applications or distance learning security has been always the most concerned The firewall of the Vigor router helps to protect your local network against attack from unauthorized outsiders It also restricts users in the local network from accessing the Internet Furthermore it can filter out specific packets that trigger the router to build an unwanted outgoing connection Firewall Facilities The users on the LAN are provided with secured protection by the following firewall facilities User configurable IP filter Call Filter Data Filter Stateful Packet Inspection SPI tracks packets and denies unsolicited incoming data Selectable Denial of Service DoS Distributed DoS DDoS attacks protection IP Filters Depending on whether there is an existing Internet connection or in other words the WAN link status is up or down the IP filter architecture categorizes traffic into two Call Filter and Data Filter Call Filter When there is no existing Internet connection Call Filter is applied to all traffic all of which should be outgoing It will check packets according to the filter rules If legal the packet will pass Then the router shall initiate a call to build the Internet connection and send the packet to Internet Data Filter
311. ile Click Import to Upload the local certificate Upload PACS 12 Certificate Select a PECS12 file PKCS12 file Click Import to Upload the PECS12 file Upload Certificate and Private Key Select a certificate file and a matchable Private Key Certificate file Key file Click Import to Upload the local certificate and private key Available settings are explained as follows Item Description Upload Local Certificate It allows users to import the certificate which is generated by vigor router and signed by CA server If you have done well in certificate generation the Status of the certificate will be shown as OK Import X509 Local Certificate Congratulation gt Local Certificate has been imported successfully Please click Back to view the certificate X509 Local Certificate Configuration Modify Name Subject Status View Delete draytekdemo O Draytek OU Draytek Sales OK View Delete View Delete GENERATE IMPORT REFRESH Upload PKCS12 It allows users to import the certificate whose extensions are Certificate usually pfx or p12 And these certificates usually need passwords Note PKCS12 is a standard for storing private keys and Vigor2830 Series User s Guide 270 Dr ay Te k certificates securely It is used in among other things Netscape and Microsoft Internet Explorer with their import and export options Upload Certificate and Private Key It i
312. ill then decide whether to allow access to this site according to the categories you have selected Please note that this action will not introduce any delay in your Web surfing because each of multiple load balanced database servers can handle millions of requests for categorization Note The priority of URL Content Filter is higher than Web Content Filter Vigor2830 Series User s Guide 196 Dr ay Tek 3 8 1 APP Enforcement Profile You can define policy profiles for IM Instant Messenger P2P Peer to Peer Protocol OTHERS application This page allows you to set 32 profiles for different requirements The APP Enforcement Profile will be applied in Default Rule of Firewall gt gt General Setup for filtering CSM gt APP Enforcement Profile APP Enforcement Profile Table Setto Factory Default Profile Name Profile Name 1 1 2 15 3 13 4 20 De l 6 22 i 23 8 24 J 23 10 2b Ti f 12 26 13 29 t4 30 13 31 16 32 Available settings are explained as follows Item Description Set to Factory Default Clear all profiles Profile Display the number of the profile which allows you to click to set different policy Name Display the name of the APP Enforcement Profile Click the number under Index column for settings in detail There are four tabs IM P2P Protocol and Misc displayed on this page Each tab will bring out different items that you can choose to disallow people using Dr
313. ine Status to view logging status of SSL VPN Web Access Control gt gt Online User Status Refresh Seconds Host IP Time out seconds Action 192 168 30 14 299 Available settings are explained as follows Item Description Active User Display current user who visit SSL VPN server Host IP Display the IP address for the host Time out Display the time remaining for logging out Action You can click Drop to drop certain login user from the router s SSL Portal UI Dray Te k 327 Vigor2830 Series User s Guide 3 16 USB Application USB storage disk connected on Vigor router can be regarded as a server By way of Vigor router clients on LAN can access write and read data stored in USB storage disk with different applications After setting the configuration in USB Application you can type the IP address of the Vigor router and username password created in USB Application gt gt USB User Management on the client software Then the client can use the FTP site USB storage disk or share the Samba service through Vigor router 3 16 1 USB General Settings This page will determine the number of concurrent FTP connection default charset for FTP server and enable Samba service At present the Vigor router can support USB storage disk with formats of FAT16 and FAT32 only Therefore before connecting the USB storage disk into the Vigor router please make sure the memory format for the USB storage disk is FAT16 or FAT32 It
314. ing in dial in type by checking the box Also you should further specify the corresponding security methods on the right side If you uncheck the checkbox the connection type you select above will apply the authentication methods and security methods in the general settings User Name This field is applicable when you select PPTP or L2TP with or without IPSec policy above The maximum length for both username is 11 characters Password This field is applicable when you select PPTP or L2TP with or without IPSec policy above The maximum length for both username is 11 characters VJ Compression VJ Compression is used for TCP IP protocol header compression This field is applicable when you select PPTP or L2TP with or without IPSec policy above IKE Authentication Method This group of fields is applicable for IPSec Tunnels and L2TP with IPSec Policy when you specify the IP address of the remote node The only exception is Digital Signature X 509 can be set when you select IPSec tunnel either with or without specify the IP address of the remote node Pre Shared Key Check the box of Pre Shared Key to invoke this function and type in the required characters 1 63 as the pre shared key Digital Signature X 509 Check the box of Digital Signature to invoke this function and select one predefined Profiles set in the VPN and Remote Access gt gt IPSec Peer Identity Local ID Specify which one will be inspected first Al
315. ing the configuration of the LDAP profiles they will be listed in the page of VPN and Remote Access gt gt PPP General Setup If you want to use the profiles for WPN authentication check the boxes Under PPTP LDAP Profiles in VPN and Remote Access gt gt PPP General Setup first There are three types of bind type supported Simple Mode Just simply do the bind authentication without any search action Anonymous Perform a search action first with Anonymous account then do the bind authentication Regular Mode Mostly it is the same with anonymous mode The different is that the server will firstly check if you have the search authority For the regular mode you ll need to type in the Regular DN and Regular Password Create LDAP server profiles Click the Active Directory LDAP tab to open the profile web page and click any one of the index number link If we have two groups RD1 and SHRD on LDAP server we can configure two LDAP server profiles with different Group Distinguished Name 433 Vigor2830 Series User s Guide Applications gt gt Active Directory LDAP gt gt Server Profiles Index No 1 Mame rd Common Name Identifier uid Base Distinguished Mame ou people de ms dc draytek dc co Additional Filter ch rdi ou group dc ms dc draytek d Note Plaase type in your additional filter for BaseON search request For example 1 For OpenLDAP fgidNumber 500 2 For 40 mshPAllowDialin TR
316. ing the user name and password above simply click it to create a new local user The new one will be shown on the Local User List immediately Edit If the username listed on the box above is not satisfied simply click the username and modify it on the field of User Name Later click Edit to update the information Delete If the local user listed on the box above is not satisfied simply click the username and click Delete to remove it Enable Admin Login From Wan The default setting is enabled It can ensure any user accessing into web user interface of Vigor router through Internet by username password of admin admin Administrator LDAP Enable LDAP AD login for Admin users If it is Setting enabled any user can access into the web user interface of Vigor router through the LDAP server authentication LDAP Server Profiles Available profiles will be displayed here under the link of LDAP Profile Setup LDAP Profile Setup It allows you to create a new LDAP profile When you click OK the login window will appear Please use the new password to access into the web user interface again Dray Te k 339 Vigor2830 Series User s Guide 3 17 4 User Password This page allows you to set new password for user operation System Maintenance gt gt User Password Enable User Mode for simple web configuration User Password Setto Factory Default Password Confirm Password Mote 1 Passwo
317. ingbox ovod Remote Control VAC Radmin Spyany where ShowMyPc LogMeIn Teamviewer gagrak RemoteContralPro CrossLoop WindowsROP pcAnywhere Timbuktu WindowsLiveSync SharedvView Web HD HTTP Upload IHiINet SafteBox MS SkyDrive GDoc Uploader ADrive My OtherOrive Mozy BoxNet OfficeLive DropBos 199 Vigor2830 Series User s Guide 3 8 2 URL Content Filter Profile To provide an appropriate cyberspace to users Vigor router equips with URL Content Filter not only to limit illegal traffic from to the inappropriate web sites but also prohibit other web feature where malicious code may conceal Once a user type in or click on an URL with objectionable keywords URL keyword blocking facility will decline the HTTP request to that web page thus can limit user s access to the website You may imagine URL Content Filter as a well trained convenience store clerk who won t sell adult magazines to teenagers At office URL Content Filter can also provide a job related only environment hence to increase the employee work efficiency How can URL Content Filter work better than traditional firewall in the field of filtering Because it checks the URL strings or some of HTTP data hiding in the payload of TCP packets while legacy firewall inspects packets based on the fields of TCP IP headers only On the other hand Vigor router can prevent user from accidentally downloading malicious codes from web pages It s very common that malicious codes conceal in th
318. ings Profile Name Backup1l ERD Mode Normal O Resume Member 1 first Detail Information Environment Recovers Detection ERD Status Normal Mode v lt gt Detailed information for this dialog see later section Advanced Backup General Setup Status After choosing one of the profile listed above please click Enable to activate this profile If you click Disable the selected or current used VPN TRUNK Backup Load Balance mechanism profile will not have any effect for VPN tunnel Profile Name Type a name for VPN TRUNK profile Each profile can group two VPN connections set in LAN to LAN The saved VPN profiles in LAN to LAN will be shown on Member and Member fields Member 1 Member2 Display the selection for LAN to LAN dial out profiles configured in VPN and Remote Access gt gt LAN to LAN for you to choose for grouping under certain VPN TRUNK VPN Backup mechanism profile No Index number of LAN to LAN dial out profile Dr ay Te k 263 Vigor2830 Series User s Guide Name Profile name of LAN to LAN dial out profile Connection Type Connection type of LAN to LAN dial out profile VPN ServerIP Private Network VPN Server IP of LAN to LAN dial out profiles Active Mode Display available mode for you to choose Add Add and save new profile to the backup profile list Update Click this button to save the changes to the Status Enable or Disable profile name member or member2
319. ion Dray Te k 401 Vigor2830 Series User s Guide 2 Dial Out Settings Type of Server am calling PPTP IPsec Tunnel L2TP with IPsec Policy Server IP Host Name for VPN such as draytek com or 123 45 67 89 220 135 240 208 Username oe Password Max 15 char f PPP Authentication Y Compression IKE Authentication Method Pre Shared Key Digital Signature 509 Local ID Alternative Subject Name First Subject Name First Local Certificate IPsec Security Method Medium AH O High EsP DES without Authentication Y Indexf1 15 in Schedule Setup L bi bi bl If a PPP based service is selected you should further specify the remote peer IP Address Username Password PPP Authentication and VJ Compression for this Dial Out connection Dial Out Settings Type of Server lam calling PPTP IPsec Tunnel L2TP with IPsec Policy Server IP Host Name for VPN such as draytek com or 123 45 67 89 220 195 240 208 Username Password Max 15 char PPP Authentication PAPICHAPIMNGE CHAPIMNS CHAPY2 W SSW On off IKE Authentication Method Pre Shared Key Digital Signature 509 Local ID Alternative Subject Name First Subject Name First Local Certificate None IPsec Security Method MediumicsH High ESP DES without Authentication Index 1 15 in Schedule Setup L bO bO Ld 6 Set Dial In settings to
320. ion Backup Restoration Restoration Select a configuration file ae Click Restore to upload the file Backup Click Backup to download current running configurations as a file 2 Click Browse button to choose the correct configuration file for uploading to the router 3 Click Restore button and wait for few seconds the following picture will tell you that the restoration procedure is successful Dray Te k 345 Vigor2830 Series User s Guide 3 17 7 Syslog Mail Alert SysLog function is provided for users to monitor router There is no bother to directly get into the Web user interface of the router or borrow debug equipments System Maintenance gt gt SysLog Mail Alert Setup SysLog Mail Alert Setup SysLog Access Setup Mail Alert Setup Enable Enable Send a test e mail Syslog Save to SMTP Server Syslog Server SMITE Port uss Disk Mail To Return Path Destination Port C Authentication Mail Syslog Enable Username Enable syslog message Firewall Lag Password YPN Log Enable E Mail Alert y User Access Log Dos Attack WAN Lo HT WAN Log Router OSL information AlertLog Setup C Enable AlertLog Port Note 1 Mail Syslog cannot be activated unless USB Disk is ticked for Syslog Save to 2 Mail Syslog feature sends a Syslog file when its size reaches 1M Bytes 3 We only support secured SMTP connection on port 465 Available settings are explained as follows Item Descripti
321. ions gt gt Schedule web page and you can use the number that you have set in that web page After finishing all the settings here please click OK to activate them Vigor2830 Series User s Guide 76 Dr ay Tek Details Page for MPoA RFC1483 2684 in WAN1 MPOA is a specification that enables ATM services to be integrated with existing LANs which use either Ethernet token ring or TCP IP protocols The goal of MPOA is to allow different LANs to send packets to each other via an ATM backbone To use MPoA as the accessing protocol of the Internet select MPoA from the WAN gt gt Internet Access gt gt WANI page The following web page will appear WAN gt Internet Access WAN 1 PPPoE PPPoA MPoA RFC 1483 2684 IPv6 Enable gt Disable WAN IP Network Settings WAN IP Alias Obtain an IP address automatical DSL Modem Settings rats iy 4 Multi PC channel Channel 2 E S Domain Name oOo tC idzC 1483 Bridged IP LLC Required for some ISPs DHCP Client Identifier for some ISP VPI Enable vl Username Loo Modulation Password OoOo f Specify an IP address WAN Connection Detection IP Address ai Subnet Mask ale d Gateway IP Address f RIP Protocol Default MAC Address Specify a MAC Address MAC Address ho AA FAS 142 5g Bridge Mode Enable Bridge Mode DNS Server IP Address Primary IP 4ddress 8 8 8 8 Secondary IP Address 8 8 4 4 Available settings are explained as follows Enable RIP Item
322. ior PHB The definition of PHB includes Expedited Forwarding EF Assured Forwarding AF and Best Effort BE AF defines the four classes of delivery or forwarding classes and three levels of drop precedence in each class Vigor routers as edge routers of DS domain shall check the marked DSCP value in the IP header of bypassing traffic thus to allocate certain amount of resource execute appropriate policing classification or scheduling The core routers in the backbone will do the same checking before executing treatments in order to ensure service level consistency throughout the whole QoS enabled network Private Network DS domain 1 DS domain 2 Vigor2830 Series User s Guide 214 Dr ay Te k However each node may take different attitude toward packets with high priority marking since it may bind with the business deal of SLA among different DS domain owners It s not easy to achieve deterministic and consistent high priority QoS traffic throughout the whole network with merely Vigor router s effort In the Bandwidth Management menu click Quality of Service to open the web page Bandwidth Management gt gt Quality of Service General Setup Setto Factory Default Class Class Class ne Online Index Status Bandwidth Direction Others Bandwidth ae 1 2 3 Statistics Control WANI Enable Kbps Kbps Outbound 25 25 25 25 Inactive Status Setup WAN Enable 100000Kbps 100000Kbps Outbound 25 25 25 25 Inactive status Setup
323. is field Password Type a valid password provided by the ISP Confirm Password Retype the password Back Click it to return to previous setting page Next Click it to get into the next setting page Cancel Click it to give up the quick start wizard 3 Please manually enter the Username Password provided by your ISP Then click Next for viewing summary of such connection Vigor2830 Series User s Guide 26 Dr ay Tek 4 3 Quick Start Wizard Please contirm your settings WAN Interface WAMI Physical Mode ADSL Physical Type Auta negotiation WHI 0 WOT 33 Protocol Encapsulation PPPoE LLE Fixed IP Ho Primary DNS 5 5 5 8 Secondary DNS 6 6 4 4 Click Finish A page of Quick Start Wizard Setup OK will appear Then the system status of this protocol will be shown Quick Start Wizard Setup OK H Now you can enjoy surfing on the Internet 1483 Bridged IP 1483 Routed IP Choose WANI as WAN Interface and click the Next button you will get the following l Dray Tek page Choose 1483 Bridged IP 1483 Routed IP as the protocol Quick Start Wizard Connect to Internet WAH 1 VBI Auto detect Vl Protocol Encapsulation 1483 Routed IP LLC Fixed IP Oves NofDynamic IP IP Address Subnet Mask Default Gateway Primary ONS Second ONS Available settings are explained as follows Cancel Item Description 21 Vigor2830 Series User s Guide VPI Type in the valu
324. is recommended for you to use FAT32 for viewing the filename completely FAT16 cannot support long filename USE Application gt USB General Settings USB General Settings General Settings Simultaneous FTP Connections Maximum 6 Default Charset English ww Samba Service Settings Network Neighborhood Enable Disable Access Mode LAN Only LAN 4nd AN NetBios Name Service Workgroup Name WORKGROUP Host Name igor Note 1 If Charset is set to English only English long file name is supported 2 Multi session tp download will be banned by Router FTP server If your ftp client have multi connection mechanism such as Filezilla you may limit cient connections setting to 1 to get better performance 3 workgroup name must not be the same as the host name The workgroup name and the host name can have as many as 15 characters and a host name can have as many as 23 characters but both cannot contain any of the following pies 4 4 7 Available settings are explained as follows Item Description General Settings Simultaneous FTP Connections This field is used to specify the quantity of the FTP sessions The router allows up to 6 FTP sessions connecting to USB storage disk at one time Default Charset At present Vigor router supports four types of character sets Default Charset is for English based Vigor2830 Series User s Guide 328 Dr ay Tek file name English w Chinese Simnle Chines
325. it will be illustrated as below Alice Bob sip alicem draytel com sip bobmdraytel com The major benefit of this mode is that you don t have to memorize your friend s IP address which might change very frequently if it s dynamic Instead of that you will only have to using dial plan or directly dial your friend s account name if you are with the same SIP Registrar Peer to Peer Before calling you have to know your friend s IP Address The Vigor VoIP Routers will build connection between each other Vigor VoIP Router Vigor VoIP Router Our Vigor V models firstly apply efficient codecs designed to make the best use of available bandwidth but Vigor V models also equip with automatic QoS assurance QoS Assurance assists to assign high priority to voice traffic via Internet You will always have the required inbound and outbound bandwidth that is prioritized exclusively for Voice traffic over Internet but you just get your data a little slower and it is tolerable for data traffic Vigor2830 Series User s Guide 274 Dr ay Te k 3 13 1 DialPlan This page allows you to set phone book and digit map for the VoIP function Click the Phone Book and Digit Map links on the page to access into next pages for dialplan settings VoIP gt gt DialPlan Setup DialPlan Configuration Phone Book Digit Map Call Barring Regional PSTN Setup Secure Phone configuration Enable Secure Phone ZRTP SRTP E
326. ithout IPSec policy above The maximum length for username is 16 characters Password This field is applicable when you select PPTP or L2TP with or without IPSec policy above The maximum length for password is 16 characters Enable Mobile One Time Passwords mOTP Check this box to make the authentication with mOTP function PIN Code Type the code for authentication e g 1234 Secret Use the 32 digit secret number generated by mOTP in the mobile phone e g e759bb6f0e94c7ab4fe6 This group of fields is applicable for IPSec Tunnels and L2TP with IPSec Policy when you specify the IP address of the remote node The only exception is Digital Signature X 509 can be set when you select IPSec tunnel either with or without specify the IP address of the remote node Pre Shared Key Check the box of Pre Shared Key to invoke this function and type in the required characters 1 63 as the 20 Dray Tek Item Description pre shared key Digital Signature X 509 Check the box of Digital Signature to invoke this function and Select one predefined Profiles set in the VPN and Remote Access gt gt IPSec Peer Identity IPSec Security Method This group of fields is a must for IPSec Tunnels and L2TP with IPSec Policy when you specify the remote node Check the Medium DES 3DES or AES box as the security method Medium Authentication Header AH means data will be authenticated but not be encrypted By default this optio
327. ity 000nnnn0aannnnoaannnnonnnnnnnsnnnnrnsnnnrenrsnnnrrosnnnrrersnnrrrrsnnrreersnnrersnnrrrrnne 246 3 11 5 Remote Dial in User smsisicaresssuteeaxnianssranduasasaudonsersecudvavensuadsseudeiwarasinindlecloneradonnsteandouses 248 LE LAN ICLAN eorr T 252 3 11 7 VPN TRUNK Management cccccssssccccssceecseeeceeseecseaseeecsaaeeecseseessaseeessenseesseass 262 3 11 8 CONNECTION MANAGEMENT ceeeecccccccccaeeeeeeceeeceeeeeseeceeeeeseaeeeseeeeeeeeseaaeeeeeeeessaaageses 267 3 12 Certificate MAnageMe nt cccccccccceeecceeeesseeeeeeeeseeseeceeeessseaeseseeeeeesssaaaeeeeeeesssuaageeeeeeees 268 3 12 1 Local Certificate 0 0 cccccccccccssssseccceeeecesseeeeeeeeeeseeeseseeeeeeesseeessseeeeeeessaeaaseeeesseaeageeeees 268 3 12 2 Trusted CA Certificate cc ccccccccccccecseeeeeeeeeeeesseeesseeeeeeeeeeaaeeseseesessaeaaeeeeeeesssaaegesss 272 3 12 3 Cerificate BACKUP wicieveccncssswnsedecnassdesedenccatetes snctievedaceceiestasiedeitsedaldacedecttsnebusestdeneantabebescese 273 Tg WM Oe ease serrate caer E E E E 273 ee POIANA ee E E E E E EEE 275 Me UAC COUN eeann tesa je eetotusesrectictras E A RE E E 284 Ce PONE Se INNS ae goes ns E E so gaesua bacseas aoqtunceaectonet aencemnatsnncsbaentons 288 FS Fe UI Sears exec E E E EES ETE E ET E E E EEE E E 293 AN SS CAN oe a T axaaterancess 295 1141 B i 0g 0 nee E T OEE O E EE 295 J142 General SEUD enn eee nee eee 297 PAAS I e E E A E E E 299 AAAS COTTO aa E E eee
328. ivated You can access into My Vigor server to activate the service e g WCF that you want 4 13 2 Creating an Account via MyVigor Web Site 1 Access into http myvigor draytek com Find the line of Not registered yet Then click the link Click here to access into next page Dray Tek ee 22 CO n Home search eo TETE ai About Us x MyVigor website replaces the VigorPro site as DrayTek s portal site for Product the latest products and services in network security including Anti UserName My Information Virus Anti Spam Web Content Filter etc The products and functions Password VigorPro that are supported in this site include f rd VigorPro Unified Security Firewall series Qb k q Vd e Activation of Commtouch GlobalView Web Content Filter If you can t read the AuthCode click here license key e Activation of DT Anti Virus license key e Activation of Kaspersky Anti Virus license key gt Fi e Activation of Commtouch Anti Spam license key and 3 membership l Not registered yet Click here Vigor routers for models that support Commtouch e Activation of Commtouch GlobalView Web Content Filter license key The MyVigor website contains a trail version of Commtouch GlobalView Web Content Filter which allows the users to set filters to block out undesirable web pages in the Internet jungle Please use IE 5 0 or above z resolution 1024 768
329. ive or not If not the router will do something to save the bandwidth for other using Click On to invoke this function click off to close the function voice Active Detector 3 13 3 Phone Settings This page allows user to set phone settings for Phone and Phone 2 respectively However it changes slightly according to different model you have VoIP gt gt Phone Settings Index Port Call Feature Tone Gain Mic Speaker Default SIP Account DTMF Relay 1 Phonel CW CT User Defined D5 DutBand Phone CW CT User Defined o 5 OutBand RTP CO Symmetric RTP Dynamic RTP Port Start 10050 Dynamic ETP Port End 15000 ETF TOS IF precedence 5 w hooo Available settings are explained as follows N OO Vigor2830 Series User s Guide Dray Tek Item Description Phone List Port there are two phone ports provided here for you to configure Phonel Phone2 allows you to set general settings for PSTN phones Call Feature A brief description for call feature will be shown in this field for your reference Tone Display the tone settings that configured in the advanced settings page of Phone Index Gain Display the volume gain settings for Mic Speaker that configured in the advanced settings page of Phone Index Default SIP Account draytel_1 is the default SIP account You can click the number below the Index field to change SIP account for each phone port DTMF Relay Display DTMF mode that configur
330. k the tab of Port based Bridge Check the box of Enable for the 5 WAN Check the box of P4 All of the traffic coming from LAN Port 4 will be directed to channel 5 first and then to channel 1 WAN gt Multi PVCs Multi PVCs General ATM QoS Port based Bridge PVC to PVC Binding Add Tag Channel Enable P1 P2 P3 P4 Service Type 1 2 Normal Normal Normal Normal Normal Normal Note 1 Channel 1 to 2 are reserved for Nat Route use P1 is reserved for Nat Route use 10 Click OK to save the settings 11 Now all the data from P1 transmitted to the remote PPPoE server via WAN and the data from P4 IPTV transmitted to the remote DHCP Server via WAN 5 are all processed by Channel 1 Vigor2830 Series User s Guide 374 Dr ay Te k 4 2 How to Configure Multi Subnet in Vigor2830 There are two types of VLAN One is Port Based VLAN the other is Tag Based VLAN Refer to the following sections for learning the usage of VLAN I Port Based VLAN Vigor2830 can divide the physical LAN ports into several groups For example it can divide the internal departments of a company into three different groups Each group uses different network segment See the following graphic for an example VLAN2 Sales Dept LAN3 192 168 5 x Finance Dept LAN2 192 168 3 x MR Dept LAN4 192 168 1 x Group 0 VLANO Human Resource LAN Port 1 IP 192 168 1 0 24 Group VLAN1 Finance Dept LAN Port 2 IP 192 168 3 0 24 Group 2
331. lained as follows Item Description Name Type a name for this profile e g game Contents Type the content for such profile For example type gambling as Contents When you browse the webpage the page with gambling information will be watched out and be passed blocked based on the configuration on Firewall settings 3 After finishing all the settings here please click OK to save the configuration Objects Setting gt gt Keyword Object Keyword Object Profiles Setto Factory Default Index Name Index Name L Keyword 1 ii A Keyword 2 18 a 19 Vigor2830 Series User s Guide 184 Dr ay Te k 3 7 8 Keyword Group This page allows you to bind several keyword objects into one group The keyword groups set here will be chosen as black white list in CSM gt gt URL Web Content Filter Profile Objects Setting gt gt Keyword Group Keyword Group Table Setto Factory Default Index Name Index Name 1 17 Z 16 3 19 4 20 5 FA 6 22 i 3 5 24 a 25 11 2T 12 28 14 30 Available settings are explained as follows Item Description Set to Factory Default Clear all profiles Index Display the profile number that you can configure Name Display the name of the group profile To set a new profile please do the steps listed below 1 Click the number e g 1 under Index column for configuration in details Objects Setting gt Keyword Group Keyword Group Table Index Name ie
332. lease type the tag value and specify the priority for the packets sending by WANI1 Disable Disable the function of VLAN with tag Tag value Type the value as the VLAN ID number The 68 Dray Tek range is form 0 to 4095 Priority Type the packet priority number for such VLAN The range is from 0 to 7 Active Mode Choose Always On to make such WAN connection being activated always Always On Aluy Y 5 D n Backup Load Balance Check this box to enable auto load balance function for such WAN interface When the data traffic is large the WAN interface with the function enabled will balance the data transmission automatically among all of the WAN interfaces in connection status Backup Type If you choose Backup as the Active Mode Backup WAN will be changed into Backup Type You have to specify which role the WAN interface should play if you want to backup multiple WANs However ignore this setting if you want to backup a single WAN Active Mode Backup j Owan 11 WAN 2 Owan 3 Sarg eb a wha When any of selected WAN disconnect multiple WAN When all of selected WAN disconnect When any of selected WAN disconnect Such backup WAN will be activated when any master WAN interface disconnects When all of selected WAN disconnect Such backup WAN will be activated only when all master WAN interfaces disconnect After finishing all the settings here please click OK to save the configuratio
333. lected Specific Number for barring Type Route All means all the phone calls will be blocked with such mechanism Index 1 15 in Schedule Enter the index of schedule profiles to control the call barring according to the preconfigured schedules Refer to section Applications gt gt Schedule for detailed configuration Additionally you can set advanced settings for call barring such as Block Anonymous Block Unknown Domain or Block IP Address Simply click the relational links to open the web page For Block Anonymous this function can block the incoming calls without caller ID on the interface Phone port specified in the following window Such control also can be done based on preconfigured schedules Vigor2830 Series User s Guide 280 Dr ay Tek VoIP gt gt DialPlan Setup Call Barring Block Anonymous Enable Route C Phonei LJ Phone Index 1 15 in Schedule Setup Note Block the incoming calls which do not have the caller ID For Block Unknown Domain this function can block incoming calls through Phone port from unrecognized domain that is not specified in SIP accounts Such control also can be done based on preconfigured schedules VoIP gt DialPlan Setup Call Barring Block Unknown Domain Enable Route C Phonet J Phone Index 1 15 in Schedule Setup Note If the domain of the incoming call is different from the domain found in SIP accounts the call should be blo
334. lid DSL Modem Settings Set up the DSL parameters required by your ISP These are vital for building DSL connection to your ISP Multi PVC channel The selections displayed here are determined by the page of Internet Access gt gt Multi PVCs Select M PVCs Channel means no selection will be chosen VPI Type in the value provided by ISP VCI Type in the value provided by ISP Encapsulating Type Drop down the list to choose the type provided by ISP Protocol Drop down the list to choose the one PPPoE or PPPoA provided by ISP Vigor2830 Series User s Guide 74 Dr ay Tek Dray Tek PPPoE Pass through WAN Connection Detection Bridge Mode MTU ISP Access Setup If you have already used Quick Start Wizard to set the protocol then it is not necessary for you to change any settings in this group Modulation Default setting is Multimode Choose the one that fits the requirement of your router Modulation Multimode A 71 412 5 Lite 5 OMT ADSLATS Soe 3 ADSL annex Ml ADSLA 6 99725 ADSL2 annex Mv Multimode The router offers PPPoE dial up connection Besides you also can establish the PPPoE connection directly from local clients to your ISP via the Vigor router When PPPoA protocol is selected the PPPoE package transmitted by PC will be transformed into PPPoA package and sent to WAN server Thus the PC can access Internet through such direction For Wired LAN If you check this box
335. ll restart with the factory default configuration GigaLAN 1 4 Connecters for local networked devices DSL Connecter for accessing the Internet through ADSL2 2 WAN2 Giga Connecters for remote networked devices USB Connecter for a USB device for 3G USB Modem or printer PWR Connecter for a power adapter ON OFF Power Switch Dr ay Tek 3 Vigor2830 Series User s Guide 1 1 2 For Vigor2830n Vigor2830n plus wiesa Lay G CF O ONMOFFWFS act WLAN DoS O O 0 a USB DSL WPN Factory Renal ESM WAHT God Wireiesstan O 6 amp ONIOFFIWPS ACT WLAN DoS O USB DSL VPN Factory Reset o CSM WAN2Z QoS LED ACT Activity USB CSM WLAN DSL WAN2 DoS VPN QoS LED on Connector GigaLAN 1 2 3 4 WAN 2 Giga Vigor2830 Series User s Guide Drey Tek Dray Tek SEIE Blinking Off Blinking 5 Blinking Blinking Blinking Blinking Left LED Green O Blinking O 5 gt JB Right LED Green Off Left LED Green Off Blinking On Off Right LED Green Vigor2830n ADSL Security Firewall z 3 a DSL GigaLAN r 1 Vigor2830n plus ADSL2 Security Firewall 2 3 a DSL GigaLAN 1 WAN 2G ga USB Dual Band WAN2 Giga USB Explanation The router is powered on and running normally The router is powered off USB device is connected and ready for use The data is transmitting Th
336. llow your computer to trust certificates issued from this certification authority tis not necessary to manually install the CA certification path if you request and install a certificate from this certification authority because the CA certification path will be installed for you automatically Choose file to download CA Certificate Previous vigor ODER encoded or Base 64 encoded Download CA certificate Download CA certification path Download latest certificate revocation list 3 Back to Vigor router go to Trusted CA Certificate Click IMPORT button and browse the file to import the certificate cer file into Vigor router When finished click refresh and you will find the below illustration Certificate Management gt gt Trusted CA Certificate X509 Trusted CA Certificate Configuration Name Subject Status Modify Trusted CA 1 IC USithl vigor Not Yet Valid lew Delete Trusted CA 2 MEIE Delete Trusted CA 3 lew Delete IMPORT REFRESH 4 You may review the detail information of the certificate by clicking View button Mame Trusted CA 1 Issuer f SroN vigor Subject IOsUSiehl vigar Subject Alternative Name Valid From Aug 30 23 08 43 2005 GMT Valid Ta Aug 30 23 17 47 2007 GMT Close ONS draytek com Note Before setting certificate configuration please go to System Maintenance gt gt Time and Date to reset current time of the router first
337. long we divide the page into several sections for explanation Profile Index 1 1 Common Settings Profile Name 09 Call Direction Both Dial out Dial in C Enable this profile O Always on Idle Timeout second s YPN Dial Out Through WA First C Enable PING to keep alive Netbios Naming Packet Pass eBlock PING to the IP Multicast via VPN OPass Block for same IGMP IP Camera DHCP PRelay etc 2 Dial Out Settings Type of Server am calling Username 399 PPTP Password Max 15 char fe IPsec Tunnel PPP Authentication L2TP with IPsec Policy Mone PAP Only y Y Compression on off Server IP Host Name for WPH such as draytek com or 1235 45 67 89 IKE Authentication Method Pre Shared Key Digital Signature 509 Local ID Alternative Subject Name First Subject Name First Local Certificate IPsec Security Method MediumtAH High ESP DES without Auhertioaion E Index 1 15 in Schedule Setup Available settings are explained as follows Item Description Common Settings Profile Name Specify a name for the profile of the LAN to LAN connection Enable this profile Check here to activate this profile VPN Dial Out Through Use the drop down menu to choose a proper WAN interface for this profile This setting Dr ay Tek 253 Vigor2830 Series User s Guide Vigor2830 Series User s Guide is useful for dial out only AANI First WANT Orly WAM First
338. lows devices to take more time in sleeping state and consume less power to improve the performance by minimizing transmission latency Wireless LAN gt gt WMM Configuration WMM Configuration WMM Capable Enable Disable APSD Capable Enable Disable WMM Parameters of Access Point Alfsn CWMin CWMax Txop ACM AckPolicy AC_BE o o Ac no oO Ac_vo o oO WMM Parameters of Station Aifsn CWMin CWMax Txop ACM AC_VvO E OK Available settings are explained as follows Item Description WMM Capable To apply WMM parameters for wireless data transmission please click the Enable radio button APSD Capable The default setting is Disable Aifsn It controls how long the client waits for each data transmission Please specify the value ranging from to 15 Such parameter will influence the time delay for WMM accessing categories For the service of voice or video image please set small value for AC_VI and AC_VO categories For the service of e mail or web browsing please set large value for AC_BE and AC_BK categories CW Min CW Max CWMin means contention Window Min and CWMax means contention Window Max Please specify the value ranging from to 15 Be aware that CWMax value must be greater than CWMin or equals to CWMin value Both values will influence the time delay for WMM accessing categories The difference between AC_VI and AC_VO Dr ay Tek 311 Vigor2830 Series User s Guide categories must be smaller however the differe
339. ls Page Advanced You can configure DHCP options here Force router to use DNS server IP address settings specified in For the detailed settings of the network segment open LAN gt gt General Setup and click Details Page Adjust the settings for your request Refer to the following figure Dr ay Tek 379 Vigor2830 Series User s Guide LAN gt General Setup LAN 1 Ethernet TCP 1IP and DHCP Setup Network Configuration For WAT Usage IP 4ddress Subnet Mask RIP Protocol Control 192 168 1 1 255 255 255 0 LAN 11IPv i Setup DHCP Server Configuration Enable Server Disable Server Enable Relay Agent 1927 168 1 10 Start IP Address 200 IP Pool Counts Gateway IP Address 192 168 1 1 56400 s Lease Time C Retrieve IPs from inactive clients periodically DNS Server IP Address Primary IP Address Secondary IP Address Configuration for VigorSwitch 2240 1 Open Vlan gt gt Tag based Group 2 Add four VID groups In this case we can explanation it with Port 15 16 17 18 and Trunk Port 23 Dray Tek Auto Logout oF VigorSwitch G2240 a system Port Clyian vlan Mode Tag based Grot Por based Group Ports Port Isolation Management Vian HMAC GVRP Hoos SNMP MAct HIP MAC Binding Tag Based VLAN Memberships Configuration IGMP A IGMP Aware VLAN Name P VLAN Private VLAN CJC GVRP P GVRP Propagation Port Members Del VID IGMP A P VLAN GVRP P 1
340. lt settings Index Display the profile number that you can configure Name Display the name of the object profile To set a new profile please do the steps listed below 1 Click the number e g 1 under Profile column for configuration in details Objects Setting gt File Extension Object File Extension Object Profiles Profile Name 1 m Dr ay Tek 187 Vigor2830 Series User s Guide 2 The configuration page will be shown as follows Objects Setting gt File Extension Object Setup Profile Index 1 Categories Image Select All Clear All Select All rat T oO Clear All Audio Select All Clear All Java Select All Clear All Activex Select All Clear All Compression Select All Clear All Executation Select All Clear All Item Profile Name L bmp E pet F asf d g aac Fra class L jse Ol alx Ol viv ace Cl war d bas F SCI C dib E pex M aw E rm E aiff Ol ram E jad C jsp E apb C vrm LJ arj F Sit LJ bat File Extensions E gif C pic C mov C wmy E au O wox LJ jar C jtk Ol axs C bzip2 EO zip Cl com Available settings are explained as follows Description LI jpeg C pict L mpe E 3gp O mp3 O waw Cl jav C ocx E bz2 d EXE Type a name for this profile L jpg L png L mpeg L 3gpp COl m4a L wm
341. lt Clear all profiles Index Display the profile number that you can configure Name Display the name of the object profile To set a new profile please do the steps listed below 1 Click the number e g 1 under Index column for configuration in details Objects Setting gt IPv6 Object IPvo Object Profiles 2 The configuration page will be shown as follows Dr ay Tek 175 Vigor2830 Series User s Guide Objects Setting gt gt IPv6 Object Profile Index 1 Name Address Type Mac Address Start IP Address End IP Address Prefix Len Invert Selection Ss ba Yoo oo Yoo Yoo Yon TTC SY Sd O Available settings are explained as follows Item Name Address Type MAC Address Start IP Address End IP Address Subnet Mask Invert Selection Description Type a name for this profile Maximum 15 characters are allowed Determine the address type for the IPv6 address Select Single Address if this object contains one IPv6 address only Select Range Address if this object contains several IPv6s within a range Select Subnet Address if this object contains one subnet for IPv6 address Select Any Address if this object contains any IPv6 address Select Mac Address if this object contains Mac address Range Address cingle Address Range Address Mac Address Type the MAC address of the network card which will be controlled Type the start IP address for Single Addr
342. lt Gateway Primary ONS Second ONS Available settings are explained as follows Item VPI VCI Protocol Encapsulation Fixed IP IP Address Primary DNS Secondary DNS Back Next Cancel Description Type in the value provided by ISP Auto detect Click this button to have the VPI and VCI to be detected by the system automatically Type in the value provided by ISP There are several modes offered for you to choose for WANI interface PPPoE LLC SNAP bd PPPoE VC MUX PPPoA LLC SNAP PPPoA VC MUX 1463 Bridged IP LLC 1463 Routed IP LLC 1463 Bridged IP VC Mux 1463 Routed IP VC Mux IPoA 1453 Bridged IP IPoE Click Yes to enable Fixed IP feature Type the IP address if Fixed IP is enabled Type in the primary IP address for the router Type in secondary IP address for necessity in the future Click it to return to previous setting page Click it to get into the next setting page Click it to give up the quick start wizard 25 Vigor2830 Series User s Guide 2 After finished the above settings simply click Next Quick Start Wizard Set PPPoE PPPoA WAN 1 Service Name Optional D4005 755 hinet net Username Password Confirm Password Available settings are explained as follows Item Description Service Name Enter the description of the specific network service Optional User Name Type in the valid user name maximum 63 characters provided by the ISP in th
343. lt MAC Address WAN Connection Detection Specify a MAC Address Mode MAC Address 50 fra Ping IP MTU Max 1492 Available settings are explained as follows Item Description Enable Disable Click Enable for activating this function If you click Disable this function will be closed and all the settings that you adjusted in this page will be invalid ISP Access Setup Enter your allocated username password and authentication parameters according to the information provided by your ISP Username Type in the valid user name maximum 63 characters provided by the ISP in this field Password Type in the password provided by ISP in this field Index 1 15 in Schedule Setup You can type in four sets of time schedule for your request All the schedules can be set previously in Application gt gt Schedule web page and you can use the number that you have set in that web page WAN Connection Such function allows you to verify whether network Detection connection is alive or not through ARP Detect or Ping Detect Mode Choose ARP Detect or Ping Detect for the system to execute for WAN detection Ping IP If you choose Ping Detect as detection mode you Vigor2830 Series User s Guide 80 Dr ay Tek have to type IP address in this field for pinging TTL Time to Live Displays value for your reference TTL value is set by telnet command MTU It means Max Transmit Unit for packet The def
344. m Start menu gt Run Type command for Windows 95 98 ME or cmd for Windows NT 2000 XP Vista The DOS command dialog will appear w Command Prompt Microsoft Windows HP Version 5 1 2688 CC Copyright 1985 2001 Microsoft Corp D Documents and Settings faerping 192 168 1 1 Pinging 192 168 1 1 with 32 bytes of data Reply from 192 168 1 1 bytes 32 time lt ims TTL 255 Reply from 192 168 1 1 bytes 32 time lt ims Reply from 192 168 1 1 bytes 32 time lt ims Reply from 192 168 1 1 bytes 32 time lt ims TTL 255 Ping statistics for 192 168 1 1 Packets Sent 4 Received 4 Lost A tz loss Approximate round trip times in milli seconds Minimum Hms Maximum ms Average Ams D Documents and Settings fae gt _ Type ping 192 168 1 1 and press Enter If the link is OK the line of Reply from 192 168 1 1 bytes 32 time lt Ims TTL 2595 will appear If the line does not appear please check the IP address setting of your computer For MacOs Terminal 1 2 3 4 Dray Tek Double click on the current used MacOs on the desktop Open the Application folder and get into Utilities Double click Terminal The Terminal window will appear Type ping 192 168 1 1 and press Enter If the link is OK the line of 64 bytes from 192 168 1 1 icmp_seq 0 ttl 255 time xxxx ms will appear 447 Vigor2830 Series User s Guide AHA Terminal bash 80x24 Last login Sat Jan 3 8224218 on typi Welcome to Darwiri
345. mapping to Account 1 Account Number Name Se 63 char max Password ee 63 char max Phone 2 default mapping to Account 2 use the same Account as phonel Account Number Name ES as 63 char max Password fs 63 char max 7 Available settings are explained as follows Item Description Set VoIP service VoIP service provider Use the drop down list to choose provider domain the ISP which offers the VoIP service for your router SIP Port Use the default setting 5060 Set Account quickly Account Number Name Type the account number name registered to your ISP Password Type the password for the account registered to your ISP Use the same Account as phone 1 If you don t need to configure Phone 2 settings simply check this box Next Click it to get into the next setting page Cancel Click it to give up the quick start wizard Vigor2830 Series User s Guide 58 Dr ay Te k 3 After finished the settings above click Next for viewing summary of such connection VoIP Wizard Please confirm your settings VoIP Service Provider draytel org SIP Port 5060 Phone 1 Account 5335 Phone 2 Account 56335 Click Back to modify changes if necessary Otherwise click Finish to sawe current settings 4 Click Finish A page of VoIP Wizard Setup OK will appear VoIP Wizard Setup OR 2 Registering Vigor Router You have finished the configuration of Quick Start Wizard and you can surf the
346. me of the event occurred Log Type Display the type of the record Message Display the information for each event Vigor2830 Series User s Guide 368 Dr ay Te k 3 18 12 IPv6 TSPC Status IPv6 TSPC status web page could help you to diagnose the connection status of TSPC If TSPC has configured properly the router will display the following page when the user connects to tunnel broker successfully Diagnostics gt gt TSPC Status WAN WANZ2 WANS Refresh TSPC Enabled TSPC Connection Status Local Endpoint v4 Address 1 169 155 138 Local Endpoint v6 Address 2001 05c0 1400 000b 0000 0000 0000 b527 Router DNS name vigor2850 broker freenet6 net Remote Endpoint v4 Address B17 1 72 11 Remote Endpoint v6 Address 2001 05c0 1400 000b 0000 0000 0000 b526 Tspe Prefix 2001 05c0 1513 5900 0000 0000 0000 0000 Tspe Prefixlen 56 Tunnel Broker amsterdam freenet6 net Tunnel Status Connected Available settings are explained as follows Item Description Refresh Click this link to refresh this page manually 3 19 External Devices This page allows you to enable or disable the function of detecting external devices External Devices C External Device Auto Discovery External Devices Connected Below shows available devices that connected externally For security reason If you have changed the administrator password on External Device please click the Account button ta retype new username and password Otherwise
347. n Dr ay Te k 69 Vigor2830 Series User s Guide WANS with USB To use 3G network connection through 3G 4G USB Modem please configure WAN3 interface WAN gt General Setup WAN 3 Enable Display Name Physical Mode Line Speedikbps DownLink Uplink Active Mode Load Balance wan 1U WAN 2 WAN 3 Backup Type Only if acting as backup for When any of selected WAN disconnect multiple WAN O when all of selected WAN disconnect Note Line Speed only used for load balance mode according to Line Speed Available settings are explained as follows Item Description Enable Choose Yes to invoke the settings for this WAN interface Choose No to disable the settings for this WAN interface Display Name Type the description for such WAN interface Physical Mode Display the physical mode of such WAN interface Physical type In such WAN interface no type can be selected Line Speed If your choose According to Line Speed as the Load Balance Mode please type the line speed for downloading and uploading for such WAN interface The unit is kbps Active Mode Choose Always On to make such WAN connection being activated always Always On Aly a pi T B n Backup Load Balance Check this box to enable auto load balance function for such WAN interface When the data traffic is large the WAN interface with the function enabled will balance the data transmission automatically among all of the WAN interfaces in
348. n Login Page Title Type a brief description e g Welcome to DrayTek which will be shown on the heading of the login dialog Welcome Message and Type words or sentences here It will be displayed for Bulletin bulletin message In addition it can be displayed on the login dialog at the bottom Note that do not type URL redirect link here Preview Click it to display the preview of the login window based on the settings on this web page Set to Factory Default Click to return to the factory default setting Below shows an example of login customization with the information typed in Login Description and Bulletin Dray Te k 343 Vigor2830 Series User s Guide Login for Test Password Copyright DrayTek Corp All Rights Reserved D r ay Tek Vigor This is an example of Bulletin feature of Vigor Routers 1 John please pay your rent 2 Mary please collect your electricity bill in the mailbox 3 Josh could t manage to reach you but your parents were looking for you urgently 3 17 6 Configuration Backup Backup the Configuration Follow the steps below to backup your configuration 1 Goto System Maintenance gt gt Configuration Backup The following windows will be popped up as shown below System Maintenance gt Configuration Backup Configuration Backup Restoration Restoration Select a configuration file es cc Click Restore to upload the file Backup Click Backup to download cu
349. n List Station List Status MAC Address Status Codes Connected No encryption Connected WEP Connected WPA Connected WPA2 Blocked by Access Control Connecting Fail to pass 802 1 of WPA PSE authentication NZzObPuomMO A Note After a station connects to the router successfully it may be turned off without notice In that case it will still be on the list until the connection expires Aidid to Access Control Client s MAC address i A Add Available settings are explained as follows Item Description Refresh Click this button to refresh the status of station list Add Click this button to add current typed MAC address into Access Control Vigor2830 Series User s Guide 314 Dr ay Tek 3 14 11 Bandwidth Management It controls the bandwidth limit for all the wireless clients accessing into Internet through such router Wireless LAN gt Bandwidth Management SSID 1 SSID 2 SSID 3 SSID 4 SSID DrayTek Enable Bandwidth Limit Type Total Upload Limit Kbps4 Total Download LimitfKbps Note 1 Cownload Traffic going to any station Upload Traffic being sent from a wireless station 2 Allow auto adjustment could make the best utilization of available bandwidth Cancel K Available settings are explained as follows Item Description Enable Click this button to enable such function Bandwidth Limit Type There are two types to be specifiy Auto Adju
350. n based on 6rd mode Online Status Physical Connection System Uptime Oday 0 9 15 IPv4 IPv6 LAN Status IP Address 2001 E41 A865 1D00 21D AAFF FE83 1164 64 Global FE80 21D AAFF FE83 1164 64 Link TX Packets RX Packets TX Bytes 115 1354 WAN1 IPv6 Status Enable Mode Up Time 6rd 0 09 06 Gateway IP 2001 E41 A4865 1D01 21D AAFF FE83 11B5 128 Global FE80 COA8 651D 128 Link TX Packets RX Packets TX Bytes 13 29 967 Dr ay Tek 97 Vigor2830 Series User s Guide 3 1 4 Multi PVCs This router allows you to create multi PVCs for different data transferring for using Simply go to Internet Access and select Multi PVCs page General The system allows you to set up to eight channels which are ready for choosing as the first PVC line that will be used as multi PVCs WAN gt gt Multi PVCs Multi PVCs General Channel I ae 5 4 5 WAN 6 WAN 7 WAN 5 Note YPI YCI must be unique for each channel ATM QoS Enable VPI o o m E m E m n a a Port based Bridge PVC to PVC Binding Add Tag VC QoS Type Protocol Encapsulation BR PPPoE LLOJSNAP 4 1483 Bridged IP LLC w OO 4 0j ory BAE Ij oo c c oo D ve mux Y vc mux _ ve mux ve MUX iy ve MUX iy ve MUX iy Cancel Clear Eeee Available settings are explained as follows Item Enable VPI VCI QoS Type Protocol Vigor2830 Series User s Guide Description Check this box to en
351. n is invoked You can uncheck it to disable it High Encapsulating Security Payload ESP means payload data will be encrypted and authenticated You may select encryption algorithm from Data Encryption Standard DES Triple DES 3DES and AES Local ID optional Specify a local ID to be used for Dial in setting in the LAN to LAN Profile setup This item is optional and can be used only in IKE aggressive mode After finishing all the settings here please click OK to save the configuration Dray Te k 251 Vigor2830 Series User s Guide 3 11 6 LAN to LAN Here you can manage LAN to LAN connections by maintaining a table of connection profiles You may set parameters including specified connection direction dial in or dial out connection peer ID connection type VPN connection including PPTP IPSec Tunnel and L2TP by itself or over IPSec and corresponding security methods etc The router supports up to 32 VPN tunnels simultaneously The following figure shows the summary table according to the item All Trunk selected for View VPN and Remote Access gt LAN to LAN LAN to Lah Profi Set to Factory Default Index Name Active Status Index Name Active Status 1 d ar 17 Fi 2 77 d aes 18 Ol 3 d zgi 19 C r 4 2 d oe 20 C aaa 5 nee d o H 77 C 6 d as 22 77 a es i 77 d a 23 C aes B LJ ona 24 C _ g 779 L 25 L Zoe 10 m d aae
352. n vertical axis represent the numbers of the NAT sessions during the past Dray Te k 365 Vigor2830 Series User s Guide 3 18 10 Trace Route Click Diagnostics and click Trace Route to open the web page This page allows you to trace the routes from router to the host Simply type the IP address of the host in the box and click Run The result of route trace will be shown on the screen Diagnostics gt gt Trace Route Trace Route IPv4 OIPVE Trace through Unspecified Protocal ICMP Run Result Clear Or Diagnostics gt gt Trace Route Trace Route Trace Host IP Address S O Run Result Clear Available settings are explained as follows Item Description IPv4 IPv6 Click one of them to display corresponding information for it Trace through Use the drop down list to choose the interface that you want Vigor2830 Series User s Guide 366 Dr ay Te k to ping through Protocol Use the drop down list to choose the protocol that you want to ping through Host IP Address It indicates the IP address of the host Trace Host IP Address It indicates the IPv6 address of the host Run Click this button to start route tracing work Clear Click this link to remove the result on the window 3 18 11 Syslog Explorer Such page provides real time syslog and displays the information on the screen For Web Syslog This page displays the time and message for User Firewall call W AN VPN settings You can ch
353. nable SAS Yoice Prompt Available settings are explained as follows Item Description Enable Secure Phone It allows users to have encrypted RTP stream with the peer side using the same protocol ZRTP SRTP Check this box to have secure call Enable SAS Voice Prompt If it is enabled SAS prompt will be heard for both ends every time If it is disabled no SAS prompt will be heard any more Application for Secure Phone Enable SAS Voice Prompt for ex if vigor router A calls vigor router B with checking Enable Secure Phone and Enable SAS Voice Prompt then 1 After the connection established vigor router A will send SAS voice prompt to A and vigor router B will send the SAS voice prompt to B 2 Then the RTP traffic is secured until the call ends 3 If vigor router A wants to call vigor router B again next time both A and B will not hear any voice prompt again even checking Enable SAS Voice Prompt on web UI It means only the first call between them will have voice prompt Enable SAS Voice Prompt for ex if vigor router A calls vigor router B with checking Enable Secure Phone but not Enable SAS Voice Prompt then 1 After the connection established vigor router A will NOT send SAS voice prompt to vigor router A and vigor router B will NOT send the SAS voice prompt to vigor router B 2 Even no voice prompt but the RTP traffic is still secured until the call ends Note If the incoming or outgoing calls do not match any
354. nabled LAN parts will have issues when connecting to a L2 switch If you want 802 1 support for multiple network devices please disable 802 1 here and configure 802 1 on the connecting switch This feature supports PEAP and EAP TLS Available settings are explained as follows Item Description Enable Check the box to enable LAN 802 1x function 802 1x ports After enabling the function simply specify the LAN port s to apply such function After finishing all the settings here please click OK to save the configuration Dr ay Tek 123 Vigor2830 Series User s Guide 3 2 8 Web Portal Setup This page allows you to configure a profile with specified URL for accessing into or display a message when a wireless LAN user connects to Internet through this router No matter what the purpose of the wireless LAN client is he she will be forced into the URL configured here while trying to access into the Internet or the desired web page through this router That is a company which wants to have an advertisement for its products to users can specify the URL in this page to reach its goal LAN gt Web Portal Setup Web Portal Table Status Disable Disable Disable Disable Interface Mone None Hone Hone Mote Internet access must be enabled while webpage redirection is about to enable Each item is explained as follows Item Profile Status Interface Preview Vigor2830 Series User s Guide De
355. name and password defined in User Management gt gt User Profile click Login You can access into Internet or access into the Landing Page if configured in User Management gt gt General Setup Dray Te k 395 Vigor2830 Series User s Guide 4 7 Create a LAN to LAN Connection Between Remote Office and Headquarter The most common case is that you may want to connect to network securely such as the remote branch office and headquarter According to the network structure as shown in the below illustration you may follow the steps to create a LAN to LAN profile These two networks LANs should NOT have the same network address Router B 220 135 240 210 RouterA 220 135 240 208 Headquarter Remote Branch Office 192 168 1 0 192 168 2 0 Settings in Router A in headquarter 1 Goto VPN and Remote Access and select Remote Access Control to enable the necessary VPN service and click OK 2 Then For using PPP based services such as PPTP L2TP you have to set general settings in PPP General Setup VPN and Remote Access gt gt PPP General Setup PPP General Setup PPP MP Protocol LDAP Server Profiles for PPP Authentication AA PAPICHAP MS CHAPIMS CHAPy2 PTP LDAP Profile Authentication Mote Please select PAP Only in Dial In PPP Dial In PPP Authentication if you want to use 4D LDAP for Encryption MPPE Optional MPPE PPP Authentication Mutual 4uthentication PAF ves No Username IP Addr
356. nce between AC_BE and AC_BK categories must be greater Txop It means transmission opportunity For WMM categories of AC_VI and AC_VO that need higher priorities in data transmission please set greater value for them to get highest transmission opportunity Specify the value ranging from 0 to 65535 ACM It is an abbreviation of Admission control Mandatory It can restrict stations from using specific category class 1f it is checked Note Vigor2920 provides standard WMM configuration in the web page If you want to modify the parameters please refer to the Wi Fi WMM standard specification AckPolicy Uncheck default value the box means the AP router will answer the response request while transmitting WMM packets through wireless connection It can assure that the peer must receive the WMM packets Check the box means the AP router will not answer any response request for the transmitting packets It will have better performance with lower reliability 3 14 9 AP Discovery Vigor router can scan all regulatory channels and find working APs in the neighborhood Based on the scanning result users will know which channel is clean for usage Also it can be used to facilitate finding an AP for a WDS link Notice that during the scanning process about 5 seconds no client is allowed to connect to Vigor This page 1s used to scan the existence of the APs on the wireless LAN Yet only the AP which is in the same channel of thi
357. nd IPv6 for you to configure the static route Both protocols bring different web pages Static Route for IPv4 LAN gt Static Route Setup IPw4 IP wo Setto Factory Default View Routing Table Index Destination Address Status Index Destination Address Status L TTF F G TT 7 2 TTT T TT T 3 TTT T TTT 4 TTT T a TTT 7 T TTF T 10 TT 7 Status v Active x Inactive Empty Available settings are explained as follows Item Description Set to Factory Default Clear all of the settings and return to factory default settings Viewing Routing Table Displays the routing table for your reference Diagnostics gt gt View Routing Table Current Running Routing Table Refresh Key C connected 5S static R RIP default private S 0 0 0 0 0 0 0 0 via 172 16 3 1 WAN 1 C 192 168 1 0 255 255 255 0 is directly connected LAN C 172 16 3 0 255 255 255 0 is directly connected WANI Index The number 1 to 10 under Index allows you to open next page to set up static route Destination Address Displays the destination address of the static route Status Displays the status of the static route Vigor2830 Series User s Guide 114 Dr ay Te k Static Route for IPv6 You can set up to 40 profiles for IPv6 static route LAN gt Static Route Setup IPw4 IPvo Setto Factory Default View IPvG Routing Table Index Destination Address Status Index Destination Address Status ie fe el W 11 at
358. nd Remote Access gt Remote Access Control Setup Remote Access Control Setup Enable PPTP VPN Service Enable IPSec VPN Service Enable L2TP VPN Service Enable SSL YPN Service Note To allow VPN pass through to a separate YPN server on the LAN disable any services above that use the same protocol and ensure that NAT Open Ports or Port Redirection is also configured 3 11 2 PPP General Setup This submenu only applies to PPP related VPN connections such as PPTP L2TP L2TP over IPSec VPN and Remote Access gt gt PPP General Setup PPP General Setup PPP MP Protocol Dial In PPP PAPICHAPIMS CHAPIMS CHAPY2 w an Authentication LDAP Server Profiles for PPP Authentication shrad Dial In PPP Note Please select PAP Only in Dial In PPP Eneryption MPPE eel ML Mutual Authentication FAF 4 Username Password Authentication If you want to use 40 LOAP for Yes No PPP Authentication IP Address Assignment for Dial In Users When DHCP Disable set Assigned IP start LAN 1 492 168 1200 LAN 2 192 168 2200 LAN 3 192 168 3 200 LAN 4 192 168 4 200 Available settings are explained as follows Item Dial In PPP Authentication Dial In PPP Encryption MPPE Vigor2830 Series User s Guide Description PAP Only elect this option to force the router to authenticate dial in users with the PAP protocol PAP or CHAP Selecting this option means the router will attempt to authentica
359. nd modify the selected IP address and MAC address that you create before Delete You can remove any item listed in IP Bind List Simply click and select the one and click Delete The selected item will be removed from the IP Bind List Note Before you select Strict Bind you have to bind one set of IP MAC address for one PC If not no one of the PCs can access into Internet And the web user interface of the router might not be accessed 3 2 6 LAN Port Mirror LAN port mirror can be applied for the users in LAN Generally speaking this function copies traffic from one or more specific ports to a target port This mechanism helps manager track the network errors or abnormal packets transmission without interrupting the flow of data access the network By the way user can apply this function to monitor all traffics which user needs to check There are some advantages supported in this feature First it is more economical without other detecting equipments to be set up Second it may be able to view traffic on one or more ports within a VLAN at the same time Third it can transfer all data traffics to be mirrored to one analyzer connect to the mirroring port Next it is more convenient and easy to configure in user s interface Last connect a PC with Smart Monitor installed to the mirror port of this router to capture monitored information LAN gt LAN Port Mirror LAN Port Mirror Port Mirror O Enable Disable Mirror p
360. ndex Name Status 1 T77 x 17 r77 x a 777 x 16 777 x 2 PPP x 19 777 x 4 777 x 20 2 x AL T77 x 1 27 x 6 777 x EEA 777 x if 77 x 23 2 x a 777 x 24 2 x 9 7979F 4 75 7979F x 10 779 4 26 7979 x 11 777 x ff F77 x 12 777 x 20 777 X 13 777 ra 39 777 x 14 777 x 30 777 x 15 777 x 31 777 x 16 777 bi Ar 777 x Available settings are explained as follows Item Description Set to Factory Default Click it to clear all indexes Index Click the number below Index to access into the setting page of IPSec Peer Identity Name Display the profile name of that index Click each index to edit one peer digital certificate There are three security levels of digital signature authentication Fill each necessary field to authenticate the remote peer The following explanation will guide you to fill all the necessary fields Vigor2830 Series User s Guide 246 Dr ay Tek VPN and Remote Access gt gt IPSec Peer Identity Profile Index 1 Profile Name one Enable this account Accept Any Peer ID Accept Subject Alternative Name Type IP Address w IP Accept Subject Name Country T State 5T SSS Location L Orginization Unit OU Po Common Name CN Email E S Available settings are explained as follows Item Description Profile Name Type the name of the profile Accept Any Peer ID Click to accept any peer regardless of its identity Accept Subject Click to check
361. ndwidth usage it will be of great value to provide the blocking mechanism that filters out the multimedia files downloading from web pages Upload Check the box to block the file upload by way of web page File Extension Profile Choose one of the profiles that you configured in Object Setting gt gt File Extension Objects previously for passing or blocking the file downloading 203 Vigor2830 Series User s Guide None After finishing all the settings here please click OK to save the configuration 3 8 3 Web Content Filter Profile There are three ways to activate WCF on vigor router using Service Activation Wizard by means of CSM gt gt Web Content Filter Profile or via System Maintenance gt gt Activation Service Activation Wizard allows you to use trial version or update the license of WCF directly without accessing into the server My Vigor located on http myvigor draytek com However if you use the Web Content Filter Profile page to activate WCF feature it is necessary for you to access into the server MyVigor located on http myvigor draytek com Therefore you need to register an account on http myvigor draytek com for using corresponding service Please refer to section of creating My Vigor account Note If you have used Service Activation Wizard to activate WCF service you can skip this section WCE adopts the mechanism developed and offered by certain service provider e g DrayTek No matter
362. necting to Vigor2830 LAN Port can get the corresponding IP address of the network segment The equipment connecting to Vigor2830 LAN Port 1 LAN1 can get the IP address of 192 168 1 0 24 The equipment connecting to Vigor2830 LAN Port 2 LAN2 can get the IP address of 192 168 3 0 24 The equipment connecting to Vigor2830 LAN Port 3 and Port 4 LAN3 can get the IP address of 192 168 5 0 24 For the detailed settings of the network segment open LAN gt gt General Setup and click Details Page Adjust the settings for your request Refer to the following figure Vigor2830 Series User s Guide 376 Dray Tek LAN gt gt General Setup LAN 1 Ethernet TCP IP and DHCP Setup LAN 1 IPv6 Setup Network Configuration DHCP Server Configuration For NAT Usage Enable Server Disable Server IP Address 192 166 1 1 LJEnable Relay Agent Subnet Mask 955 255 255 0 Start IP Address 192 166 1 10 IP Pool Counts RIP Protocol Control Gateway IP Address 192 168 1 1 Note Disable LAN amp Enable LAN shouldn t be in the same subnet Lease Time s Retrieve IPs from inactive clients periodically DNS Server IP Address Primary IP Address Secondary IP Address 6 To make any two of VLAN groups linked with each other just check the boxes of the ones in the field of Inter LAN Routing in the page of LAN gt gt General Setup Refer to the following figure LAN2 and LAN3 are linked Inter LAN Routing Subnet LAN 1 LAN 2 LAN 3 LAN 4 LAN 1
363. ng between the AP and the stations 20 40 the router will use 20Mhz or 40Mhz for data transmission and receiving according to the station capability Such channel can increase the performance for data transit It is to assure the safety of propagation delays and reflections for the sensitive digital data If you choose auto as guard interval the AP router will choose short guard interval increasing the wireless performance or long guard interval for data transmit based on the station capability Aggregation MSDU can combine frames with different sizes It is used for improving MAC layer s performance for some brand s clients The default setting is Enable This option is to define the length of the sync field in an 802 11 packet Most modern wireless network uses short preamble with 56 bit sync field instead of long preamble with 128 bit sync field However some original 11b wireless network devices only support long preamble Click Enable to use Long Preamble if needed to communicate with this kind of devices This feature can enhance the performance in data transmission about 40 more by checking Tx Burst It 309 Vigor2830 Series User s Guide is active only when both sides of Access Point and Station in wireless client invoke this function at the same time That is the wireless client must support this feature and invoke the function too Note Vigor N61 wireless adapter supports this function Therefore you
364. ng out WAIT_ ANS Indicates that a connection is launched and waiting for remote user s answer ALERTING Indicates that a call is coming ACTIVE Indicates that the VoIP connection is launched Indicates the voice codec employed by present channel The present in call or out call peer ID the format may be IP or Domain The format is represented as hours minutes seconds Total number of transmitted voice packets during this connection session Total number of received voice packets during this connection session Total number of lost packets during this connection session The jitter of received voice packets Accumulation for the times of in call Accumulation for the times of out call Accumulation for the times of missing call The volume of present call Display logs of VoIP calls 4 Dray Tek 3 14 Wireless LAN This function is used for n models only 3 14 1 Basic Concepts Over recent years the market for wireless communications has enjoyed tremendous growth Wireless technology now reaches or is capable of reaching virtually every location on the surface of the earth Hundreds of millions of people exchange information every day via wireless communication products The Vigor n model a k a Vigor wireless router is designed for maximum flexibility and efficiency of a small office home Any authorized staff can bring a built in WLAN client PDA or notebook into a meeting room for conference wi
365. ng such The default setting is WANI1 After setting Enable UPNP Service setting an icon of IP Broadband Connection on Router on Windows XP Network Connections will appear The connection status and control status will be able to be activated The NAT Traversal of UPnP enables the multimedia features of your applications to operate This has to manually set up port mappings or use other similar methods The screenshots below show examples of this facility Dray Tek Address e Network Connections Broadband Network Tasks E Create a new connection T Setup a home or small office network See Also i Network Troubleshooter Other Places Internet Gateway Te IP Broadband Connection on Router Enabled __LAN or High Speed Internet G Control Panel a My Network Places My Documents 4 My Computer Local 4rea Connection Enabled Details i m Realtek RTLG139 810x Family Network Connections aih alteri i am System Folder 235 IP Broadband Connection on Router Status AE Sa General Internet Gateway Status Connected Duration 00 19 06 Speed 100 0 Mbps Acctivity Internet Internet Gateway My Computer Packets Sent 404 Ta Received 1 115 BEE Disable Vigor2830 Series User s Guide The UPnP facility on the router enables UPnP aware applications such as MSN Messenger to discover what are behind a NAT router The application will also learn the exte
366. ngs result of the WAN interface Click the Setup link to access into next page for the general setup of WAN interface As to class rule simply click the Edit link to access into next for configuration You can configure general setup for the WAN interface edit the Class Rule and edit the Service Type for the Class Rule for your request Online Statistics Display an online statistics for quality of service for your reference Bandwidth Management gt gt Quality of Service WAN Online Statistics Pefresh Interval seconds Refresh Index Direction Class Name Reserved bandwidth Ratio Outbound Throughput Bytes sec 1 OT 25 0 2 OWT 25 0 a OJT 25 0 4 DT Others 25 0 Outbound Status Others o 5 10 Eps General Setup for WAN Interface When you click Setup you can configure the bandwidth ratio for QoS of the WAN interface There are four queues allowed for QoS control The first three Class 1 to Class 3 class rules can be adjusted for your necessity Yet the last one is reserved for the packets which are not suitable for the user defined class rules Vigor2830 Series User s Guide 216 Dr ay Tek Bandwidth Management gt gt Quality of Service WAN General Setup Enable the QoS Control Index Class Name Reserved bandwidth Ratio Class 1 25 Class 2 Yo Class 3 Yo Others Yo C Enable UDF Bandwidth Control Limited bandwidth Ratio Oo C Outbound TCP ACK Prioritize Note 1 Before enable QoS you should test t
367. ning is selected Then click OK to save the settings WAN gt General Setup WAN 2 Enable Physical Mode Ethernet Physical Type Auto negotiation Line Speed Kbps DownLink lo VLAN Tag insertion Priority Send 5M5 if line drops out Send Mail Alert if line drops out CL Active Mode WAN 1 WAN 2 IWAN 3 ear Aa sich hie When any of selected WAN disconnect multiple WAN when all of selected WAN disconnect When such WAN e g WAN2 in this example disconnects due to some reason the system will use other WAN for connection instead and send SMS to notify the user destination number 123456789 However if there is no available WAN for connection the system will send SMS to inform the user after reconnecting WAN2 successfully Vigor2830 Series User s Guide 388 Dray Tek 4 5 Web Portal Log In Application for Wireless Client With the increase of hotspot deployed via Wi Fi technology in the world we may easily get Internet connection with the served wireless connection facility provided by the campus chain store the coffee shop the airport department store municipal etc Such hotspot deployment contributes to seamless Internet connection which enables the remote workers or wireless users to get onto the cyber space anywhere at anytime In contrast to the real wireless user s advantage earn from hotspot the Wi Fi connection providers may also earn placement marketing advantage v
368. nt monitoring situation Object Settings gt gt Notification Object Setto Factory Default Profile Name Settings PEP eRe eS To set a new profile please do the steps listed below 1 Open Object Setting gt gt Notification Object and click the number e g 1 under Index column for configuration in details Object Settings gt gt Notification Object Index Profile Name 1 2 BE Vigor2830 Series User s Guide 194 Dr ay Te k 2 The configuration page will be shown as follows Object Settings gt gt Notification Object Profile Index 1 Profile Name Notify attack Category Status WAN Disconnected Reconnected VPN Tunnel Disconnected Reconnected Available settings are explained as follows Item Description Profile Name Type a name for such notification profile Category Display the types that will be monitored Status Display the status for the category You can check the box you want to be monitored 3 After finishing all the settings here please click OK to save the configuration Object Settings gt Notification Object Setto Factory Default Index Profile Name Settings Notify_attack WAN ea Dr ay Tek 195 Vigor2830 Series User s Guide 3 8 CSM Profile Content Security Management CSM CSM is an abbreviation of Content Security Management which is used to control IM P2P usage filter the web content and URL content to reach a goal
369. nt profile setup For troubleshooting needs you can specify to record information for IM P2P by checking the Log box It will be sent to Syslog server Please refer to section Syslog Mail Alert for more detailed information Select one of the URL Content Filter profile settings created in CSM gt gt URL Content Filter for applying with this router Please set at least one profile for choosing in CSM gt gt URL Content Filter web page first Or choose Create New from the drop down list in this page to create a new profile For troubleshooting needs you can specify to record information for URL Content Filter by checking the Log box It will be sent to Syslog server Please refer to section Syslog Mail Alert for more detailed information Select one of the Web Content Filter profile settings created in CSM gt gt Web Content Filter for applying with this router Please set at least one profile for anti virus in CSM gt gt Web Content Filter web page first Or choose Create New from the drop down list in this page to create a new profile For troubleshooting needs you can specify to record information for Web Content Filter by checking the Log box It will be sent to Syslog server Please refer to section Syslog Mail Alert for more detailed information Click Edit to open the following window However it is strongly recommended to use the default settings here 1 1 docfipfedrady him WHATA 192 168 1 1 doctipfedrady htm
370. ntication client server protocol that supports authentication authorization and accounting which is widely used by Internet service providers It is the most common method of authenticating and authorizing dial up and tunneled network users The built in RADIUS client feature enables the router to assist the remote dial in user or a wireless station and the RADIUS server in performing mutual authentication It enables centralized remote access authentication for network management Applications gt RADIUS RADIUS Setup Enable Destination Port 1812 Available settings are explained as follows Item Description Enable Check to enable RADIUS client feature Server IP Address Enter the IP address of RADIUS server Destination Port The UDP port number that the RADIUS server is using The default value is 1812 based on RFC 2138 Shared Secret The RADIUS server and client share a secret that is used to authenticate the messages sent between them Both sides must be configured to use the same shared secret Confirm Shared Secret Re type the Shared Secret for confirmation After finished the above settings click OK button to save the settings Dray Te k 231 Vigor2830 Series User s Guide 3 10 5 Active Directory LDAP Lightweight Directory Access Protocol LDAP is a communication protocol for using in TCP IP network It defines the methods to access distributing directory server by clients work on directory and share the in
371. ocated Enable Daylight Saving Check the box to enable the daylight saving Such feature is available for certain area Automatically Update Select a time interval for updating from the NTP server Interval Click OK to save these settings 3 17 9 SNMP This page allows you to configure settings for SNMP and SNMPV3 services The SNMPv3 is more secure than SNMP through the encryption method support AES and DES and authentication method support MD5 and SHA for the management needs Applications gt gt SNMP SNMP Setup Enable SNMP Agent Get Community Set Community Manager Host IP IPyw4 fe Manager Host IP IPv Po Trap Community Notification Host IP IPv4 fs Notification Host IP IPv6 Po Trap Timeout Enable SNMPV3 Agent Auth Algorithm Auth Password fe Privacy Algorithm Privacy Password fo Available settings are explained as follows Item Description Enable SNMP Agent Check it to enable this function Get Community Set the name for getting community by typing a proper Dray Te k 349 Vigor2830 Series User s Guide Set Community Manager Host IP IPv4 Manager Host IP IPv6 Trap Community Notification Host IP IPv4 Notification Host IP IPv6 Trap Timeout Enable SNMPV3 Agent USM User Auth Algorithm Auth Password Privacy Algorithm Privacy Password Vigor2830 Series User s Guide character The default setting is public Set community by typing a proper name Th
372. ock can prevent specified PC accessing into Internet within 5 minutes Page Refresh bps Sessions Action Block Unblock the device with the IP address will be blocked in five minutes The remaining time will be shown on the session column Page 1 Refresh Sessions Action blacked 299 Unblock Current means current transmission rate and receiving rate for WAN interface Peak means the highest peak value detected by the router in data transmission Speed means line speed specified in WAN gt gt General Setup If you do not specify any rate at that page here will display Auto for instead 34 Dray Tek 3 18 9 Traffic Graph Click Diagnostics and click Traffic Graph to pen the web page Choose WANI WAN2 WAN3 Bandwidth Sessions daily or weekly for viewing different traffic graph Click Refresh to renew the graph at any time Diagnostics gt gt Traffic Graph Show Chart WANT Bandwidth Daily Refresh Mines 1 Refresh WAN Bandwidth WANG Bandwidth Sessions a Ts Kbps a EX Kbps Diagnostics gt gt Traffic Graph Show Chart WANI Bandwidth i Refresh 56 ae Ts Kbps a RX Kbps The horizontal axis represents time Yet the vertical axis has different meanings For WANI WAN2 WAN3Bandwidth chart the numbers displayed on vertical axis represent the numbers of the transmitted and received packets in the past For Sessions chart the numbers displayed o
373. of the router which means the router is the default gateway Lease Time Enter the time to determine how long the IP address assigned by DHCP server can be used Retrieve IPs from inactive clients periodically Whenever a DHCP client requests an IP address from the LAN DHCP server the server will give out an IP to this client for a certain amount of time e g 1 day However even if this client only uses the IP for say 5 minutes the server still reserves 1 day for that client Because a DHCP server only has a limited number of IPs to lease to its DHCP clients soon enough all the IPs will be used out and then no one will be able to get any IPs from this server anymore Therefore this feature is used to get the IP back from inactive clients i e doesn t use the IP but the server still reserves the IP for him DNS stands for Domain Name System Every Internet host must have a unique IP address also they may have a human friendly easy to remember name such as www yahoo com The DNS server converts the user friendly name into its equivalent IP address Primary IP Address You must specify a DNS server IP address here because your ISP should provide you with usually more than one DNS Server If your ISP does not 111 Vigor2830 Series User s Guide provide it the router will automatically apply default DNS Server IP address 194 109 6 66 to this field Secondary IP Address You can specify secondary DNS server IP addres
374. ol gt gt User Group SSL User Group Profiles Setto Factory Default Status Se e N e a e eS e SOS PA EI EA Each item is explained as follows Item Description Set to Factory Default Click to clear all indexes Index Display the number of the client which connecting to FTP server Name Display the name of the group profile Click any index number link to open the following page for detailed configuration Web Access Control gt gt User Group Index No 1 Enable Access Authority SSL Web Proxy SSL Application WA 1 Authentication Methods Local User DataBase Available User Accounts Selected User Accounts RADTUS LDAP Active Directory rdi shrd Dray Te k 325 Vigor2830 Series User s Guide Available settings are explained as follows Item Description Enable Check this box to enable such profile Group Name Type a name for such profile The length of the name is limited to 23 characters Access Authority Specify the authority for such profile At present Vigor router allows you to create SSL Web Proxy and SSL Application profiles used for SSL VPN The available profiles will be displayed here for you to select Access Authority SSL Web Proxy SSL Application LISSL_wP_1 O Game_APP Authentication Methods It can determine the authentication method used for such profile Local User DataBase The system will do the authentication by using the user defined account profiles in VP
375. om a CA server on Windows CA Server 0ssseeeeeeeeeeeeeeeeeees 416 4 12 Request a CA Certificate and Set as Trusted on Windows CA Server ccccceeeeeeeeetee 420 4 13 Creating an Account for MyYVIgOr cccccceeeeccccceceeeeeeeeeeeeeeeseaeeseseeeeeeeaaeessseeeeeesseeeeeeseeeeeeeas 422 4 13 1 Creating an Account via Vigor Router ccccceecceeceeeeeeeeeeaeeseceeseaaeeessaeaeeeeeeseaeeeess 422 4 13 2 Creating an Account via MyVigor Web Site rnnr rnnr rnrn nnna 426 4 14 How to Implement the LDAP AD Authentication for User Management 0000008 430 4 15 How to Implement the LDAP AD Authentication for VPN ccccsseeeeeeeeeeeeeeeeeeeeeeeeeaes 433 4 16 How to Setup Address Mapping ccccccccccccccecessssesseeseeeeeeeeeeeeeeeaaaeeeaeeeeeeeeeeeeeeeeeseeeeaaaagas 436 4 17 How to setup Load Balance for Packets c cccccccceeeeesesseeeeeeeeeeeesseeeeeeeeseaeesseeeeeeeeseaas 440 Vigor2830 Series User s Guide x Dr ay Tek THOUDIC SNOOUNG esise EE EE sect 443 5 1 Checking If the Hardware Status Is OK or Not c csssseeeeeeeeeeeeeeeeeeeeeeeeeeeesseeseeeeeeeeeeeeees 443 5 2 Checking If the Network Connection Settings on Your Computer Is OK or Not 0 444 5 3 Pinging the Router from Your Computer cccccccsseeeeeeeeeeeeeeeeeeeeeceeeeaseeeeseeeeesessuaeeeeeeeeess 447 5 4 Checking If the ISP Settings are OK or NOt 448 5 5 Problems for 3G Network Connection
376. on SysLog Access Setup Enable Check Enable to activate function of syslog Syslog Save to Check Syslog Server to save the log to Syslog server Check USB Disk to save the log to the attached USB storage disk Router Name Display the name for such router configured in System Maintenance gt gt Management If there is no name here simply lick the link to access into System Maintenance gt gt Management to set the router name Server IP Address The IP address of the Syslog server Destination Port Assign a port for the Syslog protocol Mail Syslog Check the box to recode the mail event on Syslog Enable syslog message Check the box listed on this web page to send the corresponding message of firewall VPN User Access Call WAN Router DSL information to Vigor2830 Series User s Guide 346 Dr ay Tek Syslog AlertLog Setup Check Enable to activate function of alert log AlertLog Port Type the port number for alert log The default setting is 514 Mail Alert Setup Check Enable to activate function of mail alert Send a test e mail Make a simple test for the e mail address specified in this page Please assign the mail address first and click this button to execute a test for verify the mail address is available or not SMTP Server The IP address of the SMTP server Mail To Assign a mail address for sending mails out Return Path Assign a path for receiving the mail from outside
377. on of Vigor2830n and enjoy the powerful firewall bandwidth management VPN features of Vigor2830n series AN ows A NIA 6 Web Surfing m lt VPN an d l a m X After connecting into the router 3G 4G USB Modem will be regarded as the third WAN port However the original WANI and WAN2 still can be used and Load Balance can be done in the router Besides 3G 4G USB Modem in WAN3 also can be used as backup device Therefore when WANI and WAN2 are not available the router will use 3 5G for supporting automatically The supported 3G 4G USB Modem will be listed on DrayTek web site Please visit www draytek com for more detailed information Internet lt VoIP Vigor2830 Series User s Guide 64 Dr ay Tek Below shows the menu items for WAN 3 1 2 General Setup This section will introduce some general settings of Internet and explain the connection modes for WAN1 WAN2 and WAN3 in details This router supports multiple WAN function It allows users to access Internet and combine the bandwidth of the multiple WANs to speed up the transmission through the network Each WAN port can connect to different ISPs Even if the ISPs use different technology to provide telecommunication service such as DSL Cable modem etc If any connection problem occurred on one of the ISP connections all the traffic will be guided and switched to the normal communication port for proper operation Please configure WAN1 WAN2 and
378. on page will be shown as follows Dray Tek Objects Setting gt gt IP Object Profile Index 11 Name Interface Address Type Mac Address Start IP Address End IP Address Subnet Mask Invert Selection ny Go Heo Yoo Yoo Yoo Yoo 192 166 1 65 x 192 165 1 69 It Available settings are explained as follows Item Name Interface Description Type a name for this profile Maximum 15 characters are allowed Choose a proper interface Any Mw A Hi Y LAMR TAPI AR For example the Direction setting in Edit Filter Rule will ask you specify IP or IP range for WAN or LAN RT VPN or any IP address If you choose LAN RT VPN as the Interface here and choose LAN RT VPN as the direction setting in Edit Filter Rule then all the IP addresses specified with LAN RT VPN interface will be opened for you to choose in Edit Filter Rule page 171 Vigor2830 Series User s Guide Address Type MAC Address Start IP Address End IP Address Subnet Mask Invert Selection Determine the address type for the IP address Select Single Address if this object contains one IP address only Select Range Address if this object contains several IPs within a range Select Subnet Address if this object contains one subnet for IP address Select Any Address if this object contains any IP address Select Mac Address if this object contains Mac address Range Address Any Address single Add
379. onal function However if one side wants to use it the peer must enable it too My GRE IP Type the virtual IP for router itself for verified by peer Peer GRE IP Type the virtual IP of peer host for verified by router TCP IP Network My WAN IP This field is only applicable when you select Settings PPTP or L2TP with or without PSec policy above The default value is 0 0 0 0 which means the Vigor router will get a PPP IP address from the remote router during the IPCP negotiation phase If the PPP IP address is fixed by remote side specify the fixed IP address here Do not change the default value if you do not select PPTP or L2TP Remote Gateway IP This field is only applicable when you select PPTP or L2TP with or without IPSec policy above The default value is 0 0 0 0 which means the Vigor router will get a remote Gateway PPP IP address from the remote router during the IPCP negotiation phase If the PPP IP address is fixed by remote side specify the fixed IP address here Do not change the default value if you do not select PPTP or L2TP Remote Network IP Remote Network Mask Add a static route to direct all traffic destined to this Remote Network IP Address Remote Network Mask through the VPN connection For IPSec this is the destination clients Ds of phase 2 quick mode Local Network IP Local Network Mask Add a static route to direct all traffic destined to Local Network IP Address Local Network Mask through the VP
380. oned above might be the ones to drop off How this will affect application performance There are two components within Primary configuration of QoS deployment Classification Identifying low latency or crucial applications and marking them for high priority service level enforcement throughout the network Scheduling Based on classification of service level to assign packets to queues and associated service types The basic QoS implementation in Vigor routers is to classify and schedule packets based on the service type information in the IP header For instance to ensure the connection with the headquarter a teleworker may enforce an index of QoS Control to reserve bandwidth for HTTPS connection while using lots of application at the same time One more larger scale implementation of QoS network is to apply DSCP Differentiated Service Code Point and IP Precedence disciplines at Layer 3 Compared with legacy IP Precedence that uses Type of Service ToS field in the IP header to define 8 service classes DSCP is a successor creating 64 classes possible with backward IP Precedence compatibility In a QoS enabled network or Differentiated Service DiffServ or DS framework a DS domain owner should sign a Service License Agreement SLA with other DS domain owners to define the service level provided toward traffic from different domains Then each DS node in these domains will perform the priority treatment This is called per hop behav
381. onfigure option 61 here the detailed settings in WAN gt gt Interface Access will be overwritten DataType Choose the type ASCII or Hex for the data to be stored Data Type the content of the data to be processed by the function of DHCP option Dr ay Tek 73 Vigor2830 Series User s Guide Details Page for PPPoE PPPOA in WANT To choose PPPoE PPPoA as the accessing protocol of the Internet please select PPPoE PPPoA from the WAN gt gt Internet Access gt gt WANI page The following web page will be shown WAN gt Internet Access WAN 1 PPPoE PPPoA MPoA RFC 1483 2684 IPvG Enable Disable ISP Access Setup Service Name Optional fe DSL Modem Settings Multi PViC channel Channel 1 a VPI pS PPP Authentication PAP or CHAF WET 332 o l l Idle Timeout secondis Encapsulating Type LLOSSMAP IP Address From ISP WAN IF Alias Protocol PPPoE l Fixed IP Yes No Dynamic IF Modulation Multimode Fixed IP Address PPPoE Pass through Default MAC Address LI For Wired LAN Specify a MAC Address C For Wireless LAN MAC Address 50 ha eee ere en Indexf1 15 in Schedule Setup TTL Bridge Mode CO Enable Bridge Mode MTU 1442 Max 1492 Available settings are explained as follows Item Description Enable Disable Click Enable for activating this function If you click Disable this function will be closed and all the settings that you adjusted in this page will be inva
382. onnected Disconnect USB Disk Write Protect Status No Disk Capacity 2009 MB Free Capacity OMB Refresh USB Disk Users Connected Refresh 192 168 1 10 1963 Note If the write protect switch of USB disk is turned on the USB disk is in READ ONLY mode No data can be written to it Now users in LAN of Vigor2830 can access into the USB storage device by typing ftp 192 168 1 1 on any browser They can add or remove files directories depending on the Access Rule for FTP account settings in USB Application gt gt USB User Management Vigor2830 Series User s Guide 384 Dr ay Te k 4 4 How to Send a Notification to Specified Phone Number via SMS Service in WAN Disconnection Follow the steps listed below 1 Log into the web user interface of Vigor router 2 Configure relational objects first Open Object Settings gt gt SMS Mail Server Object to get the following page Object Settings gt SMS Mail Service Object SMS Provider Mail Server Set to Factory Default Profile Name SMS Provider kotsms com tw TW kotsms com tw TW kotsms com tw TW kotsms com tw TW kotsms com tw TW kotsms com tw TW kotsms com tw TW kotsms com tw TW Custom 1 B e e mN pe ee ie Custom 2 Index 1 to Index 8 allows you to choose the built in SMS service provider If the SMS service provider is not on the list you can configure Index 9 and Index 10 to add the new service provider to Vigor router
383. ontent filter license Vigor2830 Series User s Guide 206 Dray Tek CSM gt gt Web Content Filter Profile Profile Index 1 Profile Name Default Black White List Enable Action Block Action Groups Child Protection Select All Clear All Leisure Select All Clear All BUSINESS OSOL Aaii Clear All i Group Object Selections Log Block a Categories M Alcohol amp Tobacco Hate amp Intolerance Porn amp Sexually School Cheating V Child Abuse Images Ll Entertainment Travel LJ Compromised Finance LI News LJ Politics Cl Restaurants amp Dining C General Cl Image Sharing Private IP Addresses Criminal Activity egal Drug V Violence Sex Education Garnes Leisure amp Recreation LiDating amp Personals Cl Government LJ Non profits amp NGOs Real Estate Cl Shopping LJ cults Cl Network Errors Cl Uncategorised Sites Available settings are explained as follows Gambling Nudity Weapons Tasteless Cl Sports Ol Fashion amp Beauty LJ Education Health amp Medicine Personal Sites C Religion Cl Translators Greeting cards Parked Domains Enable Activate white black list function for such profile Group Object Selections Click Edit to choose the group or object profile as the content of white black list Pass allow accessing into the corresponding w
384. oose WPA PSK or WPA2 PSK mode and access WPS again Vigor2830 Series User s Guide 304 Dr ay Te k Below shows Wireless LAN gt gt WPS web page Wireless LAN gt gt WPS Wi Fi Protected Setup MlEnable wes C Wi Fi Protected Setup Information WPS Status Configured SSID DrayTek Authentication Mode Disable Device Configure Configure via Push Button Configure via Client PinCode Note WPS can help your wireless chent automatically connect to the Access point WPS is Disabled a WPS is Enabled Waiting for WPS requests from wireless clients Available settings are explained as follows Item Description Enable WPS Check this box to enable WPS setting WPS Status Display related system information for WPS If the wireless security encryption function of the router is properly configured you can see Configured message here SSID Display the SSID1 of the router WPS is supported by SSID1 only Authentication Mode Display current authentication mode of the router Only WPA2 PSK and WPA PSK support WPS Configure via Push Click Start PBC to invoke Push Button style WPS setup Button procedure The router will wait for WPS requests from wireless clients about two minutes The WPS LED on the router will blink fast when WPS 1s in progress It will return to normal condition after two minutes You need to setup WPS within two minutes Configure via Client Please input the PIN code specified in wireless cli
385. or internal users in a company or your home Wireless Wizard Host AP Configuration Mode channel Password Note The host AP configured here will be used for home or internal company use Finish Available settings are explained as follows Item Description Name Type the SSID name of this router The default name is defined with DrayTek Mode At present the router can connect to 11n Only 11g Only Mixed 11b 11g Mixed 11la 11n Mixed 11g 11n and Mixed 11b 11g 11n stations simultaneously Simply choose Mix 11b 11g 11n mode Dr ay Tek 55 Vigor2830 Series User s Guide Mixed l1b 11g i1ini 11g Only Mixed 11b 11g 11n TEY 11n Only 2 4 GHz tn Daly 2 4 GHz pee Mixed 11b 11g Mixed 1g 1 1 n Mixed 11g 11n R Mixed q1a 11n 5 GHz Mixed 11b 11g 11n T Mixed 11b 11g 11n or Channel Means the channel of frequency of the wireless LAN The default channel is 6 You may switch channel if the selected channel is under serious interference If you have no idea of choosing the frequency please select Auto to let system determine for you Password The wireless mode offered by this wizard is WPA2 PSK The WPA encrypts each frame transmitted from the radio using the key which either PSK Pre Shared Key entered manually in this field below or automatically negotiated via 802 1x authentication Either 8 63 ASCII characters such as 012345678 or 64 Hexadecimal digits leading by Ox such as
386. ork The networks are isolated secured and reduce the broadcasting storm effectively in each of networks with VLAN Guest Network 51D 1 VLAN Q SSID 2 VLANO a3 Logistics Dr ay Tek 455 Vigor2830 Series User s Guide Port based mode VLAN Confiquration Enable L afalolniniaiaga Se aS a Gl a G e Tag based mode Pienatte LAN Wireless LAN WLAN Tag Pi PZ P3 Pa S5301 SSID SSID SSM Sia bared VID Priority To deploy a guest network which serves your guests the internet accessibility but the traffics have to be isolated from your private network due to the security considerations it can be done by above settings However a switch support VLAN function is need 1f VLAN Tag enabled Triple Play Multi WAN NAT mode with VLAN Vigor2830 Series User s Guide 456 Dray Tek Following settings the set top box STB is able to attach with any LAN port Video streaming which your ISP provided will be played on your monitor l Setup the VLAN ID on WAN 1 profiles if nema WAN is the primary interface of IPTV service Physical Mode Ethernet Phyncal Type Aan regen linn Lire Speedi bee Downlink i Enable Yer Uiplani i active Modo Abways On Load Balance 4 General Channel Enable WAN Type VLAN Taq Port based Bridge 1 Yas Ethemet Wal None Yes Ethemet WAN2 Hore 2 Ho Ethemet WAN 1 Horie Enable lPi Pa ipa ip 2 Open the profile of WANS by clickin
387. ort Ope2 Mirrored port LPi Note The selected mirror port will only serve debug purposes and should not be used as a part of the LAN Vigor2830 Series User s Guide 122 Dr ay Te k Available settings are explained as follows Item Description Port Mirror Check Enable to activate this function Or check Disable to close this function Mirror Port Select a port to view traffic sent from mirrored ports Mirrored port Select which ports are necessary to be mirrored After finishing all the settings here please click OK to save the configuration 3 2 7 Wired 802 1x IEEE 802 1x is an IEEE Standard for port based Network Access Control PNAC It is part of the IEEE 802 1 group of networking protocols It provides an authentication mechanism for the device that is attached toa LAN or WLAN Wired 802 1x provides authentication for one network device on each LAN port The RADIUS Server settings must be configured before enabling 802 1x because the EAP Extensible Authentication Protocol Authenticator relies on the RADIUS Server in its authentication process Each LAN port with Wired 802 1x configured will only forward 802 1x packets and block all other packets until the authentication has successfully completed LAN gt Wired 802 1x Wired 802 1x LAM 802 1 LJ Enable s02 1 ports Fi Please note that 802 18 enabled LAN ports will support EAPOL authentication for one network device only Therefore 802 1 e
388. ose L2TP over IPSec Nice to Have or L2TP over IPSec Must you will see the following graphic VPN and Remote Access gt gt VPN Client Wizard VPN Client L2TP over IPSec Nice to Have Settings Profile Name YPN Dial OQut Through O Always an Server IP Host Name for PM e g 5551234 draytek com or 123 45 67 89 IKE Authentication Method Pre Shared Key Confirm Pre Shared Key Digital Signature 5095 Peer ID Local ID Alternative Subject Name First Subject Name First IPSec Security Method Medium AH High ESP Username Password Remote Network IP Remote Network Mask Item Description VPN 2 WAM First v Available settings are explained as follows Profile Name Type a name for such profile The length of the file is limited to 10 characters 47 Vigor2830 Series User s Guide VPN Dial Out Through Always On Pre Shared Key Digital Signature X 509 IPSec Security Method Vigor2830 Series User s Guide Use the drop down menu to choose a proper WAN interface for this profile This setting is useful for dial out only WAN1 First WAN Only WANT Only Backup WAN WAN Only Backup WAN1 WANS First WANS Only WANI First WAN2 First WAN3 First While connecting the router will use WAN1 WAN2 WANS3 as the first channel for VPN connection If WANI WAN 2 WANS3 fails the router will use another WAN interface instead WANI Only WAN2 Only WAN 3 Only While connecting the
389. our device has been successtully added to the database 7 Now you have finished the product registration 8 After clicking OK you will see the following page Your router has been registered to myvigor website successfully Dray Tek bhy otal coe etal cet D about Us Welcome droyickiac Product Last Login Time 2011 08 24 09 39 13 Last Login From 023 010 144 220 G My Information Current Login Time 2011 08 24 23 01 15 VigorACS i Current Login From 114 397 142 184 RowNe 5 PageNo 2 4 Vigor Series Your Device Lint Management Bcustomersuvey eee L ee ee ZOU 007071 44E Vigord00V Wigor3 300 x DOD 1S Vigorz870 Vigor 870 Vigor 7 1 ihn Viger fio gore S70 gorz 20 vigor 630 Wigorz630 Dr ay Tek 61 Vigor2830 Series User s Guide This page is left blank Vigor2830 Series User s Guide 62 Dr ay Te k 3 1 WAN 3 1 1 B Dray Tek Advanced Configuration This chapter will guide users to execute advanced web configuration 1 Open a web browser on your PC and type http 192 168 1 1 The window will ask for typing username and password 2 Please type admin admin on Username Password for administration operation Now the Main Screen will appear Note that different model will have different web pages Vigor2 830 Series ADSL2 Security Firewall Wizards Online Status Dray Tek System Status Model Name Firmware Version Build Date Time Vigor283
390. p view item amp id 5242 amp ltemid 293 amp lang en 3 10 3 Schedule The Vigor router has a built in real time clock which can update itself manually or automatically by means of Network Time Protocols NTP As a result you can not only schedule the router to dialup to the Internet at a specified time but also restrict Internet access to certain hours so that users can connect to the Internet only during certain hours say business hours The schedule is also applicable to other functions You have to set your time before set schedule In System Maintenance gt gt Time and Date menu press Inquire Time button to set the Vigor router s clock to current time of your PC The clock will reset once if you power down or reset the router There is another way to set up time You can inquiry an NTP server a time server on the Internet to synchronize the router s clock This method can only be applied when the WAN connection has been built up Applications gt gt Schedule Schedule Setto Factory Default Index Status Index Status ae x g H 2 x 10 H 3 11 Fs 4 4 12 x F 13 Fe 6 H 14 rs t H 15 H a 2 Status v Active x Inactive Available settings are explained as follows Item Description Set to Factory Default Clear all profiles and recover to factory settings Index Click the number below Index to access into the setting page of schedule Status Display if this schedule setting is active or inac
391. please click OK to save the configuration 3 8 5 APPE Support List This page offers the software versions for each applications managed by APP Enforcement Profiles by Vigor router Click the IM P2P PROTOCOL OTHERS tab to open the information page for different APP type CSM gt gt APPE Support List This charts lists out the APF Enforcement supported by Vigor routers Last Update on 2014 03 11 IM P P PROTOCOL OTHERS gt SO Sear services can not be blocked D T gt Baiduhi 37378 S ooo OO Po Fetion oo 200 S oooO GaduGadu Protocol Google Chat o ooo OO In ICQ6 if Videos are blacked Voices will be blocked Ica 7i at the same time In ICOS or former versions Videas and Voices can be blocked separately ICUZ 806 o O Jabber Gu a 2008 LINE o SRR eee aa nes rare LINE for PC 3 5 1 36 and mobile phone 2007 S S po MSN E Dr ay Tek 209 Vigor2830 Series User s Guide 3 9 Bandwidth Management Below shows the menu items for Bandwidth Management Bandwidth Management 3 9 1 Sessions Limit A PC with private IP address can access to the Internet via NAT router The router will generate the records of NAT sessions for such connection The P2P Peer to Peer applications e g BitTorrent always need many sessions for procession and also they will occupy over resources which might result in important accesses impacted To solve the problem you can use limit session to limit the session procession for spe
392. previous filter rule any more The number typed here is the total sessions of the packets that do not match the filter rule configured in this page The default setting is 60000 Strict Make the MAC address and IP address settings configured in IP Object for Source IP and Destination IP be bound for applying such filter rule No Strict no limitation Choose one of the QoS rules to be applied as firewall rule For detailed information of setting QoS please refer to the related section later Choose the WAN interface for applying Load Balance Policy uch item is available only when Rule Based is selected in User Management gt gt General Setup The general firewall rule will be applied to the user user group all users specified here Mone wt None User Object Create New User User Group Create New Group ALL Note When there is no user profile or group profile existed Create New User or Create New Group item will appear for you to click to create a new one Select an APP Enforcement profile for global IM P2P application blocking If there is no profile for you to selelct please choose Create New from the drop down list in this page to create a new profile All the hosts in LAN must follow the standard configured in the APP Enforcement 1s DrayTek URL Content Filter Web Content Filter Advance Setting Dray Tek profile selected here For detailed information refer to the section of APP Enforceme
393. r Dial In Users When DHCP Disable set Dial In PPP PAP or CHAP Authentication Assigned IF range 192 168 1 200 e E Optional MPPE ee Mutual Authentication PAP Yes No For using PSec based service such as IPSec or L2TP with IPSec Policy you have to set general settings in IKE IPSec General Setup such as the pre shared key that both parties have known Vigor2830 Series User s Guide 404 Dr ay Tek VPN and Remote Access gt gt IPSec General Setup VPN IKEIPSec General Setup Dial in Set up for Remote Dial in users and Dynamic IP Client LAN ta LAN IKE Authentication Method Pre Shared Key IPSec Security Method Medium CAH Data will be authentic but will not be encrypted High ESP Moes Mapes Maes Data will be encrypted and authentic 3 Go to Remote Dial In User Click on one index number to edit a profile Set Dial In settings to as shown below to allow the remote user dial in to build VPN connection If an PSec based service is selected you may further specify the remote peer IP Address IKE Authentication Method and IPSec Security Method for this Dial In connection Otherwise it will apply the settings defined in IPSec General Setup above VPN and Remote Access gt gt Remote Dial in User Index No 1 User account and Authentication C Enable this account Idle Timeout 300 second s Allowed Dial In Type C PPTP IPSec Tunnel C L2TP with IPSec Policy
394. r URL Access Control and Web Feature will be inactive Either URL Access Control First When all the packages matching with the conditions specified in URL Access Control and Web Feature below such function can determine the priority for the actions executed For this one the router will process the packages with the conditions set below for URL first then Web feature second Either Web Feature First When all the packages matching with the conditions specified in URL Access Dray Te k 201 Vigor2830 Series User s Guide URL Access Control Vigor2830 Series User s Guide Control and Web Feature below such function can determine the priority for the actions executed For this one the router will process the packages with the conditions set below for web feature first then URL second Both Pass Both Pass Both Black Either URL Access Control First Either Web Feature First None There is no log file will be recorded for this profile Pass Only the log about Pass will be recorded in Syslog Block Only the log about Block will be recorded in Syslog All All the actions Pass and Block will be recorded in Syslog Enable URL Access Control Check the box to activate URL Access Control Note that the priority for URL Access Control is higher than Restrict Web Feature If the web content match the setting set in URL Access Control the router will execute the action specified in
395. r ay Te k Index Click the number below Index to access into the setting page of schedule Profile Display the name of the profile Domain Name Display the domain name for certain service e g FTP Mail or Web server used by such profile To add anew LAN DNS profile 1 Click any index for example Index No 1 Applications gt gt LAN DNS Profile Index 1 Enable Profile IP Address List Index IF Address Same Subnet Reply Available settings are explained as follows Item Description Enable Check the box to enable such profile Profile Type a name for such profile Domain Name Type a domain name e g FTP Mail or Web server for such profile IP Address List Add Click it to open the following dialog You have to give an IP address representing the host P Host s IP Address Google Chrome O 192 168 1 1 doc landnshost htm Host s IP Address 172 16 3 55 Clonly responds to the DNS request when the sender is in the same subnet Only responds Disable it to apply this profile to all of the LAN subnets Or enable it to apply such profile to the PCs on the same subnet Delete Click it to remove the existed IP address displayed on the IP Address List Dr ay Tek 227 Vigor2830 Series User s Guide 2 Click OK button to save the settings Note For the detailed information about LAN DNS application refer to DrayTek website http www draytek com tw index php option com_k2 am
396. r detailed information CPE Client Such information is useful for Auto Configuration Server Enable Disable Allow Deny the CPE Client to connect with Auto Configuration Server Port Sometimes port conflict might be occurred To solve such problem you might change port number for CPE 337 Vigor2830 Series User s Guide Periodic Inform Settings The default setting is Enable Please set interval time or schedule time for the router to send notification to CPE Or click Disable to close the mechanism of notification STUN Settings The default is Disable If you click Enable please type the relational settings listed below Server IP Type the IP address of the STUN server Server Port Type the port number of the STUN server Minimum Keep Alive Period If STUN is enabled the CPE must send binding request to the server for the purpose of maintaining the binding in the Gateway Please type a number as the minimum period The default setting is 60 seconds Maximum Keep Alive Period If STUN is enabled the CPE must send binding request to the server for the purpose of maintaining the binding in the Gateway Please type a number as the maximum period A value of 1 indicates that no maximum period is specified 3 17 3 Admin Setting This page allows you to set new password System Maintenance gt gt Admin Setting Administrator Password Mew Password fo Max 23 characters allowed
397. r router In addition users must execute Connect manually in SSL Client Portal page SSL if you choose such selection web proxy over SSL will be applied for VPN After finishing all the settings here please click OK to save the configuration 3 15 3 SSL Application It provides a secure and flexible solution for network resources including VNC Virtual Network Computer RDP Remote Desktop Protocol SAMBA to any remote user with access to Internet and a web browser Web Access Control gt gt SSL Application SSL Applications Profiles Setto Factory Default Host Address Service x EO KX XH eH xX HN OK 1 d 3 4 a G E 8 g 10 Each item is explained as follows Item Description Name Display the application name of the profile that you create Host Address Display the IP address for VNC RDP or SAMBA path Service Display the type of the service selected e g VNC RDP SAMBA Active Display current status active or inactive of the selected profile Vigor2830 Series User s Guide 318 Dr ay Tek Dray Tek To create a new SSL application profile L Click number link under Index filed to set detailed configuration Web Access Control gt gt SSL Application SSL Applications Profiles The following page will appear Web Access Control gt gt SSL Application Profile Index 1 Enable Application Service Application Name Application IP Address Port
398. r router Vigor router Vigor router Vigor router Vigor router 172 16 3 130 J WAN Information TXRate RX Rate ae r LAN Information S TX Packets RX Packets WAN IP Goer Ss eS eee ees IPPBX Others C Pause Message statistic Session Usage 123 5 min average statistic WAN1 Tx 81 Kbps Rx 12 Kbps 5 min average USB Host Controller Driver OTG USB JEndpointAddress 82 in Attributes 02 Bulk USB EndpointAddress 01 out Attributes 02 Bulk USB Mass Storage device class USB Interface Class SubClass Protocol 08 06 50 USB InterFace 0 USB Per interface classes USB Device Class SubClass Protocol 00 00 00 USB SerialNumber 3 ED96E018 USB Product 2 Mass Storage USB Manufacturer 1 Generic USB Usb new device Yendor ID 0568F Product ID 6387 USB nurm of interfaces 1 USBJusb_set_configuration configuration 1 USB Usb Device Connected at Port 0 Transmission Rate is not fast enough Please connect your Notebook with 3G USB Modem to test the connection speed to verify if the problem is caused by Vigor2830 In addition please refer to the manual of 3G USB Modem for LED Status to make sure if the modem connects to Internet via HSDPA mode If you want to use the modem indoors please put it on the place near the window to obtain better signal receiving 5 6 Backing to Factory Default Setting If Necessary Sometimes a wrong connection can be improved
399. r specify the User Name and Password of the mutual authentication peer Assigned IP Start Enter a start IP address for the dial in PPP connection You should choose an IP address from the local private network For example if the local private network is 192 168 1 0 255 255 255 0 you could choose 192 168 1 200 as the Start IP Address You can configure up to four start IP addresses for LAN LDAP Server Profiles for Configured LDAP profiles will be listed under such item PPP Authentication Simply check the one you want to enable the PPP authentication by LDAP server profiles However if there is no profile listed simply click the link of PPTP LDAP Profile to create add some new LDAP profiles you want For detailed information about LDAP application refer to section 4 14 How to Implement the AD LDAP Authentication for User Management Dr ay Te k 243 Vigor2830 Series User s Guide 3 11 3 IPSec General Setup In IPSec General Setup there are two major parts of configuration There are two phases of IPSec gt Phase 1 negotiation of IKE parameters including encryption hash Diffie Hellman parameter values and lifetime to protect the following IKE exchange authentication of both peers using either a Pre Shared Key or Digital Signature x 509 The peer that starts the negotiation proposes all its policies to the remote peer and then remote peer tries to find a highest priority match with its policies Eventually to set up a
400. r2830 Series User s Guide 5 Open User Management gt gt General Setup Select User Based as the Mode option User Management gt gt General Setup General Setup Made Web Authentication HTTPS Notice User Management will refer to active rules in Data Filter as whitelists and blacklists In User based firewall mode Users match the above lists will not be required for authentication The firewall rules policy will still valid Otherwise authentication required for users not matched the above lists The firewall rules designated in the user profile s policy will still valid Landing Page Max 255 characters Preview Setto Factory Default body stats l gt lt script langquage Javascript gt window location http f m drayter com lt scripte lt body gt 6 Then open User Management gt gt User Profile Click index 3 to create a new user profile User Management gt gt User Profile User Profile Table Profile Name admin Dial In User a 7 Check Enable this account choose LDAP as External Server Authentication and check the user profile you want User Management gt gt User Profile Profile Enable this account Username Password Confirm Password Idle Timeout mints O Unlimited Max User Login 0O O Unlimited External Server Authentication dl Log Pop Browser Tracking Window 7 Authentication Web Alert Tool Telnet Landing Page Index 1 15 in
401. r2830 Series User s Guide 268 Dr ay Tek certificate subject alternative name type and relational settings for subject name Then click GENERATE again Certificate Management gt Local Certificate Generate Certificate Signing Request Subject Atternative Name Type IF Address w IF Subject Name Country C State ST Location L Organization 0 Organization Unit OU Common Name CN Email E Key Type RSA Note Please be noted that Common Name must be configured with rotuer s WAN IP or domain name After clicking GENERATE the generated information will be displayed on the window below Certificate Management gt gt Local Certificate X509 Local Certificate Configuration Name Subject Status Modify local C TW O DrayTek OU RD CN 192 Requesting Dr ay Tek 269 Vigor2830 Series User s Guide IMPORT Vigor router allows you to generate a certificate request and submit it the CA server then import it as Local Certificate If you have already gotten a certificate from a third party you may import it directly The supported types are PKCS12 Certificate and Certificate with a private key Click this button to import a saved file as the certification information There are three types of local certificate supported by Vigor router Certificate Management gt Local Certificate Import X509 Local Certificate Upload Local Certificate Select a local certificate file Certificate f
402. rd can contain only a z 4 2 0 9 e2 gt 7 DFE SG 2 Password can t be only Example or or Us illegal but 123 or 45 is OK Available settings are explained as follows Item Description Enable User Mode for After checking this box you can access into the web user simple web configuration interface with the password typed here for simple web configuration The settings on simple web user interface will be different with full web user interface accessed by using the administrator password Password Type in new password in this field Confirm Password Type in the new password again Set to Factory Default Click to return to the factory default setting When you click OK the login window will appear Please use the new password to access into the web user interface again Below shows an example for accessing into User Operation with User Password 1 Open System Maintenance gt gt User Password 2 Check the box of Enable User Mode for simple web configuration to enable user mode operation Type a new password in the field of New Password and click OK System Maintenance gt gt User Password Enable User Mode for simple web configuration User Password Setto Factory Default Confirm Password Note Password can contain only a zA Z0 9 lt gt 4 3 Vigor2830 Series User s Guide 340 Dr ay Tek 3 The following screen will appear Simply click OK System Maintenance gt gt User Pas
403. reater than this value is available lt the port number less than this value is available for this profile Service Group Object Use the drop down list to choose the one that you want Specify the action for fragmented packets And it is used for Data Filter only Don t care No action will be taken towards fragmented packets Unfragmented Apply the rule to unfragmented packets Fragmented Apply the rule to fragmented packets Too Short Apply the rule only to packets that are too short to contain a complete header Specifies the action to be taken when packets match the rule Block Immediately Packets matching the rule will be dropped immediately 153 Vigor2830 Series User s Guide Branch to other Filter Set Sessions Control MAC Bind IP Quality of Service Load Balance policy User Management APP Enforcement Vigor2830 Series User s Guide Pass Immediately Packets matching the rule will be passed immediately Block If No Further Match A packet matching the rule and that does not match further rules will be dropped Pass If No Further Match A packet matching the rule and that does not match further rules will be passed through If the packet matches the filter rule the next filter rule will branch to the specified filter set Select next filter rule to branch from the drop down menu Be aware that the router will apply the specified filter rule for ever and will not return to
404. reless users access into the web page through the router Check the box es representing different interfaces to be applied by such profile The advantage is that each SSID 1 2 3 4 for wireless network can be applied with different web portal separately After finishing all the settings here please click OK to save the configuration Dray Tek 125 Vigor2830 Series User s Guide 3 3 Load Balance Route Policy Load Balance Route Policy Cisco called it policy based routing is a feature where a set of rules or policies are defined first Then if there comes a packet that matches any one of the policies it will be directed to the specified interface Load Balance Route Policy Load Balance Route Policy Index Enable Protocol Interface Any AY Any Ay ANY Any AY Any jas feo s e en e e e e Any m N ee N S ok Any 10 11 20 are WAR 1 WEAR 1 WAR 1 WEAR 1 WAR 1 WEAR 1 WEAR 1 WEAR 1 WARY 1 WAR 1 21 30 3140 41 50 gt gt oO Setto Factory Default Dest Dest Dest IP Port Port End Start End Dest IP End Start Move Move Up Down Interface Src IP Address Start Down Down Down Down Down Down Down Down Down Wizard Mode most frequently used settings in three pages Advance Made all settings in one page Available settings are explained as follows Item Description Index Click the number of index to access into the con
405. ress Range Address Subnet Address Mac Address Type the MAC address of the network card which will be controlled Type the start IP address for Single Address type Type the end IP address if the Range Address type is selected Type the subnet mask if the Subnet Address type is selected If it is checked all the IP addresses except the ones listed above will be applied later while it is chosen 3 After finishing all the settings here please click OK to save the configuration Objects Setting gt gt IP Object IP Object Profiles Index oe foe Te Vigor2830 Series User s Guide RO Department Financial Dept HR Department Name Index a i ju jul SeeEeE 172 Dray Tek 3 7 2 IP Group This page allows you to bind several IP objects into one IP group Objects Setting gt gt IP Group IP Group Table Setto Factory Default Index Name Index Name ta fed fad JP I IR I I I i fee fe fe m ee ee ee ee ee ee Se i e SFeErEFBRESBrerPrereeere Available settings are explained as follows Item Description Set to Factory Default Clear all profiles Index Display the profile number that you can configure Name Display the name of the group profile To set a new profile please do the steps listed below 1 Click the number e g 1 under Index column for configuration in details Objects Setting gt gt IP Group IP Group Table Dr ay Tek 173 Vigor2830 Series Us
406. ress From ISP Fixed IP Yes Fixed IP Address Dray Tek ARP Detect MPoA RFC 1483 2634 Obtain an IP address automatically Mgor S Domain Name i Required for same ISPs Specify an IP address IP Address Subnet Mask Gateway IP Address DNS Server IP Address Primary IP Address Router Name seconds No Dynamic IF Secondary IP 4ddress 99 Vigor2830 Series User s Guide Available settings are explained as follows Item Description WAN for Router borne Choose the router service for channel 5 6 or 7 Application Management It can be specified for general management Web configuration telnet TRO69 If you choose Management the configuration for this PVC will be effective for Web configuration telnet TRO69 VoIP It can be specified for VoIP only If you choose VoIP the configuration for this PVC will be effective for VoIP data transmitting and receiving IPTV The IPTV configuration will allow the WAN interface to send IGMP packets to IPTV servers After finishing all the settings here please click OK to save the configuration For other settings refer to Details Page for PPPoE PPPoA in WANI ATM QoS Such configuration is applied to upstream packets Such information will be provided by ISP Please contact with your ISP for detailed information WAN gt Multi PVCs Multi PVCs General ATM O05 Port based Bridge PVC to PVC Binding Add Tag Channel QoS Type PCR SCR MBS ha 2 a Ea
407. ress of the NAT host will be mapped into either 202 211 100 10 or 203 98 200 10 which IP or mapping is decided by the internal load balancing algorithm With address mapping feature you can manually configure any host mapping to any WAN interface to fit the request In the above example you can configure NAT Host 1 to always map to 202 211 100 10 WAN1 Host 2 to always map to 202 211 100 11 WANT alias Host 3 always map to 203 98 200 10 WAN2 and Group 1 to always map to 202 211 100 10 WANI NAT Address Mapping function lets you specify the outgoing IP address es for one internal IP address or a block of internal IP addresses We will take an example to introduce how to make use of this feature 1 Log into the web user interface of Vigor2830 2 Open WAN gt gt Internet Access For WAN1 choose MPoA Static or Dynamic IP as the Access Mode WAN gt gt Internet Access Internet Access Index Display Name Physical Mode Access Mode WAN 1 ADSL WPOA CRFC1 4832684 w Details Fage IFw6 WAN Ethernet Static or Dynamic IP w Details Page Note Only one WAN can support IPy Advanced You can configure DHCP client options here Vigor2830 Series User s Guide 436 Dr ay Te k 3 Click the Details Page of WAN 1 to open the following page From the above figure set main WAN IP address as 202 2 1 100 10 WAN gt Internet Access WAN 1 PPPoE PPPoA MPoA RFC 1483 2684 IPvo O Enable Disable
408. ridge mode is designed to fulfill the first type of application Repeater mode is for the second one Disable There are three types for security Disable WEP and Pre shared Key The setting you choose here will make the following WEP or Pre shared key field valid or not Choose one of the types for the router Check this box to use the same key set in Security Settings page If you did not set any key in Security Settings page this check box will be dimmed Type There are some types for you to choose WPA and WPA2 are used for WDS devices e g 2920n wireless router you can set the encryption mode as WPA or WPA2 to establish your WDS system between AP and the router Key Type 8 63 ASCII characters or 64 hexadecimal digits leading by 0x If you choose Bridge as the connecting mode please type in the peer MAC address in these fields Four peer MAC addresses are allowed to be entered in this page at one time Yet please disable the unused link to get better performance If you want to invoke the peer MAC address remember to check Enable box in the front of the MAC address after typing If you choose Repeater as the connecting mode please type in the peer MAC address in these fields Four peer MAC addresses are allowed to be entered in this page at one time Similarly if you want to invoke the peer MAC address remember to check Enable box in the front of the MAC address after typing Click Enable to make t
409. rnal IP address and configure port mappings on the router Subsequently such a facility forwards packets from the external ports of the router to the internal ports used by the application Slip Broadband Cunnection on Router Properties X Advanced Settings m Services fConmect to the Internet using Select the services running on your network that Internet users can a access aa 2 DR s a IF Broadband Connection on Router l Ftp Exarnple menmear 192 168 29 11 131735 680654 UDP msnmeor 192 168 29 11 7824 14251 UDP This connection allows you to connect to the Internet through a rsnmegr 192 169 29 11 8799 63231 TCP ehared connection on another computer Settings Show iconin notification area when connected Add Edt ner OF Cancel Cancel The reminder as regards concern about Firewall and UPnP Can t work with Firewall Software Enabling firewall applications on your PC may cause the UPnP function not working properly This is because these applications will block the accessing ability of some network ports Security Considerations Activating the UPnP function on your network may incur some security threats You should consider carefully these risks before activating the UPnP function gt Some Microsoft operating systems have found out the UPnP weaknesses and hence you need to ensure that you have applied the latest service packs and patches gt
410. rnet Available settings are explained as follows Item Description Enable Click this radio button to invoke this function However IP MAC which is not listed in IP Bind List also can connect to Internet Disable Click this radio button to disable this function All the settings on this page will be invalid Strict Bind Click this radio button to block the connection of the IP MAC which 1s not listed in IP Bind List ARP Table This table is the LAN ARP table of this router The information for IP and MAC will be displayed in this field Each pair of IP and MAC address listed in ARP table can be selected and added to IP Bind List by clicking Add below Select All Click this link to select all the items in the ARP table Sort Reorder the table based on the IP address Refresh Refresh the ARP table listed below to obtain the newest Dray Te k 121 Vigor2830 Series User s Guide ARP table information Add and Update IP Address Type the IP address that will be used for the specified MAC address Mac Address Type the MAC address that is used to bind with the assigned IP address Comment Type a brief description for the entry Show Comment Check it to display the content of the comment IP Bind List It displays a list for the IP bind to MAC information Add It allows you to add the one you choose from the ARP table or the IP MAC address typed in Add and Edit to the table of IP Bind List Update It allows you to edit a
411. router will use WAN1 WAN2 WANS3 as the only channel for VPN connection WANI Only Backup WAN2 While connecting the router will use WAN2 for VPN connection If WAN2 fails the router will use backup WAN interface instead WAN2 Only Backup WANI While connecting the router will use WANI for VPN connection If WAN fails the router will use backup WAN2 interface instead Check to enable router always keep VPN connection IKE Authentication Method usually applies to those are remote dial in user or node LAN to LAN which uses dynamic IP address and PSec related VPN connections such as L2TP over IPSec and IPSec tunnel Pre Shared Key Specify a key for IKE authentication Confirm Pre Shared Key Confirm the pre shared key Click Digital Signature to invoke this function Use the drop down list to choose one of the certificates for using You have to configure one certificate at least previously in Certificate Management gt gt Local Certificate Otherwise the setting you choose here will not be effective Peer ID Choose the peer ID selection from the drop down list Local ID Choose Alternative Subject Name First or Subject Name First Medium Authentication Header AH means data will be authenticated but not be encrypted By default this option is active High Encapsulating Security Payload ESP means payload data will be encrypted and authenticated You may select encryption algorithm from Data Encryp
412. rrent running configurations as a file 2 Click Backup button to get into the following dialog Click Save button to open another dialog for saving configuration as a file File Dewnload i You are downloading the File config chg From 192 168 1 1 Would you like to open the file or save it to your computer Alias ask before opening this type of file Vigor2830 Series User s Guide 344 Dr ay Te k 3 In Save As dialog the default filename is config cfg You could give it another name by yourself my Documents F My Computer My Recent Emy Network Places Documents R pvs com Lite i 3 B Annex 4 Ic Mw Snap3i B TeleDanmark Desktop Ic Tools F E config kiarigis EI E veke 50 config_1 My Computer J config Save hy Network nave ag type Configuration file 4 Click Save button the configuration will download automatically to your computer as a file named config cfg File name The above example is using Windows platform for demonstrating examples The Mac or Linux platform will appear different windows but the backup function is still available Note Backup for Certification must be done independently The Configuration Backup does not include information of Certificate Restore Configuration 1 Goto System Maintenance gt gt Configuration Backup The following windows will be popped up as shown below System Maintenance gt gt Configuration Backup Configurat
413. rst Subject Name First Local Certificate IPsec Security Method MecdiumiesH High ESP Index 1 15 in Schedule Setup Dray Tek Dray Tek Set Dial In settings to as shown below to allow Router B dial in to build VPN connection If an PSec based service is selected you may further specify the remote peer IP Address IKE Authentication Method and IPSec Security Method for this Dial In connection Otherwise it will apply the settings defined in IPSec General Setup above 3 Dial In Settings Allowed Dial In Type C PPTP IPSec Tunnel C L2TP with IPSec Policy Specify Remote VPN Gateway Peer VPN Server IP 220 135 240 210 orPeerID o Username Password VJ Compression IKE Authentication Method Pre Shared Key Cl Digital Signature X 509 ine IPSec Security Method Medium AH High ESP DES F 3DES V AES If a PPP based service is selected you should further specify the remote peer IP Address Username Password and VJ Compression for this Dial In connection 3 Dial In Settings Allowed Dial In Type PPTP C IPSec Tunnel C L2TP with IPSec Policy Specify Remote YPN Gateway Peer VPN Server IP 220 135 240 210 orPeerID o 399 Username on off Password VI Compression IKE Authentication Method Pre Shared Key IKE Pre shared Key Digital Signaturec 509 Mone IPSec Security Method Medium AH High ESP DES 3DES AES Vigor283
414. ry default setting you can configure the settings for the router again to fit your personal request 5 7 Contacting DrayTek If the router still cannot work correctly after trying many efforts please contact your dealer for further help right away For any questions please feel free to send e mail to support Dray Tek com Vigor2830 Series User s Guide 450 Dr ay Te k Appendix l VLAN Applications on Vigor Router Virtual Local Area Network is so called VLAN It offers the logical grouping technique to separate the physical ports of Ethernet switches thus we can management our local network easier more flexible and secure For instance you re a networking administrator in your company and you re planning to isolate the visitors traffics from your private network for security considerations because you cannot ensure that visitors computer is clean Or you want to separate your private network into several parts by divisions because there are too many computers in the same network segment and it results in the local traffics heavily VLAN helps you to solve these situations and DrayTek s products support bellow two popular types Port based It uses a matrix table of the physical ports to define the traffics how to exchange between each port and the traffics will be isolated from the ports are not being ticked in the same line It is the easiest way to setup an isolate network but not a flexible way to maintain a growing ne
415. s 2 HTTP QoS Class 3 Mail Bo eo Bandwidth in Selec gt gt Quality of Sarvice Class Index 1 Name NO Status Local Address Remote Address Co ile Point if Active Any Any any ANY Vigor2830 Series User s Guide 222 Dr ay Te k 3 10 Applications Below shows the menu items for Applications Applications 3 10 1 Dynamic DNS The ISP often provides you with a dynamic IP address when you connect to the Internet via your ISP It means that the public IP address assigned to your router changes each time you access the Internet The Dynamic DNS feature lets you assign a domain name to a dynamic WAN IP address It allows the router to update its online WAN IP address mappings on the specified Dynamic DNS server Once the router is online you will be able to use the registered domain name to access the router or internal virtual servers from the Internet It is particularly helpful if you host a web server FTP server or other server behind the router Before you use the Dynamic DNS feature you have to apply for free DDNS service to the DDNS service providers The router provides up to three accounts from three different DDNS service providers Basically Vigor routers are compatible with the DDNS services supplied by most popular DDNS service providers such as www dyndns org www no ip com www dtdns com www changeip com www dynamic nameserver com You should visit their websites to re
416. s Guide 410 Dr ay Te k 8 Check Enable UDP Bandwidth Control on the bottom to prevent enormous UDP traffic of influent other application Click OK Bandwidth Management gt Quality of Service WAN General Setup Enable the QoS Control BOTH WAN Inbound Bandwidth 10000 Kbps WAN Outbound Bandwidth 10000 Kbps Class Name Reserved bandwidth Ratio E mail 25 be HTTPS Others Limited_bandwidth Ratio C Outbound TCP ACK Prioritize 9 Ifthe worker has connected to the headquarter using host to host VPN tunnel Please refer to Chapter 3 VPN for detail instruction he may set up an index for it Enter the Class Name of Index 3 In this index he will set reserved bandwidth for 1 VPN tunnel VPN Tunnel Private Network Cooperate Network 192 168 1 0 192 168 2 0 10 Click Edit to open a new window Bandwidth Management gt Quality of Service Class Index 3 Name DiffServ Status Local Address Remote Address CodePoint Service Type Empty 5 Dray Tek m Vigor2830 Series User s Guide 11 Click Add to open the following window Check the ACT box first Bandwidth Management gt gt Quality of Service Rule Edit ACT DiffServ CodePoint IP precedence 4 Service Type oY SLOG UDP 514 Note Please choose setup the Service Type first 12 Then click Edit of Local Address to set a worker s subnet address Click Edit of Remote Address to set headquarter s IP address L
417. s Page Click it to access into the setting page Each LAN will have different LAN configuration page Each LAN must be configured in different subnet IP v6 Click it to access into the settings page of IPv6 When the router receives the DHCP request from LAN client the router will assign an IP with the DHCP packets adding option number and data information 105 Vigor2830 Series User s Guide LAN gt gt General Setup DHCP Options Status Enable Disable Options List Index Option Number Ascii Hex Data Option Number DataType Ascii Hex Example of Hex Data Type Input Format Oxff 0x00 OxcO Oxa8 Data Aad Note Maximum number of custom DHCP option is five Enable Disable Enable Disable the function of DHCP Option Each DHCP option is composed by an option number with data For example Option number 100 Data abcd When such function is enabled the specified values for DHCP option will be seen in DHCP reply packets Option Number Type a number for such function DataType Choose the type ASCII or Hex for the data to be stored Data Type the content of the data to be processed by the function of DHCP option Force router to use DNS Force Vigor router to use DNS servers configured in server IP address LANI LAN2 LAN3 LAMN4 instead of DNS servers given settings as specified in by the Internet Access server PPPoE PPTP L2TP or DHCP server Inter LAN Routing
418. s follows Item Description Enable Check this box to enable such function LAN P1 P4 Check the LAN port s to be grouped under the selected VLAN Wireless LAN SSID1 SSID4 Check the SSID box es for the wireless Vigor2830 Series User s Guide 118 Dr ay Tek clients to be grouped under the selected VLAN Subnet Choose one of them to make the selected VLAN mapping to the specified subnet only For example LAN is specified for VLANO It means that PCs grouped under VLANO can get the IP address es that specified by the subnet VLAN Tag Enable Check it to enable the function of VLAN with tag The router will add specific VLAN number to all packets on the LAN while sending them out Please type the tag value and specify the priority for the packets sending by LAN VID Type the value as the VLAN ID number The range is form 0 to 4095 Priority Type the packet priority number for such VLAN The range is from 0 to 7 Permit untagged device in It can help users to communicate with the router still even P1 to access router though configuring wrong VLAN tag setting For Vigor router has one LAN physical port only it is recommended to enable the management port LAN 1 to ensure the data transmission is unimpeded Note Leave one VLAN untagged at least to prevent from not connecting to Vigor router due to unexpected error Vigor2830 series features a hugely flexible VLAN system In its simplest form
419. s here because your ISP often provides you more than one DNS Server If your ISP does not provide it the router will automatically apply default secondary DNS Server IP address 194 98 0 1 to this field The default DNS Server IP address can be found via Online Status System Status System Uptime 71 47 46 LAN Status Primary DNS 194 109 6 66 Secondary DNS 168 95 1 1 IP Address TX Packets RX Packets 192 168 1 1 347390 214004 If both the Primary IP and Secondary IP Address fields are left empty the router will use the DNS server assigned by ISP If not the router will assign its own IP address to local users as a DNS proxy server Force router to use address for DNS Force Vigor router to use DNS servers in this page instead of DNS servers given by the Internet Access server PPPoE PPTP L2TP or DHCP server After finishing all the settings here please click OK to save the configuration Details Page for IP Routed Subnet LAN gt General Setup TCPAP and DHCP Setup for IP Routed Subnet Network Configuration Enable Disable For Routing Usage IP Address 192 168 0 1 DHCP Server Configuration Start IP Address IP Pool Counts bo max 32 Lease Time 259200 5 Subnet Mask 255 255 255 0 C Use LAN Port Pi po Use MAC Address RIP Protocol Contral Note Disable LAN amp Enable LAN shouldn t be in the same subnet Index Matched MAC Address given IP Address MAC Address YH oH HO OR OH
420. s router can print documents via the router The example provided here is made based on Windows 7 For installation on other Windows systems please visit www DrayTek com Internet Before using it please follow the steps below to configure settings for connected computers or wireless clients 1 Connect the printer with the router through USB parallel port 2 Open All Programs gt gt Getting Started gt gt Devices and Printers WF smart YPN Client il Getting started k Control Panel te Priwatefirewall 7 0 Devices and Printers a Connect to a Projector PS Default Programs ETELE ree T Computer Calculator F Help and Support Windows Security Lag oft d All Programs Dray Te k 9 Vigor2830 Series User s Guide 3 Click Add a printer ae Control Panel Hardware and Sound Devices and Printe Addadevice Add a printer a Devices 3 4 A dialog will appear Click Add a local printer and click Next gam Add Printer What type of printer do you want to install Add a local printer Use this option only if you dont have a USE printer Windows automatically installs USB printers when you plug therm in Add a network wireless or Bluetooth printer Make sure that your computer is connected to the network or that your Bluetooth or wireless printer is turned on 5 In this dialog choose Create a new port In the field of Type of port use the drop down
421. s router can be found Please click Scan to discover all the connected APs Wireless LAN gt gt Access Point Discovery Access Point List BSSID Channel SSID Scan Note During the scanning process 5 seconds no station is allowed to connect with the router See Statistics Add to WDS Settings AP s MAC address E yeh db Bridge Repeater Vigor2830 Series User s Guide 312 Dr ay Tek Available settings are explained as follows Item Description Scan It is used to discover all the connected AP The results will be shown on the box above this button Statistics It displays the statistics for the channels used by APs Wireless LAN gt gt Site Survey Statistics Recommended channels for usage 12345678910 111213 AP number v s Channel 1 2 3 4 5 6 7 8 9 1011 12 13 14 Channel Cancel Add to If you want the found AP applying the WDS settings please type in the AP s MAC address on the bottom of the page and click Bridge or Repeater Next click Add to Later the MAC address of the AP will be added to Bridge or Repeater field of WDS settings page Dray Te k 313 Vigor2830 Series User s Guide 3 14 10 Station List Station List provides the knowledge of connecting wireless clients now along with its status code There is a code summary below for explanation For convenient Access Control you can select a WLAN station and click Add to Access Control below Wireless LAN gt Statio
422. s shown below to dial to connect to Router B aggressively with the selected Dial Out method If an PSec based service is selected you should further specify the remote peer IP Address IKE Authentication Method and IPSec Security Method for this Dial Out connection 2 Dial Out Settings Type of Server am calling PPTP IPsec Tunnel L2TP with IPsec Policy Server IP Host Name for VPN such as draytek com or 123 45 67 569 220 135 240 210 Username ae Password Max 15 char PPP Authentication Y Compression IKE Authentication Method Pre Shared Key Digital Signaturel 509 Local ID Alternative Subject Name First Subject Name First Local Certificate IPsec Security Method Medium H High ESP D Index 1 15 in Schedule Setup If a PPP based service is selected you should further specify the remote peer IP Address Username Password PPP Authentication and VJ Compression for this Dial Out connection 2 Dial Out Settings Type of Server lam calling PPTP IPsec Tunnel L2TP with IPsec Policy Server IP Host Name for VPN such as draytek com or 123 45 67 89 220 135 240 210 Vigor2830 Series User s Guide 398 Username Password Max 15 char PPP Authentication PAPICHAP SM S CHAPINS CHAPY2 w VI Compression on off IKE Authentication Method Pre Shared Key Digital Signature 509 Local ID Alternative Subject Name Fi
423. s useful when users have separated certificates and private keys And the password is needed if the private key is encrypted REFRESH Click this button to refresh the information listed below View Click this button to view the detailed settings for certificate request p Certificate Signing Request Information Google Chrome O 192 168 1 Lidoc XLoCt Vil btm Certificate Signing Request Information Certificate Name local Issuer Subject C TW O DrayTek QU RD CH 192 168 1 56 email4ddress press draytek com Subject Alternative Name Valid From Valid To PEM Format Content HITEpTCCAQ4C A042 TELHAEGALUEBRMCYF chEDAUBGQNYVBACTBORYYAlUeWsxCead BqNVEAsTAlJEMRUWEWYD YO ODEmm OTLUMTY 4LjEuNTyYx IDA eBgk qghkiGoIwOBCOEW ExBy2sNezQGRyYslozvsuY2 IcuIGEMAOGCS G5 Th SDOEBANUAAAGNADCBLiOEBgGOCm SSRIBRTSTctot ToAgzJevsepozsbqenuksd s6qoucngos 9lNoVFmAy Ca 16e5 ak lEwduHnJdTSiIbVFVU 54iaqkiCzhakobULpsSkEraCeDHscTiHimAywUnFTDop fo0 ZLRIYJuzisdcp elretbacxrbukxkEysrvic PEEOIAz00T DAD AR AAWDOY TKoZ Tivol AQEFEOADGYEAcO OYR34r 4 OtchyweUIh YRERAG T 6alx J peCs90aAMo40hgquts Lord YHOIUL lols 4n50vD quay Ar sM4EL det tpE Putt SavechisDodcRlyTiavsilr seuyydhCavei Eina tcLdeHbrhV YpesoP Cen0Us sxCqoI09dt 3Tuxt Close Note You have to copy the certificate request information from above window Next access your CA server and enter the page of certificate request copy the information into it and submit a request A ne
424. scription Display the number link which allows you to configure the profile Display the content Disable URL Redirect or Message of the profile Display the applied interfaced of the profile Open a preview window according to the configured settings na DrayTek To configure the profile click any index number link to open the following page LAN gt Web Portal Setup Profile Index 1 Disable O URL Redirect Message Applied Interfaces https e g htto www draytek com Note If the User Management application is enabled it will override the Web Portal settings seen here lt his lt font color red 2Vigor lt font lt hi gt lt che gt Reliable connectivity lt he gt lt he gt Robust firewall protections h lt h2 gt Multi site secure communication lt hz gt Max 255 characters LAN1 LAN LAN3 LANA SSID1 SSID2 SSID3 SSID4 Available settings are explained as follows Item Disable URL Redirect Message Applied Interfaces Description Click this button to close this function Any user who wants to access into Internet through this router will be redirected to the URL specified here first It is a useful method for the purpose of advertisement For example force the wireless user s in hotel to access into the web page that the hotel wants the user s to visit Type words or sentences here The message will be displayed on the screen for several seconds when the wi
425. se PAP Only as Dial In PPP Authentication VPN and Remote Access gt gt PPP General Setup PPP General Setup PPP MP Protocol tan PPP PAPO Authentication PAP Only w A Optional MPPE Encryption MPPE Optional MPPE be Norte e oem Authentication if you want to use AD LDAP for Mutual Authentication PAF ves No PPP AuUthentication IP Address Assignment for Dial In Users When DHCP Disable set Assigned IP start LAN 1 7 After finished above configurations click OK to save the settings Now users belong to either rd1 or shrd group can access Internet after inputting their credentials on LDAP server Dr ay Tek 435 Vigor2830 Series User s Guide 4 16 How to Setup Address Mapping Address Mapping is used to map a specified private IP or a range of private IPs of NAT subnet into a specified WAN IP or WAN IP alias IP Refer to the following figure Group 1 192 168 1 X ONAT Host 1 192 168 1 23 3 WAN 202 211 100 10 WAN1 alias 202 211 100 11 192 168 1 100 WAN2 203 98 200 10 Host 3 192 168 1 56 Group maps to WAN1 Host 1 maps to WAN1 Host 2 maps to WAN 1 alias Host 3 maps to WAN2 Suppose the WAN settings for a router are configured as follows WANT 202 211 100 10 WANI alias 202 211 100 11 WAN2 203 98 200 10 Without address mapping feature when a NAT host with an IP say 192 168 1 10 sends a packet to the WAN side or the Internet the source add
426. seaeeceeseeaseeeeesseaeeeeesseaaeeeessseaeceeessaeeseessaanseeess 161 261 Genera oep exc sects sarccete dan cancers ia a ar aE a E e Ean 162 ao e U OPOE een E 163 363 USer GOUD arroi eee ene ene ee nee ee eee eee eee eee eee eres 167 3 6 4 User Online SUAS wcectsss sce acts cca sects seaisei a deisasicth sada rage sau aseen cat duadatepsneade son deekasaaseedotsncsebiaates 169 L7 Objecte SENGS rosei ee ee eee ee ee 170 CAT a ie IPOD tetera re ee 170 oo fea cas 6 6 a Renee eee eee ee E E ee 173 oi feed mao ODOC I Ge eNeee teen ene eterna eee E eee 175 CO VO AON hes deat R anc ln ae de A EE a 177 BET NS TYPE ODFCC reccepee cet ccc eters E E EE ease 179 RDO DIV ICS Type GOUD escea os aceon ce ae ce adeeb cece AEE 181 Af KE VWOlO ODJECT sinnena acess eE EEEE EEE EEEE 183 9 1 0 Keyword Gro vssacorioccncicoig desicasienen nection nadvineaccininstasionseoecisectsaevesteccosneosd EE aE 185 3 129 File Extension ODECE EAGER E EEE 187 3 7 10 SMS Mail Service ODjeCt escorias aaa aa aa aia a Daa E 189 Oe FeAl N titication ODOC irs cassccscctorcaaincarcewedaictixeslevesnedgua iewarancedueisasenatnodose iuatancasoneadendixeaecarnecedetee 194 BO I FOTN O E AEE eatetawaesauustnnns eiacsiene tates E AE 196 3 8 1 APP Enforcement Profile cccccceecccceeeccescecceececeeeeeseueeeseaeeeseuseseusessaesessueeessueeesaaees 197 3 8 2 URL Content Filter Profile vcieictsusvacaiiniselesionrsinacousiieutnmesieesaiedmunsnateataasennsnedmiwariaunenmadineenns 20
427. setting page Next Click it to get into the next setting page Cancel Click it to give up the quick start wizard 3 Please type in the IP address mask gateway information originally provided by your ISP Then click Next for viewing summary of such connection Vigor2830 Series User s Guide 32 Dr ay Tek Quick Start Wizard Please confirm your settings WAR Interface WANE Physical Mode Ethernet Physical Type Auto negotiation Internet Access L2TP Click Back to modify changes if necessary Otherwise click Finish to save the current settings and restart the Wigor router 4 Click Finish A page of Quick Start Wizard Setup OK will appear Then the system status of this protocol will be shown Quick Start Wizard Setup OK 5 Now you can enjoy surfing on the Internet Static IP 1 Choose WAN2 as the WAN Interface and click the Next button The following page will be open for you to specify Internet Access Type Quick Start Wizard Connect to Internet WAN 2 Select one of the following Internet Access types provided by your ISP PPPoE PPTP Dr ay Tek 33 Vigor2830 Series User s Guide 2 Click Static IP as the Internet Access type Simply click Next to continue Quick Start Wizard Static IP Client Mode WAN Enter the Static IP configuration provided by your ISP wWAN IP Subnet Mask Gateway Primary ONS Secondary DNS 72 16 3 102 9 255 0 0 72 16 14 6 8 8 EEE optional
428. slussusesaipleandisanivetanuatawts 363 CHATE A n E e ce re testes A E E AA E E 365 3 19 10 Irac ROUTO eeens ienen e Ea R E E EE AE ET 366 318 11 SO ONO E sisao OE a a Ea E a ANART 367 STZ Iye TOPO TIUS iie a sae E EER 369 319 XC hell DEVICES esiseina eane aE eE rT Ea ASAREE TI 369 Application and ExampleS wcsscesiscssacsseceseectesessectaceuasecaveseescesesesncedaneessoeutens 371 4 1 How to Configure Multiple Services with PVC to PVC BINGING seeeeeeeeeeeeeeaeaees 371 4 2 How to Configure Multi Subnet in Vigor2830 cee ccceceecseeeeeeeeeeeeeaeeeceeeeeeeeeeeneeeeeeeeeseaas 375 4 3 How Can Use FTP to Get the Files from USB Storage Device Connecting to Vigor Router M ce ie EE see ett E gras sce ss ea pce ects sec a E E menses spe E E E 382 4 4 How to Send a Notification to Specified Phone Number via SMS Service in WAN LIS COMIC Cl OM a a E EE A 385 4 5 Web Portal Log In Application for Wireless Client 2 0 0 0 ee 389 4 6 How to Customize Your Login Page cccccccceccssesseeeeeeeeeseeeeeeeeeeeeeeaeeaeeeeeeeeeseaeeeeeeeeseaas 393 4 7 Create a LAN to LAN Connection Between Remote Office and Headquarter 396 4 8 Create a Remote Dial in User Connection Between the Teleworker and Headquartet 404 ASO QoS Seting EXAMP Ekseni a E E R E E A ESSEE 408 4 10 Upgrade Firmware for Your Router ccccccsessesseeeeeeeeeeeesseeeeeeeeeeneaseeeeeeeseneaseeeeseeeeneaas 413 4 11 Request a certificate fr
429. some features that are bound with some WLAN miniPCi SSID Display the SSID of the router WAN Link Status Display current connection status MAC Address Display the MAC address of the WAN Interface Connection Display the connection type IP Address Display the IP address of the WAN interface Default Gateway Display the assigned IP address of the default gateway VoIP Profile Display the VoIP profile for the phone port In Out Display the number of incoming outgoing phone call Vigor2830 Series User s Guide 336 Dr ay Te k 3 17 2 TR 069 This device supports TR 069 standard It is very convenient for an administrator to manage a TR 069 device through an Auto Configuration Server e g VigorACS System Maintenance gt gt TR069 Setting ACS and CPE Settings ACS Server On ACS Server CPE Client Enable Disable Periodic Inform Settings Disable Enable Interval Time second s STUN Settings Disable Enable server IP ss server Port bas Minimum Keep Alive Period eos second s Maximum Keep Alive Period fi second s Available settings are explained as follows Dray Tek Item Description ACS Server On Choose the interface for the router connecting to ACS server ACS Server URL Username Password Such data must be typed according to the ACS Auto Configuration Server you want to link Please refer to Auto Configuration Server user s manual fo
430. ss 0 Disable Port Isolation 11 7 0O All v 84 Access 0 Disable aaa 12 a All v g4 Trunk 0 Disable EIGVRP 13 F All 2611 Trunk 0 Disable laos 14 x O All 2611 Access 0 Disable Same C v Access 0 Disable a SS UY Y SADIE EIP MAC Binding y bad a _ go2 1x CO Eo Access O Disable El Trunk oO All a110 Access 0 Disable ISTP 19 E All 3700 Access 0 Disable GIMSTP ar S SS S SS Mirroring 20 a All 3700 Access o Disable Multicast 21 O All v 1 Access 0 Disable v HAlarm 22 C All v li Access 0 Disable w DHCP Snooping FILLDP O All ms 1 0 Disable l Save Restore J 24 O All Mi i Trunk 0 Disable v Export import 4 After finishing the above configuration the equipment connecting to VigorSwitch Port 15 16 17 and 18 can get the corresponding IP address es of the network segment The equipment connecting to VigorSwitch Port 15 can get the IP address of 192 168 1 0 24 The equipment connecting to VigorSwitch Port 16 can get the IP address of 192 168 3 0 24 The equipment connecting to VigorSwitch Port 17 can get the IP address of 192 168 5 0 24 The equipment connecting to VigorSwitch Port 18 can get the IP address of 192 168 7 0 24 5 To make any two of VLAN groups of Tag Based VLAN linked with each other just check the boxes of the ones in the field of Inter LAN Rou
431. stablish a tunnel to a DSL modem on the WAN interface Enable L2TP Click this radio button to enable a L2TP client to establish a tunnel to a DSL modem on the WAN interface Disable Click this radio button to close the connection through PPTP or L2TP Server Address Specify the IP address of the PPTP L2TP server if you enable PPTP L2TP client mode Specify Gateway IP Address Specify the gateway IP address for DHCP server Username Type in the username provided by ISP in this field Password Type in the password provided by ISP in this field Index 1 15 in Schedule Setup You can type in four sets of time schedule for your request All the schedules can be set previously in Application gt gt Schedule web page and you can use the number that you have set in that web page It means Max Transmit Unit for packet The default setting is 1442 PPP Authentication Select PAP only or PAP or CHAP for PPP Idle Timeout Set the timeout for breaking down the Internet after passing through the time without any action WAN IP Alias If you have multiple public IP addresses and would like to utilize them on the WAN interface please use WAN IP Alias You can set up to 8 public IP addresses other than the current one you are using o kee MNES a 192 168 1 SidocAvipalias htm WANI IP Alias Multi NAT Index Enable Aux WAN IP Join NAT IP Pool fe dl E O d d d d d Fixed IP Usually ISP
432. stem Maintenance Diagnostics External Devices Product Registration CE 72 ull M lt il gt System Status Dray Tek gt Model Name Firmware Version Build Date Time Vigor2830Vn 3 6 7_db Mar 24 2014 15 47 36 MAC Address 00 50 7F 64 FB 18 00 50 7F 64 FB 18 00 S0 7F 64 FB 18 00 S0 7F 64 FB 18 IP Routed Subnet 00 50 7F 64 FB 18 Subnet Mask 255 255 255 0 255 255 255 0 255 255 255 0 255 255 255 0 255 255 255 0 IP Address 192 168 1 1 192 168 2 1 192 168 3 1 192 168 4 1 192 168 0 1 Wireless LAN MAC Address 00 50 7F 64 FB 18 Link Status Disconnected Disconnected Disconnected Address Frequency Domain FCC MAC Address 00 50 7F 64 FB 19 O0 S0 7F 6A4 FB 14 00 50 7F 6 FB 1B LAN FE80 250 7FFF FE6A FB18 64 Port Profile SSID DrayTek Firmware Yersion 0 2 0 7 Connection IP Address PPPoE Default Gateway Scope Internet Access Mode Link VoIP In Out Note The home page will be different slightly in accordance with the type of the router you have The web page can be logged out according to the chosen condition The default setting is Auto Logout which means the web configuration system will logout after 5 minutes without any operation Change the setting for your necessity Please change the password for the original security of the router l Dray Tek Open a web browser on your PC and type http
433. stment Auto N Auto Adjustment If you choose Auto Adjustment the router will assign the required bandwidth for each wireless station according to the real usage Total Upload Limit Default value is 30 000 kbps All the wireless stations share the bandwidth for uploading without exceeding the valued typed here Total Download Limit Default value is 30 000 kbps All the wireless stations share the bandwidth for downloading without exceeding the valued typed here Per Station Limit If you choose Per Station Limit the router will offer the bandwidth for each wireless station based on the values configured here Upload Limit Default value is 30 000 kbps Each wireless station can have the bandwidth for uploading without exceeding the values typed here Download Limit Default value is 30 000 kbps Each wireless station can have the bandwidth for uploading without exceeding the values typed here After finished the above settings click OK to save the configuration Dray Te k 315 Vigor2830 Series User s Guide 3 15 SSL VPN An SSL VPN Secure Sockets Layer virtual private network is a form of VPN that can be used with a standard Web browser There are two benefits that SSL VPN provides gt Itis not necessary for users to preinstall VPN client software for executing SSL VPN connection gt There are less restrictions for the data encrypted through SSL VPN in comparing with traditional VPN 3 15 1 General Setup T
434. sword NENET ONA Password E 4 Log out Vigor router Web user interface Product Registration Logout All Rights Reserved 5 The following window will be open to ask for username and password Type the new user password in the filed of Password and click Login Username Password Copyright DrayTek Corp All Rights Reserved Dray Tek Dray Tek z Vigor2830 Series User s Guide 6 The main screen with User Mode will be shown as follows ADSL2 Security Firewall Vigor2830 Series E Dray Tek IRG System Status Model Name Vigor2830Vn Firmware Version 3 6 7_db Build Date Time Mar 24 2014 15 47 36 Wizards Online Status WAN LAN Load Balance Route Policy MAC Address IP Address Subnet Mask NAT 00 50 7F 64 FB 18 192 168 1 1 255 255 255 0 Applications LAN2 00 50 7F 64 FB 18 192 168 2 1 255 255 255 0 Wireless LAN LANS 00 50 7F 64 FB 18 192 168 3 1 255 255 255 0 System Maintenance LAN4 00 50 7F 64 FB 18 192 168 4 1 255 255 255 0 Diagnostics IP Routed Subnet 00 50 7F 64 FB 18 192 168 0 1 255 255 255 0 External Devices Link Status MAC Address Connection Disconnected 00 S50 7F 64 FB 19 PPPoE Disconnected 00 50 7F 64 FB 14 Disconnected 00 50 7F 64 FB 1B All Rights Reserved Address Scope Internet Access Mode LAN FE80 250 7FFF FE64 FB18 64 Link ae Port Profile In Out Phonel 0 0 Settings to be configured in User Mode will be less than settings in Admin Mode Onl
435. sword host port Some fields may be optional in different use In general host refers to a domain The userinfo includes the user field the password field and the sign following them This is very similar to a URL so some may call it SIP URL SIP supports peer to peer direct calling and also calling via a SIP proxy server a role similar to the gatekeeper in H 323 networks while the MGCP protocol uses client server architecture the calling scenario being very similar to the current PSTN network After a call is setup the voice streams transmit via RTP Real Time Transport Protocol Different codecs methods to compress and encode the voice can be embedded into RTP packets Vigor V models provide various codecs including G 711 A u law G 723 G 726 and G 729 A amp B Each codec uses a different bandwidth and hence provides different levels of voice quality The more bandwidth a codec uses the better the voice quality however the codec used must be appropriate for your Internet bandwidth Usually there will be two types of calling scenario as illustrated below Dr ay Tek 273 Vigor2830 Series User s Guide Calling via SIP Servers First the Vigor V models of yours will have to register to a SIP Registrar by sending registration messages to validate Then both parties SIP proxies will forward the sequence of messages to caller to establish the session If you both register to the same SIP Registrar then
436. t Setting timeout for sessions can make the best utilization of network resources However Queue timeout is configured for TCP protocol only session timeout is configured for the data flow which matched with the firewall rule DrayTek Banner Please uncheck this box and the following screen will not be shown for the unreachable web page The default setting is Enabled The requested Web page has been blocked by Web Content Filter Please contact your system administrator for further information Powered by Draytek Strict Security Checking All the packets while transmitting through Vigor router will be filtered by firewall settings configured by Vigor router When the resource is inadequate the packets will be blocked if Strict Security Checking is enabled If Strict Security Checking is not enabled then the packets will pass through the router APP Enforcement Check this box to execute the critical checking for all the files transferred via IM P2P After finishing all the settings here please click OK to save the configuration Example As stated before all the traffic will be separated and arbitrated using on of two IP filters call filter or data filter You may preset 12 call filters and data filters in Filter Setup and even link them in a serial manner Each filter set is composed by 7 filter rules which can be further defined After that in General Setup you may specify one set for call filter and one se
437. t Display the port for the incoming data of such triggering profile Status Display 1f the rule is active or de active Click the index number link to open the configuration page Vigor2830 Series User s Guide 140 Dr ay Tek NAT gt gt Port Triggering No 1 C Enable Service Comment Triggering Protocal Triggering Port Incoming Protocol Incoming Port User Defined Note The Triggering Port and Incoming Port should be input like this 123 456 777 789 legal 123 456 789 legal but 123 456 789 illegal Available settings are explained as follows Item Enable Service Comment Triggering Protocol Triggering Port Incoming Protocol Dray Tek Description Check to enable this entry Choose the predefined service to apply for such trigger profile User Defined User Defined Real Player Quick Time BitTorrent Type the text to memorize the application of this rule Select the protocol TCP UDP or TCP UDP for such triggering profile Type the port or port range for such trigger profile When the triggering packets received it is expected the incoming packets will use the selected protocol Select the protocol TCP UDP or TCP UDP for the incoming data of such triggering profile 141 Vigor2830 Series User s Guide Incoming Port Type the port or port range for the incoming packets After finishing all the settings here please click OK to save the configuration V
438. t Gateway Specific Gateway Auta failover to other WAM Packet Forwarding to WAN via Force MAT Force Routing Available settings are explained as follows Item Enable Dray Tek Description Check this box to enable this policy 129 Vigor2830 Series User s Guide Move Move Down Down Down Protocol Source IP Destination IP Destination Port Send to if criteria matched More options Vigor2830 Series User s Guide Use the drop down menu to choose a proper protocol for the WAN interface Any Any IP can be treated as the source IP Src IP Start Type the source IP start for the specified WAN interface Src IP End Type the source IP end for the specified WAN interface If this field is blank it means that all the source IPs inside the LAN will be passed through the WAN interface Any Any IP can be treated as the destination IP Dest IP Start Type the destination IP start for the specified WAN interface Dest IP End Type the destination IP end for the specified WAN interface If this field is blank it means that all the destination IPs will be passed through the WAN interface Any Any port number can be treated as the destination port Dest Port Start Type the destination port start for the destination IP Dest Port End Type the destination port end for the destination IP If this field is blank it means that all the destination ports will be passed
439. t IP Address Start Start End Start End Any Any 203 65 1 35 203 65 1 35 Any Any i Wizard Mode most frequently used settings in three pages Advance Mode all settings in one page Src Src Dest Dest IP IP Dest IP End Port Port Move Move Up Down Down Down Down Down Now the packets sent to the remote PC IP address 203 65 1 35 will be forcefully to pass through WANI Vigor2830 Series User s Guide 442 Dray Tek Trouble Shooting This section will guide you to solve abnormal situations if you cannot access into the Internet after installing the router and finishing the web configuration Please follow sections below to check your basic installation status stage by stage Checking if the hardware status is OK or not Checking if the network connection settings on your computer are OK or not Pinging the router from your computer Checking if the ISP settings are OK or not Backing to factory default setting if necessary If all above stages are done and the router still cannot run normally it is the time for you to contact your dealer for advanced help 5 1 Checking If the Hardware Status Is OK or Not Follow the steps below to verify the hardware status 1 Check the power line and WLAN LAN cable connections Refer to 1 3 Hardware Installation for details 2 Turn on the router Make sure the ACT LED blink once per second and the correspondent LAN LED is bright ACT W ely 1
440. t for data filter to execute first Vigor2830 Series User s Guide 156 Dr ay Tek Dray Tek hawali General Setup General Semi enai Semp dotant fula Call Hins E Enabie D beable Data Filiea Ei Enable sable El Grable Stict Sacunty Firewall Li a Flrewall Fitter Setup gt Edit Pilat Sen Filter Ser Commens Defan Coal j d Cennet Block NetBiors cecen E Start Filter Ser Sa Move Up Move lovam Dawn WP Pwet QF Dassen lig Daen uP Down ue ran Ment Fitton gi 157 Fi Accept large incoming fragmented UDP or DEMP packets far some Games ex C 4 Firewall e amp Filter Satay Filer Semp ae ee 6 Selin Factory Oefa Comments Sell Comments Default Call Fitter G Default Data Filter E z 4 u i u i iL Firewall gt gt Fillt Fier Soi gt Bilt Fleer Rale Filter Sel 1 Mule 1 u Fi Cheek to enable th Filter Eile Comments Biock NetBios ndei eleda Setup Dinaction LANAI EM 2 gt WAAN Source i ary ee Os Destination 1P bn oe Service Typo TCPAIDP Port bom 137 139 10 undefired C En Fragenerits Dont care ppiicatinm Acibon Protile Symm Filter Pans ENo Further Match 3 al branch to Other Filter Sat None Sessions Contral oy sooo i MAC Bind iP Monstret jw a Ciuality of Senco None o Load aatance policy User Marne rae m AER Ertan rege iE URL Cantena Filter a Wal Contant Eii a Advance Setting
441. t routing packet from WAN fragmented UDP or ICMP Packets Check the box to enable such function All the packets while transmitting through Vigor router will be filtered by firewall settings configured by Vigor router if such feature is enabled If the firewall system does not have any response pass or block for these packets such as no response coming from web content filter then the router s firewall will block the packets directly Usually IPv6 network sessions traffic from WAN to LAN will be blocked by IPv6 firewall to prevent remote client accessing into the PCs on LAN in default IP v6 Check the box to make the packets routed from WAN to LAN via IPv6 being accepted by such router It is effective only for the packets routed but not for packets translated by NAT IPv4 Check the box to make the incoming packets via IPv4 being accepted by such router It is effective only for the packets routed but not for packets translated by NAT Default Rule Page Such page allows you to choose filtering profiles including QoS Load Balance policy WCF APP Enforcement URL Content Filter AI AV AS for data transmission via Vigor router Firewall gt gt General Setup General Setup General Setup Actions for default rule Application Filter Sessions Control Quality of Service Load Balance policy User Management APP Enforcement URL Content Filter Web Content Filter Advance Setting Default Rule
442. t the network connection does not work Check the PIN Code of SIM card is disabled or not Please use the utility of 3G USB Modem to disable PIN code and try again If it still fails it might be the compliance problem of system Please open DrayTek Syslog Tool to capture the connection information WAN Log and send the page similar to the following graphic to the service center of DrayTek Vigor2830 Series User s Guide 448 Dr ay Tek Log Filter Syslog Utility Keyword Apply to All vw JS Firewall YPN System Time 2013 08 27 15 11 09 2013 08 27 15 11 09 2013 08 27 15 10 07 2013 08 27 15 10 06 2013 08 27 15 10 06 2013 08 27 15 10 06 2013 08 27 15 10 06 2013 08 27 15 10 06 2013 08 27 15 10 06 2013 08 27 15 10 06 2013 08 27 15 10 06 2013 08 27 15 10 06 2013 08 27 15 10 06 2013 08 27 15 10 06 2013 08 27 15 10 06 2013 08 27 15 10 06 2013 08 27 15 10 06 lt User Access Connection Router Time 4ug 27 07 10 53 4ug 27 07 10 53 4ug 27 07 09 51 4ug 27 07 09 51 4ug 27 07 09 51 4ug 27 07 09 51 4ug 27 07 09 51 4ug 27 07 09 51 4ug 27 07 09 51 4ug 27 07 09 51 4ug 27 07 09 51 ug 27 07 09 51 4ug 27 07 09 51 4ug 27 07 09 51 4ug 27 07 09 51 4ug 27 07 09 51 4ug 27 07 09 51 WAN Show Traffic Graph Hast Vigor router Vigor router Vigor router Vigor router Vigor router Vigor router Vigor router Vigor router Vigor router Vigor router Vigor router Vigor router Vigo
443. te Gateway IP Remote Network IP Remote Network Mask Local Network IP 92 168 1 1 Local Network Mask RIP Direction From first subnet to remote network you have to do Change default route to this YPN tunnel Only single WAN supports this 3 Available settings are explained as follows Item Description Allowed Dial In Determine the dial in connection with different types Type PPTP Allow the remote dial in user to make a PPTP VPN connection through the Internet You should set the User Name and Password of remote dial in user below IPSec Tunnel Allow the remote dial in user to trigger an IPSec VPN connection through Internet L2TP with IPSec Policy Allow the remote dial in user to make a L2TP VPN connection through the Internet You can select to use L2TP alone or with IPSec Select from below None Do not apply the IPSec policy Accordingly the VPN connection employed the L2TP without IPSec policy can be viewed as one pure L2TP connection Nice to Have Apply the IPSec policy first if it is applicable during negotiation Otherwise the dial in VPN connection becomes one pure L2TP connection Must Specify the IPSec policy to be definitely applied Vigor2830 Series User s Guide 258 Dray Tek Dray Tek GRE over IPSec Settings on the L2TP connection Specify Remote VPN Gateway You can specify the IP address of the remote dial in user or peer ID should be the same with the ID sett
444. te dial in users with the CHAP protocol first If the dial in user does not support this protocol it will fall back to use the PAP protocol for authentication Optional MPPE This option represents that the MPPE encryption method will be optionally employed in the router for the remote dial in user If the remote dial in user v2 Dray Tek does not support the MPPE encryption algorithm the router will transmit no MPPE encrypted packets Otherwise the MPPE encryption scheme will be used to encrypt the data Optional MPPE Oo Optional MPPE Require MPPEMO 26 bit Maximum MPPEM128 bit Require MPPE 40 128bits Selecting this option will force the router to encrypt packets by using the MPPE encryption algorithm In addition the remote dial in user will use 40 bit to perform encryption prior to using 128 bit for encryption In other words if 128 bit MPPE encryption method is not available then 40 bit encryption scheme will be applied to encrypt the data Maximum MPPE This option indicates that the router will use the MPPE encryption scheme with maximum bits 128 bit to encrypt the data Mutual Authentication The Mutual Authentication function is mainly used to PAP communicate with other routers or clients who need bi directional authentication in order to provide stronger security for example Cisco routers So you should enable this function when your peer router requires mutual authentication You should furthe
445. te with hosts connected to Bridge 2 through WDS links However hosts connected to Bridge 1 CANNOT communicate with hosts connected to Bridge 3 through Bridge 2 Host with Host with bridge Interface 1 Click WDS from Wireless LAN menu The Wireless LAN gt WDS Settings WDS Settings Mode Security Disable WEP Pre shared Key WEP Use the same WEP key set in Security Settings Pre shared Key Type WPA WPA2 Key Note WPA and WPA are not compitable with DrayTek WPA Type 8 63 ASCII characters or 64 hexadecimal digits leading by Ox for example cfgsOlaz2 or Ox65Sabcd Available settings are explained as follows Item Description bridge Interface 2 Host with bridge Interface 3 following page will be shown Setto Factor Bridge Enable d LI d CI Note Disable unused links performance Repeater Enable Peer MAC Addess Access Point Function Enable Disable Status Cl Send Hello message to peers Note The status is valid only when the peer also supports this function Cancel Mode Dray Tek Choose the mode for WDS setting Disable mode will not 307 Vigor2830 Series User s Guide Security WEP Pre shared Key Bridge Repeater Access Point Function Status Vigor2830 Series User s Guide invoke any WDS setting B
446. termine general rule for filtering the incoming and outgoing data Firewall gt gt General Setup General Setup General Setup Default Rule Call Filter Data Filter Enable Start Filter Set Disable Enable Start Filter Set Disable Accept large incoming fragmented UDF or ICMP packets for some games ex cS Enable Strict Security Firewall Accept routing packet from WAN Oipv OO IPv Note The packets will be filtered with the follow function sequentially 1 Accept Routing Packet from WAN 2 Data Filter Set and Rule in Firewall 3 Default Rule in Firewall Available settings are explained as follows Dray Tek Item Call Filter Data Filter Accept large incoming Description Check Enable to activate the Call Filter function Assign a start filter set for the Call Filter Check Enable to activate the Data Filter function Assign a start filter set for the Data Filter Some on line games for example Half Life will use lots of fragmented UDP packets to transfer game data Instinctively as a secure firewall Vigor router will reject these fragmented packets to prevent attack unless you enable Accept large incoming fragmented UDP or ICMP Packets By checking this box you can play these kinds of on line games If security concern is in higher priority you cannot enable Accept large incoming 145 Vigor2830 Series User s Guide Enable Strict Security Firewall Accep
447. ternative Subject Name First The alternative subject name configured in Certificate Management gt gt Local Certificate will be inspected first Subject Name First The subject name configured in Certificate Management gt gt Local Certificate will be inspected first IPSec Security Method This group of fields is a must for IPSec Tunnels and L2TP with IPSec Policy when you specify the remote node Medium Authentication Header AH means data will be authenticated but not be encrypted By default this option is active High Encapsulating Security Payload ESP means payload data will be encrypted and authenticated You may select encryption algorithm from Data Encryption Standard DES Triple DES 3DES and AES Enable IPSec Dial Out function GRE over IPSec Check this box to verify data and transmit data in encryption with 259 Vigor2830 Series User s Guide GRE over IPSec packet after configuring IPSec Dial Out setting Both ends must match for each other by setting same virtual IP address for communication Logical Traffic Such technique comes from RFC2890 Define logical traffic for data transmission between both sides of VPN tunnel by using the characteristic of GRE Even hacker can decipher PSec encryption he she still cannot ask LAN site to do data transmission with any information Such function can ensure the data transmitted on VPN tunnel is really sent out from both sides This is an opti
448. the URL that the user wants to access via WCF precisely however the processing rate is normal Such item can provide the most accurate URL matching L1 the router will check the URL that the user wants to access via WCF If the URL has been accessed previously it will be stored for a short time about 1 second in the router to be accessed quickly if required Such item can provide accurate URL matching with faster rate L2 the router will check the URL that the user wants to access via WCF If the data has been accessed previously the IP addresses of source and destination IDs will be memorized for a short time about second in the router When the user tries to access the same destination ID the router will check it by comparing the record stored If it matches the page will be retrieved quickly Such item can provide URL matching with the fastest rate L1 L2 Cache the router will check the URL with fast processing rate combining the feature of L1 and L2 Eight profiles are provided here as Web content filters Simply click the index number under Profile to open the following web page The items listed in Categories will be changed according to the different service providers If you have and activate another web content filter license the items will be changed simultaneously All of the configuration made for web content filter will be deleted automatically Therefore please backup your data before you change the web c
449. the following It may not DrayOS system with new web style or maybe the Linux like model WAN Internet Access gt gt Multi VLAN Muliti VLAN General VLAN Settings VLAN Members s senace Binding amp WAM Setup L Dray Tek 453 Vigor2830 Series User s Guide LAN Enable Port hased VLAN by checking the option The option of Tae Aesad VLAN VLAN Configuration Subnet VLAN ID assigned DHCP Pool will be used 802 1p field VLAN applications on Vigor router Multi Subnet VLAN of LAN SSID 1 VLAN 0 3D 2 VLANI Sales Dept SSID 3 VLANZ2 D D Vigor2830 Series User s Guide 454 Dr ay Te k Port based mode Enable LAH Wireless LAH Pi Pe Pi P4 SSID1 SSID 55103 5104 Subnet Enable Tag based mode Enable LAN Wireless LAH Pi PF P3 Pa SSID SSID SSIDD SSID4 Subnet Vue FOO A vant By above settings there are four private networks will be created and computers attached with each of LAN ports or SSIDs which are able to obtain a private IP address from each DHCP servers LAN 1 LAN2 LAN3 LAN4 However the traffics of the LAN port or SSID that are NOT being grouped in the same VLAN are unable to forward to each other The benefit of Port based is able to extend the wired ports by installing a cheaper dumb switch as many as you need but Tag based offers you a flexible and well managed netw
450. the saved SIP accounts Please set up one SIP account first to make this interface available This item will be changed according to the port settings configured in VoIP gt gt Phone Settings Move UP Move Down Click the link to move the selected entry up or down Call Barring Call barring is used to block phone calls coming from the one that is not welcomed VoIP gt DialPlan Setup Call Barring Setup Setto Factory Default Index Call Direction Barring Type Barring Number URL URI Route Schedule Status i X 2 x 3 X 4 x 5 x 6 x X x 9 x lt lt 1 10 11 20 Next Advanced Block Anonymous Block Unknown Domain Block IP Address Click any index number to display the dial plan setup page Dr ay Tek 279 Vigor2830 Series User s Guide VoIP gt DialPlan Setup Call Barring Index No 1 Call Direction IN Barring Type Specific URIURL Route All Index 1 15 in Schedule Setup a Note Wildcard is supported Available settings are explained as follows Item Description Enable Check it to enable this entry Call Direction Determine the direction for the phone call IN incoming call OUT outgoing call IN amp OUT both incoming and outgoing calls Barring Type Determine the type of the VoIP phone call URI URL or number specific URVURL Specific URVURL Specific Number Specific URI URL or This field will be changed based on the type you se
451. this field and ignore the action specified under Restrict Web Feature Prevent web access from IP address Check the box to deny any web surfing activity using IP address such as http 202 6 3 2 The reason for this is to prevent someone dodges the URL Access Control You must clear your browser cache first so that the URL content filtering facility operates properly on a web page that you visited before Action This setting is available only when Either URL Access Control First or Either Web Feature First is selected Pass Allow accessing into the corresponding webpage with the keywords listed on the box below Block Restrict accessing into the corresponding webpage with the keywords listed on the box below If the web pages do not match with the keyword set here it will be processed with reverse action Action Block Group Object Selections The Vigor router provides several frames for users to define keywords and each frame supports multiple keywords The keyword could be a noun a partial noun or a complete URL string Multiple 20 Dray Tek Dray Tek Web Feature keywords within a frame are separated by space comma or semicolon In addition the maximal length of each frame is 32 character long After specifying keywords the Vigor router will decline the connection request to the website whose URL string matched to any user defined keyword It should be noticed that the more simplified the blocking ke
452. this mode otherwise please choose Route Mode Route Mode ig m D T te h m d E MAT Mlode Please choose a There are 32 VPN profiles for users to set LAN to LAN Profile Vigor2830 Series User s Guide 44 Dr ay Tek Index Status Hane a 1 H 277 E 2 E TPY 4 H T7 5 rry 6 TPY 7 H Tr g H 777 g e777 10 H Tr 11 H Ear 1 TPY 13 T7 14 H T7 15 E TPY 16 277 1 H Tr 18 H TPY 19 777 20 H Tr 21 H Try ee TPY 2 Tr 24 H 77 25 777 26 Tr B 2T H Tr 20 H Ear 29 E Tr b 2 When you finish the mode and profile selection please click Next to open the following page VPN and Remote Access gt gt VPN Client Wizard VPN Connection Setting Security ranking 1 is the highest 5 is the lowest Throughput ranking 1 is the highest 5 is the lowest 1 L2TP over IPSec 1 PPTP None Encryption 2 IPSec 2 L2TP 3 PPTP Encryption 3 IPSec 4 L2TP 4 L2TP over IPSec 5 5 PPTP None Encryption PPTP Encryption PPTP Mone Encryption w PPTP Mone Encryption PPTP Encryption IPSec LTF Select VPN Type LATP over IPSec Nice ta Have LATP over IPSec Must In this page you have to select suitable VPN type for the VPN client profile There are six types provided here Different type will lead to different configuration page After making the choices for the client profile please click Next You will see different configurations based on the selection s you mad
453. thout laying a clot of LAN cable or drilling holes everywhere Wireless LAN enables high mobility so WLAN users can simultaneously access all LAN facilities just like on a wired LAN as well as Internet access The Vigor wireless routers are equipped with a wireless LAN interface compliant with the standard IEEE 802 11n draft 2 protocol To boost its performance further the Vigor Router is also loaded with advanced wireless technology to lift up data rate up to 300 Mbps Hence you can finally smoothly enjoy stream music and video Note The actual data throughput will vary according to the network conditions and environmental factors including volume of network traffic network overhead and building materials In an Infrastructure Mode of wireless network Vigor wireless router plays a role as an Access Point AP connecting to lots of wireless clients or Stations STA All the STAs will share the same Internet connection via Vigor wireless router The General Settings will set up the information of this wireless network including its SSID as identification located channel etc Internet SSID Draytek Channel 6 Mode WEP only Multiple SSIDs Vigor router supports four SSID settings for wireless connections Each SSID can be defined with different name and download upload rate for selecting by stations connected to the router wirelessly Dr ay Tek 295 Vigor2830 Series User s Guide Security Overview Real time Har
454. ting in the page of LAN gt gt General Setup Refer to the following figure LAN2 and LAN3 are linked Inter LAN Routing Subnet LAN 1 LAN 2 LAN 3 LAN 4 Dr ay Tek 381 Vigor2830 Series User s Guide 4 3 How Can I Use FTP to Get the Files from USB Storage Device Connecting to Vigor Router There are three methods to get files from USB devices connecting to router File Explorer Under Administration operation the administer can control the files on USB storage device through USB Application gt gt File Explorer FTP Use common FTP utility Samba Invoke Samba service and use 192 168 1 1 to access into the USB storage device Files on USB storage device can be reviewed by opening USB Applicaiton gt gt File Explorer Below shows the example of getting files from FTP 1 Plug the USB device to the USB port on the router Make sure Disk Connected appears on the Connection Status as the figure shown below USB Application gt gt USB Disk Status USB Mass Storage Device Status Connection Status Disk Connected Disconnect USB Disk i Wh Write Protect Statu Disk Capacity 2009 MB USB Disk Users Connected Refresh Index Service IP Address Port Username Note If the write protect switch of USB disk is turned on the USB disk is in READ ONLY mode No data can be written to it 2 Then please open USB Application gt gt USB General Settings to enable Samba service USB Application gt
455. tion Standard DES Triple DES 3DES and AES 48 Dray Tek User Name This field is used to authenticate for connection when you select PPTP or L2TP with or without IPSec policy above Password This field is used to authenticate for connection when you select PPTP or L2TP with or without IPSec policy above Remote Network IP Please type one LAN IP address according to the real location of the remote host for building VPN connection Remote Network Please type the network mask according to the real location Mask of the remote host for building VPN connection 3 After finishing the configuration please click Next The confirmation page will be shown as follows If there is no problem you can click one of the radio buttons listed on the page and click Finish to execute the next action VPN and Remote Access gt gt VPN Client Wizard Please confirm your settings LAN to LAN Index a Profile Name VPN 1 YPN Connection Type L2TP over IPSec Must YPN Connection Through WANI First Always on Mo Server IP Host Name draytek caom IKE Authentication Method Digital Signature x 509 IPSec Security Method AH SHAL Remote Network IP 192 168 1 6 Remote Network Mask 255 255 255 0 Click Back to modify changes if necessary Otherwise click Finish to save the current settings and proceed to the follawing action Go to the YPN Connection Management Do another VPN Client Wizard setup View more detailed config
456. tion you set for each index Time Schedule Index 1 15 in Schedule Setup You can type in four sets of time schedule for your request All the schedules can be set previously in Application gt gt Schedule web page and you can use the number that you have set in that web page After finishing all the settings here please click OK to save the configuration Dr ay Te k 213 Vigor2830 Series User s Guide 3 9 3 Quality of Service Deploying QoS Quality of Service management to guarantee that all applications receive the service levels required and sufficient bandwidth to meet performance expectations is indeed one important aspect of modern enterprise network One reason for QoS is that numerous TCP based applications tend to continually increase their transmission rate and consume all available bandwidth which is called TCP slow start If other applications are not protected by QoS it will detract much from their performance in the overcrowded network This is especially essential to those are low tolerant of loss delay or jitter delay variation Another reason is due to congestions at network intersections where speeds of interconnected circuits mismatch or traffic aggregates packets will queue up and traffic can be throttled back to a lower speed If there s no defined priority to specify which packets should be discarded or in another term dropped from an overflowing queue packets of sensitive applications menti
457. tiple VPN tunnels as backup tunnel It can assure the network connection not to be cut off due to network environment blocked by any reason gt VPN TRUNK VPN Backup mechanism can judge abnormal situation for the environment of VPN server and correct it to complete the backup of VPN Tunnel in real time gt VPN TRUNK VPN Backup mechanism is compliant with all WAN modes single multi gt Dial out connection types contain IPSec PPTP L2TP and L2TP over IPSec depends on hardware specification gt The web page is simple to understand and easy to configure gt Filly compliant with VPN Server LAN Sit Single Multi Network gt Mail Alert support please refer to System Maintenance gt gt SysLog Mail Alert for detailed configuration gt Syslog support please refer to System Maintenance gt gt SysLog Mail Alert for detailed configuration gt Specific ERD Environment Recovery Detection mechanism which can be operated by using Telnet command VPN TRUNK VPN Backup mechanism profile will be activated when initial connection of single VPN tunnel is off line Before setting VPN TRUNK VPN Backup mechanism backup profile please configure at least two sets of LAN to LAN profiles with fully configured dial out settings first otherwise you will not have selections for grouping Member and Member2 VPN and Remote Access gt gt VPN TRUNK Management ww Backup Profile List Set to Factory Default Note Active NO The LAN to
458. tive You can set up to 15 schedules Then you can apply them to your Internet Access or VPN and Remote Access gt gt LAN to LAN settings Vigor2830 Series User s Guide 228 Dr ay Tek To add a schedule 1 Click any index for example Index No 1 Applications gt gt Schedule Schedule Setto Factory Default Index Status Index Status 1 H gi 2 w 10 W 3 w 11 W 4 Fs 12 4 H 13 6 W 14 w 15 w a Fs Status v Active s Inactive 2 The detailed settings of the call schedule with index 1 are shown below Applications gt gt Schedule Index No 1 Start Date yyyy mm dd Start Time hh imm Duration Time chh mm lo Idle Timeout bo minutersi max 255 0 for default How Often once Weekdays LJ Sun Mon Tue Wed Thu Fri O Sat Available settings are explained as follows Item Description Enable Schedule Check to enable the schedule Setup Start Date Specify the starting date of the schedule yyyy mm dd Start Time hh mm Specify the starting time of the schedule Duration Time Specify the duration or period for the schedule hh mm 229 Vigor2830 Series User s Guide Dray Tek Action Specify which action Call Schedule should apply during the period of the schedule Force On Force the connection to be always on Force Down Force the connection to be always down Enable Dial On Demand Specify the connection to be dial on demand and the valu
459. to make confirmation Home Folder It determines the folder for the client to access into The user can enter a directory name in this field Then after clicking OK the router will create the specific new folder in the USB storage disk In addition if the user types here he she can access into all of the disk folders and files in USB storage disk Note When write protect status for the USB storage disk is ON you cannot type any new folder name in this field Only can be used in such case Vigor2830 Series User s Guide 330 Dr ay Te k You can click to open the following dialog to add any new folder which can be specified as the Home Folder A kip CRI SMeeAipeseciolder kia Microroft Internet Explores USB User Wanagement hows Poldlier Folder Name Polder Macnee Note The folder name can only contain the folowing characters A Z a r O O e ip 2 1 characlers a p t Only 1 haragi re allowed Access Rule It determines the authority for such profile Any user who uses such profile for accessing into USB storage disk must follow the rule specified here File Check the items Read Write and Delete for such profile Directory Check the items List Create and Remove for such profile Before you click OK you have to insert a USB storage disk into the USB interface of the Vigor router Otherwise you cannot save the configuration Dr ay Tek 331 Vigor2830 Series User s Gui
460. to upgrade firmware Click OK The following screen will appear Please execute the firmware upgrade utility first System Maintenance gt gt Firmware Upgrade A TFTF server is running Please execute a Firmware Upgrade Utility software to upgrade router s firmware This server will be closed by itself when the firmware upgrading finished Vigor2830 Series User s Guide 354 Dr ay Te k 3 17 13 Activation There are three ways to activate WCF on vigor router using Service Activation Wizard by means of CSM gt gt Web Content Filter Profile or via System Maintenance gt gt Activation After you have finished the setting profiles for WCF refer to Web Content Filter Profile it is the time to activate the mechanism for your computer Click System Maintenance gt gt Activation to open the following page for accessing http myvigor draytek com System Maintenance gt gt Activation Activate via interface auto selected Web Filter License Activate Status Not Activated Authentication Message WebFilter 3ervice not activate 2010 06 16 OF 56 36 Note If you want to use email alert or syslog please configure the SysLog Mail Alert Setup page If you change the service provider the configuration of the function will be reset Available settings are explained as follows Item Description Activate via Interface Choose WAN interface used by such device for activating Web Content Filter Activate via interfac
461. tomatically APN Name APN means Access Point Name which is provided and required by some ISPs 3 Then click Next for viewing summary of such connection Quick Start Wizard Please confirm your settings WAN Interface WARNS Physical Mode LISB Internet Access DHCP Click Back to modify changes if necessary Otherwise click Finish to save the current settings and restart the Vigor router 4 Click Finish A page of Quick Start Wizard Setup OK will appear Then the system status of this protocol will be shown Quick Start Wizard Setup OK 5 Now you can enjoy surfing on the Internet Dr ay Tek 39 Vigor2830 Series User s Guide 2 2 Service Activation Wizard Service Activation Wizard can guide you to activate WCF service Web Content Filter with a quick and easy way For the Service Activation Wizard is only available for admin operation therefore please type admin admin on Username Password while Logging into the web user interface Service Activation Wizard is a tool which allows you to use trial version or update the license of WCF directly without accessing into the server MyVigor located on http myvigor draytek com For using Web Content Filter Profile please refer to later section Web Content Filter Profile for detailed information Now follow the steps listed below to activate WCF feature for your router 1 Open Service Activation Wizard Wizards 2 The screen of Servic
462. ttings here please click OK to activate them Dr ay Tek 81 Vigor2830 Series User s Guide Details Page for Static or Dynamic IP in WAN2 For static IP mode you usually receive a fixed public IP address or a public subnet namely multiple public IP addresses from your DSL or Cable ISP service providers In most cases a Cable service provider will offer a fixed public IP while a DSL service provider will offer a public subnet If you have a public subnet you could assign an IP address or many IP address to the WAN interface To use Static or Dynamic IP as the accessing protocol of the internet please click the Static or Dynamic IP tab The following web page will be shown WAN gt Internet Access WAN 2 PPPoE Static or Dynamic IP PPTP L2TP IP Disable Enable Keep WAN Connection C Enable PING to keep alive PING Interval o minute s WAN Connection Detection Mode ARP Detect TTL MTU 1442 Max 1500 RIP Protocol C Enable RIP WAN IP Network Settings Obtain an IP address automatically Router Mame Domain Name Required for same ISPs DHCP Client ldentifier for some ISP C Enable Specify an IP address IP Address f Subnet Mask i Gateway IP Address OoOo Default MAC Address O Specify a MAC Address MAC Address 150 FF FIBA ha DNS Server IP Address Primary IP Address 6 9 9 8 Secondary IP Address 8 6 44 Available settings are explained as follows Item Enabl
463. ttings in IPSec General Setup such as the pre shared key that both parties have known Vigor2830 Series User s Guide 400 Dr ay Tek VPN and Remote Access gt IPsec General Setup VPN IKEAF sec General Setup Dial in Set up for Remote Dial in users and Dynamic IP Client LAN to LAM IKE Authentication Method Certificate for Dial in Pre Shared Key Pre Shared Key Confirm Pre Shared Key IPsec Security Method Medium tH Data will be authentic but will not be encrypted High ESP IDES Ml3peES MAES Data willbe encrypted and authentic 3 Goto LAN to LAN Click on one index number to edit a profile 4 Set Common Settings as shown below You should enable both of VPN connections because any one of the parties may start the VPN connection VPN and Remote Access gt gt LAHN to LAN Profile Index 1 1 Common Settings Profile Name Call Direction Both Dial Gut Dial in C Enable this profile CO Always on idle Timeout second s YPN Dial Out Through WAM First C Enable PING to keep alive Netbios Naming Packet Pass Block PING to the IP Multicast via VPN OPpass Block for some IGMP IP Camera DHCP Relay etc 5 Set Dial Out Settings as shown below to dial to connect to Router B aggressively with the selected Dial Out method If an PSec based service is selected you should further specify the remote peer IP Address IKE Authentication Method and IPSec Security Method for this Dial Out connect
464. tup Status Enable C Disable Profile Name 071023 Memberi Please choose the combination that you want Member2 Please choose the combination that you vant lease choose the combination that you want Attribute Mode No lt Nane t Connect 1on Type gt CVEN ServerIP Private Network gt 11 To A PlacelIPSec 192 168 2 25 20 20 20 0 Fi To B Site IPSec 192 168 2 26 20 20 21 0 Add Edit Delete Take a look for LAN to LAN profiles Index 1 is chosen as Member1 index 2 is chosen as Member2 For such reason LAN to LAN profiles of 1 and 2 will be expressed in red to indicate that they are fixed If you delete the VPN TRUNK VPN Backup mechanism profile the selected LAN to LAN profiles will be released and expressed in black VPN and Remote Access gt gt LAN to LAN LAN to LAN Profiles Index Name Status i To amp Place f To B Site a To place i 4 To D Site y How can you set a GRE over IPSec profile L 2 Dray Tek Please go to LAN to LAN to set a profile with IPSec If the router will be used as the VPN Server 1 e with virtual address 192 168 50 200 Please type 192 168 50 200 in the field of My GRE IP Type IP address 192 168 50 100 of the client in the field of Peer GRE IP See the following graphic for an example Callback Budget i minute s 4 GRE over IPSec Settings L Enable IPSec Dial Out function GRE over IPSec Logical Traffic My GRE IP 192 169 50
465. twork Because the idea of port based VLAN is grouping by physical ports but the difficulty is how to handle the traffics between two or more Ethernet switches Thus VLAN is suitable for some circumstances for example the rental apartment SOHO office and so on These clients may need two or three isolated networks only and setup a network in a simple way Port based VLAW Switch Group A Group B 112 E31 oo Group A Group B Switch Switch Tag based The idea of tag based VLAN is to identify a virtual LAN with a specific ID therefore VLAN ID introduced by tag based VLAN Through VLAN ID ports with different VID VLAN ID will be identified as in different LANs so the traffics also will be isolated from each of VLANs Many administrators who manage an enterprise network or even the internet service providers ISP adopt Tag based VLAN popularly because it is convenient to maintenance and management a distributed network Setting a large scale network is easy by giving each of them with different VID and isolating the traffics at the same time Besides the VLAN ID there is another feature Trunk introduced While the role of a port on an Ethernet switch is setup as a Trunk port it means the VLAN ID will be kept while forwarding the packets between switches By this feature VLANs are able to distribute over two or more Ethernet Dray Te k 451 Vigor2830 Series User s Guide switches easily moreover design a large and secured n
466. typed in this field to release this function Call Waiting Act Dial the number typed in this field to make all the incoming calls waiting for your answer Call Waiting Deact Dial the number typed in this field to release this function Block Anonymous Act Dial the number typed in this field to block all the incoming calls with unknown ID Block Anonymous Deact Dial the number typed in this field to release this function Block Unknown Domain Dial the number typed in this field to block all the incoming Act calls from unknown domain Block Unknown Domain Dial the number typed in this field to release this function Deact Block IP Calls Act Dial the number typed in this filed to block all the incoming calls from IP address Block IP Calls Deact Dial the number typed in this field to release this function Block Last Calls Act Dial the number typed in this field to block the last incoming phone call PSTN Setup Some emergency phone e g 911 or special phone cannot be dialed out by using VoIP and can be called out through PSTN line only To solve this problem this page allows you to set five sets of PSTN number for dialing without passing through Internet Please type the number in the field of phone number for PSTN relay VoIP gt PSTN Setup Default phone number for PSTN relay Enable phone number for PSTN relay E Po Po po Saas Then check the Enable box to make the PSTN number availabl
467. u have to contact your SMS provider to obtain the exact URL string Dray Te k 191 Vigor2830 Series User s Guide Username Type a user name that the sender can use to register to selected SMS provider Password Type a password that the sender can use to register to selected SMS provider Quota Type the total number of the messages that the router will send out Sending Interval Type the shortest time interval for the system to send SMS After finishing all the settings here please click OK to save the configuration Mail Service Object This page allows you to set ten profiles which will be applied in Application gt gt SMS Mail Alert Service Object Settings gt gt SMS Mail Service Object SMS Provider Mail Server Setto Factory Default Profile Name i i a 4 a 6 f a a 10 Each item is explained as follows Item Description Set to Factory Default Clear all of the settings and return to factory default settings Index Display the profile number that you can configure Profile Display the name for such mail server profile Vigor2830 Series User s Guide 192 Dr ay Te k To set a new profile please do the steps listed below 1 Click the Mail Server tab and click the number e g 1 under Index column for configuration in details Object Settings gt SMS Mail Service Object SMS Provider Mail Server Index Pre gt ie I ie a i a i 2 The configuration page will be shown
468. u re 218 a E116 eee ee eee eee 335 OM eA OO ia ate wan cerns ye ee aca nadie dene E E A E E ad A E 337 A AA E ea inacn se aessvenoce E E E 338 SAU Fe SWO e a E E E 340 Ol Pe OG It PAJE ECUN e EA 343 21 40 JO PING AMON BACKUP rieni a 344 SAIA OY bog Mal Alei asrnane eaa NaS O TrA aad iE EE EENE 346 oo WINS ANG O Oee aE EE 348 D ra y T e k ix Vigor2830 Series User s Guide A S INIVIE sess E E E E E E E E E 349 3 17 10 MANAQSIMCIM sisiavssccutuoneonsinscensneatamontinentalvaeseetinaanniiiededinabisdenen rineaubeniamedauaimenemniewsiteniens 351 3 17 11 Reboot Syste essnee i EEE a aeia aaeei 353 3 17 12 Firmware Upgrade cccccccssssscceeecceeeeeseeeeeeeeeseeeeesceeeeeeeeseeaaeeeeeeeessaaaseeeeesesessaaaasees 354 Di Ledge PNG IW UNO ere e E 5 lifectoarmasen ce E E E E 355 oTo DaO e ences aE E E E E R 357 3 18 1 Diakout IG IO eccrsessnstegecindotacneiy aea aa a eA EEr STRANE aii 357 Os 1e2 ROUNO TADIG osonro arrean aaae Ra aaraa ai 358 3 18 3 ARP Cache Table siriospannnnn danaa aaa aaa A EET Ea 359 3 18 4 IPv6 Neighbour Table cc cccecccccceeeessseseceeeeeeeeeesseeeeeeeesseeeaseeeeeesseaaaseeeeeeseseneagases 359 eV DHCP WONG e E 360 3 18 6 NAT SCSSIONS Table sirieias iaae ai aa a aeina iae 361 3 197 Ping Diagnosis wsaiinnencictracunsaiiesisckacananchuucaunialesantosdyedvacinisnaeininsbentehnseneniiueniuetcetrsusainnsauds 362 3 18 8 Data Flow IMOMMON siutsnostanenasanerndasytonsiaiseduusaienvessaivedunndussdeuniesisbsvess
469. ual value and will be offered solely at our discretion This warranty will not apply if the product is modified misused tampered with damaged by an act of God or subjected to abnormal working conditions The warranty does not cover the bundled or licensed software of other vendors Defects which do not significantly affect the usability of the product will not be covered by the warranty We reserve the right to revise the manual and online documentation and to make changes from time to time in the contents hereof without obligation to notify any person of such revision or changes Web registration is preferred You can register your Vigor router via http www DrayTek com Due to the continuous evolution of DrayTek technology all routers will be regularly upgraded Please consult the DrayTek web site for more information on newest firmware tools and documents http www DrayTek com iv Dray Tek European Community Declarations Manufacturer DrayTek Corp Address No 26 Fu Shing Road HuKou Township HsinChu Industrial Park Hsin Chu Taiwan 303 Product Vigor2830 Series Router DrayTek Corp declares that Vigor2830 Series of routers are in compliance with the following essential requirements and other relevant provisions of R amp TTE Directive 1999 5 EEC The product conforms to the requirements of Electro Magnetic Compatibility EMC Directive 2004 108 EC by complying with the requirements set forth in EN55022 Class B and E
470. ur ISP does not provide it the router will automatically apply default secondary DNS Server IP address 194 98 0 1 to this field The default DNS Server IP address can be found via Online Status System Status System Uptime 71 47 46 LAN Status Primary DNS 194 109 6 66 Secondary DNS 168 95 1 1 IP Address TX Packets RX Packets 192 168 1 1 347390 214004 If both the Primary IP and Secondary IP Address fields are left empty the router will use the DNS server assigned by ISP If not the router will assign its own IP address to local users as a DNS proxy server Force router to use address for DNS Force Vigor router to use DNS servers in this page instead of DNS servers given by the Internet Access server PPPoE PPTP L2TP or DHCP server After finishing all the settings here please click OK to save the configuration Vigor2830 Series User s Guide 108 Dr ay Tek Details Page for LAN1 IPv6 Setup There are two configuration pages for LAN1 Ethernet TCP IP and DHCP Setup based on IPv4 and IPv6 Setup Click the tab for each type and refer to the following explanations for detailed information Below shows the settings page for IPv6 LAN gt General Setup LAN 1 Ethernet TCP IP and DHCP Setup LAN 1 IPv6 Setup RADVD Configuration Enable Disable Advertisement Lifetime 1800 Seconds Range 600 9000 DHCP Server Configuration Enable Server Disable Server ONS Server IPv Address Static IPv6
471. ur Public IP Address from ISP In ADSL deployment the PPP Point to Point style authentication and authorization is required for bridging customer premises equipment CPE Point to Point Protocol over Ethernet PPPoE connects a network of hosts via an access device to a remote access concentrator or aggregation concentrator This implementation provides users with significant ease of use Meanwhile it provides access control billing and type of service according to user requirement When a router begins to connect to your ISP a serial of discovery process will occur to ask for a connection Then a session will be created Your user ID and password is authenticated via PAP or CHAP with RADIUS authentication system And your IP address DNS server and other related information will usually be assigned by your ISP Network Connection by 3G 4G USB Modem For 3G 4G mobile communication through Access Point is popular more and more Vigor2830 adds the function of 3G 4G network connection for such purpose By connecting 3G 4G USB Modem to the USB port of Vigor2830 it can support HSDPA UMTS EDGE GPRS GSM and the future 3G standard HSUPA etc Vigor2830n with 3G 4G USB Modem allows you to receive 3G signals at any place such as your car or certain location holding outdoor activity and share the bandwidth for using by more people Users can use four LAN ports on the router to access Internet Also they can access Internet via 802 11n wireless functi
472. uration By the way you can set up to 20 rules for one Class If you want to edit an existed rule please select the radio button of that one and click Edit to open the rule edit page for modification Bandwidth Management gt Quality of Service Class Index 1 Name Tag packets as AF Class High Drop Y NO Status Local Address Remote Address Desery Service Type CodePoint id Active Any Any ANY ANY A AF Classi Medium SNMP TRAPS 20 Active 192 168 1 96 1 2 16 3 228 Drop TCP UDP 162 Edit the Service Type for Class Rule 1 To add anew service type edit or delete an existed service type please click the Edit link under Service Type field Vigor2830 Series User s Guide 220 Dr ay Tek Dray Tek Bandwidth Management gt Quality of Service General Setup Setto Factory Default Index Status Bandwidth Direction tees lass less Others a AN 1 2 ss Control Statistics WANI Enable Kkbps Kkbps Outbound 25 25 25 25 Inactive Status Setup WA Enable 10000Kbps 10000Kbps Outbound 259 25 25 25 Inactive Status Setup WANS Disable 10000Kbps 10000Kbps 25 25 259 25 Inactive Status Setup Class Rule Index Mame Rule Service Type Class 1 Edit Class 2 Edit Edit Class 3 Edit After you click the Edit link you will see the following page Bandwidth Management gt gt Quality of Service User Defined Service Type No Name Protocol Port 1 Empty z For adding a new service type click Add to open the following page
473. urations Available settings are explained as follows Item Description Go to the VPN Click this radio button to access VPN and Remote Connection Access gt gt Connection Management for viewing VPN Management Connection status Do another VPN Click this radio button to set another profile of VPN Server Server Wizard Setup through VPN Server Wizard View more detailed Click this radio button to access VPN and Remote configuration Access gt gt LAN to LAN for viewing detailed configuration Dr ay Te k 49 Vigor2830 Series User s Guide 2 4 VPN Server Wizard Such wizard is used to configure VPN settings for VPN server Such wizard will guide to set the LAN to LAN profile for VPN dial in connection from client to server step by step 1 Open VPN and Remote Access gt gt VPN Server Wizard The following page will appear VPN Server Wizard Choose VPN Establishment Environment YPN Server Mode Selection site to Site YPN LAN to L4N Please choose a L4AN to LaW Profile 1 x 397 w Allowed Dial in Type PPTR IPsec L2TP with IPsec Policy SSL Tunnel Available settings are explained as follows Item Description VPN Server Mode Choose the direction for the VPN server Selection Site to Site VPN To set a LAN to LAN profile automatically please choose Site to Site VPN Remote Dial in User You can manage remote access by maintaining a table of remote user profile so that users can be authenticated to dial in v
474. v 5 Type your personal information in this page and then click Continue Register Create an account Please enter personal profile Fiek s marked by are required Account Information Gs UserName Mary Check Account 3 20 characters oo Password a a ee El CSRi 4 20 characters Do notset the same as the usetname Confirm Password PT yt Personal Information E Preterences First Name Mary Last Name Ted E completion Company Name Tech Ltd Email Address mary_ted tech corn F Please note thata valid E mail address is tequired to receive the Subseription Code You will need this code to activate your account Tel o i Country SWITZERLAND Career Supervisor vl 6 Choose proper selection for your computer and click Continue Create an account Please enter personal profile How did you find out about this website Internet v Gaareement What kind of anti virus do you use Antivir v would like to subscribe to the MyVigor e letter v Personal yeg Information would like to receive DrayTek product news Please select the mail server for receiving the Global Server YW Scompierion Vigor2830 Series User s Guide 424 Dr ay Te k 7 Now you have created an account successfully Click START Create an account Please enter personal profile Completion Gs reement A confirmation email has been sent to mary_ted tech com Pl
475. vice providers specify a specific MAC address for access authentication In such cases you need to click the Specify a MAC Address and enter the MAC address in the MAC Address field DNS Server IP Address Type in the primary IP address for the router if you want to use Static IP mode If necessary type in secondary IP address for necessity in the future After finishing all the settings here please click OK to activate them Details Page for PPTP L2TP in WAN2 To use PPTP L2TP as the accessing protocol of the internet please click the PPTP L2TP tab The following web page will be shown WAN gt gt Internet Access WAN 2 PPPoE Static or Dynamic IP PPTP L2TP IPvo OEnable PPTP Enable L2TP Disable PPP Setup Server Address Do O PPP Authentication PAP or CHAP Specify Gateway IP Address Idle Timeout seconds IP Address Assignment Method IPCP WAM IP Alias ISP Access Setup Fixed IP Yes No Dynamic IF Username Eh Fixed IP Address O Password O WAN IP Network Settings Index 1 15 in Schedule Setup Obtain an IP address automatically a I IL ILC Specify an IP address IP 4ddress MTU Max 1460 tatz Maki1480 Subnet Mask O Detailed explanation is shown below Item Description PPTP L2TP Enable PPTP Click this radio button to enable a PPTP Vigor2830 Series User s Guide 84 Dr ay Tek ISP Access Setup MTU PPP Setup IP Address Assignment Method IPCP Dray Tek client to e
476. view the content of the ARP Address Resolution Protocol cache held in the router The table shows a mapping between an Ethernet hardware address MAC Address and an IP address Diagnostics gt gt View ARP Cache Table Ethernet ARP Cache Table MAC Address 00 26 6C E4 6C 02 00 50 7F CF 46 D E0 CB 4E DaA 48 75 IP Address 172 16 3 166 192 168 1 1 192 168 11 10 Netbios Name CARRIE OCTCB251 Clear Refresh Interface WAN2 LANI LANI Available settings are explained as follows Item Clear Refresh Description Click it to clear the whole table Click it to reload the page 3 18 4 IPv6 Neighbour Table The table shows a mapping between an Ethernet hardware address MAC Address and an IPv6 address This information is helpful in diagnosing network problems such as IP address conflicts etc Click Diagnostics and click IPv6 Neighbour Table to open the web page Diagnostics gt gt View IPv Neighbour Table lFv6 Neighbour Table Refresh a TPv Address Mac Address Interface State a FFOA 2A 33 33 00 00 00 02 LAN CONNECTED lFRO 24 3 33 23 00 01 00 03 LAN CONNECTED PERD s SBSEUP7S 875110448 e d 87 87 69 2 LEN STALE FRO2 2 PRP5iraA445 33 33 f 51 a4 4b LAN CONNECTED FEZO 2504 7FPF FECS 1E79 d0 50 7 c9 1e 79 LAN STALE PREQS 250 7FFF FEC amp S 4305 g0 50 7f c8 43 05 LAN STALF FEGI DA 33 33 00 00 00 01 LAN CONNECTED FERUZI 00 00 00 00 00 00 UsSB2 CONNECTED PRQZF 1
477. w certificate will be issued to you by the CA server You can save it Dray Te k 271 Vigor2830 Series User s Guide 3 12 2 Trusted CA Certificate Trusted CA certificate lists three sets of trusted CA certificate Certificate Management gt gt Trusted CA Certificate X509 Trusted CA Certificate Configuration Name Subject Status Modify Trusted CA 1 Trusted CA 2 lew Delete Trusted CA 3 flew Delete IMPORT REFRESH To import a pre saved trusted CA certificate please click IMPORT to open the following window Use Browse to find out the saved text file Then click Import The one you imported will be listed on the Trusted CA Certificate window Then click Import to use the pre saved file Cerificate Management gt gt Trusted CA Certificate Import X509 Trusted CA Certificate Select a trusted CA certificate file es cc Click Import to upload the certification For viewing each trusted CA certificate click View to open the certificate detail information window If you want to delete a CA certificate choose the one and click Delete to remove all the certificate information Certificate Information Windows Internet Explorer eo Ed E http 192 108 1 1doc a iY il him Certificate Detail Information Certificate Name Trusted CA 1 Valid From Valid To Vigor2830 Series User s Guide 212 Dr ay Te k 3 12 3 Certificate Backup Local certificate and Trusted CA certif
478. ware file typing box Locate the files that you download from the company web sites You will find out two files with different extension names xxxx all keep the old custom settings and xxxx rst reset all the custom settings to default settings Choose any one of them that you need Firmware Upezade tility 3 5 1 Saks Time Guk Sec Router IP 192 1681 J Pork Firmware File C Documents and Settings Carrie m Password Vigor2830 Series User s Guide 414 Dr ay Te k 10 Click Send Firmware Upgrade Utility 3 5 1 Time OutiSec j Router IP 192 160 1 1 Fort Firmware File CABocuments and Settings Carrie al Password Sending 11 Now the firmware update is finished Using Web Page The web page also can guide you to upgrade firmware Note that this example is running over Windows OS Operating System 1 Download the newest firmware from DrayTek s web site or FTP site The DrayTek web site is www DrayTek com or local DrayTek s web site and FTP site is ftp DrayTek com 2 Click System Maintenance gt gt Firmware Upgrade System Maintenance gt gt Firmware Upgrade Web Firmware Upgrade Select a firmware file Ema REFR Click Upgrade to upload the file TFTP Firmware Upgrade from LAN Current Firmware Version 3 6 6 1 db RCL Firmware Upgrade Procedures Click OK to start the TFTP server Open the Firmware Upgrade Utility or other 3 party TFTP client software
479. we take the examples of choosing Remote Dial in User as the VPN Server Mode 51 Vigor2830 Series User s Guide When you check PPTP you will see the following graphic VPN Server Wizard VPN Authentication Setting Profile Mame rr PPTP LEeTP f LETP over IPsec 7 SSL Tunnel Authentication Username ere Password Peer IP VPN Client IP Site to Site Information Remote Network IP 0 0 0 Pemote Network Mask 255 255 255 0 When you check PPTP IPSec L2TP three types or PPTP IPSec two types or L2TP with Policy Nice to Have Must you will see the following graphic VPN and Remote Access gt gt VPN Server Wizard VPN Authentication Setting PPTP LETP L2TF over IPSec Authentication Username server IPSec LTP over IPSec Authentication C Digital Signature 509 Peer ID Peer IP YPH Client IP 192 168 1 99 ea er Vigor2830 Series User s Guide 52 Dr ay Te k Dray Tek When you check IPSec you will see the following graphic VPN and Remote Access gt gt VPN Server Wizard VPN Authentication Setting IPSec f L2TP over IPSec Authentication Pre Shared Key Confirm Pre Shared Key C Digital Signature 5095 Peer ID Peer IP YPN Client IP Peer ID Item Profile Name User Name Password Pre Shared Key Confirm Pre Shared Key Digital Signature X 509 Peer IP VPN Client IP Peer ID Remote Network IP Remote Network Mask Available settings are explain
480. web page and you can use the number that you have set in that web page WAN Connection Such function allows you to verify whether network Detection connection is alive or not through ARP Detect or Ping Detect Mode Choose ARP Detect or Ping Detect for the system to execute for WAN detection Ping IP If you choose Ping Detect as detection mode you have to type IP address in this field for pinging TTL Time to Live Displays value for your reference TTL value is set by telnet command After finishing all the settings here please click OK to save the configuration Details Page for 4G USB Modem DHCP in WAN3 To use 4G USB Modem DHCP mode as the accessing protocol of the internet please choose Internet Access from WAN menu Then select 4G USB Modem DHCP mode for WANS The following web page will be shown WAN gt Internet Access wa WAN 3 Modem Support List 46 USB Modem DHCP mode Enable Disable SIM PIN code f Network Mode Default 46 36 26 APN Name fe MTU Default 1390 LTE software version LTE hardware version as WAN Connection Detection Mode ARP Detect TTL Available settings are explained as follows Item Description 4G USB Modem DHCP Click Enable for activating this function If you click mode Disable this function will be closed and all the settings that you adjusted in this page will be invalid Vigor2830 Series User s Guide 88 Dr ay Tek SIM PIN code Net
481. wered off USB device is connected and ready for use The data is transmitting The profile s of CSM Content Security Management for IM P2P URL Web Content Filter application is enabled from Firewall gt gt General Setup Such profile must be established under CSM menu The Web Content Filter is active It is enabled from Firewall gt gt General Setup The router is ready to access Internet through DSL link Slowly The DSL connection is ready Quickly The connection is tranning The WAN2 connection is ready It will blink while transmitting data The DoS DDoS function is active It will blink while an attack is detected The VPN tunnel is active The QoS function is active The port is connected The port is disconnected The data is transmitting The port is connected with 1000Mbps The port is connected with 10 100Mbps when left LED is on The port is connected The port is disconnected The data is transmitting The port is connected with 1000Mbps The port is connected with 10 100Mbps when left LED is on Dray Tek r2830 Securi ty Firewall z 3 4 DSL Factory Re ON OFF PWR GigaLAN amp 1 WANG Giga USB Interface Description Factory Reset Restore the default settings Usage Turn on the router ACT LED is blinking Press the hole and keep for more than 5 seconds When you see the ACT LED begins to blink rapidly than usual release the button Then the router wi
482. work Mode APN Name MTU WAN Connection Detection Modem Support List Type PIN code of the SIM card that will be used to access Internet The maximum length of the PIN code you can set is 19 characters Force Vigor router to connect Internet with the mode specified here If you choose 4G 3G 2G as network mode the router will choose a suitable one according to the actual wireless signal automatically APN means Access Point Name which is provided and required by some ISPs Type the name and click Apply The maximum length of the name you can set is 47 characters It means Max Transmit Unit for packet The default setting is 1380 Such function allows you to verify whether network connection is alive or not through ARP Detect or Ping Detect Mode Choose ARP Detect or Ping Detect for the system to execute for WAN detection Ping IP If you choose Ping Detect as detection mode you have to type IP address in this field for pinging TTL Time to Live Displays value for your reference TTL value is set by telnet command It lists all of the modems supported by such router 4G Modem Support List Last updated on 2013 03 26 WIMAX Tested and is supported M Has not been tested but might be supported After finishing all the settings here please click OK to save the configuration Details Page for IPv6 Offline in WAN1 WAN2 WAN3 When Offline is selected the IPv6 connection will be disabled
483. xternal Service Authentication Log Pop Browser Tracking Window Authentication Description Firewall gt gt Edit Filter Set gt Edit Filter Rule Filter Set 1 Rule 2 Comments O O Index 1 15 in Schedule Setup Source IP Any Destination IP Any Service Type Any For the detailed configuration simply refer to Firewall gt gt Filter Rule The firewall filter rules that are not selected in Firewall gt gt General gt gt Default rule can be available for use in User Management gt gt User Profile The router will authenticate the dial in user by itself or by external service such as Radius server If Radius is selected here it is not necessary to configure the password setting above Mone Mone Time of login log out block unblock for the user s can be sent to and displayed in Syslog Please choose any one of the log items to take down relational records for the user s If such function is enabled a pop up window will be displayed on the screen with time remaining for connection if Idle Timeout is set However the system will update the time periodically to keep the connection always on Thus Idle Timeout will not interrupt the network connection Any user from LAN side or WLAN side tries to connect to Internet via Vigor router must be authenticated by the router first There are three ways offered by the router for the user to choose for authentication Web If it is select
484. y Lease Time Enter the time to determine how long the IP address assigned by DHCP server can be used Retrieve IPs from inactive clients periodically Whenever a DHCP client requests an IP address from the LAN DHCP server the server will give out an IP to this client for a certain amount of time e g 1 day However even if this client only uses the IP for say 5 minutes the server still reserves day for that client Because a DHCP server only has a limited number of IPs to lease to its DHCP clients soon enough all the IPs will be used out and then no one will be able to get any IPs from this server anymore Therefore this feature is used to get the IP back from inactive clients i e doesn t use the IP but the server still reserves the IP for him DNS Server DNS stands for Domain Name System Every Internet host Configuration must have a unique IP address also they may have a human friendly easy to remember name such as www yahoo com The DNS server converts the user friendly name into its equivalent IP address Primary IP Address You must specify a DNS server IP address here because your ISP should provide you with usually more than one DNS Server If your ISP does not provide it the router will automatically apply default DNS Server IP address 194 109 6 66 to this field Secondary IP Address You can specify secondary DNS server IP address here because your ISP often provides you more than one DNS Server If yo
485. y basic configuration settings will be available in User Mode and can be configured as same as in Admin Mode Vigor2830 Series User s Guide 342 Dr ay Te k 3 17 5 Login Page Greeting When you want to access into the web user interface of Vigor router the system will ask you to offer username and password first At that moment the background of the web page is blank and no heading will be displayed on the Login window This page allows you to specify background message and the heading on the Login window if you have such requirement System Maintenance gt gt Login Page Greeting Login Page Greeting C Enable Login Page Title Router Login 31 char max Welcome Message and Bulletin Max 511 characters Preview Setto Factory Default lt hi gt lt b gt lt font color red gt Welcome Message lt font gt lt b gt lt hi gt lt p gt This welcome message is displayed in the Login page of the router Replace this text with your own message lt p gt lt ol gt lt 1li gt The welcome message can be written in HTML so lists such as this one can be created lt 1i gt lt 1li gt Other markup tags such as p font or img can be used lt 1i gt lt ol gt Examples of Welcome Message and Bulletin lt hi gt lt b gt lt font color red gt Welcome Message lt font lt b gt lt h1 gt lt p gt Message lt p gt Available settings are explained as follows Item Description Enable Check this box to enable the login customization functio
486. you to obtain an IP address automatically and allows you type in IP address manually WAN IP Alias If you have multiple public IP addresses and would like to utilize them on the WAN interface please use WAN IP Alias You can set up to 8 public IP addresses other than the current one you are using o RRA MAES m 192 168 1 5idocAvipeliss him WANI IP Alias Multi NAT Index Enable Aux WAN IP Join NAT IP Pool ad E d d d d dl d Obtain an IP address automatically Click this button to obtain the IP address automatically if you want to use Dynamic IP mode Router Name Type in the router name provided by ISP Domain Name Type in the domain name that you have assigned DHCP Client Identifier for some ISP Enable Check the box to specify username and password as the DHCP client identifier for some 83 Vigor2830 Series User s Guide ISP Username Type a name as username The maximum length of the user name you can set is 63 characters Password Type a password The maximum length of the password you can set is 62 characters Specify an IP address Click this radio button to specify some data if you want to use Static IP mode IP Address Type the IP address Subnet Mask Type the subnet mask Gateway IP Address Type the gateway IP address Default MAC Address Click this radio button to use default MAC address for the router Specify a MAC Address Some Cable ser
487. yption key should be entered in WEP Key WEP 802 1x Only Accepts only WEP clients and the encryption key is obtained dynamically from RADIUS server with 802 1 X protocol WPA 802 1x Only Accepts only WPA clients and the encryption key is obtained dynamically from RADIUS server with 802 1X protocol WPA2 802 1x Only Accepts only WPA2 clients and the encryption key is obtained dynamically from RADIUS server with 802 1X protocol Mixed WPA WPA2 802 1x only Accepts WPA and WPA2 clients simultaneously and the encryption key is obtained dynamically from RADIUS server with 802 1X protocol WPA PSK Accepts only WPA clients and the encryption key should be entered in PSK WPA2 PSK Accepts only WPA2 clients and the encryption key should be entered in PSK Mixed WPA WPA2 PSK Accepts WPA and WPA2 clients simultaneously and the encryption key should be entered in PSK The WPA encrypts each frame transmitted from the radio using the key which either PSK Pre Shared Key entered manually in this field below or automatically negotiated via 802 1x authentication Either 8 63 ASCII characters such as 012345678 or 64 Hexadecimal digits leading by Ox such as 0x321253abcde Type Select from Mixed WPA WPA2 or WPA2 only Pre Shared Key PSK Either 8 63 ASCII characters such as 012345678 or 64 Hexadecimal digits leading by Ox such as 0x321253abcde 309 Dray Tek WEP 64 Bit For 64 bits WEP key either 5 ASC
488. yword list is the more efficiently the Vigor router performs gt Group Object Edit Windows Intemet Explorer http 192 168 1 1 docicfkw gob hin Object Group Edit Keyword Object None or Keyword Object None or Keyword Object None v or Keyword Object None or Keyword Object None or Keyword Object None or Keyword Object None v or Keyword Object None or Keyword Group None or Keyword Group None or Keyword Group None x or Keyword Group None or Keyword Group None v or Keyword Group None or Keyword Group None j or Keyword Group None wji Enable Restrict Web Feature Check this box to make the keyword being blocked or passed Action This setting is available only when Either URL Access Control First or Either Web Feature Firs is selected Pass allows accessing into the corresponding webpage with the keywords listed on the box below Pass Allow accessing into the corresponding webpage with the keywords listed on the box below Block Restrict accessing into the corresponding webpage with the keywords listed on the box below If the web pages do not match with the specified feature set here it will be processed with reverse action Cookie Check the box to filter out the cookie transmission from inside to outside world to protect the local user s privacy Proxy Check the box to reject any proxy transmission To control efficiently the limited ba

Download Pdf Manuals

Related Search

Related Contents

ISUSCORE2FS - ISU Judging System  InstrucSheet-Reef_NEW 3_PRINTERS SPREADS  アメージュZ シャワートイレ （床排水、リトイレ）  Trendnet TPL-402E    GBC 930-073 User's Manual  Zebra Printhead, 203dpi (t)  Milwaukee 9071-20 User's Manual  

Copyright © All rights reserved. Failed to retrieve file