Home

User Guide

1. Connection Status Disk Connected Disconnect USB Disk Write Protect Status No Disk Capacity 2009 MB USB Disk Users Connected Refresh Service IP Address Port Username FTP 192 168 1 10 1963 userl Now users in LAN of Vigor2710 can access into the USB storage device by typing ftp 192 168 1 1 on any browser They can add or remove files directories depending on the Access Rule for FTP account settings in USB Application gt gt USB User Management Vigor2860 Series User s Guide 448 Dr ay Te k 4 3 How to Build a LAN to LAN VPN Between Remote Office and Headquarter via IPsec Tunnel Main Mode IPSec Tunnel a 7 k ae Mt a ae a gt ai Manaa praal Internet Head Office Branch Office WAN 218 242 133 9 WAN 218 242 130 19 172 17 1 0 24 192 168 1 0 24 Configuration on Vigor Router for Head Office l 2 Dray Tek Log into the web user interface of Vigor router Open VPN and Remote Access gt gt LAN to LAN to create a LAN to LAN profile The following settings are for a permanent VPN connection VPN and Remote Access gt gt LAN to LAN LAN to LAN Profiles Setto Factory Default View All Trunk Index Name Active Status Index Name Active Status A x if x 2 x 16 x 2 x 19 x A x 20 x 5 x 21 x 6 x 22 x Click any index number to open the configuration page Type a name which is easy for identification for such profile in this case t
2. Note If you want to use email alert or syslog please configure the SysLoq Mail Alert Setup page If you change the service provider the configuration of the function will be reset 3 20 Diagnostics Dray Tek Diagnostic Tools provide a useful way to view or diagnose the status of your Vigor router Below shows the menu items for Diagnostics Diagnostics 419 Vigor2860 Series User s Guide 3 20 1 Dial out Triggering Click Diagnostics and click Dial out Triggering to open the web page The internet connection e g PPPoE is triggered by a package sending from the source IP address Diagnostics gt Dial out Triggering Dial out Triggered Packet Header Refresh HEX Format 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Decoded Format 0 0 0 0 gt 0 0 0 0 Pr 0 len 0 0 Available settings are explained as follows Item Description Decoded Format It shows the source IP address local destination IP remote address the protocol and length of the package Refresh Click it to reload the page Vigor2860 Series User s Guide 420 Dr ay Tek 3 20 2 Routing Table Click Diagnostics and click Routing Table to open the web page Diagnostics gt gt View Routing
3. Browser Mozilla Firefox File Edit View History Bookmarks Tools Help Mozilla Firefox Start Page 3 Browser Browser 3 Browser chrome dnssd content browser htm Dr ay Tek 265 Vigor2860 Series User s Guide 2 Open the web browse Firefox If Bonjour and DNSSD have been installed you can open the web page DNSSD and see the following results Google chrome dnssd content browser html e DNSSD for Firefox Browser Configuration Options Diagnostic Information Interface Name Type Domain Service Info 2 D51010Plus _http _tcp local Select a service on the left to view further details 2 DS1010Plus WebDAy _http _tcp local 2 HP LaserJet 1300 _ipp _tcp local 2 tctseng virtual machine ty _udisks ssh _tcp local 2 tctseng virtual machine 00 0c 29 76 be 24 _workstation _tcp local 2 tomkao desktop 00 0c 29 26 09 5d _workstation _tcp local 3 Open System Maintenance gt gt Management Type a name e g Dray_2925 as the Router Name and click OK System Maintenance gt gt Management IPv4 Management Setup IPv6 Management Setup Router Name Vigor Router Management Port Setup User Define Ports Default Ports Management Access Control Telnet Port Default Allow management from the Internet HTTP Port an Default FTP Server HTTPS Port Default HTTP Server FTP Port Default HTTPS Server Telnet Server 23H Port Default SSH Server Dis
4. Click this button to let multicast packets pass through the router Block This is default setting Click this button to let multicast packets be blocked by the router User Name This field is applicable when you select PPTP or L2TP with or without IPsec policy above The length of the name is limited to 23 characters Password This field is applicable when you select PPTP or L2TP with or without IPsec policy above The length of the password is limited to 19 characters Enable Mobile One Time Passwords mOTP Check this box to make the authentication with mOTP function PIN Code Type the code for authentication e g 1234 Secret Use the 32 digit secret number generated by mOTP in the mobile phone e g e759bb6f0e94c7ab4fe6 Chose one of the subnet selections for such VPN profile Assign Static IP Address Please type a static IP address for the subnet you specified This group of fields is applicable for IPsec Tunnels and L2TP with IPsec Policy when you specify the IP address of the remote node The only exception is Digital Signature X 509 can be set when you select IPsec tunnel either with or without specify the IP address of the remote node 276 Dray Tek IPsec Security Method Pre Shared Key Check the box of Pre Shared Key to invoke this function and type in the required characters 1 63 as the pre shared key Digital Signature X 509 Check the box of Digital Signature to in
5. Default Charset At present Vigor router supports four types of character sets Default Charset is for English based file name English English Chinesefsimple Chinese Traditional German Click Enable to invoke samba service via the router LAN Only Users coming from internet cannot connect to the samba server of the router LAN And WAN Both LAN and WAN users can access samba server of the router For the NetBios service of USB storage disk you have to specify a workgroup name and a host name A workgroup name must not be the same as the host name The workgroup name can have as many as 15 characters and the host name can have as many as 23 characters Both them cannot contain any of the following lt gt Workgroup Name Type a name for the workgroup Host Name Type the host name for the router After finishing all the settings here please click OK to save the configuration 3 18 2 USB User Management This page allows you to set profiles for FTP Samba users Any user who wants to access into the USB storage disk must type the same username and password configured in this page Before adding or modifying settings in this page please insert a USB storage disk first Otherwise an error message will appear to warn you Dray Tek USB User Management Index Username Pe et eS a USB Application gt USB User Management Setto Factory Default Home Folder Index Userna
6. L2TP with IPsec Policy VJ Compression On Off Server IP Host Name for VPN IKE Authentication Method such as draytek com or 123 45 67 89 Pre Shared Key Digital Signature x 509 Peer ID Local ID Alternative Subject Name First Subject Name First IPsec Security Method Medium AH High EsP 3DES with Authentication Index 1 15 in Schedule Setup 5 Continue to navigate to the TCP IP Network Settings for setting the LAN IP for the remote side 4 Gre over IPsec Settings C Enable IPsec Dial Out function GRE over IPsec C Logical Traffic My GRE IP ES Peer GRE IP fo 5 TCP IP Network Settings My WAN IP RIP Direction Remote Gateway IP pigs first subnet to remote network you have to Remote Network IP Remote Network Mask 255 255 255 0 Local Network IP 19 1681 9 L Change default route to this VPN tunnel Only single WAN supports this Local Network Mask 255 255 255 0 6 Click OK to save the settings Vigor2860 Series User s Guide 452 Dr ay Te k 7 Open VPN and Remote Access gt gt Connection Management to check the dial in connection status from head office VPN and Remote Access gt gt Connection Management Dial out Tool Refresh Seconds V2920 172 16 2 145 v VPN Connection Status Current Page 1 Page Nol 69 Tx Tx Rate Rx Rx Rate VPN Type Remote IP Virtual Network Pkts Bps Pkts Bps UpTime cee Ea a 21a eda ia al A yal pe g 3 de 36 O 6 4
7. Obtain an IP address automatically gt La iz Specify an IP address Available settings are explained as follows Item Description PPTP L2TP Enable PPTP Click this radio button to enable a PPTP client to establish a tunnel to a DSL modem on the WAN interface Enable L2TP Click this radio button to enable a L2TP client to establish a tunnel to a DSL modem on the WAN interface Disable Click this radio button to close the connection through PPTP or L2TP Server Address Specify the IP address of the PPTP L2TP server if you enable PPTP L2TP client mode Specify Gateway IP Address Specify the gateway IP address for DHCP server ISP Access Setup Username Type in the username provided by ISP in this field The maximum length of the user name you can set is 63 characters Password Type in the password provided by ISP in this field The maximum length of the password you can set is 62 characters Index 1 15 in Schedule Setup You can type in four sets Dray Te k 101 Vigor2860 Series User s Guide of time schedule for your request All the schedules can be set previously in Application gt gt Schedule web page and you can use the number that you have set in that web page MTU It means Max Transmit Unit for packet The default setting is 1492 PPP Setup PPP Authentication Select PAP only or PAP or CHAP for PPP Idle Timeout Set the timeout for breaking down the Internet after passing th
8. ee ee e E les ln I E e N S ga User 77 P Active ee ee eR N ee mN ek d Set to Factory Default Status Index User Active Status gt 47 777 O 18 O s 19 d 20 777 O 21 2 LI ss 22 d n 73 777 d m 24 777 F 25 777 Fi e 26 777 d 27 d 28 d gt 29 777 O 30 77 C 31 777 d 32 C s5 Note User Accounts need to be added into User Group to enable SSL Portal Login Available settings are explained as follows Item Set to Factory Default Index User Active Status Vigor2860 Series User s Guide Description Click to clear all indexes Click the number below Index to access into the setting page of Remote Dial in User Display the username for the specific dial in user of the LAN to LAN profile The symbol represents that the profile is empty Check the box to activate such profile Display the access state of the specific dial in user The symbol V and X represent the specific dial in user to be active and inactive respectively 274 Dray Tek Click each index to edit one remote user profile Each Dial In Type requires you to fill the different corresponding fields on the right If the fields gray out it means you may leave it untouched The following explanation wi
9. 11 DrayTek LAN A AP 00 1d aa 76 20 44 Mixed 99 100 Jan 01 00 50 26 11 James_900 AP 00 1d aa 9c f0 20 WPA 89 100 Jan 01 00 50 26 2 Later some options will appear on the bottom of the page 6 DrayTek AP OO 1d aa 9c f7 38 Mixed 78 100 Jan 01 00 50 26 AF s MAC Address loo ta sfaa a8 be bo AF s SSID O Add to Friendly APs Rogue APs Delete from Rogue APs Friendly APs Note NI Green Friendly APs Red Rogue APs Black Unknown APs mY Ey i L y U E Vigor2860 doesn t apply any security policies to Rogue AP List ox Available settings are explained as follows Item Description AP s MAC Address The MAC address of the selected AP will be displayed here automatically AP s SSID The SSID of the selected AP will be displayed here automatically Add to Friendly APs If the selected AP shall be treated as Friendly AP simply click Add to change its classification from Dray Te k 325 Vigor2860 Series User s Guide Delete From unknown to Friendly Rogue APs If the selected AP shall be treated as rogue AP simply click Add to change its classification from unknown to Rogue Rogue APs If you want to change the classification of the rogue AP simply choose the one and click Delete Later the page will refresh and the one will be classified as Unknown Friendly APs If you want to change the classification of the friendly AP simply choose the one and click Delete
10. Cluse the same SSID and Security Key as above Name DrayTek2ob0 SGmarketing Mode Mixed l1lat linj Channel Channel 60 5300MHz Security Key Note The hast AP configured here will be used for home or internal company use Available settings are explained as follows Item Description Wireless 2 4GHz Settings Name Type the SSID name of this router for wireless 2 4GHz The default name is defined with DrayTek Change the name if required Mode At present the router can connect to 11n Only 11g Only Mixed 11b 11g Mixed 1la 11n Mixed 11g 11n and Mixed 11b 11g 11n stations simultaneously Simply choose Mix 11b 11g 11n mode Dr ay Tek 63 Vigor2860 Series User s Guide Channel Security Key Use the same SSID and Security Key as above Mixed 11b 11g 11n 11g Only 11n Only 2 4 GHz Mixed 11b 11q Mixed 11g 11n Mixed 11b 11g 41n Means the channel of frequency of the wireless LAN The default channel is 6 You may switch channel if the selected channel is under serious interference If you have no idea of choosing the frequency please select Auto to let system determine for you The wireless mode offered by this wizard is WPA2 PSK The WPA encrypts each frame transmitted from the radio using the key which either PSK Pre Shared Key entered manually in this field below or automatically negotiated via 802 1x authentication Either 8 63 ASCII characters such as 0123456
11. Connection Type PPP ha Note IPv4 WAN setting should be PPPoE client Below shows an example for successful IPv6 connection based on PPP mode Vigor2860 Series User s Guide 106 Dr ay Tek Online Status Physical Connection System Uptime 0 2 327 IPv4 IPvG LAN Status IP Address 2001 B8010 7300 201 210 44FF FE46 2568 64 Global FESO 210 44FF FE46 2568 64 Link TX Packets RX Packets TX Bytes RX Bytes tg 4 690 328 WAN IPv6 Status gt gt Drop PPP Enable Mode Up Time YES PPF 00208 IP Gateway IP 2001 8010 7300 201 210 44FF FE46 2564 128 Global FE80 90 1400 242 4D52 FESO 10 A4FF FE46 2564 1298 Link DNS IP 2001 E000 168 1 2001 6000 165 12 TX Packets RX Packets TX Bytes RX Bytes F g 54 4 itg Note At present the IPv6 prefix can be acquired via the PPPOE mode connection which is available for the areas such as Taiwan hinet the Netherlands Australia and UK Details Page for IPv6 TSPC in WAN1 WAN2 WAN3 WAN4 Tunnel setup protocol client TSPC is an application which could help you to connect to IPv6 network easily Please make sure your IPv4 WAN connection is OK and apply one free account from hexago http gogonet gogo6 com page freenet6 account before you try to use TSPC for network connection TSPC would connect to tunnel broker and requests a tunnel according to the specifications inside the configuration file It gets a public IPv6 IP address and an IPv6 prefix from t
12. Display an online statistics for quality of service for your reference This feature is available only when the Quality of Service for WAN interface is enabled Bandwidth Management gt gt Quality of Service WAN Online Statistics Refresh Inte rval 5 wt seconds Refresh Index Direction Class Name Reserved bandwidth Ratio Outbound Throughput Bytes sec 1 OUT VoIP TER E zZ OUT 20 a 3 OUT 25 o 4 OUT 255 o a OUT Others 20 a Outbound Status VoIP Other General Setup for WAN Interface When you click Setup you can configure the bandwidth ratio for QoS of the WAN interface There are four queues allowed for QoS control The first three Class 1 to Class 3 class rules can be adjusted for your necessity Yet the last one is reserved for the packets which are not suitable for the user defined class rules Dr ay Te k 239 Vigor2860 Series User s Guide Bandwidth Management gt Quality of Service WAN General Setup Enable the QoS Control WAN Inbound Bandwidth WAN Outbound Bandwidth Okbps Mbps Okbps Mbps Index Class Name Reserved bandwidth Ratio Class 1 VoIP 25 Class IPT Class 3 Data Emaill Others Limited_bandwidth Ratio w C Enable UDP Bandwidth Control C Outbound TCP ACK Prioritize Note 1 Before enable QoS you should test the real bandwidth first QoS may not work properly if the bandwidth is not accurate 2 ou can do speed test by http speedtest net or contact with your I
13. Dray Tek 277 Vigor2860 Series User s Guide VPN and Remote Access gt gt LAN to LAN wo LAN to LAN Profiles Setto Factory Default Status Index Name Status 17 777 ela E e R Ele eie mn Pere ep m S o a o S o S S S o S S S S S ma e e S a a S a S S S S a a N S axa Ths Dial out profile has already joined for YPN Load Balance Mechanism haaa Ths Dial out profile has already joined for VPN Backup Mechanism haaa This Dial out profile does not join for YPN TRUNE The following shows profiles joined into VPN Load Balance and VPN Backup mechanism VPN and Remote Access gt gt LAN to LAN LAN to LAN Profiles View All Name Activate Members Status Loadbalant W WPHN 2 Offline Connection Offline XXXXXX This Dial out profile has already joined for VPN Load Balance Mechanism XSXXXXX This Dial out profile has already joined for VPN Backup Mechanism If there is no profile joined yet this page will be shown as follows VPN and Remote Access gt gt LAN to LAN LAN to LAN Profiles View Al amp Trunk Name Activate Members Status XRRRXAA THIS Dial out profile has already joined for VPN Load Balance Mechanism XXX This Dial out profile has already joined for VPN Backup Mechanism Vigor2860 Series User s Guide 278 Dr ay Te k Available settings are explained as follows Item Description View All Click it to display the LAN to LAN profiles Trunk Click it to
14. Enable 3 J oO Orection LARRY 2 Wine w 5 El Sure iP Any Edit i J LI ra timate EP Any Edit semite TF TCPAUDP Port from 137 129 te any Em Fragments Doni Care oK Clear Cancel Applicadoen 4ctloniProflle Syslog Filter Page Immediately w o Branch te Other Filter Sef Sessions Control o arnon i MAC Bind IP hon rict LJ Quality of Servlee None aa Load Balamce policy Auto Select w o Uyar Monagenayi Nore L ABP Enforcement Nene oa C URL Content Filter None o Wolk Cambil Filter Mome LI Advance Setting Ea OK Clear Cancel Vigor2860 Series User s Guide 180 Dr ay Te k 3 5 4 DoS Defense As a sub functionality of IP Filter Firewall there are 15 types of detect defense function in the DoS Defense setup The DoS Defense functionality is disabled for default Click Firewall and click DoS Defense to open the setup page Firewall gt gt DoS defense Setup DoS defense Setup C Enable DoS Defense Select All Enable SYN flood defense Block IP options Black Land Block Smurf Block trace route Block SYN fragment Block Fraggle Attack Threshold packets sec Timeout Sec Enable UDP flood defense Threshald packets sec Timeout Sec Enable ICMP flood defense Threshold packets sec Timeout SEC Enable Port Scan detection Threshold a00 packets sec Black TCP flag scan Block Tear Drop Block Ping of Death Block ICMP fragment Block Unassigned Numbers
15. IPv Neighbour Table Refresh IPv6 Address Mac Address Interface IFFO 2 33 33 00 00 00 02 LAN IFFOZ 1 3 33 33 00 01 00 03 LAN FE6O0 3D5E E74 8751 A4468 ef Gd 87 87 69 2 LAN IFFO2 1 FF51 A44B8 33 33 f 51 a4 4b LAN FE80 250 7FFF FEC9 18E79 0 50 T cS le T9 LAN FE 80 250 7FFF FEC8 4205 08 50 7 c 43 05 LAN FFOQS ssi 3 23 00 00 00 01 LAN FFO2Z 1 00 00 00 00 00 00 USB2 FF02 1 2 00 00 00 00 00 00 USB2 FE80 9D5C CA86 5428 3CAT 00 26 2d fe 63 4 LAN FFO2Z 1 FFOA 673C 33 33 f f Oa 67 S3e LAN lt LU gt Available settings are explained as follows Item Description Vigor2860 Series User s Guide 422 Dr ay Te k Refresh Click it to reload the page 3 20 5 DHCP Table The facility provides information on IP address assignments This information is helpful in diagnosing network problems such as IP address conflicts etc Click Diagnostics and click DHCP Table to open the web page Diagnostics gt gt View DHCP Assigned IP Addresses DHCP IP Assignment Table DHCPYv6 IP Assignment Table Refresh 192 166 1 1 255 255 255 0 DHCP server Off and Diagnostics gt View DHCP Assigned IP Addresses DHEP IP Assignment Table DHEPv6 IP Assignment Table Refresh DHCPv6 server binding client Index IPv6 Address MAC Address Available settings are explained as follows Item Description Index It displays the connection item number IP Address It displays the IP
16. Item Description Name Display the application name of the profile that you create Host Address Display the IP address for VNC RDP or SAMBA path Service Display the type of the service selected e g VNC RDP SAMBA Active Display current status active or inactive of the selected profile To create a new SSL application profile 1 Click number link under Index filed to set detailed configuration SSL VPN gt gt SSL Application SSL Applications Profiles Index Name Ho e Tee i 2 The following page will appear Vigor2860 Series User s Guide 376 Dr ay Te k Dray Tek SSL VPN gt gt SSL Application Profile Index 1 LJ Enable Application Service Application Name Application IP Address Port Idle Timeout Scaling Virtual Network Computing VNC v Please Select Virtual Network Computing VNC Remote Desktop Protocol ROP Samba Application Be Seeorna Available settings are explained as follows Item Enable Application Server Application Name Application IP Address Port Idle Timeout Scaling Screen Size Samba Path Description Check the box to enable such profile Type a name for such application The length of the name is limited to 23 characters There are three types offered for you to create an application profile Please Select Please Select Virtual Network Computing VNC Remote Desktop Protocol RDP Samba Applic
17. Note The incoming calls by means of IP dialing 2 9 4192 168 1 1 4 should be blocked Dray Te k 337 Vigor2860 Series User s Guide Regional This page allows you to process incoming or outgoing phone calls by regional Default values common used in most areas will be shown on this web page You can change the number based on the region that the router is placed VoIP gt gt DialPlan Setup Enable Regional Last Call Return Miss Last Call Return In Call Forward All Act Call Forward Busy Act Do Not Disturb Act Hide caller ID Act Call Waiting Act Block Anonymous Act Block Unknow Domain Act Block IP Calls Act Block Last Calls Act i Setto Factory Default Last Call Return Out Call Forward Deact Call Forward No 4ns Act number Do Not Disturb Deact Hide caller ID Deact TE Call Waiting Deact Black Anonymous Deact Block Unknow Domain Deact r Paz a Block IP Calls Deact Available settings are explained as follows Item Enable Regional Last Call Return Miss Last Call Return In Last Call Return Out Call Forward All Act Call Forward Deact Call Forward Busy Act Call Forward No Vigor2860 Series User s Guide Description Check this box to enable this function Sometimes people might miss some phone calls Please dial number t
18. Physical Type Auto negotiation VLAN Tag insertion Available settings are explained as follows Item Description Display Name Type a name for the router VLAN Tag insertion The settings configured in this field are available for WAN1 and WAN2 Enable Enable the function of VLAN with tag The router will add specific VLAN number to all packets on the WAN while sending them out Please type the tag value and specify the priority for the packets sending by WANI1 Disable Disable the function of VLAN with tag Tag value Type the value as the VLAN ID number The range is form 0 to 4095 Priority Type the packet priority number for such VLAN The range is from 0 to 7 On the next page as shown below please select the appropriate Internet access type according to the information from your ISP For example you should select PPPoE mode if the ISP provides you PPPoE interface Then click Next for next step Dr ay Tek 37 Vigor2860 Series User s Guide PPPoE 1 Choose WAN2 as the WAN Interface and click the Next button The following page will be open for you to specify Internet Access Type Quick Start Wizard Connect to Internet WAN 2 Select one of the following Internet Access types provided by your ISP PPPoE PPTP L2TP Static IP DHCP 2 Click PPPoE as the Internet Access Type Then click Next to continue Quick Start Wizard PPPoE Client Mode WAN 2 Enter the user name and pa
19. The data is transmitting The router is ready to access Internet through DSL link Slowly The DSL connection is ready Quickly The connection is training Wireless access point with bandwidth of 5GHz is ready It will blink slowly while wireless traffic goes through ACT and WLAN LEDs blink quickly and simultaneously when WPS is working and will return to normal condition after two minutes You need to setup WPS within 2 minutes A PSTN phone call comes in and out However when the phone call is disconnected the LED will be off There is no PSTN phone call The phone connected to this port is off hook The phone connected to this port is on hook A phone call comes The port is connected The port is disconnected The data is transmitting The port is connected with 1000Mbps The port is connected with 10 100Mbps The port is connected The port is disconnected The data is transmitting The port is connected with 1000Mbps 9 Vigor2860 Series User s Guide The port is connected with 10 100Mbps PWR E ON A Interface Wireless LAN ON OFF WPS Factory Reset USB VDSL2 ADSL WAN Giga GigaLAN 1 6 Phone 1 2 Line PWR Vigor2860 Series User s Guide Description Press Wireless LAN ON OFF WPS button once to wait for client device making network connection through WPS Press Wireless LAN ON OFF WPS button twice to enable WLAN LED on or disable WLAN LED off wire
20. To set the IP address manually please choose Any Address Single Address Range Address Subnet Address as the Address Type and type them in this dialog In addition if you want to use the IP range from defined groups or objects please choose Group and Objects as the Address Type Group and Objects Any Address single Address Range Address subnet Address Group and Objects From the IP Group drop down list choose the one that you want to apply Or use the IP Object drop down list to choose the object that you want Click Edit to access into the following dialog to choose a suitable service type 175 Vigor2860 Series User s Guide Fragments Filter Vigor2860 Series User s Guide Service Type Edit Windows Internet Explorer itp 192 168 1 1 Service Type Edit Service Type User defined Protocol TCP UDP v Source Port W 137 A139 Destination Port 1 65535 Service Group or Service Object or Service Object or Service Object oa To set the service type manually please choose User defined as the Service Type and type them in this dialog In addition if you want to use the service type from defined groups or objects please choose Group and Objects as the Service Type User defined Ls er d efi E d Group and Objects Protocol Specify the protocol s which this filter rule will apply to Source Destination Port wh
21. Type in the primary IP address for the router Second DNS Type in secondary IP address for necessity in the future PPTP Server L2TP Type the IP address of the server Server Back Click it to return to previous setting page Next Click it to get into the next setting page Cancel Click it to give up the quick start wizard 3 Please type in the IP address mask gateway information originally provided by your ISP Then click Next for viewing summary of such connection Quick Start Wizard Please confirm your settings WAN Interface WAN Physical Mode Ethernet Physical Type Auto negotiation Internet Access PPTP Click Back to modify changes if necessary Otherwise click Finish to save the current settings and restart the Vigor router 4 Click Finish A page of Quick Start Wizard Setup OK will appear Then the system status of this protocol will be shown Quick Start Wizard Setup OR 5 Now you can enjoy surfing on the Internet Dr ay Tek 41 Vigor2860 Series User s Guide Static IP 1 Choose WAN2 as the WAN Interface and click the Next button The following page will be open for you to specify Internet Access Type Quick Start Wizard Connect to Internet WAN 2 Select one of the following Internet Access types provided by your ISP PPPoE PPTP L2TP Static IP DHCP 2 Click Static IP as the Internet Access type Simply click Next to continue Quick Start Wizard Static IP Clie
22. URI Description Hardware Version Software Version Modem Firmware Version Close c E lees VigorIPPBX 2820 00507F7E1DB0 PQC PBX i DrayTek 00507F Vigor 00507F7E1DB0 PERL 220 132 97 49 8069 cwm CRN html DrayTek Vigor Router i 222 3 5 9 _RC2a 211011_A Annex_A Any device CPE which follows the standard of TR 069 can be configured and can be detected by Vigor2860 series automatically Only eight remote devices can be managed by Vigor2860 at one time Therefore other remote devices detected by Vigor2860 series might be displayed in such field Add Move the selected device from Unmanaged Devices List to Managed Devices List IP Address Display the IP address of the remote device Mac Address Display the MAC address of the remote device 308 Dray Tek Refresh Device Model Display the model name of the remote device Description Name Define the name or type the additional description of CPE for identification in VPN management and CPE management Location Type the location address of the CPE to be displayed by Google Map Click it to refresh current web page 3 13 2 2 CPE Maintenance This area displays all the profiles which are created for applying to the managed device This page can help the administrator to do maintenance jobs like firmware upgrade configuration backup configuration restoration and etc CWM gt CPE Management
23. Vigor2860 Series User s Guide Central AP Management gt Rogue AP Detection Rogue AP Detection Enable M All APs P a a 2 aD 2 2 9 9 7a 2 2a Note EA James_AP amp 800 DrayTek LAN B DrayTek LAN A James_900 burce2464 burce24G3 burce24G2 burce24G1 Wesley_crash_test3 Wesley_crash_test2 Wesley_crash_test1 Wesley_crash_test DrayTek E Neighbor AP Detection V Local WLAN Detection Refresh Min s 1 Refresh 50 7f cc 08 Mixed 1d aa 74 20 4 Mixed tid aa 76 20 4 Mixed tid aa 9c fO0 WPA tid aa 9c f7 20 NONE tid aa 9c f7 20 NONE 2 1id aa 9c f7 20 NONE tid aa 9c f7 20 WPA2PSK aa bO be 38 NONE aa bO be 38 NONE taa bO be 38 NONE j aa bO be 38 NONE id aa 9c f7 38 Mixed Green Friendly APs SN Red Rogue APs gt Black Unknown APs b ol Vigor2860 doesn t apply any security policies to Rogue AP List Available settings are explained as follows Item Enable AIL APS All APS Unknown AFS 7 Rogue APS i 1 Friendly AFS F Refresh Min s Refresh Ch SSID Vigor2860 Series User s Guide Description Neighbor AP Detection The access point s registered to Vigor2860 will be used to detect other access points and send the scanned results to Vigor2860 Later the scanned result will be displayed on this page Local WLAN Detection The router will detect all the access points through wireless LA
24. Wireless LAN 2 4GHz gt Security Settings SID1 SSID 2 SID3 5104 Mode WEP 802 1x Only WPA Encryption Mode TKIP for WPA AES for WPA Pre Shared Key PSK Type 8 63 ASCII character or 64 Hexadecimal digits leading by Ox for example cigsOlaz2 or Ox655abecd WEP Encryption Mode 64 Bit Key 1 Key 2 Key 3 Key 4 Note Please configure the RADIUS Server if 802 1 is used For 64 bit WEP key configurations please insert 5 ASCII characters or 10 Hexadecimal digits leading by Ox Examples are AB312 or Ox41423331532 For 128 bit WEP key configurations please insert 13 ASCII characters or 26 Hexadecimal digits leading by Ox Available settings are explained as follows Item Description Mode There are several modes provided for you to choose Dray Tek 357 Vigor2860 Series User s Guide WPA WEP Vigor2860 Series User s Guide Disable wt Note You should also set RADIUS Server simultaneously if 802 1x mode is selected Disable Turn off the encryption mechanism WEP lt Accepts only WEP clients and the encryption key should be entered in WEP Key WEP 802 1x Only Accepts only WEP clients and the encryption key is obtained dynamically from RADIUS server with 802 1X protocol WPA 802 1x Only Accepts only WPA clients and the encryption key is obtained dynamically from RADIUS server with 802 1X protocol WPA2 802 1x Only Accepts only WPA2 clients and the encryp
25. gt J j Note gt 1 AP with the same SSID and security 1 is the same entry Traffic Limit 50M Traffic Limit 50M in scan list Central AP Management gt gt Load Balance Enable Mode By Station Number Overload Detected By Maximum Statian Number 3 64 By Traffic Upload Limit 256K v bos Default unit K Download Limit bps Default unit K Force Overload Disassociation Available settings are explained as follows Item Description Enable Check the box to enable such function Mode It is used to determine the operation mode when the system detects overload between access points By Station Number The operation of load balance will be executed based on the station number configured in this page It is used to limit the allowed number for the station connecting to the access point The purpose is to prevent lots of stations connecting to access point at the same time and causing traffic unbalanced By Traffic The operation of load balance will executed according to the traffic configuration in this page Dray Te k 327 Vigor2860 Series User s Guide Upload Limit Use the drop down list to specify the traffic limit for uploading Download Limit Use the drop down list to specify the traffic limit for downloading Force Overload By Idle Time When the access point is overload e g Disassociation reaching the limit of station number or limit of network tra
26. 6 Click the Default Rule tab Choose the profile just configured from the drop down list in the field of URL Content Filter Now users cannot open any web page with the word facebook inside Firewall gt gt General Setup General Setup General Setup Default Rule Actions for default rule Application Filter Sessions Control Quality of Service Load Balance policy User Management Advance Setting Action Profile Syslog Pass M o 60000 None Auto Select None w PE SE Ase 2S B Disallow users to play games on Facebook 1 Open Object Settings gt gt Keyword Object Click an index number to open the setting page 2 In the field of Contents please type apps facebook Configure the settings as the following figure Objects Setting gt gt Keyword Object Setup Profile Index 2 Name Contents Dray Tek facebook apps Limit of Contents Max 3 Words and 63 Characters Each word should be separated by a single space You can replace a character with HEX Example Contents backdoo 72 virus keep 200ut Result 1 backdoor 2 virus 3 keep out 493 Vigor2860 Series User s Guide 3 Open CSM gt gt URL Content Filter Profile Click an index number to open the setting page 4 Configure the settings as the following figure CSM gt URL Content Filter Profile Profile Index 2 Profile Name Priority Either URL Access Control First Log None
27. Display the name of VPN TRUNK VPN Load Balance mechanism profile Member Display the dial out profile selected from the Member drop down list below Active Yes means normal condition No means the state might be disabled or that profile currently is set with Dial in mode for call direction in LAN to LAN Type Display the connection type for that profile such as IPsec PPTP L2TP L2TP over IPsec NICE L2TP over IPsec MUST and so on Memberz2 Display the dial out profile selected from the Member2 drop down list below Advanced This button is only available when there is one or more profiles created in this page Vigor2860 Series User s Guide 290 Dr ay Tek Dray Tek General Setup FPN Load Balance Advance Settings Windows Internet Explorer a a l hitp 192 168 1 1 VPN Load Balance Advance Settings Profile Name Loadbalan1 Load Balance Algorithm Round Robin Weighted Round Robin Auto Weighted Se According to Speed Ratio Member1 Member2 50 50 VPN Load Balance Policy Edit O Insert after Tunnel Bind Table Index 1 64 Active Active v Binding Dial Out Profile 20 i Src IP Start 0 0 0 0 End 255 255 255 255 Dest IP Start 0 0 0 0 End 255 255 255 255 Dest Port Start End Protocol ANY Detail Information VPN Load Balance Profile name Loadbalani A Algorithm Round Robin Detailed information for this dialog see la
28. E se Your reliable networking solutions partner User s Guide V2 51 Vigor2860 Series VDSL2 Security Firewall User s Guide Version 2 51 Firmware Version V3 7 4 1 For future update please visit DrayTek web site Date August 15 2014 Vigor2860 Series User s Guide ii Dr ay Te k Copyright Information Copyright Declarations Trademarks Copyright 2014 All rights reserved This publication contains information that is protected by copyright No part may be reproduced transmitted transcribed stored in a retrieval system or translated into any language without written permission from the copyright holders The following trademarks are used in this document Microsoft is a registered trademark of Microsoft Corp Windows Windows 95 98 Me NT 2000 XP Vista and Explorer are trademarks of Microsoft Corp Apple and Mac OS are registered trademarks of Apple Inc Other products may be trademarks or registered trademarks of their respective manufacturers Safety Instructions and Approval Safety Instructions Warranty Be a Registered Owner Firmware amp Tools Updates Dray Tek Read the installation guide thoroughly before you set up the router The router is a complicated electronic unit that may be repaired only be authorized and qualified personnel Do not try to open or repair the router yourself Do not place the router in a damp or humid place e g a bathroom
29. Index 1 15 in Schedule Setup WAN Connection Detection Such value is used to initialize USB modem Please use the default value If you have any question please contact to your ISP The maximum length of the string you can set is 47 characters APN means Access Point Name which is provided and required by some ISPs Type the name and click Apply The maximum length of the name you can set is 43 characters The initial string is shared with APN In some cases user may need another initial AT command to restrict 3G band or do any special settings The maximum length of the string you can set 1s 47 characters Such value is used to dial through USB mode Please use the default value If you have any question please contact to your ISP The maximum length of the string you can set is 31 characters Type the PPP username optional The maximum length of the name you can set is 63 characters Type the PPP password optional The maximum length of the password you can set is 62 characters Select PAP only or PAP or CHAP for PPP You can type in four sets of time schedule for your request All the schedules can be set previously in Application gt gt Schedule web page and you can use the number that you have set in that web page Such function allows you to verify whether network connection is alive or not through ARP Detect or Ping Detect Mode Choose ARP Detect or Ping Detect for the system to execut
30. hello message to peers Yet it is valid only when the peer also supports this function After finishing all the settings here please click OK to save the configuration Dray Te k 365 Vigor2860 Series User s Guide 3 16 7 Advanced Setting This page allows users to set advanced settings such as operation mode channel bandwidth guard interval and aggregation MSDU for wireless data transmission Wireless LAN 2 4GHz gt Advanced Setting HT Physical Mode Operation Mode Channel Bandwidth Guard Interval Aggregation MSDU A MSDU Long Preamble Packet OVERDRIVE Tx Burst or Mixed Mode Green Field 20 20 40 long auto Disable Enable Disable Enable Disable Enable Wireless LAN SGHz gt Advanced Setting Physical Mode Operation Mode Channel Bandwidth Guard Interval Aggregation MSDU A MSDU Mixed Mode Green Field 20 20 40 long auto Disable Enable Available settings are explained as follows Item Operation Mode Channel Bandwidth Guard Interval Vigor2860 Series User s Guide Description Mixed Mode the router can transmit data with the ways supported in both 802 1 1a b g and 802 11n standards However the entire wireless transmission will be slowed down if 802 11g or 802 11b wireless client is connected Green Field to get the highest throughput please choose such mode Such mode can make the data transmission
31. lao ee ee e oe USB Disk Status SB Disk Connected File Explorer Note f you want to use CPE Maintenance feature you ll have to plug in a USB Disk 6 Click Now to perform the firmware upgrade immediately for Vigor2850 7 Wait for several minutes for firmware upgrade Dray Te k 505 Vigor2860 Series User s Guide 8 Then check the device information for the managed device if the firmware upgrade is successful or not Click Managed Devices List Managed Devices List CPE Maintenance Google Map Refresh Managed Devices List Kate local 192 168 30 12 Unmanaged Devices List IP Address Mac Address Device Model Description Name Location 9 Click the icon of Vigor2850 and click Edit and view the software version Another way to check if the firmware upgrade is completed or not simply open Central VPN Management gt gt Log amp Alert Vigor2860 Series User s Guide 506 Dray Tek 4 17 How to setup Load Balance for Packets The following figure shows a simple application of load balance WAN1 and WAN2 can be used to access into Internet The PC in LANI can send the data to the remote PC through the specified WANI z Remote PC 203 65 1 955 Remote PC 139 75 244 8 Any IP address NAT 1 Access into web user interface of Vigor2860 series Open Load Balance Route Policy WAN OLAN Load Balance Route Policy EIA T EErEE Firewall User Management 2 From the
32. s Guide 246 Dr ay Te k Available settings are explained as follows Item Description Enable Dynamic Check this box to enable DDNS function DNS Setup Set to Factory Clear all profiles and recover to factory settings Default View Log Display DDNS log status Force Update Force the router updates its information to DDNS server Auto Update Set the time for the router to perform auto update for DDNS interval Service Index Click the number below Index to access into the setting page of DDNS setup to set account s WAN Interface Display the WAN interface used Domain Name Display the domain name that you set on the setting page of DDNS setup Active Display if this account is active or inactive 3 Select Index number 1 to add an account for the router Check Enable Dynamic DNS Account and choose correct Service Provider dyndns org type the registered hostname hostname and domain name suffix dyndns org in the Domain Name block The following two blocks should be typed your account Login Name test and Password test Applications gt Dynamic DNS Setup gt Dynamic DONS Account Setup Index 1 Enable Dynamic DNS Account WAN Interface WAN First Service Provider dyndns org www dyndns org Service Type Domain Name chronic6653 Jayndns org dyndns org v Login Name max 64 characters Password max 23 characters O Wildcards C Backup Mx Mail Extender Determine Real WAN IP Wiese Clea
33. 1 URL Access Control Enable URL Access Control Prevent web access from IP address Action Group Object Selections 2 Web Feature Enable Restrict Web Feature Action L cookie Proxy LJUpload File Extension Profile 5 When you finished the above steps please open Firewall gt gt General Setup 6 Click the Default Rule tab Choose the profile just configured from the drop down list in the field of URL Content Filter Now users cannot open any web page with the word facebook inside Firewall gt gt General Setup General Setup General Setup Default Rule Actions for default rule Application Action Profile Syslog Filter oO sessions Control of Quality of Service Load Balance policy User Management APP Enforcement URL Content Filter v Web Content Filter m o N ds Advance Setting Vigor2860 Series User s Guide 494 Dr ay Te k 4 13 How to use AP Management function in Vigor2860 to check AP status and deploy WLAN profile The administrator can manage the access points linked to Vigor2860 1 Open External Devices gt gt Access Point Devices Vigor2860 will detect the AP connecting to the router automatically and display as below External Device gt Access Point Devices Status WLAN Profile Note Green Online Red Offline Grey Hidden SSID Maximum support 20 APs In this case a device named with APSO0_00507F6EE4980 has been detected by Vigor router 2
34. 51D 1 VLAN Q SSID 2 VLANO a3 Logistics Dr ay Tek 531 Vigor2860 Series User s Guide Port based mode VLAN Confiquration Enable L afalolniniaiaga Se aS a Gl a G e Tag based mode Pienatte LAN Wireless LAN WLAN Tag Pi PZ P3 Pa S5301 SSID SSID SSM Sia bared VID Priority To deploy a guest network which serves your guests the internet accessibility but the traffics have to be isolated from your private network due to the security considerations it can be done by above settings However a switch support VLAN function is need 1f VLAN Tag enabled Triple Play Multi WAN NAT mode with VLAN Vigor2860 Series User s Guide 532 Dray Tek Following settings the set top box STB is able to attach with any LAN port Video streaming which your ISP provided will be played on your monitor l Setup the VLAN ID on WAN 1 profiles if nema WAN is the primary interface of IPTV service Physical Mode Ethernet Phyncal Type Aan regen linn Lire Speedi bee Downlink i Enable Yer Uiplani i active Modo Abways On Load Balance 4 General Channel Enable WAN Type VLAN Taq Port based Bridge 1 Yas Ethemet Wal None Yes Ethemet WAN2 Hore 2 Ho Ethemet WAN 1 Horie Enable lPi Pa ipa ip 2 Open the profile of WANS by clicking the ID 4 No Ethernet WAN1 Hane Enable Cpi lee ipal ip BEWANG Ho Ethernet WAN1 Hone Enable py pa ipa ip 5 4 ANG Ha Ethemet WwaAN
35. Available settings are explained as follows Dray Tek Item Enable Dos Defense Select All Enable SYN flood defense Enable UDP flood defense Description Check the box to activate the DoS Defense Functionality Click this button to select all the items listed below Check the box to activate the SYN flood defense function Once detecting the Threshold of the TCP SYN packets from the Internet has exceeded the defined value the Vigor router will start to randomly discard the subsequent TCP SYN packets for a period defined in Timeout The goal for this is prevent the TCP SYN packets attempt to exhaust the limited resource of Vigor router By default the threshold and timeout values are set to 2000 packets per second and 10 seconds respectively That means when 2000 packets per second received they will be regarded as attack event and the session will be paused for 10 seconds Check the box to activate the UDP flood defense function Once detecting the Threshold of the UDP packets from the Internet has exceeded the defined value the Vigor router will start to randomly discard the subsequent UDP packets for a period defined in Timeout 181 Vigor2860 Series User s Guide Enable ICMP flood defense Enable PortScan detection Block IP options Block Land Block Smurf Block trace router Block SYN fragment Block Fraggle Attack Vigor2860 Series User s Guide The default setting for threshold and tim
36. Clear Gateway 2 Gateway 3 Gateway 4 Or Diagnostics gt gt Ping Diagnosis Ping Diagnosis OPV4 IPV6 PingIPv6 Address o O Run Result Clear Available settings are explained as follows Item Description IPV4 IPV6 Choose the interface for such function Ping through Use the drop down list to choose the WAN interface that you want to ping through or choose Unspecified to be determined by the router automatically Ping to Use the drop down list to choose the destination that you want to ping IP Address Type the IP address of the Host IP that you want to ping Ping IPv6 Address Type the IPv6 address that you want to ping Dr ay Tek 425 Vigor2860 Series User s Guide Run Click this button to start the ping work The result will be displayed on the screen Clear Click this link to remove the result on the window 3 20 8 Data Flow Monitor This page displays the running procedure for the IP address monitored and refreshes the data in an interval of several seconds The IP address listed here is configured in Bandwidth Management You have to enable IP bandwidth limit and IP session limit before invoke Data Flow Monitor If not a notification dialog box will appear to remind you enabling it Bandwidth Management gt Sessions Limit Sessions Limit Default Max Sessions Limitation List Index Start IP End IF Click Diagnostics and click Data Flow Monitor to open the web page You can click
37. Click the WLAN Profile tab to get the following page Check the box of the default profile to make the Edit button being available Then click the Edit button External Device gt gt Access Point Devices Status WLAN Profile Set to Factory Default Profile Name Main SSID Multi SSID WLAN ACL Rate Control Default DrayTek LAN A WPA WPA2 PSE Enable None None Appy To Device _ 3 When the following configuration page appears make the changes you want and check Apply to All APs Then click Next to access into the next page External Device gt gt Access Point Devices WLAN Profile Edit Device Settings Profile Name Z Apply to aaps pO Administrator Password a ee 2nd Subnet 2 46 WLAN General Settings 2 4G Mode Mixedf11b 11g tin 2 46 Channel 246 2hHz Channel 11 s WMM O Enable Disable 5G WLAN General Settings 5G Mode Mixed liatiin Dray Tek 495 Vigor2860 Series User s Guide Note Apply to All APs can automatically apply the settings on Default profile to all of the access points registered to Vigor2860 later Hence it is not necessary for you to manually apply wireless profiles for APs respectively Such feature will be convenient for people who want to quickly deploy multiple Vigor APs in a large exhibition to reach the goal of plug and play and zero configuration 4 The following page allows you to modify related settings for 2 4G SSID of managed AP Make the cha
38. Content Security Management provides users control and management in IM Instant Messenger and P2P Peer to Peer more efficiency than before By the way DoS DDoS prevention and URL Web content filter strengthen the security outside and control inside Object based firewall is flexible and allows your network be safe User Management implemented on your router firmware can allow you to prevent any computer from accessing your Internet connection without a username or password You can also allocate time budgets to your employees within office network With the 6 port Gigabit switch on the LAN side provides extremely high speed connectivity for the highest speed local data transfer of any server or local PCs The tagged VLANs IEEE802 1Q can mark data with a VLAN identifier This identifier can be carried through an onward Ethernet switch to specific ports The specific VLAN clients can also pick up this identifier as it is just passed to the LAN You can set the priorities for LAN side QoS You can assign each of VLANs to each of the different IP subnets that the router may also be operating to provide even more isolation The said functionality is tag based Multi subnet Multiple Private LAN Subnets On the Wireless equipped models Vigor2860n n plus Vn Vn plus each of the wireless SSIDs can also be grouped within one of the VLANs In addition Vigor2860 series supports USB interface for connecting USB printer to share printing function or
39. Disable this function will be closed and all the settings that you adjusted in this page will be invalid Modem Setting for It is not necessary to configure settings in these fields for ADSL only modem settings are prepared for ADSL only WAN Connection Such function allows you to verify whether network Detection connection is alive or not through ARP Detect or Ping Detect Mode Choose ARP Detect or Ping Detect for the system to execute for WAN detection Ping IP If you choose Ping Detect as detection mode you have to type IP address in this field for pinging Dr ay Te k 87 Vigor2860 Series User s Guide TTL Time to Live Displays value for your reference TTL value is set by telnet command MTU It means Max Transmit Unit for packet The default setting is 1500 RIP Protocol Routing Information Protocol is abbreviated as RIP RFC1058 specifying how routers exchange routing tables information Click Enable RIP for activating this function Bridge Mode If you choose Bridged IP as the protocol you can check this box to invoke the function The router will work as a bridge modem WAN IP Network This group allows you to obtain an IP address automatically Settings and allows you type in IP address manually WAN IP Alias If you have multiple public IP addresses and would like to utilize them on the WAN interface please use WAN IP Alias You can set up to 8 public IP addresses other than the current one you
40. Enter the Class Name of Index 3 In this index he will set reserved bandwidth for 1 VPN tunnel Internet VPN Tunnel Private Network Cooperate Network 192 168 1 0 192 168 2 0 Click Edit for Class 3 to open a new window In this index the user will set reserved bandwidth for VPN Bandwidth Management gt gt Quality of Service Class Index 3 DiffServ sat Status Local Address Remote Address CodePoint Service Type Empty B 461 Vigor2860 Series User s Guide 11 Click Add to open the following window Check the ACT box first Bandwidth Management gt Quality of Service Rule Edit Ethernet Type 1Pv4 OC IPv6 Local Address Any Edit Remote Address Any Edit DiffServ CodePoint Service Type Note Please choose setup the Service Type first 12 Then click Edit of Local Address to set a worker s subnet address Click Edit of Remote Address to set headquarter s IP address Leave other fields and click OK Bandwidth Management gt Quality of Service Rule Edit ACT Ethernet Type IPv4 O IPv6 Local Address Remote Address 19 168 70 DiffServ CodePoint ANY ka Service Type Predefined hd Note Please choose setup the Service Type first Vigor2860 Series User s Guide 462 Dr ay Te k 4 6 How to Implement the LDAP AD Authentication for User Management For simplifying the configuration of LDAP authentication for User Access Management we implement Group
41. Item Description Set to Factory Default Clear all profiles Profile Display the number of the profile which allows you to click to set different policy Name Display the name of the URL Content Filter Profile Administration Message You can type the message manually for your necessity Default Message You can type the message manually for your necessity or click this button to get the default message which will be displayed on the field of Administration Message You can set eight profiles as URL content filter Simply click the index number under Profile to open the following web page Dr ay Tek 223 Vigor2860 Series User s Guide CSM gt gt URL Content Filter Profile Profile Index 1 Priority Both Pass Log 1 URL Access Control Cl Enable URL Access Control CL Prevent web access from IP address Action Group Object Selections E 2 Web Feature C Enable Restrict Web Feature Action Cookie U Proxy Upload File Extension Profile Clear Cancel Available settings are explained as follows Item Description Profile Name Type a name for the CSM profile The maximum length of the name you can set is 15 characters Priority It determines the action that this router will apply Both Pass The router will let all the packages that match with the conditions specified in URL Access Control and Web Feature below passing through When you choose this setting both configuration set in this page
42. LIsername acs Polling Interval Seconds Note 1 To enable the CVM feature one of the Port MUST be Enabled Available settings are explained as follows Item Description CVM Port Check the box to enable the port setting Type the port number in the box CVM SSL Port Check the box to enable the port setting Type the port number in the box WAN IP for Remote For Vigor router can managed only the client from WAN Connection interface therefore you have to specify which interface will be used for such function If you choose MANUALLY you have to specify WAN IP address WANT iw WAN MANUALLY _ HT wu Username Type a username which will be used by any CPE tried to connect to Vigor router Password Type the password for the user Polling Interval Type the time value unit is second The range is from 60 86400 After finishing all the settings here please click OK to save the configuration Dray Te k 305 Vigor2860 Series User s Guide 3 13 1 2 IPsec VPN Settings Central VPN management is operated through IPsec VPN connection CWM gt General Setup General Settings IPsec VPN Settings IPsec Mode Aggressive mode Security Method ESP s Encryption Type AES aw Local Subnet ooo 5 y O Hote To enable the CWM feature one of the Port MUST be Enabled Available settings are explained as follows Item Description IPsec Mode Choose Aggressive or Main as the IPsec Mode Security Method Cho
43. Later the page will refresh and the one will be classified as Unknown 3 Click OK to save the settings The following figure shows the APs classified and displayed in different colors Rogue AP Detection Enable v All APs aD k eo aD Ex Ea 2 K a Note Neighbor AP Detection EA James_AP amp OO DrayTek LAN B DrayTek LAN A James_900 burce2 464 burce24G3 burce24G62 burce2461 Wesley_crash_test3 Wesley_crash_test2 Wesley_crash_testl Wesley_crash_test DrayTek c Local WLAN Detection Refresh Min s 1 Refresh 0 50 7f cc 08 Mixed 2 1id aa 74 20 44 Mixed id aa 76 20 Mixed tid aa 9e fO z WPA tid aa 9c f7 2 NONE tid aa 9c f NONE 2 1d aa 9c f7 20 NONE tid aa 9c f7 20 WPA2PSK aa bO0 bc 38 NONE aa bO be 38 NONE taa bO be 38 NONE aa bO be 38 NONE id aa 9c f7 38 Mixed Green Friendly APs css Red Rogue APs Black Unknown APs b j TALL Ly Vigor2860 Series User s Guide 32 DrayTek 3 14 6 Load Balance The parameters configured for Load Balance can help to distribute the traffic for all of the access points registered to Vigor router Thus the bandwidth will not be occupied by certain access points AP Load Balance Traffic overload Traffic 50Mbps Traffic 30Mbps Traffic overload aw 86 olm Traffic Limit 50M Traffic Limit 50M Traffic 50Mbps r Traffic 30Mbps Traffic overload D D
44. Lease Time 259200 s Subnet Mask 255 255 255 0 C Use LAN Port Pi po Use MAC Address RIP Protocol Control the same subnet given IP Address mac address HH 1K 1 Available settings are explained as follows Dray Tek Item Network Configuration DHCP Server Configuration Description Enable Disable Click Enable to enable such configuration click Disable to disable such configuration For Routing Usage IP Address Type in private IP address for connecting to a local private network Default 192 168 1 1 Subnet Mask Type in an address code that determines the size of the network Default 255 255 255 0 24 RIP Protocol Control Disable deactivate the RIP protocol It will lead to a stoppage of the exchange of routing information between routers Default Enable activate the RIP protocol DHCP stands for Dynamic Host Configuration Protocol The router by factory default acts a DHCP server for your network so it automatically dispatch related IP settings to any local user configured as a DHCP client It is highly 131 Vigor2860 Series User s Guide recommended that you leave the router enabled as a DHCP server if you do not have a DHCP server for your network If you want to use another DHCP server in the network other than the Vigor Router s you can let Relay Agent help you to redirect the DHCP request to the specified location Start IP Address Enter a value of the IP ad
45. Muliti VLAN General VLAN Settings VLAN Members s senace Binding amp WAM Setup L Dray Tek 529 Vigor2860 Series User s Guide LAN Enable Port hased VLAN by checking the option The option of Tae Aesad VLAN VLAN Configuration Subnet VLAN ID assigned DHCP Pool will be used 802 1p field VLAN applications on Vigor router Multi Subnet VLAN of LAN SSID 1 VLAN 0 3D 2 VLANI Sales Dept SSID 3 VLANZ2 D D Vigor2860 Series User s Guide 530 Dr ay Te k Port based mode Enable LAH Wireless LAH Pi Pe Pi P4 SSID1 SSID 55103 5104 Subnet Enable Tag based mode Enable LAN Wireless LAH Pi PF P3 Pa SSID SSID SSIDD SSID4 Subnet Vue FOO A vant By above settings there are four private networks will be created and computers attached with each of LAN ports or SSIDs which are able to obtain a private IP address from each DHCP servers LAN 1 LAN2 LAN3 LAN4 However the traffics of the LAN port or SSID that are NOT being grouped in the same VLAN are unable to forward to each other The benefit of Port based is able to extend the wired ports by installing a cheaper dumb switch as many as you need but Tag based offers you a flexible and well managed network The networks are isolated secured and reduce the broadcasting storm effectively in each of networks with VLAN Guest Network
46. Name HTTPS C Tag packets as Default iffSe NO Status Local Address Remote Address DiffServ Service Type CodePoint a z 172 10 1 242 2 1 Active 17 16 1 2749 Any ANY ANY 7 Click Setup link for WAN2 Bandwidth Management gt gt Quality of Service General Setup Setto Factory Default F Class Class Class Por Index Status Bandwidth Direction 1 5 3 Others Bandwidth ene Control WANT Enable Kbps Kbps Both 25 25 Inactive Status Setup WAH Disable 100000Kbps 100000Kbps 25 25 Inactive Status WARNS Disable 1O0000Kbps 100000Kbps 25 25 Inactive Status WAN Disable 1O0000Kbps 100000Kbps 25 25 Inactive Status Class Rule Index Service Type Class 1 Class 2 i Edit Class 3 i Enable the First Priority for VoIP SIP RTP SIP UDP Port S5060 Default 5060 Vigor2860 Series User s Guide wo DrayTek Dray Tek 8 9 10 Check Enable UDP Bandwidth Control on the bottom to prevent enormous UDP traffic influent other application Click OK Bandwidth Management gt Quality of Service WAN General Setup Enable the QoS Control WAN Inbound Bandwidth 100000 Kbps WAN Outbound Bandwidth 100000 Kbps Class Name Reserved bandwidth Ratio E mail 25 le HTTPS 25 lee 25 h Others GTA Limited_bandwidth Ratio o If the worker has connected to the headquarter using host to host VPN tunnel Please refer to Chapter 3 VPN for detail instruction he may set up an index for it
47. Open VPN and Remote Access gt gt VPN Server Wizard The following page will appear VPN Server Wizard Choose VPN Establishment Environment VPN Server Mode Selection Remote Dial in User Teleworker Please choose a L4N to L4N Profile Please choose a Dial in User Accounts Allowed Dial in Type PPTR IPsec L2TP with IPsec Policy SSL Tunnel Available settings are explained as follows Item Description VPN Server Mode Choose the direction for the VPN server Selection Site to Site VPN To set a LAN to LAN profile automatically please choose Site to Site VPN Remote Dial in User You can manage remote access by maintaining a table of remote user profile so that users can be authenticated to dial in via VPN connection Site to Site VPN LANto LAN E Site to Site YPN LAN to LAN Remote Dial in User Teleworker Please choose a This item is available when you choose Site to Site VPN LAN to LAN Profile LAN to LAN as VPN server mode There are 32 VPN profiles for users to set Vigor2860 Series User s Guide 58 Dr ay Tek Index Status Hane a 1 faa F 2 E TPY 4 E Tr 5 E Pay Bi Tr 7 E Tr E E fates J E Tr 10 E Tr 11 Tr 12 E Tr 13 raters 14 E Tr 15 E Tr 16 Tr 1 E ater 18 fates 14 Tr 20 E TP 21 faa 22 Tr 23 Tr 24 E Tr 25 fae 26 fates B 2T E Tr 20 fas 29 E PrF k Please choose a This item is available w
48. Please choose the edition you need Free trial edition Finish Cancel Service Activation Wizard Select the service type that you want to activate Please choose the item you want to use WCF service Web Content Filter Commtouch License Agreement Commtouch is the web content filter based on Commtouch operated in the worldwide Enter your License key fo Activation Date 2013 03 22 select Web Content Filter fragFINN License Agreement Enter your License key O O Activation Date 2013 02 18 select CII have read and accept the above Agreement Please check this box Note The activation date is brought out by the server automatically and cannot be changed Dr ay Tek 5 Vigor2860 Series User s Guide 2 3 VPN Client Wizard Such wizard is used to configure VPN settings for VPN client Such wizard will guide to set the LAN to LAN profile for VPN dial out connection from server to client step by step 1 Open VPN and Remote Access gt gt VPN Client Wizard The following page will appear VPN and Remote Access gt gt VPN Client Wizard Choose VPN Establishment Environment LAN to LAN VPN Client Mode Selection Route Mode Please choose a LAN to LAWN Profile Note For a typical LAN to LAN tunnel please select Route Mode If the remote network is expecting only a single client or ip and is not configured to route the subnet and then select NAT
49. Remote Network IP 172 16 3 56 Remote Network Mask 255 255 255 0 Click Back to modify changes if necessary Otherwise click Finish to save the current settings and proceed to the following action Goto the VPN Connection Management Do another VPN Server Wizard setup View more detailed configurations Available settings are explained as follows Item Description Go to the VPN Click this radio button to access VPN and Remote Connection Access gt gt Connection Management for viewing VPN Management Connection status Do another VPN Click this radio button to set another profile of VPN Server Server Wizard Setup through VPN Server Wizard View more detailed Click this radio button to access VPN and Remote configuration Access gt gt LAN to LAN for viewing detailed configuration Vigor2860 Series User s Guide 62 Dr ay Tek 2 5 Wireless Wizard The wireless wizard allows you to configure settings specified for a host AP for home use or internal use for a company and specified for a guest AP for any wireless clients accessing into Internet Follow the steps listed below 1 Open Wireless Wizard 2 The screen of wireless wizard will be shown as follows This page will be used for internal users in a company or your home Wireless Wizard Host AP Configuration Wireless 2 4GHz Settings Name ob0 marketing Mode Mixed 1q 11n Channel Channeld 244 MHz Security Key Wireless 5GHz Settings
50. The router should be used in a sheltered area within a temperature range of 5 to 40 Celsius Do not expose the router to direct sunlight or other heat sources The housing and electronic components may be damaged by direct sunlight or heat sources Do not deploy the cable for LAN connection outdoor to prevent electronic shock hazards Keep the package out of reach of children When you want to dispose of the router please follow local regulations on conservation of the environment We warrant to the original end user purchaser that the router will be free from any defects in workmanship or materials for a period of two 2 years from the date of purchase from the dealer Please keep your purchase receipt in a safe place as it serves as proof of date of purchase During the warranty period and upon proof of purchase should the product have indications of failure due to faulty workmanship and or materials we will at our discretion repair or replace the defective products or components without charge for either parts or labor to whatever extent we deem necessary tore store the product to proper operating condition Any replacement will consist of a new or re manufactured functionally equivalent product of equal value and will be offered solely at our discretion This warranty will not apply if the product is modified misused tampered with damaged by an act of God or subjected to abnormal working conditions The w
51. To set the user profile please click any index number link to open the following page Notice that profile 1 admin and profile 2 Dial In User are factory default settings Profile 2 is reserved for future use User Management User Profile Profile Index 3 Enable this account User Name Password O Confirm Password O Idle Timeout min s O Unlimited Max User Login 0 Unlimited External Server Authentication Pop Browser Tracking Window Authentication Web Alert Tool Telnet Landing Page C Ind xf1 15 in Schedule Setup z C Enable Time Quota 0 min L Jo min O Enable Data Quota 0 MB Jo me Reset quota to default when scheduling time expired L Enable Default Time Quota min Default Data Quota b me Dr ay Tek 187 Vigor2860 Series User s Guide Available settings are explained as follows Item Description Enable this account Check this box to enable such user profile User Name Type a name for such user profile e g LAN_User_Group_l WLAN_User_Group_A WLAN_User_Group_B etc When a user tries to access Internet through this router an authentication step must be performed first The user has to type the User Name specified here to pass the authentication When the user passes the authentication he she can access Internet via this router However the accessing operation will be restricted with the conditions configured in this user profile The maximum length of the name you can set is 24 chara
52. Vigor router provides a facility DMZ Host that maps ALL unsolicited data on any protocol to a single host in the LAN Regular web surfing and other such Internet activities from other clients will continue to work without inappropriate interruption DMZ Host allows a defined internal user to be totally exposed to the Internet which usually helps some special applications such as Netmeeting or Internet Games etc Destined to Internet 220 135 240 207 Protocol Any Port Any The security properties of NAT are somewhat bypassed if you set up DMZ host We suggest you to add additional filter rules or a secondary firewall Click DMZ Host to open the following page You can set different DMZ host for each WAN interface Click the WAN tab to switch into the configuration page for that WAN NAT gt gt DMZ Host Setup DMZ Host Setup WANt WAN2 WAN3 WANA WAN 1 Private IP CoO Choose IP MAC Address of the True IP DMZ Host bo oo oo koo po Note When a True IP DMZ host is turned on it will force the router s WAN connection to be always on Available settings are explained as follows Vigor2860 Series User s Guide 158 Dr ay Te k Item Description WAN 1 Choose Private IP or Active True IP first Active True IP selection is available for WAN only Private IP Active True IP h Private IP Enter the private IP address of the DMZ host or click Choose PC to select one Choose PC Click this button and the
53. WAN 1 PPPoE PPPoA MPOoOA Static or Dynatnic IP Pv Enable Disable WAN IP Network Settings AN IP Alias Obtain an IP address automaticalh Modem Settings for ADSL only Gri a y gt Router Name igor Mult PVe channel Channel 2 a Encapsulation pice ate Ae SS Se gt gt Required for some SPs 1483 Bndged IF LLE SEHEMU DHCP Client Identifier for some ISP wee O Enable vel 88 Username Modulation Multinode w Paseword Spec IP addre WAN Connection Detection sige ne amet eT TET IP ress 211100 Mode ARP Detect Subnet Mask 155 755 255 0 Ping IP TTL Gateway IP Address MTU 1497 Max 1500 Default MAC Address Specify a MAC Address RIP Protocol MAC Address 00 AD AA Hss 7 51 Click the WAN IP Alias button to configure the other P address which is 202 211 100 111 Make sure Join IP NAT Pool is not checked Click OK to save the settings WAN1 IP Alias Multi NAT Index Enable Aux WAN IP Join NAT IP Pool as 02 211 100 10 02 211 100 11 C 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 i L L LI LI LI Dr ay Tek 483 Vigor2860 Series User s Guide 4 After finished configuration for WAN1 open Load Balance Route Policy Load Balance Route Policy Policy Route Set to Factory Default Index Enable Protocol Interface terface SreIP SrcIP DestIP DestIP port port Move Move Start End 1 d any WAN1 Down 2
54. WEP and Pre shared Key The setting you choose here will make the following WEP or Pre shared key field valid or not Choose one of the types for the router WEP Check this box to use the same key set in Security Settings page If you did not set any key in Security Settings page this check box will be dimmed Pre shared Key Type There are some types for you to choose WPA and WPA2 are used for WDS devices e g 2920n wireless router you can set the encryption mode as WPA or WPA2 to establish your WDS system between AP and the router Key Type 8 63 ASCII characters or 64 hexadecimal digits leading by 0x Bridge If you choose Bridge as the connecting mode please type in the peer MAC address in these fields Four peer MAC addresses are allowed to be entered in this page at one time Yet please disable the unused link to get better performance If you want to invoke the peer MAC address remember to check Enable box in the front of the MAC address after typing Repeater If you choose Repeater as the connecting mode please type in the peer MAC address in these fields Four peer MAC addresses are allowed to be entered in this page at one time Similarly if you want to invoke the peer MAC address remember to check Enable box in the front of the MAC address after typing Access Point Function Click Enable to make this router serving as an access point click Disable to cancel this function Status It allows user to send
55. amp Medicine System Maintenance _ Diagnoall C News Non profits amp NGOs Cl Personal Sites External Devices O Politics C Real Estate O Religion io v C Restaurants amp Dining Shopping C Translators a y O General C Cults C Greeting cards Admi de Stii Ready Cl Image Sharing Cl Network Errors Cl Parked Domains Ml Nenenta TN_A ddrannnn 3 Enable this profile in Firewall gt gt General Setup gt gt Default Rule Dray Tek Vigor 2860 Series e ie Firewall gt gt General Setup General Setup a Dashboard Quick Start Wizard Service Activation Wizard Online Status General Setup Default Rule WAN LAN w Actions for default rule General Setup Application Action Profile Syslog Filter oO User Management Sessions Control o 60000 go Objects Setting P F 7 CSM Quality of Service g Bandwidth Management Load Balance policy Auto Select o Applications i VPN and Remote Access User Management None wi F Certificate Management APP Enforcement o SSL VPN A a USB Application URL Content Filter i aan oati ea Web Content Filter go External Devices Ls vl Advance Setting Admin mode Status Ready a 4 Next time when someone accesses facebook via this router the web page would be blocked and the following message would be displayed instead The requested Web page from 192 168 2 114 to www facebook com that is categorized with Social Networking
56. and 2 This device may accept any interference received including interference that may cause undesired operation The antenna transmitter should be kept at least 20 cm away from human body DrayTek Vigor2860 series VDSL2 ADSL2 routers are compliant with 47 C F R Part 68 More update please visit www draytek com Vigor2860 Series User s Guide iv Dr ay Tek Table of Contents NT OGUUIG ClO a PONE EE E EE A A E E 1 1 1 Web Configuration Buttons Explanation cccccccccccccceceeesesseeeeeeeesseaeeeceeeeessaeaeseeeeeeeessaaaasees 2 1 2 LED Indicators ANd ConnectorS cccccccccecceccececcecceccecccucceceucueceecucaeceetaceeeueaesuceesaeaeeeeseeseees 3 T21 FOr VIGOI 2600 esere E E E EE ESS 3 1 22 FOr VigOr286Q0 sses E a a E T EE REET 5 1 2 3 FOr VIGOI ZO OOM DING tisssesiiniesassas ecu dirian anaa e aE EAE Ei aai TE NE aai nias 7 1 2 4 For VIGO 20 OO VIOUS sinesctniedassavennstansatanaaan nna cian esuastanpianeceieeslanaaeuaieacesiaatduumsenetedimtanicetmabcanntaneds 9 1 3 Hardware Installation sci cccacconesercanscedsavecdsedesevasdtasacdsuesseedeieargelendeancot savaree edsavacddgdeceeaedtarachensiacd 11 1 4 Printer INStallation ccc cc cccccececaccecececuceeaecececueaeaececeeeeaesecuceeaeaesececaeaeaeaesecueavaeaeseeetaeaesetaes 12 1 5 ACCESSING Web Page ccccccsssseeccccesseceecceauececccuaeeeeeesuuseeeeesaeuseceesesaueeeessuaneeeessaagesessssaaaess 17 1 6 GHGNGING PASS WON be cdcucssssnacascetcers
57. application blocking If there is no profile for you to select please choose Create New from the drop down list in this page to create a new profile All the hosts in LAN must follow the standard configured in the APP Enforcement profile selected here For detailed information refer to the 177 Vigor2860 Series User s Guide URL Content Filter URL Content Filter Web Content Filter Advance Setting Vigor2860 Series User s Guide section of APP Enforcement profile setup For troubleshooting needs you can specify to record information for IM P2P by checking the Log box It will be sent to Syslog server Please refer to section Syslog Mail Alert for more detailed information Select one of the URL Content Filter profile settings created in CSM gt gt URL Content Filter for applying with this router Please set at least one profile for choosing in CSM gt gt URL Content Filter web page first Or choose Create New from the drop down list in this page to create a new profile For troubleshooting needs you can specify to record information for URL Content Filter by checking the Log box It will be sent to Syslog server Please refer to section Syslog Mail Alert for more detailed information Select one of the URL Content Filter profile settings created in CSM gt gt URL Content Filter for applying with this router Please set at least one profile for choosing in CSM gt gt URL Content Filter web page first Or choose C
58. gt CPE Maintenance Managed Devices List USB Disk Index 1 2 J 4 D G f a CPE Maintenance Google Map Refresh Disk Usage 1084MB 2009MB Set to Factory Default Device Name Action FilefPath Schedule Note To enable the schedulings an USB storage MUST be plugged onto router Available settings are explained as follows Item Refresh USB Disk Disk Usage Dray Tek Description Click it to refresh current page EEN JSE Disk C ka It means a USB disk connecting to Vigor2860 USB Disk It means no USB disk connecting to Vigor2860 BIB eae Meena rae rena Use dicieconnects to Vigor2860 the disk usage and the disk capacity will be displayed in such field Disk Usage USB Storage Disconnected When eretene USB disk connecting to Vigor2860 such message will be displayed in this field 309 Vigor2860 Series User s Guide Set to Factory Default Index Profile Name Device Name Action File Path Schedule Now Click the icon to see the content inside the USB disk Click to clear all indexes Display the number of the profile that you can edit Display the name of the maintenance profile Display the name of the managed CPE that the maintenance profile will apply to Display the action that managed CPE shall accept Display the location of the file you want to save restore or upgrade for CPE Display the schedule profiles selected for such profile
59. gt gt Web Content Filter Profile Web Filter License Activate Status Not Activated Setup Query Server Find more Setup Test Server Find more Web Content Filter Profile Table Set to Factory Default Profile Name Profile Name 4 Default 5 2 6 3 T 4 8 Administration Message Max 255 characters Default Message Cache L1 L2 Cache lt body gt lt center gt lt br gt lt br gt lt br gt psThe requested Web page lt br gt from t5IPs lt br gt to tURL lt br gt that is categorized with CL lt br gt has been blocked by RENAME Web Content Filter lt p gt Please contact your system administrator for further information lt center gt body gt Legend SSIP Source IP DIP Destination IP URL URL CL Category SRNAME Router Name Available settings are explained as follows Item Description Activate Click it to access into MyVigor for activating WCF service Setup Query Server It is recommended for you to use the default setting auto selected You need to specify a server for categorize searching when you type URL in browser based on the web content filter profile Setup Test Server It is recommended for you to use the default setting auto selected Find more Click it to open http myvigor draytek com for searching another qualified and suitable server Test a site to verify Click this link to do the verification whether it is categorized Set to Factory Default Click this link to retrieve the
60. host in the LAN Disable Server Let you manually assign IP address to every host in the LAN Enable Relay Agent Specify which subnet that DHCP server is located the relay agent should redirect the DHCP 125 Vigor2860 Series User s Guide DNS Server IP Address Vigor2860 Series User s Guide request to DHCP Server IP Address It is available when Enable Relay Agent is checked Set the IP address of the DHCP server you are going to use so the Relay Agent can help to forward the DHCP request to the DHCP server Start IP Address Enter a value of the IP address pool for the DHCP server to start with when issuing IP addresses If the Ist IP address of your router is 192 168 1 1 the starting IP address must be 192 168 1 2 or greater but smaller than 192 168 1 254 IP Pool Counts Enter the maximum number of PCs that you want the DHCP server to assign IP addresses to The default is 50 and the maximum is 253 Gateway IP Address Enter a value of the gateway IP address for the DHCP server The value is usually as same as the 1st IP address of the router which means the router is the default gateway Lease Time Enter the time to determine how long the IP address assigned by DHCP server can be used Retrieve IPs from inactive clients periodically Whenever a DHCP client requests an IP address from the LAN DHCP server the server will give out an IP to this client for a certain amount of time e g 1 day
61. igerenduter DCS Mock Frage attack TOU UL 25 255 2b oye LOT enag Lene FUER Lay A Se Water Dose sted P00 00 oS 0b ot Soo LOr ened Taree J01 Fa Aago igerrouter DOr tL a 255 295 295 39907 O ensi T AUIS AS a MAAS Bape Diak an arte A e 28255 E eT TUE TH ensi Teras ANS A San Aag JANASA onere DOS raga k 000 Gb 8S ER O88 AT LO Hens Tene Sie Sytem Timar Tinn nuy frm the comer ahh pes the oying apie Preiter Tipe Tiar tag from riha Vigor2860 Series User s Guide 184 Dr ay Te k 3 6 User Management User Management is a security feature which disallows any IP traffic except DHCP related packets from a particular host until that host has correctly supplied a valid username and password Instead of managing with IP address MAC address User Management function manages hosts with user account Network administrator can give different firewall policies or rules for different hosts with different User Management accounts This is more flexible and convenient for network management Not only offering the basic checking for Internet access User Management also provides additional firewall rules e g CSM checking for protecting hosts lt M Lisa s notebook WLAN_User_Group_A Password wug123 Allen s PC gt be Tom s PC a Le me lt lt David s notebook WLAN User Group B LAN_User_Group_1 Password wug456 Password lugi23 Nina s PC Diana s PC LAN he Amy s PC Not contro
62. make a L2TP VPN connection through the Internet You can select to use L2TP alone or with IPsec Select from below None Do not apply the IPsec policy Accordingly the VPN connection employed the L2TP without IPsec policy can be viewed as one pure L2TP 275 Vigor2860 Series User s Guide Subnet IKE Authentication Method Vigor2860 Series User s Guide connection Nice to Have Apply the IPsec policy first if it is applicable during negotiation Otherwise the dial in VPN connection becomes one pure L2TP connection Must Specify the IPsec policy to be definitely applied on the L2TP connection SSL Tunnel Allow the remote dial in user to make an SSL VPN connection through Internet Specify Remote Node You can specify the IP address of the remote dial in user ISDN number or peer ID used in IKE aggressive mode Uncheck the checkbox means the connection type you select above will apply the authentication methods and security methods in the general settings Netbios Naming Packet Pass Click it to have an inquiry for data transmission between the hosts located on both sides of VPN Tunnel while connecting Block When there is conflict occurred between the hosts on both sides of VPN Tunnel in connecting such function can block data transmission of Netbios Naming Packet inside the tunnel Multicast via VPN Some programs might send multicast packets via VPN connection Pass
63. you can use a fixed endpoint rather than any cast endpoint The mode has more reliability WAN gt gt Internet Access wa WAN 1 PPPoE Static or Dynamic IP PPTP L2TP IPvb Internet Access Mode Connection Type bind Static Tunnel 6in4d Static Tunnel Remote Endpoint IPv4 Address Po Tunnel TTL 255 default 255 Available settings are explained as follows Item Description Remote Endpoint IP v4 Type the static Pv4 address for the remote server Address 6in4 IPv6 Address Type the static IPv6 address for Pv4 tunnel with the value for prefix length LAN Routed Prefix Type the static IPv6 address for LAN routing with the value for prefix length Tunnel TTL Type the number for the data lifetime in tunnel After finished the above settings click OK to save the settings Dray Te k 111 Vigor2860 Series User s Guide Below shows an example for successful IPv6 connection based on 6in4 Static Tunnel mode Online Status Physical Connection System Uptime Oday 0 4 16 IPv4 IPv6 LAN Status IP Address 2001 4DD0 FFO0 83E4 21D AAFF FE83 11B64 64 Global FE80 21D AAFF FE83 11B4 64 Link TA Packets RX Packets TA Bytes 80 1244 WAN1 IPv6 Status Enable Mode Up Time 6in4 Static Tunnel 0 04 07 Gateway IP 2001 4DD0 FF10 83E4 2131 64 Global FE80 COA8 651D 128 Link TA Packets RX Packets TX Bytes RX Bytes 3 26 11 2302 Details Page for IPv6 6rd in WAN1 WAN2 This type allows you to setup 6rd for WAN interfa
64. 1 Subnet Mask Type in an address code that determines the size of the network Default 255 255 255 0 24 DHCP Server Configuration DHCP stands for Dynamic Host Configuration Protocol The router by factory default acts a DHCP server for your network so it automatically dispatch related IP settings to any local user configured as a DHCP client It is highly recommended that you leave the router enabled as a DHCP server if you do not have a DHCP server for your network Enable Server Let the router assign IP address to every host in the LAN Disable Server Let you manually assign IP address to every host in the LAN Enable Relay Agent If you want to use another DHCP server in the network other than the Vigor Router s you can let Relay Agent help you to redirect the DHCP request to the specified location DHCP Server IP Address It is available when Enable Relay Agent is checked Set the IP address of the DHCP server you are going to use so the Relay Agent can help to 129 Vigor2860 Series User s Guide DNS Server IP Address Vigor2860 Series User s Guide forward the DHCP request to the DHCP server Start IP Address Enter a value of the IP address pool for the DHCP server to start with when issuing IP addresses If the Ist IP address of your router is 192 168 1 1 the starting IP address must be 192 168 1 2 or greater but smaller than 192 168 1 254 IP Pool Counts Enter the maximum number o
65. 1 Checking If the Hardware Status Is OK or Not Follow the steps below to verify the hardware status 1 Check the power line and WLAN LAN cable connections Refer to 1 3 Hardware Installation for details 2 Turn on the router Make sure the ACT LED blink once per second and the correspondent LAN LED is bright ACT X J N j Dray lek oo Q ONIOFFIWPS ACT WLAN Line vy Q USB ADSL Phonet Factory O Reset WAN2 VDSL Phone2 Phone1 2 Li 3 Ifnot it means that there is something wrong with the hardware status Simply back to 1 3 Hardware Installation to execute the hardware installation again And then try again Dray Te k 519 Vigor2860 Series User s Guide 5 2 Checking If the Network Connection Settings on Your Computer Is OK or Not Sometimes the link failure occurs due to the wrong network connection settings After trying the above section if the link is stilled failed please do the steps listed below to make sure the network connection settings is OK For Windows The example is based on Windows XP As to the examples for other operation systems please refer to the similar steps or find support notes in www DrayTek com 1 Goto Control Panel and then double click on Network Connections Jetaiork Connections 2 Right click on Local Area Connection and click on Properties Disable Status Repair Bridge Connections Create Shortcut Rename Proper
66. 15 4 Status From this page you can find codec connection and other important call status for each port VoIP gt Status Status Refresh Seconds Tx Rx Rx Rx In Out Miss Speaker Pkts Pkts Losts Jitter ms Calls Calls Calls Gain Phonel IDLE 00 00 00 a a 0 0 a 0 0 5 Phone2 IDLE a0 00 d 0 T 0 5 Port Status Codec PeerID Elapse hh mmi ss Log Date Duration In Out Miss Account ID Peer ID irri dd yyy ihh a3 0 0 oO 00 00 00 oo oO0 oO0 00 00 OO O0 00 00 00 oo o0 00 00 00 oO0 O0 00 00 00 oo oO0 oO OO oo O0 mOoceau0n0 ceo oO 8 HMERMEEX VOIP is encrypted HMEEMEEM VOIP isn t encrypted Available settings are explained as follows Item Description Refresh Seconds Specify the interval of refresh time to obtain the latest VoIP calling information The information will update immediately when the Refresh button is clicked Petresh Seconds Port It shows current connection status for Phone s ports Vigor2860 Series User s Guide 350 Dr ay Te k Dray Tek Status Codec PeerID Elapse hh mmiss Tx Pkts Rx Pkts Rx Losts Rx Jitter In Calls Out Calls Miss Calls Speaker Gain Log It shows the VoIP connection status IDLE Indicates that the VoIP function is idle HANG _UP Indicates that the connection is not established busy tone CONNECTING Indicates that the user is calling out WAIT_ ANS Indicates that a connection is launched a
67. 1B BS 192 168 7 1 233 235 235 0 ON 10 28 560 IF Routed Subnet O0 10 44 B6 1B B8 192 166 0 1 255 255 255 0 ON 10 25 60 Wireless LAN MAC Address Frequency Domain Firmware Version SSID O0 10 44 B6 1B B FOE 2 oly bd 2660 marketing Wireless LAN 5GHz MAC Address Frequency Domain Firmware Version SSID OO 1D 44 B6 1B BA FCC O0 9 17 1 DravTek2960 SGmarketing Link Status MAC Address Connection IP Address Default Gateway WANI Connected O0 10 44 B6 1B B9 DHCP Clent 192 168 100 202 192 168 100 254 WAH Connected O0 10 44 B6 1B6 B4 Static IP 17210313 172 106 3 1 WANS Disconnected O0 10 44 B6 1B BB PPP WAH4 Disconnected O0 10 44 B6 1B BC Scope Internet Access Mode LAM FESO 210 44FFIFEBG 1BBSe 64 Link Available settings are explained as follows Dray Tek Item Model Name Firmware Version Build Date Time LAN WAN Description Display the model name of the router Display the firmware version of the router Display the date and time of the current firmware build MAC Address Display the MAC address of the LAN Interface IP Address Display the IP address of the LAN interface Subnet Mask Display the subnet mask address of the LAN interface DHCP Server Display the current status of DHCP server of the LAN interface DNS Display the assigned IP address of the primary DNS Link Status Display current connection status MAC Address Display the MAC address of the WAN Interfac
68. 28 60 10 IP Pool Counts oo RIP Protocol Control Gateway IP Address 10 28 60 1 Note Disable LAN amp Enable LAN shouldn t be ee ieee eee oa Lease Time o4 s the same subnet Retrieve IPs fram inactive cllents periodically DNS Server IP Address Primary IP Address 10 28 60 1 Secondary IF Address Doo Available settings are explained as follows Dray Tek Item Network Configuration DHCP Server Configuration Description For NAT Usage IP Address Type in private IP address for connecting to a local private network Default 192 168 1 1 Subnet Mask Type in an address code that determines the size of the network Default 255 255 255 0 24 RIP Protocol Control Disable deactivate the RIP protocol It will lead to a stoppage of the exchange of routing information between routers Default Enable activate the RIP protocol DHCP stands for Dynamic Host Configuration Protocol The router by factory default acts a DHCP server for your network so it automatically dispatch related IP settings to any local user configured as a DHCP client It is highly recommended that you leave the router enabled as a DHCP server if you do not have a DHCP server for your network If you want to use another DHCP server in the network other than the Vigor Router s you can let Relay Agent help you to redirect the DHCP request to the specified location Enable Server Let the router assign IP address to every
69. 3 18 2 USB User Manageme n cccccccccccssssseeeceeeeeeeaeeesseceeeeesseueeeeeeeesseaaaeeeeeeeesssaaeeeeees 387 OF MS FX ON CU o a 389 3 184 USB DC VIC StalUS miinide neen a denon actnesana En EEEE 390 3 18 5 Temperature SCNSOMS ccccccccsssecccceeccseeseeecceeeeeeeeeeseeeeeeesseeseeeeeeeeessseeaeeeeeessssaeeeeeeess 391 3 18 6 Modem SUD DOI LIS lerrora ad nE Ea e aE EA FEE 393 3 19 System MaINteNANCE cccccccccsssseccceeecceeeeseeeecceeeesaeeeeeeeeeeesseaaeeeeeeesesseeaseeeeeesessaaaaeeeeeeees 394 AO V a iaa E E N EE E 394 A TER ODO a T E E E E 397 3 19 3 Administrator PASSWOMK cccccccseeeeecseeeeeceseeesaeeeeeeaeeeeeeseaeeessueeeeseaueeesseeeesseseeenaass 399 3 19 4 User Password cccccccseccccescecceseeeceaeeecseuseeessuseeeceauseecssasecessuecesseaseeesseseeessegseesseass 401 3 19 5 Login Page Greeting ccccsseesccccceseeceeeeeeseeeeeceeeeeeeeeseeeeeeeeesseaeeeeesaeeeeesssaaeeeeeesaaages 403 3 19 6 Configuration Backup cccccccccccceeeceseeseeeeeeeeeeseeesseeeeeesseeeesseeeeeeeessaeaseeeeeeeessaaegeees 405 3 19 7 Syslog Mail Alert ccccccccccssseeccccceeceecceeesecececeeaeceesssaueceeseuaueeeesesageeeeessasesessssageess 407 3 19 8 Time and Date cccccccecccccsesececeesseecceseeeceeeeceeuseecseaeeessaueeecsegeeesseeeeessageeesaneeesseaess 410 CRE SES e e E E 411 3 19 10 ManageMent cccccsscccccssscecceeeeecsesececseuseeessaseeceeuscesseaseeessageeeseue
70. 9 Saving Configuration Each time you click OK on the web page for saving the configuration you can find messages showing the system interaction with you Ready indicates the system is ready for you to input settings Settings Saved means your settings are saved once you click Finish or OK button Vigor2860 Series User s Guide 28 Dr ay Tek Quick Setup There are several setup wizards offered for you to configure the router simply and quickly Quick Start Wizard used for building network connection Internet access Service Activation Wizard used for activating the web content filter service VPN Client Wizard used for establishing VPN tunnel the router is treated as a VPN client VPN Server Wizard used for establishing VPN tunnel the router is treated as a VPN server Wireless Wizard used for building wireless LAN connection VoIP Wizard used for establishing VoIP profile 2 1 Quick Start Wizard Quick Start Wizard can help you to deploy and use the router easily and quickly The first screen of Quick Start Wizard is entering login password After typing the password please click Next Quick Start Wizard Enter login password Please enter an alpha numeric string as your Password Max 23 characters Old Password New Password Confirm Password Dr ay Te k 29 Vigor2860 Series User s Guide On the next page as shown below please select the WAN interface that you use If
71. ADSL please make sure the channel that you are binding to is using ADSL as its WAN type The binding will work only under PPPoE and MPoA 1483 Bridge mode Item QoS Type PCR SCR MBS PVC to PVC Binding Available settings are explained as follows Description Select a proper QoS type for the channel according to the information that your ISP provides It represents Peak Cell Rate The default setting is 0 It represents Sustainable Cell Rate The value of SCR must be smaller than PCR It represents Maximum Burst Size The range of the value is 10 to 50 It allows the PVC channel to use the same ADSL connection settings of another PVC channel Please choose the PVC channel via the drop down list After finished the above settings click OK to save the settings Vigor2860 Series User s Guide 120 Dray Tek 3 2 LAN Local Area Network LAN is a group of subnets regulated and ruled by router The design of network structure is related to what type of public IP addresses coming from your ISP 3 2 1 Basics of LAN The most generic function of Vigor router is NAT It creates a private subnet of your own As mentioned previously the router will talk to other public hosts on the Internet by using public IP address and talking to local hosts by using its private IP address What NAT does is to translate the packets from public IP address to private IP address to forward the right packets to the right hos
72. ALL Note When there is no user profile or group profile existed Create New User or Create New Group item will appear for you to click to create a new one Select an APP Enforcement profile for global IM P2P application blocking If there is no profile for you to select please choose Create New from the drop down list in this page to create a new profile All the hosts in LAN must follow the standard configured in the APP Enforcement profile selected here For detailed information refer to the section of APP Enforcement profile setup For 170 Dray Tek troubleshooting needs you can specify to record information for IM P2P by checking the Log box It will be sent to Syslog server Please refer to section Syslog Mail Alert for more detailed information URL Content Filter Select one of the URL Content Filter profile settings created in CSM gt gt URL Content Filter for applying with this router Please set at least one profile for choosing in CSM gt gt URL Content Filter web page first Or choose Create New from the drop down list in this page to create a new profile For troubleshooting needs you can specify to record information for URL Content Filter by checking the Log box It will be sent to Syslog server Please refer to section Syslog Mail Alert for more detailed information Web Content Filter Select one of the Web Content Filter profile settings created in CSM gt gt Web Content Filter for applying with this ro
73. Access WAN 2 PPPoE Static or Dynamic IF PPTP L2TP Pw internet Access Mode Connection Type Static PVG Static IPvi Address configuration Prefis Length Scope 20U01 BO1L0 7300 201 21D AAFF FEA6 2564 64 Global E 2001 1111 2222 5555 210 AAFF FEA6 2564 64 Global FESO 21D AAFF FEA6B 2564 64 Link Static Pv Gateway configuration IPv6 Gateway Address OK Cancel Click OK and open Online Status If the connection is successful the physical connection will be shows as follows Online Status Physical Connection System Uptime 0 4 2 IPv4 IPvi LAN Status IP Address FESO 210 44FF FES6 2568 64 Link TX Packets RX Packets TX Bytes RX Bytes 4 O aie 0 WAN IPv6 Status Enable Mode Up Time Static IP 6 Gateway IP 2001 BOLO s00 20T 210 oe Tl mS Tore Peo FESO0 210 44FF FE46 2564 64 Link TX Packets RX Packets o 2 Vigor2860 Series User s Guide 440 Dr ay Tek 6in4 Static Tunnel Choose 6in4 Static Tunnel Type remote endpoint IPv4 address 6in4 IPv6 Address LAN Routed Prefix and Tunnel TTL WAN gt gt Internet Access wa WAN 1 PPPoE Static or Dynamic IP PPTP L2TP IPvo Internet Access Mode Connection Type 6in4 Static Tunnel bind Static Tunnel Remote Endpoint IPw4 Address Po 6in4 IPv Address Po f 4 default 64 Tunnel TTL 255 default 255 Click OK and open Online Status If the connection is successful the physi
74. Anti Intrusion Anti Spam Service http www draytek com user SupportFA QDetail php ID 286 How to use the Web Content Filter WCF http www draytek com user SupportFA QDetail php ID 1953 What the Web Content Filter WCF license benefits are http www draytek com user PdInfoDetail php Id 1 10 Vigor2860 Series User s Guide 490 Dr ay Te k 2 Open CSM gt gt Web Content Filter Profile to create a WCF profile Check Social Networking with Action Block DrayTek Vigor 2860 Series tt E gt i C Travel JLeisure amp Recreation Fashion amp Beauty IR6 a Business Dashboard Select All a i Quick Start Wizard O Business job Search C web based Mail Service Activation Wizard Clear All Online Status Chating wan BECIE LAN Select All E Chat O Instant Messaging NAT Clear All Firewall User Management Computer Internet Anonymizers Cl Forums amp Newsgroups Computers Objects Settin cea ae Select All C Download Sites C Streaming Downloads Phishing amp Fraud Clear All CI Search Engine Portals Social Networking CI Spam Sites Web Content Filter Profile C Malware _IBotnets O Hacking Bandwidth Management CIllegal Software Cl Information Security Peer to Peer Applications VPN and Remote Access f Other Cl Adv amp Pop Ups Darts C Transportation Ser ae Menage E Select All CI Compromised Cl Dating amp Personals Cl Education USB Application Clear All O Finance CI Government Cl Health
75. Applications gt gt RADIUS RADIUS Setup Destination Port 1812 Available settings are explained as follows Item Description Enable Check to enable RADIUS client feature Server IP Address Enter the IP address of RADIUS server Destination Port The UDP port number that the RADIUS server is using The default value is 1812 based on RFC 2138 Shared Secret The RADIUS server and client share a secret that is used to authenticate the messages sent between them Both sides must be configured to use the same shared secret The maximum length of the shared secret you can set is 36 characters Vigor2860 Series User s Guide 254 Dr ay Te k Confirm Shared Secret Re type the Shared Secret for confirmation After finished the above settings click OK button to save the settings 3 10 5 LDAP Active Directory Setup Lightweight Directory Access Protocol LDAP is a communication protocol for using in TCP IP network It defines the methods to access distributing directory server by clients work on directory and share the information in the directory by clients The LDAP standard is established by the work team of Internet Engineering Task Force IETF As the name described LDAP is designed as an effect way to access directory service without the complexity of other directory service protocols For LDAP is defined to perform inquire and modify the information within the directory and acquire the data in the directory securely th
76. Backup Type If you choose Backup as the Active Mode Backup Type will appear Please specify which WAN will be treated as the Backup WAN Active Mode Backup Load Balance Owan 1O wAn 2 WAN aO WAN 4 Gane aback ier When any of selected WAN disconnect multiple WAN O When all of selected WAN disconnect When any of selected WAN disconnect Such backup WAN will be activated when any master WAN interface disconnects When all of selected WAN disconnect Such backup WAN will be activated only when all master WAN interfaces disconnect After finished the above settings click OK to save the settings Dr ay Te k 81 Vigor2860 Series User s Guide 3 1 3 Internet Access For the router supports multi WAN function the users can set different WAN settings for WANI WAN2 WAN3 WAN4 for Internet Access Due to different Physical Mode for WAN interface the Access Mode for these connections also varies Refer to the following figures WAN gt Internet Access Internet Access Index Display Name Physical Mode Access Mode WANI ADSL 7 bd PPPoE PPPoA Details Page Puta WARK Ethernet PPPoE PPPOA Details Page Pita MPoA Static or Dynamic IP WANS USE WY At ISB Note Only one WAN can support IPv6 You can configure DHCP client options here WAN gt Internet Access Internet Access Index Display Name Physical Mode Access Mode WANT ADSL VDSL2 PPPoE PPPoA Details Page WAN Ethernet stati
77. Click a button numbered 1 7 to edit the filter rule Click the button will open Edit Filter Rule web page For the detailed information refer to the following page Active Enable or disable the filter rule Comment Enter filter set comments description Maximum length is 23 character long Move Up Down Use Up or Down link to move the order of the filter rules Next Filter Set Set the link to the next filter set to be executed after the current filter run Do not make a loop with many filter sets To edit Filter Rule click the Filter Rule index button to enter the Filter Rule setup page Dr ay Tek 173 Vigor2860 Series User s Guide Firewall gt Edit Filter Set gt gt Edit Filter Rule Filter Set 1 Rule 1 Check to enable the Filter Rule Comments Index 1 15 in Schedule Setup Block NetBios Clear sessions when schedule ON C Enable Direction Source IP Destination IP Service Type Fragments Application Filter Branch to Other Filter Set Sessions Control MAC Bind IP Quality of Service Load Balance policy User Management APP Enforcement URL Content Filter Web Content Filter Advance Setting LAN RTI VPN gt WAN Edit Edit Edit ny TCP UDP Port from 137 139 to any P a x Dont Care w Action Profile Pass Immediately Non Strict Syslog O Mone Auto Select Mone None mN N Mone Edit o a La x Available settings are explained
78. Configuration Wireless 2 4GHz Settings Enable Disable SSID DrayTek_ Guest Security Key Rate Control Venable Upload 30000 kbps Download SO000 kbps Wireless 5GHz Settings eEnable Disable Cluse the same SSID and Security Key as above SSID UrayTek 5 3 suest Security key Rate Control Jenable Upload 30000 kbps Download SO000 kbps Note The configured quest AP will not be able ta access the LAN network YPN connections or communicate with wireless devices connecting to the router s other APs This AP interface shall be used for Internet access only Available settings are explained as follows Item Description Wireless 2 4GHz Settings Enable Disable Click it to enable or disable settings in this page SSID Type the SSID name of this router SSID1 Security Key The wireless mode offered by this wizard is WPA2 PSK The WPA encrypts each frame transmitted from the radio using the key which either PSK Pre Shared Key entered manually in this field below or automatically negotiated via 802 1x authentication Either 8 63 ASCII characters such as 012345678 or 64 Hexadecimal digits leading by Ox such as 0x321253abcde Rate Control It controls the data transmission rate through wireless connection Upload Check Enable and type the transmitting rate for data upload Default value is 30 000 kbps Download Type the transmitting rate for data download Default value is 30 000 kbps W
79. DSL interface is used please choose WAN1 if Ethernet interface is used please choose WAN2 if 3G USB modem is used please choose WAN3 or WAN4 Then click Next for next step Quick Start Wizard WAN Interface WAN Interface Display Name Physical Mode ADSL VOSLe DSL Mode VDOSL2 only Physical Type Auto negotiation WYLAN Tag insertion Tag value oo 0 4095 Priority o OF WANI WAN2 WAN3 and WAN4 will bring up different configuration page Refer to the following sections for detailed information Vigor2860 Series User s Guide 30 Dr ay Te k 2 1 1 For WAN1 ADSL VDSL2 WANI is specified for ADSL or VDSL2 connection Quick Start Wizard WAN Interface WAN Interface Display Name Physical Mode OSL Mode Physical Type VLAN Tag insertion Tag value Priority ADSL VOSLe2 od O 4095 07 Available settings are explained as follows Item Display Name DSL Mode VLAN Tag insertion Description Type a name to identify such WAN Specify the physical mode VDSL2 only or ADSL only for such router manually The settings configured in this field are available for WAN and WAN2 Enable Enable the function of VLAN with tag The router will add specific VLAN number to all packets on the WAN while sending them out Please type the tag value and specify the priority for the packets sending by WANI Disable Disable the function of VLAN with tag Tag value Type the
80. First Local Certificate Use the drop down list to choose one of the certificates for using You have to configure one certificate at least previously in Certificate Management gt gt Local Certificate Otherwise the setting you choose here will not be effective Medium Authentication Header AH means data will be authenticated but not be encrypted By default this option 56 Dray Tek User Name Password Remote Network IP Remote Network Mask 1S active High Encapsulating Security Payload ESP means payload data will be encrypted and authenticated You may select encryption algorithm from Data Encryption Standard DES Triple DES 3DES and AES This field is used to authenticate for connection when you select PPTP or L2TP with or without IPsec policy above The length of the use name is limited to 11 characters This field is used to authenticate for connection when you select PPTP or L2TP with or without IPsec policy above The length of the password is limited to 11 characters Please type one LAN IP address according to the real location of the remote host for building VPN connection Please type the network mask according to the real location of the remote host for building VPN connection 3 After finishing the configuration please click Next The confirmation page will be shown as follows If there is no problem you can click one of the radio buttons listed on the page and click Finish to e
81. ID is limited to 47 characters Index 1 15 Set the wireless LAN to work at certain time interval only You may choose up to 4 schedules out of the 15 schedules pre defined in Applications gt gt Schedule setup The default setting of this field is blank and the function will always work 283 Vigor2860 Series User s Guide 3 Dial in Settings Allowed Dial In Type Username TTY PPTP Password Max 11 char O O IPsec Tunnel VJ Compression on off L2TP with IPsec Policy IKE Authentication Method C Specify Remote VPN Gateway Pre Shared Key Peer VPN Server IP O O Doo y C Digital Signature X 509 or Peer ID O Local ID Alternative Subject Name First Subject Name First IPsec Security Method Medium AH High ESP DES SDES AES 4 GRE over IPsec Settings CO Enable IPsec Dial Out function GRE over IPsec Logical Traffic My GREIP PeeeReEIP 5 TCP IP Network Settings My WAN IP 0 0 0 0 RIP Direction Disable wv Remote Gateway IP 0 0 0 0 From first subnet to remote network you have to do Remote Network IP 0 0 0 0 Route T Remote Network Mask 255 255 255 0 Local Network IP 192 168 1 1 Change default route to this VPN tunnel t Only Local Network Mask 255 255 255 0 SR WAN eer Es Available settings are explained as follows Item Description Dial In Settings Allowed Dial In Type Determine the dial in connection with different types PPTP Allow the remote dial in user to
82. ISP Protocol Drop down the list to choose the one PPPoE or PPPoA provided by ISP If you have already used Quick Start Wizard to set the protocol then it is not necessary for you to change any settings in this group Modulation Default setting is Multimode Choose the one that fits the requirement of your router Modulation Mlultimode 71 412 5 Lite 5 OMT ADSLATS Soe 3 ADSL annex Ml ADSC 5 992 5 ADSL2 annex NM Multimode The router offers PPPoE dial up connection Besides you also can establish the PPPoE connection directly from local clients to your ISP via the Vigor router When PPPoA protocol is selected the PPPoE package transmitted by PC will be transformed into PPPoA package and sent to WAN server Thus the PC can access Internet through such direction For Wired LAN If you check this box PCs on the same network can use another set of PPPoE session different with the Host PC to access into Internet For Wireless LAN It is available for n model If you check this box PCs on the same wireless network can use another set of PPPoE session different with the Host PC to access into Internet Note To have PPPoA Pass through please choose PPPoA protocol and check the box es here The router will behave like a modem which only serves the PPPoE client on the LAN That s the router will offer PPPoA dial up connection Such function allows you to verify whether network connection is a
83. Internet Note To have PPPoA Pass through please choose PPPoA protocol and check the box es here The router will behave like a modem which only serves the PPPoE client on the LAN That s the router will offer PPPoA dial up connection Such function allows you to verify whether network connection is alive or not through ARP Detect or Ping Detect Mode Choose ARP Detect or Ping Detect for the system to execute for WAN detection Ping IP If you choose Ping Detect as detection mode you have to type IP address in this field for pinging TTL Time to Live Displays value for your reference TTL value is set by telnet command It means Max Transmit Unit for packet The default setting is 1500 Enter your allocated username password and authentication parameters according to the information provided by your ISP Username Type in the username provided by ISP in this field Password Type in the password provided by ISP in this field Separate Account for ADSL In default WAN1 supports VDSL2 ADSL and uses the same PPPoE account and password for connection If required you can configure another account and password for ADSL connection by checking this box If it is checked the system will ask you to type another group of account and password additionally PPP Authentication Select PAP only or PAP or CHAP for PPP Idle Timeout Set the timeout for breaking down the Internet after passing th
84. Internet e What kind of anti virus do you use Antivir vv would like to subscribe to the MyVigor e letter would like to receive DrayTek product news akan a mail server for receiving the 479 Vigor2860 Series User s Guide 5 Now you have created an account successfully Click START Create an account Please enter personal profile Completion Gs reement A confirmation email has been sent to mary_ted tech com Please click on the activation link in the email Personal Information to activate your account E rreferences AR 6 Check to see the confirmation email with the title of New Account Confirmation Letter from myvigor draytek com wkk This is an automated message trom myvigor draytek cor Thank you Mary for creating an account Please click on the activation link below to actrvate your account Link Activate my Account 7 Click the Activate my Account link to enable the account that you created The following screen will be shown to verify the register process is finished Please click Login Register Search for this site Register Confirm The Confirm message of New Owner Mary maybe timeout Please try agam or contact to draytek_com Vigor2860 Series User s Guide 480 Dray Te k Dray Tek 8 When you see the following page please type in the account and password that you just created in the fields of UserName and Password Then type the code in the box of Auth Code accor
85. LAN E For Wireless LAN Default MAC Address Specify a MAC Address WAN Connection Detection MAC Address ho AA PBe Ba Mode ARP Detect w sete Indexf 1 15 in Schedule Setup e i i i ay O Se L MTU 1500 Max 14923 Available settings are explained as follows Item Description Enable Disable Click Enable for activating this function If you click Disable this function will be closed and all the settings that you adjusted in this page will be invalid Modem Setting for It is not necessary to configure settings in these fields for ADSL only modem settings are prepared for ADSL only PPPoE Pass through The router offers PPPoE dial up connection Besides you also can establish the PPPoE connection directly from local clients to your ISP via the Vigor router When PPPoA protocol is selected the PPPoE package transmitted by PC will be transformed into PPPoA package and sent to WAN server Thus the PC can access Internet through such direction Vigor2860 Series User s Guide 84 Dr ay Tek Dray Tek WAN Connection Detection MTU ISP Access Setup IP Address From ISP For Wired LAN If you check this box PCs on the same network can use another set of PPPoE session different with the Host PC to access into Internet For Wireless LAN It is available for n model If you check this box PCs on the same wireless network can use another set of PPPoE session different with the Host PC to access into
86. LIpcast LItvkKoo L Sopcast LIUDLivex LITvuUPlayer LImMySee L joost L Flashvideo LJ silverlight 1 slingbox Klovoo LIvnec LJRadmin LI Spy4nywhere L ShowmMypPec J Logmetn L lTeamViewer LI sogrok LJRemotecontrolPra LIcrossLoop LI WindowsRDP Jocanywhere LJ Tirmbuktu LI WindowsLiveSyne Sharedview LIHTP Upload LIHiNet Safebox LIMS SkyDrive LJ6Doc Uploader LJaprive LI mMyOtherDrive LI Mozy LJ BoxNet LJofficelive LJ oropBox LI Google Service LJicloud 3 8 2 URL Content Filter Profile To provide an appropriate cyberspace to users Vigor router equips with URL Content Filter not only to limit illegal traffic from to the inappropriate web sites but also prohibit other web feature where malicious code may conceal Once a user type in or click on an URL with objectionable keywords URL keyword blocking facility will decline the HTTP request to that web page thus can limit user s access to the website You may imagine URL Content Filter as a well trained convenience store clerk who won t sell adult magazines to teenagers At office URL Content Filter can also provide a job related only environment hence to increase the employee work efficiency How can URL Content Filter work better than traditional firewall in the field of filtering Because it checks the URL strings or some of HTTP data hiding in the payload of TCP packets while legacy firewall inspects packets based on the fields of TCP IP headers only On the other hand Vigor router ca
87. LOLSOL Note Action and Idle Timeout settings will be ignored Index 1 60 in Phone Book as Exception List LE LL Cl CLIR thide caller ID Call Waiting Call Transfer Available settings are explained as follows Item Description Hotline Check the box to enable it Type in the SIP URL in the field for dialing automatically when you pick up the phone set Session Timer Check the box to enable the function In the limited time that you set in this field if there is no response the connecting call will be closed automatically T 38 Fax Function Check the box to enable T 38 fax function Error Correction Mode choose a mode for error correction DND Do Not Disturb Set a period of peace time without disturbing by VoIP mode phone call During the period the one who dial in will listen busy tone yet the local user will not listen any ring tone Index 1 15 in Schedule Enter the index of schedule profiles to control when the phone will ring and when will not according to the preconfigured schedules Refer to section Application gt gt Schedule for detailed configuration Index 1 60 in Phone Book Enter the index of phone book profiles Refer to section DialPlan Phone Book for detailed configuration CLIR hide caller ID Check this box to hide the caller ID on the display panel of the phone set Call Waiting Check this box to invoke this function A notice sound will appear to tell the user new phone call
88. Level This setting is used to adjust the loudness of the dial tone The smaller the number is the louder the dial tone is It is recommended for you to use the default setting Call Waiting Tone Power Level This setting is used to adjust the loudness of the call waiting tone The smaller the number is the louder the tone is It is recommended for you to use the default setting Interdigit Timeout Type a value in this field to specify time limit for interdigit DTMF Mode There are four DTMF modes for you to choose OTMEF mode InBand InBand_ QutBand RF C2033 SIP INFO cisco format SIP IMFO nortel format InBand Choose this one then the Vigor will send the DTME tone as audio directly when you press the 349 Vigor2860 Series User s Guide keypad on the phone OutBand Choose this one then the Vigor will capture the keypad number you pressed and transform it to digital form then send to the other side the receiver will generate the tone according to the digital form it receive This function is very useful when the network traffic congestion occurs and it still can remain the accuracy of DTMF tone SIP INFO Choose this one then the Vigor will capture the DTMF tone and transfer it into SIP form Then it will be sent to the remote end with SIP message Payload Type rfc2833 Type a number from 96 to 127 the default value was 101 This setting is available for the OutBand RFC2833 mode 3
89. Management Protocol It is a communication protocol which is mainly used for managing the membership of Internet Protocol multicast groups Applications gt gt IGMP ISMP C Enable IGMP Proxy IGMP Proxy is to act as a multicast proxy for hosts on the LAN side Enable IGMP Proxy if you will access any multicast group But this function take no affect when Bridge Mode is enabled L Enable IGMP Snooping Enable IGMP Snooping multicast traffic is only forwarded to ports that have members of that group Disable IGMP snooping multicast traffic is treated in the same manner as broadcast traffic Refresh Working Multicast Groups Index Group ID PI P P3 P4 P5 P6 Available settings are explained as follows Item Description Enable IGMP Proxy Check this box to enable this function The application of multicast will be executed through WAN port In addition such function is available in NAT mode WANT l E CYWANZ T WANS iVVANA fi PW Enable IGMP Snooping Check this box to enable this function Multicast traffic will be forwarded to ports that have members of that group Disabling IGMP snooping will make multicast traffic treated in the same manner as broadcast traffic Refresh Click this link to renew the working multicast group status Group ID This field displays the ID port for the multicast group The available range for IGMP starts from 224 0 0 0 to 239 255 255 254 P1 to P6 It indicates the LAN port used for
90. Max 255 characters Cache L1 L2 Cache lt body gt lt center gt lt br gt lt br gt lt br gt lt p gt The requested Web page lt br gt from 451P 4 lt br gt to t0RL4 lt br gt that is categorized with CL lt br gt has been blocked by tRNAME Web Content Filter lt p gt Please contact your system administrator for further information lt center gt lt body gt Or Click System Maintenance gt gt lt Activation to open the following page System Maintenance gt Activation Activate via interface auto selected i Status Not Activated Authentication Message Activation authenticate fail contact with support draytek com 2012 10 30 16 17 01 Vigor2860 Series User s Guide 474 Dr ay Te k 2 Click the Activate link A login page for MyVigor web site will pop up automatically Please take a moment to register Membership Registration entitles you to upgrade firmware for your purchased product and receive news about upcoming products and services UserName I Password txxhdd If you cannot read the word click here Forgotten password Auth Code Don t have a MyVigor Account Create an account now If you are having difficulty logging in contact our customer service Customer Service 886 3 597 2727 or 3 Click the link of Create an account now 4 Check to confirm that you accept the Agreement and click Accept Create an account Please enter personal pro
91. Per interface classes 2013 08 27 15 10 06 Aug 27 07 09 51 vigor router USB Device Class SubClass Protocol 00 00 00 2013 08 27 15 10 06 Aug 27 07 09 51 vigor router USB SerialNumber 3 ED96E018 2013 08 27 15 10 06 Aug 27 07 09 51 Yigor router USB Product 2 Mass Storage 2013 08 27 15 10 06 ug 27 07 09 51 vigor router USB Manufacturer 1 Generic 2013 08 27 15 10 06 Aug 27 07 09 51 vigor router USB Usb new device vendor ID 0568F Product ID 6387 2013 08 27 15 10 06 Aug 27 07 09 51 vigor router USB num of interfaces 1 2013 08 27 15 10 06 ug 27 07 09 51 YVigor router USB usb_set_configuration configuration 1 2013 08 27 15 10 06 Aug 27 07 09 51 vigor router USB Usb Device Connected at Port 0 lt 2 Transmission Rate is not fast enough Please connect your Notebook with 3G USB Modem to test the connection speed to verify if the problem is caused by Vigor2860 In addition please refer to the manual of 3G USB Modem for LED Status to make sure 1f the modem connects to Internet via HSDPA mode If you want to use the modem indoors please put it on the place near the window to obtain better signal receiving 5 6 Backing to Factory Default Setting If Necessary Sometimes a wrong connection can be improved by returning to the default settings Try to reset the router by software or hardware Such function is available in Admin Mode only Warning After pressing factory default setting you will loose all settings you did
92. Port Default Default LAN Access Control Allow management from LAM FTF Server HTTP Server HTTPS Server Telnet Server SSH Server Apply To LAN LAN3 M LAN 4 LANS MILANG DM IP Routed Subnet Access List from the Internet List Subnet Mask Note LANI is always allowed to access all the router services regardless of LAN Access Control settings Available settings are explained as follows Item Description Router Name Default Disable Auto Logout Type in the router name provided by ISP If it is enabled the function of auto logout for web user interface will be disabled Vigor2860 Series User s Guide Dray Tek 413 Internet Access Control LAN Access Control Access List from the Internet Management Port Setup CVM Access Control The web user interface will be open until you click the Logout icon manually Allow management from the Internet Enable the checkbox to allow system administrators to login from the Internet There are several servers provided by the system to allow you managing the router from Internet Check the box es to specify Disable PING from the Internet Check the checkbox to reject all PING packets from the Internet For security issue this function is enabled by default Allow management from LAN Enable the checkbox to allow system administrators to login from LAN interface There are several servers provided by the system which allow you to man
93. Product vo My Information ee VigorACS SI Serial number Lins 32031 lt gt Vigor Series Nickname vigor2860 0 Management Registration Date 08 24 2011 Product Usage i Select Registration Product Rating Select Your opinion so far No of Employees Select In total within your company Supplier Where you bought it from Date of Purchase mm dd yyyy Internet Connection gt Customer Survey O Cable O ADSL O VDSL O Fiber O 3G O WiMAX O LTE Vigor2860 Series User s Guide 70 Dr ay Tek 6 9 Dray Tek When the following page appears your router information has been added to the database Your device has been successtully added to the database Now you have finished the product registration After clicking OK you will see the following page Your router has been registered to myvigor website successfully If you have not activated web content filter service by using Service Activation Wizard you can activate the service from this step Please click the serial number link Ae oM My Information D About Us Welcome james_fae Product Last Login Time 2011 03 16 01 45 09 My Information Last Login From 172 16 2 180 E vif l Current Login Time 2011 03 16 18 20 31 VigorACS SI Current Login From 172 16 3 148 lt 3 Vigor Series RowNo PageNo Your Device List Q Management gt Customer Survey Serial Number Host ID Device Name Mod
94. Profile and click one of the index number e g index number 3 links User Management gt gt User Profile User Profile Table Profile Name admin Dial In User efe gt 3 In the following page check the box of Landing page and click OK to save the settings Vigor2860 Series User s Guide 468 Dr ay Te k User Management gt User Profile Profile Index 3 Enable this account User Name Password Confirm Password Idle Timeout Max User Login External Server Authentication Log Pop Browser Tracking Window Authentication Landing Page Enable Time Quota Indexf1 15 in Schedule Setup min s O Unlimited O Unlimited Web Alert Tool Telnet min s Refresh more mints 4 Open any browser e g FireFox Internet Explorer The logging page will appear and asks for username and password Please type the correct username and password Username Password Copyright GrayTek Corp All Rights Reserve 3 www draytek com eS ee ae ae D DiayTek Cop Headquarter Di P 4 Dray Tek J Derek Group O ME O BRE Dray Tek ES What s New gt DrayTek Milestone Development for Reliable IP based Network gt gt more Awards Reviews gt DrayTek VigorlPPBX 2820 got the positive review by MREZA magazine in Croatia gt gt more Events WEXPy DrayTek Unveils Latest Solutions for Next Generation Networks at C fi www draytek com user index php 7Lang en US New Ho
95. RIP What are Virtual LANs and Rate Control You can group local hosts by physical ports and create up to 8 virtual LANs To manage the communication between different groups please set up rules in Virtual LAN VLAN function and the rate of each Internet p1 P2 P3 P4 osie Vigor2860n MEI Senente Revel Vigor2860 Series User s Guide 122 Dr ay Tek 3 2 2 General Setup This page provides you the general settings for LAN Click LAN to open the LAN settings page and choose General Setup There are six subnets provided by the router which allow users to divide groups into different subnets LAN1 LAN6 In addition different subnets can link for each other by configuring Inter LAN Routing At present LAN setting is fixed with NAT mode only LAN2 LAN6 can be operated under NAT or Route mode IP Routed Subnet can be operated under Route mode LAN gt gt General Setup General Setup Status DHCP IP Address y y 10 28 60 1 Details Page 192 108 2 1 Ie E al 192 168 4 1 192 168 5 1 LAN 6 192 168 6 1 DMZ Port 192 168 7 1 IP Routed Subnet 192 168 0 1 You can configure DHCP server options here Force router to use DNS server IP address settings specified in LANT se Inter LAN Routing Subnet LAN 1 LAN 2 LAN 3 LAN 4 LAN 5 LAN 6 DIZ Port LAN 1 LAN 2 LAN 3 LAN 4 LAN 5 LAN 6 DM Port Mote LAN 273747576 are available when YLAN is enabled DMZ subnet is default bound to P1 and
96. Router is equipped with a hardware AES encryption engine so it can apply the highest protection to your data without influencing user experience Complete Security Standard Selection To ensure the security and privacy of your wireless communication we provide several prevailing standards on market WEP Wired Equivalent Privacy is a legacy method to encrypt each frame transmitted via radio using either a 64 bit or 128 bit key Usually access point will preset a set of four keys and it will communicate with each station using only one out of the four keys WPA Wi Fi Protected Access the most dominating security mechanism in industry is separated into two categories WPA personal or called WPA Pre Share Key WPA PSK and WPA Enterprise or called WPA 802 1x In WPA Personal a pre defined key is used for encryption during data transmission WPA applies Temporal Key Integrity Protocol TKIP for data encryption while WPA2 applies AES The WPA Enterprise combines not only encryption but also authentication Since WEP has been proved vulnerable you may consider using WPA for the most secure connection You should select the appropriate security mechanism according to your needs No matter which security suite you select they all will enhance the over the air data protection and or privacy on your wireless network The Vigor wireless router is very flexible and can support multiple secure connections with both WEP and WPA at the same time S
97. Service IP Address Port Username Note If the write protect switch of USB disk is turned on the USB disk ts in READ ONLY mode Mo data can be written to it 3 18 5 Temperature Sensor A USB Thermometer is now available that complements your installed DrayTek router installations that will help you monitor the server or data communications room environment and notify you if the server room or data communications room is overheating During summer in particular it is important to ensure that your server or data communications equipment are not overheating due to cooling system failures The inclusion of a USB thermometer in compatible Vigor routers will continuously monitor the temperature of its environment When a pre determined threshold is reached you will be alerted by either an email or SMS so you can undertake appropriate action Temperature Sensor Settings USB Application gt gt Temperature Sensor Setting Temperature Sensor Settings Temperature Chart Display Settings Temperature Calibration Temperature Unit Celsius Fahrenheit Alarm Settings L Enable Syslog Alarm Upper temperature limit 30 00 Lower temperature limit 16 00 OK Available settings are explained as follows Dr ay Tek 391 Vigor2860 Series User s Guide Item Description Display Settings Temperature Calibration Type a value used for correcting the temperature error Temperature Unit Choose the display unit of the temperatu
98. Setup You then will access the admin screen of by suffixing the IP address with 8080 e g http 192 168 1 1 8080 instead of port 80 Vigor2860 Series User s Guide 156 DrayTek Dray Tek System Maintenance gt gt Management IPv4 Management Setup Router Name C Default Disable Auto Logout Internet Access Control Allow management from the Internet C FTP Server HTTP Server HTTPS Server Telnet Server C TRO69 Server C SSH Server Disable PING from the Internet LAN Access Control Allow management from LAM FIP Server HTTP Server HTTPS Server Telnet Server SSH Server Apply To LAN M LAN3 M LAN M LANS MILANG DMZ IP Routed Subnet Access List from the Internet List Subnet Mask IPv6 Management Setup Management Port Setup User Define Ports Telnet Port HTTP Port HTTPS Port FTP Port TROGS Port SSH Fort CVM Access Control Cl cvm Port C cvm SSL Port Default Ports Default Default Default Default Default Default Default Default Note LANI is always allowed to access all the router services regardless of LAN Access Control settings 157 Vigor2860 Series User s Guide 3 4 2 DMZ Host As mentioned above Port Redirection can redirect incoming TCP UDP or other traffic on particular ports to the specific private IP address port of host in the LAN However other IP protocols for example Protocols 50 ESP and 51 AH do not travel on a fixed port
99. TCP WWW 60 sec TCP SYN 60 sec NAT gt Port Triggering Port Triggering Setto Factory Default Index Comment Triggering Protocol Triggering Port Incoming Protocol Incoming Port Status 1 x 2 x 3 x 4 x 5 x 6 x I x x al x lt lt 1 10 11 20 Next Available settings are explained as follows Item Description Comment Display the text which memorizes the application of this rule Dr ay Te k 163 Vigor2860 Series User s Guide Triggering Protocol Display the protocol of the triggering packets Triggering Port Display the port of the triggering packets Incoming Protocol Display the protocol for the incoming data of such triggering profile Incoming Port Display the port for the incoming data of such triggering profile Status Display if the rule is active or de active Click the index number link to open the configuration page NAT gt Port Triggering No 1 Enable Service Comment Triggering Protocol C Triggering Port Incoming Protocol UD Incoming Port sl slalla E D U lt lt Note The Triggering Port and Incoming Port should be input like this 123 456 777 789 legal 123 456 789 legal but 123 456 789 illegal Available settings are explained as follows Item Description Enable Check to enable this entry Service Choose the predefined service to apply for such trigger profile User Defined User Defined Real Player Quick Time BitTorrent Comment Ty
100. The action will be performed for the selected CPE immediately How to add a new Maintenance Profile Follow the steps below to create a new maintenance profile 1 Click any index number link e g Index 1 Managed Devices List CPE Maintenance USB Disk fe Disk Usage 1084MB Index Protile Name Device Nar con i oe 2 The Maintenance dialog appears Central VPN Management gt CPE Management gt gt Maintanance Profile Profile Name Enable Device Name Action Type File Path Index in Schedule For 2850 00507F7D9D00 S Note Action and Idle Timeout settings will be ignored Available parameters are listed as follows Item Profile Name Vigor2860 Series User s Guide Description Type the name of the maintenance profile 310 DrayTek Enable Check it to enable such profile Device Name The drop down list will display all the CPE devices detected by Vigor2860 series Choose the one which will be applied with such new created profile Action Type There are three actions for you to choose for such profile al Contig Backup Contig Backup Contig Restore Firmware Upgrade Config Backup It means such profile will be used for configuration backup of the selected CPE Config Restore It means such profile will be used for restoring the configuration of the selected CPE Note When restoring configuration to a CPE make sure the configuration fil
101. This product is designed for the DSL and 2 4GHz 5GHz WLAN network throughout the EC region Please see the user manual for the applicable networks on your product Regulatory Information Federal Communication Commission Interference Statement This equipment has been tested and found to comply with the limits for a Class B digital device pursuant to Part 15 of the FCC Rules These limits are designed to provide reasonable protection against harmful interference in a residential installation This equipment generates uses and can radiate radio frequency energy and if not installed and used in accordance with the instructions may cause harmful interference to radio communications However there is no guarantee that interference will not occur in a particular installation If this equipment does cause harmful interference to radio or television reception which can be determined by turning the equipment off and on the user is encouraged to try to correct the interference by one of the following measures Reorient or relocate the receiving antenna Increase the separation between the equipment and receiver Connect the equipment into an outlet on a circuit different from that to which the receiver is connected Consult the dealer or an experienced radio TV technician for help This device complies with Part 15 of the FCC Rules Operation is subject to the following two conditions 1 This device may not cause harmful interference
102. Tunnel Bind Table Idnex l Binding Dial Out Index Binding protocol Binding Sre IP Binding Dst IP Binding Dst Port ANY Protocol 192 168 10 24 255 255 255 255 192 168 1 20 255 255 255 255 l 65535 Note To configure a successful binding tunnel you have to Type Binding Src IP range Start and End and Binding Des IP range Start and End Choose TCP UDP IGMP ICMP or Other as Binding Protocol Detailed Settings for Advanced Backup gt YER Backup Advance Settings Windows Internet Explorer E http192 168 1 1 hin VPN Backup Advance Settings Profile Name Backupl ERD Mode Normal Resume Member 1 first Detail Information Environment Recovers Detection ERD Status Normal Mode Pas H w Available settings are explained as follows Vigor2860 Series User s Guide 296 Dr ay Te k Item Profile Name ERD Mode Description List the backup profile name ERD means Environment Recovers Detection Dray Tek a Normal choose this mode to make all dial out VPN TRUNK backup profiles being activated alternatively Resume when VPN connection breaks down or disconnects Member 1 will be the top priority for the system to do VPN connection Detail Information This field will display detailed information for Environment Recovers Detection 3 11 8 Connection Management You can find the summary table of all VPN connections You may disconnect any VPN co
103. USB Modem to disable PIN code and try again If it still fails it might be the compliance problem of system Please open DrayTek Syslog Tool to capture the connection information WAN Log and send the page similar to the following graphic to the service center of DrayTek Dray Te k 523 Vigor2860 Series User s Guide Syslog Utility 172 TET F J WAN Information OOo S TX Rate R Rate v Log Filter j LAN Information Keyword p MA Tx Packets RX Packets WAN IP Gateway IP Apply to All v Firewall YPN User Access Connection WAN IPPBX Others Show Syslog List Show Traffic Graph C Pause System Time Router Time Host Message 2013 08 27 15 11 09 Aug 27 07 10 53 vigor router statistic Session Usage 123 5 min average 2013 08 27 15 11 09 Aug 27 07 10 53 vigor router statistic WAN1 Tx 81 Kbps Rx 12 Kbps 5 min average 2013 08 27 15 10 07 ug 27 07 09 51 YVigor router USB Host Controller Driver OTG 2013 08 27 15 10 06 Aug 27 07 09 51 Vigor router USB Endpoint ddress 82 in Attributes 02 Bulk 2013 08 27 15 10 06 Aug 27 07 09 51 vigor router USBJEndpointAddress 01 out Attributes 02 Bulk 2013 08 27 15 10 06 Aug 27 07 09 51 Yigor router USB Mass Storage device class 2013 08 27 15 10 06 Aug 27 07 09 51 vigor router USB Interface Class SubClass Protocol 08 06 50 2013 08 27 15 10 06 Aug 27 07 09 51 Yigor router USB Interface 0 2013 08 27 15 10 06 Aug 27 07 09 51 vigor router USB
104. User s Guide 54 Dr ay Te k VPN and Remote Access gt gt VPN Client Wizard VPN Client L2TP Settings Profile Name 77 VPN Dial Out Through O Always on Server IP Host Name for VPN DO E e g draytek com or 123 45 67 89 Username TTY password P Remote Network IP Remote Network Mask 255 255 255 0 E When you choose L2TP over IPsec Nice to Have or L2TP over IPsec Must you will see the following graphic VPN and Remote Access gt gt VPH Client Wizard VPN Client L2TP over IPsec Nice to Have Settings Profile Name VPN 2 VPN Dial Qut Through WAN First po O Always on Server IP Host Name for VPN e g draytek com or 123 45 67 89 IKE Authentication Method Pre Shared Key Confirm Pre Shared Key Digital Signature X 509 Peer ID Local ID Alternative Subject Name First Subject Name First Local Certificate IPsec Security Method Medium AH High ESP Username Password Remote Network IP Remote Network Mask 755 755 7550 Available settings are explained as follows Item Description Profile Name Type a name for such profile The length of the file is limited to 10 characters Dr ay Tek 55 Vigor2860 Series User s Guide VPN Dial Out Through Always On Server IP Host Name for VPN IKE Authentication Method Digital Signature X 509 IPsec Security Method Vigor2860 Series User s Guide Use the drop down menu to choose a proper WAN interface for t
105. WAN 1 Status gt gt Dial PPPoE Enable Line Name Mode Up Time YES ADSL PPPoE 00 00 00 IF GV IP TX Packets TX Rate Bps RX Packets RX Rate Bps 0 0 T F WAN 2 Status gt gt Drop PPPoE Enable Line Name Mode Up Time Yeas Ethernet PPPOE 0 00 54 IP GVW IP TX Packets TX Rate Bps FX Packets RX Rate Bps 114 44 43 54 166 95 96 254 api 4761 azl DEIF WAN 3 Status Enable Line Name Mode Up Time Signal Yes LSB OO O00 00 IP GVW IP TX Packets TX Rate Bps Rx Packets RX Rate Bps Oo 0 0 0 ADSL Information ADSL Firmware Version 05 04 04 04 00 01 ATM Statistics TX Cells FRX Cells TX CRC errs FX CRC errs g g 0 T ADSL Status Mode State Up Speed Down Speed SNR Margin Loop Att READY 0 0 0 0 Dr ay Tek 435 Vigor2860 Series User s Guide Online Status Physical Connection System Uptime 0 24 32 LAN Status IP Address 001 8010 7300 201 210 44FF FE46 2568 64 Global Si TL Be HA TX Packets RX Packets TX Bytes RX Bytes F 4 690 328 WAN IPv Status gt gt Drop PPP Enable Gateway IP 2001 8000 168 1 2001 2000 168 2 TX Packets RX Packets F q Vigor2860 Series User s Guide 436 Dr ay Te k TSPC Tunnel application both IPv6 hosts communicate through IPv4 network Choose TSPC and type the information for TSPC service Note While using such mode you have to make sure the IPv4 network connection is normal In the following figure the TSPC information is obtained fro
106. X509 Local Certificate Congratulation Local Certificate has been imported successfully Please click Back to view the certificate X509 Local Certificate Configuration Name Subject Status Modify draytekdemo O Draytek OU Draytek Sales OK View Delete View Delete View Delete GENERATE IMPORT REFRESH Upload PKCS12 It allows users to import the certificate whose extensions are Certificate usually pfx or p12 And these certificates usually need passwords Note PKCS12 is a standard for storing private keys and certificates securely It is used in among other things Netscape and Microsoft Internet Explorer with their import and export options Upload Certificate and It is useful when users have separated certificates and private Private Key keys And the password is needed if the private key is encrypted REFRESH Click this button to refresh the information listed below View Click this button to view the detailed settings for certificate request a http 192_168 1 1 Certificate Siznm e Request Information Microsoft Internet Explorer Certificate Information Certificate Name server Issuer C TW ST Hsinchu L Hsinchu O Draytek QU MKT CN DT subject emailAddress support idraytek com Subject Alternative Name Valid From Valid To PEM Format Content MITBwetCasuC igauglYIxCchIBoNVEAYTALRENR AWD GYDVOOlEwdIc2 LuYyzhilRiaw Do DVOOQHE wd Ice lLuYzZhitRaw
107. account your SIP service provider will give you an Account Name or user name SIP Registrar Proxy and Domain name The last three might be the same in some case Then you can tell your folks your SIP Address as in Account Name Domain name As Vigor VoIP Router is turned on it will first register with Registrar using AuthorizationUser Domain Realm After that your call will be bypassed by SIP Proxy to the destination using AccountName Domain Realm as identity Note Selection items for Ring Port will differ according to the router you have Vigor2860 Series User s Guide 340 Dr ay Tek VoIP gt gt SIP Accounts aD Ring Port Status 1 7294 8 Phonei U Phones 7294 8 Phonei U Phonez 7294 8 phonei Phones 7294 8 Phonei L Phone2 7294 8 Phonei L Phone 7294 8 Phonei U Phone 7294 8 Phonei LI Phone 7294 8 pPhonei Phones 7294 8 Phonei Phones 7294 8 LC Phonei l Phone 7294 8 Phonei LI Phone 7294 8 Phone U Phonez RB success registered on SIP server fall to register on SIP server SIP Accounts List Index Profile DomainfRealm Proxy AccountName Codec NAT Traversal Setting STUN Server External IP SIP PING Interval Available settings are explained as follows Item Description Dray Tek Index Click this link to access into next page for setting SIP account Profile Display the profile name of the account Domain Realm Display the domain name or IP address of
108. aeni Device Name File Path Schedule 2 Fee fF PFP p jH USB Disk Status USB Disk Connected File Explorer Note If you want to use CPE Maintenance feature you ll have to plug in a USB Disk 3 Click any index number link e g Index 1 CVM gt gt CPE Management gt gt CPE Maintena Managed Devices List CPE Mainte Maintenance Profile List Index Profile Name Devi Vigor2860 Series User s Guide 504 Dr ay Tek 4 The Maintenance profile dialog appears Central VPN Management gt gt CPE Management gt gt Maintanance Profile Profile Name 2850 Enable l Device Name 00507F7D9D00 e Action Type Firmware Upgrade l Config Backup File Path j Contig Restore Index in Schedule Firmware Upgrade Note Action and Idle Timeout settings will be ignored In the field of Profile Name type a name for such maintenance profile check Enable and choose the one you want to perform firmware upgrade from Device Name drop down list From the Action Type choose Firmware Upgrade Type the file path of the newest firmware or click Select to locate it Specify the Schedule profile At last click OK 5 Now anew maintenance profile has been created CWM gt CPE Management gt CPE Maintenance Managed Devices List CPE Maintenance Google Map Refresh Maintenance Profile List Set to Factory Default Index Profile Name Device Name Action FilePath Schedule 2850 OO507F7O900 Firmware Upgrade
109. all the IPs within the range of Start IP and End IP share the speed defined in TX limit and RX limit fields TX limit Define the limitation for the speed of the upstream If you do not set the limit in this field the system will use the default speed for the specific limitation you set for each index RX limit Define the limitation for the speed of the downstream If you do not set the limit in this field the system will use the default speed for the specific limitation you set for each index Add Add the specific speed limitation onto the list above Edit Allow you to edit the settings for the selected limitation Delete Remove the selected settings existing on the limitation list Smart Bandwidth Limit Check this box to have the bandwidth limit determined by the system automatically TX limit Define the limitation for the speed of the upstream If you do not set the limit in this field the system will use the default speed for the specific limitation you set for each index RX limit Define the limitation for the speed of the downstream If you do not set the limit in this field the system will use the default speed for the specific limitation you set for each index Time Schedule Index 1 15 in Schedule Setup You can type in four sets of time schedule for your request All the schedules can be set previously in Application gt gt Schedule web page and you can use the number that you have set in that web p
110. an IP say 192 168 1 10 sends a packet to the WAN side or the Internet the source address of the NAT host will be mapped into either 202 211 100 10 or 203 98 200 10 which IP or mapping is decided by the internal load balancing algorithm With address mapping feature you can manually configure any host mapping to any WAN interface to fit the request In the above example you can configure NAT Host 1 to always map to 202 211 100 10 WAN1 Host 2 to always map to 202 211 100 11 WANT alias Host 3 always map to 203 98 200 10 WAN2 and Group 1 to always map to 202 211 100 10 WANI NAT Address Mapping function lets you specify the outgoing IP address es for one internal IP address or a block of internal IP addresses We will take an example to introduce how to make use of this feature 1 Log into the web user interface of Vigor2860 2 Open WAN gt gt Internet Access For WAN1 choose MPoA Static or Dynamic IP as the Access Mode WAN gt Internet Access Internet Access Access Mlode PPPoE PPPoA None PPPoE PPPoA MPa Static or Dynamic IP WANS one Index Display Name Physical Mode WARM 1 ADSL 7 YDSL2 Details Page Pata Details Page Pots WEARS Ethernet WY AL Note Only one WAN can support IPv6 You can configure DHCP client options here Dray Tek 3 Click the Details Page of WAN 1 to open the following page From the above figure set main WAN IP address as 202 2 1 100 10
111. and type ina fixed IP address in the box of Fixed IP Address MPoA RFC1483 2684 Obtain an IP address automatically Click this button to obtain the IP address automatically Router Name Type in the router name provided by ISP Domain Name Type in the domain name that you have assigned Specify an IP address Click this radio button to specify some data IP Address Type in the private IP address Subnet Mask Type in the subnet mask Gateway IP Address Type in gateway IP address DNS Server IP Address Type in the primary IP address for the router if you want to use Static IP mode If necessary type in secondary IP address for necessity in the future After finished the above settings click OK to save the settings and return to previous page Dr ay Te k 119 Vigor2860 Series User s Guide Advanced Such configuration is applied to upstream packets Such information will be provided by ISP Please contact with your ISP for detailed information WAN gt Multi PVCs Multi PVCs General Advanced Channel QoS Type 1 UBR ATM QoS PCR oo SCR MBS PYC to PVC Binding c e Note 1 If the parameters in the ATM QoS settings are set to zero then their default settings will be used Also PCRimax ADSL Up Speed 53 8 2 Multiple channels may use the same ADSL channel link through the PVC Binding configuration The PVC Binding configuration is only supported for channels using
112. and you shouldn t continue Get me out of here Technical Details Understand the Risks Vigor2860 Series User s Guide 510 Dray Tek With Crome browser you may get the following warning Click Proceed anyway SSL Error amp C Be bttps 192 168 1 1 coi bin user_login cai fid 101 amp src_ip 192 168 1 11 amp target_url www dra vy S A The site s security certificate is not trusted You attempted to reach 192 168 1 1 but the server presented a certificate issued by an entity that is not trusted by your computer s operating system This may mean that the server has generated its own security credentials which Google Chrome cannot rely on for identity information or an attacker may be trying to intercept your communications You should not proceed especially if you have never seen this warning before for this site Help me understand After that the web authentication window will appear Input the user name and the password for your account defined in User Management and click Login erna sip Favorites qi B Suggested Sites E Web Slice Gallery Username Password Internet Protected Mode On ___ ___ ___ Dr ay Tek 511 Vigor2860 Series User s Guide If the authentication is successful the client will be redirected to the original web site that he tried to access In this example it is http www draytek com Furthermore you will get a popped up window
113. any codepage no decoding job of URL will be processed Please use the drop down list to choose a codepage If you do not have any idea of choosing suitable codepage please open Syslog From Codepage Information of Setup dialog you will see the recommended codepage listed on the dialog box Dray Tek P Syslog Utility D Toul Zetun Tell Remon deio Codepage Iiarmmaboa Recovery Hebroik lnfannabon Hel State Windows Veron 30 2600 RECOMMENDED CODE AGE GA AHSDOEH Tred kcal hiis Dags Dia G Pe OD a en Ded a T SS SY by ea ea a Oe Oe Window size It determines the size of TCP protocol O 65535 The more the value is the better the performance will be However if the network is not stable small value will be proper Session timeout Setting timeout for sessions can make the best utilization of network resources However Queue timeout is configured for TCP protocol only session timeout is configured for the data flow which matched with the firewall rule DrayTek Banner Please uncheck this box and the following screen will not be shown for the unreachable web page The default setting is Enabled The requested Web page has been blocked by Web Content Filter Please contact your system administrator for further information Powered by Draytek Strict Security Checking All the packets while transmitting through Vigor router will be filtered by firewall settings configured by Vigor
114. are explained as follows Item Description Profile Display the name of the profile The default profile cannot be renamed Main SSID Display the SSID configured by such wireless profile Security Display the security mode selected by such wireless profile Multi SSID Enable means multiple SSIDs more than one are active Disable means only SSID 1 is active WLAN ACL Display the name of the access control list Rate Control Display the upload and or download transmission rate Dray Te k 317 Vigor2860 Series User s Guide Clone It can copy settings from an existing WLAN profile to another WLAN profile First you have to check the box of the existing profile as the original profile Second click Clone The following dialog will appear 172 16 3 143 2860 docfwlclone htm Mii Was _ 172 16 3 143 2860 docwlclone htm 4 Clone WLAN Profile Setting Original Profile Name Default Remamedas Select Profile Index 1 None v Third choose the profile index to accept the settings from the original profile Forth type a new name in the field of Renamed as Last click Apply to save the settings on this dialog The new profile has been created with the settings coming from the original profile Edit It allows you to modify an existing wireless profile or create a new wireless profile Apply to Device Click it to apply the selected wireless profile to the specified Access Point 5 3 143 2860d
115. as the following Then you can access the Internet eA ADS C a Hello userl login from 192 168 1 11 00 29 46 E D Internet Protected Modei g 100 Note if you block the web browser to pop up any window you will not see such window If the authentication is failed you will get the error message The username or password you entered is incorrect Please login again Username Password l The username or password you entered is incorrect Copyright DrayTek Corp All Rights Reserved Dray Tek Vigor2860 Series User s Guide 512 Dr ay Te k E In above description you access an external web site to trigger the authentication You may also directly access the router s Web UI for authentication Both HTTP and HTTPS are supported for example http 192 168 1 1 or https 192 168 1 1 Replace 192 168 1 1 with your router s real IP address and add the port number if the default management port has been modified If the authentication is successful you will get the Welcome Message that is set in the User Management gt gt General Setup page User Management gt General Setup General Setup Riule Based LIser Based Web Authentication HTTPS Notice User Management will refer to active rules in Data Filter as whitelists and blacklists In User based firewall mode Users match the above lists will not be required for authentication The firewall rules policy
116. be shown Quick Start Wizard Setup OR 5 Now you can enjoy surfing on the Internet Dr ay Tek 45 Vigor2860 Series User s Guide 2 1 3 For WAN3 WAN4 USB WAN3 WAN4 is dedicated to physical mode in USB 1 Choose WAN3 WAN4 as WAN Interface Quick Start Wizard WAN Interface WAN Interface Display Name Physical Mode 2 Then click Next for getting the following page Quick Start Wizard Connect to Internet WAN 3 Internet Access 36 46 ISA Modem PPP mode 3G 4G USB Modem PPP mode Modem Initial String ATS amp FEOVT AT amp O2801S0 0 Default ATRFEOV 12 180280150 0 APN Name Po Available settings are explained as follows Item Description Internet Access Choose one of the selections as the protocol of accessing the internet 3G 4G USB Modem SIM Pin code Type PIN code of the SIM card that will be PPP mode used to access Internet The maximum length of the pin code you can set is 15 characters Modem Initial String Such value is used to initialize USB modem Please use the default value If you have any Vigor2860 Series User s Guide 46 Dr ay Tek question please contact to your ISP The maximum length of the string you can set is 47 characters APN Name APN means Access Point Name which is provided and required by some ISPs Type the name and click Apply Note Such mode is supported by WAN3 only 4G USB Modem SIM Pin code Type PIN code of the SIM card that will be DHCP m
117. bring out different configuration page Refer to the following PPP Dual Stack application IPv4 and IPv6 services can be utilized at the same time Choose PPP and type the information for PPPoE of IPv4 WAN gt gt Internet Access PPTP L2TP IPvG PPP MP Setup PAP or CHAF Static or Dynamic IP O Disable PPP Authentication ISP Access Setup Username 73 7 68635 hinetnet Password Index 1 15 in Schedule Setup tb tL b WAN Connection Detection Mode ARP Detect Ping IP y TTL MTU 1442 Max 1492 OK Idle Timeout Ea secondis IP Address Assignment Method IPCP WAN IP Alias Fixed IP Yes No Dynamic IP Fixed IP Address Default MAC Address Specify a MAC Address MAC Address loo 10 Jaa Yas Er 6A Cancel Access into the setting page for IPv6 service it is not necessary for you to configure anything Vigor2860 Series User s Guide 434 Dray Tek WAN gt gt Internet Access WAN 2 PPPoE Static or Dynamic IP PPTP IL2TP Internet Access Mode Connection Type PPP ka Note IPv4 WAN setting should be PPPoE client Click OK and open Online Status If the connection is successful you will get the IP address for IPv4 and IPv6 at the same time Online Status Physical Connection System Uptime 0 41 17 Pvt LAN Status Primary DNS 166 95 192 1 Secondary DNS 168 95 1 1 IP Address TX Packets RX Packets 192 168 1 1 g 3085
118. button It will be displayed in the Selected User Account on the right box For detailed information about configuring the profile setting refer to Objects Setting gt gt IP Group RADIUS The RADIUS server will do the authentication by using the username and password LDAP Active Directory If it is checked the LDAP AD server will do the authentication by using the username password information stated on the selected profiles If the above three options are enabled the system will do the authentication based on them in sequence After finishing all the settings here please click OK to save the configuration Vigor2860 Series User s Guide z DrayTek 3 17 6 Online User Status If you have finished the configuration of SSL Web Proxy server users can find out corresponding settings when they access into Draytek SSL VPN portal interface Dray Tek Provide SSL WPH SSL Web Proxy SSL Tunnel logout J INFO Main Page id mike You have successfully logged in 1 2 17 1 42 y E elisa ivil l Welcome to DrayTek ou are given the following privileges SaL HA SSL Web Proxy SSL Tunnel Timeout ater 5 minutes Reset Copyright 2006 DrayTek Corp All Rights Reserved Next users can open SSL VPN gt gt Online Status to view logging status of SSL VPN SSL VPN gt Online User Status Refresh Seconds Active User Host IP Time out seconds Action Kate 192 168 30 14 299 Available setti
119. certain amount of resource execute appropriate policing classification or scheduling The core routers in the backbone will do the same checking before executing treatments in order to ensure service level consistency throughout the whole QoS enabled network Private Network DS domain 1 DS domain 2 Dr ay Tek 237 Vigor2860 Series User s Guide However each node may take different attitude toward packets with high priority marking since it may bind with the business deal of SLA among different DS domain owners It s not easy to achieve deterministic and consistent high priority QoS traffic throughout the whole network with merely Vigor router s effort In the Bandwidth Management menu click Quality of Service to open the web page Bandwidth Management gt gt Quality of Service General Setup Setto Factory Default p Class Class Class UDP Online Index Status Bandwidth Direction Others Bandwidth Se 1 2 3 Control Statistics WANI Disable Kkbps kbps 25 Inactive Status WAH Disable 100000Kbps 100000Kbps 25 Inactive Status WAS Disable 100000Kbps 100000Kbps 25 Inactive Status WaARN4 Disable 100000Kbps 100000Kbps 25 Inactive Status Class Rule Index Service Type Class 1 Class 2 i Edit Class 3 Enable the First Priority for VoIP SIP RIP SIP UDF Part 5060 Default 50605 Available settings are explained as follows Item Description General Setup Index Display the WAN interface number that you ca
120. com we 0 seconds Available settings are explained as follows Item Profile Name SMTP Server SMTP Port Sender Address Use SSL Authentication Dray Tek Description Type a name for such mail service profile The maximum length of the name you can set is 31 characters Type the IP address of the mail server The maximum length of the name you can set is 63 characters Type the port number for SMTP server Type the e mail address of the sender Check this box to use port 465 for SMTP server for some e mail server uses https as the transmission method The mail server must be authenticated with the correct username and password to have the right of sending message out Check the box to enable the function Username Type a name for authentication The maximum length of the name you can set is 31 characters Password Type a password for authentication The maximum length of the password you can set is 31 215 Vigor2860 Series User s Guide characters Sending Interval Define the interval for the system to send the SMS out 3 After finishing all the settings here please click OK to save the configuration Object Settings gt SMS Mail Service Object SMS Provider Mail Server Set to Factory Default Index Profile Name Mail Notify si ile 3 7 11 Notification Object This page allows you to set ten profiles which will be applied in Application gt gt SMS Mail Alert Service You c
121. configuration will forbid the wireless cllents associated to the same SSID from connecting to each other The isolate VPN configuration will isolate the wireless traffic fram VPN connections and thus wireless clients will not be able to access the VPN network under this setting Rate Control Enable Upload Download SSID 1 E kbps kbps SSID 2 O kbps kbps SSID 3 O kbps 20000 kbps SSID 4 oO 20000 kbps 20000 kbps Note Configurable upload and download rates are from 100 to 50 000 kbps Associated Schedule Profiles Note Only schedule profiles that have the action Force Down are applied to the WLAN all other actions are ignored Valid settings are profile indexes 1 to 15 Available settings are explained as follows Item Description Enable Wireless LAN Check the box to enable wireless function Mode For 2 4GHz At present the router can connect to 11g Only 11n Only 2 4 GHz Mixed 11b 11g Mixed 11g 11n and Mixed 11b 11g 11n stations simultaneously Simply choose Mixed 11b 11g 11n mode Vigor2860 Series User s Guide 354 Dr ay Te k Channel Hide SSID SSID Isolate Rate Control Dray Tek Mixed 11b 11g 11n Y 11g Only 11n Only 2 4 GHz Mixed 11b 11g Mixed 11a 11n Mixed 11qg 11n d 11a Only 41n Only 5 GHz Mixed 11a 11n For 5 GHz At present the router can connect to 11a Only lIn Only 5 GHz Mixed 11a 11n stations simultaneously Simply choo
122. default setting is 1492 RIP Protocol Routing Information Protocol is abbreviated as RIP RFC1058 specifying how routers exchange routing tables information Click Enable RIP for activating this function WAN IP Network This group allows you to obtain an IP address automatically Settings and allows you type in IP address manually WAN IP Alias If you have multiple public IP addresses and would like to utilize them on the WAN interface please use WAN IP Alias You can set up to 8 public IP addresses other than the current one you are using Dr ay Te k 99 Vigor2860 Series User s Guide Vigor2860 Series User s Guide WAN IP Alias AHAZTE x 0 172 16 3 143 2860 doc vipaliss htm WAN IP Alias Multi NAT Index Enable Aux WAN IP Join NAT IP Pool 0 39 0 150 d a 10 54 0 10 0 0 0 0 0 0 0 0 0 0 0 0 d d LI L L m nm 17 24 25 32 gt gt Obtain an IP address automatically Click this button to obtain the IP address automatically if you want to use Dynamic IP mode Router Name Type in the router name provided by ISP Domain Name Type in the domain name that you have assigned DHCP Client Identifier for some ISP Enable Check the box to specify username and password as the DHCP client identifier for some ISP Username Type a name as username The maximum length of the user name you can set is 63 characters Password Type a password The maximum length of th
123. display the Trunk profiles Set to Factory Default Click to clear all indexes Name Indicate the name of the LAN to LAN profile The symbol represents that the profile is empty Active V means the profile has been enabled X mans the profile has not been enabled Status Indicate the status of individual profiles The symbol V and X represent the profile to be active and inactive respectively To edit each profile Dray Tek 1 Click each index to edit each profile and you will get the following page Each LAN to LAN profile includes 4 subgroups If the fields gray out it means you may leave it untouched The following explanations will guide you to fill all the necessary fields For the web page is too long we divide the page into several sections for explanation VPN and Remote Access gt gt LAN to LAN Profile Index 1 1 Common Settings Profile Name C Enable this profile Call Direction Both Dial Out Dial in Always on Idle Timeout second s C Enable PING to keep alive YPN Dial Out Through WAN First ka Netbios Naming Packet Pass Block Multicast via VPN OPpass Block for some IGMP IP Camera DHCP Relay etc j 2 Dial Out Settings Type of Server am calling PPTP IPsec Tunnel L2TP with IPsec Policy Nons Server IP Host Name for VPN such as draytek com or 123 45 67 89 b025277 ubddns org 219 Username PasswordiMas 15 char ms PPP Authentic
124. does not match further rules will be dropped Pass If No Further Match A packet matching the rule and that does not match further rules will be passed through If the packet matches the filter rule the next filter rule will branch to the specified filter set Select next filter rule to branch from the drop down menu Be aware that the router will apply the specified filter rule for ever and will not return to previous filter rule any more The number typed here is the total sessions of the packets that do not match the filter rule configured in this page The default setting is 60000 Strict Make the MAC address and IP address settings configured in IP Object for Source IP and Destination IP be bound for applying such filter rule No Strict no limitation Choose one of the QoS rules to be applied as firewall rule For detailed information of setting QoS please refer to the related section later Choose the WAN interface for applying Load Balance Policy Such item is available only when Rule Based is selected in User Management gt gt General Setup The general firewall rule will be applied to the user user group all users specified here User Object Create New User User Group Create New Group ALL Note When there is no user profile or group profile existed Create New User or Create New Group item will appear for you to click to create a new one Select an APP Enforcement profile for global IM P2P
125. drop down list if users set several certificates previously Otherwise choose Self signed to use the router s built in default certificate The default certificate can be used in SSL VPN server and HTTPS Web Proxy Encryption Key Choose the encryption level for the data connection in SSL Algorithm VPN server After finishing all the settings here please click OK to save the configuration 3 17 2 SSL Web Proxy SSL Web Proxy will allow the remote users to access the internal web sites over SSL SSL VPN gt SSL Web Proxy SSL Web Proxy Servers Profiles Setto Factory Default Index Name URL Active T x 2 x 3 X 4 x 5 x 6 x i x a x a x Each item is explained as follows Item Description Name Display the name of the profile that you create URL Display the URL Active Display current status active or inactive of such profile Click number link under Index filed to set detailed configuration Vigor2860 Series User s Guide 374 Dr ay Tek SSL VPN gt SSL Web Proxy Profile Index 1 Name URL Host IP Address Access Method Disable Disable 000000 Note URL format must be entered as http raed Port Redirection Domain_name directory where Domain_name is a FODH Available settings are explained as follows Item Name URL Host IP Address Access Method Description Type name of the profile The length of the name is limited to 15 characters Type the address
126. e fo S S e fe Next gt gt mh mn k ad Pd a a a t E m io on Vv wr Available settings are explained as follows Item Description Set to Factory Default Clear all profiles Index Display the profile number that you can configure Name Display the name of the object profile Vigor2860 Series User s Guide 202 Dr ay Tek To set a new profile please do the steps listed below 1 Click the number e g 1 under Index column for configuration in details 2 The configuration page will be shown as follows Objects Setting gt Service Type Object Setup Profile Index 1 Name Protocol Source Port Destination Port Available settings are explained as follows Item Name Protocol Source Destination Port Dray Tek Description Type a name for this profile Maximum 15 characters are allowed Specify the protocol s which this profile will apply to Source Port and the Destination Port column are available for TCP UDP protocol It can be ignored for other protocols The filter rule will filter out any port number when the first and last value are the same it indicates one port when the first and last values are different it indicates a range for the port and available for this profile when the first and last value are the same it indicates all the ports except the port defined here when the first and last values are different it indicates that all the po
127. feature There is no need to pre configure user profile for each user on Vigor router anymore We only need to configure the Groups DN then the Vigor router e g Vigor 3200 series can pass the authentication to LDAP server with the pre defined Group path Below shows the configuration steps 1 Access into the web user interface of the Vigor router 2 Open Applications gt gt Active Directory LDAP to get the following page for configuring LDAP related settings Applications gt gt Active Directory LDAP Active Directory LDAP Setto Factory Default Active Directory General Setup LDAP Profiles Enable Bind Type Regular Mode Server IP Address 1172 16 28 Destination Port Regular DN uid vpntest ou vpnuser dc ms dce draytel Regular Password 1234 There are three types of bind type supported Simple Mode Just simply do the bind authentication without any search action Anonymous Perform a search action first with Anonymous account then do the bind authentication Regular Mode Mostly it is the same with anonymous mode The different is that the server will firstly check if you have the search authority For the regular mode you ll need to type in the Regular DN and Regular Password 3 Create LDAP server profiles Click the Active Directory LDAP tab to open the profile web page and click any one of the index number link If we have two groups RD1 and SHRD on LDAP
128. function variation or IP address or path of the proxy server If you type function variation as URL you have to type corresponding IP address in this filed Such field must match with URL setting There are three modes for you to choose Disable the profile will be inactive If you choose Disable all the web proxy profile appeared under VPN remote dial in web page will disappear Secured Port Redirection such technique applies private port mapping to random WAN port There are two restrictions for proxy web server for such selection 1 it is only used for WAN to LAN access the web server must be configured behind vigor router 2 web server gateway must be indicated to vigor router In addition users must execute Connect manually in SSL Client Portal page SSL if you choose such selection web proxy over SSL will be applied for VPN After finishing all the settings here please click OK to save the configuration Dray Tek 375 Vigor2860 Series User s Guide 3 17 3 SSL Application It provides a secure and flexible solution for network resources including VNC Virtual Network Computer RDP Remote Desktop Protocol SAMBA to any remote user with access to Internet and a web browser SSL VPN gt SSL Application SSL Applications Profiles Set to Factory Default Index Name Host Address Service Active x 2 X 3 X 4 x 5 x 6 X f X a x g x 10 x Each item is explained as follows
129. gt gt Web Content Filter Profile Dashboard Quick Start Wizard Service Activation Wizar Online Status f Web Filter License Activate Status Commtouch Start Date 2012 12 31 Expire Date 2013 01 08 Setup Query Server auto selected Find more WAN LAN Setup Test Server auto selected Find more NAT Firewall User Management Web Content Filter Profile Table Set to Factory Default Coal Setting Profile Name Profile Name Default J 2 6 Web Content Filter Profile 3 7 Bandwidth Management Applications 4 8 VPN and Remote Acces Sel ee Manse Administration Message Max 255 characters Cache L1 L2 Cache v USB Application System Maintenance Diagnostics External Devices lt body gt lt center gt lt br gt lt br gt lt br gt lt p gt The requested Web page lt br gt from SIP lt br gt to URLS lt br gt that is categorized with tCL lt br gt has been blocked by RNAMES Web Content Filter lt p gt Please contact your system administrator for further information lt center gt lt body gt iii gt Admin mode Legend Status Ready SIP Source IP DIP Destination IP URL URL z How to register activate Web Content Filter WCF license Please visit for getting more information How to Register AI AV AS WCE Service Service Activation Wizard http www draytek com user SupportFA QDetail php ID 1955 How to Activate Anti Virus
130. gt Filter Setup Click the Set 2 link and choose the Filter Rule 3 button 5 Check the box of Check to enable the Filter Rule Type the comments e g open_ip Click the Edit button for Source IP Firewall gt Edit Filter Set gt Edit Filter Rule Check to enable the Filter Rule Lomments Indexf 1 15 in Schedule Setup Clear sessions when schedule Op Direction Source IP Destination IP Service Type Fragments Application Action Profile Syslog Filter Block Immediately vw C oe N Vigor2860 Series User s Guide Dray Tek i 6 A dialog box will be popped up Choose Range Address as Address Type by using the drop down list Type 192 168 1 10 in the field of Start IP and type 192 168 1 20 in the field of End IP Then click OK to save the settings The computers within the range can access into the Internet IP Address Edit Address Type Start IP Address End IP Address Subnet Mask Invert Selection IP Group or IP Object or IP Object or IP Object IPvo Group or Pv Object or IPv Object or IP v Object Range Address t 168 1 10 192 168 1 20 7 Now check the content of Source IP is correct or not The action for Filter shall be set with Pass Immediately Then click OK to save the settings Firewall gt Edit Fiter Set gt gt Edit Filter Rule Fiter Set 2 Rule 3 Check to enable the Filter Rule Comments Index 1 15 in Schedule Setup Clear sess
131. happening between 11n systems only In addition it does not have protection mechanism to avoid the conflict with neighboring devices of 802 1 1a b g 20 the router will use 20Mhz for data transmission and receiving between the AP and the stations 20 40 the router will use 20Mhz or 40Mhz for data transmission and receiving according to the station capability Such channel can increase the performance for data transit It is to assure the safety of propagation delays and reflections for the sensitive digital data If you choose auto as guard interval the AP router will choose short guard interval increasing the wireless performance or long guard interval for data transmit based on the station capability 7 DrayTek Aggregation MSDU Aggregation MSDU can combine frames with different sizes It is used for improving MAC layer s performance for some brand s clients The default setting is Enable Long Preamble This option is to define the length of the sync field in an 802 11 packet Most modern wireless network uses short preamble with 56 bit sync field instead of long preamble with 128 bit sync field However some original 11b wireless network devices only support long preamble Click Enable to use Long Preamble if needed to communicate with this kind of devices Packet OVERDRIVE This feature can enhance the performance in data transmission about 40 more by checking Tx Burst It is active only when both sides of Access P
132. has been blocked by Web Content Filter Please contact your system administrator for further information Fowered by DrayTek Dray Tek 491 Vigor2860 Series User s Guide ll Via URL Content Filter A Block the web page containing the word of Facebook 1 Open Object Settings gt gt Keyword Object Click an index number to open the setting page 2 Inthe field of Contents please type facebook Configure the settings as the following figure Objects Setting gt Keyword Object Setup Profile Index 1 Name Contents feccbood D Limit of Contents Max 3 Words and 63 Characters Each word should be separated by a single space You can replace a character with HEX Example Contents backdoo 7 virus keep 2 0o0ut Result 1 backdoor 2 virus 3 keep out 3 Open CSM gt gt URL Content Filter Profile Click an index number to open the setting page 4 Configure the settings as the following figure CSM gt URL Content Filter Profile Profile Index 1 Profile Name Priority Either URL Access Control First Log 1 URL Access Control Enable URL Access Control Prevent web access from IP address Action Group Object Selections 2 Web Feature Enable Restrict Web Feature Action L cookie LJProxy Clupload File Extension Profile 5 When you finished the above steps click OK Then open Firewall gt gt General Setup Vigor2860 Series User s Guide 492 Dr ay Te k
133. is simple to understand and easy to configure gt Filly compliant with VPN Server LAN Sit Single Multi Network gt Mail Alert support please refer to System Maintenance gt gt SysLog Mail Alert for detailed configuration gt Syslog support please refer to System Maintenance gt gt SysLog Mail Alert for detailed configuration gt Specific ERD Environment Recovery Detection mechanism which can be operated by using Telnet command VPN TRUNK VPN Backup mechanism profile will be activated when initial connection of single VPN tunnel is off line Before setting VPN TRUNK VPN Backup mechanism backup profile please configure at least two sets of LAN to LAN profiles with fully configured dial out settings first otherwise you will not have selections for grouping Member and Member 2 Features of VPN TRUNK VPN Load Balance Mechanism VPN Load Balance Mechanism can set multiple VPN tunnels for using as traffic load balance tunnel It can assist users to do effective load sharing for multiple VPN tunnels according to real line bandwidth Moreover it offers three types of algorithms for load balancing and binding tunnel policy mechanism to let the administrator manage the network more flexibly gt Three types of load sharing algorithm offered Round Robin Weighted Round Robin and Fastest gt Binding Tunnel Policy mechanism allows users to encrypt the data in transmission or specified service function in transmission and def
134. local user 399 Vigor2860 Series User s Guide User Name Give a user name for the local user Password Type the password for the local user Confirm Password Type the password again for confirmation Add After typing the user name and password above simply click it to create a new local user The new one will be shown on the Local User List immediately Edit If the username listed on the box above is not satisfied simply click the username and modify it on the field of User Name Later click Edit to update the information Delete If the local user listed on the box above is not satisfied simply click the username and click Delete to remove it Enable Admin Login From Wan The default setting is enabled It can ensure any user accessing into web user interface of Vigor router through Internet by username password of admin admin Administrator LDAP Enable LDAP AD login for Admin users If it is Setting enabled any user can access into the web user interface of Vigor router through the LDAP server authentication LDAP Server Profiles Available profiles will be displayed here under the link of LDAP Profile Setup LDAP Profile Setup It allows you to create a new LDAP profile When you click OK the login window will appear Please use the new password to access into the web user interface again Vigor2860 Series User s Guide 400 Dr ay Tek 3 19 4 User Password This page al
135. name you can set is 63 characters Password Type a password The maximum length of the password you can set is 62 characters Specify an IP address Click this radio button to specify some data IP Address Type in the private IP address Subnet Mask Type in the subnet mask Gateway IP Address Type in gateway IP address Default MAC Address Type in MAC address for the router You can use Default MAC Address or specify another MAC address for your necessity Specify a MAC Address Type in the MAC address for the router manually Type in the primary IP address for the router If necessary type in secondary IP address for necessity in the future 95 Vigor2860 Series User s Guide After finishing all the settings here please click OK to activate them Details Page for PPPoE in WAN2 To choose PPPoE as the accessing protocol of the Internet please select PPPoE from the WAN gt gt Internet Access gt gt WAN2 page The following web page will be shown WAN gt gt Internet Access WAN 2 PPPoE Static or Dynamic IP PPTP L2TP IPG Enable Disable PPP MP Setup PPP 4uthentication PAP or CHAP Idle Timeout zj seconds Service Name Optional sd IP Address Assignment Method IPCP Username Poa BSbs5 Gahinet net WAN IP Alias Password Fixed IP Yes No Dynamic IP Index 1 15 in Schedule Setup Fixed IP address ISP Access Setup Default MAC Address WAN Connection Dete
136. numbers 9 or 10 allowing you to customize the SMS Provider In the web page type the URL string of the SMS provider and type the username and password After clicking OK the new added SMS provider will be added and will be available for you to specify for sending SMS out Object Settings gt gt SMS Mail Service Object Profile Index 9 Profile Name Service Provider clickatell Please contact with your SMS provide to get the exact URL String eg bulksms vsms net 5567 eapi submission send_sms 2 2 0 username gt txtUser amp password txtPwd 8 amp msisdn txtDest 8 amp message txtMsg Username lani23 Quota Sending Interval seconds Dr ay Tek 473 Vigor2860 Series User s Guide 4 9 How to Create an Account for MyVigor The website of My Vigor a server located on http myvigor draytek com provides several useful services such as Anti Spam Web Content Filter Anti Intrusion and etc to filtering the web pages for the sake of protecting your system To access into MyVigor for getting more information please create an account for MyVigor 4 9 1 Create an Account via Vigor Router 1 Click CSM gt gt Web Content Filter Profile The following page will appear CSM gt Web Content Filter Profile Web Filter License Activate Status Not Activated Web Content Filter Profile Table Setto Factory Default Profile Name Profile Name 1 Default 4 2 6 ae E 4 amp Administration Message
137. of external devices In order to control or manage the external devices conveniently open External Devices to make detailed configuration 3 21 1 All Devices External Device gt All Devices External Devices Connected Below shows available devices that connected externally For security reason If you have changed the administrator password on External Device please click the Account button to retype new username and password Otherwise the router will be unable to monitor the External Device device properly Click the Clear button to Clear the off line information and account information Available settings are explained as follows Item Description External Device Auto Check this box to detect the external device automatically Discovery and display on this page From this web page check the box of External Device Auto Discovery Later all the available devices will be displayed in this page with icons and corresponding information You can change the device name if required or remove the information for off line device whenever you want External Device gt gt All Devices External Device Auto Discovery External Devices Connected Below shows available devices that connected externally OnLine Yigor4P900 YigorA4P900 Connection Uptine 18 15 27 IP Address 10 28 60 12 OnLine P2261 Connection Uptime 18 15 17 IP Address 192 168 1 226 For security reason If you have changed the administrator passwor
138. of the password you can set is 31 characters Quota Type the total number of the messages that the router will send out Sending Interval Type the shortest time interval for the system to send SMS After finishing all the settings here please click OK to save the configuration Mail Service Object This page allows you to set ten profiles which will be applied in Application gt gt SMS Mail Alert Service Object Settings gt SMS Mail Service Object SMS Provider Mail Server Set to Factory Default Index Profile Name 1 2 3 4 5 6 F a 9 10 Each item is explained as follows Item Description Set to Factory Default Clear all of the settings and return to factory default settings Index Display the profile number that you can configure Profile Display the name for such mail server profile Vigor2860 Series User s Guide 214 Dr ay Te k To set a new profile please do the steps listed below 1 Click the Mail Server tab and click the number e g 1 under Index column for configuration in details Object Settings gt SMS Mail Service Object SMS Provider Index ie N Mail Server 2 The configuration page will be shown as follows Object Settings gt SMS Mail Service Object Profile Index 1 Profile Name SMTP Server SMTP Port Sender Address Authentication Username Password Sending Interval Mail_Notify 192 166 1 96 came _ni draytek
139. only one key can be selected at a time The keys can be entered in ASCII or Hexadecimal Check the key you wish to use After finishing all the settings here please click OK to save the configuration 3 16 4 Access Control In the Access Control the router may restrict wireless access to certain wireless clients only by locking their MAC address into a black or white list The user may block wireless clients by inserting their MAC addresses into a black list or only let them be able to connect by inserting their MAC addresses into a white list In the Access Control web page users may configure the white black list modes used by each SSID and the MAC addresses applied to their lists Wireless LAN 2 4GHz gt Access Control Access Control Enable Mac Address Filter Fl SSID 1 Fl SSID 2 O ssiIp3 O ssip4 MAC Address Filter Index Attribute MAC Address Apply SSID Client s MAC Address eee Apply SSID O SSID 1 O 551D2 O ssID3 O SsID4 Attribute C s Isolate the station fram LAN Available settings are explained as follows Item Description Enable Mac Address Select to enable the MAC Address filter for wireless LAN Filter identified with SSID 1 to 4 respectively All the clients expressed by MAC addresses listed in the box can be grouped under different wireless LAN For example they Dray Te k 359 Vigor2860 Series User s Guide can be grouped under SSID 1 and SSID 2 at the same time if you check SSID 1 and SSI
140. or the function is working For detailed information about the LED display refer to 1 2 LED Indicators and Connectors 1 7 2 Name with a Link A name with a link e g Router Name Current Time WAN1 and etc below means you can click it to open the configuration page for modification Dray Tek system Information Oo CSCSC iCCrenntTime 2000 Jan 1 Sat 0 28 45 Router Name IPv4 Internet Access Le Line Mode IP Address MAC Address _ _ UpTime WANA 05L2 DHCP Client _ 192 168 10 118 00 1D AA B6 1B 89 0 28 05 WAN2 thernet StaticIP 172 16 3 133 00 1D AA B6 1B BA 0 28 38 wan3 psa Pppp Disconnected 00 1D AA B6 1B BB 00 00 00 Kwang Wise f Disconnected O0 1D AA B6 1B BC 000000 21 Vigor2860 Series User s Guide 1 7 3 Quick Access for Common Used Menu All the menu items can be accessed and arranged orderly on the left side of the main page for your request However some important and common used menu items which can be accessed in a quick way just for convenience Look at the right side of the Dashboard You will find a group of common used functions grouped under Quick Access system Status ynamic DNS TR 069 User Management IM P2F Block Schedule SsysLog Mail Alert LDAP RADIUS Firewall Object Setting Data Flow Monitor The function links of System Status Dynamic DDNS TR 069 User Management IM P2P Block Schedule Syslog Mail Alert LDAP
141. please click OK to save the configuration Vigor2860 Series User s Guide 144 Dr ay Te k 3 2 7 Wired 802 1x IEEE 802 1x is an IEEE Standard for port based Network Access Control PNAC It is part of the IEEE 802 1 group of networking protocols It provides an authentication mechanism for the device that is attached to a LAN or WLAN Wired 802 1x provides authentication for one network device on each LAN port The RADIUS Server settings must be configured before enabling 802 1x because the EAP Extensible Authentication Protocol Authenticator relies on the RADIUS Server in its authentication process Each LAN port with Wired 802 1x configured will only forward 802 1x packets and block all other packets until the authentication has successfully completed LAN gt Wired 802 1 Wired 80 7 1x LAN 802 18 M Enable 02 18 ports lpi Clipz Please note that 802 18 enabled LAN ports will support EAPOL authentication for one network device only Therefore 802 18 enabled LAN ports will have issues when connecting to a Le switch If you want 802 18 support for multiple network devices please disable 802 1 here and configure 802 1 on the connecting switch This feature supports PEAP and EAP TLS Available settings are explained as follows Item Description Enable Check the box to enable LAN 802 1x function 802 1x ports After enabling the function simply specify the LAN port s to apply such function After finishi
142. port Available settings are explained as follows Item Description Enable Click it to enable VLAN configuration LAN P1 P6 Check the LAN port s to group them under the selected VLAN Wireless LAN 2 4GHz SSID1 SSID4 Check the SSID boxes to group them under the selected VLAN Wireless LAN 5GHz SSID1 SSID4 Check the SSID boxes to group them under the selected VLAN Subnet Choose one of them to make the selected VLAN mapping to the specified subnet only For example LAN is specified for VLANO It means that PCs grouped under VLANO can get the IP address es that specified by the subnet Subnet Dr ay Tek 139 Vigor2860 Series User s Guide Permit untagged device in It can help users to communicate with the router still even P1 to access router though configuring wrong VLAN tag setting For Vigor router has one LAN physical port only it is recommended to enable the management port LAN 1 to ensure the data transmission is unimpeded VLAN Tag Enable Check the box to enable the function of VLAN with tag The router will add specific VLAN number to all packets on the LAN while sending them out Please type the tag value and specify the priority for the packets sending by LAN VID Type the value as the VLAN ID number The range is form 0 to 4095 Priority Type the packet priority number for such VLAN The range is from 0 to 7 Note Leave one VLAN untagged at least to prev
143. refer to later section Web Content Filter Profile for detailed information Now follow the steps listed below to activate WCF feature for your router Note Such function is available only for Admin Mode 1 Open Wizards gt gt Service Activation Wizard 2 The screen of Service Activation Wizard will be shown as follows Choose the one you need and click Next In this case we choose to activate free trail edition Service Activation Wizard Select the service type that you want to activate This wizard is used for activating Web Content Filter Please choose the edition you need Free trial edition Formal edition with license key Free trial edition it offers a period of trial for you to get acquainted with WCF function Formal edition with license key you can extend the license valid time manually Note If you activate Formal edition with license key first the free trial edition will be invalid Vigor2860 Series User s Guide 48 Dr ay Te k 3 In the following page you can activate the Web content filter services at the same time or individually When you finish the selection please click Next Service Activation Wizard Select the service type that you want to activate This product provides 30 days of free trial please choose the item s you want to use WCF service Web Content Filter BPjM BPjM is the web content filter based on service operated in Germany We recommend only users l
144. settings specified here and ICMP Service Port also fits the number here such binding tunnel table can be established IGMP means when the source IP destination IP destination port and fragment conditions match with the settings specified here and IGMP Service Port also fits the number here such binding tunnel table can be established Other means when the source IP destination IP destination port and fragment conditions match with the settings specified here with different TCP Service Port UDP Service Port ICMP IGMP such binding tunnel table can be established 295 Vigor2860 Series User s Guide Detail Information This field will display detailed information for Binding Tunnel Policy Below shows a successful binding tunnel policy for load balance YPN Load Balance Advance Settings Mozilla Firefox 192 168 1 1 doc ypntlb htm VPN Load Balance Advance Settings Profile Name 1 Load Balance Algorithm Round Robin Weighted Round Robin Auto Weighted O According to Speed Ratio Member1 Member2 50 50 v VPN Load Balance Policy edit O Insert after Tunnel Bind Table Index 1 64 Active Active Binding Dial Out Profile 1 m Src IP Start 0 0 0 0 End 255 255 255 255 Dest IP Start 0 000 End 255 255 255 255 Dest Port Start ei End 65535 Protocol ANY 0 m o Set OKI Detail Information VPN Load Balance Profile name l J Algorithm Round Robin sNo 1 gt
145. specified for general management Web configuration telnet TRO69 If you choose Management the configuration for this VLAN will be effective for Web configuration telnet TRO69 IPTV The IPTV configuration will allow the WAN us Dray Tek interface to send IGMP packets to IPTV servers WAN Connection Such function allows you to verify whether network Detection connection is alive or not through ARP Detect or Ping Detect Mode Choose ARP Detect or Ping Detect for the system to execute for WAN detection Ping IP If you choose Ping Detect as detection mode you have to type IP address in this field for pinging TTL Time to Live Displays value for your reference TTL value is set by telnet command PPPoE PPPoA Client Enter your allocated username password and authentication parameters according to the information provided by your ISP ISP Name Type in the name of your ISP Username Type in the username provided by ISP in this field The maximum length of the name you can set is 80 characters Password Type in the password provided by ISP in this field The maximum length of the password you can set is 48 characters PPP Authentication Select PAP only or PAP or CHAP for PPP Always On Check it to keep the network connection always Idle Timeout Set the timeout for breaking down the Internet after passing through the time without any action Fixed IP Click Yes to use this function
146. such WAN when it is disabled Note In default each WAN port is enabled After finished the above settings click OK to save the settings WAN 1 with ADSL VDSL Vigor router will detect the physical line is connected by ADSL or VDSL2 automatically Therefore this page allows you is it is not necessary for you to respectively WAN gt General Setup WAN 1 Enable Display Name Physical Mode DSL Mode Physical Type DSL Modem Code Line Speed Kbpsi DownLink UpLink VLAN Tag insertion ADSL Tag value Priority VLAN Tag insertion DSL2 Tag value Priority Active Mode Note 1 The line speed setting of WAN to configure settings for ADSL and VDSL2 at one time That configure different profile settings for ADSL and VDSL2 Yeas w VOSLe VOSL only Default b bP o 0 4095 nr j o 04095 7 Load Balance Interface is available only when According to Line Speed is selected as the Load Balance Mode 2 In OSL auto mode the router will reboot automatically while switching between VOSL2 and ADSL lines Available settings are explained as follows Item Enable Display Name Vigor2860 Series User s Guide Description Choose Yes to invoke the settings for this WAN interface Choose No to disable the settings for this WAN interface Type the description for such interface 76 Dray Tek Dray Tek Physical Mode DSL Mode Physical Type D
147. the SIP registrar server Proxy Display the domain name or IP address of the SIP proxy Account Name Codec server Display the account name of SIP address before Display the codec type for the account Ring Port Specify which port will ring when receiving a phone call Status Show the status for the corresponding SIP account R means such account is registered on SIP server successfully means the account is failed to register on SIP server STUN Server Type in the IP address or domain of the STUN server External IP Type in the gateway IP address 341 Vigor2860 Series User s Guide SIP PING interval The default value is 150 sec It is useful for a Nortel server NAT Traversal Support Click any index link to access into the following page for configuring SIP account VoIP gt SIP Accounts SIP Account Index No 1 Profile Name Po 11 char max Register via L call without Registration SIP Port DomainfRealm Po 63 char max Cl act as outbound proxy Display Name Ps 23 char max j Account Number Name Se 63 char max Ol authentication ID Po 63 char max Password Po 63 char max Expiry Time sec WAT Traversal Support Call Forwarding Time Gut sec Ring Port LJPhonei Li Phones Ring Pattern Prefer Codec LI Single Codec Packet Size Voice Active Detector Available settings are explained as follows Item Description Profile Name Assign a name for this profile for identifying You can
148. the bottom of the page and click Bridge or Repeater Next click Add to Later the MAC address of the AP will be added to Bridge or Repeater field of WDS settings page 370 Dray Tek 3 16 10 Station List Station List provides the knowledge of connecting wireless clients now along with its status code There is a code summary below for explanation For convenient Access Control you can select a WLAN station and click Add to Access Control below Wireless LAN 2 4GHz gt gt Station List Station List Status MAC Address Associated with Status Codes C Connected No encryption Connected WEP Connected WPA Connected WPA2 Blocked by Access Control Connecting Fail to pass WPA PSK authentication oO Ta OPM Note After a station connects to the router successfully it may be turned off without notice In that case it will still be on the list until the connection expires Add to Access Control Client s MAC address Available settings are explained as follows Item Description Refresh Click this button to refresh the status of station list Add Click this button to add current typed MAC address into Access Control Dr ay Tek 371 Vigor2860 Series User s Guide 3 16 11 Station Control Station Control is used to specify the duration for the wireless client to connect and reconnect Vigor router If such function is not enabled the wireless client can co
149. this function If you click Disable this function will be closed and all the settings that you adjusted in this page will be invalid Set up the DSL parameters required by your ISP These settings configured here are specified for ADSL only Multi PVC channel The selections displayed here are determined by the page of Internet Access gt gt Multi PVCs Select M PVCs Channel means no selection will be chosen Encapsulating Drop down the list to choose the type provided by ISP VPI Type in the value provided by ISP VCI Type in the value provided by ISP Modulation Default setting is Multimode Choose the one that fits the requirement of your router 93 Vigor2860 Series User s Guide WAN Connection Detection MTU RIP Protocol Bridge Mode WAN IP Network Settings Vigor2860 Series User s Guide Modulation Mlultimode I 71 412 5 Lite 5 OMT ADSLATS Soe 3 ADSL annex hy ADSLA 6 9972 5 ADSL2 annex NM Multimode Such function allows you to verify whether network connection is alive or not through ARP Detect or Ping Detect Mode Choose ARP Detect or Ping Detect for the system to execute for WAN detection Ping IP If you choose Ping Detect as detection mode you have to type IP address in this field for pinging TTL Time to Live Displays value for your reference TTL value is set by telnet command It means Max Transmit Unit for packet The default setting is 1492 R
150. to choose right name of the printer that you installed onto the router Such step can make correct driver loaded onto your PC When you finish the selection click Next Add Printer Wizard Install Printer Software The manufacturer and model determine which printer software to use Li Select the manufacturer and model of your printer If your printer came with an installation disk click Have Disk If your printer is not listed consult your printer documentation for compatible printer software Manufacturer I Printers AST a Brother HL 1060 BR Sule O Ef This driver is digitally signed Windows Update Tell me why driver signing is important Ca 10 For the final stage you need to go back to Control Panel gt Printers and edit the property of the new printer you have added amp Brother HL 1070 Properties General Sharing Ports Advanced Device Settings 8 Brother HL 1070 Print to the following ports Documents will print to the first free checked port Port Description Printer O 3 250 Standard TCP IP Port Epson Stylus COLOR 1160 O P41 Standard TCP IP Port O P1 Standard TCP IP Port HP Lasenet 1300 O P_1 Standard TCP IP Port O P_1 Standard TCP IP Port M IP_1 Standard TCPAP Fort Brother HL 1070 O PDF Local Port PDF995 11 Select LPR on Protocol type p1 number 1 as Queue Name Then click OK Next please refe
151. users VPN and Remote Access gt gt IPsec Peer Identity x509 Peer ID Accounts Index Name a m m a ei aJ aJ aJ 3J J J j amp le b S 5 Available settings are explained as follows Item Set to Factory Default Index Name Status A Description Click it to clear all indexes KO a a ee ee a ee a es Index SEEBRBREREBRER BEE Setto Factory Default Status x ee a ee ee Click the number below Index to access into the setting page of IPsec Peer Identity Display the profile name of that index Click each index to edit one peer digital certificate There are three security levels of digital signature authentication Fill each necessary field to authenticate the remote peer The following explanation will guide you to fill all the necessary fields Vigor2860 Series User s Guide 272 Dray Tek VPN and Remote Access gt gt IPsec Peer Identity Profile Index 1 Profile Name 77 C Enable this account Accept Any Peer ID Accept Subject Alternative Name Type IP Domain Name E Mail Accept Subject Name Country C State ST Location L Orginization 0 Orginization Unit fOU4 Common Name CN Email E IP Address ka Available settings are explained as follows Item Profile Name Enable this account Accept Any Peer ID Accept Subject Alternative Name Accept Subject Name Description Type the name of the profile The maxi
152. value as the VLAN ID number The range is form 0 to 4095 Priority Type the packet priority number for such VLAN The range is from 0 to 7 You have to select the appropriate Internet access type according to the information from your ISP For example you should select PPPoE mode if the ISP provides you PPPoE interface In addition the field of For ADSL Only will be available only when ADSL is detected Then click Next for next step Dray Tek 31 Vigor2860 Series User s Guide PPPoE PPPoA 1 Choose WANI as WAN Interface and click the Next button you will get the following page Quick Start Wizard Connect to Internet WAH 1 Protocol For ADSL Only Encapsulation Fixed IP IP Address Subnet Mask Default Gateway Primary ONS Second ONS PPPoE PPPOA v PPPoE LLGSNAFP oo 33 Oves NolDynamic IP Available settings are explained as follows Item Description Protocol For ADSL Only Fixed IP IP Address Subnet Mask Default Gateway Primary DNS Vigor2860 Series User s Guide There are two modes offered for you to choose for WANI1 interface PPPoE PPPoA PPPoE PPPoA MPa Static or Dynarnic IP Choose PPPoE PPPOoOA as the protocol Such field is provided for ADSL only You have to choose encapsulation and type the values for VPI and VCI Or click Auto detect to find out the best values PPPoE LLC SNAP PPPoE LLC SNAP PPPoE VC MUX PPPoA LLG SMAP PPPoA E M
153. via the router Assuming the Internet access has been configured and the router works properly use the Main Router to surf the Internet create a private subnet 192 168 10 0 using an internal Router A 192 168 1 2 create a public subnet 211 100 88 0 via an internal Router B 192 168 1 3 have set Main Router 192 168 1 1 as the default gateway for the Router A 192 168 1 2 Before setting Static Route user A cannot talk to user B for Router A can only forward recognized packets to its default gateway Main Router Internet 4 Set Router l Static Route 192 16 E Router 192 168 1 2 Gateway 192 168 1 m Priv 192 1 Goto LAN page and click General Setup select Ist Subnet as the RIP Protocol Control Then click the OK button Note There are two reasons that we have to apply RIP Protocol Control on Ist Subnet The first is that the LAN interface can exchange RIP packets with the neighboring routers via the Ist subnet 192 168 1 0 24 The second is that those hosts on the internal private subnets ex 192 168 10 0 24 can access the Internet via the router and continuously exchange of IP routing information with different subnets Vigor2860 Series User s Guide 134 Dray Tek 2 Click the LAN gt gt Static Route and click on the Index Number 1 Check the Enable box Please add a static route as shown below which regulates all packets destined to 192 168 10 0 will be forwarded to 192 168 1 2
154. voice prompt to A and vigor router B will send the SAS voice prompt to B 2 Then the RTP traffic is secured until the call ends 3 If vigor router A wants to call vigor router B again next time both A and B will not hear any voice prompt again even checking Enable SAS Voice Prompt on web UI It means only the first call between them will have voice prompt Enable SAS Voice Prompt for ex if vigor router A calls vigor router B with checking Enable Secure Phone but not Enable SAS Voice Prompt then 1 After the connection established vigor router A will NOT send SAS voice prompt to vigor router A and vigor router B will NOT send the SAS voice prompt to vigor router B 2 Even no voice prompt but the RTP traffic is still secured until the call ends Note If the incoming or outgoing calls do not match any entry on the phonebook the router will try to make the call being protected But if the call ends up unprotected e g peer side does not support ZRTP SRTP the router will not play out a warning message Dr ay Tek 331 Vigor2860 Series User s Guide Phone Book In this section you can set your VoIP contacts in the phonebook It can help you to make calls quickly and easily by using speed dial Phone Number There are total 60 index entries in the phonebook for you to store all your friends and family members SIP addresses Loop through and Backup Phone Number will be displayed if you are using Vigor2830Vn fo
155. will be seen aM MM 73 32 EAn _ The KAME project Windows Internet Explorer GO cee HE SHD HAO BHEEH Tan HAH KH oe G Ga 7 4 iy Ge The KAME project The KAME project 1998 4 2006 3 Dancing kame by atelier momonge If you can see a turtle dancing on the screen that means IPv6 service is ready for you to access and utilize 445 Vigor2860 Series User s Guide 4 2 How can I get the files from USB storage device connecting to Vigor router Files on USB storage device can be reviewed by opening USB Applicaiton gt gt File Explorer If it is necessary for you to delete copy files on the device or write paste files to the devcie it must be done through SAMBA server or FTP server Samba service is based on the original USB FTP service You will need to setup USB FTP first We would like to give brief instructions on USB FTP setup here 1 Plug the USB device to the USB port on the router Make sure Disk Connected appears on the Connection Status as the figure shown below USB Application gt gt USB Disk Status USB Mass Storage Device Status Connection Status Disk Connected Disconnect USB Disk Write Protect Status Wo Disk Capacity 2009 MB USB Disk Users Connected Refresh Index Service IP Address Port Username Note If the write protect switch of USB disk is turned on the USB disk is in READ ONLY mode No d
156. will overwrite the settings of P1 at LAN gt gt VLAN page Available settings are explained as follows Item Description General Setup Allow to configure settings for each subnet respectively Index Display all of the LAN items Status Basically LAN1 status is enabled in default LAN2 LAN6 and IP Routed Subnet can be observed by checking the box of Status DHCP LANI is configured with DHCP in default If required please check the DHCP box for each LAN IP Address Display the IP address for each LAN item Such information is set in default and you can not modify it Details Page Click it to access into the setting page Each Dr ay Tek 123 Vigor2860 Series User s Guide LAN will have different LAN configuration page Each LAN must be configured in different subnet IP v6 Click it to access into the settings page of IPv6 Advanced DHCP packets can be processed by adding option number and data information when such function is enabled LAN gt gt General Setup DHCP Server Options Status Options List Enable Interface Option Enable All LAN1 LSN2 LANS LSN4 LANS LANG DMZ IP Routed Subnet Interface Oo Oo o o o Oo Option Number DataType ASCII Character EX Option 18 Data path Hexadecimal Digit EX Option 18 Data 2f70617468 O Address List EX Option 44 Data 172 16 2 10 172 16 2 20 Data Add Enable Disable Enable Disable the function of DHCP
157. will still valid Otherwise authentication required for users not matched the above lists The firewall rules designated in the user profile s policy will still valid Landing Page Max 255 characters Preview Setto Factory Default lt body stats ls gt lt script lanquage jJavascript gt window lacation http am draytek com lt scripte lt hody gt With the default setup lt body stats 1 gt lt script language javascript gt window location http www draytek com lt script gt lt body gt you will be redirected to http www draytek com You may change it if you want For example you will get the following welcome message if you enter Login Successful in the Welcome Message table E https 192 168 1 DA _migt_redir htm Windows inteme A Explorer a gt wie ae a ere GEL 3K ere JF Se bites 1922681 uoc yt Certif ie sal pe we Favorites qig E Suggested Sitesv jB Web Slice Gallery A https 192 168 11 doc u to GE ge Pager Safetye Toos Q El Pop up blocked To see this pop up or additional options click here ey Internet Protected Mode On Also you will get a Tracking Window if you don t block the pop up window Dray Te k 513 Vigor2860 Series User s Guide E Don t setup a user profile in User Management and a VPN Remote Dial in user profile with the same Username Otherwise you may get u
158. with IPv6 address will be forwarded to the destination of IPv6 network Translation Such feature is active only for the user who uses IPv4 to communicate with other user using IPv4 service Before configuring the settings on Vigor2860 you need to know which connection type that your IPv6 service used I Configuring the WAN Settings For the IPv6 WAN settings for Vigor2860 there are five connection types to be chosen PPP TSPC AICCU DHCPv6 Client and Static IPv6 l Dray Tek Access into the web user interface of Viogr2860 Open WAN gt gt Internet Access Choose one of the WAN interfaces as the one supporting IPv6 service Then click the IPv6 button of the selected WAN WAN gt Internet Access Internet Access Index Display Name Physical Mode Access Mode WAN1 ADSL VDSL Static or Dynamic IP Details Page WAN Ethernet PPPoE w Details Page wana use Data Page Note Only one WAN can support IPv6 433 Vigor2860 Series User s Guide Note Only one WAN interface support IPv6 service at one time In this example WAN2 is chosen as the one supporting IPv6 service 2 In the following figure use the drop down list to choose a proper connection type WEAN gt Internet Access o WAN 1 PPPoE PPPoA Internet Access Mode MPoA Static or Dynamic IP IPvo Ofline PPP TSP Connection Type AlCCU DHCPY6 Client Static Pv 6in4 Static Tunnel Ard Different connection types will
159. you each time you connect to it and request In some case your ISP provides service to always assign you the same IP address whenever you request In this case you can fill in this IP address in the Fixed IP field Please contact your ISP before you want to use this function WAN IP Alias If you have multiple public IP addresses and would like to utilize them on the WAN interface please use WAN IP Alias You can set up to 8 public IP addresses other than the current one you are using Dr ay Te k 91 Vigor2860 Series User s Guide WANLIP Alias AHAZTE alal x 0 172 16 3 143 2960 docvipalias htm WAN1 IP Alias Multi NAT Index Enable Aux WAN IP Join NAT IP Pool d LI d d d E ad nm 17 24 25 32 gt gt Fixed IP Click Yes to use this function and type in a fixed IP address in the box of Fixed IP Address Default MAC Address You can use Default MAC Address or specify another MAC address by typing on the boxes of MAC Address for the router Specify a MAC Address Type the MAC address for the router manually Index 1 15 in Schedule Setup You can type in four sets of time schedule for your request All the schedules can be set previously in Applications gt gt Schedule web page and you can use the number that you have set in that web page After finishing all the settings here please click OK to activate them Details Page for MPoA Static or Dynamic IP in WAN1 Physical Mode ADSL M
160. 0 0 0 which means the Vigor router will get a PPP IP address from the remote router during the IPCP negotiation phase If the PPP IP address is fixed by remote side specify the fixed IP address here Do not change the default value if you do not select PPTP or L2TP Remote Gateway IP This field is only applicable when you select PPTP or L2TP with or without IPsec policy above The default value is 0 0 0 0 which means the Vigor router will get a remote Gateway PPP IP address from the remote router during the IPCP negotiation phase If the PPP IP address is fixed by remote side specify the fixed IP address here Do not change the default value if you do not select PPTP or L2TP Remote Network IP Remote Network Mask Add a Static route to direct all traffic destined to this Remote Network IP Address Remote Network Mask through the VPN connection For IPsec this is the destination clients IDs of phase 2 quick mode Local Network IP Local Network Mask Display the local network IP and mask for TCP IP configuration You can modify the settings if required More Add a static route to direct all traffic destined to more Remote Network IP Addresses Remote Network Mask through the VPN connection This is usually used when you find there are several subnets behind the remote VPN router z6 DrayTek LAN to LAN Profile Windows Internet Explorer Profile Index 1 Remote Network Network IP Netmask 255 255 255 255
161. 0 profiles for IPv6 static route Click the IPv6 tab to open the following page LAN gt Static Route Setup IPv4 IPv6 Setto Factory Default View IPv6 Routing Table Index Destination Address Status Index Destination Address Status 1 0 x 11 0 x 2 n0 x 12 0 x oe 7 0 x 13 0 x 4 0 x 14 0 x 5 7 0 x 15 7 0 x 6 0 x 16 0 x i rT x If 0 x a 0 x 16 0 x 5 0 x 19 0 x 10 0 x 20 0 x lt lt 1 20 21 40 gt gt Next Status v Active x Inactive Empty Available settings are explained as follows Item Description Index The number 1 to 40 under Index allows you to open next page to set up Static route Destination Address Displays the destination address of the static route Status Displays the status of the static route Set to Factory Default Clear all of the settings and return to factory default settings Viewing IPv6 Routing Displays the routing table for your reference Table Click any underline of index number to get the following page Vigor2860 Series User s Guide 136 Dr ay Tek LAN gt Static Route Setup Index No 1 C Enable Network Interface LAN Delete Available settings are explained as follows Item Description Enable Click it to enable this profile Destination IPv6 Address Type the IP address with the prefix length for this entry Prefix Len Gateway IPv6 Address Type the gateway address for this entry
162. 00Kbps 100000Kbps 25 25 Inactive Status WaAN4 Disable 100000Kbps 100000Kbps 25 25 Inactive Status Class Rule Index Rule Service Type Class 1 Class 2 Edit Class 3 i Enable the First Priority for VoIP SIP RIP SIP UDF Part 5060 Default 50605 3 In the following page type a name e g VoIP for such class and click Add Bandwidth Management gt Quality of Service Class Index DiffServ CodePoint 1 Empty 7 3 4 Check the box of ACT Click Edit to specify the local address Bandwidth Management gt gt Quality of Service NO Status Local Address Remote Address Service Type Rule Edit ACT Thernet Type IPw4 OIPv6 DiffServ CodePoint ANY ka Service Type Predefined Note Please choose setup the Service Type first 5 In the pop up window choose Range Address as the Address Type and type the start IP address and end IP address in relational fields Click OK to save the settings and exit the window Vigor2860 Series User s Guide 454 Dr ay Te k Ethernet Type IPw4 Address Type Start IP Address End IP Address Subnet Mask 6 Click OK again to save the settings Bandwidth Management gt gt Quality of Service Rule Edit ACT Ethernet Type I1Pv4 IPv6 Local Address Remote Address DiffServ CodePoint Service Type Predefined v Note Please choose setup the Service Type first ora 7 The class rule for VoIP has been set Click OK to return t
163. 1 Hane Enable Py pe Ja JA LANT Ho Ethemet WANI None Enable Pi Pa ipa Pp Bt No Ethemet WAHL Nore Enable lpi lP pa Op 3 Setup connection of WAN 4 and bind the senace onto it 21 7ag value must be sat between 1 4095 and unique f each channel l 2 Only one channel can be untagged aqual to 0 sical Members Orpi Op Cpa lOps ops Note 3 P1 is reserged for NAT use and cannot be configured for bridge mode NO need to enable Port based Bridge a PAP ar CHAF Authentication J Always On Idle Timeout L E second s 4 Go to Application gt IGMP to bind it on PVC WAN IGMP Proxy is to act as a multicast proxy fo will access any multicast group But this fir eias come mu erat wima MNUE UT BE Ep ELA Enable IGMP Snooping Enable IGMP Snooping multicast traffic is only forwarded to ports that have members of that group Disable IGMP snooping multicast trafie is treated in the same manner as broadcast traffic Dray Te k 533 Vigor2860 Series User s Guide Bridge mode with VLAN Se1 0p Hox lt 7 Muhi VLAH General Channel Enable WAN Type VLAN Tan Port based Bridge 1 Yeas Ethermet WANI Nore Z Yes Ethermet WANZ Nore a No Ethermet WAN1 Nore Enable PiL Palpa ipa ips 4 No Etherneti WANI Nore Enable Pi lp leg O0 p4 OPs 5 WANS No See ea e z o m m E WANG Ho Miulti LAN Chanrvel 3 Enable Disable LWANT No WAN Type Ethemet WANT 8 No General S
164. 1 sb O USB 2 Quick Access System Status TR 069 _User Management IMP2P Block Schedule SysLoqg Mail Alert LDAP RADIUS a pa S di 1 7 1 Virtual Panel On the top of the Dashboard a virtual panel simulating the physical panel of the router displays the physical interface connection It will be refreshed every five seconds When you move and click the mouse cursor on LEDs except ACT USB ports VDSL ADSL WAN2 or LANI LAN6 related web setting page will be open for you to configure if required Dashboard ACT WAN2 QoS da VDSL2 Security Firewall J 6 os oa zH ret SESE TITTI CLs uen 2 3 4 5 6 Reset USB2 VPN DoS VOSUADSL WAN2 Giga GigaLAN gt 1 Irae T ste Vigor2 o Di Ww Lek igor2860 Vigor2860 Series User s Guide 20 Dr ay Tek Port Ethernet Port WAN LAN VDSL ADSL USB LED left side Color Explanation Displayed Black It means such port is disconnected Green It means such port is connected with Giga transmission rate physically Orange It means such port is connected physically Black It means such port is disconnected Green It means such port is connected with VDSL Orange It means such port is connected with ADSL Black It means no USB device is connected Green It means a USB device is connected Black It means the router or the function is not working Green It means the router
165. 1 ie 64 Bytes from 192 165 1 1 tomposege4 ttl 255 timesh 7 ME AC 192 166 1 1 ping statistics E pockets transmitted 5 packets received 0 pocket loss round trip minfavgenax B 697 A 7235 8 755 te Vigori draytek jj 5 4 Checking If the ISP Settings are OK or Not Open WAN gt gt Internet Access page and then check whether the ISP settings are set correctly Click Details Page of WAN1 WAN4 to review the settings that you configured previously R6 WAN gt gt Internet Access Dashboard Internet Access Wizards Online Status ei Index Display Namek i G GUE A OGUE ADSL VDSL2 PPPoE PPPoA Details Page Ethernet Static or Dynamic IP j Details Page WAN Internet Access USB None USB None Note Only one WA Objects Setting You can configure DHCP client options here 5 5 Problems for 3G Network Connection When you have trouble in using 3G network transmission please check the following Check if USB LED lights on or off You have to wait about 15 seconds after inserting 3G USB Modem into your Vigor2860 Later the USB LED will light on which means the installation of USB Modem is successful If the USB LED does not light on please remove and reinsert the modem again If it still fails restart Vigor2860 USB LED lights on but the network connection does not work Check the PIN Code of SIM card is disabled or not Please use the utility of 3G
166. 17 2 18 3 19 4 20 5 21 6 22 i 23 8 24 9 25 10 26 a 27 12 28 14 30 15 31 Available settings are explained as follows Item Description Set to Factory Default Clear all profiles Index Display the profile number that you can configure Name Display the name of the group profile To set a new profile please do the steps listed below l 2 The configuration page will be shown as follows Dray Tek Objects Setting IPv6 Group Profile Index 1 Available IPv6 Objects 4 Selected IPv6 Objects Clear Cancel Available settings are explained as follows 201 Click the number e g 1 under Index column for configuration in details Vigor2860 Series User s Guide Item Description Name Type a name for this profile Maximum 15 characters are allowed Available IPv6 All the available IPv6 objects with the specified interface Objects chosen above will be shown in this box Selected IPv6 Objects Click gt gt button to add the selected IPv6 objects in this box 3 After finishing all the settings please click OK to save the configuration 3 7 5 Service Type Object You can set up to 96 sets of Service Type Objects with different conditions Objects Setting gt Service Type Object Service Type Object Profiles Set to Factory Default Index Name Index Name 17 18 k k k k k _ a s F 5 la la l le S E is e m e I e e Is e R S e le S l
167. 2 teM Data is encrypted HMERMEER Data isn t encrypted 4 4 How to Optimize the Bandwidth through QoS Technology Have you ever gotten any problems in uploading downloading files Voice video or email data only with the narrow districted bandwidth you may share from the common Internet connection line The advanced bandwidth management technology QoS Quality of Service helps you to well allocate the bandwidth upon your demand of Voice Video or Data transferring Let s see how to get the optimum bandwidth per your request by using DrayTek Vigor router as below Scenario The Internet connection you got from ISP line is 2MB 512Kb There are VoIP telephony network IPTV set top box and data server at your home Assume you want to allocate 30 of the bandwidth you got to VoIP demand 50 for IPTV 15 for mail data 5 for others Let s see how easily it is to do the setting as below 1 Open Bandwidth Management gt gt Quality of Service Dandy es sions Limit Sandwidth Limit 2 You will get the following page Click the Edit link for Class 1 Dr ay Tek 453 Vigor2860 Series User s Guide Bandwidth Management gt gt Quality of Service General Setup Setto Factory Default Class Class Class ORP Index Status Bandwidth Direction Others Bandwidth 1 2 3 Control Online Statistics WANI Disable Kkbps kbps 25 25 Inactive Status WAH Disable 100000Kbps 100000Kbps 25 25 Inactive Status WANS Disable 1000
168. 2860 Series User s Guide 1403 Route IP LLC 483 Bridged IP LLC 1463 Route IP LLCO YE MUS 1483 Bridged IP WC Mux 1483 Routed IP VC MuxilPoA 1403 Bridged IP IPoE LLOSSNAP Add VLAN Header Check the box to enable the following two options VLAN Tag Type the value as the VLAN ID number Valid settings are in the range from 1 to 4095 The network traffic flowing on each channel will be identified by the system via their VLAN Tags Channels using the same WAN type may not configure the same VLAN tag value Priority Choose the number to determine the packet priority for such VLAN The range is from 0 to 7 ATM OoS QoS Type Select a proper QoS type for the channel Type the values for PCR SCR and MBS respectively Bridge mode Enable Click it to enable Bridge mode for such channel Physical Members Group the physical ports by checking the corresponding check box es for applying the bridge connection After finished the above settings click OK to save the settings WAN links for Channel 5 6 and 7 are provided for router borne application such as TR 069 The settings must be applied and obtained from your ISP For your special request please contact with your ISP and then click WAN link of Channel 5 6 or 7 to configure your router Vigor2860 Series User s Guide 116 Dr ay Tek WAN gt Multi PVCs gt gt Channel 5 Multi P C Channel 5 Enable Disable WAR Type General Sett
169. 3 OO 4 O d 6 O alee iy d is O 19 O 20 6 Note hatch Prefix Mode OP Number Min Len lax Len Route e e e o A nd E a a sw E j a Bn Bd FS E Roe a dd sw nn Kee En Bn Bi Sw nnn ee 9 nd Bd Pd Fw Po ore J Pe es Po None AE e 2 ess Po one JP es Po ore J LO 2 Bd es 1 The length for Min Len and Max Len flelds should be between O 25 2 Wildcard is supported Available settings are explained as follows Move Move Up Ss amp E T 7 S amp EE E g E 7 Ss amp E T 7 Down Down Down Down Down Down Down Down Down Down Down Item Description Enable Check this box to invoke this setting Match Prefix It is used to match with the number you dialed and can be modified with the OP Number by the mode add strip or replace Mode None No action Vigor2860 Series User s Guide Add When you choose this mode the OP number will be added with the prefix number for calling out through the specific VoIP interface Strip When you choose this mode the OP number will be deleted by the prefix number for calling out through the specific VoIP interface Take the above picture Prefix Table Setup web page as an example the OP number of 886 will be deleted completely for the prefix number is set with SS6 Replace When you choose this mode the OP number will be replaced by the prefix number for calling out through the speci
170. 3G USB modem for network connection Vigor2860 series provides two level management to simplify the configuration of network connection The user mode allows user accessing into WEB interface via simple configuration However if users want to have advanced configurations they can access into WEB interface through admin mode Dr ay Tek 1 Vigor2860 Series User s Guide 1 1 Web Configuration Buttons Explanation Several main buttons appeared on the web pages are defined as the following ots Save and apply current settings Cancel Cancel current settings and recover to the previous saved settings Teei Clear all the selections and parameters settings including selection from drop down list All the values must be reset with factory default settings Add Add new settings for specified item Edit Edit the settings for the selected item Delete Delete the selected item with the corresponding settings Note For the other buttons shown on the web pages please refer to Chapter 3 4 for detailed explanation Vigor2860 Series User s Guide 2 Dr ay Tek 1 2 LED Indicators and Connectors Before you use the Vigor router please get acquainted with the LED indicators and connectors first 1 2 1 For Vigor2860 D USBI DSL WCF Factory Reset USB2 VPN DoS amp SB VDSUADSL LED Status ACT Activity USB1 2 WAN Off DSL Blinking VPN Qos DoS LED on Connector Left WAN2 LED Giga Right LED Off Lef
171. 47 Vigor2860 Series User s Guide 3 3 Load Balance Route Policy Load Balance Route Policy Cisco called it policy based routing is a feature where a set of rules or policies are defined first Then if there comes a packet that matches any one of the policies it will be directed to the specified interface Load Balance Route Policy Load Balance Route Policy Index Enable Protocol Interface Any WAND Any WAN 1 Any WANI Any WANI Any WANI Any WANI Any WAT 1 Any WANI WANI WAMI 1 2 5 4 2 G f g I i t Set to Factory Default Src Src Dest Dest Interface Dest IP Address IP IP Dest IP End Port Port Move Move StartEnd tart Start End Y Down 172 16 3 133 Any Any 172 16 0 1 172 17 35 253 Any Any Down Any Any Ary Ary Any Any l Down Down Down Down Down own own wizard Mode most frequently used settings in three pages Advance Mode all settings in one page Available settings are explained as follows Item Index Enable Protocol Interface Interface Address Src IP Start Src IP End Dest IP Start Dest IP End Dest Port Start Dest Port End Move UP Move Down Wizard Mode Advance Mode Vigor2860 Series User s Guide Description Click the number of index to access into the configuration web page Check this box to enable this policy Display the protocol used for this policy Display the interface to send packets to once the policy is matche
172. 60 Series User s Guide Available settings are explained as follows Item Description Name Address Type Mac Address Start IP Address End IP Address Prefix Length Invert Selection Type a name for this profile Maximum 15 characters are allowed Determine the address type for the IPv6 address Select Single Address if this object contains one IPv6 address only Select Range Address if this object contains several IPv6s within a range Select Subnet Address if this object contains one subnet for IPv6 address Select Any Address if this object contains any IPv6 address Select Mac Address if this object contains Mac address Range Address Any Address single Address Range Address Subnet Address Mac Address Type the MAC address of the network card which will be controlled Type the start IP address for Single Address type Type the end IP address if the Range Address type is selected Type the number e g 64 for the prefix length of IPv6 address If it is checked all the IPv6 addresses except the ones listed above will be applied later while it is chosen 3 After finishing all the settings please click OK to save the configuration Vigor2860 Series User s Guide 200 Dray Tek 3 7 4 IPv6 Group This page allows you to bind several IPv6 objects into one IPv6 group Objects Setting gt IPv6 Group IPv6 Group Table Set to Factory Default Index Name Index Name 1
173. 78 or 64 Hexadecimal digits leading by Ox such as Ox321253abcde Check the box to use the same settings configured above Wireless 5GHz Settings Name Mode Channel Security Key Next Vigor2860 Series User s Guide Type the SSID name of this router for wireless 5GHz At present the router can connect to Ila Only 11n Only and Mixed 11a 11n stations simultaneously Mixed 11a 11n Tia Only Tin Only f GHz Mixed 11atiini Means the channel of frequency of the wireless LAN The default channel is 6 You may switch channel if the selected channel is under serious interference If you have no idea of choosing the frequency please select Auto to let system determine for you The wireless mode offered by this wizard is WPA2 PSK The WPA encrypts each frame transmitted from the radio using the key which either PSK Pre Shared Key entered manually in this field below or automatically negotiated via 802 1x authentication Either 8 63 ASCII characters such as 012345678 or 64 Hexadecimal digits leading by Ox such as 0x321253abcde Click it to get into the next setting page 64 Dray Tek Cancel Exit the wireless wizard without saving any changes 3 After typing the required information click Next The settings in the page limit the wireless station guest accessing into Internet but not being allowed to share the LAN network and VPN connection Wireless Wizard Guest AP
174. 9 Vigor2860 Series User s Guide 3 16 9 AP Discovery Vigor router can scan all regulatory channels and find working APs in the neighborhood Based on the scanning result users will know which channel is clean for usage Also it can be used to facilitate finding an AP for a WDS link Notice that during the scanning process about 5 seconds This page 1 which is in no client is allowed to connect to Vigor s used to scan the existence of the APs on the wireless LAN Yet only the AP the same channel of this router can be found Please click Scan to discover all the connected APs Wireless LAN 2 4GHz gt Access Point Discovery Access Point List BSSID Channel SSID See Statistics Note During the scanning process 5 seconds no station is allowed to connect with the router Add to WDS Settings AP s MAC address Beene Bridge Repeater Available settings are explained as follows Item Scan Statistics Add to Vigor2860 Series User s Guide Description It is used to discover all the connected AP The results will be shown on the box above this button It displays the statistics for the channels used by APs Wireless LAN gt gt Site Survey Statistics Recommended channels for usage 123456789 101112 13 AP number v s Channel 1 2 3 4 5 6 7 8 9 10 11 12 13 14 Channel Cancel If you want the found AP applying the WDS settings please type in the AP s MAC address on
175. AC Address You can use Default MAC 97 Vigor2860 Series User s Guide Address or specify another MAC address by typing on the boxes of MAC Address for the router Specify a MAC Address Type the MAC address for the router manually After finishing all the settings here please click OK to activate them Details Page for Static or Dynamic IP in WAN2 For static IP mode you usually receive a fixed public IP address or a public subnet namely multiple public IP addresses from your DSL or Cable ISP service providers In most cases a Cable service provider will offer a fixed public IP while a DSL service provider will offer a public subnet If you have a public subnet you could assign an IP address or many IP address to the WAN interface To use Static or Dynamic IP as the accessing protocol of the internet please click the Static or Dynamic IP tab The following web page will be shown WAN gt gt Internet Access WAN 2 PPPoE Static or Dynamic IP PPTP L2TP IPv6 Enable Disable WAN IP Network Settings WAN IP Alias Obtain an IP address automatically Keep WAN Connection L Enable PING to keep alive PING to the IP fs ener ere Required for some ISPs imams 0 minute s DHCP Client Identifier for some ISP Enable WAN Connection Detection Mode ARP Detect Username e man Password TTL Specify an IP address IP Address 172 16 3 130 MTU 1442 Max 1500 Subnet Mask 255 2550 0 RIF Prot
176. AN Profiles Setto Factory Default View All Trunk Index Name Active Status Index Name Active Status 1 x at x 2 x ane 16 x bee 2 x 19 x 4 x a 20 x 5 x 31 x 6 x ate 22 x 3 Click any index number to open the configuration page Type a name which is easy for identification for such profile in this case type VPN Client and check the box of Enable This Profile For such Vigor router will be set as a client the call direction shall be set as Dial out Check the box of Always on for a permanent VPN connection VPN and Remote Access gt gt LAN to LAN Profile Index 1 1 Common Settings Call Direction Both Dial Out Dial in VPN Client a Profile Name Enable this profile fF CEE Idle Timeout 1 second s VPN Dial Out Through WANT First M O Enable PING to keep alive Netbios Naming Packet Pass Block PING to the IP tS Multicast via VPN Pass Block for some IGMP IP Camera DHCP Relay etc Dray Te k 451 Vigor2860 Series User s Guide 4 Now navigate to the next section Dial Out Settings to select the IPsec Tunnel service and type the remote server IP host name e g 218 242 133 91 in this case Press the IKE Pre Shared Key button to set the PSK and select Medium AH or High ESP as the security method 2 Dial Out Settings Type of Server am calling Username 77 PPTP Password f IPsec Tunnel PPP Authentication P CHA
177. Available settings are explained as follows Item Description Name Type a name for this profile Maximum 15 characters are allowed Available Service All the available service objects that you have added on Type Objects Objects Setting gt gt Service Type Object will be shown in this box Selected Service Type Click gt gt button to add the selected IP objects in this box Objects 3 After finishing all the settings please click OK to save the configuration Dr ay Tek 205 Vigor2860 Series User s Guide 3 7 7 Keyword Object You can set 200 keyword object profiles for choosing as black white list in CSM gt gt URL Web Content Filter Profile Objects Setting gt gt Keyword Object Keyword Object Profiles Index Name Index Name 1 1 2 18 ER 19 4 20 5 21 6 22 t 23 8 24 ED 25 10 26 11 27 12 28 13 29 14 30 15 a1 16 32 lt lt 1 32 33 64 65 96 97 128 129 160 161 192 193 200 gt gt Next gt gt Available settings are explained as follows Item Description Set to Factory Default Clear all profiles Index Display the profile number that you can configure Name Display the name of the object profile Vigor2860 Series User s Guide 206 Dr ay Tek To set a new profile please do the steps listed below 1 Click the number e g 1 under Index column for configuration in details 2 The configuration page will be shown as follows Objects Setting Keyword O
178. Click OE to start the TFTP server Open the Firmware Upgrade Utility or other 3 party TFTP client software Check that the firmware filename is correct Click Upgrade on the Firmware Upgrade Utility to start the upgrade 4tter the upgrade is compelete the TFTP server will automatically stop running Do you want to upgrade firmware Click OK The following screen will appear Please execute the firmware upgrade utility first System Maintenance gt gt Firmware Upgrade A TFP server is running Please execute a Firmware Upgrade Utility software to upgrade router s firmware This server will be closed by itself when the firmware upgrading finished For the detailed information about firmware update please go to Chapter 5 Dr ay Tek 417 Vigor2860 Series User s Guide 3 19 13 Modem Code Upgrade This function is used to upgrade modem code if you find built in modem code 1s not suitable for Vigor router Contact with your dealer for further assistance if required System Maintenance gt gt Modem Code Upgrade Web DSL Modem Code Upgrade Select a modem code file telase lS Se Click Upgrade to upload the file Upgrade 3 19 14 Activation There are three ways to activate WCF on vigor router using Service Activation Wizard by means of CSM gt gt Web Content Filter Profile or via System Maintenance gt gt Activation After you have finished the setting profiles for WCF refer to Web Content Filter P
179. Click OK LAN gt gt Static Route Setup Index No 1 C Enable Destination IP Address Subnet Mask Gateway IP Address Network Interface Note WANS WANG WN are router borne WANS Available settings are explained as follows Item Description Enable Click it to enable this profile Destination IP Type an IP address as the destination of such static route Address Subnet Mask Type the subnet mask for such static route Network Interface Use the drop down list to specify an interface for such static route 3 Return to Static Route Setup page Click on another Index Number to add another static route as show below which regulates all packets destined to 211 100 88 0 will be forwarded to 192 168 1 3 Click OK LAN gt Static Route Setup Index No 1 Destination IP Address 211 100 88 0 Subnet Mask 255 755 255 0 Gateway IP Address 192 168 1 3 Network Interface LAN 4 Note WANS WANG VAN are router borne WANS Dr ay Tek 135 Vigor2860 Series User s Guide 4 Go to Diagnostics and choose Routing Table to verify current routing table Diagnostics gt gt View Routing Table Current Running Routing Table IPv6 Routing Table Refresh C connected 5 static R RIP default private 192 168 10 07 255 255 255 0 Via 192 168 1 2 LANI 192 168 1 0 255 255 255 0 directly connected LANI 211 100 88 07 255 255 255 0 Via 192 168 1 3 LANI Static Route for IPv6 You can set up to 4
180. Control Access List Description Allow management from the Internet Enable the checkbox to allow system administrators to login from the Internet There are several servers provided by the system to allow you managing the router from Internet Check the box es to specify Enable PING from the Internet Check the checkbox to enable all PING packets from the Internet For security issue this function 1s disabled by default You could specify that the system administrator can only login from a specific host or network defined in the list A maximum of three Ps subnet masks is allowed IPv6 Address Prefix Length Indicate the IP address es allowed to login to the router After finished the above settings click OK to save the configuration Dray Tek 415 Vigor2860 Series User s Guide 3 19 11 Reboot System The Web user interface may be used to restart your router Click Reboot System from System Maintenance to open the following page System Maintenance gt Reboot System Reboot System Do you want to reboot your router 7 Using current configuration Using factory default configuration Reboot Now Auto Reboot Time Schedule Index 1 15 in Schedule Setup Note Action and Idle Timeout settings will be ignored Index 1 15 in Schedule Setup You can type in four sets of time schedule for performing system reboot All the schedules can be set previously in Applications gt gt Schedule w
181. D msNPAllowDialin TRUE Group Distinguished Name Available settings are explained as follows Item Description Name Type a name for such profile The length of the use name is limited to 19 characters Common Name Type or edit the common name identifier for the LDAP server Identifier The common name identifier for most LDAP server is cn Dr ay Tek 257 Vigor2860 Series User s Guide Base Distinguished Type or edit the distinguished name used to look up entries on Name Group the LDAP server PSEATS Ue eA Naig Sometimes you may forget the Distinguished Name since it s too long Then you may click the I button to list all the account information on the AD LDAP Server to assist you finish the setup Additional Filter This is an optional setting After finished the above settings click OK to save and exit this page A new profile has been created For detailed information about LDAP application refer to section 4 7 How to Implement the AD LDAP Authentication for User Management Vigor2860 Series User s Guide 258 Dr ay Tek 3 10 6 UPnP The UPnP Universal Plug and Play protocol is supported to bring to network connected devices the ease of installation and configuration which is already available for directly connected PC peripherals with the existing Windows Plug and Play system For NAT routers the major feature of UPnP on the router is NAT Traversal This enables applications inside the firew
182. D 2 MAC Address Filter Display all MAC addresses that are edited before Client s MAC Address Manually enter the MAC address of wireless client Apply SSID After entering the client s MAC address check the box of the SSIDs desired to insert this MAC address into their access control list Attribute s Isolate the station from LAN select to isolate the wireless connection of the wireless client of the MAC address from LAN Add Add a new MAC address into the list Delete Delete the selected MAC address in the list Edit Edit the selected MAC address in the list Cancel Give up the access control set up OK Click it to save the access control list Clear All Clean all entries in the MAC address list After finishing all the settings here please click OK to save the configuration 3 16 5 WPS WPS Wi Fi Protected Setup provides easy procedure to make network connection between wireless station and wireless access point vigor router with the encryption of WPA and WPA2 Wireless Card Installed Connection viaWPS P F TEEPEE fe ef ef np EEEE EE E Station Y Set SSID and a gt Encryption WPA WPA2 lt u gt PIN Code Note Such function is available for the wireless station with WPS supported It is the simplest way to build connection between wireless network clients and vigor router Users do not need to select any encryption mode and type any long encryption passphrase to setup a wireless client ev
183. DrayTek2860_SGmarketing Guest AP Guest AP Status Enabled Status Enabled SSID Name OrayTek_Guest SSID Name DrayTek_5SG_Guest Rate Control Disabled Rate Control Disabled 6 Click Finish to complete the wireless settings configuration Vigor2860 Series User s Guide 66 Dr ay Tek 2 6 VoIP Wizard Vigor router offers a quick method to configure settings for VoIP application Follow the steps listed below Note This wizard is available for V model only 1 Open Wizards gt gt VoIP Wizard 2 The screen of VoIP Wizard will be shown as follows VoIP Wizard Set VoIP service provider domain VoIP service provider draytel org draytel org 63 char mas SIP Port 5060 Set Account quickly Phone 1 default mapping to Account 1 Account Number Name fF 63 char mas Password Po 63 char maxi Phone 2 default mapping to Account 2 use the same Account as phonel Account Number Name 63 char mas Password 63 char mas Available settings are explained as follows Item Description Set VoIP service VoIP service provider Use the drop down list to choose provider domain the ISP which offers the VoIP service for your router SIP Port Use the default setting 5060 Set Account quickly Account Number Name Type the account number name registered to your ISP Password Type the password for the account registered to your ISP Use the same Account as phone 1 If you don
184. E80 COA8 651D 128 Link TX Packets RX Packets TX Bytes 13 29 967 Dr ay Tek 113 Vigor2860 Series User s Guide 3 1 4 Multi PVC This router allows you to create multi PVC for different data transferring for using Simply go to Internet Access and select Multi PVC page General The system allows you to set up to eight channels which are ready for choosing as the first PVC line that will be used as multi PVC WAN gt Multi PVCs Multi PVCs General Advanced Channel Enable 1 Z 3 4 5 6 l 8 9 B WAN Type ADSL ADSL ADSL ADSL ADSL ADSL ADSL ADSL ADSL VPIVCI VLAN Tag Port based Bridge 0 33 Mone Etherneti Wane Mone 1 43 Mone 1 44 Hone 1 45 None Enable 1 46 Mone Enable 1 47 Mone Enable 1 48 Mone Enable po Mone Enable 0 0 None Enable Available settings are explained as follows Item Channel Enable WAN Type VPI VCI VLAN Tag Port based Bridge Vigor2860 Series User s Guide Description Display the number of each channel Channels 1 and 2 are used by the Internet Access web user interface and can not be configured here Channels 5 10 are configurable Display whether the settings in this channel are enabled Yes or not No Displays the physical medium that the channel will use Display the value for VPI and VCI Displays the VLAN tag value that will be used for the packets traveling on this channel The network traffic flowing on each c
185. F any WAN1 UP Down 3 O any WAN1 UP Down 4 F any WAN1 UP Down 5 Fi any WAN1 UP Down 6 F any WAN1 UP Down 7 Pi any WAN1 UP Down 8 Fi any WAN1 UP Down 9 O any WAN1 UP Down 10 F any WAN1 UP Down lt lt 1 10 11 20 21 30 31 40 41 50 gt gt Next gt gt 5 Click Index number and 2 to configure the details After finished the settings click OK to save the settings respectively Load Balance Route Policy Index 1 Enable criteria Protocol Source IP Destination IP Destination Port send to if criteria matched Interface Interface Address Gateway IP more options any any Src IP Start Src IP End ew 1192 166 1 31 Dest IP Start Dest IP End any Dest Port Start Dest Port End ef E Ww default gateway O specificgateway O Auto Failover To The Other WAN Packet Forwarding to WAN via force NAT Vigor2860 Series User s Guide force Routing 484 Dray Tek And Load Balance Route Policy Index 2 Enable criteria Protocol any Source IP any Src IP Start Src IP End 192 168 1 100 r 192 168 1 100 Destination IP any Dest IP Start Dest IP End any Destination Port Dest Port Start Dest Port End send to if criteria matched Interface Interface Address 2 i Gateway IP default gateway specificgateway more options O Auto Failover To The Other WAN Packet Forwarding
186. Header AH means data will be authenticated but not be encrypted By default this option is active High Encapsulating Security Payload ESP means 285 Vigor2860 Series User s Guide GRE over IPsec Settings TCP IP Network Settings Vigor2860 Series User s Guide payload data will be encrypted and authenticated You may select encryption algorithm from Data Encryption Standard DES Triple DES 3DES and AES Enable IPsec Dial Out function GRE over IPsec Check this box to verify data and transmit data in encryption with GRE over IPsec packet after configuring IPsec Dial Out setting Both ends must match for each other by setting same virtual IP address for communication Logical Traffic Such technique comes from RFC2890 Define logical traffic for data transmission between both sides of VPN tunnel by using the characteristic of GRE Even hacker can decipher IPsec encryption he she still cannot ask LAN site to do data transmission with any information Such function can ensure the data transmitted on VPN tunnel is really sent out from both sides This is an optional function However if one side wants to use it the peer must enable it too My GRE IP Type the virtual IP for router itself for verified by peer Peer GRE IP Type the virtual IP of peer host for verified by router My WAN IP This field is only applicable when you select PPTP or L2TP with or without IPsec policy above The default value is 0
187. However even if this client only uses the IP for say 5 minutes the server still reserves 1 day for that client Because a DHCP server only has a limited number of IPs to lease to its DHCP clients soon enough all the IPs will be used out and then no one will be able to get any IPs from this server anymore Therefore this feature is used to get the IP back from inactive clients i e doesn t use the IP but the server still reserves the IP for him DNS stands for Domain Name System Every Internet host must have a unique IP address also they may have a human friendly easy to remember name such as www yahoo com The DNS server converts the user friendly name into its equivalent IP address Primary IP Address You must specify a DNS server IP address here because your ISP should provide you with usually more than one DNS Server If your ISP does not provide it the router will automatically apply default DNS Server IP address 194 109 6 66 to this field Secondary IP Address You can specify secondary DNS server IP address here because your ISP often provides you more than one DNS Server If your ISP does not provide it the router will automatically apply default secondary DNS Server IP address 194 98 0 1 to this field The default DNS Server IP address can be found via Online Status 2s DrayTek Online Status Physical Connection System Uptime 22 22 45 IPv4 IPv6 LAN Status Primary DNS 8 8 8 8 Secondary DNS 8 8 4 4 IP Add
188. Hz msec msec msec msec Do D o po Dial tone 440 Ringing tone s0 z200 Busy tone 375 Congestion tone Volume Gain DTMF Mic Gainf 1 10 DTMF Mode OutBand RF C2833 ka Payload Type RFC2833 96 127 um Speaker Gaing 1 10 MISC Dial Tone Power Level 1 50 Ring Frequency 10 50Hz Call Waiting Tone Power Level ia Interdigit Timeout 1 10 sec Available settings are explained as follows Item Description Region Select the proper region which you are located The common settings of Caller ID Type Dial tone Ringing tone Busy tone and Congestion tone will be shown Vigor2860 Series User s Guide 348 Dr ay Tek Dray Tek Volume Gain MISC DTMF automatically on the page If you cannot find out a suitable one please choose User Defined and fill out the corresponding values for dial tone ringing tone busy tone congestion tone by yourself for VoIP phone User Defined heal JK US i Denmark L Italy Germany q Netherlands ip Portugal 6 Sweden Australia Slovenia Czech Slovakia 1 Hungary Switzerland France JE COA China Talwar Also you can specify each field for your necessity It is recommended for you to use the default settings for VoIP communication Mic Gain 1 10 Speaker Gain 1 10 Adjust the volume of microphone and speaker by entering number from 1 10 The larger of the number the louder the volume is Dial Tone Power
189. I 32 Me Create Phase SA for each subnet IPsec RIP Direction The option specifies the direction of RIP Routing Information Protocol packets You can enable disable one of direction here Herein we provide four options TX RX Both TX Only RX Only and Disable From first subnet to remote network you have to do If the remote network only allows you to dial in with single IP please choose NAT otherwise choose Route Change default route to this VPN tunnel Check this box to change the default route with this VPN tunnel 2 After finishing all the settings here please click OK to save the configuration Dr ay Tek 287 Vigor2860 Series User s Guide 3 11 7 VPN TRUNK Management VPN trunk includes four features VPN Backup VPN load balance GRE over IPsec and Binding tunnel policy Features of VPN TRUNK VPN Backup Mechanism VPN TRUNK Management is a backup mechanism which can set multiple VPN tunnels as backup tunnel It can assure the network connection not to be cut off due to network environment blocked by any reason gt VPN TRUNK VPN Backup mechanism can judge abnormal situation for the environment of VPN server and correct it to complete the backup of VPN Tunnel in real time gt VPN TRUNK VPN Backup mechanism is compliant with all WAN modes single multi gt Dial out connection types contain IPsec PPTP L2TP L2TP over IPsec and ISDN depends on hardware specification gt The web page
190. IP Address TX rate RX rate or Session link for arranging the data display Diagnostics gt Data Flow Monitor _ Enable Data Flow Monitor Refresh Seconds Page Refresh Index IP Address TX rate Kbps RX rate Kbps Sessions Action Current Peak Speed Current Peak Speed Current Peak WAN O 0 Auto 0 0 Auto 0 WAN 172 16 3 133 61 1148 Auto 25 6968 Auto g1 WAN3 O 0 Auta O 0 Auto O WAN4 O O Auto O 0 Auto 0 Total 61 1148 Auto 25 7 6968 Auto 91 314 Note 1 Click Block to prevent specified PC from suring Internet for 5 minutes 2 The IP blocked by the router will be shown in red and the session column will display the remaining time that the specified IP will be blocked 3 Kbps shared bandwidth residual bandwidth used Current Peak are average Available settings are explained as follows Vigor2860 Series User s Guide 426 Dr ay Tek Dray Tek Item Enable Data Flow Monitor Refresh Seconds Refresh Index IP Address TX rate kbps RX rate kbps Sessions Action Current Peak Speed Description Check this box to enable this function Use the drop down list to choose the time interval of refreshing data flow that will be done by the system automatically Refresh Seconds 14 Click this link to refresh this page manually Display the number of the data flow Display the IP address of the monitored device Display the transmission speed of the monitored
191. IP Network Settings for setting the LAN IP for remote side AIGA ESP WJ DES BJ SVES WH AES 4 Gre over IPsec Settings C Enable IPsec Dial Out function GRE over IPsec O Logical Traffic My GRE1P PeerGREIP 5 TCP IP Network Settings My WAN IP 0 0 0 0 RIP Direction Rone Catewar I 0000 From first subnet to remote network you have to Remote Network IP 192 168 1 0 do C Change default route to this VPN tunnel Only single WAN supports this Remote Network Mask Local Network Mask 255 255 255 0 6 Click OK to save the settings Vigor2860 Series User s Guide 450 Dr ay Te k 7 Open VPN and Remote Access gt gt Connection Management to check the dial in connection status from branch office VPN and Remote Access gt gt Connection Management Dial out Tool Refresh Seconds V2920 172 16 2 145 VPN Connection Status Current Page 1 Page No Go Tx Tx Rate Rx Rx Rate VPN Type Remote IP Virtual Network Pkts Bps nea Bs UpTime 1 IPSec Tunnel VPN Server GES SHAL Auth 2128 242 130 19 192 168 1 0 24 353 3 291 3 0 13 58 MMEEMKER Data is encrypted KARASAK Liddle ISTIL EPIL YPL LELU Configuration on Vigor Router for Branch Office 1 Log into the web user interface of Vigor router 2 Open VPN and Remote Access gt gt LAN to LAN to create a LAN to LAN profile The following settings are for a permanent VPN connection VPN and Remote Access gt gt LAN to LAN LAN to L
192. Internet Land line jack POTS Power Adapter aS Vigor 860n Fe VOSLE Socurity Firowall gt Internet m Cable DSL Modem D Power Switch or Media Converter l a Dr ay Tek 11 Vigor2860 Series User s Guide 1 4 Printer Installation You can install a printer onto the router for sharing printing All the PCs connected this router can print documents via the router The example provided here is made based on Windows XP 2000 For Windows 98 SE Vista please visit www DrayTek com Internet Before using it please follow the steps below to configure settings for connected computers or wireless clients 1 Connect the printer with the router through USB parallel port 2 Open Start gt Settings gt Printer and Faxes F EE Documents b D Settings B Control Panel Network Connections Search i 2 Printers and Faxes of Taskbar and Start Menu Help and Support Run Log OFF coco lee Turn OFF Computer Internet Explorer Vigor2860 Series User s Guide 12 Dray Tek 3 Open File gt Add Printer A welcome dialog will appear Please click Next Add Printer Wizard Welcome to the Add Printer Q Wizard This wizard helps you install a printer or make printer connections If you have a Plug and Play printer that connects 1 through a USB port or any other hot pluggable port such as IEEE 1394 infrared and so on you S Printers and Fax
193. Li et m Logical Trattic My GRE IF 192 168 590 100 Peer GRE IP 192 168 50 200 5 TCPAP Network Settings My WAN IP 0 0 0 0 RIP Direction Remote Gateway IP 197 168 25 1 From first subnet to remote network you have to do Remote Network IP 192 168 25 0 Remote Network Mask 255 255 2551 Local Network IP 192 168 1 1 Change default route to this WPN tunnel i Only single WAN supports this Local Network Mask 255 255 255 0 Dr ay Tek 293 Vigor2860 Series User s Guide Advanced Load Balance and Backup After setting profiles for load balance you can choose any one of them and click Advance for more detailed configuration The windows for advanced load balance and backup are different Refer to the following explanation Advanced Load Balance YEN Load Balance Advance settings Windows Internet Explorer E hitp192 168 1 1 Eom z S VPN Load Balance Advance Settings Profile Name Loadbalanl Load Balance Algorithm Round Robin Weighted Round Robin Auto Weighted According to Speed Ratio Member1 Member2 50 50 VPN Load Balance Policy Edit Insert after 1 64 i Tunnel Bind Table Index Cap EF T l Active ctive Binding Dial Out Profile ho oo 4 silo B silo Src IP Start End 255 755 755 255 Dest IP Start End 255 255 255 255 Dest Port Start Protocol ANY ka lo Detail Information VPN Load Balance P
194. N cable or drilling holes everywhere Wireless LAN enables high mobility so WLAN users can simultaneously access all LAN facilities just like on a wired LAN as well as Internet access The Vigor wireless routers are equipped with a wireless LAN interface compliant with the standard IEEE 802 11n draft 2 protocol To boost its performance further the Vigor Router is also loaded with advanced wireless technology to lift up data rate up to 300 Mbps Hence you can finally smoothly enjoy stream music and video Note The actual data throughput will vary according to the network conditions and environmental factors including volume of network traffic network overhead and building materials In an Infrastructure Mode of wireless network Vigor wireless router plays a role as an Access Point AP connecting to lots of wireless clients or Stations STA All the STAs will share the same Internet connection via Vigor wireless router The General Settings will set up the information of this wireless network including its SSID as identification located channel etc Internet SSID Draytek Channel 6 Mode WEP only Multiple SSIDs Vigor router supports four SSID settings for wireless connections Each SSID can be defined with different name and download upload rate for selecting by stations connected to the router wirelessly Vigor2860 Series User s Guide 352 Dr ay Te k Security Overview Real time Hardware Encryption Vigor
195. N connection Specify the access points which are classified under each type Use the drop down list to specify the time to refresh the web page Click such link to refresh the web page immediately Display the channel used by the detected access point Display the SSID specified for the detected access point z DrayTek Mode Display the mode AP or Ad Hoc used by the detected access point BSSID Display the MAC address of the detected access point Security Display the encryption mode used by the access point Signal Display the signal strength represented by percentage sent by the access point Beacon Period Display the period time of the beacon The beacon signal will be sent out periodically Last Detected Display the data and time that such access point detected by Vigor router All the APs detected by Vigor router will be treated as unknown APs You have to specify which AP is friendly and which one is Rogue respectively Follow the steps below to perform the classification of access points 1 Click the radio button on one of the access points In this case DrayTek LAN A is selected Central AP Management gt gt Rogue AP Detection Rogue AP Detection Enable I Neighbor AP Detection IWH Local WLAN Detection All APs ba Refresh Min s 1 Refresh 11 James_AP800 AP 00 50 7f cc 08 e8 Mixed 68 100 Jan 01 00 50 26 11 DrayTek LAN B AP 02 1d aa 74 20 44 Mixed 100 100 Jan 01 00 50 26
196. N3 WAN4 To use 3G 4G USB Modem PPP mode as the accessing protocol of the internet please choose Internet Access from WAN menu Then select 3G 4G USB Modem PPP mode for WANS The following web page will be shown WAN gt gt Internet Access ww WAN 3 Modem Support List 3G 4G USB Modem PPP mode O Enable Disahle ATePFEOYTAT amp 02801 SO 0 Default ATRFEOV1s 18028 C0150 04 Modem Initial String2 Modem Dial String ATOT USF Default ATOT 99 CDMA ATDOT 777 TO SCOMA ATOT 98 144 Modem Initial String PPP Username hee Optional PRP Password Optima PPP Authentication PAP or CHAP Indexf1 15 in Schedule Setup WAN Connection Detection TTL Available settings are explained as follows Item Description Modem Support List It lists all of the modems supported by such router 46 Modem Supper List Last updated on 2012 05 12 Sianmdarid Brad Mochis Siahas LTE ZTE ZE MFBZI Y 3G 4G USB Modem PPP Click Enable for activating this function If you click mode Disable this function will be closed and all the settings that you adjusted in this page will be invalid SIM PIN code Type PIN code of the SIM card that will be used to access Internet The maximum length of the PIN code you can set is 15 characters Dr ay Tek 103 Vigor2860 Series User s Guide Modem Initial String APN Name Modem Initial String2 Modem Dial String PPP Username PPP Password PPP Authentication
197. NIA 6 Web Surfing a lt VPN pe d l a m X After connecting into the router 3G 4G USB Modem will be regarded as the third WAN port However the original WANI and WAN2 still can be used and Load Balance can be done in the router Besides 3G 4G USB Modem in WAN3 also can be used as backup device Therefore when WANI and WAN2 are not available the router will use 3 5G for supporting automatically The supported 3G 4G USB Modem will be listed on DrayTek web site Please visit www draytek com for more detailed information Internet lt VoIP Below shows the menu items for WAN Vigor2860 Series User s Guide 74 Dr ay Tek 3 1 2 General Setup This section will introduce some general settings of Internet and explain the connection modes for WANI1 WAN2 and WAN3 WAMN4 in details This router supports multiple WAN function It allows users to access Internet and combine the bandwidth of the multiple WANs to speed up the transmission through the network Each WAN port can connect to different ISPs Even if the ISPs use different technology to provide telecommunication service such as DSL Cable modem etc If any connection problem occurred on one of the ISP connections all the traffic will be guided and switched to the normal communication port for proper operation Please configure WANI WAN2 WAN3 and WAN4 settings This webpage allows you to set general setup for WAN1 WAN2 WAN3 and WAN4 respectively In
198. Network Information Centre NIC Having a unique IP address is mandatory for those devices participated in the public network but not in the private TCP IP local area networks LANs such as host PCs under the management of a router since they do not need to be accessed by the public Hence the NIC has reserved certain addresses that will never be registered publicly These are known as private IP addresses and are listed in the following ranges From 10 0 0 0 to 10 255 255 255 From 172 16 0 0 to 172 31 255 255 From 192 168 0 0 to 192 168 255 255 73 Vigor2860 Series User s Guide What are Public IP Address and Private IP Address As the router plays a role to manage and further protect its LAN it interconnects groups of host PCs Each of them has a private IP address assigned by the built in DHCP server of the Vigor router The router itself will also use the default private IP address 192 168 1 1 to communicate with the local hosts Meanwhile Vigor router will communicate with other network devices through a public IP address When the data flow passing through the Network Address Translation NAT function of the router will dedicate to translate public private addresses and the packets will be delivered to the correct host PC in the local area network Thus all the host PCs can share a common Internet connection Get Your Public IP Address from ISP In ADSL deployment the PPP Point to Point style authentication and authorization
199. Network Interface Use the drop down list to specify an interface for this static route When you finish the configuration please click OK to save and exit this page Dr ay Tek 137 Vigor2860 Series User s Guide 3 2 4 VLAN With the 6 port Gigabit switch on the LAN side Vigor router provides extremely high speed connectivity for the highest speed local data transfer of any server or local PCs On the Wireless equipped models Vigor2860n Vigor2860n plus Vigor2860Vn plus each of the wireless SSIDs can also be grouped within one of the VLANs Tagged VLAN The tagged VLANs 802 1q can mark data with a VLAN identifier This identifier can be carried through an onward Ethernet switch to specific ports The specific VLAN clients can also pick up this identifier as it is just passed to the LAN You can set the priorities for LAN side QoS You can assign each of VLANs to each of the different IP subnets that the router may also be operating to provide even more isolation The said functionality is tag based multi subnet Port Based VLAN Relative to tag based VLAN which groups clients with an identifier port based VLAN uses physical ports P1 P6 to separate the clients into different VLAN group Virtual LAN function provides you a very convenient way to manage hosts by grouping them based on the physical port The multi subnet can let a small businesses have much better isolation for multi occupancy applications Go to LAN page and sele
200. O0507F6EE4980 detected by Vigor router will be applied with the settings modified by Vigor router 497 Vigor2860 Series User s Guide 4 14 CVM Application How to manage the CPE router through Vigor2860 series To manage CPEs through Vigor2860 series you have to set URL on CPE first and set username and password for Vigor2860 series For this section we use Vigor2850 series as the example All the CPE configuration will be done through Vigor2850 series 4 14 1 Configure CVM Settings on Vigor2860 series 2 4 Access into the web user interface of Vigor2860 series Open Central VPN Management gt gt General Setup Central VPN Mani General Setup _ In the following page check the boxes for CVM Port and CVM SSL Port to enable the port setting Type the values for CVM Port CVM SSL Port Username and Password respectively Remember the values configured in this page CWM gt General Setup General Settings IPsec VPN Settings C M Port 000 CWM SSL Port 443 Copy the following URL to paste onto Remote devices ACS Server URL field http 172 168 35 150 8000 4CSServer servicefAcsserylet https 172 16 5 1390 8443 4CSServerfservice 4acsserylet Username Password Polling Interval Seconds WAN IP for Remote Connection WAN j Note To enable the CWM feature one of the Port MUST be Enabled Click OK to save the settings Vigor2860 Series User s Guide 498 Dr ay Te k 4 14 2 Confi
201. OK to save the configuration 3 15 3 Phone Settings This page allows user to set phone settings for Phone and Phone 2 respectively However it changes slightly according to different model you have VoIP gt gt Phone Settings Port Call Feature Tone Gain Mic Speaker Default SIP Account DTMF Relay Phonel CW CT User Defined 575 DutBand Phone CWT User Defined g5 QutBand RTP Cl Symmetric RTP Dynamic ETP Port Start 10050 Dynamic RTP Port End 15000 RTP TOS IF precedence 5 j 10100000 Available settings are explained as follows Item Description Phone List Port there are two phone ports provided here for you to configure Phonel Phone2 allows you to set general settings for PSTN phones Call Feature A brief description for call feature will be shown in this field for your reference Tone Display the tone settings that configured in the advanced settings page of Phone Index Gain Display the volume gain settings for Mic Speaker that configured in the advanced settings page of Phone Index Default SIP Account draytel_1 is the default SIP account You can click the number below the Index field to Dray Te k 345 Vigor2860 Series User s Guide change SIP account for each phone port DTMF Relay Display DTMF mode that configured in the advanced settings page of Phone Index RTP Symmetric RTP Check this box to invoke the function To make the data transmission going through o
202. Option Each DHCP option is composed by an option number with data For example Option number 100 Data abcd When such function is enabled the specified values for DHCP option will be seen in DHCP reply packets Interface Choose the interface for such option Option Number Type a number for such function DataType Choose the type ASCII or Hex for the data to be stored Data Type the content of the data to be processed by the function of DHCP option Force router to use DNS Force Vigor router to use DNS servers configured in server IP address LAN1I LAN2 LAN3 LAN4 LANS LAN6 instead of DNS servers given by the Internet Access server PPPoE PPTP L2TP or DHCP server Inter LAN Routing Check the box to link two or more different subnets LAN and LAN When you finish the configuration please click OK to save and exit this page Vigor2860 Series User s Guide 124 Dr ay Te k Details Page for LAN1 Ethernet TCP IP and DHCP Setup There are two configuration pages for LAN1 Ethernet TCP IP and DHCP Setup based on IPv4 and IPv6 Setup Click the tab for each type and refer to the following explanations for detailed information LAN gt General Setup LAN 1 Ethernet TCP IP and DHCP Setup LAN 1 1IPv6 Setup Network Configuration For WAT Usage DHCP Server Configuration Enable Server Disable Server IP Address 10 29 60 1 F Enable Relay Agent Subnet Mask 255 255 255 0 Start IP Address 10
203. P URL Type in the SIP URL e g aaa draytel org or abc iptel org as the site for call forwarded Time Out Set the time out for the call forwarding The default setting is 30 sec Set Phone 1 and or Phone 2 as the default ring port s for this SIP account Choose a ring tone type for the VoIP phone call Ring Pattern Select one of five codecs as the default for your VoIP calls The codec used for each call will be negotiated with the peer party before each session and so may not be your default choice The default codec is G 729A B it occupies little bandwidth while maintaining good voice quality If your upstream speed is only 64Kbps do not use G711 codec It is better for you to have at least 256Kbps upstream if you would like to use G711 G 729A B BKbps Y G 711MU 64kbps G 711A B4Kbps G 29A B fok bps 3 7235 b 4kbps G26 32 32kbps Single Codec If the box is checked only the selected Codec will be applied The amount of data contained in a single packet The default value is 20 ms which means the data packet will contain 20 ms voice information 7 DrayTek Packet Size Voice Active Detector This function can detect if the voice on both sides is active or not If not the router will do something to save the bandwidth for other using Click On to invoke this function click off to close the function voice Active Detector After finishing all the settings here please click
204. P data hiding in the payload of TCP packets while legacy firewall inspects packets based on the fields of TCP IP headers only On the other hand Vigor router can prevent user from accidentally downloading malicious codes from web pages It s very common that malicious codes conceal in the executable objects such as ActiveX Java Applet compressed files and other executable files Once downloading these types of files from websites you may risk bringing threat to your system For example an ActiveX control object is usually used for providing interactive web feature If malicious code hides inside it may occupy user s system Web Content Filter We all know that the content on the Internet just like other types of media may be inappropriate sometimes As a responsible parent or employer you should protect those in your trust against the hazards With Web filtering service of the Vigor router you can protect your business from common primary threats such as productivity legal lability network and security threats For parents you can protect your children from viewing adult websites or chat rooms Once you have activated your Web Filtering service in Vigor router and chosen the categories of website you wish to restrict each URL address requested e g www bbc co uk will be checked against our server database This database is updated as frequent as daily by a global team of Internet researchers The server will look up the URL and ret
205. PoA 1403 Bridged IP IPoE Wes SofOvnamic IP Fixed IP Click Yes to enable Fixed IP feature IP Address Type the IP address if Fixed IP is enabled Subnet Mask Type the subnet mask Dr ay Tek 35 Vigor2860 Series User s Guide Default Gateway Primary DNS Secondary DNS Back Next Cancel Type the IP address as the default gateway Type in the primary IP address for the router Type in secondary IP address for necessity in the future Click it to return to previous setting page Click it to get into the next setting page Click it to give up the quick start wizard 2 Please type in the IP address mask gateway information originally provided by your ISP Then click Next for viewing summary of such connection Quick Start Wizard Please confirm your settings WAN Interface Physical Mode WPI WEI WANI ADSL T oo Protocol Encapsulation 1483 Bridge LLC Fixed IP Primary DNS Secondary DNS Mo 5 5 5 5 5 0 4 4 3 Click Finish A page of Quick Start Wizard Setup OK will appear Then the system status of this protocol will be shown Quick Start Wizard Setup OK 4 Now you can enjoy surfing on the Internet Vigor2860 Series User s Guide 36 Dray Tek 2 1 2 For WAN2 Ethernet WAN2 is dedicated to physical mode in Ethernet If you choose WAN2 please specify physical type Then click Next Quick Start Wizard WAN Interface WAN Interface WAT Physical Mode Ethernet
206. PoA is a specification that enables ATM services to be integrated with existing LANs which use either Ethernet token ring or TCP IP protocols The goal of MPOA is to allow different LANs to send packets to each other via an ATM backbone To use MPoA Static or Dynamic IP as the accessing protocol of the Internet select MPoA Static or Dynamic IP from the WAN gt gt Internet Access gt gt WANI page The following web page will appear Vigor2860 Series User s Guide 92 Dr ay Tek WAN gt gt Internet Access WAN 1 PPPoE PPPoA Enable Disable Modem Settings for ADSL only Router Name Channel 2 w Multi P VC channel Encapsulation 1483 Bridged IP LLC VPI VCI Modulation WAN Connection Detection ARP Detect Mode Ping IP TTL MTU RIP Protocol C Enable RIP Bridge Mode C Enable Bridge Mode Multimode Max 1500 MPoA Static or Dynamic IP IPv6 WAN IP Network Settings __ YVAN IP Alias Obtain an IP address automatically Required for some ISPs Specify an IP address IP Address Domain Name Subnet Mask ll Gateway IP Address Default MAC Address Specify a MAC Address MAC Address oo 10 aa pae B7 69 DNS Server IP Address Primary IP Address 9 9 0 0 Secondary IP Address 0 044 Available settings are explained as follows Item Enable Disable Modem Settings for ADSL only Dray Tek Description Click Enable for activating
207. RADIUS Firewall Object Setting and Data Flow Monitor are displayed here Move your mouse cursor on any one of the links and click on it The corresponding setting page will be open immediately In addition quick access for VPN security settings such as Remote Dial in User and LAN to LAN are located on the bottom of this page Scroll down the page to find them and use them if required Interface DS Connected Down Stream 101060Kbps Up Stream 96772Kbps Connected 2 WANT WIWAN2 LAN2 LAN3 User Mode is OFF now Note that there is a plus Gal icon located on the left side of VPN LAN Click it to review the VPN connection s used presently security VPN Connected 1 Remote Dial in User LAWN to LAN Current Page 1 Page No Name User Type Security Host IP Up Time V2920 IPsec 3DES 172 16 2 145 0 0 20 User Mode is OFF now Vigor2860 Series User s Guide 22 Dr ay Tek J LAN Connected 3 WLAN WLAN2 LANG LAN4 LANS LANG IP Address re E ALPHA NB 10 28 60 13 1C 4B D6 D2 D7 DB ee 10 28 60 14 O0 15 AF 09 7E FA O 10 28 60 11 00 50 7F C9 76 45 Host connected physically to the router via LAN port s will be displayed with green circles in the field of Connected All of the hosts including wireless clients displayed with Host ID IP Address and MAC address indicates that the traffic would be transmitted through LAN port s and then the WAN port The purpose is to perfor
208. Range Address type is selected Type the subnet mask if the Subnet Address type is selected If it is checked all the IP addresses except the ones listed above will be applied later while it 1s chosen 2 After finishing all the settings here please click OK to save the configuration Below is an example of IP objects settings Objects Setting gt IP Object IP Object Profiles Index a A e i iY i Vigor2860 Series User s Guide Name Index RD Department Ti Financial Dept HR Department sd Po RO J 3 S je e 9 Dray Tek 3 7 2 IP Group This page allows you to bind several IP objects into one IP group Objects Setting gt gt IP Group IP Group Table Set to Factory Default Index Name Index Name 2 18 3 13 5 21 6 22 8 24 14 30 Available settings are explained as follows Item Description Set to Factory Default Clear all profiles Index Display the profile number that you can configure Name Display the name of the group profile To set a new profile please do the steps listed below 1 Click the number e g 1 under Index column for configuration in details 2 The configuration page will be shown as follows Objects Setting gt gt IP Group Profile Index 1 Name Administration Interface Any Available IP Objects Selected IP Objects 1 RD Deparment 2 Financial Dept 3 HR Deparment Dr ay Tek 197 Vigor2860 Series User s Guide Available settings are ex
209. SL Modem Code Line Speed Kpbs VLAN Tag insertion ADSL VLAN Tag insertion VDSL2 Display the physical mode of such interface If VDSL2 is detected this field will display VDSL2 if ADSL is detected it will display ADSL Specify the physical mode VDSL or ADSL for such router manually For such interface no type can be selected Choose the correct DSL modem code for ensuring the network connection Default I Default AnnexA 560816 552011 AnnexA 545006 544401 If you have no idea about the selection simply choose Default or contact the dealer for assistance If your choose According to Line Speed as the Load Balance Mode in previous page please type the line speed for downloading and uploading for such WAN interface The unit is kbps The settings configured in this field are available for ADSL Enable Enable the function of VLAN with tag The router will add specific VLAN number to all packets on the WAN while sending them out Please type the tag value and specify the priority for the packets sending by WANI1 Disable Disable the function of VLAN with tag Tag value Type the value as the VLAN ID number The range is form 0 to 4095 Priority Type the packet priority number for such VLAN The range is from 0 to 7 The settings configured in this field are available for VDSL2 Enable Enable the function of VLAN with tag The router will add specific VLAN n
210. SMS Service Object This page allows you to set ten profiles which will be applied in Application gt gt SMS Mail Alert Service Object Settings gt SMS Mail Service Object SMS Provider Mail Server Set to Factory Default Index Profile Name SMS Provider 4 kotsms com tw TW 2 kotsms com tw TW 3 kotsms com tw TW 4 kotsms com tw TW 5 kotsms com tw TW 6 kotsms com tw TW T kotsms cam tw TW EA kotsms com tw TW3 5 Custom 1 10 Custom 2 Each item is explained as follows Item Description Set to Factory Default Clear all of the settings and return to factory default settings Index Display the profile number that you can configure Profile Display the name for such SMS profile SMS Provider Display the service provider which offers SMS service To set a new profile please do the steps listed below 1 Click the SMS Provider tab and click the number e g 1 under Index column for configuration in details Object Settings gt gt SMS Mail Service Object SMS Provider Mail Server Index Profile Name 4 2 ahs 4 Dray Te k 211 Vigor2860 Series User s Guide 2 The configuration page will be shown as follows Object Settings gt SMS Mail Service Object Profile Index 1 Profile Name Service Provider kotsms com tw THY Username Password lesse OOOO O O Quota Sending Interval seconds Available settings are explained as follows Item Description Profile Name Type a na
211. SP for speed test program Available settings are explained as follows Item Enable the QoS Control Description The factory default for this setting is checked Please also define which traffic the QoS Control settings will apply to IN apply to incoming traffic only OUT apply to outgoing traffic only BOTH apply to both incoming and outgoing traffic Check this box and click OK then click Setup link again You will see the Online Statistics link appearing on this page WAN Inbound It allows you to set the connecting rate of data input for Bandwidth WAN2 WANS For example if your ADSL supports 1M of downstream and 256K upstream please set 1000kbps for this box The default value is 10000kbps WAN Outbound It allows you to set the connecting rate of data output for Bandwidth WAN2 WANS For example if your ADSL supports 1M of downstream and 256K upstream please set 256kbps for this box The default value is 10000kbps Reserved Bandwidth It is reserved for the group index in the form of ratio of Ratio reserved bandwidth to upstream speed and reserved bandwidth to downstream speed Enable UDP Bandwidth Check this and set the limited bandwidth ratio on the right Control field This is a protection of TCP application traffic since UDP application traffic such as streaming video will exhaust lots of bandwidth Outbound TCP ACK The difference in bandwidth between download and upload Prioritize are great in ADSL2 e
212. Series User s Guide VPI Type in the value provided by your ISP VCI Type in the value provided by your ISP Protocol Select a proper protocol for this channel Encapsulation Choose a proper type for this channel The types will be different according to the protocol setting that you choose 1403 Route IP LLC 483 Bridged IP LLC 1483 Route IP LLC Wil MUK 1403 Bridged IP VWC Mux 1403 Routed IP VC Mux IPoA LLOSSNAP 1463 Bridged IPMRPoE Add VLAN Header Check the box to enable the following two options VLAN Tag Type the value as the VLAN ID number Valid settings are in the range from 1 to 4095 The network traffic flowing on each channel will be identified by the system via their VLAN Tags Channels using the same WAN type may not configure the same VLAN tag value Priority Choose the number to determine the packet priority for such VLAN The range is from 0 to 7 QoS Type Select a proper QoS type for the channel Type the values for PCR SCR and MBS respectively The settings here will create a bridge between the LAN ports selected and the WAN The WAN interface of the bridge connection will be built upon the WAN type selected using the VLAN tag configured Physical Members Group the physical ports by checking the corresponding check box es for applying the port based bridge connection Check the box to enable relating function WAN Application Management It can be
213. Service Object SMS Provider Mail Server Set to Factory Default Index Profile Name SMS Provider q kotsms com tw TW 2 kotsms com tw TW 3 kotsms com tw TW 4 kotsms com tw TW 5 kotsms com tw TW 6 kotsms com tw TW T kotsms com tw TW 8 kotsms com tw TW 9 Custom 1 10 Custom 2 You can click the number e g 9 under Index column for configuration in details Object Settings gt gt SMS Mail Service Object Profile Index 9 profile Name asm d Service Provider Please contact with your SMS provide to get the exact URL String eg bulksms vsms net 5567 eapi submission send_sms 2 2 0 username 2 stxtUser s woe E Ie JE amp password txtPwd 8 amp msisdn txtDest amp message txtMsg Username Password Quota Sending Interval seconds Available settings are explained as follows Dray Tek Item Description Profile Name Display the name of this profile It cannot be modified Service Provider Type the website of the service provider Type the URL string in the box under the filed of Service Provider You have to contact your SMS provider to obtain the exact URL string 213 Vigor2860 Series User s Guide Username Type a user name that the sender can use to register to selected SMS provider The maximum length of the name you can set is 31 characters Password Type a password that the sender can use to register to selected SMS provider The maximum length
214. Table Current Running Routing Table IPv6 Routing Table C connected 5 static R RIP default private 197 166 1 0 255 255 2455 0 directly connected LANI Refresh Diagnostics gt gt View Routing Table Current Running Routing Table IPv Routing Table Refresh Destination Interface Flags Metric Next Hop FEGO 64 LAN U 256 FFOO 6 LAN U 256 Available settings are explained as follows Item Description Refresh Click it to reload the page Dray Te k 421 Vigor2860 Series User s Guide 3 20 3 ARP Cache Table Click Diagnostics and click ARP Cache Table to view the content of the ARP Address Resolution Protocol cache held in the router The table shows a mapping between an Ethernet hardware address MAC Address and an IP address Diagnostics gt gt View ARP Cache Table Ethernet ARP Cache Table Clear Refresh IPF Address MAC Address Netbios Name Interface 132 168 1 5 00 5S0 7F CD O7 42 LANI 197 166 1 49 EQ CR 4E DA 42 73 CBARRIE OCTCB251 LANI Available settings are explained as follows Item Description Refresh Click it to reload the page 3 20 4 IPv6 Neighbour Table The table shows a mapping between an Ethernet hardware address MAC Address and an IPv6 address This information is helpful in diagnosing network problems such as IP address conflicts etc Click Diagnostics and click IPv6 Neighbour Table to open the web page Diagnostics gt gt View IPv6 Neighbour Table
215. Te k 6 Then open VPN and Remote Access gt gt PPP General Setup to check the profile s that will be authenticated with LDAP server VPN and Remote Access gt gt PPP General Setup PPP General Setup PPP MP Protocol mip eo Authentication oe MPPE Optional MPPE kd Mutual Authentication PAP Yes No Username sd Password sd IP Address Assignment for Dial In Users When DHCP Disable set Assigned IP start LAN 1 LAN 2 192 168 2200 LAN 3 192 168 3200 LAN 4 192 168 4200 LAN 5 ca E 7 After above configurations users belong to either rd1 or shrd group can access Internet after inputting their credentials on LDAP server Dr ay Tek 465 Vigor2860 Series User s Guide 4 7 How to use Landing Page Feature Landing Page is a special feature configured under User Management It can specify the message content to be seen or specify which website to be accessed into when users try to access into the Internet by passing the authentication Here we take Vigor2860 series router as an example Example 1 Users can see the message for landing page after logging into Internet successfully 1 Open the web user interface of Vigor2860 2 Open User Management gt General Setup to get the following page In the field of Landing Page please type the words of Login Success Please note that the maximum number of characters to be typed here is 255 User Management gt gt General Setup Gene
216. The DSL connection is ready Quickly The connection is training VPN The VPN tunnel is active Qos The QoS function is active WCF The Web Content Filter is active It is enabled from Firewall gt gt General Setup DoS The DoS DDoS function is active It will blink while detecting an attack LED on Connector Left The port is connected WAN2 LED The port is disconnected Giga The data is transmitting Right The port is connected with 1000Mbps LED Off The port is connected with 10 100Mbps Left The port is connected aaa LED Off The port is disconnected Blinking The data is transmitting Right On The port is connected with LOOOMbps LED Off The port is connected with 10 100Mbps Dr ay Te k 5 Vigor2860 Series User s Guide Wireless LAN Interface Wireless LAN ON OFF WPS Factory Reset USB VDSL ADSL WAN Giga GigaLAN 1 6 PWR ON OFF Vigor2860 Series User s Guide s ONIOFFIWPS a a 3 j aa zl Vigor2860n H TITT Description Press Wireless LAN ON OFF WPS button once to wait for client device making network connection through WPS Press Wireless LAN ON OFF WPS button twice to enable WLAN LED on or disable WLAN LED off wireless connection Restore the default settings Usage Turn on the router ACT LED is blinking Press the hole and keep for more than 5 seconds When you see the ACT LED begins to blink rapidly than usual release the button Then the router will restart with the factory
217. Then a login window will be popped up and ask the user to type the user name and password for authentication If succeed a Welcome Message configured in User Management gt gt General Setup will be displayed After authentication the destination URL if requested by the user will be guided automatically by the router Alert Tool If it is selected the user can open Alert Tool and type the user name and password for authentication A 189 Vigor2860 Series User s Guide Landing Page Index 1 15 in Schedule Setup Enable Time Quota Enable Data Quota Vigor2860 Series User s Guide window with remaining time of connection for such user will be displayed Next the user can access Internet through any browser on Windows Note that Alert Tool can be downloaded from DrayTek web site Telnet If it is selected the user can use Telnet command to perform the authentication job When a user tries to access into the web user interface of Vigor router series with the user name and password specified in this profile he she will be lead into the web page configured in Landing Page field in User Management gt gt General Setup Check this box to enable such function You can type in four sets of time schedule for your request All the schedules can be set previously in Application gt gt Schedule web page and you can use the number that you have set in that web page Time quota means the total connection time allowe
218. This item is optional and can be used only in IKE aggressive mode Local Certificate Select one of the profiles set in Certificate Management gt gt Local Certificate IPsec Security Method This group of fields is a must for IPsec Tunnels and L2TP with IPsec Policy Medium AH Authentication Header means data will be authenticated but not be encrypted By default this option is active High ESP Encapsulating Security Payload means payload data will be encrypted and authenticated Select from below DES without Authentication Use DES encryption algorithm and not apply any authentication scheme DES with Authentication Use DES encryption algorithm and apply MD5 or SHA 1 authentication algorithm 3DES without Authentication Use triple DES encryption algorithm and not apply any authentication scheme 3DES with Authentication Use triple DES encryption algorithm and apply MD5 or SHA 1 authentication algorithm AES without Authentication Use AES encryption algorithm and not apply any authentication scheme AES with Authentication Use AES encryption algorithm and apply MD5 or SHA 1 authentication algorithm m2 Dray Tek Dray Tek Advanced Specify mode proposal and key life of each IKE phase Gateway etc The window of advance setup is shown as below IKE advanced settings IKE phase 1 mode Select from Main mode and Aggressive mode The ultimate outcome is to exchange security propos
219. This submenu only applies to PPP related VPN connections such as PPTP L2TP L2TP over IPsec VPN and Remote Access gt gt PPP General Setup PPP General Setup PPP MP Protocol LDAP Server Profiles for PPP Authentication ee PAP CHAP MS CHAP MS CHAPy2 TE LDAP Profile Authentication Note Please select PAP Only in Dial In PPP Dial In PPP Authentication if you want to use AD LDAP for Encryption MPPE SUE Rules os PPP Authentication Mutual Authentication PAP Yes No IP Address Assignment for Dial In Users When DHCP Disable set Assigned IP start LAN 1 10 26 60 200 LAN 2 192 166 2200 LAN 3 192 166 3 200 LAN 4 192 166 4 200 LAN 5 192 166 5 200 LAN 6 192 166 6 200 Available settings are explained as follows Item Description Dial In PPP PAP Only elect this option to force the router to Authentication authenticate dial in users with the PAP protocol PAP CHAP MS CHAP MS CHAPv2 Selecting this option means the router will attempt to authenticate dial in users with the CHAP protocol first If the dial in user does not support this protocol it will fall back to use the PAP protocol for authentication Dial In PPP Encryption Optional MPPE This option represents that the MPPE MPPE encryption method will be optionally employed in the router for the remote dial in user If the remote dial in user does not support the MPPE encryption algorithm the router will transmit no MPPE encrypted pac
220. Us Click Yes to enable Fixed IP feature Type the IP address if Fixed IP is enabled Type the subnet mask Type the IP address as the default gateway Type in the primary IP address for the router 32 Dray Tek Secondary DNS Back Next Cancel Type in secondary IP address for necessity in the future Click it to return to previous setting page Click it to get into the next setting page Click it to give up the quick start wizard 2 After finished the above settings simply click Next Manually enter the Username Password provided by your ISP Quick Start Wizard Set PPPoE PPPoA WAN 1 Service Name Optional lIsername Password Confirm Password 400a P55 ehinetnet Available settings are explained as follows Item Description Service Name Optional Username Password Confirm Password Back Next Cancel Dray Tek Enter the description of the specific network service Assign a specific valid user name provided by the ISP Note The maximum length of the user name you can set is 63 characters Assign a valid password provided by the ISP Note The maximum length of the password you can set is 62 characters Retype the password Click it to return to previous setting page Click it to get into the next setting page Click it to give up the quick start wizard 33 Vigor2860 Series User s Guide 3 After finished the above settings click Next for viewing summary of such con
221. VPN Backup mechanism profile Status v means such profile is enabled x means such profile is disabled Name Display the name of VPN TRUNK VPN Backup mechanism profile Member Display the dial out profile selected from the Member drop down list below Active Yes means normal condition No means the state might be disabled or that profile currently is set with Dial in mode for call direction in LAN to LAN Type Display the connection type for that profile such as IPsec PPTP L2TP L2TP over IPsec NICE L2TP over IPsec MUST and so on Memberz2 Display the dial out profile selected from the Member 2 drop down list below Dr ay Tek 289 Vigor2860 Series User s Guide Advanced This button is available only when LAN to LAN profile or more is created TPN Backup Advance Settings Windows Internet Explorer http 192 168 1 1 bal VPN Backup Advance Settings Profile Name Backup1 ERD Mode Normal Resume Member 1 first Detail Information Environment Recovers Detection ERD Status Normal Mode Detailed information for this dialog see later section Advanced Load Balance and Backup Load Balance Profile List Set to Factory Default Click to clear all VPN TRUNK VPN Load Balance mechanism profile No The order of VPN TRUNK VPN Load Balance mechanism profile Status v means such profile is enabled x means such profile is disabled Name
222. VPN Type Remote IP Network Pkts Rate Bps Pkts Rate Bps Time 3 PPTP MPPE 192 168 30 12 192 168 50 1 24 805 3 1088 3 0 40 30 1 evm_7D93D00 via WAN2 IPsec To build a quick VPN connection with IPsec simply click the managed CPE displayed on the Display Screen first and then click such button If the connection is built successfully related information will be displayed on CPE VPN Connection Dray Te k 313 Vigor2860 Series User s Guide List CPE VPN Connection List Virtual Tx Rx Rx Up Network Pkts Rate Bps Pkts Rate Bpos Time YPN Type Remote IP 192 168 30 12 via WAN2 IPsec Tunne 3DES SHA1 192 168 50 1 24 28 3 Aut 1 cym_7D9D00 Advanced To build a VPN connection with detailed configuration such as PPP authentication and VJ compression click Advanced Mozilla Firefox AeA 192 168 1 1 doc cvmY pnA hin Device O0507F7DSD00 w Dial Type PPTP v PPP Authentication PAP ony v VJ Compression ON Specify the remote CPE from the Device drop down list select PPTP or IPsec as the Dial Type choose PAP only or PAP or CHAP as PPP authentication enable ON or disable OFF VJ Compression then click OK to build the VPN connection CPE VPN Connection List VPN Display the name of the LAN to LAN profile It is generated automatically when you click the PPTP IPsec Advanced button to build the VPN connection between Vigor2860 and remote CPE Type Display the dial in type and the authen
223. WPS within two minutes 362 Dray Tek 3 16 6 WDS WDS means Wireless Distribution System It is a protocol for connecting two access points AP wirelessly Usually it can be used for the following application Provide bridge traffic between two LANs through the air Extend the coverage range of a WLAN To meet the above requirement two WDS modes are implemented in Vigor router One is Bridge the other is Repeater Below shows the function of WDS bridge interface LAN3 Se PT ly oo y 36 gt ee 44 4 we ws i 4 De _ rin LAN1 LAN2 The application for the WDS Repeater mode is depicted as below Host with Host with _ Host with bridge Interface 1 repeater Interface bridge Interface 2 b mw gu wmamann _ 2 eoeepes e ese spe eweeeewsw m Dray Tek 363 Vigor2860 Series User s Guide The major difference between these two modes is that while in Repeater mode the packets received from one peer AP can be repeated to another peer AP through WDS links Yet in Bridge mode packets received from a WDS link will only be forwarded to local wired or wireless hosts In other words only Repeater mode can do WDS to WDS packet forwarding In the following examples hosts connected to Bridge 1 or 3 can communicate with hosts connected to Bridge 2 through WDS links However hosts connected to Bridge 1 CANNOT communicate with hosts connected to Bridge 3 through Bri
224. a Control Statistics WANI Disable Kbps Kbps 25 2596 Inactive Status Setup WAN Disable 100000Kbps 100000Kbps 2596 2596 Inactive Status Setup WANS Disable 100000Kbps 100000kKbps 2596 2596 Inactive Status Setup WaAN4 Disable 100000Kbps 100000Kbps 2596 2596 Inactive Status Setup Class Rule Index Service Type Class 1 Class 2 i Edit Class 3 Enable the First Priority for VoIP SIP RTP SIP UDP Port 5060 Default 5060 2 After you click the Edit link you will see the following page Bandwidth Management gt Quality of Service User Defined Service Type NO Name Protocol Port 1 Empty 2 5 Cancel Dr ay Tek 243 Vigor2860 Series User s Guide 3 For adding a new service type click Add to open the following page Bandwidth Management gt Quality of Service Service Type Edit Service Name fe Port Configuration Type Single Range Port Number oo 7 jo Available settings are explained as follows Item Description Service Name Type in a new service for your request The maximum length of the name you can set is 11 characters Service Type Choose the type TCP UDP or TCP UDP or other for the new service Port Configuration Type Click Single or Range as the Type If you select Range you have to type in the starting port number and the end porting number on the boxes below Port Number Type in the starting port number and the end porting number here if you choose Range as the ty
225. able 100000Kbps 100000Kbps 259 25 259 2556 Inactive Status Setup WAN4 Disable 100000Kbps 100000Kbps 25 25 Inactive Status Setup Class Rule Index Name Service Type Class 1 oIP Class 2 IPT i Edit Class 3 Data Email i 10 In the Setup page check the box of Enable the QoS Control Type 30 50 and 15 in the boxes for VoIP IPTV and Data Email respectively Check the box of Enable UDP Bandwidth Control Bandwidth Management gt gt Quality of Service WAN1 General Setup Enable the QoS Control Index Class Name Class 1 VoIP Class 2 IPTV Class 3 Data Email Others C Enable UDP Bandwidth Control O outbound TCP ACK Prioritize Vigor2860 Series User s Guide 456 Dr ay Te k 11 Dray Tek Bandwidth Management gt gt Quality of Service General Setup Index Status Bandwidth Direction WANT Enable Kbps Kbps Outbound WAN Disable 100000Kbps 100000Kbps WANS Disable 100000Kbps 100000Kbps WAN4 Disable 100000Kbps 100000Kbps Class Rule Index Class 1 Class 2 Class 3 457 lass Class Class 1 2 i0 3 Others Bandwidth Click OK to save the settings The class rules for WANI are defined as shown below Setto Factory Default ail Online antec Statistics Status Active Status Status Status Inactive Inactive 25 Inactive Service Type Edit Vigor2860 Series User s Guide 4 5 QoS Setting Example Assume a teleworker some
226. able PING from the Internet Access List List Subnet Mask 4 Next open Applications gt gt Bonjour Check the service that you want to use via Bonjour Applications gt gt Bonjour Bonjour Setup HTTP Server Telnet Server FIP Server SSH Server LPR Printer Server Vigor2860 Series User s Guide 266 Dr ay Te k 5 Open the DNSSD page again The available items will be changed as the follows It means the Vigor router based on Bonjour protocol is ready to be used as a printer server FTP server SSH Server Telnet Server and HTTP Server chrome dnssd content browser html e B Google DNSSD for Firefox Browser Configuration Options Diagnostic Information Interface Name Type Domain Service Info 2 DS1010Plus _http _tcp local Select a service on the left to view further details 2 DS51010Plus WebDAy _http _tcp local 2 HP LaserJet 1300 _ipp _tcp local 2 Vigor Router _ftp _tcp 2 Vigor Router _http _tcp 2 Vigor Router _printer _tcp 2 Vigor Router _ssh _tcp 2 Vigor Router _telnet _tcp 2 tetseng virtual machine UY _udisks ssh _tcp local 2 tetseng virtual machine 00 0c 29 76 be 24 _workstation _tcp local 2 tomkao desktop 00 0c 29 26 09 5d _workstation _tcp local 6 Now any page or document can be printed out through Vigor router installed with a printer Printer Mame Microsoft PS Document Writer r Ahes Auto AP Jet 1200 Series PLL on RD K Auto Microsoft SPS Document Writer
227. address assigned by this router for specified PC MAC Address It displays the MAC address for the specified PC that DHCP assigned IP address for it Dr ay Te k 423 Vigor2860 Series User s Guide Leased Time HOST ID Refresh 3 20 6 NAT Sessions Table It displays the leased time of the specified PC It displays the host ID name of the specified PC Click it to reload the page Click Diagnostics and click NAT Sessions Table to open the list page Diagnostics gt NAT Sessions Table NAT Active Sessions Table 1924 L602 12 192 160 1 1924 166 1 Refresh 24 59 2935 4109 20T 46 25 2 207 46 5 10 Available settings are explained as follows Item Private IP Port Pseudo Port Peer IP Port Interface Refresh Vigor2860 Series User s Guide Description It indicates the source IP address and port of local PC It indicates the temporary port of the router used for NAT It indicates the destination IP address and port of remote host It displays the representing number for different interface Click it to reload the page i Dray Tek 3 20 7 Ping Diagnosis Click Diagnostics and click Ping Diagnosis to pen the web page Diagnostics gt gt Ping Diagnosis Ping Diagnosis Ipv4 OUPVE Note If you want to ping a LAN PC or you don t want to specify which WAN to ping through please select Unspecified Ping through Unspecified Fing to Hosts IP w IP Address fs Run Result
228. aeeesseeeeeeeessaeaeeeeeeeesessaaegeses 211 3 7 11 Notification ODjeCt cc cccccccccsssseecceeeeeeeeeeeeeceeeeesseeseeeeeeeessueesseeeeeeeessaeaaeeeeeeeeessaaeasess 216 I FOES icc arts E E A E E E A E 218 30 1 AFP Enorcomenl Ft OMG erenedeca osceccavandsbaasosesetcecoscedee a Ra oaa iD 219 B02 URE COMI Fier PONE eireas E E AA 222 3 8 3 Web Content Filtet Prole sasssa A EE 227 EOIN AILEY enee E E E E 231 TOS APPE UPPT E Ere a E E E E eee ee eee 232 Vigor2860 Series User s Guide vi Dr ay Tek 3 9 Bandwidth Management cccccssssecccssseecceeseecceeseeceeuseeessageeecseseeeseaueeessageeessageeesseneeenes 233 VS oS NS IW a E eeuesqeacecesaesensesoctaceeeeue 233 292 AMO IGEN a cieside taster trenisciaciesie E a E E EE 235 OS ANE ON V eee A E AAA S E 237 AAO APIC IGNE oe a E E E emai nanenintoanaianonseanetn 246 310 1 Dynamic DNG serras anea I 246 O ANDON e E E 249 OO SC CRIN A EA E E A E E E A E 252 POT ND S er a E E ens te asdeleecsasaseactonteaseocsevasesesaactese 254 3 10 5 LDAP Active Directory S tup ccccccccsseseeecceeeeceseeeeeeeeeeseaeeesseeeeeessssaeaaeeeeeesssaaeaeees 255 OO PUM a E gate lt u gseneeasesaseact poa tocsevsstsarascetes 259 MO ol NGO E E ET E E EE E E T E 261 ON VO ORN LA Norrenan ani a a a cones 262 32109 SMS Mal Alert SEVICE essc a 263 Sel O DOMJOUD ea E E E caren dauueenonaneunias 265 3 11 VPN and Remote ACCESS vex iscssececisnetesecascisencsaantenndeundnlscatnncscdtwaskesniveetadess
229. age Vigor2860 Series User s Guide 236 Dr ay Tek 3 9 3 Quality of Service Deploying QoS Quality of Service management to guarantee that all applications receive the service levels required and sufficient bandwidth to meet performance expectations is indeed one important aspect of modern enterprise network One reason for QoS is that numerous TCP based applications tend to continually increase their transmission rate and consume all available bandwidth which is called TCP slow start If other applications are not protected by QoS it will detract much from their performance in the overcrowded network This is especially essential to those are low tolerant of loss delay or jitter delay variation Another reason is due to congestions at network intersections where speeds of interconnected circuits mismatch or traffic aggregates packets will queue up and traffic can be throttled back to a lower speed If there s no defined priority to specify which packets should be discarded or in another term dropped from an overflowing queue packets of sensitive applications mentioned above might be the ones to drop off How this will affect application performance There are two components within Primary configuration of QoS deployment Classification Identifying low latency or crucial applications and marking them for high priority service level enforcement throughout the network Scheduling Based on classification of serv
230. age the router from LAN interface Check the box es to specify Apply To Check the LAN interface for the administrator to use for accessing into web user interface of Vigor router You could specify that the system administrator can only login from a specific host or network defined in the list A maximum of three Ps subnet masks is allowed List IP Indicate an IP address allowed to login to the router Subnet Mask Represent a subnet mask allowed to login to the router User Define Ports Check to specify user defined port numbers for the Telnet HTTP HTTPS FTP TR 069 and SSH servers Default Ports Check to use standard port numbers for the Telnet and HTTP servers CVM Port Check the box to enable such port setting CVM SSL Port Check the box to enable such port setting After finished the above settings click OK to save the configuration Vigor2860 Series User s Guide a Dray Tek For IPv6 System Maintenance gt gt Management IPv4 Management Setup Management Access Control IPv Management Setup Allow management fram the Internet C Telnet Server Port 23 C HTP Server Port 2860 C HTTPS Server Port 443 C SSH Server Port 22 C Enable PING from the Internet Access List List IPv Address Prefis Length 1 TE 2 SSS O Note Telnet Http server port is the same as IPy4 Available settings are explained as follows Item Management Access
231. ain office even in a guest network or web cafe The SSL technology is the same as the encryption that you use for secure web sites such as your online bank The SSL VPN can be operated in either full tunnel mode or proxy mode Now Vigor2860 series allows up to 16 simultaneous incoming users For SSL VPN identity authentication and power management are implemented through deploying user accounts Therefore the user account for SSL VPN must be set together with remote dial in user web page Such menu item will guide to access into VPN and Remote Access gt gt Remote Dial in user SSL VPN gt Remote Dial in User Remote Access User Accounts Setto Factory Default Index User Active Status Index User Active Status d F 17 C 2 Oo 18 C 3 d 19 7 d A C 20 777 C 5 F oe 21 O 6 C oe 22 d p I 2 d 23 d a d Has 24 PTT d mas 9 EEE LI 25 777 C ee 10 272 L a 26 777 F 11 oF F Tes 2f LI ois 12 d 28 777 C 13 d 29 777 C 14 C 30 C 15 d 34 C 16 277 Oo ts 32 299 o o Note User Accounts need to be added into User Group to enable SSL Portal Login Click each index to edit one remote user profile Dray Te k 379 Vigor2860 Series User s Guide SSL VPN gt Remote Dial in User Index No 1 User account and Authentication iceman 999 C Enable this ac
232. al mode of Ethernet WAN gt General Setup WAN 2 Enable Display Name Physical Mode Physical Type Line Speedikbps DownLink UpLink VLAN Tag insertion Tag value Priority Active Mode Backup Type Only if acting as backup for multiple WAR Note Ethernet p p o 4095 pj o r Load Balance Owan i wan oO wan aClwan 4 When any of selected WAN disconnect O when all of selected WAN disconnect The line speed setting of WAN interface is available only when According to Line Speed is selected as the Load Balance Mode Vigor2860 Series User s Guide 78 Dray Tek Available settings are explained as follows Item Description Enable Choose Yes to invoke the settings for this WAN interface Choose No to disable the settings for this WAN interface Display Name Type the description for such WAN interface Physical Mode Display the physical mode of such WAN interface Physical Type You can change the physical type for WAN2 or choose Auto negotiation for determined by the system Auto negotiation 10M full duplex 100M half duplex 100M full duplex 1000M full duplex Dray Tek Line Speed If your choose According to Line Speed as the Load Balance Mode please type the line speed for downloading and uploading for such WAN interface The unit is kbps VLAN Tag insertion Enable Enable the function of VLAN with tag The router will add specific VLAN number to all pa
233. all gt gt Edit Filter Set gt gt Edit Filter Rule Filter Set 1 Rule 2 Comments Index 1 15 in Schedule Setup E a E Clear sessions when schedule ON C Enable Direction Deesa IF ny Service Tyoe Anw For the detailed configuration simply refer to Firewall gt gt Filter Rule The firewall filter rules that are not selected in Firewall gt gt General gt gt Default rule can be available for use in User Management gt gt User Profile The router will authenticate the dial in user by itself or by external service such as LDAP server or Radius server If LDAP or Radius is selected here it is not necessary to configure the password setting above Time of login log out block unblock for the user s can be sent to and displayed in Syslog Please choose any one of the log items to take down relational records for the user s Mone If such function is enabled a pop up window will be displayed on the screen with time remaining for connection if Idle Timeout is set However the system will update the time periodically to keep the connection always on Thus Idle Timeout will not interrupt the network connection Any user from LAN side or WLAN side tries to connect to Internet via Vigor router must be authenticated by the router first There are three ways offered by the router for the user to choose for authentication Web If it is selected the use can type the URL of the router from any browser
234. all to automatically open the ports that they need to pass through a router It is more reliable than requiring a router to work out by itself which ports need to be opened Further the user does not have to manually set up port mappings or a DMZ UPnP is available on Windows XP and the router provide the associated support for MSN Messenger to allow full use of the voice video and messaging features Applications gt UPnP T Enable UPnP Service Default WAN Cl Enable Connection control Service L Enable Connection Status Service Note If you intend running UPnP service inside your LAN you should check the appropriate service above to allow control as well as the appropriate UPnP settings Clear Cancel Available settings are explained as follows Item Description Enable UPNP Service Accordingly you can enable either the Connection Control Service or Connection Status Service 1 It is used to specify the WAN interface for applying such function Default WAN Default WAN After setting Enable UPNP Service setting an icon of IP Broadband Connection on Router on Windows XP Network Connections will appear The connection status and control status will be able to be activated The NAT Traversal of UPnP enables the multimedia features of your applications to operate This has to manually set up port mappings or use other similar methods The screenshots below show examples of this facility Dr ay Tek 259 Vigor2860 Series U
235. als to create a protected secure channel Main mode is more secure than Aggressive mode since more exchanges are done in a secure channel to set up the IPsec session However the Aggressive mode is faster The default value in Vigor router is Main mode IKE phase 1 proposal To propose the local available authentication schemes and encryption algorithms to the VPN peers and get its feedback to find a match Two combinations are available for Aggressive mode and nine for Main mode We suggest you select the combination that covers the most schemes IKE phase 2 proposal To propose the local available algorithms to the VPN peers and get its feedback to find a match Three combinations are available for both modes We suggest you select the combination that covers the most algorithms IKE phase 1 key lifetime For security reason the lifetime of key should be defined The default value is 28800 seconds You may specify a value in between 900 and 86400 seconds IKE phase 2 key lifetime For security reason the lifetime of key should be defined The default value is 3600 seconds You may specify a value in between 600 and 86400 seconds Perfect Forward Secret PFS The IKE Phase 1 key will be reused to avoid the computation complexity in phase 2 The default value is inactive this function Local ID In Aggressive mode Local ID is on behalf of the IP address while identity authenticating with remote VPN server The length of the
236. an set an object with different monitoring situation Object Settings gt Notification Object Set to Factory Default Index Profile Name Settings er ei iS i To set a new profile please do the steps listed below 1 Open Object Setting gt gt Notification Object and click the number e g 1 under Index column for configuration in details Object Settings gt Notification Object Index Profile Name e ie iY i Vigor2860 Series User s Guide 216 Dr ay Tek 2 The configuration page will be shown as follows Object Settings gt Notification Object Profile Index 1 Profile Name Notify attack Category Status WAN Disconnected Reconnected VPN Tunnel Disconnected Reconnected Temperature Alert LJ out of Range Available settings are explained as follows Item Description Profile Name Type a name for such notification profile The maximum length of the name you can set is 15 characters Category Display the types that will be monitored Status Display the status for the category You can check the box you want to be monitored 3 After finishing all the settings here please click OK to save the configuration Object Settings gt Notification Object Setto Factory Default Index Profile Name Settings Notify attack WAN VPN je ee w Dr ay Tek 217 Vigor2860 Series User s Guide 3 8 CSM Profile CSM is an abbreviation of Content Security Management which is used to control IM P2P usage fi
237. anagement menu click Sessions Limit to open the web page Bandwidth Management gt Sessions Limit Sessions Limit Enable Disable Default Max Sessions Limitation List Index Start IF End IF Hax Sessions Specific Limitation startme end Maximum Sessions e Administration Message Max 256 characters Default Message Time Schedule Index 1 15 in Schedule Setup Note Action and Idle Timeout settings will be ignored To activate the function of limit session simply click Enable and set the default session limit Available settings are explained as follows Item Description Session Limit Enable Click this button to activate the function of limit session Disable Click this button to close the function of limit session Dr ay Tek 233 Vigor2860 Series User s Guide Default session limit Defines the default session number used for each computer in LAN Limitation List Displays a list of specific limitations that you set on this web page Specific Limitation Start IP Defines the start IP address for limit session End IP Defines the end IP address for limit session Maximum Sessions Defines the available session number for each host in the specific range of IP addresses If you do not set the session number in this field the system will use the default session limit for the specific limitation you set for each index Add Adds the specific session limitation ont
238. ant to offer service in a local host You should click the appropriate index number to edit or clear the corresponding entry Comment Specify the name for the defined network service WAN Interface Display the WAN interface used by such index Aux WAN IP Display the IP alias setting used by such index If no IP alias setting exists such field will not appear Local IP Address Display the private IP address of the local host offering the Service Status Display the state for the corresponding entry X or V is to represent the Inactive or Active state To add or edit port settings click one index number on the page The index entry setup page will pop up In each index entry you can specify 10 port ranges for diverse services Dray Te k 161 Vigor2860 Series User s Guide NAT gt Open Ports gt gt Edit Open Ports Index No 10 Enable Open Ports WAN Interface WANI Private IF OoOo Choose IP Protocol Start Port End Port Protocol p b p e p e p e p e Available settings are explained as follows Item Description Enable Open Ports Check to enable this entry Comment Make a name for the defined network application service WAN Interface Specify the WAN interface that will be used for this entry WAN IP Specify the WAN IP address that will be used for this entry This setting is available when WAN IP Alias is configured Private IP Enter the private IP address of the local host or click Ch
239. any more until the administrator manually adds additional time for you Vigor2860 Series User s Guide 516 Dr ay Te k Authentication via VigorPro Alert Notice Tool Authentication via Web or Telnet is convenient for users however it has some limitations The most advantage with VigorPro Alert Notice Tool to operate the authentication is the ability to do auto login If the timeout value set on the router for the user account has been reached the router will stop the client computer from accessing the Internet until it does an authentication again Authentication via VigorPro Alert Notice Tool allows user to setup the re authentication interval so that the utility will send authentication requests periodically This will keep the client hosts from having to manually authenticate again and again The configuration of the VigorPro Alert Notice Tool is as follows 1 Click Authenticate Now to start the authentication immediately Authentication account info Settings Authentication V Enable User Name z ser rd 1 User Password Authentication oe Gatew y IP address V Enable Auto Login Syne Interval 1 9999 gin Status Authentication Success Time Remaining Auto Login allows the Alter Tool to Logout i Authentication Now authenticate the account automatically ax Cancel The Time Quota left Click Logout to keep the Time Quota 2 You may get the VigorPro Alert Notice Tool from
240. are using Notice that this setting is available for WAN1 only Type the additional WAN IP address and check the Enable box Then click OK to exit the dialog a E WANIIF Alias Windows nternet Explorer Sz x E hitp192 168 1 1 bf WAN1 IP Alias Multi NAT Index Enable Aux WAN IP Join NAT IF Pool ai L C dl d ad E Obtain an IP address automatically Click this button to obtain the IP address automatically Router Name Type in the router name provided by ISP Domain Name Type in the domain name that you have assigned Specify an IP address Click this radio button to specify some data IP Address Type in the private IP address Subnet Mask Type in the subnet mask Gateway IP Address Type in gateway IP Vigor2860 Series User s Guide 88 Dr ay Tek address Default MAC Address Type in MAC address for the router You can use Default MAC Address or specify another MAC address for your necessity Specify a MAC Address Type in the MAC address for the router manually DNS Server IP Address Type in the primary IP address for the router If necessary type in secondary IP address for necessity in the future After finishing all the settings here please click OK to activate them Details Page for PPPoE PPPOA in WAN1 Physical Mode ADSL WAN gt Internet Access WAN 1 PPPoE PPPoA MPoA Static or Dynamic IP IPvo Enable Disable ISP Acces
241. arranty does not cover the bundled or licensed software of other vendors Defects which do not significantly affect the usability of the product will not be covered by the warranty We reserve the right to revise the manual and online documentation and to make changes from time to time in the contents hereof without obligation to notify any person of such revision or changes Web registration is preferred You can register your Vigor router via http www DrayTek com Due to the continuous evolution of DrayTek technology all routers will be regularly upgraded Please consult the DrayTek web site for more information on newest firmware tools and documents http www DrayTek com iii Vigor2860 Series User s Guide European Community Declarations Manufacturer DrayTek Corp Address No 26 Fu Shing Road Hukou Township Hsinchu Industrial Park Hsinchu County Taiwan 303 Product Vigor2860 Series Router DrayTek Corp declares that Vigor2860 Series of routers are in compliance with the following essential requirements and other relevant provisions of R amp TTE 1999 5 EC ErP 2009 125 EC and RoHS 2011 65 EU The product conforms to the requirements of Electro Magnetic Compatibility EMC Directive 2004 108 EC by complying with the requirements set forth in EN55022 Class B and EN55024 Class B The product conforms to the requirements of Low Voltage LVD Directive 2006 95 EC by complying with the requirements set forth in EN60950 1
242. as follows Item Check to enable the Filter Rule Comments Index 1 15 Clear sessions when schedule ON Direction Vigor2860 Series User s Guide Description Check this box to enable the filter rule Enter filter set comments description Maximum length is 14 character long Set PCs on LAN to work at certain time interval only You may choose up to 4 schedules out of the 15 schedules pre defined in Applications gt gt Schedule setup The default setting of this field is blank and the function will always work Check this box to clear the sessions when the above schedule profiles are applied Set the direction of packet flow It is for Data Filter only For the Call Filter this setting is not available since Call Filter is only applied to outgoing traffic 174 Dray Tek Dray Tek Source Destination IP Service Type LAMRTAPN gt WAM LAN RTAVPN gt WAN WAN gt LANRTAVPN LAMRTAPN gt LANRTA PN Note RT means routing domain for 2nd subnet or other LAN Click Edit to access into the following dialog to choose the source destination IP or IP ranges Paa gt IP Address Edit Windows Internet Explorer 192 168 1 1 IP Address Edit Address Type Any Address a Start IP Address End IP Address Subnet Mask Invert Selection IP Group or IP Object or IP Object or IP Object IPv6 Group or IPv6 Object or IPv6 Object or IPv6 Object
243. ata can be written to it 2 Then please open USB Application gt gt USB General Settings to enable Samba service USB Application gt gt USB General Settings USB General Settings General Settings Simultaneous FTP Connections 5 Maximum 6 Default Charset English ka Samba Service Settings Network Neighborhood Disable Access Mode OLAN Only LAN And WAN NetBios Name Service Host Name Vigor2o60 Note 1 If Charset is set to English only English long file name is supported 2 Multi session ftp download will be banned by Router FTP server If your ftp client have multi connection mechanism such as FileZilla you may limit client connections setting to 1 to get better performance 3 A workgroup name must not be the same as the host name The workgroup name and the host name can have as many as 15 characters and a host name can have as many as 23 characters but both cannot contain any of the following lt 2 7 Vigor2860 Series User s Guide 446 Dr ay Te k 3 Setup a user account for the FTP service by using USB Application gt gt USB User Management Click Enable to enable FTP Samba User account Here we add a new account userl and assign authorities Read Write and List to it USB Application gt gt USB User Management Profile Index 1 FTP Samba User Username Password Access Rule File Read Write CO Delete Directory JList C creata Remove Note The f
244. ation Virtual Network Computing VNC It allows you to access and control a remote PC through VNC protocol Remote Desktop Protocol RDP It allows you to access and control a remote PC through RDP protocol Samba Application It allows you to access and control a remote PC through Samba service If you choose VNC or RDP you have to type the IP address for this protocol If you choose VNC or RDP you have to specify the port used for this protocol The default setting is 5900 If you choose VNC you have to specify the time for disconnecting the SSL VPN tunnel If you choose VNC you have to choose the percentage 100 80 60 for such application If you choose RDP you have to choose the screen size for such application If you choose Samba you have to specify the path of the Samba service 377 Vigor2860 Series User s Guide Enter the required information 4 After finished the above settings click OK to save the configuration 53L VPN gt gt SSL Application SSL Applications Profiles Index Name Host Address Service Active 4 VNC_1 1927 168 1 51 5900 VNC Vv 2 x a x Vigor2860 Series User s Guide 378 Dr ay Te k 3 17 4 User Account With SSL VPN Vigor2860 series let teleworkers have convenient and simple remote access to central site VPN The teleworkers do not need to install any VPN software manually From regular web browser you can establish VPN connection back to your m
245. ation Interface Address 203 69 175 51 Any Any Src IP Start Src IP End Set to Factory Default Dest Dest Dest IP End Port Port Start End 203 oa k9 LU GaS AnA Any Down Down Move Move Up Down Dest IP Start UP UP Down UP Down UP Down UP Down UP Down UP Down UP Down UP Down Next gt gt Now the packets sent to the remote PC IP address 203 65 1 35 will be forcefully to pass through WANI Vigor2860 Series User s Guide 508 Dray Tek 4 18 How to authenticate clients via User Management Before using the function of User Management please make sure User Based has been selected as the Mode in the User Management gt gt General Setup page User Management gt General Setup General Setup Rule Based Llser Hased Web Authentication HTTPS Hotice User Management will refer to active rules in Data Filter as whitelists and blacklists In User based firewall mode Users match the above lists will not be required for authentication The firewall rules policy will still walid Otherwise authentication required for users not matched the above lists The firewall rules designated in the user profile s policy will still valid Landing Page Max 255 characters Preview Setto Factory Default thody states l gt lt script langquage jJavascript gt window Llocation http wm draytek com scripte body With User Management authentication function before a val
246. ation PAPICHAPINME CHAPIME CHAPY2 VI Compression On off IKE Authentication Method Pre Shared Key ae Digital Signaturel 509 Peer ID Local ID Alternative Subject Name First Subject Name First Local Certificate IPsec Security Method MecdiumicH High SP DES winor Auhertoaion E Indexf 1 15 in Schedule Setup Vigor2860 Series User s Guide Available settings are explained as follows Item Description Common Settings Profile Name Specify a name for the profile of the LAN to LAN connection Enable this profile Check here to activate this profile VPN Dial Out Through Use the drop down menu to choose a proper WAN interface for this profile This setting is useful for dial out only WANA First WANA First WANT Only WAND First WANZ Only WANT only Only establish VPN if VAN down WANZ only Only establish VPN if WANI down WARNS First WARNS Only WAMA First WAMA Onl WAN First WAN2 First WAN3 First WAN4 First While connecting the router will use WANI WAN2 WANS as the first channel for VPN connection If WAN1 WAN2 WAN3 WAMN4 fails the router will use another WAN interface instead WANI Only WAN2 Only WAN 3 Only WAN 4 Only While connecting the router will use WANI WAN2 WAN3 WAN4 as the only channel for VPN connection WANI Only Only establish VPN if WAN2 down If WAN2 failed the router will use WANI for VPN connection WAN2 Only Only establish VPN i
247. ation IP Any Any IP can be treated as the destination IP Dest IP Start Type the destination IP start for the specified WAN interface Dest IP End Type the destination IP end for the specified WAN interface If this field is blank it means that all the destination IPs will be passed through the WAN interface 3 Click Next to get the following page Load Balance Route Policy Index 1 Interface Load Balance Route Policy directs the packets to the interface below Interface LANS Available settings are explained as follows Item Description Interface Use the drop down list to choose a WAN or LAN interface or VPN profile Packets match with the above criteria will be transferred to the interface chosen here Dr ay Tek 149 Vigor2860 Series User s Guide 4 After specifying the interface click Next to get the following page Load Balance Route Policy Index 1 NAT or Routing Based on the settings in the previous pages we guess you want to have Force NAT The current setting is Force NAT Force Routing Available settings are explained as follows Item Description Force NAT Force It determines which mechanism that the router will use to Routing forward the packet to WAN 5 After choosing the mechanism click Next to get the summary page for reference Load Balance Route Policy Index 1 Configuration Summary Criteria Source IP Any Destination IP 192 168 1 6 192 168 1 66 Interfac
248. ator Password This page allows you to set new password System Maintenance gt gt Administrator Password Setup Administrator Password Old Password New Password Confirm Password fo Max 23 characters allowed fo Max 23 characters allowed Note Password can contain only a z A z 0 9 lt c gt 4 7 08 710 Administrator Local User C Local User Local User List Specific User Confirm Password it od Enable Admin Login From an Administrator LDAP Setting C Enable LDAFP AD login for Admin users Enable Admin Login Fram Warn LDAP Server Profiles LDAP Profile Setup Note Please select Admin fram group select box on login WI Available settings are explained as follows Item Administrator Password Administrator Local User Dray Tek Description Old Password Type in the old password The factory default setting for password is admin New Password Type in new password in this field The length of the password is limited to 23 characters Confirm Password Type in the new password again The administrator can login web user interface of Vigor router to modify all of the settings to fit the requirements This feature allows other user in LAN who can access into the web user interface with the same privilege of the administrator Local User Check the box to enable the local user configuration Local User List It displays the username of the
249. atus ADSL information and so on Dr ay Tek 25 Vigor2860 Series User s Guide Physical Connection for IPv4 Protocol Online Status Physical Connection LAN Status IP Address 10 28 60 1 WAN 1 Status Enable WAN Status Enable WAN 3 Status Enable WAN 4 Status Enable ADSL Information ATM Statistics ADSL Status Physical Connection for IPv6 Protocol Online Status Physical Connection IPw4 Mode IPv4 TX Packets 100092 Line Ethernet GW IP 10 39 0 1 ADSL Firmware version TX Cells O State IPvb Primary DNS 10 39 0 1 Name TX Packets 0 Name TX Packets 1174358 Name TX Packets 0 Name TX Packets 0 RX Cells T Up Speed TRAINING 0 RX Packets 2402 77 Mode PPPoE TX Rate Bps 0 Mode DHEP Client TX Rate Bps 9696 Mode TX Rate Bps O 05 04 04 04 00 01 4 TX CRC errs O Down Speed 0 System Uptime Sdays 0 24 15 Secondary DNS 3 6 4 4 Up Time 00 00 g RX Packets 0 Up Time 2156 24 07 RX Packets 15a2lSr Up Time 00 00 oa RX Packets 0 Up Time 00 00 00 RX Packets 0 gt gt Dial PPPoE RX Rate Bps 0 gt gt Release RX Rate Bps l4 Signal RX Rate Bps 0 Signal RX Rate Bps O RX CRC errs 0 SNR Margin 0 Loop Att 0 System Uptime O 1 18 LAN Status IP Address 2001 4DD0 FFOO 83E4 210 44FF FE46 2568 o4 Global FESO 210 44FF FE46 25608 64 Lin
250. authenticate for connection when you select PPTP or L2TP with or without IPsec policy above The length of the name is limited to 11 characters For Psec L2TP IPsec authentication you have to type a pre shared key The length of the name is limited to 64 characters Type the pre shared key again for confirmation Check the box of Digital Signature to invoke this function Peer ID Choose the peer ID selection from the drop down list Local ID Choose Alternative Subject Name First or Subject Name First Type the WAN IP address or VPN client IP address for the remote client Type the ID name for the remote client The length of the name is limited to 47 characters 61 Vigor2860 Series User s Guide Remote Network IP Please type one LAN IP address according to the real location of the remote host for building VPN connection Remote Network Mask Please type the network mask according to the real location of the remote host for building VPN connection 3 After finishing the configuration please click Next The confirmation page will be shown as follows If there is no problem you can click one of the radio buttons listed on the page and click Finish to execute the next action VPN Server Wizard Please Confirm Your Settings YEN Environment Site to Site VPN L amp N to Lan Index 2 Profile Name 27 Lsername fe Allowed Service PPTP L2TP with IPsec Policy Peer IPVPN Client IP Peer ID 456
251. avorites Sep E Suggested Sites v g8 Web Slice Gallery v S Certificate Error Navigation Blocked ty Bl me Pager Safetyy Toos iv There is a problem with this website s security certificate The security certificate presented by this website was not issued by a trusted certificate authority The security certificate presented by this website was issued for a different website s address Security certificate problems may indicate an attempt to fool you or intercept any data you send to the server We recommend that you close this webpage and do not continue to this website Click here to close this webpage x Continue to this website not recommended More information Internet Protected Mode On With Mozilla Firefox you may get the following warning message Select I Understand the Risks Firefox 2 Untrusted Connection i e ibe httes 197 168 01 cqi bin userloginvagifid 101 amp erc_ip 192 16 L This Connection is Untrusted You have asked Firefox to connect securely to 192 168 1 1 but we can t confirm that your connection is secure Normally when you try to connect securely sites will present trusted identification to prove that you are going to the right place However this site s identity cant be verified What Should I Do If you usually connect to this site without problems this error could mean that someone is trying te impersonate the site
252. axis has different meanings For WANI WAN2 WAN3 WAN4 Bandwidth chart the numbers displayed on vertical axis represent the numbers of the transmitted and received packets in the past For Sessions chart the numbers displayed on vertical axis represent the numbers of the NAT sessions during the past Vigor2860 Series User s Guide 428 Dr ay Tek 3 20 10 Trace Route Click Diagnostics and click Trace Route to open the web page This page allows you to trace the routes from router to the host Simply type the IP address of the host in the box and click Run The result of route trace will be shown on the screen Diagnostics gt gt Trace Route Trace Route IPV4 OIPV6 Trace through Unspecified Protocol ICMP Host IP Address i Result Clear Or Diagnostics gt gt Trace Route Trace Route Trace Host IPAddress o O Run Result Clear Available settings are explained as follows Item Description IPv4 IP v6 Click one of them to display corresponding information for it Trace through Use the drop down list to choose the interface that you want Dr ay Tek 429 Vigor2860 Series User s Guide to ping through Protocol Use the drop down list to choose the protocol that you want to ping through Host IP Address It indicates the IP address of the host Trace Host IP Address It indicates the IPv6 address of the host Run Click this button to start route tracing work Clear Click this link to remove the
253. before Make sure you have recorded all useful settings before you pressing The password of factory default is null Software Reset You can reset the router to factory default via Web page Such function is available in Admin Mode only Go to System Maintenance and choose Reboot System on the web page The following screen will appear Choose Using factory default configuration and click Reboot Now After few seconds the router will return all the settings to the factory settings Vigor2860 Series User s Guide 524 Dray Tek System Maintenance gt gt Reboot System Reboot System Do you want to reboot your router Using current configuration Using factory default configuration Reboot Now Auto Reboot Time Schedule Indexf1 15 in Schedule Setup Et Note Action and Idle Timeout settings will be ignored Hardware Reset While the router is running ACT LED blinking press the Factory Reset button and hold for more than 5 seconds When you see the ACT LED blinks rapidly please release the button Then the router will restart with the default configuration Factory USB ADSL Phonet Factory cy O a Reset WAN VDSL Phone Phanet 2 After restore the factory default setting you can configure the settings for the router again to fit your personal request 5 7 Contacting Your Dealer If the router still cannot work correctly after trying many efforts please contact y
254. bject Setup Profile Index 1 Name tt y y Contents DLO ef Limit of Contents Max 3 Words and 63 Characters Each word should be separated by a single space You can replace a character with HEX Example Contents backdoo 7 virus keep 200ut Result 1 backdoor 2 virus 3 keep out Available settings are explained as follows Item Description Name Type a name for this profile e g game Maximum 15 characters are allowed Contents Type the content for such profile For example type gambling as Contents When you browse the webpage the page with gambling information will be watched out and be passed blocked based on the configuration on Firewall settings 3 After finishing all the settings please click OK to save the configuration Dr ay Tek 207 Vigor2860 Series User s Guide 3 7 8 Keyword Group This page allows you to bind several keyword objects into one group The keyword groups set here will be chosen as black white list in CSM gt gt URL Web Content Filter Profile Objects Setting gt Keyword Group Keyword Group Table Set to Factory Default Index Name Index Name wa foo Joo po Po Ro Jeo po po eo jea ao j oe j IS S S B le S l le e e e S E e le B l la e B le l is e m S ie e e IS je Available settings are explained as follows Item Description Set to Factory Default Clear all profiles Index Display the profile number that you can configure Name Display the na
255. ble PING to keep alive is used to handle abnormal IPsec VPN connection disruption It will help to provide the state of a VPN connection for router s judgment of redial Normally if any one of VPN peers wants to disconnect the connection it should follow a serial of packet exchange procedure to inform each other However if the remote peer disconnect without notice Vigor router will by no where to know this situation To resolve this dilemma by continuously sending PING packets to the remote host the Vigor router can know the true existence of this VPN connection and react accordingly This is independent of DPD dead peer detection PING to the IP Enter the IP address of the remote host that located at the other end of the VPN tunnel Type of Server I am calling PPTP Build a PPTP VPN connection to the server through the Internet You should set the identity like User Name and Password below for the authentication of remote server IPsec Tunnel Build an IPsec VPN connection to the server through Internet L2TP with IPsec Policy Build a L2TP VPN connection through the Internet You can select to use L2TP alone or with IPsec Select from below None Do not apply the IPsec policy Accordingly the VPN connection employed the L2TP without IPsec policy can be viewed as one pure L2TP connection Nice to Have Apply the IPsec policy first if it is applicable during negotiation Otherwise the dial out VPN connection bec
256. box of Digital Signature to invoke this function and Select one predefined Profiles set in the VPN and Remote Access gt gt IPSec Peer Identity IPSec Security Method This group of fields is a must for IPSec Tunnels and L2TP with IPSec Policy when you specify the remote node Check the Medium DES 3DES or AES box as the security method Medium Authentication Header AH means data will be authenticated but not be encrypted By default this option is invoked You can uncheck it to disable it High Encapsulating Security Payload ESP means payload data will be encrypted and authenticated You may select encryption algorithm from Data Encryption Standard DES Triple DES 3DES and AES Local ID Specify a local ID to be used for Dial in setting in the LAN to LAN Profile setup This item is optional and can be used only in IKE aggressive mode After finishing all the settings here please click OK to save the configuration Vigor2860 Series User s Guide 382 Dr ay Tek 3 17 5 User Group There are 10 user group profiles which can be created for authentication by LDAP server Such profiles will be used by applications such as User Management VPN and etc SSL VPN gt gt User Group SSL User Group Profiles Setto Factory Default Index Name Status q X 2 x J x 4 x o x X a x g X 10 x Each item 1s explained as follows Item Description Set to Factory Default Click to clear all indexes Index Dis
257. by using web console have the same effects as modified through web user interface The functions settings modified under Web Console also can be reviewed on the web user interface Click the Web Console icon on the top of the main screen to open the following screen 2 http 172 16 2 132 8080 Mdoc console_htm Windows Internet Explorer ea htt 72 16 2 1320080rdocitonsole hin Type for command help gt 2 Valid commands are adsl bpa 3 ddns di exit internet ip ipi ipf mngt msubnet object portmaptime qos quit show switch testmail upnp wigbrg Vpn an wol nand Vigor2860 Series User s Guide 24 Dr ay Te k 1 7 6 Config Backup ewe There is one way to store current used settings quickly by clicking the Config Backup icon It allows you to backup current settings as a file Such configuration file can be restored by using System Maintenance gt gt Configuration Backup Simply click the icon on the top of the main screen and a pop up dialog will appear Opening 2860 20140402 cfz x You have chosen to open 2000 20140402 ciz whichis cte File 8 8 EB from hittp l72 16 3 133 2860 What should Firefox do wath this file Click Save to store the setting 1 7 7 Logout E Click this icon to exit the web user interface 1 8 Online Status Online Stat 1 8 1 Physical Connection Such page displays the physical connection status such as LAN connection status WAN connection st
258. c ar Dynamic IP aa Details Page Mone WANS USB PPPoE Static or Dynamic IF WAN USB PPTPILITP Note Only one WAN can support Pv6 You can configure DHCP client options here WAN gt gt Internet Access Internet Access Index Display Name Physical Mode Access Mode WANI ADSL VOSL2 MPoAs Static or Dynamic IP w Details Page eh Ethernet Static or Dynamic IF Ww Details Fage Pye WANS USB 3IG 4G USB Modem PPP mode Details Page Pye WAN USB Pye 36 46 USB ModemiPPP mode Note 1 Device on USB port 1 applies WANS 4G USB Modem DHCP mode Device on USB port 2 applies WAN4 configuration 2 Only one WAN can support IPy Advanced You can configure DHCP client options here Available settings are explained as follows Item Description Index Display the WAN interface Display Name It shows the name of the WAN1 WAN2 WAN3 WAN4 that entered in general setup Physical Mode It shows the physical connection for Vigor2860 Series User s Guide 82 Dr ay Te k Dray Tek Access Mode Details Page IPv6 Advanced WANI ADSL VDSL2 WAN2 Ethernet WAN3 WAN4 3G 4G USB Modem according to the real network connection Use the drop down list to choose a proper access mode The details page of that mode will be popped up If not click Details Page for accessing the page to configure the settings This button will open different web page based on IPv4 according to the access m
259. cal connection will be shows as follows Online Status Physical Connection System Uptime Oday 0 4 16 IPv4 IPv6 LAN Status IP Address TX Packets RX Packets 80 WAN1 IPv6 Status Enable Mode 6in4 Static Tunnel 0 04 07 Gateway IP TA Packets RX Packets RX Bytes 3 26 2302 Dray Te k 441 Vigor2860 Series User s Guide rd Choose 6rd Type IPv4 Border Relay IPv4 Mask Length 6rd Prefix and 6rd Prefix Length WAN 1 PPPoE Static or Dynamic IP PPTP L2TP IPv6 Internet Access Mode Connection Type 6rd 6rd Settings 6rd Mode Auto 6rd Static 6rd Static 6rd Settings IPv4 Border Relay 192 168 101 111 IPv4 Mask Length 0 6rd Prefix 2001 E41 6rd Prefix Length 32 Click OK and open Online Status If the connection is successful the physical connection will be shows as follows Online Status Physical Connection System Uptime Oday 0 9 15 LAN Status IP Address 3 11B4 64 RX Packets 113 WAN1 IPv6 Status Enable Gateway IP FE80 C0OA8 651D 128 Link TX Packets RX Packets 13 29 Vigor2860 Series User s Guide 442 Dr ay Te k ll Configuring the LAN Settings After finished the WAN settings for IPv6 please configure the LAN settings to make the router s client getting the Pv6 address 1 Access into the web user interface of Viogr2860 Open LAN gt gt General Setup Click the IP v6 button Note Only the subnet of LAN1 supports IPv6 feature LAN gt Gene
260. ce WAN 1 PPPoE Static or Dynamic IP PPTP L2TP IPv6 Internet Access Mode Connection Type 6rd a 6rd Settings 6rd Mode Auto 6rd Static 6rd Static 6rd Settings IPv4 Border Relay 192 168 101 111 IPv4 Mask Length 0 6rd Prefix 2001 E41 6rd Prefix Length 32 OK Cancel Available settings are explained as follows Item Description 6rd Mode Auto 6rd Retrieve 6rd prefix automatically from 6rd service provider The IPv4 WAN must be set as DHCP Static 6rd Set 6rd options manually IPv4 Border Relay Type the IPv4 addresses of the 6rd Border Relay for a given 6rd domain IPv4 Mask Length Type a number of high order bits that are identical across all CE IPv4 addresses within a given 6rd domain It may be any value between 0 and 32 Vigor2860 Series User s Guide 112 Dr ay Te k 6rd Prefix Type the 6rd IPv6 address 6rd Prefix Length Type the IPv6 prefix length for the 6rd IPv6 prefix in number of bits After finished the above settings click OK to save the settings Below shows an example for successful IPv6 connection based on 6rd mode Online Status Physical Connection System Uptime Oday 0 9 15 IPv4 IPv6 LAN Status IP Address 2001 E41 A865 1D00 21D AAFF FE83 1164 64 Global FESO 21D AM4AFF FE83 1164 64 Link TX Packets RX Packets TX Bytes 115 1354 WAN1 IPv6 Status Enable Mode Up Time 6rd 0 09 06 Gateway IP 2001 41 4865 1D01 21D AAFF FEB3 1165 128 Global F
261. ceesceesceauseceeseeauseceesseauseeecssuaaseeesssuaeessssagages 154 3 4 2 DMZ moc 158 ois OPN PON ee ee eee eee eee eee 161 Se POPE TOO SING ticcitncaterea A E E A 163 OY NN EEE eect eee ceases A NTE V EEN E A N E EE T 166 3 9 1 Basics lor Firewall sicssprsiironiscs niaaa a a aE O EATA a EERENS 166 Sowa E E e eE i ee A ee E E ee E A 168 CAE EET o EI A E E A E E EE E T A E 173 Oe OO CTS SS r E E 181 3 6 User Mic hl AGS MIG WM ses obsscasaeceugssactces susadseemesshassiesbasecenstnesesecsebeasessedecpesneieu suesnectasses nectacceeeass 185 SKEE Eg eie Ee 6 ID sass E A E A E A A A E T A E E 186 ape Usor PG eea niienna vambahenndsquaadiabed entation neancananiweduseanmenaieneatisanannevns 187 SS o p A E E E E E E E E E T E 192 3 64 User Online StalUS os saeco piae ve nmosnactoccuusas mnsnasuasestse staan acuedscoues svancenaddoneaaasndeuuuer aneneeecs 193 37 9 cletsee 11 1 oe ee en ei ee O E ERR 194 BMWA ODOC a E E E E E A E E 194 STENE E 6 eee ee een A E ere eee A AE E E 197 dJa IPVC OD OCF unese r EEEE EE o E EEEE a I 199 TS GOUD nosen eo EET EAEN EEEa TEE O ETENEE E ai 201 3 7 5 Service Type ODOC aisse enne EEEN EEEE EENE a E EENE EEEREN 202 3 7 6 SOIWVICE Type GOUD escis e aE iE ian 204 3A Keyword ODOC esd stints trots Seadeemes eE E EA EEEE N ESE 206 OF 8 KeyWord GROUD esris E A EEE ESN ESEE 208 3 7 9 File Extension ODjeCi eisenii n anaa a aaia anean 209 3 7 10 SMS Mail Service ODjeCt eeccccccccccccsseseeeeeeeeeceeeeeseeeeeees
262. cess into the Internet Click LAN and click Bind IP to MAC to open the setup page LAN gt Bind IP to MAC Bind IP to MAC Enable Disable Strict Bind ARP Table Select All Sort Refresh IP Bind List Limit 300 entries Select All Sort IF Address Mac Address Index IF Address Mac Address 10 28 600 l O0 50 F 22 33 43 Add or Update IP Address fe Mac Address H HR HEHEH CI Show Comment Note IP MAC binding presets DHCP Allocations If you select Strict Bind unspecified LAN clients cannot access the Internet Backup IP Bind List Upload From File tase e Available settings are explained as follows Item Description Enable Click this radio button to invoke this function However IP MAC which is not listed in IP Bind List also can connect to Internet Disable Click this radio button to disable this function All the settings on this page will be invalid Strict Bind Click this radio button to block the connection of the IP MAC which 1s not listed in IP Bind List ARP Table This table is the LAN ARP table of this router The information for IP and MAC will be displayed in this field Each pair of IP and MAC address listed in ARP table can be selected and added to IP Bind List by clicking Add below Select All Click this link to select all the items in the ARP table Sort Reorder the table based on the IP address Vigor2860 Series User s Guide 142 Dr ay Te k Refresh Refresh th
263. ch as web servers FTP servers E mail servers etc Most of the case you need a public IP address for each server and this public IP address domain name are recognized by all users Since the server is actually located inside the LAN the network well protected by NAT of the router and identified by its private IP address port the goal of Port Redirection function is to forward all access request with public IP address from external users to the mapping private IP address port of the server Internet Destined to 220 135 240 207 Port 213 The port redirection can only apply to incoming traffic To use this function please go to NAT page and choose Port Redirection web page The Port Redirection Table provides 40 port mapping entries for the internal hosts NAT gt Port Redirection Port Redirection Setto Factory Default Index Service Name WAR Protocol Public Port Private IP Interface All All All All All All All All All All Note The configured ports in the Managementand SSL VPN webUls will be used by the router and not be sent to the local computer defined here Vigor2860 Series User s Guide 154 Dr ay Te k Each item is explained as follows Item Description Index Display the number of the profile Service Name Display the description of the specific network service WAN Interface Display the WAN IP address used by the profile Protocol Display the transport layer protocol TCP or UDP Public Por
264. choose 192 168 1 200 as the Start IP Address You can configure up to four start IP addresses for LANI LANG Configured LDAP profiles will be listed under such item Simply check the one you want to enable the PPP authentication by LDAP server profiles However if there is no profile listed simply click the link of PPTP LDAP Profile to create add some new LDAP profiles you want For detailed information about LDAP application refer to section 4 7 How to Implement the AD LDAP Authentication for User Management In IPsec General Setup there are two major parts of configuration There are two phases of IPsec gt Phase 1 negotiation of IKE parameters including encryption hash Diffie Hellman parameter values and lifetime to protect the following IKE exchange authentication of both peers using either a Pre Shared Key or Digital Signature x 509 The peer that starts the negotiation proposes all its policies to the remote peer and then remote peer tries to find a highest priority match with its policies Eventually to set up a secure tunnel for IKE Phase 2 gt Phase 2 negotiation Psec security methods including Authentication Header AH or Encapsulating Security Payload ESP for the following IKE exchange and mutual examination of the secure tunnel establishment There are two encapsulation methods used in IPsec Transport and Tunnel The Transport mode will add the AH ESP payload and use original IP header to encap
265. ck Disable for Status in General Setup field How can you set a VPN TRUNK VPN Backup Load Balance mechanism profile 1 First of all go to VPN and Remote Access gt gt LAN to LAN Set two or more LAN to LAN profiles first that will be used for Member and Member2 If you do not set enough LAN to LAN profiles you cannot operate VPN TRUNK VPN Backup Load Balance mechanism profile management well 2 Access into VPN and Remote Access gt gt VPN TRUNK Management 3 Set one group of VPN TRUNK VPN Backup Load Balance mechanism backup profile by choosing Enable radio button type a name for such profile e g 071023 choose one of the LAN to LAN profiles from Member drop down list choose one of the LAN to LAN profiles from Member2 drop down list and click Add at last General Setup Status Enable Disable Profile Name 07 1023 Memberi Please choose the combination that you want Member Please choose the combination that you want Please choose the combination that you want i i y i r Attribute Mode No Name gt Connect ion lType gt VPN ServerlIP Private Network gt 1 To A PlaceIPSec 192 168 2 25 20 20 20 0 F To B Site IPSec 192 168 2 26 20 20 21 0 Add Edit Delete Vigor2860 Series User s Guide 292 Dr ay Te k 4 Take a look for LAN to LAN profiles Index 1 is chosen as Member index 2 is chosen as Member2 For such reason LAN to LAN profiles of 1 and 2 will be expressed in red to indicate that t
266. ck this box to make the wireless clients stations with the same SSID not accessing for each other VPN Check this box to make the wireless clients stations with different VPN not accessing for each other It controls the data transmission rate through wireless 355 Vigor2860 Series User s Guide connection Upload Check Enable and type the transmitting rate for data upload Default value is 30 000 kbps Download Type the transmitting rate for data download Default value is 30 000 kbps Schedule Set the wireless LAN to work at certain time interval only You may choose up to 4 schedules out of the 15 schedules pre defined in Applications gt gt Schedule setup The default setting of this field is blank and the function will always work After finishing all the settings here please click OK to save the configuration Vigor2860 Series User s Guide 356 Dr ay Te k 3 16 3 Security This page allows you to set security with different modes for SSID 1 2 3 and 4 respectively After configuring the correct settings please click OK to save and invoke it The password PSK of default security mode is provided and stated on the label pasted on the bottom of the router For the wireless client who wants to access into Internet through such router please input the default PSK value for connection By clicking the Security Settings a new web page will appear so that you could configure the settings of WPA and WEP
267. ckets on the WAN while sending them out Please type the tag value and specify the priority for the packets sending by WANI Disable Disable the function of VLAN with tag Tag value Type the value as the VLAN ID number The range is form 0 to 4095 Priority Type the packet priority number for such VLAN The range is from 0 to 7 Active Mode Choose Always On to make the WAN2 connection being activated always Always Orn Aly a T T D n Backup Load Balance Check this box to enable auto load balance function for such WAN interface When the data traffic 1s large the WAN interface with the function enabled will balance the data transmission automatically among all of the WAN interfaces in connection status 79 Vigor2860 Series User s Guide Backup Type If you choose Backup as the Active Mode Backup Type will appear Please specify which WAN will be treated as the Backup WAN Active Mode Backup Load Balance Owan i Wan 2 llwan aO wan 4 oo sabapa When any of selected WAN disconnect multiple WAN O when all of selected WAN disconnect When any of selected WAN disconnect Such backup WAN will be activated when any master WAN interface disconnects When all of selected WAN disconnect Such backup WAN will be activated only when all master WAN interfaces disconnect After finished the above settings click OK to save the settings WANS3 WAN4 with USB To use 3G 4G network c
268. come message is displayed in the Login page of the router Replace this text With your own message lt p gt lt ol gt lt li gt The welcome message can be written in HTML so lists such as this one can be created lt 1i gt lt 1i gt 0ther markup tags such as Dp font or img can be used lt 1i gt lt ol gt Examples of Welcome Message and Bulletin lt hi gt lt b gt lt font color red Welcome Message lt font lt b gt lt h1 gt lt p gt Message lt p gt Dray Tek 403 Vigor2860 Series User s Guide Available settings are explained as follows Item Description Enable Check this box to enable the login customization function Login Page Title Type a brief description e g Welcome to DrayTek which will be shown on the heading of the login dialog Welcome Message and Type words or sentences here It will be displayed for Bulletin bulletin message In addition it can be displayed on the login dialog at the bottom Note that do not type URL redirect link here Preview Click it to display the preview of the login window based on the settings on this web page Set to Factory Default Click to return to the factory default setting Below shows an example of login customization with the information typed in Login Description and Bulletin gt Vigor Login Page Windows Internet Explorer E 192 168 1 1 Just for Carrie Username Password Group Welcome Message This welcome message is displaved in the Login page
269. conds WEP Setup WEP Key if WEP is enabled o0e 1 WEP Enable Disable Access Control Mode Mone wt ee a Client s MAC Address _ m C Bandwidth Limit Backup ACL Cfg Upload From File jS tse Ata Vigor2860 Series User s Guide 320 Dr ay Tek 4 After finished the above web page configuration click Next to open the following page for 5G wireless security settings Central AP Management gt gt WLAN Profile 5G 5SID1 5G SSID2 5G SSID3 5G SSID4 56 SS 0 Enable Disable DrayTek 56 LAN A e Hide SSID O untag oi Fram Member Disable i Set Up RADIUS vier if 802 1 is enabled WPA WEA Algonthms TKIP AES TEIP AES Pass Phrase a ey Key Renewalinterval 2600 Seconds ies Setup WEP Key if WEP is enabled 802 1 WEP Enable Disable Access Control Client s MAC Address fpi Ji I fs FL Caa Coe CE eee i a Bandwidth Limit Enable bisable Auto Adjustment C Enable _Obdisable ead Note 5G SSID Configuration only work with VigorAP800 v1 1 1 and newer 4PM Client _Finish_ Backup ACL Cfo Backup Upload From File ES Restore 5 When you finished the above web page configuration click Finish to exit and return to the first page The modified WLAN profile will be shown on the web page Central AP Management gt gt WLAN Profile Profile Name Main SSID Multi SSID WLAN ACL Rate Control P t i00 Kbps Default DrayT
270. count Password Max 19 char fs Idle Timeout 300 secondis s C Enable Mobile One Time Passwords mOTP Allowed Dial In Type PIN Code OOOO O IPsec Tunnel L2TP with IPsec Policy None w SSL Tunnel IKE Authentication Method Pre Shared Key OI Digital Signature x 509 C Specify Remote Node Remote Client IP sd IPsec Security Method orPeerip o O Medium AH Netbios Naming Packet Pass Block Highf ESP DES 3DES AES Multicast via VPN OPass Block Local ID optional Po for some IGMP IP Camera DHCP Relay etc Subnet L Assign Static IP Address Available settings are explained as follows Item Description User account and Enable this account Check the box to enable this function Authentication Idle Timeout If the dial in user is idle over the limitation of the timer the router will drop this connection By default the Idle Timeout is set to 300 seconds User Name This field is applicable when you select PPTP or L2TP with or without IPsec policy above The length of the name password is limited to 23 characters Password This field is applicable when you select PPTP or L2TP with or without IPsec policy above The length of the name password is limited to 19 characters Enable Mobile One Time Passwords mOTP Check this box to make the authentication with mOTP function PIN Code Type the code for authentication e g 1234 Secret Use the 32 digit secret number ge
271. ct VLAN The following page will appear Click Enable to invoke VLAN function Below is an example page in Vigor2860n LAN gt VLAN Configuration VLAN Configuration Enable Wireless LAN P6 SSID1 SSID2 SSIDS SSID4 Subnet Enable VID LAM 1 w LAN 1 Mi ow M1 ow N1 w M1 w M1 w M1 w T mm G E a a a a G a a G a a G a a G a a a E ay a E T S P1 P2 P3 e AR aa d d d OOO d d d OOO OOO OOO OOOO Permit untagged device in P1 to access router 1 Tag based WYLAN only applied for LAN Ports 2 The checked Wireless LAN SSID will not has WYLAN tagging function but regarded as joining WLAN group 3 The set VLAN ID VID must be unique and not duplicate Vigor2860 Series User s Guide 138 Dr ay Tek For Vigor2860n plus series the web page will be shown as follows LAN gt gt VLAN Configuration VLAN Configuration Enable LAN Wireless LAN 4GHz Wireless LAN 5GHz VLAN Tag Pi P2 P3 P4 P5 P6 SSID1 SSID SSIDS SSID4 SSID1SSID2 SSID3 SSID4 Subnet Enable VID VLANO a5 LA o o o lt S m O Oo Oo Oo Oo OO Oo podada ARR Permit untagged device in Pi to access router 1 For each YLAN row if enable is checked for the WYLAN Tag then the corresponding WID will be applied to wired LAN traffic 2 Wireless LAN traffic is always untagged but will still be a member of the WLAN group selected 3 Each VID must be unique Note Settings in this page only applied to LAN port but not WAN
272. cters Password Type a password for such profile e g lug 123 wug123 wug456 etc When a user tries to access Internet through this router an authentication step must be performed first The user has to type the password specified here to pass the authentication When the user passes the authentication he she can access Internet via this router with the limitation configured in this user profile The maximum length of the password you can set is 24 characters Confirm Password Type the password again for confirmation Idle Timeout If the user is idle over the limitation of the timer the network connection will be stopped for such user By default the Idle Timeout is set to 10 minutes Max User Login Such profile can be used by many users You can set the limitation for the number of users accessing Internet with the conditions of such profile The default setting is O which means no limitation in the number of users Policy It is available only when User Based mode selected in User Management gt gt General Setup Default If you choose such item the filter rules pre configured in Firewall can be adopted for such user profile Create New Policy If you choose such item the following page will be popped up for you to define another filter rule as a new policy Vigor2860 Series User s Guide 188 Dr ay Tek Dray Tek External Service Authentication Log Pop Browser Tracking Window Authentication Firew
273. ction O Specify a MAC Address Mode MAC Address ho a HBe 18 Ba Ping IP ti tsizdq MTU Max 1492 Available settings are explained as follows Item Description Enable Disable Click Enable for activating this function If you click Disable this function will be closed and all the settings that you adjusted in this page will be invalid ISP Access Setup Enter your allocated username password and authentication parameters according to the information provided by your ISP Service Name Optional Enter the description of the specific network service Username Type in the username provided by ISP in this field The maximum length of the user name you can set is 63 characters Password Type in the password provided by ISP in this field The maximum length of the password you can set is 62 characters Index 1 15 in Schedule Setup You can type in four sets of time schedule for your request All the schedules can be set previously in Application gt gt Schedule web page and you can use the number that you have set in that web page Vigor2860 Series User s Guide 96 Dr ay Tek WAN Connection Detection MTU PPP MP Setup IP Address Assignment Method IPCP Dray Tek Such function allows you to verify whether network connection is alive or not through ARP Detect or Ping Detect Mode Choose ARP Detect or Ping Detect for the system to execute for WAN detection Ping IP If you ch
274. d Vigor2860n plus VDSL2 Security Firewall Dames Eat kio bt Ge a Lee ACT VDSUADSL WAN2 Giga Gigal AN 1 System Information 0 56 37 Router Name Current Time 2014 Apr 1 Tue 6 32 3 Mar 20 2014 14 09 50 00 1D AA B6 1B B8 IPv4 Internet Access hine Mode IP Address MAC Address UpTime WAN1 VDSL2 DHCP Client _ 192 168 100 202 00 1D AA B6 1B B9 0 55 55 _ WAN2 Ethernet Static IP__ 172 16 3 133 00 1D AA B6 1B BA 0 56 27 WAN3 UsB PPP Disconnected 00 1D AA B6 1B BB 00 00 00 WAN4 UsB Disconnected 00 1D AA B6 1B BC_ 00 00 00 Quick Access em Status amic DNS ser Management Log Mail Alert irewall Object Settin Data Flow Monitor System Maintenance Diagnostics External Devices Interface WAN Connected 2 WANI WQWAN2 WANS WANG FALAN Connected 4 LAN1 LAN LAN3 LAN4 LANS LAN6 conna adn USB 1 USB 2 Product Registration All Riahts Reserved Quick Start Wizard offers user an easy method to quick setup the connection mode for the router Moreover if you want to adjust more settings for different WAN modes please go to WAN group 3 1 1 Basics of Internet Protocol IP Network Dray Tek IP means Internet Protocol Every device in an IP based Network including routers print server and host PCs needs an IP address to identify its location on the network To avoid address conflicts IP addresses are publicly registered with the
275. d Display the WAN IP or WAN IP alias address which is used as source IP of the outgoing packets Displays the IP address for the start of the source IP Displays the IP address for the end of the source IP Displays the IP address for the start of the destination IP Displays the IP address for the end of the destination IP Displays the IP address for the start of the destination port Displays the IP address for the end of the destination port Use Up or Down link to move the order of the policy Allows to configure frequently used settings of route policy via three setting pages Allows to configure detailed settings of route policy 14s DrayTek To use Wizard Mode simple do the following steps 1 Click the Wizard Mode radio button 2 Click Index 1 The setting page will appear as follows Load Balance Route Policy Index 1 criteria Load Balance Route Policy applies to packets that meet the following criteria source IP Any Src IP Start Sre IP End Destination IP Any Dest IP Start Dest IP End 192 168 1 6 192 168 1 66 Available settings are explained as follows Item Description Source IP Any Any IP can be treated as the source IP Src IP Start Type the source IP start for the specified WAN interface Src IP End Type the source IP end for the specified WAN interface If this field is blank it means that all the source IPs inside the LAN will be passed through the WAN interface Destin
276. d configuration Additionally you can set advanced settings for call barring such as Block Anonymous Block Unknown Domain or Block IP Address Simply click the relational links to open the web page For Block Anonymous this function can block the incoming calls without caller ID on the interface Phone port specified in the following window Such control also can be done based on preconfigured schedules Vigor2860 Series User s Guide 336 Dr ay Te k VoIP gt DialPlan Setup Call Barring Block Anonymous Route C Phonei LJ Phone Indexf1 15 in Schedule Setup Note Block the incoming calls which do not have the caller ID For Block Unknown Domain this function can block incoming calls through Phone port from unrecognized domain that is not specified in SIP accounts Such control also can be done based on preconfigured schedules VoIP gt DialPlan Setup Call Barring Block Unknown Domain Route C Phonei LJ Phone Index 1 15 in Schedule Setup _ az Note If the domain of the incoming call is different from the domain found in SIP accounts the call should be blocked For Block IP Address this function can block incoming calls through Phone port coming from IP address Such control also can be done based on preconfigured schedules VoIP gt gt DialPlan Setup Call Barring Block IP Address Route Cl Phonei LI Phone Index 1 15 in Schedule Setup
277. d by the router for the user with such profile Check the box to enable the function of time quota The first box displays the remaining time of the network connection The second box allows to type the number of time unit is minute which is available for the user using such profile to access Internet Click this box to set and increase the time quota for such profile lasad Click this box to decrease the time quota for such profile Note A dialog will be popped up to notify how many time remained when a user accesses into Internet through Vigor router successfully Internet Access HoR Michael you are now connected Time remaining online 00 32 41 Time used 01 12 54 When the time is up all the connection jobs including network IM social media facebook and etc will be terminated Data Quota means the total amount for data transmission allowed for the user The unit is MB GB Click this box to set and increase the data quota for such profile 90 Dray Tek lasad Click this box to decrease the data quota for such profile Reset quota to default Set default time quota and data quota for such profile when scheduling time When the scheduling time is up the router will use the expired default quota settings automatically Enable Check it to use the default setting for time quota and data quota Default Time Quota Type the value for the time manually Default Data Quota Type th
278. d in this field to make all the incoming calls waiting for your answer Dial the number typed in this field to release this function Dial the number typed in this field to block all the incoming calls with unknown ID Dial the number typed in this field to release this function Dial the number typed in this field to block all the incoming calls from unknown domain Dial the number typed in this field to release this function Dial the number typed in this filed to block all the incoming calls from IP address Dial the number typed in this field to release this function Dial the number typed in this field to block the last incoming phone call After finishing all the settings here please click OK to save the configuration PSTN Setup Some emergency phone e g 911 or special phone cannot be dialed out by using VoIP and can be called out through PSTN line only To solve this problem this page allows you to set five sets of PSTN number for dialing without passing through Internet Check the Enable box to make the PSTN number available for dial whenever you need and type the number in the field of phone number for PSTN relay Vigor2860 Series User s Guide Dray Tek VoIP gt gt PSTN Setup Default phone number for PSTN relay After finishing all the settings here please click OK to save the configuration 3 15 2 SIP Accounts In this section you set up your own SIP settings When you apply for an
279. d on External Device please click the Account button to retype new Username and password Otherwise the router will be unable to monitor the External Device device properly Click the Clear button to Clear the off line information and account information When you finished the configuration click OK to save it Note Only DrayTek products can be detected by this function Vigor2860 Series User s Guide 432 Dr ay Te k Tutorials and Applications 4 1 How to configure settings for IPv6 Service in Vigor2860 Due to the shortage of IPv4 address more and more countries use IPv6 to solve the problem However to continually use the original rich resources of IPv4 both IPv6 and IPv4 networks shall communicate for each other via intercommunication mechanism to complete the shifting job from IPv4 to IPv6 gradually At present there are three common types of intercommunication mechanisms Dual Stack The user can use both IPv4 and IPv6 techniques at the same time That means adding an IPv6 stack on the origin network layer to let the host own the communication capability of IPv4 and IPv6 Tunnel Both IPv6 hosts can communication for each other via existing IPv4 network environment The IPv6 packets will be encapsulated with the header of IPv4 first Later the packets will be transformed and judged by IPv4 router Once the packets arrive the border between IPv4 and IPv6 the header of IPv4 on the packets will be removed Then the packets
280. d then forward it At the same time the router shall list an entry in a table to memorize this address port mapping relationship When the public server response the incoming traffic of course is destined to the router s public IP address and the router will do the inversion based on its table Therefore the internal host can communicate with external host smoothly The benefit of the NAT includes Save cost on applying public IP address and apply efficient usage of IP address NAT allows the internal IP addresses of local hosts to be translated into one public IP address thus you can have only one IP address on behalf of the entire internal hosts Enhance security of the internal network by obscuring the IP address There are many attacks aiming victims based on the IP address Since the attacker cannot be aware of any private IP addresses the NAT function can protect the internal network Note On NAT page you will see the private IP address defined in RFC 1918 Usually we use the 192 168 1 0 24 subnet for the router As stated before the NAT facility can map one or more IP addresses and or service ports into different specified services In other words the NAT function can be achieved by using port mapping methods Below shows the menu items for NAT Dr ay Tek 153 Vigor2860 Series User s Guide 3 4 1 Port Redirection Port Redirection is usually set up for server related service inside the local network LAN su
281. d_bandwidth Ratio Class 1 VoIP 25 lon Note The rate of outbound inbound must be smaller than the real bandwidth to ensure correct calculation of QoS It is suggested to set the bandwidth value for inbound outbound as 80 85 of physical network speed provided by ISP to maximize the QoS performance 4 Return to previous page Enter the Name of Index Class 1 by clicking Edit link Type the name E mail for Class 1 Click OK to save the settings Bandwidth Management gt Quality of Service Class Index 1 CJ Tag packets as NO Status Local Address Remote Address see ities Service Type CodePoint 10 Active Any Any ANY ANY 5 Click the Setup link for WAN2 The user can set reserved bandwidth e g 25 for E mail using protocol POP3 and SMTP Click OK to save the settings Bandwidth Management gt Quality of Service WAN General Setup Enable the QoS Control BOTH WAN Inbound Bandwidth 100000 Kbps WAN Outbound Bandwidth 100000 Kbps Index Class Name Reserved bandwidth Ratio Class 1 E mail 125 doy Class 2 25 lo Class 3 25 l Others 25 Jo Cl Enable UDP Bandwidth Control Limited bandwidth Ratio s Vg C outbound TCP ACK Prioritize Dr ay Tek 459 Vigor2860 Series User s Guide Return to previous page Enter the Name of Index Class 2 by clicking Edit link In this index the user will set reserved bandwidth for HTTPS And click OK Bandwidth Management gt gt Quality of Service Class Index 2
282. data Reply from 192 168 1 1 bytes 32 time lt ims TTL 255 Reply from 192 168 1 1 bytes 32 time lt ims Reply from 192 168 1 1 bytes 32 time lt ims Reply from 192 168 1 1 bytes 32 time lt ims TTL 255 Ping statistics for 192 168 1 1 Packets Sent 4 Received 4 Lost A tz loss Approximate round trip times in milli seconds Minimum Hms Maximum ms Average Ams D Documents and Settings fae gt _ Type ping 192 168 1 1 and press Enter If the link is OK the line of Reply from 192 168 1 1 bytes 32 time lt Ims TTL 2595 will appear If the line does not appear please check the IP address setting of your computer For Mac OS Terminal 1 2 3 4 Double click on the current used MacOs on the desktop Open the Application folder and get into Utilities Double click Terminal The Terminal window will appear Type ping 192 168 1 1 and press Enter If the link is OK the line of 64 bytes from 192 168 1 1 icmp_seq 0 ttl 255 time xxxx ms will appear Vigor2860 Series User s Guide 522 Dr ay Tek AAA Terminal bash 80x24 Last logins Sat dan 3 gz 24 1i6 on ttypi Welcome to Darwin Vigorif draytekt ping 192 165 1 1 PING 192 166 1 1 192 168 1 1 56 dota bytes 64 bytes from 192 168 1 1 icmp oseg 8 thl 255 timesH 755 me 64 bytes from 192 160 1 1 icmp seg 1 ttl 255 timesB 697 me 64 bytes from 192 168 1 1 icmp_seg 2 ttl 255 times6 716 m 64 bytes from 192 166 12 icmp seg 3 ttl 255 timesh 73
283. de Utility fF Sysloe i gt Uninstall Router Tools 3 5 1 Visit DrayTek Web Site 3 From the Syslog screen select the router you want to monitor Be reminded that in Network Information select the network adapter used to connect to the router Otherwise you won t succeed in retrieving information from the router Vigor2860 Series User s Guide 408 Dr ay Tek Dray Tek Syslog Utility 172 16 3 130 J WAN Information TX Rate RX Rate eem Edf r Log Filter Keyword Apply to a Tool Setup Telnet Read out Setup Codepage Information Recovery Network Information Net State Firewall Host Name carrie 0c7cb251 NIC Description Atheros 4R8121 4R6113 4R8114 PCI E Ethernet Controller Packet Scheduh v System NIC Information On Line Routers MAC Address E0 CB 4E DA 48 79 IP Address Mask MAC 192 168 1 5 255 255 25 O0 50 7F CD 0 IP Address 192 168 1 10 v Subnet Mask 255 255 255 0 DNS Servers 88 44 88 8 8 Default Geteway 192 168 1 5 DHCP Server 192 168 1 5 Lease Obtained Tue Aug 27 00 04 10 2013 Lease Expires Fri 4ug 30 00 04 10 2013 Refresh til a lw Dr ay Te k 409 Vigor2860 Series User s Guide 3 19 8 Time and Date It allows you to specify where the time of the router should be inquired from System Maintenance gt Time and Date Time Information Current System T
284. default WAN2 is disabled If you want to enable it simply click the WAN2 link and select Yes in the field of Enable WAN gt gt General Setup Load Balance Mode Auto Weight ha Setup Physical Line Speed Kbps Mode Type DownLink UpLink WAHI ADSL 070 Always On Index Active Mode WAN Ethernet Auta negotiation ozo Always On WANS LS eh 070 Always On WAN4 USB 070 Always On Note The line speed setting of WAN interface is available only when According ta Line Speed is selected as the Load Balance Mode Available settings are explained as follows Item Description Load Balance Mode This option is available for multiple WAN for getting enough bandwidth for each WAN port If you know the practical bandwidth for your WAN interface please choose the setting of According to Line Speed Otherwise please choose Auto Weigh to let the router reach the best load balance Load Balance Mode Index Click the WAN interface link under Index to access into the WAN configuration page Enable V means such WAN interface is enabled and ready to be used Dr ay Tek 75 Vigor2860 Series User s Guide Physical Mode Type Line Speed Kbps DownLink UpLink Active Mode Display the physical mode and physical type of such WAN interface Display the downstream and upstream rate of such WAN interface Display whether such WAN interface is Active device or backup device Backup WAN Display the backup WAN interface for
285. default configuration Connecter for a USB device for 3G USB Modem or printer Connecter for accessing the Internet Connecter for local network devices or modem for accessing Internet Connecters for local network devices Connecter for a power adapter Power Switch 6 Dray Tek 1 2 3 For Vigor2860n plus Valk Vigor2860n plus VDSL2 Security Firewall Wireless LA USB DSL WCF O O O 2 4G 5G DoS VDSLIADSL WAN2 Giga GigaLAN gt 1 2 3 4 5 6 LED SIGLO Explanation ACT Activity The router is powered on and running normally Off The router is powered off USB USB device is connected and ready for use Blinking The data is transmitting 2 4G Wireless access point with bandwidth of 2 4GHz is ready Blinking It will blink slowly while wireless traffic goes through ACT and WLAN LEDs blink quickly and simultaneously when WPS is working and will return to normal condition after two minutes You need to setup WPS within 2 minutes WAN2 Internet connection is ready Internet connection is not ready The data is transmitting DSL The router is ready to access Internet through DSL link Blinking Slowly The DSL connection is ready Quickly The connection is training 5G Wireless access point with bandwidth of 5GHz is ready Blinking It will blink slowly while wireless traffic goes through ACT and WLAN LEDs blink quickly and simultaneously when WPS is working and will return to normal condition after two
286. device Display the receiving speed of the monitored device Display the session number that you specified in Limit Session web page Block can prevent specified PC accessing into Internet within 5 minutes Page Refresh Sessions 1 Unblock the device with the IP address will be blocked in five minutes The remaining time will be shown on the session column J Page Refresh Sessions Action APP QoS blocked 299 Unblock Current means current transmission rate and receiving rate for WAN interface Peak means the highest peak value detected by the router in data transmission Speed means line speed specified in WAN gt gt General Setup If you do not specify any rate at that page here will display Auto for instead 427 Vigor2860 Series User s Guide 3 20 9 Traffic Graph Click Diagnostics and click Traffic Graph to pen the web page Choose WANI WAN2 WAN3 WAN4 Bandwidth Sessions daily or weekly for viewing different traffic graph Click Reset to zero the accumulated RX TX received and transmitted data of WAN Click Refresh to renew the graph at any time Diagnostics gt gt Traffic Graph Show Chart Refresh Mints Refresh WAR Bandwidth WAN Bandwidth WANS Bandwidth WANA Bandwidth WAN1 total TX 21 MB RY 119 MB Wh total Tx 0 Bytes Ra O Bytes WANS total Ta O Bytes Ra O Bytes WANM4 total Tx O Bytes Ra O Bytes The horizontal axis represents time Yet the vertical
287. dge 2 Host with Host with Host with bridge Interface 1 bridge Interface 2 bridge Interface 3 Click WDS from Wireless LAN menu The following page will be shown Wireless LAN 2 4GHz gt WDS Settings WDS Settings Setto Factory Default Mode Bridge Bridge Enable Peer MAC Address Security O i i 1 Disable WEP Pre shared Key e it i it Jt dt Iio CH qt dif qf we 2 OOOO Use the same WEP key setin Security Settings Note Disable unused links to get better performance Pre shared Key T Repeater ype di Enable Feer MAC Addess nooo WPA and WPA2 t tible with Eat ote A and WPA are not compatible wi DrayTek WPA i Type 8 63 ASCII characters or 64 hexadecimal digits leading by Ox for example cfgs01az2 or Ox6 55abcd Access Point Function Enable Disable Status Cl Send Hello message to peers Note The status is valid only when the peer also supparts this function Cok cance Vigor2860 Series User s Guide 364 Dr ay Te k Available settings are explained as follows Item Description Mode Choose the mode for WDS setting Disable mode will not invoke any WDS setting Bridge mode is designed to fulfill the first type of application Repeater mode is for the second one Disable Security There are three types for security Disable
288. ding to the value displayed on the right side of it Please take a moment to register Membership Registration entitles you to upgrade firmware for your purchased product and receive news about upcoming products and services UserName Mary Password eeee Auth Code Tee l4he1C lf you cannot read the word click here Forgotten password Don t have a MyVigor Account Create an account now lf you are having difficulty logging in contact our customer se mice Customer Senmice 886 3 597 2727 or Now click Login Your account has been activated You can access into MyVigor server to activate the service e g WCF that you want 481 Vigor2860 Series User s Guide 4 10 How to Setup Address Mapping Address Mapping is used to map a specified private IP or a range of private IPs of NAT subnet into a specified WAN IP or WAN IP alias IP Refer to the following figure Group 1 192 168 1 X ONAT Host 1 192 168 1 23 3 7 2 gt i k Host2 192 168 1 100 WAN 202 211 100 10 WAN1 alias 202 211 100 11 WAN2 Vigor2860 Series User s Guide 482 203 98 200 10 Host 3 192 168 1 56 Group1 maps to WAN1 Host 1 maps to WAN1 Host 2 maps to WAN 1 alias Host 3 maps to WAN2 Suppose the WAN settings for a router are configured as follows WANT 202 211 100 10 WANI alias 202 211 100 11 WAN2 203 98 200 10 Without address mapping feature when a NAT host with
289. dress pool for the DHCP server to start with when issuing IP addresses If the Ist IP address of your router is 192 168 1 1 the starting IP address must be 192 168 1 2 or greater but smaller than 192 168 1 254 IP Pool Counts Enter the maximum number of PCs that you want the DHCP server to assign IP addresses to The default is 50 and the maximum is 253 Lease Time Enter the time to determine how long the IP address assigned by DHCP server can be used Use LAN Port Specify an IP for IP Route Subnet If it is enabled DHCP server will assign IP address automatically for the clients coming from P1 and or P2 Please check the box of P1 and P2 Use MAC Address Check such box to specify MAC address MAC Address Enter the MAC Address of the host one by one and click Add to create a list of hosts to be assigned deleted or edited IP address from above pool Set a list of MAC Address for 2 DHCP server will help router to assign the correct IP address of the correct subnet to the correct host So those hosts in 2 subnet won t get an IP address belonging to 1 subnet Add Type the MAC address in the boxes and click this button to add Delete Click it to delete the selected MAC address Edit Click it to edit the selected MAC address Cancel Click it to cancel the job of adding deleting and editing When you finish the configuration please click OK to save and exit this page Vigor2860 Series User s Guid
290. e 395 Vigor2860 Series User s Guide Connection Display the connection type IP Address Display the IP address of the WAN interface Default Gateway Display the assigned IP address of the default gateway IP v6 Address Display the IPv6 address for LAN Scope Display the scope of IPv6 address For example IPv6 Link Local could only be used for direct IPv6 link It can t be used for IPv6 internet Internet Access Mode Display the connection mode chosen for accessing into Internet Vigor2860 Series User s Guide 396 Dr ay Te k 3 19 2 TR 069 This device supports TR 069 standard It is very convenient for an administrator to manage a TR 069 device through an Auto Configuration Server e g VigorACS System Maintenance gt gt TR 069 Setting ACS and CPE Settings ACS Server On WAN Z w ACS Server R L thwivigoracs draytek comaAcsserensenviceslAcsservlet Username alpha Password CPE Client Enable Disable URL Periodic Inform Settings Disable Enable Interval Time seconds STUN Settings Disable Enable Server Address Server Port 3478 Minimum Keep Alive Period secondis Maximum Keep Alive Period secondis Available settings are explained as follows Dray Tek Item Description ACS and CPE Settings ACS Server On Choose the interface for the router connecting to ACS server ACS Server URL Username Password Such data must be typed accord
291. e Directory Check the items List Create and Remove for such profile Before you click OK you have to insert a USB storage disk into the USB interface of the Vigor router Otherwise you cannot save the configuration 3 18 3 File Explorer File Explorer offers an easy way for users to view and manage the content of USB storage disk connected on Vigor router USB Application gt File Explorer File Explorer o Current Path 7 Upload File Select a file ES Upload Note The folder can not be deleted when it is not empty Available settings are explained as follows Item Description Click this icon to refresh files list Refresh zi Click this icon to return to the upper directory Back Dr ay Tek 389 Vigor2860 Series User s Guide Click this icon to add a new folder Create Current Path Display current folder Upload Click this button to upload the selected file to the USB storage disk The uploaded file in the USB diskette can be shared for other user through FTP 3 18 4 USB Device Status This page is to monitor the status for the users who accessing into FTP or Samba server USB storage disk via the Vigor router In addition the status of the USB modem or USB printer connecting to Vigor router can be checked from such page If you want to remove the storage disk from USB port in router please click Disconnect USB Disk first And then remove the USB storage disk later USB Applicat
292. e WARD 1 More options Force AAT 6 If there is no error click Finish to complete wizard setting Load Balance Route Policy Load Balance Route Policy Setto Factory Src Src Dest Dest Index Enable Protocol Interface pelts IP pte DestIP End Port Port a Start End Start End P i F Any WANI 172 16 3 130 Any Any 192 168 1 6 197 168 1 66 Any Any To use Advance Mode do the following steps 1 Click the Advance Mode radio button 2 Click Index 1 to access into the following page Vigor2860 Series User s Guide 150 Dr ay Tek Load Balance Route Policy Index 1 Enable Criteria Protocol Source IP Destination IP Destination Port Send to if Criteria Matched Interface Gateway IP More Options Any Any Sre IP Start Src IP End rat Any Dest IP Start Dest IP End rt Any Dest Port Start Dest Port End mo WAMI s Default Gateway O Specific Gateway O Auto Failover to the Other WAN Packet Forwarding to WAN Force NAT via Force Routing Note 1 Force NATiRouting NAT Routing will be performed on outgoing packets regardless of which type of subnet NAT or IP Routing they originate fram 2 Please use the Any with caution The settings applied here have higher priority than the static routes rules and the routes in the routing table Available settings are explained as follows Item Enable Protocol Source IP Dray Tek Descr
293. e 132 Dr ay Te k 3 2 3 Static Route Go to LAN to open setting page and choose Static Route The router offers IPv4 and IPv6 for you to configure the static route Both protocols bring different web pages Static Route for IPv4 LAN gt Static Route Setup IPv4 IPvo Setto Factory Default View Routing Table Index Destination Address Status Index Destination Address Status 1 777 7 6 TF7 2 T a 777 7 777 7 4 T77 7 9 T77 7 5 777 7 10 777 7 Status v Active x Inactive 7 Empty Available settings are explained as follows Dray Tek Item Index Destination Address Status Set to Factory Default Viewing Routing Table Description The number 1 to 10 under Index allows you to open next page to set up static route Displays the destination address of the static route Displays the status of the static route Clear all of the settings and return to factory default settings Displays the routing table for your reference Diagnostics gt gt View Routing Table Current Running Routing Table IPv6 Routing Table Refresh Key C connected S static R RIP default private Aj C 192 168 1 0 259 255 255 0 directly connected LAN1 133 Vigor2860 Series User s Guide Add Static Routes to Private and Public Networks Here is an example based on Pv4 of setting Static Route in Main Router so that user A and B locating in different subnet can talk to each other
294. e ARP table listed below to obtain the newest ARP table information Add or Update IP Address Type the IP address that will be used for the specified MAC address Mac Address Type the MAC address that is used to bind with the assigned IP address Comment Type a brief description for the entry Show Comment Check this box to display the comment on IP Bind List box IP Bind List It displays a list for the IP bind to MAC information Add It allows you to add the one you choose from the ARP table or the IP MAC address typed in Add and Edit to the table of IP Bind List Update It allows you to edit and modify the selected IP address and MAC address that you create before Delete You can remove any item listed in IP Bind List Simply click and select the one and click Delete The selected item will be removed from the IP Bind List Backup Store the configuration for Bind IP to MAC as a file Restore Restore the previously stored configuration file and apply to such page Note Before you select Strict Bind you have to bind one set of IP MAC address for one PC If not no one of the PCs can access into Internet And the web user interface of the router might not be accessed When you finish the configuration click OK to save the settings Dr ay Te k 143 Vigor2860 Series User s Guide 3 2 6 LAN Port Mirror LAN port mirror can be applied for the users in LAN Generally speaking this function copies traffic from o
295. e Activation Wizard to activate WCF service you can skip this section WCE adopts the mechanism developed and offered by certain service provider e g DrayTek No matter activating WCF feature or getting a new license for web content filter you have to click Activate to satisfy your request Be aware that service provider matching with Vigor router currently offers a period of time for trial version for users to experiment If you want to purchase a formal edition simply contact with the channel partner or your dealer Click CSM and click Web Content Filter Profile to open the profile setting page The default setting for Setup Query Server Setup Test Server is auto selected You can choose another server for your necessity by clicking Find more to open http myvigor draytek com for searching another qualified and suitable one Note 1 Web Content Filter WCF is not a built in service of Vigor router but a service powered by Commtouch If you want to use such service trial or formal edition you have to perform the procedure of activation first For the service of formal edition please contact with your dealer distributor for detailed information Note 2 Commtouch is merged by Cyren and GlobalView services will be continued to deliver powerful cloud based information security solutions Refer to http www prnewswire com news releases commtouch is now cyren 239025 151 html Dr ay Te k 227 Vigor2860 Series User s Guide CSM
296. e DMZ host or click Choose PC to select one Choose PC Click this button and then a window will automatically pop up as depicted below The window consists of a list of private IP addresses of all hosts in your LAN network Select one private IP address in the list to be the DMZ host ET Akla 132 168 1 10 1s 168 118 When you have selected one private IP from the above dialog the IP address will be shown on the screen Click OK to save the setting After finishing all the settings here please click OK to save the configuration Vigor2860 Series User s Guide 160 Dr ay Tek 3 4 3 Open Ports Open Ports allows you to open a range of ports for the traffic of special applications Common application of Open Ports includes P2P application e g BT KaZaA Gnutella WinMX eMule and others Internet Camera etc Ensure that you keep the application involved up to date to avoid falling victim to any security exploits Click Open Ports to open the following page NAT gt gt Open Ports Open Ports Setup Setto Factory Default Comment WAN Interface AUX WAN IP Local IP Address Status lt lt 1 10 11 20 21 30 3140 gt gt ext gt gt Note The configured ports in the Managementand SSL VPN webUIs will be used by the router and not be sent to the local computer defined here Available settings are explained as follows Item Description Index Indicate the relative number for the particular entry that you w
297. e call connection may not succeed By using the specified dial out account the successful connection can be assured Loop through Choose PSTN to enable loop through function Backup Phone Number When the VoIP phone is obstructs or the Internet breaks down for some reasons the backup phone will be dialed out to replace the VoIP phone number At this time the phone call will be changed from VoIP phone into PSTN call according to the loop through direction chosen Note that during the phone switch the blare of phone will appear for a short time And when the VoIP phone is switched into the PSTN phone the telecom co might charge you for the connection fee Please type in backup phone number for this VoIP phone setting After finishing all the settings here please click OK to save the configuration Note If the incoming or outgoing calls do not match any entry on the phonebook the router will try to make the call being protected But if the call ends up unprotected e g peer side does not support ZRTP SRTP the router will not play out a warning message Dray Te k 333 Vigor2860 Series User s Guide Digit Map For the convenience of user this page allows users to edit prefix number for the SIP account with adding number stripping number or replacing number It is used to help user having a quick and easy way to dial out through VoIP interface VoIP gt DialPlan Setup Digit Map Setup Enable 1 2
298. e default setting is All which means all the incoming data from any port will be redirected to specified range of IP address and port Specify which port can be redirected to the specified Private IP and Port of the internal host If you choose Range as the port redirection mode you will see two boxes on this field Simply type the required number on the first box The second one will be assigned automatically later Specify the private IP address of the internal host providing the service If you choose Range as the port redirection mode you will see two boxes on this field Type a complete IP address in the first box as the starting point and the fourth digits in the second box as the end point Specify the private port number of the service offered by the internal host After finishing all the settings here please click OK to save the configuration Note that the router has its own built in services servers such as Telnet HTTP and FTP etc Since the common port numbers of these services servers are all the same you may need to reset the router in order to avoid confliction For example the built in web user interface in the router is with default port 80 which may conflict with the web server in the local network http 192 168 1 13 80 Therefore you need to change the router s http port to any one other than the default port 80 to avoid conflict such as 8080 This can be set in the System Maintenance gt gt Management
299. e for WAN detection Ping IP If you choose Ping Detect as detection mode you have to type IP address in this field for pinging TTL Time to Live Displays value for your reference TTL value is set by telnet command After finishing all the settings here please click OK to activate them Vigor2860 Series User s Guide 104 Dray Tek Details Page for 4G USB Modem DHCP mode in WAN3 WAN4 To use 4G USB Modem DHCP mode as the accessing protocol of the internet please choose Internet Access from WAN menu Then select 4G USB Modem DHCP mode for WANS The following web page will be shown WAN gt gt Internet Access WAN 3 4G USB Modem DHCP FS mode paat i T Modem Support List SIM PIN code OoOo Network Mode Default 4G 3G 2G APN Name fe MTU Default 1380 LTE software version LTE hardware version Available settings are explained as follows Item Modem Support List 4G USB Modem DHCP mode SIM PIN code Network Mode APN Name MTU Description It lists all of the modems supported by such router pals sup Lt Tlie wows elefie Expo a Lf Let LL 46 Modem Supper List Last Updated on 2012 05 12 Siandarid Brand Moclasla Stabus LTE ZTE ZE MFBZI Y Click Enable for activating this function If you click Disable this function will be closed and all the settings that you adjusted in this page will be invalid Type PIN code of the SIM card that will be us
300. e identify association IAID Type a number as IAID After finished the above settings click OK to save the settings Dray Tek L Vigor2860 Series User s Guide Details Page for IPv6 Static IPv6 in WAN1 WAN2 This type allows you to setup static IPv6 address for WAN interface WAN gt Internet Access WAN 1 PPPoE Static or Dynamic IP PPTP IPv6 Internet Access Mode Connection Type static Pv6 Static IPv6 Address configuration IPv6 Address Prefix Length Os ra Current IPv6 Address Table Index IPv6 Address Prefix Length Scope Static IPv6 Gateway configuration IPv Gateway Address EO Available settings are explained as follows Item Description Static IPv6 Address IPv6 Address Type the IPv6 Static IP Address configuration Prefix Length Type the fixed value for prefix length Add Click it to add a new entry Delete Click it to remove an existed entry Current IPv6 Address Display current interface IPv6 address Table Static IPv6 Gateway IPv6 Gateway Address Type your IPv6 gateway address Configuration here After finished the above settings click OK to save the settings Vigor2860 Series User s Guide 110 Dr ay Tek Details Page for IPv6 6in4 Static Tunnel in WAN1 WAN2 This type allows you to setup 6in4 Static Tunnel for WAN interface Such mode allows the router to access Pv6 network through IPv4 network However 6in4 offers a prefix outside of 2002 0 16 So
301. e is not supported by Vigor Router Please disable the mode on the FTP client Type the password for FTP Samba users for accessing FTP server Later you can open FTP client software and type the password specified here for accessing into USB storage disk The length of the password is limited to 11 characters Type the password again to make confirmation It determines the folder for the client to access into The user can enter a directory name in this field Then after clicking OK the router will create the specific new folder in the USB storage disk In addition if the user types here he she can access into all of the disk folders and files in USB storage disk Note When write protect status for the USB storage disk is ON you cannot type any new folder name in this field Only can be used in such case sss DrayTek You can click to open the following dialog to add any new folder which can be specified as the Home Folder a tp 991 Sider peserfolder him Mierooott Lnternet Explores WSB User hlanagament ese Pevdidier Folder Name Polder Macnee pe af CRAIE Note The folder name can andy contain the folowing characters A 2 ar 00t e Dny Li charag lers are allow Access Rule It determines the authority for such profile Any user who uses such profile for accessing into USB storage disk must follow the rule specified here File Check the items Read Write and Delete for such profil
302. e mode If you uncheck the checkbox the connection type you select above will apply the authentication methods and security methods in the general settings Netbios Naming Packet Pass Click it to have an inquiry for data transmission between the hosts located on both sides of VPN Tunnel while connecting Block When there is conflict occurred between the hosts on both sides of VPN Tunnel in connecting such function can block data transmission of Netbios Naming Packet inside the tunnel Multicast via VPN Some programs might send multicast packets via VPN connection Pass Click this button to let multicast packets pass through the router Block This is default setting Click this button to let multicast packets be blocked by the router Chose one of the subnet selections for such VPN profile Assign Static IP Address Please type a static IP address for the subnet you specified This group of fields is applicable for IPSec Tunnels and L2TP with IPSec Policy when you specify the IP address of the remote node The only exception is Digital Signature X 509 can be set when you select IPSec tunnel either with or without specify the IP address of the remote node Pre Shared Key Check the box of Pre Shared Key to invoke this function and type in the required characters 1 63 as the 381 Vigor2860 Series User s Guide Item Description pre shared key Digital Signature X 509 Check the
303. e password you can set is 62 characters Specify an IP address Click this radio button to specify some data if you want to use Static IP mode IP Address Type the IP address Subnet Mask Type the subnet mask Gateway IP Address Type the gateway IP address Default MAC Address Click this radio button to use default MAC address for the router Specify a MAC Address Some Cable service providers specify a specific MAC address for access authentication In such cases you need to click the Specify a MAC Address and enter the MAC address in the MAC Address field 100 Dray Tek DNS Server IP Address Type in the primary IP address for the router if you want to use Static IP mode If necessary type in secondary IP address for necessity in the future After finishing all the settings here please click OK to activate them Details Page for PPTP L2TP in WAN2 To use PPTP L2TP as the accessing protocol of the internet please click the PPTP L2TP tab The following web page will be shown WAN gt gt Internet Access WAN 2 PPPoE Static or Dynamic IP PPTP L2TP IPv6 O Enable PPTP O Enable L2TP Disable PPP Setup Gener Aina Oooo PPP Authentication PAP or CHAP Specify Gateway IP Address Idle Timeout A second s fs IP Address Assignment Method IPCP WAN IP Alias ISP Access Setup Fixed IP Yes No Dynamic IP Username Fixed IP Address Password Po WAN IP Network Settings Index 1 15 in Schedule Setup
304. e value for the data manually After finishing all the settings here please click OK to save the configuration Dray Te k 191 Vigor2860 Series User s Guide 3 6 3 User Group This page allows you to bind several user profiles into one group These groups will be used in Firewall gt gt General Setup as part of filter rules User Management gt gt User Group User Group Table Set to Factory Default Index Name Index Name i ir 2 18 4 20 5 24 6 22 i 23 8 24 a 25 40 26 1 27 14 30 16 32 Please click any index number link to open the following page User Management gt User Group Profile Index 1 Available User Objects Selected User Objects Max 32 Objects 1 admin Dial In User S LAN User Group 1 4 VVWLAN User Group A S VWWLAN User Group B Available settings are explained as follows Item Description Name Type a name for this user group Available User Objects You can gather user profiles objects from User Profile page within one user group All the available user objects that you have created will be shown in this box Notice that user object Admin and Dial In User are factory settings User defined profiles will be numbered with 3 4 5 and so on Vigor2860 Series User s Guide 192 Dr ay Te k Ree are Click button to add the selected user objects in this box After finishing all the settings here please click OK to save the configuration 3 6 4 User Onli
305. e with Vigor router WAN yp p p g IPv6 How do configure LPR printing on Windows7 ase How do I configure LPR printing on My Windows Vista Dual WAN Note 2 Vigor router supports printing request from computers via LAN ports but not WAN port Vigor2860 Series User s Guide 16 Dray Tek 1 5 Accessing Web Page 1 Make sure your PC connects to the router correctly You may either simply set up your computer to get IP dynamically from the router or set up the IP address of the computer to be the same subnet as the default IP address of Vigor router 192 168 1 1 For the detailed information please refer to the later section Trouble Shooting of the guide 2 Open a web browser on your PC and type http 192 168 1 1 The following window will be open to ask for username and password DrayTek MEZEA Username admin Password Login Copyright amp 2013 DrayTek Corp All Rights Reserved 3 Please type admin admin as the Username Password and click Login Notice If you fail to access to the web configuration please go to Trouble Shooting for detecting and solving your problem Dr ay Tek 17 Vigor2860 Series User s Guide 4 Dray Tek Dashboard Wizards Online Status WAN LAN Load Balance Route Policy NAT Firewall User Management Objects Setting CSM Bandwidth Management Applications VPN and Remote Access Certificate Management Central VPN Management Central AP Management W
306. e you selected was backup from this CPE before Because restoring from another device s configuration file may cause serious problem e g Both devices have different ISP username password Restoring configuration from one CPE to the other will cause Internet connection not being online Firmware Upgrade It means such profile will be used for firmware upgrade File Path Click Select to locate the file you want to save restore or upgrade for CPE Index in Schedule Vigor2860 series will perform the specified action to the selected CPE based on the schedule configured here Specify one or two schedule profiles represented by number here Enter all the settings and click OK 4 Anew maintenance profile has been created CVM gt gt CPE Management gt gt CPE Maintenance Managed Devices List CPE Maintenance Google Map Refresh USE Disk Disk Usage 1084ME 7 2009MB Set to Factory Default Index Profile Name Device Name Action FilePath Schedule For 2850 00507F7D9D00 Config Backup BS m ie bp ple b p bjo p bojo po a m a I Note To enable the schedulings an USB storage MUST be plugged onto router Dr ay Tek 311 Vigor2860 Series User s Guide 3 13 2 3 Google Map To display the location of the managed CPE with a bird s eye view open Central VPN Management gt gt CPE Management and click the tab of Google Map Vigor 2860 Series CVM gt gt CPE Management gt gt Goog
307. ease note thata valid E mail address is tequired to receive the Subseription Code You will need this code to activate your account Tel o i Country SWITZERLAND Career Supervisor vl 6 Choose proper selection for your computer and click Continue Create an account Please enter personal profile How did you find out about this website Internet v Gaareement What kind of anti virus do you use Antivir v would like to subscribe to the MyVigor e letter v Personal yeg Information would like to receive DrayTek product news Please select the mail server for receiving the Global Server YW Scompierion Vigor2860 Series User s Guide 476 Dr ay Te k 7 Now you have created an account successfully Click START Create an account Please enter personal profile Completion Gs reement A confirmation email has been sent to mary_ted tech com Please click on the activation link in the email Personal Information to activate your account E Preferences START 8 Check to see the confirmation email with the title of New Account Confirmation Letter from myvigor draytek com RACE This is an automated message trom myvigor draytek com Thank you Mary for creating an account Please click on the activation link below to actrvate your account Link Activate my Account 9 Click the Activate my Account link to enable the account that you created The following screen will be
308. eb page and you can use the number that you have set in that web page If you want to reboot the router using the current configuration check Using current configuration and click Reboot Now To reset the router settings to default values check Using factory default configuration and click Reboot Now The router will take 5 seconds to reboot the system Note When the system pops up Reboot System web page after you configure web settings please click Reboot Now to reboot your router for ensuring normal operation and preventing unexpected errors of the router in the future Vigor2860 Series User s Guide 416 Dr ay Tek 3 19 12 Firmware Upgrade Before upgrading your router firmware you need to install the Router Tools The Firmware Upgrade Utility is included in the tools The following web page will guide you to upgrade firmware by using an example Note that this example is running over Windows OS Operating System Download the newest firmware from DrayTek s web site or FTP site The DrayTek web site is www DrayTek com or local DrayTek s web site and FTP site is ftp DrayTek com Click System Maintenance gt gt Firmware Upgrade to launch the Firmware Upgrade Utility System Maintenance gt gt Firmware Upgrade Web Firmware Upgrade Select a firmware file Sigs Se Click Upgrade to Upload the file Upgrade TFTP Firmware Upgrade from LAN Current Firmware Version 3 7 4 1 Firmware Upgrade Procedures
309. ecececcccccccceeeeeeeeeeeeeeeseeeeeeeeeseeeseseeeeeeesseaesseeceesseuaaaeeeeeeeessuaageeess 354 a ORS Gres lt 6 01d i ee A ee ee ee ee eee 357 3 16 4 ACCESS GON ON aiastecasteciscevisncsmdabecesiadaslesakugenddlecendtlcnesdduedeiessaniusdancsetabeandenededededancsudeedoenesSeecs 359 WO sce eins sce te cats peerage enc N A tig setae ee anes A E E E E A sascsensosceet 360 D ray Tek Vii Vigor2860 Series User s Guide OV ere E E E ex dieatsaauay ontereasionmas lt quessde E 363 3 16 7 Advanced SettiinG ccccccccccsseseeeceeeeeceeeeseeeceeeeeseeeeaeeeeeeeesseesseeeeeeesessaeasgeeeeeesessaaaaeees 366 3 16 8 WMM Configuration ccccccccesecccceecseeeeeeeceeeeeeeeeeseueceeeesasaeseeeeeeeesssaeaeseeeeesssaaaeseeeees 368 310 9 A DISCOVGLY serren E Ee E R a T NE EE EERE 370 C1 do FA Oise S AEE E 371 3 1611 Stalon COMO ssania ianen saaa Aa E AENEA EEIT ESEN EAER 372 ci Wests Ba cd e A E E E E EE 373 SAFAREE e T 8 A A E E AE A E A eee eee 373 Oe he DORs WV OOF OX y eea foeteseptawacedssaesegasssedaudateetangatans aeetosasaaudataeteucatavactee 374 3 17 3 SO OD ICAO ase ca2ercrs asa sanccnes cousade iiaeia aniani EO a EEN Eaa A aaie 376 SA U Er ACCOUN oeren E aE E NET NE 379 T U TOO e E E E 383 3 1746 Online User StatUS siea aaa a a aT a E 385 Po Ike a gt 2728 07211 6 orean a e E E eee ee 386 3 18 1 USB General SettingS cc ceececccceceesesseeeceeeeesseeesseeeeeeeeeeseeaseeeeeeesseeaaseeeeeeeessaaagsees 386
310. ecestndaoaenncusdasdbccnneduoinatdenconsnsscubinat aon a ETA 18 1 7 Introducing Dashboard sisisi ennienni oreda aaa aiiai 20 Wes Pe Tt ON E EEE EE EEN E EA NE EEA AE AEE 20 L2 Name witha LOK erea a NG 21 1 7 3 Quick Access for Common Used MN cccccccesccscceccescceccucececcusececceuecaceuccauecaceasenass 22 IEEE E e E E E AE EE E A E E E A 23 oND ON Ol ear a E A ate ueceseaceteseoces 24 TAGON Ba U e a E ea ee ee eee 25 LET OO OU E A E E O E E E E E sive fecautetaus 25 LS ONNE SAWS A AA 25 1 8 1 Physical Connection 2 0 0 cecccccccecceeeeeeeeeeeeeeeeeeaeeseseceeeeeeeeeeeeeseeeeeesssseaseeeeeeeeesaaseeeeeeeees 25 1 8 2 Virtual WAN cccccccccccccecceccececceccuccecaccuccuceeceeaececaesacaucaecauaeeausuesaeaecaeeaeneeaeseuaeseetenneenenes 28 Be Sa Vil OMIM MM OM ae E E EEE A A EEE E E EEE 28 UTC SQUID S AE A E 29 2 1 Quick Start Wizard 2 02 ccc ccc ees eccecccceccecccceccuccececcuccuccecuecuucuccecuecuucecucauaucueceeaeseecutsueaeseceuuaeeeeees 29 2 1 1 For WANT ADSL V DSL 2 scs ssccssccsanacesncnvasannentsasanensny eredad salvavosntsnveusasayoregaieaneseasaduxiwesanyenns 31 2 1 2 For WAN2 Ethernet ccccccccccesceccseseeeceesseecceeseeeceaeeecseuseeessageessaaseeeseuseeessageeessageees 37 2 1 3 For WANS WANGS4 USB ccccscssserecssesssetecssoseesecssouseeeecseagseseeseaseeeeetsoasenteetsagseetes 46 2 2 Service Activation WIZAIC cccccceccecceccececceccuceeccccecuecucceenecaecueaeceuceesueaecuua
311. ecorded on the USB storage disk Diagnostics gt Syslog Explorer Web Syslog USB Syslog Note The syslog will show while the saved syslog file size is over 1MB Folder n a File n a Page n a Log Type n a Time Log Type Message Available settings are explained as follows Item Description Time Display the time of the event occurred Log Type Display the type of the record Message Display the information for each event 3 20 12 TSPC Status IPv6 TSPC status web page could help you to diagnose the connection status of TSPC If TSPC has configured properly the router will display the following page when the user connects to tunnel broker successfully Diagnostics gt gt IPv6 TSPC Status WANT WAN WANS WAN4 Retresh TSPC Enabled TSPC Connection Status Local Endpoint v4 Address 114 44 54 220 Local Endpoint vw Address 2001 05c0 1400 000b 0000 0000 0000 10b9 Router DNS name 88886666 broker freenet net Remote Endpoint v4 Address 61 171 72 11 Remote Endpoint v6 Address 2001 05c0 1400 000b 0000 0000 0000 10b8 Tspe Prefix 2001 05c0 1502 0d00 0000 0000 0000 0000 Tspe Prefixlen 56 Tunnel Broker amsterdam freenet net Tunnel Status Connected Dray Te k 431 Vigor2860 Series User s Guide Available settings are explained as follows Item Description Refresh Click this link to refresh this page manually 3 21 External Devices Vigor router can be used to connect with many types
312. ed to access Internet The maximum length of the PIN code you can set is 19 characters Force Vigor router to connect Internet with the mode specified here If you choose 4G 3G 2G as network mode the router will choose a suitable one according to the actual wireless signal automatically APN means Access Point Name which is provided and required by some ISPs Type the name and click Apply The maximum length of the name you can set is 47 characters It means Max Transmit Unit for packet The default setting is 1380 After finishing all the settings here please click OK to activate them Dray Tek 105 Vigor2860 Series User s Guide Details Page for IPv6 Offline in WAN1 WAN2 WAN3 WAN4 When Offline is selected the IPv6 connection will be disabled WAN gt Internet Access WAN 1 PPPoE Static or Dynamic IP PPTP IPvG Internet Access Mode Connection Type Details Page for IPv6 PPP in WAN1 WAN2 During the procedure of IPv4 PPPoE connection we can get the IPv6 Link Local Address between the gateway and Vigor router through IPv6CP Later use DHCPv6 or Accept RA to acquire the IPv6 prefix address such as 2001 B010 7300 200 64 offered by the ISP In addition PCs under LAN also can have the public IPv6 address for Internet access by means of the generated prefix No need to type any other information for PPP mode WAN gt Internet Access WAN 1 PPPoE Static or Dynamic IP PPTP IPv6 Internet Access Mode
313. eeessageeessaneeesseass 413 S191 REDOOLSY StI tice cnnsssvsawectvnntacabscsentedsbevcustsroueesieeeloueiescwsepabariueuaeesOansiaceueeatencvee stale 416 3 19 12 Firmware Upgrade ccccccssecccccssseeecceeessececcceaueeceeseaaaeececesaaeeeeeseuaeeeesssuageeesessaaaes 417 3 19 13 Modem Code Upgrade cccceccccecccsssseeceeeeeeeaeeseeeeeeeeeaeeeeeeeeeesssuaaaeeeeeeeesssaaagseeeees 418 3 19 14 PAC IV NOU ssrin a re atictoce E EET E EEE 418 20 TAINO SING E E E E E EE E E 419 2201 Dialour IG OS MN scssi a a a E EAR aa i aeaa ERE 420 SO FAOUUING TDG aene E E EE E O EE 421 J20 SARF Cache TIDE n a E E E E OEE E E E E 422 3 20 4 IPv6 Neighbour Table cccccccccssssceccceeeeeeccceeueeceeeseaaeeceeeseeaseeeceeaeeeeeseaaeeeesssaaaass 422 OHIO TIC a E E EE 423 3 20 6 NAT Sessions Table aaeaceietccint gen ceaceqedenneecancsiatdestabbotdoatsensneaaeeda abet sieatdoaevenenteitone aecastaunene 424 ae Oe PMG AQIS erst tee rvienarneadiatrin Satan eaaitntnt ER 425 3 20 9 Dala FOW MONITO lisivicnmnatdnnimsinttsiesiinlsanchaxnatcenaus dia niesaaditained Ea Aa araka 426 SS TENG A D ee EE E E E EE A 428 Sree WO Traco ROUI sneseamutcamtonen sumansetrintuaientayesmet tachindeboumnnemtaawe sbeeuamamadsmusndaien incandnonaamernatiamee sine 429 3 20 11 Syslog EXPlOl Ol se seccocasdescnves asnestaesnwesnataneastandengesuds emmenceeepeendandisonsanadbesdeaseersauenteseueesibek 430 320 12 TSPC SII US eege coaatintvenoasnetnencqucsnearaetavesaee sas s
314. eessaaeeesseeaeseeseeseseeees 474 4 9 2 Create an Account via MyVigor Web Site ccccccccseseeeeeeceeseeeeeseeeeeeeeeeeaeseeeesaeeeeess 478 4 10 How to Setup Address Mapping cccccccccceccceeesseeceeeeeesaeeeeeeeeeeesseeeseeeeeeeessaeeeeeseeeeeesaaas 482 4 11 How to Configure Certain Computers Accessing to Internet cceceeeeeeeeeeeeeeeeeeeeeeeaes 486 4 12 How to Block Facebook Service Accessed by the Users via Web Content Filter URL COR NEP IIO orraa cheese acne amen aoc EE econ atasee nsec acoessesancaceage A E 490 4 13 How to use AP Management function in Vigor2860 to check AP status and deploy WLAN DOO aah cae a ci ce a cela E ose ay te eared eats imme nL arooaleanan CearReneeheaieaniesttoarean 495 4 14 CVM Application How to manage the CPE router through Vigor2860 series 498 4 15 CVM Application How to build the VPN between remote devices and Vigor2860 ee 4 16 CVM Application How to upgrade CPE firmware through Vigor2860 series 504 4 17 How to setup Load Balance for Packets cccccccccssseececceeseeeeececeeeecseeeaeeeeessaaeeeeesenes 507 4 18 How to authenticate clients via User Manageme nt cccccscesccceseeseeeeeeeeeeeeeeeseeeeeeeeeas 509 Tro bl Shooting coisi aE aE NEEESE 519 5 1 Checking If the Hardware Status Is OK or NoOb ccccccccccceesceeeseeeeeeeeeeesaeeeeeeeeessseaaeeeeeeeess 519 5 2 Checking If the Network Connection Settings on Yo
315. ek Lah 4 Disable Disable None 100 Kbps DrayTek Disable Disable Nore None Clone Edit Apply To Device Dray Tek 321 Vigor2860 Series User s Guide 3 14 3 AP Maintenance Vigor router can execute configuration backup configuration restoration firmware upgrade and remote reboot for the APs managed by the router It is very convenient for the administrator to process maintenance without accessing into the web user interface of the access point Note Config Backup can be performed to one AP at one time Others functions e g Config Restore Firmware Upgrade Remote Reboot can be performed to more than one AP at one time by using Vigor2860 Central AP Management gt gt AP Maintenance AP Maintenance Select Action Action Type Config Backup s FilePath Fe Sia ae Select Device Existing Device Selected Device 1 AF810_007620482810 2 AP900_00507F223343 Available settings are explained as follows Item Description Action There are four actions provided by Vigor router to manage the access points Config Backup ve Contig Backup Contig Restore Firmware Upgrade Remote Reboot File Path Specify the file and the path which will be used to perform Config Restore or Firmware Upgrade Select Device Display all the available access points managed by Vigor router Simply click lt lt or gt gt to move the device s between Select Device and Selected Device areas Selected Device Display the access
316. el 2011031603200201 Vigor2860 Vigor2860 From the Device s Service section click the Trial My Product About Us A Device Information My Information Nickname vigor2860 Serial 2011031609200201 VigorACs SI Model Vigor2860 Series Customer Survey iter with only i month trial After trial EEA ELN BPM is the web content fiter based on service operated in Germany Wve recommend only users live in Germany to try the BRIM WVCF service This is a free service without guarantees 71 Vigor2860 Series User s Guide 10 Inthe following page check the box of I have read and accept the above Agreement The system will find out the date for you to activate this version of service Then click Next Confirm Message About Us Cancel Product Cancel My Information User Name james_fae VigorACS SI Serial 2011031609200201 _ VigorPro Model Vigor2560 Customer Survey License Number Service Provider Status End User License Agreement PLEASE READ THIS SOFTWARE LICENSE AGREEMENT LICENSE CAREFULLY BEFORE DOWNLOADING OR OTHERWISE USING THE SOFTWARE BY DOWNLOADING INSTALLING OR USING THE SOFTWARE YOU ARE AGREEING TO BE BOUND BY THE TERMS OF THIS LICENSE IF YOU po NOT AGREE TO THE TERNS OF THIS LICENSE YOU ARE NOT AUTHORIZED TO DOWNLOAD OR USE THIS SOFTWARE 1 Scope have read and accept the sbowe Agreement Please check this box 11 When this page ap
317. en the first and last value are the same it indicates one port when the first and last values are different it indicates a range for the port and available for this service type when the first and last value are the same it indicates all the ports except the port defined here when the first and last values are different it indicates that all the ports except the range defined here are available for this service type gt the port number greater than this value is available lt the port number less than this value is available for this profile Service Group Object Use the drop down list to choose the one that you want Specify the action for fragmented packets And it is used for Data Filter only Don t care No action will be taken towards fragmented packets Unfragmented Apply the rule to unfragmented packets Fragmented Apply the rule to fragmented packets Too Short Apply the rule only to packets that are too short to contain a complete header Specifies the action to be taken when packets match the rule Block Immediately Packets matching the rule will be dropped immediately Pass Immediately Packets matching the rule will be 176 Dray Tek Dray Tek Branch to other Filter Set Sessions Control MAC Bind IP Quality of Service Load Balance policy User Management APP Enforcement passed immediately Block If No Further Match A packet matching the rule and that
318. ent from not connecting to Vigor router due to unexpected error Vigor2860 series features a hugely flexible VLAN system In its simplest form each of the Gigabit LAN ports can be isolated from each other for example to feed different companies or departments but keeping their local traffic completely separated Configuring port based VLAN for wireless and non wireless clients 1 All the wire network clients are categorized to group VLANO in subnet 192 168 1 0 24 LANI 2 All the wireless network clients are categorized to group VLANI in subnet 192 168 2 0 24 LAN2 3 Open LAN gt gt VLAN Configuration Check the boxes according to the statement in step 1 and Step 2 LAN gt gt VLAN Configuration VLAN Configuration Enable Wireless LAN 4GHz Wireless LAN 5GHz VLAN Tag SSID1 SSID2 SSIDS SSID4 SSID1 SSID2 SSID3 SSID4 Subnet Enable VID d M d d d d d P2 P3 P4 P5 P6 M M M M FRPP d d d d ld MHOOOO d d d d d OOOO d ll ll d ll FRRE AOOO eles elle lelielial Permit untagged device in Pl to access router 1 For each WLAN row If enable is checked for the VLAN Tag then the corresponding VID willbe applied to wired LAN traffic 2 Wireless LAN traffic is always untagged but will still be a member of the WLAN group selected 3 Each VID must be unique Vigor2860 Series User s Guide 140 Dr ay Tek Click OK Open LAN gt gt General Setup If you want to let the clients in both groups co
319. eout are 2000 packets per second and 10 seconds respectively That means when 2000 packets per second received they will be regarded as attack event and the session will be paused for 10 seconds Check the box to activate the ICMP flood defense function Similar to the UDP flood defense function once if the Threshold of ICMP packets from Internet has exceeded the defined value the router will discard the ICMP echo requests coming from the Internet The default setting for threshold and timeout are 250 packets per second and 10 seconds respectively That means when 250 packets per second received they will be regarded as attack event and the session will be paused for 10 seconds Port Scan attacks the Vigor router by sending lots of packets to many ports in an attempt to find ignorant services would respond Check the box to activate the Port Scan detection Whenever detecting this malicious exploration behavior by monitoring the port scanning Threshold rate the Vigor router will send out a warning By default the Vigor router sets the threshold as 2000 packets per second That means when 2000 packets per second received they will be regarded as attack event Check the box to activate the Block IP options function The Vigor router will ignore any IP packets with IP option field in the datagram header The reason for limitation is IP option appears to be a vulnerability of the security for the LAN because it w
320. eparate the Wireless and the Wired LAN WLAN Isolation enables you to isolate your wireless LAN from wired LAN for either quarantine or limit access reasons To isolate means neither of the parties can access each other To elaborate an example for business use you may set up a wireless LAN for visitors only so they can connect to Internet without hassle of the confidential information leakage For a more flexible deployment you may add filters of MAC addresses to isolate users access from wired LAN Manage Wireless Stations Station List will display all the station in your wireless network and the status of their connection Below shows the menu items for Wireless LAN 2 4Ghz and Wireless LAN 5GHz The following sections explain setting for wireless LAN Here we take menu items under Wireless LAN 2 4 GHz as the examples The differences for the settings between 2 4 GHz and 5 GHz will be pointed out Dray Tek 353 Vigor2860 Series User s Guide 3 16 2 General Setup By clicking the General Settings a new web page will appear so that you could configure the SSID and the wireless channel Please refer to the following figure for more information Wireless LAN 2 4GHz gt gt General Setup General Setting IEEE 807 11 Enable Wireless LAN Mode Mixed dib 141ig 1in Channel Channel 6 2437MHzZ Enable Hide SSID SSID Isolate Member Isolate VPN 1 Oo Oo Oo 2 H 3 oO Doo y 4 Note Enabling the Isolate Member
321. er interface of Vigor router 2 Open Firewall gt gt Filter Setup Click the Set 2 link and choose the Filter Rule 2 button Firewall gt Fitter Setup Fiter Setup Setto Factory Default Comments Comments Default Call Filter Default Data Filter Firewag gt gt Filter Setup gt gt Edit Filter Set Fitter Sat 2 Comments Fitek Rule Active Comments Move Up Move Down A sMetBios gt DNS Down d UP Down LI uP Down 4 al UP Down Vigor2860 Series User s Guide 486 Dr ay Te k 3 Check the box of Check to enable the Filter Rule Type the comments e g block_all Choose Block If No Further Match for the Filter setting Then click OK Firewall gt gt Edit Filter Set gt Edit Filter Rule Fitter Set 2 Rule 2 Check to enable the Filter Rule Comments block_all Index 1 15 in Schedule Setup Clear sessions when schedule Direction source IP Destination IP Service Type Fragments Application Action Profile Filter Block Ifo Further Match Branch to Other Filter Set a Cesecine Cortes m fleono ac Note In default the router will check the packets starting with Set 2 Filter Rule 2 to Filter Rule 7 If Block If No Further Match for is selected for Filter the firewall of the router would check the packets with the rules starting from Rule 3 to Rule 7 The packets not matching with the rules will be processed according to Rule 2 4 Next set another rule Just open Firewall gt
322. erefore users can apply LDAP to search or list the directory object inquire or manage the active directory General Setup This page allows you to enable the function and specify general settings for LDAP server Applications gt gt Active Directory LDAP Active Directory LDAP Set to Factory Default Active Directory General Setup LDAP Profiles Enable Bind Type Server Address Destination Port Use SSL Regular DN Regular Password Note After finishing the configuration of the LDAP profiles they will be listed in the page of VPN and Remote Access gt gt PPP General Setup If you want to use the profiles for VPN authentication check the boxes under PPTP LOAP Profiles in VPN and Remote Access gt gt PPP General Setup first Dr ay Tek 255 Vigor2860 Series User s Guide Available settings are explained as follows Item Description Enable Check to enable such function Bind Type There are three types of bind type supported Simple Mode v Simple Mode Anonymous Regular Mode Simple Mode Just simply do the bind authentication without any search action Anonymous Perform a search action first with Anonymous account then do the bind authentication Regular Mode Mostly it is the same with anonymous mode The different is that the server will firstly check if you have the search authority For the regular mode you ll need to type in the Regular DN and Regular Password S
323. erived from 802 1d prioritization tabs The categories are designed with specific types of traffic voice video best effort and low priority data There are four accessing categories AC_BE AC_BK AC_VI and AC_VO for WMM APSD automatic power save delivery is an enhancement over the power save mechanisms supported by Wi Fi networks It allows devices to take more time in sleeping state and consume less power to improve the performance by minimizing transmission latency Wireless LAN 2 4GHz gt WMM Configuration WMM Configuration WMM Capable Enable Disable APSD Capable Enable Disable WMM Parameters of Access Point Aifsn CWMin CWMax Txop ACM AckPolicy AC_BE e o m AC_BK o oO m AC_VI o o AC_VO o o WMM Parameters of Station Alfsn CWHMin CWMax Txop ACM AC_BK D AC_VI o AC_VO o OK Available settings are explained as follows Item Description WMM Capable To apply WMM parameters for wireless data transmission please click the Enable radio button APSD Capable The default setting is Disable Aifsn It controls how long the client waits for each data transmission Please specify the value ranging from to 15 Such parameter will influence the time delay for WMM accessing categories For the service of voice or video image please set small value for AC_VI and AC_VO categories For the service of e mail or web browsing please set large value for AC_BE and AC_BK categories CWMin CW Max CWMin means contention Wi
324. ernet Access tine Mode IP Address MAC Address UpTime WAN1 VDSL2 DHCP Client _ 192 168 100 202 00 1D AA B6 1B B9_ 3 25 14 WAN2 Ethernet Static IP___ 172 16 3 133 00 1D AA B6 1B BA WANS _ USB PPP Disconnected 00 1D AA B6 1B BB 00 00 00 WANA UsB Disconnected 00 1D 44 B6 1B BC Interface WAN Connected 2 WANI Q WAN2 WANS WANG FLAN Connected 3 LAN1 LAN LAN3 LAN4 System Resource Dashboard Wizards kd Online Status cores O a i ICF J User mode Status Settings Saved Settings to be configured in User Mode will be less than settings in Admin Mode Only basic configuration settings will be available in User Mode Note Setting in User Mode can be configured as same as in Admin Mode 3 19 5 Login Page Greeting When you want to access into the web user interface of Vigor router the system will ask you to offer username and password first At that moment the background of the web page is blank and no heading will be displayed on the Login window This page allows you to specify login URL and the heading on the Login window if you have such requirement System Maintenance gt gt Login Page Greeting Login Page Greeting C Enable Login Page Title Router Login 31 char max Welcome Message and Bulletin Max 511 characters Preview Setto Factory Default lt his lt b gt lt font color red gt Welcome Message lt font gt lt b gt lt hi gt lt p gt This wel
325. erver Address Enter the IP address of LDAP server Destination Port Type a port number as the destination port for LDAP server Use SSL Check the box to use the port number specified for SSL Regular DN Type this setting if Regular Mode is selected as Bind Type Regular Password Specify a password if Regular Mode is selected as Bind Type After finished the above settings click OK button to save the settings Vigor2860 Series User s Guide 256 Dr ay Tek Profiles You can configure eight AD LDAP profiles These profiles would be used with User Management for different purposes in management Applications gt Active Directory LDAP Active Directory LDAP Set to Factory Default Active Directory General Setup LDAP Profiles Index Name Distinguished Name 99 ieee ieee lee Note After finishing the configuration of the LDAP profiles they will be listed in the page of VPN and Remote Access gt gt PPP General Setup If you want to use the profiles for VPN authentication check the boxes under PPTP LDAF Profiles in VPN and Remote Access gt gt PPP General Setup first Click any index number link to open the following page Applications gt gt Active Directory LDAP gt Server Profiles Index No 1 Name Common Name Identifier Base Distinguished Name Additional Filter Hote Please type in your additional filter for BaseDN search request For example 1 For OpenLDAP gidNumber 500 2 For A
326. erver Wizard VPN Authentication Setting Profile Name PPTP LeTP LeTP over IPsec Authentication Username Password IPsec f L2TP over IPsec Authentication Pre Shared Key Confirm Pre Shared Key LI Digital Signature 509 Peer ID Local ID Alternative Subject Name First Subject Name First Peer IP YPH Client IP Peer ID Site to Site Information Remote Network IP 0 0 0 0 Remote Network Mask 255 255 255 0 Vigor2860 Series User s Guide 60 Dr ay Te k Dray Tek When you check IPsec you will see the following graphic VPN Server Wizard VPN Authentication Setting Profile Name IPsec L2TP over IPsec Authentication Pre Shared Key Confirm Pre Shared Key Cl Digital Signature 509 Peer ID Local ID Alternative Subject Name First Subject Name First Peer IP PN Client IP Peer ID Site to Site Information Remote Network IP Remote Network Mask Item Profile Name User Name Password Pre Shared Key Confirm Pre Shared Key Digital Signature X 509 Peer IP VPN Client IP Peer ID Po Nowe Po 0 0 0 0 255 255 255 0 Available settings are explained as follows Description Type a name for such profile The length of the file is limited to 10 characters This field is used to authenticate for connection when you select PPTP or L2TP with or without IPsec policy above The length of the name is limited to 11 characters This field is used to
327. ery time He she only needs to press a button on wireless client and WPS will connect for client and router automatically There are two methods to do network connection through WPS between AP and Stations pressing the Start PBC button or using PIN Code Vigor2860 Series User s Guide 360 Dr ay Te k On the side of Vigor 2850 series which served as an AP press WPS button once on the front panel of the router or click Start PBC on web configuration interface On the side of a station with network card installed press Start PBC button of network card WLAN Card If you want to use PIN code you have to know the PIN code specified in wireless client Then provide the PIN code of the wireless client you wish to connect to the vigor router PINCode _ WLAN Card Lp Sat N M Define a PIN Code of Station PIN Code For WPS is supported in WPA PSK or WPA2 PSK mode if you do not choose such mode in Wireless LAN gt gt Security you will see the following message box Microsoft Internet Explorer A WPS only supports in WFEAMPEALZ FPSE Mode Please click OK and go back Wireless LAN gt gt Security to choose WPA PSK or WPA2 PSK mode and access WPS again Dr ay Tek 361 Vigor2860 Series User s Guide Below shows Wireless LAN gt gt WPS web page Wireless LAN 2 4GHz gt WPS Wi Fi Protected Setup Enable WPS Wi Fi Protected Setup Information WPS Status SSID Authentication Mode Device Configure C
328. es User s Guide profiles in LAN to LAN will be displayed in blue Update Click this button to save the changes to the Status Enable or Disable profile name member or member2 Delete Click this button to delete the selected VPN TRUNK profile The corresponding members LAN to LAN profiles grouped in the deleted VPN TRUNK profile will be released and that profiles in LAN to LAN will be displayed in black Time for activating VPN TRUNK VPN Backup mechanism profile VPN TRUNK VPN Backup mechanism will be activated automatically after the initial connection of single VPN Tunnel off line The content in Member1 2 within VPN TRUNK VPN Backup mechanism backup profile is similar to dial out profile configured in LAN to LAN web page VPN TRUNK VPN Backup mechanism backup profile will process and handle everything unless it is off line once it is activated Time for activating VPN TRUNK VPN Load Balance mechanism profile After finishing the connection for one tunnel the other tunnel will dial out automatically within two seconds Therefore you can choose any one of members under VPN Load Balance for dialing out Time for activating VPN TRUNK Dial out when VPN Load Balance Disconnected For there is one Tunnel created and connected successfully to keep the load balance effect between two tunnels auto dial will be executed within two seconds To close two tunnels of load balance after connecting please cli
329. es do not need to use this wizard Click Cancel to close the wizard and then plug the printer s cable Edit View Favorites Tools into your computer or point the printer toward your computer s infrared port and turn the printer on Server Properties S P Sea Windows will automatically install the printer for you Set Up Faxing To continue click Next reate Shortcut Delete Rename Properties Close Cancel 4 Click Local printer attached to this computer and click Next Add Printer Wizard Local or Network Printer The wizard needs to know which type of printer to set up Select the option that describes the printer you want to use Local Automatically detect and install my Plug and Play printer OA network printer or a printer attached ta another computer Toset up 4 network printer that is not attached to a print server 1 use the Local printer option m 5 In this dialog choose Create a new port Type of port and use the drop down list to select Standard TCP IP Port Click Next Add Printer Wizard Select a Printer Port Computers communicate with printers through ports Select the port you want your printer to use If the port is not listed you can create a new port Use the following port LPT Recommended Printer Pot Note Mott computers Use the LATTI por to comrmunicate with a local printer abe tL gt ine 5 tans The onrect r
330. esueseesataeseteeuneeaaees 48 23 ING Se Wizard scanna ane sacccusn cite a a ue niahena nein a a aai 52 DNTP WN SOLVE VIZ Aart eects tes E ednektateteiata constant cembet aut cetutakt dtectia etemetaeccesiane 58 2 5 Wireless Wizard weencccsnccsmeescexscunetacasivnanedsnensadaswdeia sdaiinetas cides ocwdentnie dedicate tanvdnsncdeanksceasndasecandatned 63 26 VolP Wizarani a E DDN 67 2 7 Registering Vigor ROUTE vasawinssrsantcassravneaxansctvasarawsvinavsaesuiveunshvacontwhriuysantousssacieoversel dadverasgsancaws 69 Dr ay Tek V Vigor2860 Series User s Guide 3 1 1 Basics of Internet Protocol IP N tWOrk ccceccccsseeeeeeeeeeeeseeeeeeeseeeeeseaseessaeeeesaaeess 73 is ou fey lt 1 E eo 0 eee ee eee E ee ee 75 3 1 3 Internet ACCESS cccccccsescecceseeeccesececceseeeseaeeecsaeeecseuseeeseaeeessageeeesauseeessaseeessageeessansenes 82 SAE SVC a 1 O ee ee ee 114 e EAN aes aeatctra pact Gace eerea ae E A E E E E A E 121 52a FE SO EAN erian r E E a 121 CRAE I re e i o APE E TEA EATA A E E A E E 123 Te ae AO e a E E E E A E 133 SeA IN e E E E 138 BZ TAC IO MA O eama a E E E E E EA E 142 TACEN POT NITO eoa E E E E E EE E EEE 144 OE NOC 02 K a E E E scacaengsecsenset 145 oie ND POr T e cr ee ee E E ee ee 146 3 3 Load Balance Route PONCY ccsesincevceseecenccccuvendecndssteecedcietesnd sfacdadensdeddedanscebcvedadocacebassteveneueses 148 ANAT e A E T 153 3 4 1 Port Redirection ccccccecececccseseeeeccceasseeecc
331. esult you can not only schedule the router to dialup to the Internet at a specified time but also restrict Internet access to certain hours so that users can connect to the Internet only during certain hours say business hours The schedule is also applicable to other functions You have to set your time before set schedule In System Maintenance gt gt Time and Date menu press Inquire Time button to set the Vigor router s clock to current time of your PC The clock will reset once if you power down or reset the router There is another way to set up time You can inquiry an NTP server a time server on the Internet to synchronize the router s clock This method can only be applied when the WAN connection has been built up Applications gt gt Schedule Schedule Setto Factory Default Index Status Index Status 1 x 9 x Z x 10 x 3 x 11 x 4 x 12 x 5 x 13 x 6 x 14 x i x 15 x a x Status v Active x Inactive Available settings are explained as follows Item Description Set to Factory Default Clear all profiles and recover to factory settings Index Click the number below Index to access into the setting page of schedule Status Display if this schedule setting is active or inactive You can set up to 15 schedules Then you can apply them to your Internet Access or VPN and Remote Access gt gt LAN to LAN settings To add a schedule 1 Click any index say Index No 1 2 The detailed setti
332. ettings VLAN Header Note 1 Tag value must be set between 1 4095 and unique for each channel 2 0Only one channel can be untagged equal to 0 at a time Bridge mode Note 3 P1 is reserved for NAT use and cannot be configured for bridge mode Set top box STB or the other kinds of media devices are able to attach with Port4 or Port5 of LAN Those devices that attached with Port4 or Port5 are able to access the services network directly which your ISP provided Vigor2860 Series User s Guide 334 Dr ay Te k Appendix Il Release Note Firmware Version 3 7 4 1 New Features Support VoIP Support DMZ port setting in LAN1 Support dual 3G 4G LTE function WAN3 WAN4 Support Bonjour and SSH Secure Shell for IPv6 Support Central AP Management including AP Load Balance Rogue AP Detection gt gt gt AP Maintenance Configuration Backup Restoration and Firmware Upgrade gt AP Traffic Graph gt Station List Support Station Control function for wireless connection Improvement Improved Support more TR 069 parameters including CPU memory and up time Improved Support customized DDNS Improved Separate PPPoE display name and service name Improved Support configuration backup restore for IP bind MAC Improved Multi PVCs page improvement Improved Support up to 31 characters configured for Server IP Host name for VPN Improved Modification for wireless setting for 2 4GHz and 5GHz Impro
333. f PCs that you want the DHCP server to assign IP addresses to The default is 50 and the maximum is 253 Gateway IP Address Enter a value of the gateway IP address for the DHCP server The value is usually as same as the Ist IP address of the router which means the router 1s the default gateway Lease Time Enter the time to determine how long the IP address assigned by DHCP server can be used Retrieve IPs from inactive clients periodically Whenever a DHCP client requests an IP address from the LAN DHCP server the server will give out an IP to this client for a certain amount of time e g 1 day However even if this client only uses the IP for say 5 minutes the server still reserves 1 day for that client Because a DHCP server only has a limited number of IPs to lease to its DHCP clients soon enough all the IPs will be used out and then no one will be able to get any IPs from this server anymore Therefore this feature is used to get the IP back from inactive clients i e doesn t use the IP but the server still reserves the IP for him DNS stands for Domain Name System Every Internet host must have a unique IP address also they may have a human friendly easy to remember name such as www yahoo com The DNS server converts the user friendly name into its equivalent IP address Primary IP Address You must specify a DNS server IP address here because your ISP should provide you with usually more than one DNS Server If y
334. f WAN1 down If WANI failed the router will use WAN2 for VPN connection Netbios Naming Packet Pass click it to have an inquiry for data transmission between the hosts located on both sides of VPN Tunnel while connecting Block When there is conflict occurred between the hosts on both sides of VPN Tunnel in connecting such function can block data transmission of Netbios Naming Packet inside the tunnel Multicast via VPN Some programs might send multicast packets via VPN connection Pass Click this button to let multicast packets pass through the router Block This is default setting Click this button to let multicast packets be blocked by the router Call Direction Specify the allowed call direction of this LAN to LAN profile Vigor2860 Series User s Guide 280 Dr ay Tek Dray Tek Dial Out Settings Both initiator responder Dial Out initiator only Dial In responder only Always On Check to enable router always keep VPN connection Idle Timeout The default value is 300 seconds If the connection has been idled over the value the router will drop the connection Enable PING to keep alive This function is to help the router to determine the status of IPsec VPN connection especially useful in the case of abnormal VPN IPsec tunnel disruption For details please refer to the note below Check to enable the transmission of PING packets to a specified IP address Ena
335. factory settings Default Message You can type the message manually for your necessity or click this button to get the default message which will be displayed on the field of Administration Message Vigor2860 Series User s Guide 228 Dr ay Tek Cache None the router will check the URL that the user wants to access via WCF precisely however the processing rate is normal Such item can provide the most accurate URL matching L1 the router will check the URL that the user wants to access via WCF If the URL has been accessed previously it will be stored for a short time about 1 second in the router to be accessed quickly if required Such item can provide accurate URL matching with faster rate L2 the router will check the URL that the user wants to access via WCF If the data has been accessed previously the IP addresses of source and destination IDs will be memorized for a short time about second in the router When the user tries to access the same destination ID the router will check it by comparing the record stored If it matches the page will be retrieved quickly Such item can provide URL matching with the fastest rate L1 L2 Cache the router will check the URL with fast processing rate combining the feature of L1 and L2 Eight profiles are provided here as Web content filters Simply click the index number under Profile to open the following web page The items listed in Categories will be changed acc
336. ffic it will terminate the network connection of the client s station which is idle for a longest time By signal Strength When the access point is overload e g reaching the limit of station number or limit of network traffic it will terminate the network connection of the client s station with the weakest signal None Lv i By Idle Time i By signal Strength After finishing all the settings here please click OK to save the configuration 3 14 7 Function Support List Click the Client tab to list the AP management functions that the Access Points support under different firmware versions Click the Server tab to list the AP management functions that Vigor router supports under different firmware versions Central AP Management gt Function Support List client Server Moet Name es ee es ee Oe OS Register static o d d y S d y Profile 2aGHz a aaa GHz S o d y y i y yi aPMode a Repeater Mode o do o o ooo oo oy d y y Yy Client Disable Auto Provision ET WLAN Enable Disable do o ooo do d o Y Station List stationList_ aa Load Balance Joo toad Balance o ooo d o S S Yy Traffic Graph Traffic Graph o ooo o d o y S y d Yy Rogue AP Detection Rogue AP Detection o o do o o ooo o S A Yi AP Maintenance Config Backup Restore TE o y Firmware Upgrade PE S Yyy Remote Reboot PE Vigor2860 Series User s Guide 328 Dray Te k 3 15 VoIP Note This function is used for V models Voice ove
337. fic VoIP interface Take the above picture Prefix 334 Dray Tek OP Number Min Len Max Len Route Move UP Move Down Table Setup web page as an example the prefix number of 03 will be replaced by 8863 For example dial number of 031111111 will be changed to 88631111111 and sent to SIP server Mode None Add Strip tepl The front number you type here is the first part of the account number that you want to execute special function according to the chosen mode by using the prefix number Set the minimal length of the dial number for applying the prefix number settings Take the above picture Prefix Table Setup web page as an example if the dial number is between 7 and 9 that number can apply the prefix number settings here Set the maximum length of the dial number for applying the prefix number settings Choose the one that you want to enable the prefix number settings from the saved SIP accounts Please set up one SIP account first to make this interface available This item will be changed according to the port settings configured in VoIP gt gt Phone Settings Click the link to move the selected entry up or down After finishing all the settings here please click OK to save the configuration Call Barring Call barring is used to block phone calls coming from the one that is not welcomed Dray Tek VoIP gt gt DialPlan Setup Call Barring Setup Index Call Direction a
338. file prerson al Information Draytek provides My igor myvigor draytek com service according to this agreement Ahen you use MyYigor service t means that you have read understand and agree to accept the items listed in this agreement Draytek can modify or change the content of the items without any reasons tt is E Preferences suggested for you to notice the medications or changes at any time If you still use MyVvigor service after knowing the modifications and changes of this service it means you have read understand and agree to accept the modifications and changes If you do not agree the content of this agreement A please stop using My igor service completion 2 Registration To use this service you have to agree the following conditions a Provide your complete and correct information according to the registration steps of this service Dray Tek 475 Vigor2860 Series User s Guide 5 Type your personal information in this page and then click Continue Register Create an account Please enter personal profile Fiek s marked by are required Account Information Gs UserName Mary Check Account 3 20 characters oo Password a a ee El CSRi 4 20 characters Do notset the same as the usetname Confirm Password PT yt Personal Information E Preterences First Name Mary Last Name Ted E completion Company Name Tech Ltd Email Address mary_ted tech corn F Pl
339. fill in Start IP address and End IP address For Subnet Address you have to fill in Start IP address and Subnet Mask All the packets of data will be divided with different levels and will be processed according to the level type by the system Please assign one of the levels of the data for processing with QoS control It determines the service type of the data for processing with QoS control It can also be edited You can choose the predefined service type from the Service Type drop down list Those types are predefined in factory Simply choose the one that you want for using by current QoS 22 Dray Tek 4 After finishing all the settings here please click OK to save the configuration By the way you can set up to 20 rules for one Class If you want to edit an existed rule please select the radio button of that one and click Edit to open the rule edit page for modification Bandwidth Management gt gt Quality of Service Class Index 1 Name Cl Tag packets as Default DiffServ CodePoint iO Active Any Any ANY ANY WO Status Local Address Remote Address Service Type Edit the Service Type for Class Rule 1 To add anew service type edit or delete an existed service type please click the Edit link under Service Type field Bandwidth Management gt gt Quality of Service General Setup Setto Factory Default UDP Glass Class Class Others Bandwidth Index Status Bandwidth Direction Online 1 2
340. fine the name for that Class In this case Test is used as the name of Class Index 1 Bandwidth Management gt Quality of Service Class Index 1 Name D Tag packets as Default v NO Status Local Address Remote Address DiffServ CodePoint Service Type i Empty 2 Dray Te k 241 Vigor2860 Series User s Guide 3 For adding a new rule click Add to open the following page Bandwidth Management gt Quality of Service Rule Edit ACT Ethernet Type Local Address Remote Address DiffServ CodePoint Service Type Item ACT Ethernet Type Local Address Remote Address DiffServ CodePoint Service Type Vigor2860 Series User s Guide IPv4 IPv6 ey SS fey Sd Predefined Note Please choose setup the Service Type first Available settings are explained as follows Description Check this box to invoke these settings Please specify which protocol IPv4 or IPv6 will be used for this rule Click the Edit button to set the local IP address on LAN for the rule Click the Edit button to set the remote IP address on LAN WAN for the rule 3 http 192_168_ 1_1 doc QosIpEdthtm Microsoft Internet Explorer Address Type Subnet Address v Start IP Address 0 0 0 0 End IP Address Subnet Mask 0 0 0 0 Address Type Determine the address type for the source address For Single Address you have to fill in Start IP address For Range Address you have to
341. following web page simply click index number 1 Load Balance Route Policy J Set to Factory Default Interface Dest IP Dest Dest Move Move Index Enable Protocol Interface Adileace Src IP Start Src IP End Start Dest IP End kiraka aaa Up Down Policy Route Down Down Down Down Down Down Down Down Down Down Next gt gt Dray Tek 507 Vigor2860 Series User s Guide 3 In the following page check Enable set Dest IP Start and Dest IP End with 203 65 1 35 and 203 65 1 35 choose WAN as the Interface click default gateway do not check Auto Failover To The Other WAN Load Balance Route Policy Index 1 Enable criteria Protocol Source IF Destination Destination IP Port any any Src IFP Start Can Dest IP Start 203 65 1 35 e 203 65 1 35 Dest Port Start send to if criteria matched Interface Interface Address Gateway IP more options raat rt Src IP End Dest IP End Dest Port End WAMI w fe default gateway O specific gateway O Auto Failover To The Other WAM Packet Forwarding to WAM via Load Balance Route Policy Policy Route Index Enable Protocol Interface 1 2 3 4 5 6 Z 8 9 10 any any any any any any any any any bje fbf bf bf m any WANI WAN 1 WAN 1 WAN 1 WANI WANI WANI WAN 1 WAN 1 WAN 1 force MAT force Routing 4 After finished the above settings click OK to save the configur
342. for URL Access Control and Web Feature will be inactive Both Block The router will block all the packages that match with the conditions specified in URL Access Control and Web Feature below When you choose this setting both configuration set in this page for URL Access Control and Web Feature will be inactive Either URL Access Control First When all the packages matching with the conditions specified in URL Access Control and Web Feature below such function can determine the priority for the actions executed For this one the router will process the packages with the conditions set below for URL first then Web feature second Either Web Feature First When all the packages matching with the conditions specified in URL Access Control and Web Feature below such function can determine the priority for the actions executed For this one the router will process the packages with the conditions set below for web feature first then URL second Vigor2860 Series User s Guide 224 Dr ay Te k Dray Tek Log URL Access Control Both Pass Both Block Either URL Access Control First Either Web Feature First None There is no log file will be recorded for this profile Pass Only the log about Pass will be recorded in Syslog Block Only the log about Block will be recorded in Syslog All All the actions Pass and Block will be recorded in Syslog None Enable URL Access Control Check t
343. ge of Central VPN Management gt gt CPE Management Return to the web user interface of Vigor2860 series Open Central VPN Management gt gt VPN Management Now there is one CPE displayed on the field of Unmanaged Devices List Choose the one Vigor2850 from Unmanaged Devices List and click Add The following dialog will be popped up Type the name and the location of the router respectively Click OK to save the configuration 9 Device Information Mozilla Firefox 192 168 1 1Moc epelnfo htm System Maintenance gt gt Edit Device Information DER Model Name Device Name Name Manufacturer OUI Product Class Mac Address Location IP Port URI Description Hardware Version Software Version Modem Firmware Version Vigor2850 nate nangg Kate_local_ 2850 00507F Vigor aig i No 26 Fu Road HS Ci 8069 fewm CRN html DrayTek Vigor Router 104 3 6 3 211801_4 Annex_A The selected CPE will be moved and displayed on Managed Devices List which means it is controlled managed by Vigor2860 series from now on Managed Devices List Managed Devices List Kate local 192 168 30 12 v Unmanaged Devices List CPE Maintenance Google Map Refresh IP Address Mac Address Device Model Description Name Location 501 Vigor2860 Series User s Guide 4 15 CVM Application How to build the VPN between remote devices and Vigor2860 series When a remote device is managed by Vigor2860 ser
344. gure Settings on CPE l 4 Dray Tek In the end of the CPE access into the web user interface of the CPE e g Vigor2850 series Open a web browser for example IE Mozilla Firefox or Netscape and type http 192 168 1 1 Open System Maintenance gt gt TR 069 System Maintenance In the field of ACS Server type the URL IP address with port number of Vigor2860 series and type the same Username and Password defined on the page of Central VPN Management gt gt General Setup in Vigor2860 series Then click Enable for CPE Client and then click OK to save the settings System Maintenance gt gt TR 069 Setting ACS and CPE Settings ACS Serer On Internet ACS Server URL http172 17 1 182 9000 Username Password CPE Client Enable Disable URL http172 17 1 208 2069 ewmsCRN html Port sername Password Periodic Inform Settings Disable Enable _ Teterivsal Time EN ceaconndfc Open System Maintenance gt gt Management Setup 499 Vigor2860 Series User s Guide 5 Check Allow management from the Internet to set management access control and click OK System Maintenance gt gt Management IPv4d Management Setup IPv6 Management Setup User Define Ports Default Ports Management Access Control Telnet Port Default 23 l Allow management from the Internet HTTP Fort Default 80 FTF Server HTTPS Port Default 443 HTTP Server FTP Port 21 a HTTPS Server Defau
345. hannel will be identified by the system via their VLAN Tags Channels using the same WAN type may not configure the same VLAN tag value Enable Check this box to enable the port based bridge function on this channel P1 P6 Check the box es to build bridge connection on LAN na DrayTek Click any index 8 10 to get the following web page WAN gt Multi PVCs gt gt Channel Multi P C Channel 8 Enable Disable WAH Type ADSL w General Settings ATM QoS VPI Qo5 Type VOI PCR Protocol SCR Encapsulation MBS J add VLAN Header VLAN Tag Priority Bridge mode Enable Physical Members F1 Pe P3 F Available settings are explained as follows Item Description Multi VLAN Channel Enable Click it to enable the configuration of this 3 4 8 channel Disable Click it to disable the configuration of this channel WAN Type The connections and interfaces created in every channel may select a specific WAN type to be built upon In the Multi PVCs application only the Ethernet WAN type is available The user will be able to select the physical WAN interface the channel shall use here General Settings VPI Type in the value provided by your ISP VCI Type in the value provided by your ISP Protocol Select a proper protocol for this channel Encapsulation Choose a proper type for this channel The types will be different according to the protocol setting that you choose Dr ay Tek 115 Vigor
346. he box to activate URL Access Control Note that the priority for URL Access Control is higher than Restrict Web Feature If the web content match the setting set in URL Access Control the router will execute the action specified in this field and ignore the action specified under Restrict Web Feature Prevent web access from IP address Check the box to deny any web surfing activity using IP address such as http 202 6 3 2 The reason for this is to prevent someone dodges the URL Access Control You must clear your browser cache first so that the URL content filtering facility Operates properly on a web page that you visited before Action This setting is available only when Either URL Access Control First or Either Web Feature First is selected Pass Allow accessing into the corresponding webpage with the keywords listed on the box below Block Restrict accessing into the corresponding webpage with the keywords listed on the box below If the web pages do not match with the keyword set here it will be processed with reverse action Action Block Group Object Selections The Vigor router provides several frames for users to define keywords and each frame supports multiple keywords The keyword could be a noun a partial noun or a complete URL string Multiple keywords within a frame are separated by space comma or semicolon In addition the maximal length of each frame is 32 character long After specifying keywo
347. he other is DHCPv6 Server Stateful Available settings are explained as follows Dray Tek 127 Vigor2860 Series User s Guide Item Router Advertisement Server DHCPv6 Server Configuration DNS Server IPv6 Address Static IPv6 Address configuration Current IPv6 Address Table Description Enable Click it to enable the router advertisement daemon The router advertisement daemon radvd sends Router Advertisement messages specified by RFC 2461 to a local Ethernet LAN periodically and when requested by a node sending a Router Solicitation message These messages are required for Pv6 stateless auto configuration Disable Click it to disable RADVD server Advertisement Lifetime The lifetime associated with the default router in units of seconds It s used to control the lifetime of the prefix The maximum value corresponds to 18 2 hours A lifetime of O indicates that the router is not a default router and should not appear on the default router list Enable Server Click it to enable DHCPV6 server DHCPv6 Server could assign IPv6 address to PC according to the Start End IPv6 address configuration Disable Server Click it to disable DHCPvV6 server Start IPv6 Address End IPv6 Address Type the start and end address for IPv6 server Primary DNS Sever Type the IPv6 address for Primary DNS server Secondary DNS Server Type another IPv6 address for DNS server if required IPv6 Address Type
348. he tunnel broker and then monitors the state of the tunnel in background After getting the IPv6 prefix and starting router advertisement daemon RADVD the PC behind this router can directly connect to IPv6 the Internet WAN gt gt Internet Access WAN 1 PPPoE Static or Dynamic IP PPTP IPv6 Internet Access Mode Connection Type TSPC Configuration Available settings are explained as follows Dr ay Tek 107 Vigor2860 Series User s Guide Item Username Password Confirm Password Tunnel Broker Description Type the name obtained from the broker It is suggested for you to apply another username and password for http gogonet gogo6 com page freenet6 account The maximum length of the name you can set is 63 characters Type the password assigned with the user name The maximum length of the name you can set is 19 characters Type the password again to make the confirmation Type the address for the tunnel broker IP FQDN or an optional port number After finished the above settings click OK to save the settings Details Page for IPv6 AICCU in WAN1 WAN2 WAN3 WAN4 WAN gt Internet Access WAN 1 PPPoE PPPoA MPoA Static or Dynamic IP IPv internet Access Mode Connection Type AICCU Configuration O Always On Username Password Confirm Password Tunnel Broker Subnet Pretix ns Note If Always On is not enabled 4ICCU connection would only retry three times Available set
349. header information also monitor the state of the connection Denial of Service DoS Defense The DoS Defense functionality helps you to detect and mitigate the DoS attack The attacks are usually categorized into two types the flooding type attacks and the vulnerability attacks The flooding type attacks will attempt to exhaust all your system s resource while the vulnerability attacks will try to paralyze the system by offending the vulnerabilities of the protocol or operation system The DoS Defense function enables the Vigor router to inspect every incoming packet based on the attack signature database Any malicious packet that might duplicate itself to paralyze the host in the secure LAN will be strictly blocked and a Syslog message will be sent as warning if you Set up Syslog server Also the Vigor router monitors the traffic Any abnormal traffic flow violating the pre defined parameter such as the number of thresholds is identified as an attack and the Vigor router will activate its defense mechanism to mitigate in a real time manner The below shows the attack types that DoS DDoS defense function can detect 1 SYN flood attack 9 SYN fragment 2 UDP flood attack 10 Fraggle attack 3 ICMP flood attack 11 TCP flag scan 4 Port Scan attack 12 Tear drop attack 5 IP options 13 Ping of Death attack 6 Land attack 14 ICMP fragment 7 Smurf attack 15 Unassigned Numbers 8 Trace route Below shows the menu items for Firewal
350. hedule 3 Click OK button to save the settings Example Suppose you want to control the PPPoE Internet access connection to be always on Force On from 9 00 to 18 00 for whole week Other time the Internet access connection should be disconnected Force Down Dr ay Tek 253 Vigor2860 Series User s Guide Office 1 12 1 1 k 10 2 10 2 Hour a 4 4 5 Force On 7 5 7 Mon Sun 9 00 am to 6 00 pm Make sure the PPPoE connection and Time Setup is working properly Configure the PPPoE always on from 9 00 to 18 00 for whole week Configure the Force Down from 18 00 to next day 9 00 for whole week oe SS Assign these two profiles to the PPPoE Internet access profile Now the PPPoE Internet connection will follow the schedule order to perform Force On or Force Down action according to the time plan that has been pre defined in the schedule profiles 3 10 4 RADIUS Remote Authentication Dial In User Service RADIUS is a security authentication client server protocol that supports authentication authorization and accounting which is widely used by Internet service providers It is the most common method of authenticating and authorizing dial up and tunneled network users The built in RADIUS client feature enables the router to assist the remote dial in user or a wireless station and the RADIUS server in performing mutual authentication It enables centralized remote access authentication for network management
351. hen you choose Remote Dial in Dial in User User Teleworker as VPN server mode There are 32 VPN Accounts tunnels for users to set Allowed Dial in Type This item is available after you choose any one of dial in user account profiles Next you have to select suitable dial in type for the VPN server profile There are several types provided here similar to VPN Client Wizard PPTP IPsec L2TP with IPsec Policy SSL Tunnel Mone Mice to Have Must Different Dial in Type will lead to different configuration page In addition adjustable items for each dial in type will be changed according to the VPN Server Mode Site to Site VPN and Remote Dial in User selected 2 After making the choices for the server profile please click Next You will see different configurations based on the selection you made Here we take the examples of choosing Site to Site VPN as the VPN Server Mode Dr ay Te k 59 Vigor2860 Series User s Guide When you check PPTP you will see the following graphic VPN Server Wizard VPN Authentication Setting Profile Name PPTP r LETP LETP over IPsec Authentication Username Password Peer IP VPNH Client IP Site to Site Information Remote Network IP 0 0 0 0 Pemote Network Mask 255 255 255 0 Cpa C C C When you check PPTP amp IPsec amp L2TP three types or PPTP amp IPsec two types or L2TP with Policy Nice to Have Must you will see the following graphic VPN S
352. hey are fixed If you delete the VPN TRUNK VPN Backup Load Balance mechanism profile the selected LAN to LAN profiles will be released and expressed in black LAN to LAN Profiles View All Trunk Index Name Active Status 1 To A Place V offline 2 To B Site V offline 3 To C Place V offline 4 To D Site V offline How can you set a GRE over IPsec profile 1 Please go to LAN to LAN to set a profile with IPsec 2 If the router will be used as the VPN Server 1 e with virtual address 192 168 50 200 Please type 192 168 50 200 in the field of My GRE IP Type IP address 192 168 50 100 of the client in the field of Peer GRE IP See the following graphic for an example JHigh ESP DES 3DES AES 4 Gre over IPsec Settings Enable IPsec Dial o Sie renee z CI Logical Traffic My GRE IP 192 168 50 200 Peer GRE IP 192 168 530 100 5 TCPAP Network Settings My WAN IP RIP Direction From first subnet to remote network you have to da Remote Network IP Remote Network Mask 255 255 2550 Local Network IP 192 168 25 1 Change default route to this WPN tunnel Only single WWAN supports this 3 Remote Gateway IP Local Network Mask 3 Later on peer side as VPN Client please type 192 168 50 100 in the field of My GRE IP and type IP address of the server 192 168 50 200 in the field of Peer GRE IP mgn ESF OES SUES AES 4 Gre over IPsec Settings Enable IPsec DiahOut function Ge D
353. his binding tunnel table Binding Dial Out Index Specify connection type for transmission by choosing the index LAN to LAN Profile Index for such binding tunnel table Scr IP Start End Specify source IP addresses as starting point and ending point Dest IP Start End Specify destination IP addresses as starting point and ending point Dest Port Start End Specify destination service port as starting point and ending point Protocol Any means when the source IP destination IP destination port and fragment conditions match with the settings specified here such binding tunnel table can be established for TCP Service Port UDP Service Port ICMP IGMP specified here TCP means when the source IP destination IP destination port and fragment conditions match with the settings specified here and TCP Service Port also fits the number here such binding tunnel table can be established UDP means when the source IP destination IP destination port and fragment conditions match with the settings specified here and UDP Service Port also fits the number here such binding tunnel table can be established TCP UPD means when the source IP destination IP destination port and fragment conditions match with the settings specified here and TCP UDP Service Port also fits the number here such binding tunnel table can be established ICMP means when the source IP destination IP destination port and fragment conditions match with the
354. his profile This setting is useful for dial out only WAR First AVANT First WANI Only WAN First WAN Only WANT only Only establish WPN if WAM down WARS only Only establish WPN if WAMI down WARNS First WANS Only WAKA First WANA Only WANI First WAN2 First WAN3 First WAN4 First While connecting the router will use WAN I WAN2 WAN3 WAN4 as the first channel for VPN connection If WANI WAN2 WAN3 WAMN4 fails the router will use another WAN interface instead WANI Only WAN2 Only WAN3 Only WAN4 Only While connecting the router will use WANI WAN2 WAN3 as the only channel for VPN connection WANI Only Only establish VPN if WAN2 down If WAN failed the router will use WANI for VPN connection WAN2 Only Only establish VPN if WAN1 down If WANI failed the router will use WAN2 for VPN connection Check to enable router always keep VPN connection Type the IP address of the server or type the host name for such VPN profile IKE Authentication Method usually applies to those are remote dial in user or node LAN to LAN which uses dynamic IP address and Psec related VPN connections such as L2TP over IPsec and IPsec tunnel Pre Shared Key Specify a key for IKE authentication Confirm Pre Shared Key Confirm the pre shared key Click Digital Signature to invoke this function Peer ID Choose the peer ID selection from the drop down list Local ID Choose Alternative Subject Name First or Subject Name
355. hoo M AIM lt 5 9 Login Massage File Transfer Game ConterencelVideo oice Other Activities IM Application Claime 7 CQQ Lichat Ljabber GoogleTalk Uskype Lkubao Googlechat LI Fire L GaduGadu LI Paltalk Licizmo Lsip rte LJonext LIpoco Pps65 a resChat LI alia C TelTel d TeamSpeak L Lava Lava Llicuz Lispa Clue q eamspea LI MobilemSn LI BaiduHi LJ Fetion LILINE Raid all Web IM more than one address eMessenger WebMSN meebo ILovelM ICO Java ICQ Flash qoowy getMessenger IMU nitive Wablet mabber KoollM MessenqgerFx MessengerAdictos WebyYahoolM CU WwebIM URLs The items categorized under P2P CSM gt gt APP Enforcement Profile Profile Index 1 Profile Name O O P2P Protocol OTHERS IM Support List Fcnutela Lopster XNap WinLop J aitTorrent BitTorrent BitSpirit BitComet Other P2P Applications LJ xunlei Lvagaa LJpps65 LJpoca LJ clubbox Clares ClezPeer ClPanda ClHuntmine Clkuwo Dray Te k 221 Vigor2860 Series User s Guide The items categorized under OTHERS CSM gt gt APP Enforcement Profile Profile Index 1 Profile Name IM P P Protocal OTHERS Select All Clear All Support List LI socks4 5 LIPGPNet LIHTTP Proxy LItor LIYNN L Softether IMs TEREDO LI Wujie UltraSurt L Hamachi LIHTTF Tunnel LJ Ping Tunnel LI tinyvPN JRealTunnel LibynaPass LJultravPn L Freau Lskyfire Hotspot Shield LI mms LIRTSP LI Tvants LIPPStream LIPPTy LI Feibian LJuusee LINSPlayer
356. ic IP in WAN1 Physical Mode VDSL2 MPoA is a specification that enables ATM services to be integrated with existing LANs which use either Ethernet token ring or TCP IP protocols The goal of MPoA is to allow different LANs to send packets to each other via an ATM backbone To use Static or Dynamic IP as the accessing protocol of the Internet select Static or Dynamic IP from the WAN gt gt Internet Access gt gt WANI page The following web page will appear WAN gt Internet Access WAN 1 PPPoE PPPoA MPoA Static or Dynamic IP IPvo Enable Disable WAN IP Network Settings AN IP Alias Obtain an IP address automatically Modem Settings for ADSL only Router Name Multi PC channel Channel 2 t J Domain Name t Required for same ISPs Encapsulation eee DHCP Client Identifier for some ISP VPI cS C Enable WIC Username EUS Modulation Password a WAN Connection Detection Specify an IP address IP Add 192 168 10 118 Mode ARP Detect nine Subnet Mask 255 255 255 0 Gateway IF Address 192 168 10 254 TTL MTU 1500 Max 1500 Default MAC Address Specify a MAC Address RIP Protocol MAC Address ho laa EBB 1B Ba C Enable RIP DNS Server IP Address Bridge Mode Primary IP Address 6 9 6 8 L Enable Bridge Mode Secondary IP Address 8 8 4 4 Available settings are explained as follows Item Description Enable Disable Click Enable for activating this function If you click
357. icate 4909 Local Certificate Configuration Name Subject Status Modify server C TW ST Hsinchu L Hsinchu d Requesting View Delete View Delete Rae met ae View Delete GENERATE IMPORT REFRESH IMPORT Vigor router allows you to generate a certificate request and submit it the CA server then import it as Local Certificate If you have already gotten a certificate from a third party you may import it directly The supported types are PKCS12 Certificate and Certificate with a private key Click this button to import a saved file as the certification information There are three types of local certificate supported by Vigor router Certificate Management gt Local Certificate Import X509 Local Certificate Upload Local Certificate Select a local certificate file Click Import to upload the local certificate Cancel Upload PACS12 Certificate Select a PKCS1 file Click Import to upload the PKCS12 file Upload Certificate and Private Key Select a certificate file and a matchable Private Key Click Import to upload the local certificate and private key Available settings are explained as follows Item Description Upload Local Certificate It allows users to import the certificate which is generated by vigor router and signed by CA server If you have done well in certificate generation the Status of the certificate will be shown as OK Vigor2860 Series User s Guide 300 Dray Tek Import
358. ice level to assign packets to queues and associated service types The basic QoS implementation in Vigor routers is to classify and schedule packets based on the service type information in the IP header For instance to ensure the connection with the headquarter a teleworker may enforce an index of QoS Control to reserve bandwidth for HTTPS connection while using lots of application at the same time One more larger scale implementation of QoS network is to apply DSCP Differentiated Service Code Point and IP Precedence disciplines at Layer 3 Compared with legacy IP Precedence that uses Type of Service ToS field in the IP header to define 8 service classes DSCP is a successor creating 64 classes possible with backward IP Precedence compatibility In a QoS enabled network or Differentiated Service DiffServ or DS framework a DS domain owner should sign a Service License Agreement SLA with other DS domain owners to define the service level provided toward traffic from different domains Then each DS node in these domains will perform the priority treatment This is called per hop behavior PHB The definition of PHB includes Expedited Forwarding EF Assured Forwarding AF and Best Effort BE AF defines the four classes of delivery or forwarding classes and three levels of drop precedence in each class Vigor routers as edge routers of DS domain shall check the marked DSCP value in the IP header of bypassing traffic thus to allocate
359. id username and password have been correctly supplied a particular client will not be allowed to access Internet through the router There are three ways for authentication Web Telnet and Alert Tool Dray Tek User Management gt gt User Profile Profile Index 3 Enable this account ser Name Password Confirm Password Idle Timeout mings O Unlimited Max User Login O Unlimited Policy Default The selection of items could be crested as rules and which not set to active External Server Authentication FJ TARET Authentication Web Alert Tool Telnet d Index 1 15 in Schedule Setup Enable Time Quota 0 min CE ha min C Enable Data Quota o Jo mB Reset quota to default when scheduling time expired C Enable Default Time Quota Doo min Default Data Quota o e 509 Vigor2860 Series User s Guide Authentication via Web E IfaLAN client who hasn t passed the authentication opens an external web site in his browser he will be redirected to the router s Web authentication interface first Then the client is trying to access http www draytek com and but brought to the Vigor router Since this is an SSL connection some web browsers will display warning messages With Microsoft Internet Explorer you may get the following warning message Please press Continue to this website not recommended E bttps 192 168 11 cgi bin user_login cgitfid 101 amp src_ip X Uy F
360. ies it is easy to build VPN between these two devices I 2 Access into the web user interface of Vigor2860 series Open Central VPN Management gt gt CPE Management CVM gt gt VPN Management VPN Management Kate_local Kate_local 192 168 50 12 192 168 30 13 a CPE VPN Connection List Virtual Tx Tx Rw Ry Up Network Pkts Rate Bos Pkts Rate Bos Time Type Remote IP Click the device icon marked with a and click the PPTP IPsec button Wait for a moment If VPN is built successfully related information will be displayed on CPE VPN Connection List CYM gt VPN Management VPN Management Kate_local Kate local 1952 168 30 12 192 168 30 13 CPE VPN Connection List Virtual Tx TH Rx Rx Up Network Pkts Rate Bos Pkts Rate Bos Time VPN Type Remote IP 1 192 168 3012 as ae ee PPTP MPPE 192 168 50 1 24 805 3 1088 3 0 40 30 evm_ TD93D00 f via WAN f Vigor2860 Series User s Guide 502 Dr ay Te k 5 ALAN to LAN profile for such VPN will be generated automatically You can access into VPN and Remote Access gt gt LAN to LAN of the remote device for viewing the detailed information VPN and Remote Access gt gt LANto LAN LAN to LAWN Profiles View Al Trunk Index Name Active Status Index Name Active Status ne cym_7D9D00 online 17 77 F a Profile Index 1 1 Common Settings Profile Name evm_ DSD00 Call Direction Both Dial Out Dial in Enable
361. ife will use lots of fragmented UDP packets to transfer game data Instinctively as a secure firewall Vigor router will reject these fragmented packets to prevent attack unless you enable Accept large incoming fragmented UDP or ICMP Packets By checking this box you can play these kinds of on line games If security concern is in higher priority you cannot enable Accept large incoming fragmented UDP or ICMP Packets les DrayTek Enable Strict Security Firewall Accept routing packet from WAN Default Rule Page For the sake of security the router will execute strict security checking for data transmission Such feature is enabled in default All the packets while transmitting through Vigor router will be filtered by firewall If the firewall system e g content filter server does not make any response pass or block for these packets then the router s firewall will block the packets directly Usually IPv6 network sessions traffic from WAN to LAN will be blocked by IPv6 firewall to prevent remote client accessing into the PCs on LAN in default IP v6 Check the box to make the packets routed from WAN to LAN via IPv6 being accepted by such router It is effective only for the packets routed but not for packets translated by NAT IPv4 Check the box to make the incoming packets via IPv4 being accepted by such router It is effective only for the packets routed but not for packets translated by NAT S
362. ify Schedule Type the name of the one who will receive the SMS Use the drop down list to choose a message profile The recipient will get the content stated in the message profile You can click the Notify Profile link to define the content of the SMS Type the schedule number that the SMS will be sent out You can click the Schedule 1 15 link to define the schedule After finishing all the settings here please click OK to save the configuration Mail Server This page allows you to specify Mail Server profile who will get the notification e mail what the content is and when the message will be sent Application gt gt SMS Mail Alert Service SMS Provider Seeneeeeene Mail Server Setto Factory Default Recipient Notify Profile schedule 1 15 IL Available settings are explained as follows Item Index Mail Service Recipient Notify Vigor2860 Series User s Guide Description Check the box to enable such profile Use the drop down list to choose mail service provider You can click Mail Service link to define the mail server Type the e mail address of the one who will receive the notification message Use the drop down list to choose a message profile The recipient will get the content stated in the message profile You can click the Notify Profile link to define the content of the mail message 26 Dray Tek Schedule Type the schedule number that the notification will be sent
363. igor2860 series will perform for the managed CPE Message Display the information for each event The Alert page offers brief information to identify the CPE connected to Vigor2860 series Dray Te k 315 Vigor2860 Series User s Guide 3 14 Central AP Management Vigor2860 can manage the access points supporting AP management via Central AP Management 3 14 1 Status This page displays current status online offline or SSID hidden IP address encryption channel version password and etc of the access points managed by Vigor router Please open Central AP Management gt gt Function Support List to check what AP Models are supported Central AP Management gt gt Status Clear Refresh APE1O_ 007620482810 10 28 60 11 x gt ShA APa00 _00507F223343 10 28 60 12 Note Online SS Red Offi ero J Green Online N Red Offline Grey Hidden SSID Maximum support 20 AFS When AF Devices connect via another intermediate router or switch please check unblock the following ports UDP 67 68 4944 and TCP 80 of the router switch thus AP status can be retrieved Available settings are explained as follows Item Description Index Click the index number link for viewing the settings summary of the access point Device Name The name of the AP managed by Vigor router will be displayed here IP Address Display the true IP address of the access point SSID Display the SSID configured for the access point s c
364. ill carry significant information such as security TCC closed user group parameters a series of Internet addresses routing messages etc An eavesdropper outside might learn the details of your private networks Check the box to enforce the Vigor router to defense the Land attacks The Land attack combines the SYN attack technology with IP spoofing A Land attack occurs when an attacker sends spoofed SYN packets with the identical source and destination addresses as well as the port number to victims Check the box to activate the Block Smurf function The Vigor router will ignore any broadcasting ICMP echo request Check the box to enforce the Vigor router not to forward any trace route packets Check the box to activate the Block SYN fragment function The Vigor router will drop any packets having SYN flag and more fragment bit set Check the box to activate the Block fraggle Attack function Any broadcast UDP packets received from the Internet is blocked 182 DrayTek Block TCP flag scan Block Tear Drop Block Ping of Death Block ICMP Fragment Block Unassigned Numbers Warning Messages Dray Tek Activating the DoS DDoS defense functionality might block some legal packets For example when you activate the fraggle attack defense all broadcast UDP packets coming from the Internet are blocked Therefore the RIP packets from the Internet might be dropped Check the box to activate the Block TCP flag scan f
365. ime 2013 Aug 2 Fri 5 35 21 Time Setup Use Browser Time Use Internet Time Time Server pool_ntp_org Priority Auto Time Zone GMT Greenwich Mean Time Dublin Enable Daylight Saving F Automatically Update Interval 30 min Available settings are explained as follows Item Description Current System Time Click Inquire Time to get the current time Use Browser Time Select this option to use the browser time from the remote administrator PC host as router s system time Use Internet Time Select to inquire time information from Time Server on the Internet using assigned protocol Time Server Type the web site of the time server Priority Choose Auto or IPv6 First as the priority IPv6 First Time Zone Select the time zone where the router is located Enable Daylight Saving Check the box to enable the daylight saving Such feature is available for certain area Automatically Update Select a time interval for updating from the NTP server Interval Click OK to save these settings Vigor2860 Series User s Guide 410 Dr ay Tek 3 19 9 SNMP This page allows you to configure settings for SNMP and SNMPV3 services The SNMPv3 is more secure than SNMP through the encryption method support AES and DES and authentication method support MD5 and SHA for the management needs Applications gt gt SNMP SNMP Setup Get Community Set Community Manager Host IP IPW4 Manager Host IP IPV6 Trap Comm
366. in this area Such mail server will be used as backup mail exchange If a Vigor router is installed behind any NAT router you can enable such function to locate the real WAN IP When the WAN IP used by Vigor router is private IP this function can detect the public IP used by the NAT router and use the detected IP address for DDNS update There are two methods offered for you to choose Internet IP WAN IP WAN IP If it is selected and the WAN IP of Vigor router is private DDNS update will take place right away Internet IP If it is selected and the WAN IP of Vigor router is private it will be converted to public IP before DDNS update takes place 4 Click OK button to activate the settings You will see your setting has been saved Disable the Function and Clear all Dynamic DNS Accounts Vigor2860 Series User s Guide ss DrayTek In the DDNS setup menu uncheck Enable Dynamic DNS Setup and push Clear All button to disable the function and clear all accounts from the router Delete a Dynamic DNS Account In the DDNS setup menu click the Index number you want to delete and then push Clear All button to delete the account 3 10 2 LAN DNS LAN DNS is a simple version of DNS server It is not necessary for the user to build another DNS server in LAN With such feature the user can configure some services such as ftp www or database with domain name which is easy to be accessed Applications LAN DNS Pr
367. india Vernon 50 2 RECOMMENDED CODE AGE Se ANSDOGH Tredisenal Shanes Bagh Dia G Pap Des SC Len Dd Mae Ty eh ea Oe Oe Oe 7 013 ove CoMepages mH 2013 aD A Sal 2013 ath Window size It determines the size of TCP protocol O 65535 The more the value is the better the performance will be However if the network is not stable small value will be proper Session timeout Setting timeout for sessions can make the best utilization of network resources After finishing all the settings here please click OK to save the configuration Vigor2860 Series User s Guide 172 Dr ay Te k 3 5 3 Filter Setup Click Firewall and click Filter Setup to open the setup page Firewall gt gt Filter Setup Filter Setup Setto Factory Default Set Comments Set Comments Default Call Filter i 2 Default Data Filter Oo 3 J 4 10 J 11 6 12 To edit or add a filter click on the set number to edit the individual set The following page will be shown Each filter set contains up to 7 rules Click on the rule number button to edit each rule Check Active to enable the rule Firewall gt gt Filter Setup gt Edit Filter Set Filter Set 1 Comments Default Call Filter Filter Rule Active Comments Move Up Move Down Block NetBios Down O UP Down O UP Down O UP Down O UP Down O UP Down E E Next Filter Set Available settings are explained as follows Item Description Filter Rule
368. ine specified VPN Tunnel for having effective bandwidth management gt Dial out connection types contain IPsec PPTP L2TP L2TP over IPsec and GRE over IPsec gt The web page is simple to understand and easy to configure gt The TCP Session transmitted by using VPN TRUNK VPN Load Balance mechanism will not be lost due to one of VPN Tunnels disconnected Users do not need to reconnect with setting TCP UDP Service Port again The VPN Load Balance function can keep the transmission for internal data on tunnel stably Vigor2860 Series User s Guide 288 Dr ay Tek VPN and Remote Access gt gt VPN TRUNK Management mT Backup Profile List Set to Factory Default Note Active NO The LAN to LAN Profile is disabled or under Dial In Call Direction at present No Status Name Member Active Type Member Active Type Load Balance Profile List Set to Factory Default Note Active NO The LAN to LAN Profile is disabled or under Dial In Call Direction at present No Status Name Member Active Type Member Active Type General Setup Status Enable Disable Profile Name E Memberi select a LAN to LAN Dial Out profile Member select a LAN to LAN Dial Out profile Active Mode Backup Load Balance Available settings are explained as follows Item Description Backup Profile List Set to Factory Default Click to clear all VPN TRUNK VPN Backup mechanism profile No The order of VPN TRUNK
369. ing to the ACS Auto Configuration Server you want to link Please refer to Auto Configuration Server user s manual for detailed information CPE Client Such information is useful for Auto Configuration Server Enable Disable Allow Deny the CPE Client to connect with Auto Configuration Server Port Sometimes port conflict might be occurred To solve such problem you might change port number for CPE Periodic Inform Settings The default setting is Enable Please set interval time or schedule time for the router to send notification to CPE Or 397 Vigor2860 Series User s Guide click Disable to close the mechanism of notification STUN Settings The default is Disable If you click Enable please type the relational settings listed below Server IP Type the IP address of the STUN server Server Port Type the port number of the STUN server Minimum Keep Alive Period If STUN is enabled the CPE must send binding request to the server for the purpose of maintaining the binding in the Gateway Please type a number as the minimum period The default setting is 60 seconds Maximum Keep Alive Period If STUN is enabled the CPE must send binding request to the server for the purpose of maintaining the binding in the Gateway Please type a number as the maximum period A value of 1 indicates that no maximum period is specified Vigor2860 Series User s Guide 398 Dr ay Te k 3 19 3 Administr
370. ings ATM QoS YPI Qos Type ZI PCR Protocol SCR Encapsulation MBS V Add VLAN Header VLAN Tag Priority Open Port based Bridge Connection for this Channel Physical Members Pi Ore Ole3 Clea Ops OPG Open WAN Interface for this Channel WAN Application WAN Connection Detection Mode ARP Detect Fing IF PPPoE PPPoA Client MPoA RFC1483 2684 ISP Access Setup Obtain an IP address automatically Username Domain Mame a Password Required for some ISPs PPP Authentication PAP or CHAP Specify an IP address IP Address M Always On Idle Timeout second s Subnet Mask IP Address From ISP Gateway IP Address Fixed IP Yes No Dynamic IF DNS Server IP Address Fixed IP Address fs Primary IP Address 6 8 8 6 Secondary IP Address 0 0 4 4 Available settings are explained as follows Item Description Multi VLAN Channel Enable Click it to enable the configuration of this 5 6 7 channel Disable Click it to disable the configuration of this channel WAN Type The connections and interfaces created in every channel may select a specific WAN type to be built upon In the Multi PVCs application only the Ethernet WAN type is available The user will be able to select the physical WAN interface the channel shall use here Dr ay Tek 117 Vigor2860 Series User s Guide General Settings ATM OoS Open Port based Bridge Connection for this Channel Open WAN Interface for this Channel Vigor2860
371. ion gt USB Device Status Disk Modem Printer Refresh USB Mass Storage Device Status Connection Status No Disk Connected Disk Capacity 0 MB Free Capacity OMB Refresh USB Disk Users Connected Index Service IP Address Port Username Note If the write protect switch of USB disk is turned on the USB disk is in READ ONLY mode No data can be written to it Available settings are explained as follows Item Description Connection Status If there is no USB storage disk connected to Vigor router No Disk Connected will be shown here Disk Capacity It displays the total capacity of the USB storage disk Free Capacity It displays the free space of the USB storage disk Click Refresh at any time to get new status for free capacity Index It displays the number of the client which connecting to FTP server IP Address It displays the IP address of the user s host which connecting to the FTP server Username It displays the username that user uses to login to the FTP server When you insert USB storage disk into the Vigor router the system will start to find out such device within several seconds Vigor2860 Series User s Guide 390 Dr ay Te k USB Application gt USE Device Status Disk Modem Printer Refresh USB Mass Storage Device Status Connection Status Disk Connected Disconnect USB Disk Wirite Protect Status No Disk Capacity 2009 MB Free Capacity 925 MB Refresh USB Disk Users Connected Index
372. ion entitles you to upgrade firmware for your purchased product and receive news about upcoming products and services Usertlame james fae Auth Code t xxhdd If you cannot read the word click here Forgotten password Dont have a MyViger Account 7 Create an account now lf you are having difficulty logging in contact aur customer service Customer Senmice 88613 597 2727 or Dr ay Tek 69 Vigor2860 Series User s Guide 4 The following page will be displayed after you logging in MyVigor From this page please click Add or Product Registration Dray Tek D About Us Welcome james_fae Product Last Login Time 2011 08 24 09 39 13 Last Login From 123 110 144 220 O My Information Current Login Time 2011 08 24 23 01 15 Current Login From 114 37 142 164 i VigorAcs SI an RowNo 5 w PageNo mpe e Vigor Series Your Device List Q Management serial Number D N Product Host ID evice Name Prepa 104001703857 Vigor2710 Vigor2710 Customer Survey 200807100001 VigorPro5300 VigorPro5300 200911030001 ryan YigorPro5300 5 When the following page appears please type in Nickname for the router and choose the right registration date from the popup calendar it appears when you click on the box of Registration Date After adding the basic information for the router please click Submit Dray Tek 4 My Vigo gor D About Us My Product Search for this site co
373. ion is composed by an option number with data For example Option number 100 Data abcd When such function is enabled the specified values for DHCP option will be seen in DHCP reply packets Interface Specify the WAN interface s that will be overwritten by such function WANS WAN7 can be located under WAN gt gt Multi PVCs Option Number Type a number for such function Note If you choose to configure option 61 here the 83 Vigor2860 Series User s Guide detailed settings in WAN gt gt Interface Access will be overwritten DataType Choose the type ASCII or Hex for the data to be stored Data Type the content of the data to be processed by the function of DHCP option Details Page for PPPoE in WAN1 Physical Mode VDSL2 To choose PPPoE as the accessing protocol of the Internet please select PPPoE from the WAN gt gt Internet Access gt gt WANI1 page The following web page will be shown WAN gt Internet Access WAN 1 PPPoE PPPoA MPoA Static or Dynamic IP IPvo Enable Disable ISP Access Setup Service Name Optional O O ARN Settings for ADSL only izenare D i Multi PC channel Channel 1 Wt WPI o ClSeparate Account for ADSL vCl E ainut a PPP Authentication PAP or CHAF Idle Timeout seconds Protocol PPPoE IP Address From ISP WAN IP Alias Modulation Multimode v Fixed IP ves No Dynamic IP PPPoE Pass through Fixed IP Address C For Wired
374. ions when schedule OM Direction source IP Destination IP Service Type Fragments Application Filter Branch to other Filter Set Vigor2860 Series User s Guide I co C Enable LANIRTVPN WAN y 92 168 1 10 192 168 1 20 carini Acti on Profile Pass Immediately ww C a Dray Tek Both filter rules have been created Click OK Firewall gt gt Fitter Setup gt gt Edit Filter Set Filter Set 2 Comments Default Data Filter Fitter Rule Comments Move Up Move Down MetBios gt ONS Down block all Down open_ip Down Down Down Down L4J Le Next Filter Set 9 Now all the settings are configured well Only the computers with the IP addresses within 192 168 1 10 192 168 1 20 can access to Internet Dr ay Tek 489 Vigor2860 Series User s Guide 4 12 How to Block Facebook Service Accessed by the Users via Web Content Filter URL Content Filter There are two ways to block the facebook service Web Content Filter and URL Content Filter Web Content Filter Benefits Easily and quickly implement the category website that you want to block Note License is required URL Content Filter Benefits Free flexible for customize webpage Note Manual setting e g one keyword for one website I Via Web Content Filter 1 Make sure the Web Content Filter powered by Commtouch license is valid DrayTek Vigor 2860 Series ew ie amp gt Off v IR CSM
375. iption Check this box to enable this policy Use the drop down menu to choose a proper protocol for the WAN interface Any Any IP can be treated as the source IP Src IP Start Type the source IP start for the specified WAN interface Src IP End Type the source IP end for the specified WAN interface If this field is blank it means that all the source IPs inside the LAN will be passed through the WAN interface 151 Vigor2860 Series User s Guide Destination IP Any Any IP can be treated as the destination IP Dest IP Start Type the destination IP start for the specified WAN interface Dest IP End Type the destination IP end for the specified WAN interface If this field is blank it means that all the destination IPs will be passed through the WAN interface Destination Port Any Any port number can be treated as the destination port Dest Port Start Type the destination port start for the destination IP Dest Port End Type the destination port end for the destination IP If this field is blank it means that all the destination ports will be passed through the WAN interface Send to if criteria Interface Use the drop down list to choose a WAN or matched LAN interface or VPN profile Packets match with the above criteria will be transferred to the interface chosen here Gateway IP Specific gateway is used only when you want to forward the packets to the desired gateway Usually Defau
376. ireless 5GHz Settings Enable Disable Click it to enable or disable settings in this page Dr ay Tek 65 Vigor2860 Series User s Guide Use the same SSID Check the box to use the same settings configured above and Security Key as above SSID Type the SSID name of this router SSID2 Security Key The wireless mode offered by this wizard is WPA2 PSK The WPA encrypts each frame transmitted from the radio using the key which either PSK Pre Shared Key entered manually in this field below or automatically negotiated via 802 1x authentication Either 8 63 ASCII characters such as 012345678 or 64 Hexadecimal digits leading by Ox such as 0x321253abcde Rate Control It controls the data transmission rate through wireless connection Upload Check Enable and type the transmitting rate for data upload Default value is 30 000 kbps Download Type the transmitting rate for data download Default value is 30 000 kbps Next Click it to get into the next setting page Cancel Exit the wireless wizard without saving any changes 4 After typing the required information click Next 5 The following page will display the configuration summary for wireless setting Wireless Wizard Configuration Summary Wireless 2 4GHz Settings Wireless 5GHz Settings Mode Mised iig iini Mode Mixed 11a iin Channel Channel 8 2447MHz Channel Channel 60 S300MHz Host AFP Host AP SSID Name 2860 marketing SSID Name
377. ireless LAN 2 4 GHz Wireless LAN 5 GHz SSL VPN USB Application System Maintenance Diagnostics External Devices Now the Main Screen will appear Vigor 2860 Series Dashboard E m T ry T o Vigor2860n pl bd ww he rake sunt coe mead ais e _ ile clo aaa gt DL DoS m 2 3 A s 6 VDSUADSL WAN2Giga GigaLAN gt 1 System Information 0 56 37 Router Name CrrentTime 2014 Apr 1 Tue 6 32 3 Mar 20 2014 14 09 50 00 1D A4 B6 1B B8 IPv4 Internet Access fkine Mode IP Address MAC Address UpTime WAN1 VDSL2 DHCP Client _ 192 168 100 202 00 10 AA B6 1B8 B9 0 55 55 WAN2 Ethernet StaticIP__ 172 16 3 133 00 1D AA B6 1B BA 0 56 27 WANS uUsB PPP Disconnected 00 1D AA B6 1B BB_ 00 00 00 __ WANG USB Disconnected 00 1D AA B6 1B BC_ 00 00 00 Interface Connected Down Stream 81032Kbps Up Stream 49536Kbps WAN Connected 2 WANT WAN WANS WAN4 Quick Acc Dynamic DNS TR 069 2P Bloc Lo P R User Management IMP k Schedule SysLog Mail Alert LDAP o RADIUS Firewall Object Setting Data Flow Monitor LAN Connected 4 LAN1 LAN2 LANS LAN4 LANS LANG WLAN Connected 2 Product Registration i WLANSG Connected 0 All Riahts Reserved ea een T A Note The home page will be different slightly in accordance with the type of the router you have 5 The web page can be logged out acc
378. is required for bridging customer premises equipment CPE Point to Point Protocol over Ethernet PPPoE connects a network of hosts via an access device to a remote access concentrator or aggregation concentrator This implementation provides users with significant ease of use Meanwhile it provides access control billing and type of service according to user requirement When a router begins to connect to your ISP a serial of discovery process will occur to ask for a connection Then a session will be created Your user ID and password is authenticated via PAP or CHAP with RADIUS authentication system And your IP address DNS server and other related information will usually be assigned by your ISP Network Connection by 3G 4G USB Modem For 3G 4G mobile communication through Access Point is popular more and more Vigor2860 adds the function of 3G network connection for such purpose By connecting 3G USB Modem to the USB port of Vigor2860 it can support HSDPA UMTS EDGE GPRS GSM and the future 3G standard HSUPA etc Vigor2860n with 3G 4G USB Modem allows you to receive 3G signals at any place such as your car or certain location holding outdoor activity and share the bandwidth for using by more people Users can use four LAN ports on the router to access Internet Also they can access Internet via 802 11n wireless function of Vigor2860n and enjoy the powerful firewall bandwidth management VPN features of Vigor2860n series AN ows A
379. is waiting for your Dray Te k 347 Vigor2860 Series User s Guide response Click hook flash to pick up the waiting phone call Call Transfer Check this box to invoke this function Click hook flash to initiate another phone call When the phone call connection succeeds hang up the phone The other two sides can communicate then Default SIP Account You can set SIP accounts up to six groups on SIP Account page Use the drop down list to choose one of the profile names for the accounts as the default one for this phone setting Play dial tone only when account registered Check this box to invoke the function In addition you can press the Advanced button to configure tone settings volume gain MISC and DTMF mode Advanced setting is provided for fitting the telecommunication custom for the local area of the router installed Wrong tone settings might cause inconvenience for users To set the sound pattern of the phone set simply choose a proper region to let the system find out the preset tone settings and caller ID type automatically Or you can adjust tone settings manually if you choose User Defined TOn1 TOff1 TOn2 and TOff2 mean the cadence of the tone pattern TOn1 and TOn2 represent sound on TOff1 and TOff2 represent the sound off VoIP gt gt Phone Settings Advance Settings gt gt Phone 1 Tone Settings Region User Defined Caller ID Type FS5K_ETSI Lov High Toni T off 1 Ton T off 2 Freq Hz Freq
380. ive in Germany to try the BPjM WCF service This is a free service without guarantee Activation Date Web Content Filter Commtouch License Agreement Commtouch is the web content filter based on Commtouch operated in the worldwide There is a 30 day trial period After trial you can purchase DrayTek s prepared Commtouch GlobalView WCF package from retailing outlets Activation Date 13 02 18 Web Content Filter fragFINN License Activation Agreement Date I have read and accept the above Agreement Please check this box Note The activation date is brought out by the server automatically and cannot be changed Commtouch is the web content filter based on Commtouch operated in the worldwide There is a 30 day trial period After trial you can purchase DrayTek s prepared Commtouch GlobalView WCF package from retailing outlets BPjM is WCF for German Speaking users The fragfINN is whitelist for German Speaking users The BPjM is ideal for your family to provide more Internet security for youngsters The fragFINN is designed for protecting kids from inadequate web sites More info is available at http www draytek de jugendschutz 4 Setting confirmation page will be displayed as follows please click Next Service Activation Wizard Please confirm your settings Sevice Type Trial version Sevice Activated Web Content Filter Commtouch Please click Back to re select service ty
381. ivicnadeatiaedauglindabe 268 3 11 1 Remote Access Control ccccccccccccceeceeeeeseceeeeessaeesseeeeeeesseseeesesecesssseeaseeeeeeeesssaaeaeses 268 2112 PPP General SQUID ici ceseneniied nore sehscectstensadetseeeee auubepsesdeaneebesswexsacoieeestadedeeesteene nodes 269 3 11 3 IPsec General SQtup c cc cceecceecceccceeesseeceeeesseaeeesseeeeeesseesseeeeeessseeeaeeeeeeeesesaaaeeeees 270 3 11 4 IPsec Peer IGe ntity cc ccccccccssseeeceesececsesseeeceeseeessaeeeceeueeecseseeessgeeessagseessaneesssasees 272 3 11 5 Remote Dial in User cc ceccccssscccceeseeeccesceeceaneeeceeuseeceeaeeecsausecseaseeessaseeessegseesseass 274 lt a Di eo ig TO CAN Renee ene ne ee eee ee eee eee 277 3 11 7 VPN TRUNK Management cccccssseccccssceeceseeeceeseeeceaseeesseseeeeeseessseeesseseeesseaes 288 3 11 8 CONNECTION Management cceecccccccccceeeeeeeceeeccaeesseeeeeeeeeeaeesseeeeeeeesssaaseeeeeeesssaeageses 297 3 12 Certificate MAnageMent ccccccecccceeeceseeeeeeceeeeeseeseeeeeeeeeseeaseeseeeeeeessseeseeeeeeessuaageeeeeeees 298 CAB POCA CFS IE i EA T E ETET E A E TE 298 di2 2 Mustad CA SIMIC ANS snusen a e A A A O Sai 302 soe Ie TMI EBA IID eea E 303 3 13 Central VPN Management cccccccccccssssseecceeseeseeeeeeeeeeeeseeeseeeeeeeessaeaseeeeeessaeaageeseeeees 304 lel ENET Se NUD eE E EE EEE E 304 3 13 2 CPE Management cccccsseseecccceessececceseseeeeccceuscececseaueceesssauseceesssaueeees
382. k TX Packets 147 WAN IPv6 Status Enable EX Packets 167 Moile AICCH TX Bytes 34205 Up Time QO 00 48 2001 4000 FF00 3E4 2 64 Global FE8O 4CO0 FFOO 3E4 2 04 Link TX Packets 186 Vigor2860 Series User s Guide RX Packets 1s 26 RX Bytes 19176 bateway IP RX Bytes 33093 Dray Tek Detailed explanation for IPv4 is shown below Item Description LAN Status Primary DNS Displays the primary DNS server address for WAN interface Secondary DNS Displays the secondary DNS server address for WAN interface IP Address Displays the IP address of the LAN interface TX Packets Displays the total transmitted packets at the LAN interface RX Packets Displays the total received packets at the LAN interface WANI WAN2 WAN3 Enable Yes in red means such interface is available but WAN4 Status not enabled Yes in green means such interface is enabled Line Displays the physical connection VDSL ADSL Ethernet or USB of this interface Name Display the name of the router Mode Displays the type of WAN connection e g PPPoE Up Time Displays the total uptime of the interface IP Displays the IP address of the WAN interface GW IP Displays the IP address of the default gateway TX Packets Displays the total transmitted packets at the WAN interface TX Rate Displays the speed of transmitted octets at the WAN interface RX Packets Displays the total n
383. ked Logout the user will be logged out forcefully 3 7 Objects Settings For IPs in a range and service ports in a limited range usually will be applied in configuring router s settings therefore we can define them with objects and bind them with groups for using conveniently Later we can select that object group that can apply it For example all the IPs in the same department can be defined with an IP object a range of IP address fice Type Object fice Type Group SMail Service Object ification Object 3 7 1 IP Object You can set up to 192 sets of IP Objects with different conditions Objects Setting gt gt IP Object IP Object Profiles Index Name Index L i 2 18 3 13 4 20 J 21 6 22 T 23 5 24 J 23 10 26 11 2i 12 28 14 30 15 31 16 32 Available settings are explained as follows Item Description Set to Factory Default Clear all profiles Vigor2860 Series User s Guide 194 Setto Factory Default Name Tr x ot Dray Tek Index Name Display the profile number that you can configure Display the name of the object profile To set a new profile please do the steps listed below l Click the number e g 1 under Index column for configuration in details 2 The configuration page will be shown as follows Dray Tek Objects Setting gt IP Object Profile Index 1 Name Interface Address Type Mac Addres
384. kets Otherwise the MPPE encryption scheme will be used to encrypt the data otional MPPE w Optional WIPPE Require MPPE 40 128bits Selecting this option will force the router to encrypt packets by using the MPPE encryption algorithm In addition the remote dial in user will use 40 bit to perform encryption prior to using 128 bit for encryption In other words if 128 bit MPPE encryption method is not available then 40 bit encryption scheme will Dr ay Tek 269 Vigor2860 Series User s Guide Mutual Authentication PAP Assigned IP Start LDAP Server Profiles for PPP Authentication 3 11 3 IPsec General Setup be applied to encrypt the data Maximum MPPE This option indicates that the router will use the MPPE encryption scheme with maximum bits 128 bit to encrypt the data The Mutual Authentication function is mainly used to communicate with other routers or clients who need bi directional authentication in order to provide stronger security for example Cisco routers So you should enable this function when your peer router requires mutual authentication You should further specify the User Name and Password of the mutual authentication peer The length of the name password is limited to 23 19 characters Enter a start IP address for the dial in PPP connection You should choose an IP address from the local private network For example if the local private network is 192 168 1 0 255 255 255 0 you could
385. l Dr ay Tek 167 Vigor2860 Series User s Guide 3 5 2 General Setup General Setup allows you to adjust settings of IP Filter and common options Here you can enable or disable the Call Filter or Data Filter Under some circumstance your filter set can be linked to work in a serial manner So here you assign the Start Filter Set only Also you can configure the Log Flag settings Apply IP filter to VPN incoming packets and Accept incoming fragmented UDP packets Click Firewall and click General Setup to open the general setup page General Setup Page Such page allows you to enable disable Call Filter and Data Filter determine general rule for filtering the incoming and outgoing data Firewall gt gt General Setup General Setup General Setup Default Rule Call Filter Data Filter Enable Start Filter Set Disable Enable Start Filter Set Disable Accept large incoming fragmented UDP or ICMP packets t for some games ex CS Enable Strict Security Firewall Accept routing packet from WAN LJ pwe O pve Available settings are explained as follows Item Call Filter Data Filter Accept large incoming Vigor2860 Series User s Guide Description Check Enable to activate the Call Filter function Assign a start filter set for the Call Filter Check Enable to activate the Data Filter function Assign a start filter set for the Data Filter Some on line games for example Half L
386. l or SSL Web Proxy is disabled in the VPN profile a User Management account and a remote dial in VPN profile can use the same Username even with different passwords However we recommend you to use different usernames for different user profiles in User Management and VPN profiles Vigor2860 Series User s Guide 514 Dr ay Tek Authentication via Telnet The LAN clients can also authenticate their accounts via telnet L Dray Tek Telnet to the router s LAN IP address and input the account name for the authentication Telnet 192 16811 10 x Account user la e E Type the password for authentication and press Enter The message User login successful will be displayed with the expired time if configured Account uger Ya aanmord EEEE Jger login successful expired time ig Unlimited Note Here expired time is Unlimited means the Time Quota function is not enabled for this account After login this account will not be expired until it is logout In the Web interface of router the configuration page of Time Quota is shown as below User Management gt gt User Profile Profile Index 3 Enable this account User Name Password Confirm Password Idle Timeout mints O Unlimited Max User Login O Unlimited Policy Default The selection of items could be created as rules and which not set to active External Server Authentication Pop Browser Tracking Window A
387. lack list Pass allow accessing into the corresponding webpage with the characters listed on Group Object Selections If the web pages do not match with the specified feature set here they will be processed with the categories listed on the box below Block restrict accessing into the corresponding webpage with the characters listed on Group Object Selections If the web pages do not match with the specified feature set here they will be processed with the categories listed on the box below Action Pass allow accessing into the corresponding webpage with the categories listed on the box below Block restrict accessing into the corresponding webpage with the categories listed on the box below If the web pages do not match with the specified feature set here it will be processed with reverse action Log None There is no log file will be recorded for this profile Pass Only the log about Pass will be recorded in Syslog Block Only the log about Block will be recorded in Syslog All All the actions Pass and Block will be recorded in Syslog After finishing all the settings please click OK to save the configuration Vigor2860 Series User s Guide 230 Dr ay Tek 3 8 4 DNS Filter The DNS Filter monitors DNS queries on UDP port 53 and will pass the DNS query information to the WCF to help with categorizing HTTPS URL s Note For DNS filter must use the WCF service profile to filter the packets therefo
388. lated to DoS Defense will be sent to user and user can review it through Syslog daemon Look for the keyword DoS in the message followed by a name to indicate what kind of attacks is detected 183 Vigor2860 Series User s Guide System Maintenance gt gt SysLog Mail Alert Setup SysLog Mail Alert Setup SysLog Access Setup Mail Alert Setup Enable enable Syslog Save to SMTP Server Sysl S Bisys T SMTP Port 25 CI USB Disk Mail To Router Name Return Path O Authentication Server IP Address Destination Port 514 Mail Syslog C Enable POET T Enable syslog message Password Firewall Log Enable E Mail Alert User Access Log DoS Attack WAN Log IM P2P Router DSL information VPN LOG AlertLog Setup C Enable AlertLog Port 514 Note 1 Mail Syslog cannot be activated unless USB Disk is ticked for Syslog Save to 2 Mail Syslog feature sends a Syslog file when its size reaches 1M Bytes E x IF DrayTek Slog 45 3 Dray Tek Syslog Utility SALAD Tid ETTE TED 4 tl 1 172 148 3 1 wt Be we BBE EVF la 1 Bie m ann LAN InFermatnn iai m o Te Paias AX Parkers Wan E Gabewarp IP Aly bo i Pfam Lee iif a SS Fremad yp Uber decess Connection WN BPE hers 2 Stare dog Lod Show Defame Aled TOPU Br Piter Log CSM Lug Deileree Lg C Pec Dyt Time 5 Router Tine Gee Message BUA Liu au RUS
389. le Map i f A 1 x ue Af be fet yF Y rT 7 T r pe oy i ir 1 Vigor2860 Series User s Guide 312 Dr ay Ie k 3 13 3 VPN Management An easy and quick method is offered to configure VPN settings for building VPN connection automatically between Vigor2860 series treated as VPN server and other Vigor router treated as CPE device 1 e VPN client Page without CPE connected CVM gt VPN Management VPN Management CPE VPN Connection List TX Tx Rate RX Rx Rate Lp Remote IP Virtual Network Pkts Bps Diets Bps Time Page with CPE connected CYM gt gt VPN Management VPN Management AO ye De Display Screen Kate_local Kate_local 192 168 30 12 192 168 30 13 CPE VPN Connection List Virtual Tx Tx Riz Ri Up Remote IP Network Pkts Rate Bos Pkts Rate Bps Time Available parameters are listed as follows Item Description VPN Management Display Screen Once the device is managed controlled by Vigor2860 series it will be displayed on such screen automatically If not refer to sections 4 15 How to manage the CPE router through Vigor2860 for more detailed information PPTP To build a quick VPN connection with PPTP simply click the managed CPE displayed on the Display Screen first and then click such button If the connection is built successfully related information will be displayed on CPE VPN Connection List CPE VPN Connection List Virtual Tx Tx Rx Rx Up
390. less connection Restore the default settings Usage Turn on the router ACT LED is blinking Press the hole and keep for more than 5 seconds When you see the ACT LED begins to blink rapidly than usual release the button Then the router will restart with the factory default configuration Connecter for a USB device for 3G USB Modem or printer Connecter for accessing the Internet Connecter for local network devices or modem for accessing Internet Connecters for local network devices Connecter for analog phone s Connector for PSTN life line Connecter for a power adapter 10 Dray Tek 1 3 Hardware Installation Before starting to configure the router you have to connect your devices correctly 1 Connect the DSL interface to the land line jack with a DSL line cable 2 Connect the cable Modem DSL Modem Media Converter to the WAN port of router with Ethernet cable RJ 45 3 Connect one end of an Ethernet cable RJ 45 to one of the LAN ports of the router and the other end of the cable RJ 45 into the Ethernet port on your computer 4 Connect one end of the power adapter to the router s power port on the rear panel and the other side into a wall outlet Power on the device by pressing down the power switch on the rear panel 6 The system starts to initiate After completing the system test the ACT LED will light up and start blinking For the hardware connection we take n model as an example
391. lete Available settings are explained as follows Item Description Managed Devices List This area displays device icons up to 8 for the CPE managed by Vigor2860 series Edit To modify the name and location of specific CPE click the one you want and click the Edit button A pop up window will appear Simply change the name and or location manually Dray Te k 307 Vigor2860 Series User s Guide Unmanaged Devices List Vigor2860 Series User s Guide Device Information Mozilla Firefox D 192 168 1140 fepelnfo htn System Maintenance gt gt Edit Device Information Model Name Device Name Name Manufacturer OUI Product Class Mac Addres Location IP Port URI Description Hardware Version Software Version Modem Firmware Version Vigor2850 00507F D3D00 Kate_local_ 2850 DrayTek 00507F Vigor 00507F709D00 No 26 Fu Road HS Ci 192 168 30 12 8069 fowm CRN htm DrayTek Vigor Router 104 3 6 3 211801_4 Annex_A Delete To disconnect the management of any CPE click the CPE icon you want and click the Delete button Note Double clicking the CPE icon also can pop up the Managed Device Detail window However you cannot modify any data on the window D Device Information Google Chrome 172 16 3 5 3000 doc cpelInfo htm System Maintenance gt gt Managed Device Detail Model Name Device Name Name Manufacturer OUI Product Class Mac Address Location IP Port
392. lgYDVOGKEwdEcmF SdG6Vr MouwlgyDVYOOLEwiHs 10X CZAIJBQGNVEAMNTAKRUMS IwlaYdKod ThyvcNaGkBFPhnzdkbubs JOGGRyYE1LOeZWsur2 ot MIGTMA0GCS gGs Ibs DORR AGUALAGNADCBICRBgGoChobgdDLIFEUwooucgHYPuqila Ra uaSChd 4 hmwJ VohmkeFRYRUZSPTulltayyPEH61M2 cHDLRUJhOnENAGH luvsen3u k 2rU0MNp2 IF pbnd fom bue2 61011 Evi trv xIgk CMhdpsql0rGcikenssoyr uz THogY Ek 7Gadw6fOIDAgabosawDOYIKos lhycNiOEFBOADGYEABLiNMne zHeRdu EZOT EtPJakhyo2VEooYTYOxdxublrhVadhyT SWqht yai DLAVSIOVIPssTze94Ddcen yOlrbh Zos6lsxcuck TOG IMByYOLubchHHRYRaxi2 RTNOYOICRscyvIMExx 4 pnb IaNeOlwGz 1Z BhlnYkz2F Q8uzZ1IsXxyY J Note You have to copy the certificate request information from above window Next access your CA server and enter the page of certificate request copy the information into Dr ay Tek 301 Vigor2860 Series User s Guide it and submit a request A new certificate will be issued to you by the CA server You can save it Delete Click this button to remove the selected certificate 3 12 2 Trusted CA Certificate Trusted CA certificate lists three sets of trusted CA certificate Cerificate Management gt Trusted CA Certificate X309 Trusted CA Certificate Configuration Name Subject Status Modify Trusted CA 1 nan Trusted CA 2 i io Trusted CA 3 che nee IMPORT REFRESH To import a pre saved trusted CA certificate please click IMPORT to open the following window Use Browse to find out the saved text file Then click Import The one you i
393. live or not through ARP Detect or Ping Detect Mode Choose ARP Detect or Ping Detect for the system to execute for WAN detection Ping IP If you choose Ping Detect as detection mode you have to type IP address in this field for pinging TTL Time to Live Displays value for your reference TTL value is set by telnet command It means Max Transmit Unit for packet The default setting is 1442 90 Dray Tek RIP Protocol Routing Information Protocol is abbreviated as RIP RFC1058 specifying how routers exchange routing tables information Click Enable RIP for activating this function ISP Access Setup Enter your allocated username password and authentication parameters according to the information provided by your ISP Username Type in the username provided by ISP in this field Password Type in the password provided by ISP in this field Separate Account for ADSL In default WAN1 supports VDSL2 ADSL and uses the same PPPoE account and password for connection If required you can configure another account and password for ADSL connection by checking this box If it is checked the system will ask you to type another group of account and password additionally PPP Authentication Select PAP only or PAP or CHAP for PPP Idle Timeout Set the timeout for breaking down the Internet after passing through the time without any action IP Address From ISP Usually ISP dynamically assigns IP address to
394. ll bring out different items that you can choose to disallow people using Dr ay Tek 219 Vigor2860 Series User s Guide Below shows the items which are categorized under Protocol CSM gt APP Enforcement Profile Profile Index 1 Profile Name IM P2P Protocol OTHERS Select All Clear All Support List Action rte CHTTP Lire Llpapa CSME CISNMP LssuTLS LITELMET LI mMySav Postgresae Sybase LJinformis Available settings are explained as follows Item Description Profile Name Type a name for the CSM profile The maximum length of the name you can set is 15 characters Select All Click it to choose all of the items in this page Clear All Uncheck all the selected boxes Support List Display the all the information name version and note about IM P2P Protocol and others applications that Vigor router supports for APPE function Action Block Block all the packets passing with the settings configured in this page Pass Pass all the packets with the settings configured in this page The profiles configured here can be applied in the Firewall gt gt General Setup and Firewall gt gt Filter Setup pages as the standard for the host s to follow Vigor2860 Series User s Guide 220 Dr ay Tek Below shows the items which are categorized under IM CSM gt APP Enforcement Profile Profile Index 1 Profile Name IM P2P Protocol OTHERS Select All Clear All Support List Activity Application Ya
395. ll guide you to fill all the necessary fields VPN and Remote Access gt gt Remote Dial in User Index No 1 User account and Authentication C Enable this account Idle Timeout 300 Allowed Dial In Type PPTP IPsec Tunnel L2TP with IPsec Policy SSL Tunnel L Specify Remote Node Remote Client IP orPeerD i O Netbios Naming Packet Multicast via VPN second s Pass Block O Pass Block TI C Enable Mobile One Time Passwords mOTP Username Password PIN Code Secret IKE Authentication Method Pre Shared Key LJ Digital Signature xX 509 IPsec Security Method Medium AH High ESP DES SDES AES Local ID optional for some IGMP IP Camera DHCP Relay etc Subnet Cl Assign Static IP Address Available settings are explained as follows Item User account and Authentication Allowed Dial In Type Dray Tek Description Enable this account Check the box to enable this function Idle Timeout If the dial in user is idle over the limitation of the timer the router will drop this connection By default the Idle Timeout is set to 300 seconds PPTP Allow the remote dial in user to make a PPTP VPN connection through the Internet You should set the User Name and Password of remote dial in user below IPsec Tunnel Allow the remote dial in user to make an IPsec VPN connection through Internet L2TP with IPsec Policy Allow the remote dial in user to
396. lled by user Management LAN User Group 2 Password lug456 Note Filter rules configured under Firewall usually are applied to the host the one that the router installed only With user management the rules can be applied to every user connected to the router with customized profiles Note If Transparency Mode is selected in Firewall gt gt General Setup User Management cannot be used any more Please uncheck Transparency Mode first if you want to utilize user management to handle users in LAN WAN or WLAN Dr ay Tek 185 Vigor2860 Series User s Guide 3 6 1 General Setup General Setup can determine the standard rule based or user based for the users controlled by User Management The mode standard selected here will influence the contents of the filter rule s applied to every user User Management gt gt General Setup General Setup Mode Rule Based Web Authentication HTTPS Notice 1 User Management will refer to active rules in Data Filter as whitelists and blacklists in user based firewall mode 2 Users match the above lists will not be required for authentication The firewall rules policy will still valid 3 Otherwise authentication required for users not matched the above lists The firewall rules designated in the user profile s policy will still valid Landing Page Max 255 characters Preview Setto Factory Default lt body stats l gt lt script language javascript gt
397. lows you to set new password for user operation system Maintenance gt gt User Password Cl Enable User Mode for simple web configuration User Password Set to Factory Default Note 1 Password can contain only a zA 20 9 lt gt Qs 6 3 2 Password can t be only Example or or js illegal but 123 or 45 is OK Available settings are explained as follows Item Description Enable User Mode for After checking this box you can access into the web user simple web configuration interface with the password typed here for simple web configuration The settings on simple web user interface will be different with full web user interface accessed by using the administrator password Password Type in new password in this field The length of the password is limited to 31 characters Confirm Password Type in the new password again Set to Factory Default Click to return to the factory default setting When you click OK the login window will appear Please use the new password to access into the web user interface again Below shows an example for accessing into User Operation with User Password 1 Open System Maintenance gt gt User Password 2 Check the box of Enable User Mode for simple web configuration to enable user mode operation Type a new password in the field of New Password and click OK System Maintenance gt gt User Password Enable User Mode for simple web configuration User Pas
398. ls 2 3 4 J 6 l 8 9 10 A A P mn r Advanced Block Anonymous Block Unknown Domain Block IP Address Barring Type v Setto Factory Default Barring Number URL URI Route Schedule Status Wizard1 a Wizard 1 Wizard1 H wWizardi x Wizard1 4 Wizard 1 Wizard1 4 Wizard 1 Wizard1 Wizard 1 Next gt gt 335 Vigor2860 Series User s Guide Click any index number to display the dial plan setup page VoIP gt DialPlan Setup Call Barring Index No 1 Enable Call Direction IT ka Barring Type specific URVURL Poute Index 1 15 in Schedule Setup Note Wildcard 7 is supported Available settings are explained as follows Item Description Enable Check it to enable this entry Call Direction Determine the direction for the phone call IN incoming call OUT outgoing call IN amp OUT both incoming and outgoing calls Barring Type Determine the type of the VoIP phone call URI URL or number specitic URIVURL Spe cific URVURL Specific Number Specific URI URL or This field will be changed based on the type you selected Specific Number for barring Type Route All means all the phone calls will be blocked with such mechanism Index 1 15 in Schedule Enter the index of schedule profiles to control the call barring according to the preconfigured schedules Refer to section Applications gt gt Schedule for detaile
399. lt 21 Telnet Server SSH Port Default 22 Cl SSH Server Disable PING from the Internet Access List List IP Subnet Mask 6 Open WAN gt gt Internet Access Use the drop down list of Access Mode on WANI to select MPoA RFC1483 2684 Then click Details Page 7 Click Specify an IP address Type correct WAN IP address subnet mask and gateway IP address for your CPE Then click OK WAN gt Internet Access WAN 1 PPPoE PPPoA MPoA RFC1483 2684 IPvG Enable Disable WAN IP Network Settings WAN IP Alias DSL Modem Settings Obtain an IP address automatically Multi PY C channel Channel 2 we Router Name a 1453 Bridged IP LLC Domain Name VOI Specify an IP address Modulation IP Address 192 168 30 12 Encapsulation Subnet Mask 255 255 0 0 WAN Connection Detection Gateway IP Address 1721634 Ping IP Default MAC Address TTL Specify a MAC Address RIP Protocol mac Address oa 60 ze Hoo po 01 C Enable RIP eaa e aaa a a a a a aS DNS Server IP Address Bridge Mode Primary IP Address Oooo L Enable Bridge Mode Secondary IF Address oOo Vigor2860 Series User s Guide 500 Dray Tek 4 14 3 Check CPE Maintenance Page l 2 4 Dray Tek Note Reboot the CPE device and re log into Vigor2860 series CPE which has registered to Vigor2860 series will be captured and displayed on the pa
400. lt Gateway is selected in default More options Auto Failover To The Other WAN Check this button to lead the data passing through other WAN automatically when the selected WAN interface is down Packet Forwarding to WAN via Choose Force NAT or Force Routing 1 When you finish the configuration please click OK to save and exit this page Load Balance Route Policy Policy Route Set to Factory Default Src Dest ne Dest Dest IP Port Port U End Start Start End TCP WANI Any Any Any Any Any Down any WANI UP Down any WANI UP Down any WANI UP Down any WANI UP Down any WANI UP Down WAMI UP Down WAMI UP Down WAMI UP Down WAMI UP Down lt lt 1 40 11 20 21 30 31 40 41 50 gt gt Next gt gt Move Move Down Interface Src IP Index Enable Protocol Interface Address Start OOOUOOOUOUOOCE 1 2 3 4 2 6 f 8 9 10 Vigor2860 Series User s Guide 152 Dr ay Te k 3 4 NAT Usually the router serves as an NAT Network Address Translation router NAT is a mechanism that one or more private IP addresses can be mapped into a single public one Public IP address is usually assigned by your ISP for which you may get charged Private IP addresses are recognized only among internal hosts When the outgoing packets destined to some public server on the Internet reach the NAT router the router will change its source address into the public IP address of the router select the available public port an
401. lter the web content and URL content to reach a goal of security management APP Enforcement Filter As the popularity of all kinds of instant messenger application arises communication cannot become much easier Nevertheless while some industry may leverage this as a great tool to connect with their customers some industry may take reserve attitude in order to reduce employee misusage during office hour or prevent unknown security leak It is similar situation for corporation towards peer to peer applications since file sharing can be convenient but insecure at the same time To address these needs we provide CSM functionality URL Content Filter To provide an appropriate cyberspace to users Vigor router equips with URL Content Filter not only to limit illegal traffic from to the inappropriate web sites but also prohibit other web feature where malicious code may conceal Once a user type in or click on an URL with objectionable keywords URL keyword blocking facility will decline the HTTP request to that web page thus can limit user s access to the website You may imagine URL Content Filter as a well trained convenience store clerk who won t sell adult magazines to teenagers At office URL Content Filter can also provide a job related only environment hence to increase the employee work efficiency How can URL Content Filter work better than traditional firewall in the field of filtering Because it checks the URL strings or some of HTT
402. m http gogo6 com after applied for the service WAN gt gt Internet Access WAN 2 PPPoE Static or Dynamic IP PPTP L2TP IPvG Internet Access Mode TSPC Configuration Password Confirm Password Tunnel Broker Click OK and open Online Status If the connection is successful the physical connection will be shows as follows Online Status System Uptime 0 2 3 Physical Connection LAN Status IP Address 2001 5c0 1502 D002 ee E TX Packets RX Packets TX Bytes RX Bytes mis 121 15596 10249 WAN IPvG Status Enable i Up Time 0 01 40 Gateway IP 2001 5C0 1400 8 10897125 Global reS E i z Pir TX Packets RX Packets RX Bytes 127 5q 15866 Dr ay Tek 437 Vigor2860 Series User s Guide AICCU Tunnel application Choose AICCU and type the information for AICCU of IPv6 Note While using such mode you have to make sure the IPv4 network connection is normal In the following figure the AICCU information is obtained from https www sixxs net main after applied for the service WAN gt Internet Access WAN 2 PPPoE Static or Dynamic IP PPTPIL2TP Internet Access Mode Connection Type Alccu ka AICCU Configuration O Always On Username Password Confirm Password Tunnel Broker Subnet Prefix 2001 40D0 FF00 8805 2 Note If Always On is not enabled AICCU connection would only retry three times Lox Click OK and open Online Status If the connection i
403. m the traffic monitor of the host s 1 7 4 GUI Map All the functions the router supports are listed with table clearly in this page Users can click the function link to access into the setting page of the function for detailed configuration Click the icon on the top of the main screen to display all the functions GU Map VPH and Remote Dashboard Wizards Online Status WAN LAN Load Balance Route Policy NAT Dray Tek Uick Start Wizard Setite Activation Wizard YEN Client wizard YEN Sener Wizard Wireless Wizard Physical Connection Virtual WWAN General Setup Internet Access Wulti PWE General Setup Static Route WYLAN Bind IF to MAC LAN Fort Mirror Wired 802 1 web Portal Setup Fort Redirection Ohi Host Open Ports Cet Te 23 Access Remote Access Control PPP General Setup IPsec General Setup IPsec Peer Identity Remote Dial in User LAN to LAN YEN TEUNE Management Connection Management Certificate Management Local Certificate Trusted CA Certificate Certificate Backup Central VPN Management General Setup PE Management YEN Management Log amp Alert Central AP Management Status WLAN Profile AP Maintenance Traffic Graph Rogue AP Detection Load Balance Function Support List VWAherolace ARN APU Vigor2860 Series User s Guide 1 7 5 Web Console i ie a o p It is not necessary to use the telnet command via DOS prompt The changes made
404. make a PPTP VPN connection through the Internet You should set the User Name and Password of remote dial in user below IPsec Tunnel Allow the remote dial in user to trigger an IPsec VPN connection through Internet L2TP with IPsec Policy Allow the remote dial in user to make a L2TP VPN connection through the Internet You can select to use L2TP alone or with IPsec Select from below E None Do not apply the IPsec policy Accordingly the VPN connection employed the L2TP without IPsec policy can be viewed as one pure L2TP connection E Nice to Have Apply the IPsec policy first if it is applicable during negotiation Otherwise the dial in VPN connection becomes one pure L2TP Vigor2860 Series User s Guide 284 Dr ay Te k Dray Tek connection E Must Specify the IPsec policy to be definitely applied on the L2TP connection Specify Remote VPN Gateway You can specify the IP address of the remote dial in user or peer ID should be the same with the ID setting in dial in type by checking the box Also you should further specify the corresponding security methods on the right side If you uncheck the checkbox the connection type you select above will apply the authentication methods and security methods in the general settings User Name This field is applicable when you select PPTP or L2TP with or without IPsec policy above The length of the name is limited to 11 characters Password This field is a
405. me Home Folder els l eR Ii e 387 Vigor2860 Series User s Guide Click index number to access into configuration page USB Application gt gt USB User Management Profile Index 1 FTP Samba User Username Password Confirm Password Home Folder OcEnable Disable Pt Maxirum 11 Characters Access Rule File Read LJ write O Delete Directory C ist create Remove Note The folder name can only contain the following characters 4 7 a z 0 9 o _ Ig and space Available settings are explained as follows Item FTP Samba User Username Password Confirm Password Home Folder Vigor2860 Series User s Guide Description Enable Click this button to activate this profile account for FTP service or Samba User service Later the user can use the username specified in this page to login into FTP server Disable Click this button to disable such profile Type the username for FTP Samba users for accessing into FTP server USB storage disk Be aware that users cannot access into USB storage disk in anonymity Later you can open FTP client software and type the username specified here for accessing into USB storage disk The length of the name is limited to 11 characters Note Admin could not be typed here as username for the word is specified for accessing into web pages of Vigor router only Also it is reserved for FTP firmware upgrade usage Note FTP Passive mod
406. me for such SMS profile The maximum length of the name you can set is 31 characters Service Provider Use the drop down list to specify the service provider which offers SMS service Username Type a user name that the sender can use to register to selected SMS provider The maximum length of the name you can set is 31 characters Password Type a password that the sender can use to register to selected SMS provider The maximum length of the password you can set is 31 characters Quota Type the number of the credit that you purchase from the service provider chosen above Note that one credit equals to one SMS text message on the standard route Sending Interval To avoid quota being exhausted soon type time interval for sending the SMS 3 After finishing all the settings here please click OK to save the configuration Object Settings gt SMS Mail Service Object SM5 Provider Mail Server Set to Factory Default Index Profile Name SMS Provider 1 Line _ down kotsms com tw TW Zz kotsms com tw TW a kotsms com tw TW Ps kateme com tar TUR Vigor2860 Series User s Guide 212 Dr ay Te k Customized SMS Service Vigor router offers several SMS service provider to offer the SMS service However if your service provider cannot be found from the service provider list simply use Index 9 and Index 10 to make customized SMS service The profile name for Index 9 and Index 10 are fixed Object Settings gt SMS Mail
407. me of the group profile To set a new profile please do the steps listed below 1 Click the number e g 1 under Index column for configuration in details 2 The configuration page will be shown as follows Objects Setting gt Keyword Group Setup Profile Index 1 Name y Available Keyword Objects Selected Keyword Objects Max 16 Objects 1 Key 1 2 Key 2 OK Clear Cancel Vigor2860 Series User s Guide 208 Dr ay Tek Available settings are explained as follows Item Description Name Type a name for this group Maximum 15 characters are allowed Available Keyword You can gather keyword objects from Keyword Object Objects page within one keyword group All the available Keyword objects that you have created will be shown in this box l K l A wong Click button to add the selected Keyword objects in this box 3 After finishing all the settings please click OK to save the configuration 3 7 9 File Extension Object This page allows you to set eight profiles which will be applied in CSM gt gt URL Content Filter All the files with the extension names specified in these profiles will be processed according to the chosen action Objects Setting gt File Extension Object File Extension Object Profiles Set to Factory Default Profile Name Profile Name ei a Fo m let Available settings are explained as follows Item Description Set to Factory Default Clear all profiles Index Displa
408. mepage About DrayTek Solutions GBIT Click Login If the logging is successful you will be directed into the website of e 7 7 J RJ k3 p i e Zg NIAN STT p MANMEET FAI Abe MyVigor Login Global English Search Ceo a Products Support Solutions Contact Us 2630Vn plus Bremium ADSL2 2 Firewall Router gt More mod 123Es5 ITEXPO East Jan 31 to Feb 3 2012 SMB Productivity Enhancement solution Product Quick Finder Miami FL USA _ Please Select gt gt more P l Dranio D PRY enhitian E kl m aa 469 Vigor2860 Series User s Guide 4 8 How to Send a Notification to Specified Phone Number via SMS Service in WAN Disconnection Follow the steps listed below 1 Log into the web user interface of Vigor router 2 Configure relational objects first Open Object Settings gt gt SMS Mail Server Object to get the following page Object Settings gt SMS Mail Service Object SMS Provider Mail Server Setto Factory Default Index Profile Name SMS Provider kotsms com tw TW kotsms com tw TW kotsms com tw TW kotsms com tw TW kotsms com tw TW kotsms com tw TW kotsms com tw TW kotsms com tw TW Custom 1 k ee iS Frere rrtene Custom 2 Index 1 to Index 8 allows you to choose the built in SMS service provider If the SMS service provider is not on the list you can configure Index 9 and Index 10 to add the new
409. minutes You need to setup WPS within 2 minutes Qos The QoS function is active WCF The Web Content Filter is active It is enabled from Firewall gt gt General Setup DoS The DoS DDosS function is active It will blink while detecting an attack LED on Connector Left The port is connected WAN2 LED The port is disconnected Giga The data is transmitting Right The port is connected with 1000Mbps LED The port is connected with 10 100Mbps Left The port is connected LED Off The port is disconnected Blinking The data is transmitting Right On The port is connected with LOOOMbps LED Off The port is connected with 10 100Mbps Dr ay Te k 7 Vigor2860 Series User s Guide LD me ale i Vigor2860n plus VDSL2 Security Firewall W a N N OFF WPS Q 0 her wae occf Ly ae a ae eo oe D O Factory D o D eset USB 3 4 5 6 R 24G 5G DoS VDSLIADSL WAN2 Giga GigaLAN gt 1 2 ON mE TH Interface Description Wireless LAN Press Wireless LAN ON OFF WPS button once to wait for client ON OFF WPS device making network connection through WPS Press Wireless LAN ON OFF WPS button twice to enable WLAN LED on or disable WLAN LED off wireless connection Factory Reset Restore the default settings Usage Turn on the router ACT LED is blinking Press the hole and keep for more than 5 seconds When you see the ACT LED begins to blink rapidly than usual release the button Then the rou
410. mmunicate with each other simply activate Inter LAN Routing by checking the box between LANI and LAN2 LAN gt General Setup General Setup Index LAM 1 LAN 2 LAM 3 LAM 4 LAN 5 LAN 6 DMZ Port IP Routed Subnet Status DHCP EERE Ew IP Address 197 165 1 1 194 168 2 1 192 160 sh 192 168 4 1 2 bese 192 168 6 1 192 168 7 1 192 168 0 1 Advanced You can configure DHCP server options here Force router to use DNS server IP address settings specified in Inter LAN Routing Subnet LAN 1 LAN 1 LAN 2 LAN 3 LAN 4 LAN 5 LAN G DM Port LAN 2 LAN 3 LAN 4 Note LAN 2 s 4 5 6 are available when WYLAN is enabled Details Page Details Page Details Page Details Page Details Page Details Page Details Page Details Page LAN 6 DM Port DMZ subnet is default bound to Pl and will overwrite the settings of Pl at LAN gt VLAN page Vigor router supports up to six private IP subnets on LAN Each can be independent isolated or common able to communicate with each other This is ideal for departmental or multi occupancy applications Dray Tek 141 Vigor2860 Series User s Guide 3 2 5 Bind IP to MAC This function is used to bind the IP and MAC address in LAN to have a strengthening control in network When this function is enabled all the assigned IP and MAC address binding together cannot be changed If you modified the binding IP or MAC address it might cause you not ac
411. mode If in doubt then select Route Mode Available settings are explained as follows Item Description LAN to LAN Client Choose the client mode Mode Selection Route Mode NAT Mode If the remote network only allows you to dial in with single IP please choose this mode otherwise please choose Route Mode Route Wlode Route Made MAT Mode Please choose a There are 32 VPN profiles for users to set LAN to LAN Profile Vigor2860 Series User s Guide 52 Dr ay Tek Index Status um Wo pi P W mi P m o a m a m a m o a a a m a a a a a a a a Name wv TTT Pr eee Pr Tr Po vee Pr Pr vee vee Tr T Pr TT ve vee Pr ve vee Pr Tr Pr Pr TT Po Tr tr MM 2 When you finish the mode and profile selection please click Next to open the following Dray Tek page VPN and Remote Access gt gt VPN Client Wizard VPN Connection Setting Security ranking 1 is the highest 5 is the lowest Throughput ranking 1 ts the highest 5 is the lowest 1 L2TP over IPsec 1 PPTP None Encryption 2 IPsec 2 L2TP 3 PPTP Encryption 3 IPsec 4 L21TP 4 L2TP over IPsec 5 PPTP None Encryption 5 PPTP Encryption Select VPN Type PPTP Encryption PPIP None Encryption i PPTP Encryption IPsec L2TP L2TP over IPsec Nice to Have L2TP over IPsec Must O C In this page you have to select suitable VPN type for the VPN client profile There are six types
412. more Ethernet switches Thus VLAN is suitable for some circumstances for example the rental apartment SOHO office and so on These clients may need two or three isolated networks only and setup a network in a simple way Port based VLAW Switch Group A Group B 112 E31 oo Group A Group B Switch Switch Tag based The idea of tag based VLAN is to identify a virtual LAN with a specific ID therefore VLAN ID introduced by tag based VLAN Through VLAN ID ports with different VID VLAN ID will be identified as in different LANs so the traffics also will be isolated from each of VLANs Many administrators who manage an enterprise network or even the internet service providers ISP adopt Tag based VLAN popularly because it is convenient to maintenance and management a distributed network Setting a large scale network is easy by giving each of them with different VID and isolating the traffics at the same time Besides the VLAN ID there is another feature Trunk introduced While the role of a port on an Ethernet switch is setup as a Trunk port it means the VLAN ID will be kept while forwarding the packets between switches By this feature VLANs are able to distribute over two or more Ethernet Dray Te k 527 Vigor2860 Series User s Guide switches easily moreover design a large and secured network is possible through Trunk port When VLAN is being enabled on Vigor routers the LAN ports are being turned into Trunk mode automa
413. mported will be listed on the Trusted CA Certificate window Then click Import to use the pre saved file Certificate Management gt gt Trusted CA Certificate Import X509 Trusted CA Certificate Select a trusted CA certificate file a Click Import to upload the certification For viewing each trusted CA certificate click View to open the certificate detail information window If you want to delete a CA certificate choose the one and click Delete to remove all the certificate information Vigor2860 Series User s Guide 302 Dr ay Tek Certificate Information Windows Internet Explorer E al x E htip192 168 1 Ldoc Calf Vil him E Certificate Detail Information Certificate Name Trusted CA 1 Issuer Subject Subject Alternative Name Valid From Valid To Cince Il 3 12 3 Certificate Backup Local certificate and Trusted CA certificate for this router can be saved within one file Please click Backup on the following screen to save them If you want to set encryption password for these certificates please type characters in both fields of Encrypt password and Retype password Also you can use Restore to retrieve these two settings to the router whenever you want Certificate Management gt Certificate Backup Certificate Backup Restoration Encrypt password Confirm password to download certificates to your local PC as a file Restoration Select a backup file
414. mum length of the name you can set is 32 characters Check it to enable such account profile Click to accept any peer regardless of its identity Click to check one specific field of digital signature to accept the peer with matching value The field can be IP Address Domain or E mail Address The box under the Type will appear according to the type you select and ask you to fill in corresponding setting Click to check the specific fields of digital signature to accept the peer with matching value The field includes Country C State ST Location L Organization O Organization Unit OU Common Name CN and Email E After finishing all the settings here please click OK to save the configuration Dray Tek 273 Vigor2860 Series User s Guide 3 11 5 Remote Dial in User You can manage remote access by maintaining a table of remote user profile so that users can be authenticated to dial in via VPN connection You may set parameters including specified connection peer ID connection type VPN connection including PPTP IPsec Tunnel and L2TP by itself or over IPsec and corresponding security methods etc The router provides 32 access accounts for dial in users Besides you can extend the user accounts to the RADIUS server through the built in RADIUS client function The following figure shows the summary table VPN and Remote Access gt Remote Dial in User Remote Access User Accounts Index h h
415. n a window will automatically pop up as depicted below The window consists of a list of private IP addresses of all hosts in your LAN network Select one private IP address in the list to be the DMZ host ED 142 168 1 10 142 168 1 15 When you have selected one private IP from the above dialog the IP address will be shown on the following screen Click OK to save the setting NAT gt gt DMZ Host Setup DMZ Host Setup WAN1 WAN2 WAN3 WAN 1 Private IP v Private IP 192 168 1 49 MAC Address of the True IP DMZ Host 00 oo oo oo oo Note When a True IP DMZ host is turned on it will force the router s WAN connection to be always on DMZ Host for WAN2 WAN3 or WAN4 is slightly different with WAN1 Active True IP selection is available for WANI only See the following figure NAT gt gt DMZ Host Setup DMZ Host Setup WANT WAN WAN WAN4 WAN Enable Private IP 0 0 0 0 Choose IF Dr ay Tek 159 Vigor2860 Series User s Guide If you previously have set up WAN Alias for PPPoE or Static or Dynamic IP mode in WAN2 interface you will find them in Aux WAN IP for your selection NAT gt DMZ Host Setup DMZ Host Setup WANT WAN WANS WAN4 WAN Index Enable Aux WAN IP Private IP 1 d 10 39 0 10 0 0 0 0 2 d 10 39 0 150 0 0 0 0 Available settings are explained as follows Item Description Enable Check to enable the DMZ Host function Private IP Enter the private IP address of th
416. n both ends of local router and remote router not misleading due to IP lost for example sending data from the public IP of remote router to the private IP of local router you can check this box to solve this problem Dynamic RTP Port Start Specifies the start port for RTP stream The default value is 10050 Dynamic RTP Port End Specifies the end port for RTP stream The default value is 15000 RTP TOS It decides the level of VoIP package Use the drop down list to choose any one of them IPF precedence 1 IF precedence 2 IP precedence 3 IP precedence 4 IP precedence 5 IP precedence b IP precedence AF Class Low Drop AF Class Medium Drop AF Class High Drop AF Classe Low Drop AF Classe Medium Drop AF Class High Drop AF Classa Low Drop AF Classs Medium Drop AF Class3 High Drop Low Drop AF Class4 Medium Drop AF Class4 High Drop EF Class After finishing all the settings here please click OK to save the configuration Vigor2860 Series User s Guide 346 Dr ay Tek Detailed Settings for Phone Port Click the number link for Phone port you can access into the following page for configuring Phone settings VoIP gt gt Phone Settings Phone Call Feature Default SIP Account C Play dial tone only when account registered O Session Timer sec T 38 Fax Function Error Correction Mode REDUNDANCY Cl DND Do Not Disturb Mode Indext1 153 in Schedule Setup
417. n edit Status Display if the WAN interface is available for such function or not Bandwidth Display the inbound and outbound bandwidth setting for the WAN interface Direction Display which direction that such function will influence Class 1 Class2 Class 3 Others Display the bandwidth percentage for each class UDP Bandwidth Control Display the UDP bandwidth control is enabled or not Online Statistics Display an online statistics for quality of service for your reference Setup Allow to configure general QoS setting for WAN interface Class Rule Index Display the class number that you can edit Name Display the name of the class Rule Allow to configure detailed settings for the selected Class Service Type Allow to configure detailed settings for the Vigor2860 Series User s Guide 238 Dr ay Tek Item Description service type Enable the First Priority When this feature is enabled the VoIP SIP UDP packets will for VoIP SIP RTP be sent with highest priority SIP UDP Port Seta port number used for SIP This page displays the QoS settings result of the WAN interface Click the Setup link to access into next page for the general setup of WAN interface As to class rule simply click the Edit link to access into next for configuration You can configure general setup for the WAN interface edit the Class Rule and edit the Service Type for the Class Rule for your request Online Statistics
418. n prevent user from accidentally downloading malicious codes from web pages It s very common that malicious codes conceal in the executable objects such as ActiveX Java Applet compressed files and other executable files Once downloading these types of files from websites you may risk bringing threat to your system For example an ActiveX control object is usually used for providing interactive web feature If malicious code hides inside it may occupy user s system For example if you add key words such as sex Vigor router will limit web access to web 29 99 sites or web pages such as www sex com www backdoor net images sex p_386 html Or you may simply specify the full or partial URL such as www sex com or sex com Also the Vigor router will discard any request that tries to retrieve the malicious code Click CSM and click URL Content Filter Profile to open the profile setting page Vigor2860 Series User s Guide 222 Dr ay Te k CSM gt gt URL Content Filter Profile w URL Content Filter Profile Table Set to Factory Default Frofile Name Profile Name 1 J 2 6 2 4 8 Administration Message Max 255 characters Default Message lt body gt lt center gt lt br gt lt p gt The requested Web page has been blocked by URL Content Filter lt p gt Please contact your system administrator for further information lt center gt lt body gt Each item is explained as follows
419. nd waiting for remote user s answer ALERTING Indicates that a call is coming ACTIVE Indicates that the VoIP connection is launched Indicates the voice codec employed by present channel The present in call or out call peer ID the format may be IP or Domain The format is represented as hours minutes seconds Total number of transmitted voice packets during this connection session Total number of received voice packets during this connection session Total number of lost packets during this connection session The jitter of received voice packets Accumulation for the times of in call Accumulation for the times of out call Accumulation for the times of missing call The volume of present call Display logs of VoIP calls 351 Vigor2860 Series User s Guide 3 16 Wireless LAN 2 4GHz2 5GHz This function is used for n models only 3 16 1 Basic Concepts Over recent years the market for wireless communications has enjoyed tremendous growth Wireless technology now reaches or is capable of reaching virtually every location on the surface of the earth Hundreds of millions of people exchange information every day via wireless communication products The Vigor n model a k a Vigor wireless router is designed for maximum flexibility and efficiency of a small office home Any authorized staff can bring a built in WLAN client PDA or notebook into a meeting room for conference without laying a clot of LA
420. nd functions that are supported in this site include VigorPro VigorPro Unified Security Firewall series e Activation of Commtouch GlobalView Web Content Filter license key e Activation of DT Anti Virus license key e Activation of Kaspersky Anti Virus license key e Activation of Commtouch Anti Spam license key and membership If you can t read the AuthCode click here Forget password Not registered yet Click here Vigor routers for models that support Commtouch e Activation of Commtouch Giobalview Web Content Filter license key The MyVigor website contains a trail version of Commtouch GlobalView Web Content Filter which allows the users fo set filters to block out undesirable web pages in the Internet jungle Please use IE 5 0 or above resolution 1024 788 for best More customer oriented services are planned for MyVigor site for the display DrayTek Corp near future Vigor2860 Series User s Guide 478 Dr ay Te k 2 Check to confirm that you accept the Agreement and click Accept Create an account Please enter personal profile Grersonal Information E Preferences completion 1 Agreement Draytek provides Myvigor myvigor draytek com service according to this agreement When you use MyVigor service it means that you have read understand and agree to accept the items listed in this agreement Draytek can modify or change the content of the tems without an
421. ndow Min and CWMax means contention Window Max Please specify the value ranging from to 15 Be aware that CWMax value must be greater than CWMin or equals to CWMin value Both values will influence the time delay for WMM accessing categories The difference between AC_VI and AC_VO categories must be smaller however the difference Vigor2860 Series User s Guide 368 Dr ay Te k between AC_BE and AC_BK categories must be greater Txop It means transmission opportunity For WMM categories of AC_VI and AC_VO that need higher priorities in data transmission please set greater value for them to get highest transmission opportunity Specify the value ranging from 0 to 65535 ACM It is an abbreviation of Admission control Mandatory It can restrict stations from using specific category class if it is checked Note Vigor2860 provides standard WMM configuration in the web page If you want to modify the parameters please refer to the Wi Fi WMM standard specification AckPolicy Uncheck default value the box means the AP router will answer the response request while transmitting WMM packets through wireless connection It can assure that the peer must receive the WMM packets Check the box means the AP router will not answer any response request for the transmitting packets It will have better performance with lower reliability After finishing all the settings here please click OK to save the configuration Dray Te k 36
422. ndwidth Limit For any LAN IP Not in Limitation List when session number exceeds Note For TX RX a setting of O means unlimited bandwidth Time Schedule Index 1 15 in Schedule Setup Note Action and Idle Timeout settings will be ignored To activate the function of limit bandwidth simply click Enable and set the default upstream and downstream limit Available settings are explained as follows Item Description Bandwidth Limit Enable Click this button to activate the function of limit bandwidth IP Routed Subnet Check this box to apply the bandwidth limit to the second subnet specified in LAN gt gt General Setup Disable Click this button to close the function of limit bandwidth Default TX limit Define the default speed of the upstream for each computer in LAN Default RX limit Define the default speed of the Dr ay Tek 235 Vigor2860 Series User s Guide downstream for each computer in LAN Allow auto adjustment Check this box to make the best utilization of available bandwidth Limitation List Display a list of specific limitations that you set on this web page Specific Limitation Start IP Define the start IP address for limit bandwidth End IP Define the end IP address for limit bandwidth Each Shared Select Each to make each IP within the range of Start IP and End IP having the same speed defined in TX limit and RX limit fields select Shared to make
423. ne Status This page displays the user s connected to the router and refreshes the connection status in an interval of several seconds User Management gt User Online Status Current Time 02 17 06 56 58 Refresh Seconds Page Refresh Index User IP Address Profile Last Login Time Expired Time Data Quota Idle Time Action 1 admin 172 16 3 130 admin 02 17 05 59 25 Unlimited Unlimited Unlimited Block Logout Delete Total Number 1 Available settings are explained as follows Item Description Refresh Seconds Use the drop down list to choose the time interval of refreshing data flow that will be done by the system automatically Petresh Seconds Refresh Click this link to refresh this page manually Index Display the number of the data flow User Display the users which connect to Vigor router currently You can click the link under the username to open the user profile setting page for that user IP Address Display the IP address of the device Profile Display the authority of the account Last Login Time Display the login time that such user connects to the router last time Expired Time Display the expired time of the network connection for the user Data Quota Display the quota for data transmission Dr ay Te k 193 Vigor2860 Series User s Guide Idle Time Display the idle timeout setting for such profile Action Block can prevent specified user accessing into Internet Unblock the user will be bloc
424. ne or more specific ports to a target port This mechanism helps manager track the network errors or abnormal packets transmission without interrupting the flow of data access the network By the way user can apply this function to monitor all traffics which user needs to check There are some advantages supported in this feature First it is more economical without other detecting equipments to be set up Second it may be able to view traffic on one or more ports within a VLAN at the same time Third it can transfer all data traffics to be mirrored to one analyzer connect to the mirroring port Last it is more convenient and easy to configure in user s interface LAN gt gt LAN Port Mirror LAN Port Mirror Port Mirror Enable Disable Porti Port Ports Port4 Ports Porto WANI Mirror Port O O Mirrored Tx Port d C F L F F F Mirrored Rx Port E F O d d d d Note The mirrored WANT is a software mirror it will lead to a substantial decline in performance Available settings are explained as follows Item Description Port Mirror Check Enable to activate this function Or check Disable to close this function Mirror Port Select a port to view traffic sent from mirrored ports Mirrored Tx Port Select which ports are necessary to be mirrored for transmitting the packets Mirrored Rx Port Select which ports are necessary to be mirrored for receiving the packets After finishing all the settings here
425. nection Quick Start Wizard Please confirm your settings WAN Interface Physical Mode VPI WIT Protocol Encapsulation Fixed IP Primary ONS Secondary ONS 4 Click Finish A page of Quick Start Wizard Setup OK WANI ADSL 0 58 PPPoE LLC Mo 0 8 5 8 0 6 4 4 status of this protocol will be shown Quick Start Wizard Setup OK 5 Now you can enjoy surfing on the Internet Vigor2860 Series User s Guide 34 1 will appear Then the system Dray Tek MPOA Static or Dynamic IP 1 Choose WANI as WAN Interface and click the Next button you will get the following page Quick Start Wizard Connect to Internet WAN 1 Protocol MPoA Static or Dynamic IP For ADSL Only Encapsulation 1453 Bridged IP LLC Fixed IP Yes ONo Dynamic IP IP Address Subnet Mask fs Default Gateway fs Primary DNS fs Second DNS fs Available settings are explained as follows Item Description Protocol There are two modes offered for you to choose for WAN interface MPoA Static or Dynamic IP m PPPoE PPPoA i Static or Dynamic IP Choose MPoA Static or Dynamic IP as the protocol For ADSL Only Such field is provided for ADSL only You have to choose encapsulation and type the values for VPI and VCI Or click Auto detect to find out the best values 1403 Bridged IP LLU 1483 Bridged IP LLC 1463 Routed IP LLE 1403 Bridged IP VC Mux 1453 Routed IP VC Mux I
426. nerated by mOTP in the mobile phone e g e759bb6f0e94c7ab4fe6 Allowed Dial In Type PPTP Allow the remote dial in user to make a PPTP VPN connection through the Internet You should set the User Name and Password of remote dial in user below IPSec Tunnel Allow the remote dial in user to make an Vigor2860 Series User s Guide 380 Dr ay Te k Dray Tek Item Subnet IKE Authentication Method Description IPSec VPN connection through Internet L2TP with IPSec Policy Allow the remote dial in user to make a L2TP VPN connection through the Internet You can select to use L2TP alone or with IPSec Select from below None Do not apply the IPSec policy Accordingly the VPN connection employed the L2TP without IPSec policy can be viewed as one pure L2TP connection Nice to Have Apply the IPSec policy first if it is applicable during negotiation Otherwise the dial in VPN connection becomes one pure L2TP connection Must Specify the IPSec policy to be definitely applied on the L2TP connection SSL Tunnel It allows the remote dial in user to make an SSL VPN Tunnel connection through Internet suitable for the application through network accessing e g PPTP L2TP IPSec If you check this box the function of SSL Tunnel for this account will be activated immediately Specify Remote Node Check the checkbox to specify the IP address of the remote dial in user ISDN number or peer ID used in IKE aggressiv
427. nexpected result It is because the VPN Remote Dial in User profiles can be extended to the User profiles in User Management for authentication There are two different behaviors when a User Management account and a VPN profile share the same Username If SSL Tunnel or SSL Web Proxy is enabled in the VPN profile the user profile in User Management will always be invalid for Web authentication For example if you create a user profile in User Management with chaochen test as username password while a VPN Remote Dial in user profile with the same username chaochen but a different password 1234 you will always get error message The username or password you entered is incorrect when you use chaochen test via Web to do authentication VPN and Remote Access gt gt Remote Dial in User Index No 1 User account and Authentication Username Enable this account Password Max 19 char Idle Timeout second s Cl Enable Mobile One Time Passwords mOTP Allowed Dial In Type PPTP IPsec Tunnel IKE Authentication Method r wi i Pre Shared Key 7 E Ol Digital Signaturef 5o09 C Specify Remote Node Remote Client IP IPsec Security Method MecdiumtaH orPeerIDf High ESP l DES 3DES v AES Netbios Naming Packet Pass Block Local ID optional O O Multicast via VPN Pass Block ifor some IGMP IP Camera DHCP Relay etc Subnet O Assign Static IP Address 0K Clear _Cancet_ If SSL Tunne
428. ng all the settings here please click OK to save the configuration Dr ay Tek 145 Vigor2860 Series User s Guide 3 2 8 Web Portal Setup This page allows you to configure a profile with specified URL for accessing into or display a message when a wireless LAN user connects to Internet through this router No matter what the purpose of the wireless LAN client is he she will be forced into the URL configured here while trying to access into the Internet or the desired web page through this router That is a company which wants to have an advertisement for its products to users can specify the URL in this page to reach its goal LAN gt Web Portal Setup Web Portal Table Profile Se fy is e Status Disable Disable Disable Disable Interface None None None None Each item is explained as follows Item Profile Status Interface Preview Description Display the number link which allows you to configure the profile Display the content Disable URL Redirect or Message of the profile Display the applied interfaced of the profile Open a preview window according to the configured settings To configure the profile click any index number link to open the following page LAN gt Web Portal Setup Profile Index 2 Disable CURL Redirect Message Applied Interfaces 2 40 SSID 36 SSID Vigor2860 Series User s Guide httpd draytek corm Note If the User Manageme
429. ng the USB storage disk into the Vigor router please make sure the memory format for the USB storage disk is FAT 16 or FAT32 It is recommended for you to use FAT32 for viewing the filename completely FAT16 cannot support long filename USB Application gt USB General Settings USB General Settings General Settings Simultaneous FTP Connections 5 Maximum 6 Default Charset English v Samba Service Settings Network Neighborhood O Enable Disable Access Mode LAN Only LAN And WAN NetBios Name Service Workgroup Name Note 1 If Charset is set to English only English long file name is supported 2 Multi session ftp download will be banned by Router FTP server If your ftp client have multi connection mechanism such as FileZilla you may limit client connections setting to 1 to get better performance 3 A workgroup name must not be the same as the host name The workgroup name and the host name can have as many as 15 characters and a host name can have as many as 23 characters but both cannot contain any of the following lt gt 7 Available settings are explained as follows Vigor2860 Series User s Guide 386 Dray Tek Item General Settings Samba Service Settings Access Mode NetBios Name Service Description Simultaneous FTP Connections This field is used to specify the quantity of the FTP sessions The router allows up to 6 FTP sessions connecting to USB storage disk at one time
430. nges you want for 2 4G SSID Click Next for next page External Device gt gt Access Point Devices 5101 SSID2 SSIDS SSID4 Enable Disable DrayTek LAN A Lan A C Hide SSID o untag Security Settings WP ATPAAIPGK w Set up RADIUS Server if 802 1 is enabled WPA WPA Algorithms OTKIPF AES TKIP AES Pass Phrase Encryption Key Renewal Interval Seconds PMK Cache Period Miniutes Pre 4uthentication Enable Disable WEP Setup WEP Key if WEP is enabled a02 1 WEP Enable Disable Access Control Client s MAC Address E AE A J Bandwidth Limit Vigor2860 Series User s Guide 496 Dr ay Te k 6 Dray Tek The following page is offered for you to modify related settings for 5G SSID of managed AP Continue to make any changes you want After finished all of the changes simply click Finish External Device gt gt Access Point Devices 56 SSID1 5G SSID2 56 SSID3 5G SSID4 3G SSID Enable Disable SSID DrayTek 4G C Hide 551D 0 untag Cl From Member Security Settings Set up RADIUS Server if 802 12 is enabled WPA WPA Algorithms TEIP AES TEIPJAES Encryption Key Renewal Interval 3600 Seconds PMK Cache Period Miniutes Pre 4uthentication Enable Disable WEP Setup WEP Key if WEP is enabled 802 1 WEP Enable Disable Access Control tee ee Client s MAC Address zt E jsf jf Bandwidth Limit OcEnable Disable Auto Adjustment O Enable Disable Now the AP represented with APS00_
431. ngs are explained as follows Item Description Active User Display current user who visit SSL VPN server Host IP Display the IP address for the host Time out Display the time remaining for logging out Action You can click Drop to drop certain login user from the router s SSL Portal UI Dray Te k 385 Vigor2860 Series User s Guide 3 18 USB Application USB storage disk connected on Vigor router can be regarded as a server or WAN interface By way of Vigor router clients on LAN can access write and read data stored in USB storage disk with different applications After setting the configuration in USB Application you can type the IP address of the Vigor router and username password created in USB Application gt gt USB User Management on the client software Then the client can use the FTP site USB storage disk or share the Samba service through Vigor router Note USB ports on Vigor router are allowed to connect to USB modem Models of the modems supported by Vigor router can be seen from USB Application gt gt Modem Support List For network connection via USB modem refer to WAN gt gt Internet Access and WAN gt gt General Setup for detailed information 3 18 1 USB General Settings This page will determine the number of concurrent FTP connection default charset for FTP server and enable Samba service At present the Vigor router can support USB storage disk with formats of FAT16 and FAT32 only Therefore before connecti
432. ngs of the call schedule with index 1 are shown below Vigor2860 Series User s Guide 252 Dr ay Te k Applications gt Schedule Index No 1 Start Date yyyy mm dd 2000 11 Start Time hh mm Duration Time hh mm Action Idle Timeout lo minute s max 255 0 for default How Often Once Weekdays LC Sun Mon Tue Wed Thu Fri J Sat Available settings are explained as follows Item Description Enable Schedule Check to enable the schedule Setup Start Date Specify the starting date of the schedule yyyy mm_ dd Start Time hh mm Specify the starting time of the schedule Duration Time Specify the duration or period for the schedule hh mm Action Specify which action Call Schedule should apply during the period of the schedule Force On Force the connection to be always on Force Down Force the connection to be always down Enable Dial On Demand Specify the connection to be dial on demand and the value of idle timeout should be specified in Idle Timeout field Disable Dial On Demand Specify the connection to be up when it has traffic on the line Once there is no traffic over idle timeout the connection will be down and never up again during the schedule Idle Timeout Specify the duration or period for the schedule How often Specify how often the schedule will be applied Once The schedule will be applied just once Weekdays Specify which days in one week should perform the sc
433. nnect Vigor router until the router shuts down Such feature is especially useful for free Wi Fi service For example a coffee shop offers free W1 Fi service for its guests for one hour every day Then the connection time can be set as 1 hour and reconnection time can be set as 1 day Thus the guest can finish his job within one hour and will not occupy the wireless network for a long time Wireless LAN 4GHz gt gt Station Control SSID 1 SSID 2 SSID 3 SSID 4 SSID DrayTek2860 marketing Enable L Reconnection Time 1440 min Display All Station Control List WEB Fortal Setup Note Once the feature is enabled the Internet accessability will be restricted by the wireless station MAC address with the specific connection time Available settings are explained as follows Item Description SSID Display the SSID that the wireless station will use it to connect with Vigor router Enable Check the box to enable the station control function Connection Time Use the drop down list to choose the duration for the wireless Reconnection Time client connecting reconnecting to Vigor router Or type the duration manually when you choose User defined User defined 7 30 min 1 hour 2 hours 4 hours Display All Station All the wireless stations connecting to Vigor router by using Control List such SSID will be listed on Station Control List Vigor2860 Series User s Guide 372 Dr ay Tek WEB Portal Setup Click i
434. nnection by clicking Drop button You may also aggressively Dial out by using Dial out Tool and clicking Dial button VPN and Remote Access gt gt Connection Management Dial out Tool Refresh Seconds General Mode V2925 vigor2925 ubddns c v VPN Connection Status Current Page 1 Page No Ga Tx Tx Rx Rx VPN Remote IP Virtual Network Pkts Rate Bps Pkts Rate Bps UpTime 10 29 25 0 24 142 3 1510 3 33 55 Drop 1 IPsec Tunnel 111 251 193 140 2925 0ES No Auth via WANS weve Data is encrypted weve Data isn t encrypted Available settings are explained as follows Item Description Dial out Tool General Mode This filed displays the profile configured in LAN to LAN with Index number and VPN Server IP address The VPN connection built by General Mode does not support VPN backup function Refresh Seconds Alfa 192 168 0 26 Alfa 192 168 0 26 Bentley 192 168 0 27 Audi 192 168 0 28 BMW 192 168 0 29 Buick 192 168 0 30 Cadillac 192 168 0 31 Chrysler 192 163 0 32 Citroen 192 166 0 33 Daihatsu 192 166 0 34 Ferrari 192 168 0 35 Fiat 192 168 0 36 Gore blecde Backup Mode Load Balance Mode Page no l Backup Mode This filed displays the profile name saved Vigor2860 Series User s Guide in VPN TRUNK Management with Index number and VPN Server IP address The VPN connection built by Backup Mode supports VPN backup function Gene
435. nt Mode WAN 2 Enter the Static IP configuration provided by your ISP WAN IP Subnet Mask 255 255 25 Primary DNS fs Available settings are explained as follows Item Description WAN IP Type the IP address Subnet Mask Type the subnet mask Gateway Type the IP address of gateway Primary DNS Type in the primary IP address for the router Secondary DNS Type in secondary IP address for necessity in the future Back Click it to return to previous setting page Vigor2860 Series User s Guide 42 Dr ay Tek Next Click it to get into the next setting page Cancel Click it to give up the quick start wizard 3 Please type in the IP address information originally provided by your ISP Then click Next for next step Quick Start Wizard Please confirm your settings WAN Interface WAN Physical Mode Ethernet Physical Type Auto negotiation Internet Access Static IP Click Back to modify changes if necessary Otherwise click Finish to save the current settings and restart the Vigor router E 4 Click Finish A page of Quick Start Wizard Setup OK will appear Then the system status of this protocol will be shown Quick Start Wizard Setup OK 5 Now you can enjoy surfing on the Internet DHCP 1 Choose WAN2 as WAN Interface and click the Next button The following page will be open for you to specify Internet Access Type Quick Start Wizard Connect to Internet WAN 2 Select one of the following Inte
436. nt application is enabled it will override the Web Portal settings seen here lt hl gt lt font color red Vigor fConte lt hl gt lt he gt Reliable connectivity ieee Robust firewall protections nee lt h gt Multi site secure communications har A Max 511 characters Preview Default Message LAN1 LAN LANS LAN4 LANS LANG SSID1 SSID SSID3 SSID4 SS1D1 SSID 2 SSID3 SSID4 Me Dray Tek Available settings are explained as follows Item Description Disable Click this button to close this function URL Redirect Any user who wants to access into Internet through this router will be redirected to the URL specified here first It is a useful method for the purpose of advertisement For example force the wireless user s in hotel to access into the web page that the hotel wants the user s to visit Message Type words or sentences here The message will be displayed on the screen for several seconds when the wireless users access into the web page through the router Preview Display a preview window base on the web portal setting Default Message Click it to restore the default content Applied Interfaces Check the box es representing different interfaces to be applied by such profile The advantage is that each SSID 1 2 3 4 for wireless network can be applied with different web portal separately After finishing all the settings here please click OK to save the configuration Dr ay Te k 1
437. nterface and click the Next button The following page will be open for you to specify Internet Access Type Quick Start Wizard Connect to Internet WAN 2 Select one of the following Internet Access types provided by your ISP Static IP DHCP 2 Click PPTP L2TP as the Internet Access Type Then click Next to continue Quick Start Wizard PPTP Client Mode WAN 2 Enter the user name password WAN IP configuration and PPTP server IP provided by your ISP User Name 547 7aec Password Confirm Password WAN IP Configuration Obtain an IP address automatically Specify an IP address IP Address Subnet Mask 255 255 255 0 Gateway 192 168 3 1 Primary DNS PPTP Serwer Available settings are explained as follows Item Description User Name Assign a specific valid user name provided by the ISP Note The maximum length of the user name you can set is 63 characters Password Assign a valid password provided by the ISP Vigor2860 Series User s Guide 40 Dray Tek Note The maximum length of the password you can set is 62 characters Confirm Password Retype the password WAN IP Obtain an IP address automatically the router will get an Configuration IP address automatically from DHCP server Specify an IP address you have to type relational settings manually IP Address Type the IP address Subnet Mask Type the subnet mask Gateway Type the IP address of the gateway Primary DNS
438. nvironment For the download speed Vigor2860 Series User s Guide might be impacted by the uploading TCP ACK you can m0 Dray Tek check this box to push ACK of upload faster to speed the network traffic Limited_bandwidth Ratio The ratio typed here is reserved for limited bandwidth of UDP application Note The rate of outbound inbound must be smaller than the real bandwidth to ensure correct calculation of QoS It is suggested to set the bandwidth value for inbound outbound as 80 85 of physical network speed provided by ISP to maximize the QoS performance Edit the Class Rule for QoS 1 The first three Class 1 to Class 3 class rules can be adjusted for your necessity To add edit or delete the class rule please click the Edit link of that one Bandwidth Management gt gt Quality of Service General Setup Setto Factory Default Class Class Class ene Index Status Bandwidth Direction 2 3 Others Bandwidth Control Online Statistics WANI Disable Kkbps kbps WAH Disable 100000Kbps 100000Kbps WANS Disable 100000Kbps 100000Kbps WaARN4 Disable 100000Kbps 100000Kbps Inactive Status Setup Inactive Status Setup Inactive Status Setup Inactive Status Setup Class Rule Index Class 1 Class 2 Class 3 Service Type Edit Enable the First Priority for VoIP SIP RIP SIP UDP Part 5060 Default 50605 2 After you click the Edit link you will see the following page Now you can de
439. o previous page Bandwidth Management gt Quality of Service Class Index 1 Name Tag packets as DiffServ NO Status Local Address Remote Address CodePoint Service Type l 172 16 1 240 E i Vy 10 Active 17 16 1 241 Any ANY ANY 8 Do the same steps to add class rules for IPTV and Data Email with IP addresses as shown below Bandwidth Management gt Quality of Service Class Index 2 Name E iajpackeie a DiffServ NO Status Local Address Remote Address CodePoint Service Type 172 16 1 242 f j 1 it Active 172 16 1 249 Any ANY ANY and Dr ay Tek 455 Vigor2860 Series User s Guide Bandwidth Management gt Quality of Service Class Index 3 Name Data Email F Tag packets as Default bi i l 2 as DiffServ se ie NO Status Local Address Remote Address CodePoint Service Type id Active Any Any IP precedence 2 ANY CET Ca 9 Assuming you get 2MB 512Kb Internet line You can click the Setup link of WANI to set up the bandwidth for different groups among VoIP IPTV and Data Email Bandwidth Management gt Quality of Service General Setup Setto Factory Default Online Statistics Class Class Class mor Index Status Bandwidth Direction m 3 Others Bandwidth 1 Control WANI Enable Kbps Kbps Outbound 30 50 15 5 Active Status Setup WANS Disable 100000Kbps 100000Kbps 259 25 25 2556 Inactive Status Setup WANS Dis
440. o the list above Edit Allows you to edit the settings for the selected limitation Delete Remove the selected settings existing on the limitation list Administration Message Type the words which will be displayed when reaches the maximum number of Internet sessions permitted Default Message Click this button to apply the default message offered by the router Time Schedule Index 1 15 in Schedule Setup You can type in four sets of time schedule for your request All the schedules can be set previously in Application gt gt Schedule web page and you can use the number that you have set in that web page After finishing all the settings please click OK to save the configuration Vigor2860 Series User s Guide 234 Dr ay Tek 3 9 2 Bandwidth Limit The downstream or upstream from FTP HTTP or some P2P applications will occupy large of bandwidth and affect the applications for other programs Please use Limit Bandwidth to make the bandwidth usage more efficient In the Bandwidth Management menu click Bandwidth Limit to open the web page Bandwidth Management gt Bandwidth Limit Bandwidth Limit Enable IP Routed Subnet Disable Default TX Limit Default RX Limit O Allow auto adjustment to make the best utilization of available bandwidth Limitation List Index Start IP End IP TX limit RK limit Shared Specific Limitation startIp end P S O Each OShared TX Limit RX Limit C Smart Ba
441. ocAvlapply htm Existing Device o Selected Device 1 AP810_007620482810 2 AP900_00507F223343 Simply choose the device you want from Existing Device field Click gt gt to move the device to Selected Device field Then click OK The selected WLAN profile will be applied to the selected access point immediately Later the access point will reboot Vigor2860 Series User s Guide 318 Dr ay Tek How to edit the wireless LAN profile l 2 Click the Edit button to display the following page Dray Tek Central AP Management gt gt WLAN Profile WLAN Profile Edit Profile Name Administrator Password 2nd Subnet Operation Mode Wireless LAN 2 46 Mode 2 46 Channel Tx Power Wireless LAN 5G Channel Check the box on the left side of the selected profile Device Settings Default C Auto Provision Enable Disable 2 4G WLAN General Settings O Enable Disable 5G WLAN General Settings Enable Disable Mixed 1a iin 5180MHz Channel36 Cancel 319 Mext Vigor2860 Series User s Guide 3 After finished the general settings configuration click Next to open the following page for 2 4G wireless security settings Central AP Management gt gt WLAN Profile SSID1 SSID2 SSID3 SSID4 2 46 SSID Hide 551D Security Settings Set up RADIUS Server if 802 12 is enabled WPA WPA Algorithms TKIP AES TEIP AES Encryption Pass Phrase C key Renewal Interval bo Se
442. ocol Gateway IP Address 172 16 1 1 C Enable RIP Default MAC Address Specify a MAC Address MAC Address loo 10 Aa fjas Bs aa DNS Server IP Address Primary IP Address 166 95 1 1 Secondary IP Address 0 0 4 4 Available settings are explained as follows Item Description Enable Disable Click Enable for activating this function If you click Disable this function will be closed and all the settings that you adjusted in this page will be invalid Vigor2860 Series User s Guide 98 Dr ay Tek Keep WAN Connection Normally this function is designed for Dynamic IP environments because some ISPs will drop connections if there is no traffic within certain periods of time Check Enable PING to Keep alive box to activate this function PING to the IP If you enable the PING function please specify the IP address for the system to PING it for keeping alive PING Interval Enter the interval for the system to execute the PING operation WAN Connection Such function allows you to verify whether network Detection connection is alive or not through ARP Detect or Ping Detect Mode Choose ARP Detect or Ping Detect for the system to execute for WAN detection Ping IP If you choose Ping Detect as detection mode you have to type IP address in this field for pinging TTL Time to Live Displays value for your reference TTL value is set by telnet command MTU It means Max Transmit Unit for packet The
443. ode used to access Internet Network Mode Force Vigor router to connect Internet with the mode specified here If you choose 4G 3G 2G as network mode the router will choose a suitable one according to the actual wireless signal automatically APN Name APN means Access Point Name which is provided and required by some ISPs 3 Then click Next for viewing summary of such connection Quick Start Wizard Please confirm your settings Wat Interface WARS Physical Mode ISB Internet 4ccess QDHEFP Click Back to modify changes if necessary Otherwise click Finish to save the current settings and restart the Vigor router 4 Click Finish A page of Quick Start Wizard Setup OK will appear Then the system status of this protocol will be shown Quick Start Wizard Setup OK 5 Now you can enjoy surfing on the Internet Dr ay Tek 47 Vigor2860 Series User s Guide 2 2 Service Activation Wizard Service Activation Wizard can guide you to activate WCF service Web Content Filter with a quick and easy way For the Service Activation Wizard is only available for admin operation therefore please type admin admin on Username Password while Logging into the web user interface Service Activation Wizard is a tool which allows you to use trial version or update the license of WCF directly without accessing into the server My Vigor located on http myvigor draytek com For using Web Content Filter Profile please
444. ode that you choose in WAN interface Note that Details Page will be changed slightly based on ADSL VDSL2 physical mode specified on WAN gt gt General Setup This button will open different web page based on Physical Mode to setup IPv6 Internet Access Mode for WAN interface If IPv6 service is active on this WAN interface the color of TPv6 will become green This button allows you to configure DHCP client options DHCP packets can be processed by adding option number and data information when such function 1s enabled and configured WAN gt gt Internet Access DHCP Client Options Status Options List Enable Interface Option Enable all WANI WAN2 WAN3 WAN4 WANS WANG WANT Oo Oo OF OO gp Interface Option Number DataType ASCII Character EX Option 18 Data path O Hexadecimal Digit EX Option 18 Data 2f70617468 O Address List EX Option 44 Data 172 16 2 10 172 16 2 20 Data add Update Derete_ Note Option 61 has been given a default value You can configure option 61 Client Identifier in WAN gt gt Interface Access page If you choose to configure option 61 here the settings in WAN gt gt Interface Access Details Page will be overwritten Option 12 is reserved you cannot configure it here but you can configure it in Router Name field of WAN gt gt Interface Access Enable Disable Enable Disable the function of DHCP Option Each DHCP opt
445. of the router Replace this text with vour own message 1 The welcome message can be written in HTML so lists such as this one can be created 2 Other markup tags such as p font or img can be used Vigor2860 Series User s Guide 404 Dr ay Te k 3 19 6 Configuration Backup Backup the Configuration Follow the steps below to backup your configuration 1 Goto System Maintenance gt gt Configuration Backup The following windows will be popped up as shown below System Maintenance gt Configuration Backup Configuration Backup Restoration Restoration Select a configuration file Oooo ce Click Restore to upload the file Click Backup to download current running configurations as a file 2 Click Backup button to get into the following dialog Click Save button to open another dialog for saving configuration as a file File Download You are downloading the File config chg From 192 168 1 1 Would you like to open the file or save it toa your computer Always ask before opening this type of file 3 In Save As dialog the default filename is config cfg You could give it another name by yourself my Documents id My Computer My Recent Emy Network Places Documents i Ry5 COM Lite v2k2_232_ config 1 M Documents y v2ke_250_config_1 My Computer File name config Bd My Network Save as type Configuration file AA i Dray Tek 405 Vigor2860 Series User s Guide 4 Click Save b
446. ofile Index 1 Enable Profis scien Doman Hame Server youomnan com IP Adress Lisi ipaa LE IP Acd r nF sina FSEeeE Repl A private IP address mapped to the Domain Name 192 168 1 x 140 186 223 x Public DNS Server server yourdomain com 210 139 175 223 Quasentuas 4 Public IP 210 139 175 223 Private IP 192 168 1 100 server yourdomain com Simply click Application gt gt LAN DNS to open the following page Applications gt gt LAN DNS LAN DNS Resolution Set to Factory Default Enable Index Profile Domain Name d 1 F 2 4 3 l 4 LI 5 LI 6 4 T LI 8 P 9 10 Dr ay Tek 249 Vigor2860 Series User s Guide Each item is explained as follows Item Description Set to Factory Default Clear all profiles and recover to factory settings Enable Check the box to enable the selected profile Index Click the number below Index to access into the setting page Profile Display the name of the LAN DNS profile Domain Name Display the domain name of the LAN DNS profile You can set up to 20 LAN DNS profiles To create a LAN DNS profile 1 Click any index say Index No 1 2 The detailed settings with index are shown below Applications gt gt LAN DNS Profile Index 1 Enable Profile Domain Nameims draytekcom Z oOo IP Address List Index IP Address name Subnet Reply 1 l172 16 3 65 Available settings are e
447. oint and Station in wireless client invoke this function at the same time That is the wireless client must support this feature and invoke the function too Note Vigor N61 wireless adapter supports this function Therefore you can use and install it into your PC for matching with Packet OVERDRIVE refer to the following picture of Vigor N61 wireless utility window choose Enable for TxBURST on the tab of Option Yigor N61 802 110 Wireless USB Adapter Utility Confieuration Status Option About General Setting Advance Setting Auto launch when Windows start up C Disable Radio C Remember mini status position Fragmentation Threshold 2346 C Auto hide mini status RTS Threshold 9347 C Set mini status always on top Frequency 802 11b gn 2 4GH v C Enable IP Setting and Proxy Setting in Profile Ad hoc Channel C Group Roaming hacen Power Save Mode Tx Burst WLAN type to connect Infrastructure and Ad hoc network Infrastructure network only adhoc network only C Automatically connect to non preferred networks Te Bont Enable Note means the real transmission rate depends on the environment of the network After finishing all the settings here please click OK to save the configuration Dray Te k 367 Vigor2860 Series User s Guide 3 16 8 WMM Configuration WMM is an abbreviation of Wi Fi Multimedia It defines the priority levels for four access categories d
448. older name can only contain the following characters A Z a z 0 9 j and space 4 Click OK to save the configuration 5 Make sure the FTP service is running properly Please open a browser and type ftp 192 168 1 1 Use the account user1 to login Log On As oe Either the server does not allow anonymous logins or the e mail address was not accepted FTF server 192 168 1 1 User name Password After vou log on you can add this server to vaur Favorites and return to it easily FTF does not encrypt or encode passwords or data before sending them to the server To protect the security of your passwords and data use Web Folders CW eboa instead Learn more about using Web Folders Log on anonymously Save password Dr ay Tek 447 Vigor2860 Series User s Guide 6 When the following screen appears it means the FTP service is running properly File Edit View Favorites Tools Help pack sz gt a gp Search gt Folders EBk b B Other Places FinalbataEn opkg install tempstorage iTunesSetu wlc 1 1 5 wi 2 Internet Explorer 4 My Documents a a a i Shared Documents Wie MPS MF 115 bmp 12 Always Air supply lost Crystal t My Network Places Open mp3 inlove mpS Flower mp3 7 Return to USB Application gt gt USB Disk Status The information for FTP server will be shown as below USB Application gt USB Disk Status USB Mass Storage Device Status
449. omes one pure L2TP connection Must Specify the IPsec policy to be definitely applied on the L2TP connection User Name This field is applicable when you select PPTP or L2TP with or without IPsec policy above The length of the name is limited to 49 characters Password This field is applicable when you select PPTP or L2TP with or without IPsec policy above The length of 281 Vigor2860 Series User s Guide Vigor2860 Series User s Guide the password is limited to 15 characters PPP Authentication This field is applicable when you select PPTP or L2TP with or without IPsec policy above PAP CHAP is the most common selection due to wild compatibility VJ compression This field is applicable when you select PPTP or L2TP with or without IPsec policy above VJ Compression is used for TCP IP protocol header compression Normally set to Yes to improve bandwidth utilization IKE Authentication Method This group of fields is applicable for IPsec Tunnels and L2TP with IPsec Policy Pre Shared Key Input 1 63 characters as pre shared key Digital Signature X 509 Select one predefined Profiles set in the VPN and Remote Access gt gt IPsec Peer Identity Peer ID Select one of the predefined Profiles set in VPN and Remote Access gt gt IPsec Peer Identity Local ID Specify a local ID Alternative Subject Name First or Subject Name First to be used for Dial in setting in the LAN to LAN Profile setup
450. on Factory Reset Restore the default settings Usage Turn on the router ACT LED is blinking Press the hole and keep for more than 5 seconds When you see the ACT LED begins to blink rapidly than usual release the button Then the router will restart with the factory default configuration USB Connecter for a USB device for 3G USB Modem or printer VDSL ADSL Connecter for accessing the Internet WAN2 Connecter for local network devices or modem for accessing Internet GigaLAN 1 6 Connecters for local network devices PWR Connecter for a power adapter ON OFF Power Switch Vigor2860 Series User s Guide 4 Dr ay Tek 1 2 2 For Vigor2860n Im aay 1 a 17 Vigor2860n ei et Cl w M E VDSL Security Firewall Wireless LA ee Factory Reset USB VDSLUADSL WAN2 Giga GigaLAN gt 1 2 3 4 5 6 LED Status Explanation ACT Activity The router is powered on and running normally Off The router is powered off USB USB device is connected and ready for use The data is transmitting WLAN Wireless access point is ready Blinking It will blink slowly while wireless traffic goes through ACT and WLAN LEDs blink quickly and simultaneously when WPS is working and will return to normal condition after two minutes You need to setup WPS within 2 minutes WAN2 Internet connection is ready Internet connection is not ready The data is transmitting DSL The router is ready to access Internet through DSL link Blinking Slowly
451. on RD KC Type Auto Microsoft SPS Document Writer an TIM PC Location Vigor Router Comment Print to file Print range Copies All pages Number of copies Selection Dr ay Tek 267 Vigor2860 Series User s Guide 3 11 VPN and Remote Access A Virtual Private Network VPN is the extension of a private network that encompasses links across shared or public networks like the Internet In short by VPN technology you can send data between two computers across a shared or public network in a manner that emulates the properties of a point to point private link Below shows the menu items for VPN and Remote Access 3 11 1 Remote Access Control Enable the necessary VPN service as you need If you intend to run a VPN server inside your LAN you should disable the VPN service of Vigor Router to allow VPN tunnel pass through as well as the appropriate NAT settings such as DMZ or open port VPN and Remote Access gt gt Remote Access Control Setup Remote Access Control Setup Enable PPTP WPN Service Enable IPSec WPN Service Enable L2TP VPN Service Enable SSL YPN Service Note To allow VPN pass through to a separate VPN server on the LAN disable any services above that use the same protocol and ensure that NAT Open Ports or Port Redirection is also configured After finishing all the settings here please click OK to save the configuration Vigor2860 Series User s Guide 268 Dr ay Te k 3 11 2 PPP General Setup
452. onfigure via Push Button Configure via Client PinCode ay E 41 al m Configured DrayTek _2860_130 Mixed WPA WPAZ2PSK OOOO o i Note WPS can help your wireless client automatically connect to the Access point WPS is Disabled WPS is Enabled Waiting for WPS requests from wireless clients Available settings are explained as follows Item Enable WPS WPS Status SSID Authentication Mode Configure via Push Button Configure via Client PinCode Vigor2860 Series User s Guide Description Check this box to enable WPS setting Display related system information for WPS If the wireless security encryption function of the router is properly configured you can see Configured message here Display the SSID1 of the router WPS is supported by SSID1 only Display current authentication mode of the router Only WPA2 PSK and WPA PSK support WPS Click Start PBC to invoke Push Button style WPS setup procedure The router will wait for WPS requests from wireless clients about two minutes The WPS LED on the router will blink fast when WPS is in progress It will return to normal condition after two minutes You need to setup WPS within two minutes Please input the PIN code specified in wireless client you wish to connect and click Start PIN button The WPS LED on the router will blink fast when WPS is in progress It will return to normal condition after two minutes You need to setup
453. onnected to Vigor2860 Encryption Display the encryption mode used by the access point Ch Display the channel used by the access point WL Client Display the number of wireless clients stations connecting to the access point In which 0 64 means that up to 64 clients are allowed to connect to the access point But now no one connects to the access point The number displayed on the left side means 2 4GHz and the Vigor2860 Series User s Guide 316 Dray Tek number displayed on the right side means 5Ghz Version Display the firmware version used by the access point Password Vigor2860 can get related information of the access point by accessing into the web user interface of the access point This button is used to modify the logging password of the connected access point 3 14 2 WLAN Profile WLAN profile is used to apply to a selected access point It is very convenient for the administrator to configure the setting for access point without opening the web user interface of the access point Central AP Management gt gt WLAN Profile Set to Factory Default Default DrayTek LAN A WA LA APA Se Enable Cancel Check the box on the left side of the selected profile to modify the content of the profile The Clone Edit and Apply To Device buttons will be available then Central AP Management gt gt WLAN Profile Set to Factory Default Default DrayTek LAN A WPAN PLA PSE Enable Available settings
454. onnection through 3G 4G USB Modem please configure WANS or WAMN4 interface WAN gt gt General Setup WAN 3 Enable Display Name Physical Mode Line SpeedfkKbps DownLink Uplink Active Mode Load Balance OWwan iU wan 2 Wan aL WAN 4 Backup Type Only if acting as backup for When any of selected WAN disconnect multiple WANS O when all of selected WAN disconnect Note The line speed setting of WAN interface is available only when According ta Line Speed is selected as the Load Balance Mode Available settings are explained as follows Item Description Enable Choose Yes to invoke the settings for this WAN interface Choose No to disable the settings for this WAN interface Display Name Type the description for such WAN interface Physical Mode Display the physical mode of such WAN interface Line Speed If your choose According to Line Speed as the Load Balance Mode please type the line speed for downloading and uploading for such WAN interface The unit is kbps Vigor2860 Series User s Guide 80 Dr ay Tek Active Mode Choose Always On to make the WAN3 connection being activated always Always On Aly T 5 D n Backup Load Balance Check this box to enable auto load balance function for such WAN interface When the data traffic is large the WAN interface with the function enabled will balance the data transmission automatically among all of the WAN interfaces in connection status
455. oose PC to select one Choose PC Click this button and subsequently a window having a list of private IP addresses of local hosts will automatically pop up Select the appropriate IP address of the local host in the list Protocol Specify the transport layer protocol It could be TCP UDP Or none for selection Start Port Specify the starting port number of the service offered by the local host End Port Specify the ending port number of the service offered by the local host Vigor2860 Series User s Guide 162 Dr ay Te k After finishing all the settings here please click OK to save the configuration NAT gt Open Ports Open Ports Setup Setto Factory Default Index Comment WAN Interface Local IP Address Status P2701 WANI 192 168 1 49 W P Pee Pp SF FF o Ea 3 4 4 Port Triggering Port Triggering is a variation of open ports function The key difference between open port and port triggering 1s Once the OK button is clicked and the configuration has taken effect open port keeps the ports opened forever Once the OK button is clicked and the configuration has taken effect port triggering will only attempt to open the ports once the triggering conditions are met The duration that these ports are opened depends on the type of protocol used The default durations are shown below and these duration values can be modified via telnet commands TCP 86400 sec UDP 180 sec IGMP 10 sec
456. oose Ping Detect as detection mode you have to type IP address in this field for pinging TTL Time to Live Displays value for your reference TTL value is set by telnet command It means Max Transmit Unit for packet The default setting is 1492 PPP Authentication Select PAP only or PAP or CHAP for PPP Idle Timeout Set the timeout for breaking down the Internet after passing through the time without any action Usually ISP dynamically assigns IP address to you each time you connect to it and request In some case your ISP provides service to always assign you the same IP address whenever you request In this case you can fill in this IP address in the Fixed IP field Please contact your ISP before you want to use this function WAN IP Alias If you have multiple public IP addresses and would like to utilize them on the WAN interface please use WAN IP Alias You can set up to 8 public IP addresses other than the current one you are using Type the additional WAN IP address and check the Enable box Then click OK to exit the dialog o WANIP Alias MEAS 1 2 16 3 143 2560 iocAvipalias htm WAN IP Alias Multi NAT Index Enable Aux WAN IP Join NAT IP Pool 10 39 0 10 x 10 39 0 150 0 0 0 0 0 0 0 0 0 0 0 0 0 0 LI d LI d L O g 17 24 25 32 gt gt Fixed IP Click Yes to use this function and type in a fixed IP address in the box of Fixed IP Address Default M
457. ording to the chosen condition The default setting is Auto Logout which means the web configuration system will logout after 5 minutes without any operation Change the setting for your necessity 1 6 Changing Password Please change the password for the original security of the router 1 Open a web browser on your PC and type http 192 168 1 1 A pop up window will open to ask for username and password 2 Please type admin admin as Username Password for accessing into the web user interface with admin mode 3 Goto System Maintenance page and choose Administrator Password Vigor2860 Series User s Guide 18 Dray Tek System Maintenance gt gt Administrator Password Setup Administrator Password old Password Hew Password OoOo Max 23 characters allowed Confirm Password Max 23 characters allowed Note Password can contain only a z 4 4 0 9 lt gt 7 08710 Administrator Local User C Local User Local User List Specific User Password Confirm Password Enable Admin Login From Wan 4 Enter the login password the default is admin on the field of Old Password Type New Password and Confirm Password Then click OK to continue Note The maximum length of the password you can set is 23 characters 5 Now the password has been changed Next time use the new password to access the Web user interface for this router DrayTek fei eine Grou
458. ording to the different service providers If you have and activate another web content filter license the items will be changed simultaneously All of the configuration made for web content filter will be deleted automatically Therefore please backup your data before you change the web content filter license CSM gt gt Web Content Filter Profile Profile Index 1 Profile Name Default Black White List Enable Action Group Object Selections a Action Groups Categories Child Protection Alcohol amp Tobacco Hate amp Intolerance Porn amp Sexually Ml Cabral Chestinag Li News U Politics O Restaurants amp Dining O General l image Sharing O Frivate IP Addresses Criminal Activity legal Drug Violence Ml cay Edpestian Non profits amp NGOs Real Estate Shopping C Cults Network Errors Uncategorised Sites OK Cancel Dray Tek 29 Log Block Gambling Nudity Weapons I Tactalece Personal Sites LI Religion C Translators O Greeting cards C Parked Domains Vigor2860 Series User s Guide Available settings are explained as follows Item Description Profile Name Type a name for the CSM profile The maximum length of the name you can set is 15 characters Black White List Enable Activate white black list function for such profile Group Object Selections Click Edit to choose the group or object profile as the content of white b
459. ort Router Name Mail To Server IP address ss Return Path Destination Port Use SSL Mail Syslog Enable Authentication Enable syslog message Firewall Log PN Log User Access Log WAN Log Router DSL information AlertLog Setup Enable AlertLog Port Username Password Enable E Mail Alert DoS Attack IM P2p YVEN LOG Note 1 Mail Syslog cannot be activated unless USB Disk is ticked for Syslog Save to 2 Mail Syslog feature sends a Syslog file when its size reaches 1M Bytes 3 We only support secured SMTP connection on port 465 Available settings are explained as follows Item SysLog Access Setup Router Name Dray Tek Description Enable Check Enable to activate function of syslog Syslog Save to Check Syslog Server to save the log to Syslog server Check USB Disk to save the log to the attached USB storage disk Display the name for such router configured in System Maintenance gt gt Management If there is no name here simply lick the link to access into System Maintenance gt gt Management to set the router name Server IP Address The IP address of the Syslog server Destination Port Assign a port for the Syslog protocol Mail Syslog Check the box to recode the mail event on Syslog Enable syslog message Check the box listed on this web page to send the corresponding message of firewall VPN User Access Call WAN Router DSL information to 407 Vigor2860 Series Use
460. ose one of the following methods AH or ESP for the security of data transmission For example choose AH to specify the IPsec protocol for the Authentication Header protocol The data will be authenticated but not be encrypted Encryption Type Choose one of the selections as the encryption type Local Subnet Type the IP address and subnet mask of local host After finishing all the settings here please click OK to save the configuration Vigor2860 Series User s Guide 306 Dr ay Te k 3 13 2 CPE Management All the CPEs managed by Vigor2860 series can be seen with icons from this page Before using such feature make sure the CVM port has been enabled and configured properly 3 13 2 1 Managed Device List This page allows you to manage the CPEs connected to Vigor2860 series Page without CPE connected CWM gt CPE Management gt Managed Devices List Managed Devices List CPE Maintenance Google Map Refresh Managed Devices List Unmanaged Devices List IP Address Mac Address roe at Description Name Location Add Page with CPE connected CWM gt CPE Management gt Managed Devices List Managed Devices List CPE Maintenance Google Ma Managed Devices List Aai gt eer ONO POC PEX Intemet _ SH PEX Intemet2_ 220 132 9749 122 116 221 6 11 226 49 196 220 128 230 121 Refresh CS GW HQ PBX KDS PBX Eric Test 58 210 69 130 0 250 189 148 220 130 51 77 220 128 228 219 a a Edit De
461. otification Object Profile Index 1 Profile Name WAN Notify Category Status VPN Tunnel Disconnected Reconnected Temperature Alert Clout of Range Dray Te k 471 Vigor2860 Series User s Guide 7 After finished the settings click OK to return to previous page You have finished the configuration of the notification object profile setting Object Settings gt gt Notification Object Setto Factory Default Index Profile Name Settings 1 WAN_Notify WAN Pi iP Pe eS 8 Now open Application gt gt SMS Mail Alert Service Use the drop down list to choose SMS Provider and the Notify Profile specify the time of sending SMS Then type the phone number in the field of Recipient the one who will receive the SMS Application gt gt SMS Mail Alert Service SMS Provider Mail Server Setto Factory Default Index SMS Provider Recipient Notify Profile schedule 1 15 1 1 Local number 0912345678 1 WAN_Notify J 20 it 30 ot 40 O o 5 O o 6 O O o 70 O o 8 OO o 20 O I 1 O O o 9 Click OK to save the settings Later if one of the WAN connections fails in your router the system will send out SMS to the phone number specified If the router has only one WAN interface the system will send out SMS to the phone number while reconnecting the WAN interface successfully Vigor2860 Series User s Guide 472 Dr ay Te k Remark How the customize the SMS Provider Choose one of the Index
462. our ISP does not provide it the router will automatically apply default DNS Server IP address 194 109 6 66 to this field Secondary IP Address You can specify secondary DNS server IP address here because your ISP often provides you more than one DNS Server If your ISP does not provide it the router will automatically apply default secondary DNS Server IP address 194 98 0 1 to this field The default DNS Server IP address can be found via Online Status Online Status Physical Connection System Uptime 22 22 45 IPv4 IPv6 LAN Status Primary DNS 8 8 8 8 Secondary DNS 8 8 4 4 IP Address TX Packets RX Packets 192 168 1 1 0 41533 If both the Primary IP and Secondary IP Address fields are left empty the router will assign its own IP address to local 130 DrayTek users as a DNS proxy server and maintain a DNS cache If the IP address of a domain name is already in the DNS cache the router will resolve the domain name immediately Otherwise the router forwards the DNS query packet to the external DNS server by establishing a WAN e g DSL Cable connection When you finish the configuration please click OK to save and exit this page Details Page for IP Routed Subnet LAN gt General Setup TCPAP and DHCP Setup for IP Routed Subnet Network Configuration OQcEnable Disable For Routing Usage DHCP Server Configuration Start IP 4ddress 1927 166 0 10 IF Pool Counts oo max 32 IP Address 192 168 0 1
463. our dealer for further help right away For any questions please feel free to send e mail to support Dray Tek com Dray Te k 525 Vigor2860 Series User s Guide This page is left blank Vigor2860 Series User s Guide 526 Dr ay Tek Appendix l VLAN Applications on Vigor Router Virtual Local Area Network is so called VLAN It offers the logical grouping technique to separate the physical ports of Ethernet switches thus we can management our local network easier more flexible and secure For instance you re a networking administrator in your company and you re planning to isolate the visitors traffics from your private network for security considerations because you cannot ensure that visitors computer is clean Or you want to separate your private network into several parts by divisions because there are too many computers in the same network segment and it results in the local traffics heavily VLAN helps you to solve these situations and DrayTek s products support bellow two popular types Port based It uses a matrix table of the physical ports to define the traffics how to exchange between each port and the traffics will be isolated from the ports are not being ticked in the same line It is the easiest way to setup an isolate network but not a flexible way to maintain a growing network Because the idea of port based VLAN is grouping by physical ports but the difficulty is how to handle the traffics between two or
464. out You can click the Schedule 1 15 link to define the schedule After finishing all the settings here please click OK to save the configuration 3 10 10 Bonjour Bonjour is a service discovery protocol which is a built in service in Mac OS X for Windows or Linux platform there are correspondent software to enable this function for free Usually users have to configure the router or personal computers to use above services Sometimes the configuration e g IP settings port number is complicated and not easy to complete The purpose of Bonjour is to decrease the settings configuration e g IP setting If the host and user s computer have the plug in bonjour driver install they can utilize the service offered by the router by clicking the router name icon In short what the Clients users need to know is the name of the router only To enable the Bonjour service click Application gt gt Bonjour to open the following page Check the box es of the server service s that you want to share to the LAN clients Applications gt gt Bonjour Bonjour Setup HTTP Server Telnet Server FIP Server SSH Server LPR Printer Server m i i Below shows an example for applying the bonjour feature that Vigor router can be used as the FTP server 1 Here we use Firefox and DNSSD to discover the service in such case Therefore just ensure the Bonjour client program and DNSSD for Firefox have been installed on the computer
465. outing Information Protocol is abbreviated as RIP RFC1058 specifying how routers exchange routing tables information Click Enable RIP for activating this function If you choose Bridged IP as the protocol you can check this box to invoke the function The router will work as a bridge modem This group allows you to obtain an IP address automatically and allows you type in IP address manually WAN IP Alias If you have multiple public IP addresses and would like to utilize them on the WAN interface please use WAN IP Alias You can set up to 8 public IP addresses other than the current one you are using Notice that this setting is available for WAN1 only Type the additional WAN IP address and check the Enable box Then click OK to exit the dialog 4 Dray Tek Dray Tek DNS Server IP Address WANLIP Alias AHAZTE alal x 0 172 16 3 143 2960 docvipalias htm WAN1 IP Alias Multi NAT Index Enable Aux WAN IP Join NAT IP Pool d LI d d d E ad nm 17 24 25 32 gt gt Obtain an IP address automatically Click this button to obtain the IP address automatically Router Name Type in the router name provided by ISP Domain Name Type in the domain name that you have assigned DHCP Client Identifier for some ISP Enable Check the box to specify username and password as the DHCP client identifier for some ISP Username Type a name as username The maximum length of the user
466. p Note Even the password is changed the Username for logging onto the web user interface is still admin Dr ay Tek 19 Vigor2860 Series User s Guide 1 7 Introducing Dashboard Dashboard shows the connection status including System Information Pv4 Internet Access IPv6 Internet Access Interface physical connection Security and Quick Access Click Dashboard from the main menu on the left side of the main page A web page with default selections will be displayed on the screen Refer to the following figure ll Dashboard eo larro rov hyl Vigor2860n plus Oo k kA 9 jie m a J elk ee Security Firewall P Wireleas LAH e Led b ON OFF WPS bo amp i Za i USB DSL WCF VOSLIADSL WAN2 Giga GigaLAN 1 2 3 4 5 Fackry D z an DoS use Reset 24G 56 System Information Model Name Vigor2860n System Wo Time 0 56 37 em Status lamic DNS Router Name si erent Time 2014 Apr 1 Tue 6 32 33 Firmware Version 3 7 4 1 Build Date Time Mar 20 2014 14 09 50 DSL Version 548006_ 4 LAN MAC Address 00 1D 44 B6 1B B8 User Management IPv4 Internet Access Log Mail Alert WAN2 Ethernet Static IP 172 16 3 133 O0 1D AA B6 1B BA 05627 WANS Firewall Object Setting wana use Disconnected _ 00 10 AA B6 1B BC_ 00 00 00 Interface Connected 2 WANI1 WAN OWANS oY WANE Connected 4 LAN1 LAN LAN LAN4 LANS LANG Connected 0O lt USB
467. p the selected IP See the following figure The result will be shown on the box Vigor2860 Series User s Guide 262 Dr ay Te k Application gt gt Wake on LAN Wake on LAN Note Wake on LAN integrates with Bind IP to MAC function only binded PCs can wake up through IP Wake by MAC Address IP Address mac address C YE YK 4 Result Send command to client done 3 10 9 SMS Mail Alert Service The function of SMS Short Message Service Mail Alert is that Vigor router sends a message to user s mobile or e mail box through specified service provider to assist the user knowing the real time abnormal situations Vigor router allows you to set up to 10 SMS profiles which will be sent out according to different conditions SMS Provider This page allows you to specify SMS provider who will get the SMS what the content is and when the SMS will be sent Application gt SMS Mail Alert Service SMS Provider Mail Server Setto Factory Default Index SMS Provider Recipient Notify Profile Sschedule 1 15 3 Ld 30 otify_atta Ld fe ee e CE 6 o IL 70 T O o 8 o P n Io 9 IL 10 O 7 fe a Available settings are explained as follows Item Description Index Check the box to enable such profile SMS Provider Use the drop down list to choose SMS service provider You can click SMS Provider link to define the SMS server Dr ay Tek 263 Vigor2860 Series User s Guide Recipient Not
468. pe 5 After finishing all the settings here please click OK to save the configuration By the way you can set up to 10 service types If you want to edit delete an existed service type please select the radio button of that one and click Edit Edit for modification Vigor2860 Series User s Guide 244 Dr ay Te k Retag the Packets for Identification Packets coming from LAN IP can be retagged through QoS setting When the packets sent out through WAN interface all of them will be tagged with certain header and that will be easily to be identified by server on ISP For example in the following illustration the VoIP packets in LAN go into Vigor router without any header However when they go forward to the Server on ISP through Vigor router all of the packets are tagged with AF configured in Bandwidth gt gt QoS gt gt Class automatically QoS Class 1 VolP QoS Class 2 HTTP QoS Class 3 Mail D Bandwidth iMag gt gt Quality of Service Class Index 1 Name E Taq packets as AF Clase High Dicp NO Status Local Address Remote Address ay Service Type CodePaint i F Active Any Any any ANY Dr ay Tek 245 Vigor2860 Series User s Guide 3 10 Applications Below shows the menu items for Applications 3 10 1 Dynamic DNS The ISP often provides you with a dynamic IP address when you connect to the Internet via your ISP It means that the public IP address assigned to your router change
469. pe the text to memorize the application of this rule Triggering Protocol Select the protocol TCP UDP or TCP UDP for such triggering profile Vigor2860 Series User s Guide 164 Dr ay Te k Triggering Port Type the port or port range for such triggering profile Incoming Protocol When the triggering packets received it is expected the incoming packets will use the selected protocol Select the protocol TCP UDP or TCP UDP for the incoming data of such triggering profile Incoming Port Type the port or port range for the incoming packets After finishing all the settings here please click OK to save the configuration Dr ay Te k 165 Vigor2860 Series User s Guide 3 5 Firewall 3 5 1 Basics for Firewall While the broadband users demand more bandwidth for multimedia interactive applications or distance learning security has been always the most concerned The firewall of the Vigor router helps to protect your local network against attack from unauthorized outsiders It also restricts users in the local network from accessing the Internet Furthermore it can filter out specific packets that trigger the router to build an unwanted outgoing connection Firewall Facilities The users on the LAN are provided with secured protection by the following firewall facilities User configurable IP filter Call Filter Data Filter Stateful Packet Inspection SPI tracks packets and denies unsolicited incoming data Selec
470. pe you to activate Dr ay Tek 49 Vigor2860 Series User s Guide 5 Wait fora moment till the following page appears Service Activation Wizard Connection Succeeded Please check the following item s to enable services on your router Enable Web Content Filter When such page appears you can enable or disable these services for your necessity Then click Finish Note The service will be activated and applied as the default rule configured in Firewall gt gt General Setup 6 Now the web page will display the service that you have activated according to your selection s The valid time for the free trial of these services is one month Service Activation Wizard Server Enabled DrayTek Service Activation Service Name Start Date Expire Date Status Web Content filter 2013 02 18 2013 03 21 Commtouch Please check if the license fits with the service provider of your signature To ensure normal operation for your router update your signature again is recommended Copyright DrayTek Corp all Rights Reserved Later if you need to extend the license valid time for the same service you can also use the Service Activation Wizard again to reach your goal by clicking the radio button of Formal edition with license key and clicking Next Vigor2860 Series User s Guide 50 Dr ay Te k Service Activation Wizard Select the service type that you want to activate This wizard is used for activating Web Content Filter
471. pears click Register a Apply For A License Number About Us Product My Information Serice Name WCF VigorACS SI STEP 2 aii alt Activation Date MM DD YYYY 03 16 2011 i Customer Survey 12 Wait for a moment until the following page appears DrayTek Service Activation Service Name Start Date Expire Date Status Web Content filter 2011 03 28 011 04 27 Commtouch Please check if the license fits with the service provider of your signature To ensure normal operation for your router update your signature again is recommended Copyright DrayTek Corp All Rights Reserved Close 13 Click Close Vigor2860 Series User s Guide 72 Dray Tek 3 3 1 WAN Advanced Configuration This chapter will guide users to execute web configuration 1 Open a web browser on your PC and type http 192 168 1 1 The window will ask for typing username and password 2 Please type admin admin on Username Password for administration operation Now the Main Screen will appear Note that different model will have different web pages Dray Tek Dashboard Wizards Online Status Load BalanceRoute Policy Firewall User Management Objects Setting CSM Bandwidth Management Applications VPN and Remote Access Certificate Management Central VPN Management Central AP Management Wireless LAN 2 4 GHz Wireless LAN 5 GHz SSL VPN USB Application Vigor 2860 Series Dashboar
472. pecific DNS Suffix TP padre y a 192 168571 e TEEGEE rC Ty Ba eet ON S Coe oe k leh Gateway o o sc oe we m a a De beds fe60 250 74ff if eea feels Ethernet adapter DrayTek Virtual Interface Media State a wiere 6 ee a ps a Media ttieconnected From the above figure we can see IPv6 IP address has been captured by the system Use the Ping command to ping any IPv6 address indicating an IPv6 website For example www kame net is a website supporting IPv4 IP and IPv6 IP services Its IPv6 address is seen with a format of 2001 200 dff fff1 216 3eff feb1 44d7 ae CAWINDO WS system32 emd exe ox teply from 2001 200 r2lb Febl 44d time 43mne teply from 2001 200 dff fff1 216 3eff febl 4447 tine 623ms feply fron 2001 2010 r2lo 3ett t ebl 44a7 tine b Zone teply fron 2001 200 cale Geff febl 44d tite 6 lime STT 216 3eff febl 44d7 Packets Sent 4 Received 4 Lost 0 0 lows Approximate round trip tines in willi secends Hinimun 61 mne Maximum 74ans Average 652me C Documents and Settings Owner gt After getting the above message it means the IPv6 service has been activated successfully Vigor2860 Series User s Guide 444 Dray Tek Connect to the website for IPv6 Open a web browser and type an URL of IPv6 e g www kame net If your computer accesses into the website by using IPv6 address you may see a turtle dancing on the screen If not only a steady turtle
473. plained as follows Item Description Name Type a name for this profile Maximum 15 characters are allowed Interface Choose WAN LAN or Any to display all the available IP objects with the specified interface Available IP Objects All the available IP objects with the specified interface chosen above will be shown in this box Selected IP Objects Click gt gt button to add the selected IP objects in this box 3 After finishing all the settings here please click OK to save the configuration Vigor2860 Series User s Guide 198 Dr ay Tek 3 7 3 IPv6 Object You can set up to 64 sets of IPv6 Objects with different conditions Objects Setting gt IPv6 Object IPv6 Object Profiles Index Name Index Name la la l lS le SB is e im e m e e Ip e IS S E amp SE le E e e e le le R 33 64 gt gt Next gt my mh Cag ho Available settings are explained as follows Item Description Set to Factory Default Clear all profiles Index Display the profile number that you can configure Name Display the name of the object profile To set a new profile please do the steps listed below 1 Click the number e g 1 under Index column for configuration in details 2 The configuration page will be shown as follows Objects Setting gt IPv6 Object Profile Index 16 Address Type Mac Address Start IP Address End IP Address Prefix Length Invert Selection Dr ay Tek 199 Vigor28
474. play the number of the client which connecting to FTP server Name Display the name of the group profile Click any index number link to open the following page for detailed configuration SSL VPN gt User Group Index No 1 Enable Group Name SSL_group1 Access Authority C SSL Web Proxy C SSL Application Authentication Methods C Local User DataBase Available User Accounts Selected User Accounts d C RADIUS L LDAP Active Directory Available settings are explained as follows Dray Te k 383 Vigor2860 Series User s Guide Item Enable Group Name Access Authority Authentication Methods Description Check this box to enable such profile Type a name for such profile The length of the name is limited to 23 characters Specify the authority for such profile At present Vigor router allows you to create SSL Web Proxy and SSL Application profiles used for SSL VPN The available profiles will be displayed here for you to select Access Authority SSL Web Proxy SSL Application LISSL_wP_1 O Game_APP It can determine the authentication method used for such profile Local User DataBase The system will do the authentication by using the user defined account profiles in VPN and Remote Access gt gt Remote Dial In User The enabled profiles will be listed in the Available User Account on the left box To add a profile into a group simply choose the one from the left box and click the gt gt
475. points that will be applied by such function after clicking OK After finishing all the settings here please click OK to perform the action Vigor2860 Series User s Guide 322 Dr ay Tek 3 14 4 Traffic Graph Click Traffic Graph to open the web page Choose one of the managed Access Points LAN A or LAN B daily or weekly for viewing data transmission chart Click Refresh to renew the graph at any time Note Enabling Disabling such function will also enable disable the External Devices function Central AP Management gt gt Traffic Graph Enable Show Chart VigorAP900 VigorAPsoo LAN A iieekly Ww Refresh Minfsi 1 Refresh Note Enabling Disabling AF Traffic Graph will also Enable Disable the External Devices Function The horizontal axis represents time the vertical axis represents the transmission rate in kbps 3 14 5 Rogue AP Detection It displays the access point scanned by Vigor router In which the APs will be classified with friendly APs rogue APs and unknown APs in different colors Central AP Management gt Rogue AP Detection Rogue AP Detection Enable O Neighbor AP Detection Local WLAN Detection AILAPS 7 w Refresh Mints i Refresh Note Green Friendly APs Red Roque APs Black Unknown APs h ou 1 m Vigor2860 doesn t apply any security policies to Rogue AP List Below shows the detected APs by clicking OK Dray Tek 3
476. pplicable when you select PPTP or L2TP with or without IPsec policy above The length of the password is limited to 11 characters VJ Compression VJ Compression is used for TCP IP protocol header compression This field is applicable when you select PPTP or L2TP with or without IPsec policy above IKE Authentication Method This group of fields is applicable for IPsec Tunnels and L2TP with IPsec Policy when you specify the IP address of the remote node The only exception is Digital Signature X 509 can be set when you select Psec tunnel either with or without specify the IP address of the remote node Pre Shared Key Check the box of Pre Shared Key to invoke this function and type in the required characters 1 63 as the pre shared key Digital Signature X 509 Check the box of Digital Signature to invoke this function and select one predefined Profiles set in the VPN and Remote Access gt gt IPsec Peer Identity Local ID Specify which one will be inspected first E Alternative Subject Name First The alternative subject name configured in Certificate Management gt gt Local Certificate will be inspected first E Subject Name First The subject name configured in Certificate Management gt gt Local Certificate will be inspected first IPsec Security Method This group of fields is a must for IPsec Tunnels and L2TP with IPsec Policy when you specify the remote node Medium Authentication
477. provided here Different type will lead to different configuration page After making the choices for the client profile please click Next You will see different configurations based on the selection s you made 53 Vigor2860 Series User s Guide Note The following descriptions for VPN Type are based on the Route Mode specified in LAN to LAN Client Mode Selection When you choose PPTP None Encryption or PPTP Encryption you will see the following graphic VPN and Remote Access gt gt VPN Client Wizard VPN Client PPTP Encryption Settings Profile Name 27 VPN Dial Out Through WAN First L Always on Server IP Host Name for VPN e g draytek com or 123 45 67 89 raytek com Username Password Remote Network IP Remote Network Mask O When you choose IPsec you will see the following graphic VPN and Remote Access gt gt VPN Client Wizard VPN Client IPsec Settings Profile Name F7 WPN Dial Out Through WANT First w L Always on Server IP Host Name for VPN e g draytek com or 123 45 67 89 IKE Authentication Method Pre Shared Key I Confirm Pre Shared Key Digital Signature x 509 Peer ID Local ID Alternative Subject Name First Subject Name First Local Certificate IPsec Securily Melhud Medium AH High ESP Remote Network IP 0 0 0 0 Remote Network Mask 255 255 255 0 When you choose L2TP you will see the following graphic Vigor2860 Series
478. r s Guide Syslog AlertLog Setup Check Enable to activate function of alert log AlertLog Port Type the port number for alert log The default setting is 514 Mail Alert Setup Check Enable to activate function of mail alert Send a test e mail Make a simple test for the e mail address specified in this page Please assign the mail address first and click this button to execute a test for verify the mail address is available or not SMTP Server SMTP Port The IP address Port number of the SMTP server Mail To Assign a mail address for sending mails out Return Path Assign a path for receiving the mail from outside Use SSL Check this box to use port 465 for SMTP server for some e mail server uses https as the transmission method Authentication Check this box to activate this function while using e mail application User Name Type the user name for authentication Password Type the password for authentication Enable E mail Alert Check the box to send alert message to the e mail box while the router detecting the item s you specify here Click OK to save these settings For viewing the Syslog please do the following 1 Just set your monitor PC s IP address in the field of Server IP Address 2 Install the Router Tools in the Utility within provided CD After installation click on the Router Tools gt gt Syslog from program menu fm Router Tools 2 5 1 G About Router Tools a Firmware Upera
479. r setting the phone book VoIP gt DialPlan Setup Phone Book Index Phone number Display Name SIP URL Penna Loop through sae Status A Default Hone n 2 Default None 4 3 Default None W 4 Default Morne W 5 Default Mone A 6 Default Hone i 7 Mefarilt Kane y 16 Default None i Default None vd 18 Default Hone w 19 Default None x 20 Default None W lt lt 140 2140 4160 gt gt Next gt gt Status v Active 4 Inactive Click any index number to display the dial plan setup page VoIP gt gt DialPlan Setup Phone Book Index No 1 Enable Phone Number Display Name SIP URL mmo Jo Dial Out Account Default Loop through Backup Phone Number Available settings are explained as follows Item Description Enable Click this to enable this entry Phone Number The speed dial number of this index This can be any Vigor2860 Series User s Guide 332 Dr ay Tek number you choose using digits 0 9 and Display Name The Caller ID that you want to be displayed on your friend s screen This let your friend can easily know who s calling without memorizing lots of SIP URL Address SIP URL Enter your friend s SIP Address Dial Out Account Choose one of the SIP accounts for this profile to dial out It is useful for both sides caller and callee that registered to different SIP Registrar servers If caller and callee do not use the same SIP server sometimes the VoIP phon
480. r Cancel Available settings are explained as follows Item Description Enable Dynamic Check this box to enable the current account If you did DNS Account check the box you will see a check mark appeared on the Active column of the previous web page in step 2 Dr ay Te k 247 Vigor2860 Series User s Guide WAN Interface Service Provider Service Type Domain Name Login Name Password Wildcard and Backup MX Mail Extender Determine Real WAN IP WANI WAN2 WANS First While connecting the router will use WAN1 WAN2 WANS3 as the first channel for such account If WANI WAN2 WAN3 fails the router will use another WAN interface instead WANI WAN2 WANS Only While connecting the router will use WANI WAN2 WANS3 as the only channel for such account WANT First WAMI First Select the service provider for the DDNS account Select a service type Dynamic Custom or Static If you choose Custom you can modify the domain that is chosen in the Domain Name field Type in one domain name that you applied previously Use the drop down list to choose the desired domain Type in the login name that you set for applying domain Type in the password that you set for applying domain The Wildcard and Backup MX Mail Exchange features are not supported for all Dynamic DNS providers You could get more detailed information from their websites If the mail server is defined with another name please type the name
481. r IP network VoIP enables you to use your broadband Internet connection to make toll quality voice calls over the Internet There are many different call signaling protocols methods by which VoIP devices can talk to each other The most popular protocols are SIP MGCP Megaco and H 323 These protocols are not all compatible with each other except via a soft switch server The Vigor V models support the SIP protocol as this is an ideal and convenient deployment for the ITSP Internet Telephony Service Provider and softphone and is widely supported SIP is an end to end signaling protocol that establishes user presence and mobility in VoIP structure Every one who wants to talk using his her SIP Uniform Resource Identifier SIP Address The standard format of SIP URI is sip user password host port Some fields may be optional in different use In general host refers to a domain The userinfo includes the user field the password field and the sign following them This is very similar to a URL so some may call it SIP URL SIP supports peer to peer direct calling and also calling via a SIP proxy server a role similar to the gatekeeper in H 323 networks while the MGCP protocol uses client server architecture the calling scenario being very similar to the current PSTN network After a call is setup the voice streams transmit via RTP Real Time Transport Protocol Different codecs methods to compress and encode
482. r to the red rectangle for choosing the correct protocol and LPR name Configure Standard CP IP Port Monitor Port Settings Port Name IP_192 168 1 1 Printer Name or IP Address 192 168 1 1 Protocol O Baw LPR Raw Settings LPR Settings Queue Name _ LPR Byte Counting Enabled C SNMP Status Enabled pub L Dr ay Te k 15 Vigor2860 Series User s Guide The printer can be used for printing now Most of the printers with different manufacturers are compatible with vigor router Note 1 Some printers with the fax scanning or other additional functions are not supported If you do not know whether your printer is supported or not please visit www draytek com to find out the printer list Open Support gt FAQ Application Notes find out the link of USB gt gt Printer Server and click it D Ti k MyVigor Register E newsletter DrayTek HQ Media Center About DrayTek Global English v Products Solutions Multi Media Demo Contact Us FAQ Application You are here Home Supports FAQ Application Notes Printer Server USB 4G Interne Connection Then click the What types of printers are compatible with Vigor router link FAQ Application You are here Home Supports FAQ Application Notes Printer Server Latest FAQ Application Basic Printer Server Firmware Upgrade What types of printers are compatibl
483. ral Mode Alfa 192 168 0 26 492 168 2 103 Load Balance Mode VpnBackup i VpnBackup 192 168 2 203 Dial Click this button to execute dial out function Refresh Seconds Choose the time for refresh the dial information among 5 10 and 30 Refresh Click this button to refresh the whole connection Status 3 12 Certificate Management A digital certificate works as an electronic ID which is issued by a certification authority CA It contains information such as your name a serial number expiration dates etc and the digital signature of the certificate issuing authority so that a recipient can verify that the certificate is real Here Vigor router support digital certificates conforming to standard X 509 Any entity wants to utilize digital certificates should first request a certificate issued by a CA server It should also retrieve certificates of other trusted CA servers so it can authenticate the peer with certificates issued by those trusted CA servers Here you can manage generate and manage the local digital certificates and set trusted CA certificates Remember to adjust the time of Vigor router before using the certificate so that you can get the correct valid period of certificate Below shows the menu items for Certificate Management a rtificate Backup 3 12 1 Local Certificate Certificate Management gt Local Certificate X 509 Local Certificate Configuration Name Subject S
484. ral Setup LAN 1 Ethernet TCP IP and DHCP Setup LAN 71 IPv6 Setup RADVD Configuration Enable Disable Advertisement Lifetime i800 Seconds Range 600 9000 DHCP vo Server Conmfiquration Enable Server O Disable Server Start IPv Address OO 1111 2909 3333 1111 End IPv Address 001111 2939 33 33 9999 DNS Server IPv6 Address Primary DNS Server 17001 4860 4860 5688 Secondary DNS Server 001 4S60 4860 0844 Static IPv Address configuration IF Address i Pretis Length i Yo 7 Add Delete Current IPv Address Table Index IPy6 Addresa Prefix Length Scope 1 FESO 21D BAFF FEAG 2565764 Link 2 Inthe field of RADVD Configuration the default setting is Enable The client s PC will ask RADVD service for the Prefix of IPv6 address automatically and generate an Interface ID by itself to compose a full and unique IPv6 address 3 In the field of DHCPv6 Server Configuration when DHCPV6 service is enabled you can assign available IPv6 address for the client manually Dr ay Tek 443 Vigor2860 Series User s Guide lll Confirming IPv6 Service Run Successfully l Make sure you have get the correct IPv6 IP address Get into MS DOS interface and type the command of ipconfig Refer to the following figure Gy CAWINDO WSieystem3 2 cmd exe EEN C Documents and Settings Uwner ipcont ig Windows IP Configuration thernet adapter Test Line 5 Connectinon s
485. ral Setup Mode Notice 1 User Management will refer to active rules in Data Filter as whitelists and blacklists in user based firewall mode 2 Users match the above lists will not be required for authentication The firewall rules policy will still valid 3 Otherwise authentication required for users not matched the above lists The firewall rules designated in the user profile s policy will still valid Landing Page Max 255 characters Preview Setto Factory Default Login success 3 Now you can enable the Landing Page function Open User Management gt User Profile and click one of the index number e g index number 3 links User Management gt User Profile User Profile Table Profile Name admin Dial In User gt bf me Vigor2860 Series User s Guide 466 Dr ay Tek 4 In the following page check the box of Landing page and click OK to save the settings User Management gt User Profile Profile Index 3 oe Enable this account User Name Password esse sid Confirm Password O Idle Timeout min s O Unlimited Max User Login O Unlimited External Server Authentication Pop Browser Tracking Window Authentication Web Alert Tool Telnet Enable Time Quota mints Refresh more mints Index 1 15 in Schedule Setup O 5 Open any browser e g FireFox Internet Explorer The logging page will appear and asks for username and password Please type the correct u
486. rds the Vigor router will decline the connection request to the website whose URL string matched to any user defined keyword It 225 Vigor2860 Series User s Guide Web Feature Vigor2860 Series User s Guide should be noticed that the more simplified the blocking keyword list is the more efficiently the Vigor router performs Object Group Edit Keyword Object None or Keyword Object None or Keyword Object None or Keyword Object None or Keyword Object None or Keyword Object None or Keyword Object None or Keyword Object None or Keyword Group None or Keyword Group None or Keyword Group or Keyword Group r aan Sa 2 a yaya fj a mM tO oO om ESE or Keyword Group or Keyword Group or Keyword Group or Keyword Group 5 Pn Close Enable Restrict Web Feature Check this box to make the keyword being blocked or passed Action This setting is available only when Either URL Access Control First or Either Web Feature Firs is selected Pass allows accessing into the corresponding webpage with the keywords listed on the box below Pass Allow accessing into the corresponding webpage with the keywords listed on the box below Block Restrict accessing into the corresponding webpage with the keywords listed on the box below If the web pages do not match with the specified feature set here it will be processed with reverse action Cookie Check the box to filter out the cookie
487. re There are two types for you to choose Alarm Settings Enable Syslog Alarm The temperature log will be recorded on Syslog if it is enabled Upper temperature limit Lower temperature limit Type the upper limit and lower limit for the system to send out temperature alert Temperature Chart Below shows an example of temperature graph USB Application gt USB Temper Record Temperature Sensor Settings Temperature Chart Refresh Min s Refresh a U U 09 37 11 37 Current Temperature 20 94 Average Temperature 22 03 Maximum Temperature 22 69 Minimum temperature 20 56 Vigor2860 Series User s Guide 392 Dr ay Tek 3 18 6 Modem Support List Such page provides the information about the brand name and model name of the USB modems which are supported by Vigor router USB Application gt Modem Support List The following compatibility test lists 3 5G LTE modems supported by Vigor router under certain environment or countries If the LTE modem you have is on the list but cannot work properly please write an e mail to suppormt draytek com or consult your dealer for further information 3 50 LTE iko i andRich andRich andRich andRich andRich andRich Wawel Wawel Wawel Wawel Wawel ony Ericsson P LINE P LINKE odafone odafone ko 830 andluxe C170 andluxe C270 andluxe C321 andluxe C330 andluxe C331 andluxe C502 Wawel E169u Wawel E220 Wawel E3030 Wawel E392 Wawel E398 ony Erics
488. re WCF license must be activated first Otherwise DNS filter does not have any effect on packets CSM gt gt DNS Filter DNS Filter DNS Filter Syslog Service Cache Time hour Administration Message Max 255 characters Default Message lt hody gt lt center gt lt hr gt lt hbr gt lt hr gt lt p gt The requested Web page lt br gt from S51IPs lt br gt to URL lt hbr gt that is categorized with CLS lt br gt has been blocked by FNAMES DNS Filter lt p gt Please contact your system administrator for further information lt center gt lt body gt Legend SIP SourcelIP URL URL Yo CL Yo Category RNAME Router Name Available settings are explained as follows Item Description DNS Filter Check Enable to enable such feature Syslog The filtering result can be recorded according to the setting selected for Syslog None There is no log file will be recorded for this profile Pass Only the log about Pass will be recorded in Syslog Block Only the log about Block will be recorded in Syslog All All the actions Pass and Block will be recorded in Syslog Block M Dray Te k 231 Vigor2860 Series User s Guide Service Set the filtering conditions Specify one of the WCF profiles as Service VYCF 1 Default Choose the WCF profiles to apply DNS filter Cache Time hour Set the time for DNS query Administration Message Type the words or sentences which will be di
489. reate New from the drop down list in this page to create a new profile For troubleshooting needs you can specify to record information for URL Content Filter by checking the Log box It will be sent to Syslog server Please refer to section Syslog Mail Alert for more detailed information Select one of the Web Content Filter profile settings created in CSM gt gt Web Content Filter for applying with this router Please set at least one profile for anti virus in CSM gt gt Web Content Filter web page first Or choose Create New from the drop down list in this page to create a new profile For troubleshooting needs you can specify to record information for Web Content Filter by checking the Log box It will be sent to Syslog server Please refer to section Syslog Mail Alert for more detailed information Click Edit to open the following window However it is strongly recommended to use the default settings here Firewall gt gt Edit Filter Set gt gt Edit Filter Rule Filter Set 1 Rule 1 Advance Setting Window size Session timeout Minute DrayTek Banner Strict Security Checking LAPP Enforcement Codepage This function is used to compare the characters among different languages Choose correct codepage can help the system obtaining correct ASCII after decoding data from URL and enhance the correctness of URL Content Filter The default value for this setting is ANSI 1252 Latin 178 Dray Tek I If you do not choose
490. ress TX Packets RX Packets 192 168 1 1 0 41533 If both the Primary IP and Secondary IP Address fields are left empty the router will assign its own IP address to local users as a DNS proxy server and maintain a DNS cache If the IP address of a domain name is already in the DNS cache the router will resolve the domain name immediately Otherwise the router forwards the DNS query packet to the external DNS server by establishing a WAN e g DSL Cable connection When you finish the configuration please click OK to save and exit this page Details Page for LAN1 IPv6 Setup There are two configuration pages for LAN1 Ethernet TCP IP and DHCP Setup based on IPv4 and IPv6 Setup Click the tab for each type and refer to the following explanations for detailed information Below shows the settings page for IPv6 LAN gt General Setup LAN 1 Ethernet TCP IP and DHCP Setup LAN 1 IPv6 Setup Router Advertisement Server Enable Disable Advertisement Lifetime 1800 Seconds Range 600 9000 DHCPv6 Server Enable Server Disable Server Start IPv Address End Pv6 Address DNS Server Pv Address Primary ONS Server Secondary DNS Server Static IPv6 Address IPv Address Current IPv Address Table i Prefix Length add e Index IP76 Address Prefix Length 1 FESO 210 A4FF FEBS 15668764 It provides 2 daemons for LAN side IPv6 address configuration One is RADVD stateless and t
491. result on the window 3 20 11 Syslog Explorer Such page provides real time syslog and displays the information on the screen For Web Syslog This page displays the time and message for User Firewall call WAN VPN settings You can check Enable Web Syslog specify the type of Syslog and choose the display mode you want Later the event of Syslog with specified type will be shown for your reference Diagnostics gt gt Syslog Explorer Web Syslog USB Syslog L Enable Web Syslog Export Refresh Clear Syslog Type Display Mode stop record when fulls ka Time Message Available settings are explained as follows Item Description Enable Web Syslog Check this box to enable the function of Web Syslog Syslog Type Use the drop down list to specify a type of Syslog to be displayed ser Export Click this link to save the data as a file Refresh Click this link to refresh this page manually Clear Click this link to clear information on this page Display Mode There are two modes for you to choose Vigor2860 Series User s Guide 430 Dr ay Tek Stoo record when full z Always record the new event Stop record when fulls when the capacity of syslog is full the system will stop recording Always record the new event only the newest events will be recorded by the system Time Display the time of the event occurred Message Display the information for each event For USB Syslog This page displays the syslog r
492. rk Aae a Show All Displays Sound Network Startup Disk Location Automatic Show Built in Ethernet TCP IP PPPoE AppleTalk Proxies Ethernet IP Address m Renew DHCP Lease Subnet Mask 255 255 255 0 DHCP Client ID If required Router 192 168 1 1 DNS Servers Optional Search Domains Optional IPv6 Address fe80 0000 0000 0000 020a 95ff fe8d 72e4 Configure IPv6 rr Click the lock to prevent further changes Assist me Apply Now Dr ay Tek 521 Vigor2860 Series User s Guide 5 3 Pinging the Router from Your Computer The default gateway IP address of the router is 192 168 1 1 For some reason you might need to use ping command to check the link status of the router The most important thing is that the computer will receive a reply from 192 168 1 1 If not please check the IP address of your computer We suggest you setting the network connection as get IP automatically Please refer to the section 5 2 Please follow the steps below to ping the router correctly For Windows L Ds 4 Open the Command Prompt window from Start menu gt Run Type command for Windows 95 98 ME or cmd for Windows NT 2000 XP Vista The DOS command dialog will appear w Command Prompt Microsoft Windows HP Version 5 1 2688 CC Copyright 1985 2001 Microsoft Corp D Documents and Settings faerping 192 168 1 1 Pinging 192 168 1 1 with 32 bytes of
493. rnet Access types provided by your ISP PPPoE PPTP L2TP Static IP DHCP Dr ay Tek 43 Vigor2860 Series User s Guide 2 Click DHCP as the Internet Access type Simply click Next to continue Quick Start Wizard DHCP Client Mode WAN 2 If your ISP requires you to enter a specific host name or specific MAC address please enter it in Host Name optional MAC fip JAA As B7 6A optional Available settings are explained as follows Item Description Host Name Type the name of the host Note The maximum length of the host name you can set is 39 characters MAC Some Cable service providers specify a specific MAC address for access authentication In such cases you need to enter the MAC address Back Click it to return to previous setting page Next Click it to get into the next setting page Cancel Click it to give up the quick start wizard 3 After finished the settings above click Next for viewing summary of such connection Quick Start Wizard Please confirm your settings WAN Interface WAN Physical Mode Ethernet Physical Type Auto negotiation Internet Access DHCP Click Back to modify changes if necessary Otherwise click Finish to save the current settings and restart the Vigor router lt Back n Vigor2860 Series User s Guide 44 Dr ay Tek 4 Click Finish A page of Quick Start Wizard Setup OK will appear Then the system status of this protocol will
494. rofile it is the time to activate the mechanism for your computer Click System Maintenance gt gt Activation to open the following page for accessing http myvigor draytek com System Maintenance gt gt Activation Activate via interface auto selected Web Filter License Activate Status Not Activated Authentication Message Note If you want to use email alert or syslog please configure the SysLoq Mail Alert Setup page If you change the service provider the configuration of the function will be reset Available settings are explained as follows Item Description Activate via Interface Choose WAN interface used by such device for activating Web Content Filter auto selected auto selected WAR 1 WAR 2 WAN 3 WAN A Activate The Activate link brings you accessing into Vigor2860 Series User s Guide 418 Dr ay Tek www vigorpro com to finish the activation of the account and the router Authentication Message As for authentication information of web filter the process of authenticating will be displayed on this field for your reference Below shows the successful activation of Web Content Filter System Maintenance gt gt Activation Activate via interface auto selected Web Filter License Activate Status Commtouch Start Date 2011 03 28 Expire Date 2011 04 27 Authentication Message WebFilter Activation authenticate fail O1 00 00 24 Contact with supporthdraytek com ZC
495. rofile name Loadbalani Algorithm Round Robin Available settings are explained as follows Item Description Profile Name List the load balance profile name Load Balance Algorithm Round Robin Based on packet base both tunnels will send the packet alternatively Such method can reach the balance of packet transmission with fixed rate Weighted Round Robin Such method can reach the balance of packet transmission with flexible rate It can be divided into Auto Weighted and According to Speed Ratio Auto Weighted can detect the device speed 1OMbps 100Mbps and switch with fixed value ratio 3 7 for packet transmission If the transmission rate for packets on both sides of the tunnels is the same the value of Auto Weighted should be 5 5 According to Speed Ratio allows Vigor2860 Series User s Guide 294 Dr ay Te k Dray Tek VPN Load Balance Policy user to adjust suitable rate manually There are 100 groups of rate ratio for Memberl Member2 range from 1 99 to 99 1 Below shows the algorithm for Load Balance Edit Click this radio button for assign a blank table for configuring Binding Tunnel Insert after Click this radio button to adding a new binding tunnel table Tunnel Bind Table Index 128 Binding tunnel tables are provided by this device Specify the number of the tunnel for such Load Balance profile Active In active Delete can delete this binding tunnel table Active can activate t
496. rough the time without any action IP Address Assignment WAN IP Alias If you have multiple public IP addresses Method IPCP and would like to utilize them on the WAN interface please use WAN IP Alias You can set up to 8 public IP addresses other than the current one you are using cp WAN IP Alias HESS 172 16 3 143 2660 dochripaliss hin WAN IP Alias Multi NAT Index Enable Aux WAN IP Join NAT IP Pool 10 39 0 10 x 10 39 0 150 0 0 0 0 0 0 0 0 0 0 0 0 0 0 d d LI d d dl gn 17 24 25 32 gt gt Fixed IP Usually ISP dynamically assigns IP address to you each time you connect to it and request In some case your ISP provides service to always assign you the same IP address whenever you request In this case you can fill in this IP address in the Fixed IP field Please contact your ISP before you want to use this function Click Yes to use this function and type in a fixed IP address in the box Fixed IP Address Type a fixed IP address WAN IP Network Obtain an IP address automatically Click this button to Settings obtain the IP address automatically Specify an IP address Click this radio button to specify some data IP Address Type the IP address Subnet Mask Type the subnet mask After finishing all the settings here please click OK to activate them Vigor2860 Series User s Guide 102 Dr ay Te k Details Page for 3G 4G USB Modem PPP mode in WA
497. rough the time without any action Usually ISP dynamically assigns IP address to you each time you connect to it and request In some case your ISP provides service to always assign you the same IP address whenever you request In this case you can fill in this IP address in the Fixed IP field Please contact your ISP before you want to use this function WAN IP Alias If you have multiple public IP addresses and would like to utilize them on the WAN interface please use WAN IP Alias You can set up to 8 public IP addresses 85 Vigor2860 Series User s Guide Vigor2860 Series User s Guide other than the current one you are using e WANIIP Alias Mit 4 172 16 3 143 2860 docAvipalias htm WAN1 IP Alias Multi NAT Index Enable Aux WAN IP Join NAT IP Pool m LI L LI LI d d g 17 24 25 32 gt gt Fixed IP Click Yes to use this function and type in a fixed IP address in the box of Fixed IP Address Default MAC Address You can use Default MAC Address or specify another MAC address by typing on the boxes of MAC Address for the router Specify a MAC Address Type the MAC address for the router manually Index 1 15 in Schedule Setup You can type in four sets of time schedule for your request All the schedules can be set previously in Applications gt gt Schedule web page and you can use the number that you have set in that web page 86 Dray Tek Details Page for MPoA Static or Dynam
498. router When the resource is inadequate the packets will be blocked if Strict Security Checking is enabled If Strict Security Checking is not enabled then the packets will pass through the router Dr ay Tek 179 Vigor2860 Series User s Guide Example As stated before all the traffic will be separated and arbitrated using on of two IP filters call filter or data filter You may preset 12 call filters and data filters in Filter Setup and even link them in a serial manner Each filter set is composed by 7 filter rules which can be further defined After that in General Setup you may specify one set for call filter and one set for data filter to execute first Firewall gt General Setup General Setup Genaral Setup arian bt Hube Call Fili Enable D Tainio Data Filter Enable Start FibeN gnt Selle O Dpabie W Accopt Lage meiming fregmenterd UOP or IOMP pockets Nggonmu i Firewall gt Filter Setup F Enable Strict Secunby Firewall Fiker Setup etio Factory Default Comments Set Camments Default Call Filter L p Default Gata Filter i OK Gingil 3 4 4 10 a 11 i li Firewall Fiker Setup Edit Fiker Sen rior Sent Firewall gt gt Edit Filter Set gt gt Edit Filter Rule Commons Defauly sO Filter Active Communes Filter Set 1 Rule 1 el Block NetBios El Check to enable the Filter Rule Comments Block MetBios T J Index 1 15 m Schedule Sebup l i O Clear sessions when schedule ON
499. roxy is enabled and HD video is running Corrected Filter rule in Firewall page can not be displayed properly Corrected The warning message is shown when USB disk if full in SysLog Mail Alert page Corrected The function of wireless PPPoE pass through does not work correctly Corrected Enabling the DNF filter and unplugging the WAN cable will cause router reboot continuously Fixed Fix the problem of stability issue after enabling WCF mechanism Fixed IPv6 PPP WAN cannot connect with VLAN tag on WAN interface Vigor2860 Series User s Guide 536 Dr ay Te k
500. rts except the range defined here are available for this service type gt the port number greater than this value is available lt the port number less than this value is available for this profile 203 Vigor2860 Series User s Guide 3 After finishing all the settings please click OK to save the configuration Objects Setting gt Service Type Object Service Type Object Profiles Index Name Incl 1 www 1 i SIP at J 1 ay 3 7 6 Service Type Group This page allows you to bind several service types into one group Objects Setting Service Type Group Serice Type Group Table Set to Factory Default Group Name Group Name io jea foo ho JRO BO ho Ro RO Ro Ro Ro Ro j M gt S S oo N S on S fee e gt S s fo ask k ak k k ak gt r pe la la e le S S S is ie m iF ie e je S e Available settings are explained as follows Item Description Set to Factory Default Clear all profiles Index Display the profile number that you can configure Name Display the name of the group profile Vigor2860 Series User s Guide 204 Dr ay Te k To set a new profile please do the steps listed below 1 Click the number e g 1 under Group column for configuration in details 2 The configuration page will be shown as follows Objects Setting gt Service Type Group Setup Profile Index 1 Name Available Service Type Objects Selected Service Type Objects
501. s Start IP Address End IP Address Subnet Mask Invert Selection oo Yoo oo Yoo Joo Joo 192 166 1 59 192 166 1 65 l Available settings are explained as follows Item Name Interface Address Type Description Type a name for this profile Maximum 15 characters are allowed Choose a proper interface Any Ma LANOMLAR TFN WAR For example the Direction setting in Edit Filter Rule will ask you specify IP or IP range for WAN or LAN or any IP address If you choose LAN as the Interface here and choose LAN as the direction setting in Edit Filter Rule then all the IP addresses specified with LAN interface will be opened for you to choose in Edit Filter Rule page Determine the address type for the IP address Select Single Address if this object contains one IP address only Select Range Address if this object contains several IPs within a range Select Subnet Address if this object contains one subnet for IP address Select Any Address if this object contains any IP address Select Mac Address if this object contains Mac address 195 Vigor2860 Series User s Guide MAC Address Start IP Address End IP Address Subnet Mask Invert Selection Range Address Any Address cingle Address Range Address Subnet Address Mac Address Type the MAC address of the network card which will be controlled Type the start IP address for Single Address type Type the end IP address if the
502. s Setup Service Name Optional OoOo aai Settings for ADSL only semane DO Mulo PVc channel Channel 1 we 5 4 N asswor VPI oo Separate Account for ADSL WEI 3000 E ine ach Tracts PPP Authentication PAP or CHAP Idle Timeout second s Protocol PPPoE IP Address From ISP wWAN IP Alias Modulation Multimode w l l Fixed IP Yes No Dynamic IP PPPoE Pass through Fixed IP Address C For Wired LAN areca 4a C For Wireless LAN ee a Puy en Specify a MAC Address WAN Connection Detection MAC Address ho Bg Mode ARP Detect inae Indes 1 15 in Schedule Setup MTU 1500 Max i492 Available settings are explained as follows Item Description Enable Disable Click Enable for activating this function If you click Disable this function will be closed and all the settings that you adjusted in this page will be invalid Modem Settings Set up the DSL parameters required by your ISP These for ADSL only settings configured here are specified for ADSL only Multi PVC channel The selections displayed here are determined by the page of Internet Access gt gt Multi PVCs Select M PVCs Channel means no selection will be chosen Dr ay Te k 89 Vigor2860 Series User s Guide PPPoE Pass through WAN Connection Detection MTU Vigor2860 Series User s Guide VPI Type in the value provided by ISP VCI Type in the value provided by ISP Encapsulating Type Drop down the list to choose the type provided by
503. s each time you access the Internet The Dynamic DNS feature lets you assign a domain name to a dynamic WAN IP address It allows the router to update its online WAN IP address mappings on the specified Dynamic DNS server Once the router is online you will be able to use the registered domain name to access the router or internal virtual servers from the Internet It is particularly helpful if you host a web server FTP server or other server behind the router Before you use the Dynamic DNS feature you have to apply for free DDNS service to the DDNS service providers The router provides up to three accounts from three different DDNS service providers Basically Vigor routers are compatible with the DDNS services supplied by most popular DDNS service providers such as www dyndns org www no ip com www dtdns com www changeip com www dynamic nameserver com You should visit their websites to register your own domain name for the router Enable the Function and Add a Dynamic DNS Account l Assume you have a registered domain name from the DDNS provider say hostname dyndns org and an account with username test and password test In the DDNS setup menu check Enable Dynamic DNS Setup Applications gt gt Dynamic DNS Setup Dynamic DNS Setup Setto Factory Default Force Update Auto Update interval 14400 Mins 1 14400 Accounts Index WAN Interface Domain Name WAN First WAN First WANI First Vigor2860 Series User
504. s successful the physical connection will be shows as follows Online Status Physical Connection System Uptime 0 1 18 IPv4 IPvo LAN Status IP Address ao 4000 FFOO sn ao css ancl 2568 64 Global TX Packets ra Packets TX Bytes RX Bytes 147 187 34205 19176 WAN IPv6 Status Enable Up Time 0 00 48 bateway IP TX Packets RX Packets RX Bytes 186 137 33093 Vigor2860 Series User s Guide 438 Dr ay Tek DHCPv6 Client Choose DHCPV6 Client Click one of the identity associations and type the AID number WAN gt gt Internet Access WAN 2 PPPoE Static or Dynamic IF PPTP L2TP IPv6 Internet Access Mode Connection Type DHCPv6 Client Configuration Identity Association Prefix Delegation Tol Non temporary Address IAID Identity Association ID 972573680 Click OK and open Online Status If the connection is successful the physical connection will be shows as follows Online Status Physical Connection System Uptime 0 0 50 IPw4 IPvG LAN Status IP Address TX Packets RX Packets TX Bytes RX Bytes 6 205 156 WAN IPv6 Status Enable Mode Up Time 9 00 40 Gateway IP 2001 1111 2999 33331 1111 128 Glabal FES0 210 44FF FE46 2564 64 Link DNS IP 2001 48604860 65868 2001 4860 4860 5844 TX Packets RX Packets 14 5 Dr ay Tek 439 Vigor2860 Series User s Guide Static IPv6 Choose Static IPv6 Type IPv6 address Prefix Length and Gateway Address WAN gt Internet
505. se Mixed lla 11n mode In which 802 11b g operates on 2 4G band 802 11a operates on 5G band and 802 11n operates on either 2 4G or 5G band Means the channel of frequency of the wireless LAN The default channel is 6 You may switch channel if the selected channel is under serious interference If you have no idea of choosing the frequency please select Auto to let system determine for you For 2 4GHz For 5 GHz Channel 6 24397MHz Auto Channel 1 2412MHz Channel 2 241 MHz i Channel 3 24422wW1Hz Channel 4 2427 MHz i Channel 5 24352hMHz Channel 60 5300MHz W Channel 6 2437 MHz Auto Channel 2442 MAz Channel 60 SSO0MHz Channel 6 2447 MHz Channel 64 5320M1Hz Channel 149 5745MHz sina on Channel 153 5765MHz erie ee Z Channel 157 5785MHz Channel 11 2462MHz Channel 161 5805MHz Check it to prevent from wireless sniffing and make it harder for unauthorized clients or STAs to join your wireless LAN Depending on the wireless utility the user may only see the information except SSID or just cannot see any thing about Vigor wireless router while site surveying The system allows you to set four sets of SSID for different usage In default the first set of SSID will be enabled You can hide it for your necessity Means the identification of the wireless LAN SSID can be any text numbers or various special characters Member Che
506. sed security mode Type a username which will be used for authentication The maximum length of the text is limited to 23 characters Auth Algorithm Choose one of the encryption methods listed below as the authentication algorithm Auth Password Type a password for authentication The maximum length of the text is limited to 23 characters Privacy Algorithm Choose one of the methods listed below as the privacy algorithm No Priv Privacy Password Type a password for privacy The maximum length of the text is limited to 23 characters Click OK to save these settings Vigor2860 Series User s Guide 412 Dr ay Te k 3 19 10 Management This page allows you to manage the settings for Internet LAN Access Control Access List from Internet Management Port Setup and CVM Access Control The management pages for IPv4 and IPv6 protocols are different For IPv4 System Maintenance gt gt Management IPv d Management Setup C Default Disable Auto Logout IPv6 Management Setup Management Port Setup User Define Ports Telnet Port Default HTTP Part Default HTTPS Port 443 Default FTP Port Router Name Default Ports Internet Access Control Allow management from the Internet C FTP Server HTTP Server HTTPS Server TOGS Port 33H Port Default Default Default Telnet Server C TRO69 Server SSH Server Disable PING from the Internet CVM Access Control C cvm Port O erm SSL
507. ser s Guide Address e Network Connections 7 IP Broadband Connection on Router Status AE Broadband Network Tasks General Local 4rea Connection Enabled al k Realtek RTLB139 810x Family ae A g hinet a Create a new connection gt Disconnected Z Set up a home or small C_ E WAN Miniport PPPOE Internet Gateway office network Status Connected _ Duration 00 19 06 see Aine Dore Speed 100 0 Mbps r vey Disconnected J Network Troubleshooter dt Use L i ihe oti Activity Internet Internet Gateway My Computer Other Places Internet Gateway u e G Control Panel JS Ip Broadband Connection on lt Router a My Network Places Migr Pickels iL My Documents Sent 404 744 4 My Computer Received 1 115 BEE LAN or High Speed Internet ng Ca Details Close Network Connections System Folder The UPnP facility on the router enables UPnP aware applications such as MSN Messenger to discover what are behind a NAT router The application will also learn the external IP address and configure port mappings on the router Subsequently such a facility forwards packets from the external ports of the router to the internal ports used by the application Advanced Settings T IP Broadband Connection en Router Properties X ECT An er General Services k Connect to the Internet using Select the services running on your network
508. sername and password Username Password 6 Click Login If the logging is successful you will see the message of Login Success from the browser you use we Piveni bar Drasrtek i l C oft Be biees 192 168 10 1Mocfuser losin w F 3 CI DravTek Group O MRTA O ER mE Login success Dr ay Tek 467 Vigor2860 Series User s Guide Example 2 The system will connect to http www draytek com automatically after logging into Internet successfully 1 In the field of Landing Page please type the words as below lt body stats 1 gt lt script language javascript gt window location http www draytek com lt script gt lt body gt User Management gt General Setup General Setup Mode Notice 1 User Management will refer to active rules in Data Filter as whitelists and blacklists in user based firewall mode 2 Users match the above lists will not be required for authentication The firewall rules policy will still valid 3 Otherwise authentication required for users not matched the above lists The firewall rules designated in the user profile s policy will still valid Landing Page Max 255 characters Preview Setto Factory Default lt body stats li gt lt script langquage javascript gt window location http www draytek com lt script gt lt body gt Clear Cancel 2 Next enable the Landing Page function Open User Management gt User
509. server we can configure two LDAP server profiles with different Group Distinguished Name Dr ay Tek 463 Vigor2860 Series User s Guide Applications gt Active Directory LDAP gt gt Server Profiles Index No 1 Name Common Name Identifier Base Distinguished Name ou people dc ms dc draytek dc com Group Distinguished Name cn rd1 ou group dc ms dc draytek dc c and Applications gt gt Active Directory LDAP Server Profiles Index No 2 Name Common Name Identifier Base Distinguished Name ou people dc ms dc draytek dc com Group Distinguished Name cn shrd ou group dc ms dce draytek dc 4 Click OK to save the settings above 5 Open User Management gt gt General Setup Select User Based as the Mode option User Management gt gt General Setup General Setup Notice User Management will refer to active rules in Data Filter as whitelists and blacklists in user based firewall mode Users match the above lists will not be required for authentication The firewall rules policy will still valid Otherwise authentication required for users not matched the above lists The firewall rules designated in the user profile s policy will still valid Landing Page Max 255 characters Preview Setto Factory Default lt body stats l gt lt script language javascript gt window location http www draytek com lt script gt lt body gt Clear Vigor2860 Series User s Guide 464 Dr ay
510. service provider to Vigor router 3 Choose any index number e g Index 1 in this case to configure the SMS Provider setting In the following page type the username and password and set the quota that the router can send the message out Object Settings gt SMS Mail Service Object Profile Index 1 Profile Name Service Provider kotsms com tw TW Sending Interval seconds Vigor2860 Series User s Guide 470 Dr ay Tek 4 After finished the settings click OK to return to previous page Now you have finished the configuration of the SMS Provider profile setting Object Settings gt SMS Mail Service Object SMS Provider Mail Server Setto Factory Default Index Profile Name SMS Provider Local number kotsms com tw TW otsms com tw TW 3 kotsms com tw TW 4 kotsms com tw TW 4 kotsms com tw TW 6 kotsms com tw TW I kotsms com tw TW kotsms com tw TW g Custom 1 10 Custom 2 5 Open Object Settings gt gt Notification Object to configure the event conditions of the notification Object Settings gt gt Notification Object Setto Factory Default Index Profile Name Settings Fe Iaa e a e a i ie 6 Choose any index number e g Index 1 in this case to configure conditions for sending the SMS In the following page type the name of the profile and check the Disconnected and Reconnected boxes for WAN to work in concert with the topic of this paper Object Settings gt N
511. shown to verify the register process is finished Please click Login Register Search for this site YY Register Confirm Thank for your register in VigerPro Web Site The Register process is completed Dr ay Te k 477 Vigor2860 Series User s Guide 10 When you see the following page please type in the account and password that you just created in the fields of UserName and Password Please take a moment to register Membership Registration entitles you to upgrade firmware for your purchased product and receive news about upcoming products and services Password Auth Code 14he1C lf you cannot read the word click here Forgotten password Don t have a MyVigor Account Create an account now Ifyou are having difficulty logging in contact our customer senice Customer Serice 886 3 597 2727 or 11 Now click Login Your account has been activated You can access into My Vigor server to activate the service e g WCF that you want 4 9 2 Create an Account via MyVigor Web Site 1 Access into http myvigor draytek com Find the line of Not registered yet Then click the link Click here to access into next page Dray Tek fi Home Search MyVigor for you a aman MyVigor website replaces the VigorPro site as DrayTek s portal site for Product the latest products and services in network security including Anti My Information Virus Anti Spam Web Content Filter etc The products a
512. so werincen sneatiaesautaedeedurmndquesnesaaetavesaensahis 431 321 eS et SVC CS an cate be ateraconawanniesaeotatesinmiumtentoauiaedcanaiceonusdibeaceamcouawennipaoumtnelssaneeaientnesuioncan 432 eLA DCV CE ec ee eee ee eee eee eek eee 432 Vigor2860 Series User s Guide viii Dr ay Tek Tutorials and AppliCations ccccscscsescseseceeseeeseeeseeeeseoeseeeaeeeeeeneneeaeennees 433 4 1 How to configure settings for IPv6 Service in VigOr2860 cccccccsseeeeeeeeeeeeeeeeeeeeeeeeeaaes 433 4 2 How can I get the files from USB storage device connecting to Vigor router 446 4 3 How to Build a LAN to LAN VPN Between Remote Office and Headquarter via IPsec Tunnel OANA NEO CS EEEE AEE A E OTN sed euaeesasarshcecusanrencseneneaeceeranmacentedes 449 4 4 How to Optimize the Bandwidth through QoS Technology cccceeeeeeeeeeeeeeeeeeeeeeeeeeeees 453 4S QOS Seting EX GIO 6 senie E E 458 4 6 How to Implement the LDAP AD Authentication for User Management cceee 463 4 7 How to use Landing Page Feature ccccccsesccccseeeeeeceeseeeeeeceeeeeeseeeeeaeeessneeesseeeeeessaeeeeeas 466 4 8 How to Send a Notification to Specified Phone Number via SMS Service in WAN PIS COMING CUO eaae E E E E 470 4 9 How to Create an Account for MyVIQOL ccccccccssssecceeeeeceeeseeeeeeeseseeeeeseeeeeseeeeeeeeeeeeesaaas 474 4 9 1 Create an Account via Vigor Router cccccccssseeceeecaeeeeeeeeceeeeee
513. son MO300 P LINK MATS P LINK MAz60 odafone K3 65 2 odafone K4605 TE MF626 TE MF 2 plus TE MF633 TE MF636 pinom GPRS Modem 2 5G4 oO wn o Band o O uw Dray Te k 393 Vigor2860 Series User s Guide 3 19 System Maintenance For the system setup there are several items that you have to know the way of configuration System Status TR 069 Administrator Password User Password Login Page Greeting Configuration Backup Syslog Mail Alert Time and Date Management Reboot System Firmware Upgrade and Activation Below shows the menu items for System Maintenance System Maintenance 3 19 1 System Status The System Status provides basic network settings of Vigor router It includes LAN and WAN interface information Also you could get the current running firmware version or firmware related information from this presentation Vigor2860 Series User s Guide 394 Dr ay Te k System Status Model Name Vigor 860n Firmware Version 3 7 4 1 Build Date Time Mar 20 2014 14 09 50 MAC Address IP Address Subnet Mask DHCP Server ONS OO 10 44 B6 1B BS 10 26 60 1 233 255 235 0 ON 10 25 60 OO 10 44 B6 1B BS 10 59 0 868 235 255 235 0 OFF 10 25 60 OO 10 44 B6 1B B83S 10 26 65 254 235 233 233 0 ON 10 25 60 OO 10 44 B6 1B BS 192 168 4 1 233 25353 235 0 ON 10 28 50 OO 10 44 B6 1B B8S 192 168 5 1 255 2535 255 0 OMN 10 25 60 OO 10 44 B6 1B BS 10 28 66 254 255 255 255 0 OM 10 25 560 DMZ PORT OO 10 44 B6
514. splayed when a web page is blocked by Vigor router After finishing all the settings please click OK to save the configuration 3 8 5 APPE Support List Such page lists all the information name version and note about IM P2P Protocol and others applications that Vigor router supports for APPE function CSM gt gt APPE Support List This charts lists out the AFF Enforcement supported by Vigor routers Last Update on 2013 12 03 IM P2P PROTOCOL OTHERS amp so OO OOOCOCOCSC N SNW Only block Login If users have already logged in AIM MI 67 services can not be blocked e A In ICQ6 if Videos are blocked Voices will be blocked at Icd T the same time In ICQ5 or former versions videos and Voices can be blocked separately Jabber Protocol Soogle Talk 2008 o LINE 3 1 10 37 To block LINE for PC and mobile phone Vigor2860 Series User s Guide 232 Dr ay Te k 3 9 Bandwidth Management Below shows the menu items for Bandwidth Management 3 9 1 Sessions Limit A PC with private IP address can access to the Internet via NAT router The router will generate the records of NAT sessions for such connection The P2P Peer to Peer applications e g BitTorrent always need many sessions for procession and also they will occupy over resources which might result in important accesses impacted To solve the problem you can use limit session to limit the session procession for specified Hosts In the Bandwidth M
515. ssaageeeesssaneeess 307 3 13 3 VPN Management siertsuxsua wus teanens dvivanianannawnadnnenslmaddudamendwideauesibeninaariuinciumidiuaneendetoatetonsnens 313 SE OOO Be FLOM EEEE E E ET A E A E TE E E E E E A SN 314 3 14 Central AP Manageme mM accsccnccecaccecesscesceseccerueweaccacetend ceulcesaadewehecueseceunedebesduedewelectaeeueadeees 316 AATE f 0 gt eee een ee eee ee ee eee eee 316 314 2 WLAN POU caches cemeeranesecuiecnamatecdanmandeebsnaetaessnidanesteeee the sacaaasaoseussactimany darren oceadoaccsestedd 317 3 1453 AP NIAINGMANCE eein e aee iiaee 322 3 144 Iraifie Graphisurus iaia aa dai a a a iaa Oa Eai 323 3 14 5 Rogue AP Detection ccccccccccsssceecsesececceseeeceuseeceeuseecseuseeessagseeeeauseeseageeessansessseass 323 3 14 6 Load BalanCe cccccccsecccccecceeseceeesaeeseeeeeeeseceeessaeeeeeesaeeseeeeesseeseeeeessageeeessaaeeeeeessagesss 327 3 14 7 Function Support LISt ee eeeeccceeceeeeeeeeeeeeeeeesaeeseeeeeeeessaeeaseeeeesssaeaseeeeeeeeessasaeeees 328 6 og 0 ee nen he ee ern ee ee ee ee eee ee ee ees 329 5s DPA araetea tere peset ceduasastameatian E sacsisecauansicdeesasnedgaeasdsedatan E 331 212 IP ACCOUN aorin a a e ede ssaccdecaveoneseeassdaesesesnapavoceseapavas2eeaus 340 3 19 9 PONE SENGS esnin eran eE anapi aE 345 Bs See e E e E E S E E A EE E A EE 350 3 16 Wireless LAN 2 AG HZ 5G Z secretion E 352 3 16 11 BASIC CONCEP S su nivaiienarnenu eniai ea aE ANE EE EE E ea ET 352 3 16 2 General SCP e
516. ssword provided by your ISP Service Name Optional CHT Username o400565 ihinet net Available settings are explained as follows Item Description Service Name Enter the description of the specific network service Optional Username Assign a specific valid user name provided by the ISP Note The maximum length of the user name you can set is 63 characters Password Assign a valid password provided by the ISP Note The maximum length of the password you can set is 62 Vigor2860 Series User s Guide 38 Dr ay Tek Item Description characters Confirm Password Retype the password Back Click it to return to previous setting page Next Click it to get into the next setting page Cancel Click it to give up the quick start wizard 3 Please manually enter the Username Password provided by your ISP Click Next for viewing summary of such connection Quick Start Wizard Please confirm your settings WAN Interface WAN Physical Mode Ethernet Physical Type Auto negotiation Internet Access PPPoE Click Back to modify changes if necessary Otherwise click Finish to save the current settings and restart the Vigor router 4 Click Finish A page of Quick Start Wizard Setup OK will appear Then the system status of this protocol will be shown Quick Start Wizard Setup OR 5 Now you can enjoy surfing on the Internet Dr ay Tek 39 Vigor2860 Series User s Guide PPTP L2TP 1 Choose WAN2 as the WAN I
517. static IPv6 address for LAN Prefix Length Type the fixed value for prefix length Add Click it to add a new entry Delete Click it to remove an existed entry Display current used IPv6 addresses When you finish the configuration please click OK to save and exit this page Vigor2860 Series User s Guide zs DrayTek Details Page for LAN2 LAN6 and DMZ LAN gt General Setup LAN 2 Ethernet TCP IP and DHCP Setup Network Configuration Enable Disable For NAT Usage For Routing Usage IP Address 10 39 0 96 Subnet Mask 255 255 255 0 Note Disable LAN amp Enable LAN shouldn t be in the same subnet DHCP Server Configuration Enable Server Disable Server Enable Relay Agent DHCP Server IP Address 0 0 0 0 192 168 27 10 Start IP Address IP Pool Counts Gateway IP 4ddress Lease Time 192 168 2 1 59200 5 Retrieve IPs from inactive clients periodically DNS Server IP Address Primary IP Address 0 0 0 0 Secondary IP Address 0 0 0 0 Available settings are explained as follows Dray Tek Item Description Network Configuration Enable Disable Click Enable to enable such configuration click Disable to disable such configuration For NAT Usage Click this radio button to invoke NAT function For Routing Usage Click this radio button to invoke this function IP Address Type in private IP address for connecting to a local private network Default 192 168 1
518. sulate the data payload only It can just apply to local packet e g L2TP over IPsec The Tunnel mode will not only add the AH ESP payload but also use a new IP header Tunneled IP header to encapsulate the whole original IP packet Vigor2860 Series User s Guide 270 Dray Tek Authentication Header AH provides data authentication and integrity for IP packets passed between VPN peers This is achieved by a keyed one way hash function to the packet to create a message digest This digest will be put in the AH and transmitted along with packets On the receiving side the peer will perform the same one way hash on the packet and compare the value with the one in the AH it receives Encapsulating Security Payload ESP is a security protocol that provides data confidentiality and protection with optional authentication and replay detection service VPN and Remote Access gt gt IPsec General Setup VPN IKE IPsec General Setup Dial in Set up for Remote Dial in users and Dynamic IP Client LAN to LAN IKE Authentication Method Certificate for Dial in Pre Shared Key pre Shared Key PO Confirm Pre Shared Key Pe IPsec Security Method Medium AH Data will be authentic but will not be encrypted High ESF DES 3DES MJ AES Data will be encrypted and authentic Available settings are explained as follows Item Description IKE Authentication This usually applies to those are remote dial in user or node Method LAN to LAN
519. sword Setto Factory Default Confirm Password Note 1 Password can contain only a zA Z0 9 lt c gt 2 Password can t be only Example or of js illegal but 123 or 45 is OK Dray Te k 401 Vigor2860 Series User s Guide 3 The following screen will appear Simply click OK System Maintenance gt User Password Active Configuration Password ae 4 Log out Vigor router web user interface by clicking the Logout button iH E 5 The following window will be open to ask for username and password Type the new user password in the filed of Password and click Login Vigor2860 Series Login pm ja mamn mg Sac T Gati m r A ri _ EF gy 7 m an Copyright 2013 DrayTek Corp All Rights Reserved Vigor2860 Series User s Guide 402 Dr ay Te k 6 The main screen with User Mode will be shown as follows DrayTek MRE Dashboard an oy an f H D ay ji Z K Vigor2860n plus VOSL2 Security Firewall WAN 1 4 2 LAN s NAT i Dos basni VOSUADSL WAN2Giga GigalAN 1 Applications Wireless LAN 2 4 GHz System Information Wireless LAN 5 GHz Model Name Vigor2860n System Up Time 3 25 56 System Status System Maintenance Diagnosi Router Name Curent Time 2014 Apr 1 Tue 9 1 27 Dynamic DNS 3 7 4 1 Build Date Time Mar 20 2014 14 09 50 DSL Version 548006 4 LAN MAC Address 00 1D 44 B6 1B B8 IPv4 Int
520. t LED Off Blinking On Off Right LED Dray Tek WAN2 Giga gt Vigor2860 YDSL2 Security Firewall GigaLAN 1 2 3 4 5 6 Explanation The router is powered on and running normally The router is powered off USB device is connected and ready for use The data is transmitting Internet connection is ready Internet connection is not ready The data is transmitting The router is ready to access Internet through DSL link Slowly The DSL connection is ready Quickly The connection is training The VPN tunnel is active The QoS function 1s active The Web Content Filter is active It is enabled from Firewall gt gt General Setup The DoS DDoS function is active It will blink while detecting an attack The port is connected The port is disconnected The data is transmitting The port is connected with 1000Mbps The port is connected with 10 100Mbps The port is connected The port is disconnected The data is transmitting The port is connected with 1000Mbps The port is connected with 10 100Mbps 3 Vigor2860 Series User s Guide j gt Vigor2860 M a Gti Dad M we YDSL2 Security Firewall cr wna ose Eo _ i allie alls ull alle ACT WAN2 QoS alle e e D a 2 a gt O O USBI DSL WCF maata Factory O O Reset m a zk _ 2 3 4 5 6 USB2 VPN DoS 4 F PWR Ae VDSLUADSL WAN2 Giga GigaLAN 1 Interface Descripti
521. t Display the port number which will be redirected to the specified Private IP and Port of the internal host Private IP Display the IP address of the internal host providing the Service Status Display if the profile is enabled v or not x Press any number under Index to access into next page for configuring port redirection NAT gt gt Port Redirection Index No 1 C Enable Mode Range _ Protocol B WAN IP Public Port bo HO Private IP es ee Private Port o Note In Range Mode the End IP will be calculated automatically once the Public Port and Start IP have been entered Service Name Available settings are explained as follows Item Description Enable Check this box to enable such port redirection setting Mode Two options Single and Range are provided here for you to choose To set a range for the specific service select Range In Range mode if the public port start port and end port and the starting IP of private IP had been entered the system will calculate and display the ending IP of private IP automatically Service Name Enter the description of the specific network service Protocol Select the transport layer protocol TCP or UDP Dr ay Te k 155 Vigor2860 Series User s Guide WAN IP Public Port Private IP Private Port Select the WAN IP used for port redirection There are eight WAN IP alias that can be selected and used for port redirection Th
522. t and vice versa Besides Vigor router has a built in DHCP server that assigns private IP address to each local host See the following diagram for a briefly understanding Internet DHCP Server GR Public IP Address Private Subnet Router IP Addres In some special case you may have a public IP subnet from your ISP such as 220 135 240 0 24 This means that you can set up a public subnet or call second subnet that each host is equipped with a public IP address As a part of the public subnet the Vigor router will serve for IP routing to help hosts in the public subnet to communicate with other public hosts or servers outside Therefore the router should be set as the gateway for public hosts Dray Te k 121 Vigor2860 Series User s Guide Internet Public IP Address 220 135 240 207 _ ee i rane Private Subne TEL Router IP What is Routing Information Protocol RIP Vigor router will exchange routing information with neighboring routers using the RIP to accomplish IP routing This allows users to change the information of the router such as IP address and the routers will automatically inform for each other What is Static Route When you have several subnets in your LAN sometimes a more effective and quicker way for connection is the Static routes function rather than other method You may simply set rules to forward data from one specified subnet to another specified subnet without the presence of
523. t need to configure Phone 2 settings simply check this box Next Click it to get into the next setting page Dr ay Tek 67 Vigor2860 Series User s Guide Cancel Click it to give up the quick start wizard 3 After finished the settings above click Next for viewing summary of such connection VoIP Wizard Please confirm your settings VoIP Service Provider draytel org SIP Port s060 Phone 1 Account 56335 Phone 2 Account 56335 Click Back to modify changes if necessary Otherwise click Finish to sawe current settings 4 Click Finish A page of VoIP Wizard Setup OK will appear VoIP Wizard Setup OK Vigor2860 Series User s Guide 68 Dr ay Tek 2 7 Registering Vigor Router You have finished the configuration of Quick Start Wizard and you can surf the Internet at any time Now it is the time to register your Vigor router to MyVigor website for getting more service Please follow the steps below to finish the router registration 1 Please login the web configuration interface of Vigor router by typing admin admin as User Name Password Dr ay Tek kn Vigor2860 Series Group Login Copyright 2012 DrayTek Corp All Rights Reserved 2 Click Support Area gt gt Production Registration from the home page 3 A Login page will be shown on the screen Please type the account and password that you created previously And click Login Please take a moment to register Membership Registrat
524. t to access in to LAN gt gt Web Portal Setup page for modifying the settings if required After finishing all the settings here please click OK to save the configuration 3 17 SSL VPN An SSL VPN Secure Sockets Layer virtual private network is a form of VPN that can be used with a standard Web browser There are two benefits that SSL VPN provides gt Itis not necessary for users to preinstall VPN client software for executing SSL VPN connection gt There are less restrictions for the data encrypted through SSL VPN in comparing with traditional VPN User Group Online User Status 3 17 1 General Setup This page determines the general configuration for SSL VPN Server and SSL Tunnel SSL VPN gt General Setup SSL VPN General Setup Port 44 Default 443 Server Certificate self signed Encryption Key Algorithm High AES 128 bits and 3DES Default RC4 128 bits OLow DES Note The settings will act on all SSL applications Available settings are explained as follows Item Description Port Such port is set for SSL VPN server It will not affect the HTTPS Port configuration set in System Maintenance gt gt Management In general the default setting is 443 Dray Te k 373 Vigor2860 Series User s Guide Server Certificate When the client does not set any certificate default certificate will be used for HTTPS and SSL VPN server Choose any one of the user defined certificates from the
525. table Denial of Service DoS Distributed DoS DDoS attacks protection IP Filters Depending on whether there is an existing Internet connection or in other words the WAN link status is up or down the IP filter architecture categorizes traffic into two Call Filter and Data Filter Call Filter When there is no existing Internet connection Call Filter is applied to all traffic all of which should be outgoing It will check packets according to the filter rules If legal the packet will pass Then the router shall initiate a call to build the Internet connection and send the packet to Internet Data Filter When there is an existing Internet connection Data Filter is applied to incoming and outgoing traffic It will check packets according to the filter rules If legal the packet will pass the router The following illustrations are flow charts explaining how router will treat incoming traffic and outgoing traffic respectively Outgoing Traffic Vigor2860 Series User s Guide 166 Dr ay Te k Stateful Packet Inspection SPI Stateful inspection is a firewall architecture that works at the network layer Unlike legacy static packet filtering which examines a packet based on the information in its header stateful inspection builds up a state machine to track each connection traversing all interfaces of the firewall and makes sure they are valid The stateful firewall of Vigor router not just examine the
526. tatus Modify GENERATE IMPORT REFRESH Available settings are explained as follows Item Description Generate Click this button to open Generate Certificate Request Vigor2860 Series User s Guide 298 Dr ay Tek window Type in all the information that the window requests Then click Generate again Import Click this button to import a saved file as the certification information Refresh Click this button to refresh the information listed below View Click this button to view the detailed settings for certificate request Delete Click this button to delete selected name with certification information GENERATE Click this button to open Generate Certificate Signing Request window Type in all the information that the window request such as certifcate name used for identifying different certificate subject alternative name type and relational settings for subject name Then click GENERATE again Certificate Management gt Local Certificate Generate Certificate Signing Request Subject Alternative Name Type IP Address v Subject Name Country C 7 state 5T Cd Organization Unit OU Po Email E DoS Key Type Key Size Note Please be noted that Common Name must be configured with rotuer s WAN IP or domain name Dr ay Te k 299 Vigor2860 Series User s Guide After clicking GENERATE the generated information will be displayed on the window below Certificate Management gt Local Certif
527. ter section Advanced Load Balance and Backup Status After choosing one of the profile listed above please click Enable to activate this profile If you click Disable the selected or current used VPN TRUNK Backup Load Balance mechanism profile will not have any effect for VPN tunnel Profile Name Type a name for VPN TRUNK profile Each profile can group two VPN connections set in LAN to LAN The saved VPN profiles in LAN to LAN will be shown on Member and Member fields The length of the name is limited to 11 characters Member 1 Member2 Display the selection for LAN to LAN dial out profiles configured in VPN and Remote Access gt gt LAN to LAN for you to choose for grouping under certain VPN TRUNK VPN Backup Load Balance mechanism profile No Index number of LAN to LAN dial out profile Name Profile name of LAN to LAN dial out profile Connection Type Connection type of LAN to LAN dial out profile VPN ServerIP Private Network VPN Server IP of LAN to LAN dial out profiles Active Mode Display available mode for you to choose Choose Backup or Load Balance for your router Add Add and save new profile to the backup profile list The corresponding members LAN to LAN profiles grouped in such new VPN TRUNK VPN Backup mechanism profile will be locked The profiles in LAN to LAN will be displayed in red VPN TRUNK VPN Load Balance mechanism profile will be locked The 291 Vigor2860 Seri
528. ter will restart with the factory default configuration PWR USB Connecter for a USB device for 3G USB Modem or printer VDSL ADSL Connecter for accessing the Internet WAN Giga Connecter for local network devices or modem for accessing Internet GigaLAN 1 6 Connecters for local network devices PWR Connecter for a power adapter ON OFF Power Switch Vigor2860 Series User s Guide 8 Dr ay Tek 1 2 4 For Vigor2860Vn plus rw rT l ireiess oO WANZ2 Line O USB DSL Phonet 0 2 4G 5G Phone2 SB VDSL2Z ADSL LED SEWE ACT Activity Blinking USB Blinking Blinking WAN2 Blinking DSL On Blinking i Blinking Line Off Phone 1 2 O Off Blinking LED on Connector Left On WAN2 LED Off Giga Blinking Right On LED Off Left On GigaLAN LED Off 1 6 Blinking On Dray Tek WAN2 Giga Vigor2860Vn plus VDSL2 Security Firewall GigaLAN gt 1 2 3 4 5 6 Phone1 2 Line Explanation The router is powered on and running normally The router is powered off USB device is connected and ready for use The data is transmitting Wireless access point with bandwidth of 2 4GHz is ready It will blink slowly while wireless traffic goes through ACT and WLAN LEDs blink quickly and simultaneously when WPS is working and will return to normal condition after two minutes You need to setup WPS within 2 minutes Internet connection is ready Internet connection is not ready
529. that Internet users can a access S IP Bjedbaed Connection on Router Ftp Example menmegr 192 169 29 11 131 35 60654 UDP iM menmegr 192 168 29 11 7 824 13251 UDP Thie connection allows you to connect to the Internet through a msnmegr 192 169 29 11 8799 63231 TCP ehared connection on another computer Settings a Fears Show ican in notification area when connected Add Edt re The reminder as regards concern about Firewall and UPnP Can t work with Firewall Software Enabling firewall applications on your PC may cause the UPnP function not working properly This is because these applications will block the accessing ability of some network ports Security Considerations Activating the UPnP function on your network may incur some security threats You should consider carefully these risks before activating the UPnP function gt Some Microsoft operating systems have found out the UPnP weaknesses and hence you need to ensure that you have applied the latest service packs and patches gt Non privileged users can control some router functions including removing and adding port mappings Vigor2860 Series User s Guide 260 Dr ay Te k The UPnP function dynamically adds port mappings on behalf of some UPnP aware applications When the applications terminate abnormally these mappings may not be removed 3 10 7 IGMP IGMP is the abbreviation of Internet Group
530. the following link http www draytek com user SupportDLUtility php Note E Any modification to the Firewall policy will break down the connections of all current users They all have to authenticate again for Internet access E The administrator may check the current users from User Online Status page Dray Te k 517 Vigor2860 Series User s Guide User Management gt gt User Online Status Current Time 01 01 00 44 08 Refresh Seconds Page Refresh Index Profile IP Address User Last Login Time Expired Time Data Quota Idle Time Action 1 admin 192 168 1 10 admin 01 01 00 28 10 Unlimited Unlimited Unlimited Block Logout 2 useri 192 168 1 10 useri 02 22 01 59 14 01 59 47 Unlimited 00 00 13 Block Logout Total Number 1 Vigor2860 Series User s Guide 518 Dray Tek Trouble Shooting This section will guide you to solve abnormal situations if you cannot access into the Internet after installing the router and finishing the web configuration Please follow sections below to check your basic installation status stage by stage Checking if the hardware status is OK or not Checking if the network connection settings on your computer are OK or not Pinging the router from your computer Checking if the ISP settings are OK or not Backing to factory default setting if necessary If all above stages are done and the router still cannot run normally it is the time for you to contact your dealer for advanced help 5
531. the multicast group After finishing all the settings here please click OK to save the configuration Dray Te k 261 Vigor2860 Series User s Guide 3 10 8 Wake on LAN A PC client on LAN can be woken up by the router it connects When a user wants to wake up a specified PC through the router he she must type correct MAC address of the specified PC on this web page of Wake on LAN WOL of this router In addition such PC must have installed a network card supporting WOL function By the way WOL function must be set as Enable on the BIOS setting Application gt Wake on LAN Wake on LAN Note Wake on LAN integrates with Bind IP to MAC function only binded PCs can wake up through IP Wake by MAC Address w IP Address macaddress f fe 4 Result J y o Available settings are explained as follows Item Description Wake by Two types provide for you to wake up the bound IP If you choose Wake by MAC Address you have to type the correct MAC address of the host in MAC Address boxes If you choose Wake by IP Address you have to choose the correct IP address Wake by MAC Address MAC Address P Address IP Address The IP addresses that have been configured in Firewall gt gt Bind IP to MAC will be shown in this drop down list Choose the IP address from the drop down list that you want to wake up MAC Address Type any one of the MAC address of the bound PCs Wake Up Click this button to wake u
532. the voice can be embedded into RTP packets Vigor V models provide various codecs including G 711 A u law G 723 G 726 and G 729 A amp B Each codec uses a different bandwidth and hence provides different levels of voice quality The more bandwidth a codec uses the better the voice quality however the codec used must be appropriate for your Internet bandwidth Usually there will be two types of calling scenario as illustrated below Calling via SIP Servers First the Vigor V models of yours will have to register to a SIP Registrar by sending registration messages to validate Then both parties SIP proxies will forward the sequence of messages to caller to establish the session If you both register to the same SIP Registrar then it will be illustrated as below Dray Te k 329 Vigor2860 Series User s Guide Alice Bob sip alice draytel com sip bobmdraytel com The major benefit of this mode is that you don t have to memorize your friend s IP address which might change very frequently if it s dynamic Instead of that you will only have to using dial plan or directly dial your friend s account name if you are with the same SIP Registrar Peer to Peer Before calling you have to know your friend s IP Address The Vigor VoIP Routers will build connection between each other Vigor VoIP Router Vigor VoIP Router Our Vigor V models firstly apply efficient codecs designed to make the best
533. this profile LJ Always on Idle Timeout 0 second s C Enable PING to keep alive PING to the IP VPN Dial Out Through WAN First Netbios Naming Packet Pass OBlock Multicast via VPN OPass Block for some IGMP IP Camera DHCP Relay etc 3 Dial In Settings Allowed Dial In Type Username TIDSDOAO PPTP Password Max 11 char 000000 Ll IPsec Tunnel YVJ Compression on O off CI L2TP with IPsec Policy IKE Authentication Method Note The profile name is created automatically by the system Do not modify any value in such page to avoid VPN error Dray Te k 503 Vigor2860 Series User s Guide 4 16 CVM Application How to upgrade CPE firmware through Vigor2860 series Download the newest firmware from your Draytek website to USB Storage Disk for the device e g Vigor2850 managed by Vigor2860 series Vigor2850 as an example is chosen for Vigor2860 to perform the CPE firmware upgrade remotely in this case 1 Plug in USB storage disk onto Vigor2860 series via USB interface Make sure the USB disk has been installed correctly otherwise the firmware upgrade will not be successful 2 Access into web user interface of Vigor2860 series Open Central VPN Management gt gt CPE Management and click the CPE Maintenance tab CVM gt gt CPE Management gt gt CPE Maintenance Managed Devices List CPE Maintenance Google Map Refi esh Maintenance Profile List Set to Factory Default Profile Index
534. tically Therefore a VLAN supported switch like VigorSwitch G2260 P2261 or VigorSwitch G1240 is needed Tag based VLAN Switch VID 100 VID 200 gA go ag BG gA VID 100 VID 200 VID 100 VID 200 Switch Switch Vigor routers support Tag based feature both on LAN and WAN interfaces The next we ll demonstrate our web design and how to configure the settings by introducing the functionalities of Vigor router Note Broadband router Vigor2920 Vigor3200 Vigor2925 Vigo2960 Vigor3900 Modem router Vigor2850 Vigor2860 Note VLAN Packets on Vigor routers Trunk mode of LAN Trunk Port Trunk Port Trunk Port can carry the packets with VID but replace the Non VID packet as the VID of Trunk port while forwarding the packets to another switch Bridge mode of WAN P1 and P2 are doing NAT flow to access to the internet but P3 and P4 will forward the packets between WAN and LAN ports directly Web User Interface So far there are two kinds of open system on Vigor router One is DrayOS which is DrayTek owned and another is Linux like which customized by DrayTek from OpenWRT Here Vigor2860 Series User s Guide 528 Dray Tek DrayOS system is going to be introduced to you because it is the most stable and superfast booting system in DrayTek products If the UI style of yours is different from the following It may not DrayOS system with new web style or maybe the Linux like model WAN Internet Access gt gt Multi VLAN
535. tication method Remote IP Display the IP address of the remote CPE and the interface Virtual Network Display the IP address and subnet mask of Vigor2860 series Tx Pkts Display the number of the transmitted packets Tx Rate Bps Display the number of the transmitted rate Rx Pkts Display the number of the received packets Rx Rate Bps Display the number of the received rate UP Time Display the connection time of such VPN 3 13 4 Log amp Alert This page offers brief information to identify the CPE connected to Vigor2860 series CVM gt gt CVM Log Log Alert Refresh Clear Display Mode Always record the new event Device Name Description Name time amp date Action Type Message Available settings are explained as follows Vigor2860 Series User s Guide 314 Dr ay Tek Item Description Display Mode Choose the mode you want to display the related information on the following table Always record the new event Stop record when fulls Alwaws record the new event toate os _ 3 Stop record when fulls when the capacity of CVM log is full the system will stop recording Always record the new event only the newest events will be recorded by the system Device Name Display the name of the managed CPE Description Name Display the brief explanation for the managed CPE Time amp date Display the time and date that the managed CPE scanned by Vigor2860 series Action Type Display the action that V
536. ties 3 Select Internet Protocol TCP IP and then click Properties ethO Properties m General Authentication Advanced Connect using E ASUSTeK Broadeom 440x 10 100 Ir This connection uses the following items vi el Client for Microsoft Networks w a File and Printer Sharing for Microsol Networks il dE QoS Packet Scheduler Uig nternet Protocol TCP IP lrstall Llenrebal E Properties Description Transmission Control Protocollntemnet Protocol The default Wide area network protocol that provides communicator across diverse interconnected networks Show icon in notiication area when connected Notify me when this connection has limited or no connectivity Vigor2860 Series User s Guide 520 Dray Tek 4 Select Obtain an IP address automatically and Obtain DNS server address automatically Internet Protocol TCP IP Properties General _Altemate Configuration E You can get IF settings assigned automatically if your network supports this capability Othenwse you need to ask your network administrator for the appropriate IP settings Obtain an IP address automatically O Use the following IP address Ih f For Mac OS 1 Double click on the current used Mac OS on the desktop 2 Open the Application folder and get into Network 3 On the Network screen select Using DHCP from the drop down list of Configure IPv4 aA Netwo
537. times works at home and takes care of children When working time he would use Vigor router at home to connect to the server in the headquarter office downtown via either HTTPS or V PN to check email and access internal database Meanwhile children may chat on Skype in the restroom 1 Goto Bandwidth Management gt gt Quality of Service Bandwidth Management gt Quality of Service General Setup Setto Factory Default UDP Class Class Class Others Bandwidth Index Status Bandwidth Direction Online 1 2 3 Control Statistics WANI Disable kbpsr Kbps 25 Inactive Status Setup WAN2 Disable 100000Kbps 100000Kbps Inactive Status Setup WAS Disable 100000Kbps 100000Kbps Inactive Status Setup WARN4 Disable 100000Kbps 100000Kbps Inactive Status Setup Class Rule Index Service Type Class 1 Class 2 i Edit Class 3 Enable the First Priority for VoIP SIP RIP SIP UDF Part 5060 Default 5060 2 Click Setup link of WAN 1 2 3 Make sure the QoS Control on the left corner is checked And select BOTH in Direction Bandwidth Management gt gt Quality of Service WAN General Setup Enable the QoS Control WAN Inboun WAN OQutbot 3 Set Inbound Outbound bandwidth Vigor2860 Series User s Guide 458 Dr ay Te k Bandwidth Management gt Quality of Service WAN General Setup Enable the Qo5 Control BOTH WAN Inbound Bandwidth 100000 Kbps WAN Outbound Bandwidth 100000 Kbps Index Class Name Reserve
538. tings are explained as follows Item Always On Username Password Confirm Password Vigor2860 Series User s Guide Description Check this box to keep the network connection always Type the name obtained from the broker Please apply new account at http www sixxs net It is suggested for you to apply another username and password The maximum length of the name you can set is 19 characters Type the password assigned with the user name The maximum length of the password you can set is 19 characters Type the password again to make the confirmation los DrayTek Tunnel Broker Type the address for the tunnel broker IP FQDN or an optional port number Subnet Prefix Type the subnet prefix address getting from service provider The maximum length of the prefix you can set is 128 characters After finished the above settings click OK to save the settings Details Page for IPv6 DHCPv6 Client in WAN1 WAN2 DHCPv6 client mode would use DHCPV6 protocol to obtain IPv6 address from server WAN gt Internet Access WAN 1 PPPoE Static or Dynamic IP PPTP IPv6 Internet Access Mode Connection Type DHCP v6 Client DHCP v6 Client Configuration Identity Association Prefix Delegation Non temporary Address IAID Identity Association ID 4230640032 Available settings are explained as follows Item Description Identify Association Choose Prefix Delegation or Non temporary Address as th
539. tion key is obtained dynamically from RADIUS server with 802 1 X protocol Mixed WPA WPA2 802 1x only Accepts WPA and WPA2 clients simultaneously and the encryption key is obtained dynamically from RADIUS server with 802 1X protocol WPA PSK Accepts only WPA clients and the encryption key should be entered in PSK WPA2 PSK Accepts only WPA2 clients and the encryption key should be entered in PSK Mixed WPA WPA2 PSK Accepts WPA and WPA2 clients simultaneously and the encryption key should be entered in PSK The WPA encrypts each frame transmitted from the radio using the key which either PSK Pre Shared Key entered manually in this field below or automatically negotiated via 802 1x authentication Either 8 63 ASCII characters such as 012345678 or 64 Hexadecimal digits leading by Ox such as 0x321253abcde Pre Shared Key PSK Either 8 63 ASCII characters such as 012345678 or 64 Hexadecimal digits leading by Ox such as 0x321253abcde 64 Bit For 64 bits WEP key either 5 ASCII characters such as 12345 or 10 hexadecimal digitals leading by Ox such as 0x4142434445 128 Bit For 128 bits WEP key either 13 ASCII sss DrayTek characters such as ABCDEFGHIJKLM or 26 hexadecimal digits leading by Ox such as 0x4142434445464748494A4B4C4D Encryption Mode ba4 Bit All wireless devices must support the same WEP encryption bit size and have the same key Four Keys can be entered here but
540. to WAN via force NAT force Routing oK Clear Cancel 6 Upon completing the above configuration you have specified the outgoing IP address es for some specific computers Load Balance Route Policy wD Policy Route Set to Factory Default Index Enable Protocol Interface pereg Src IF Start Src IP End T my aa ae a eb Start End Start End any WANT 192 168 1 16 192 168 1 31 Any Any Any Any any WANT 202 211 100 11 192 168 1 100 192 168 1 100 Any Any Any Any F any WANI C any WAN1 O any WANI Fi any WAN1 any WAN1 LI any WAN1 any WAN1 LI any WAN1 lt lt 1 10 11 20 21 30 31 40 41 50 gt gt Next gt gt OK 7 Now you bind some specific computers to some WAN IP alias for outgoing traffic Dr ay Tek 485 Vigor2860 Series User s Guide 4 11 How to Configure Certain Computers Accessing to Internet We can specify certain computers e g 192 168 1 10 192 168 1 20 accessing to Internet through Vigor router Others e g 192 168 1 31 and 192 168 1 32 outside the range can get the source from LAN only Internet i i D E SE S f 2 om i S PC PC i i P PC i t 192 168 1 10 192 168 1 20 1192 168 1 31 192 168 1 32 e ae F Mes cers eae sees eee F The way we can use is to set two rules under Firewall For Rule 1 of Set 2 under Firewall gt gt Filter Setup is used as the default setting we has to create a new rule starting from Filter Rule 2 of Set 2 1 Access into the web us
541. to restore Ooo O Decrypt password Click to upload the file Dray Te k 303 Vigor2860 Series User s Guide 3 13 Central VPN Management Vigor2860 can build virtual private network VPN between itself and any other TR 069 CPE by the function of central VPN management In addition it can be treated as a server called CVM server which can manage TR 069 CPE for periodical firmware upgrade configuration backup and restoring configuration Vigor2860 Up to 8 The f w 1 0 7 of Vigor2960 and Vigor3900 is also remote site embedded CVM for limited nodes routers e Note Such menu can manage the CPE connected through WAN only Central VPN Management 3 13 1 General Setup This page is used to configure settings which will be used by the clients to register to such Vigor router Click General Settings and IPsec VPN Settings to configure the basic settings for CVM mechanism Vigor2860 Series User s Guide 304 Dr ay Te k 3 13 1 1 General Settings To enable the CVM feature the first thing you have to do is enabling CVM port or CVM SSL Port CVM gt gt General Setup General Settings IPsec VPN Settings C evM Port 5000 C cvm SSL Port 9443 WAN IP for Remote Connection WAN vw of 17216 3133 Copy the folowing URL to paste onto Remote devices ACS Server URL field htto 1 72 16 35 133 8000 40 5Server services 4cSServlet https 172 16 35 13935 94435 4CSServerservices 4cSsServlet
542. tortie ocorbernoule loak something like his Create a new port Type of port Standard TCP IP Port Dr ay Tek 13 Vigor2860 Series User s Guide 6 In the following dialog type 192 168 1 1 router s LAN IP in the field of Printer Name or IP Address and type IP_192 168 1 1 as the port name Then click Next Add Standard TCP IP Printer Port Wizard Add Port For which device do you want to add a port Enter the Printer Name or IP address and a port name for the desired device Printer Name or IP Address 192 168 1 a Port Name IP_192 168 1 1 7 Click Standard and choose Generic Network Card Add Standard TCP IP Printer Port Wizard Additional Port Information Required The device could not be identified The detected device is of unknown type Be sure that 1 The device is properly configured 2 The address on the previous page is correct Either correct the address and perform another search on the network by returning to the previous wizard page or select the device type if you are sure the address is correct Completing the Add Standard TCP IP Printer Port Wizard You have selected a port with the following characteristics SNMP No Protocol RAW Por 9109 Device 192 168 1 1 Pot Name IP_192 163 1 1 Adapter Type Genenc Network Card To complete this wizard click Finish Vigor2860 Series User s Guide 14 Dr ay Te k 9 Now your system will ask you
543. transmission from inside to outside world to protect the local user s privacy Proxy Check the box to reject any proxy transmission To control efficiently the limited bandwidth usage it will be of great value to provide the blocking mechanism that filters out the multimedia files downloading from web pages Upload Check the box to block the file upload by way of web page File Extension Profile Choose one of the profiles that you configured in Object Setting gt gt File Extension Objects previously for passing or blocking the file downloading 26 Dray Tek File Extension Profile None After finishing all the settings please click OK to save the configuration 3 8 3 Web Content Filter Profile There are three ways to activate WCF on vigor router using Service Activation Wizard by means of CSM gt gt Web Content Filter Profile or via System Maintenance gt gt Activation Service Activation Wizard allows you to use trial version or update the license of WCF directly without accessing into the server MyVigor located on http myvigor draytek com However if you use the Web Content Filter Profile page to activate WCF feature it is necessary for you to access into the server My Vigor located on http myvigor draytek com Therefore you need to register an account on http myvigor draytek com for using corresponding service Please refer to section of creating My Vigor account Note If you have used Servic
544. type similar name with the domain For example if the domain name is draytel org then you might set draytel in this field Register via If you want to make VoIP call without register personal information please choose None and check the box to achieve the goal Some SIP server allows user to use VoIP function without registering For such server please check the box of Call without Registration Choosing Auto is recommended The system will select a proper way for your VoIP call Vigor2860 Series User s Guide 342 Dr ay Tek Dray Tek SIP Port Domain Realm Proxy Act as Outbound Proxy Display Name Account Number Name Authentication ID Password Expiry Time NAT Traversal Support Mone Hone Set the port number for sending receiving SIP message for building a session The default value is 5060 Your peer must set the same value in his her Registrar Set the domain name or IP address of the SIP Registrar server Set domain name or IP address of SIP proxy server By the time you can type port number after the domain name to specify that port as the destination of data transmission e g nat draytel org 5065 Check this box to make the proxy acting as outbound proxy The caller ID that you want to be displayed on your friend s screen Enter your account name of SIP Address e g every text before Check the box to invoke this function and enter the name or number used for SIP Authorization
545. uch page allows you to choose filtering profiles including QoS Load Balance policy WCF APP Enforcement URL Content Filter for data transmission via Vigor router Firewall gt gt General Setup General Setup General Setup Default Rule Actions for default rule Application Action Profile Syslog Sessions Control 2 60000 O Quality of Service c Load Balance policy Auto Select w F APP Enforcement Oo URL Content Filter O Web Content Filter c Advance Setting OK D ra y Te k 169 Vigor2860 Series User s Guide Available settings are explained as follows Item Description Filter Sessions Control Quality of Service Load Balance Policy User Management APP Enforcement Vigor2860 Series User s Guide Select Pass or Block for the packets that do not match with the filter rules Filter The number typed here is the total sessions of the packets that do not match the filter rule configured in this page The default setting is 60000 Choose one of the QoS rules to be applied as firewall rule For detailed information of setting QoS please refer to the related section later Choose the WAN interface for applying Load Balance Policy Auto Select Such item is available only when Rule Based is selected in User Management gt gt General Setup The general firewall rule will be applied to the user user group all users specified here User Object Create New User User Group Create New Group
546. umber of received packets at the WAN interface RX Rate Displays the speed of received octets at the WAN interface Detailed explanation for IPv6 is shown below Item Description LAN Status IP Address Displays the IPv6 address of the LAN interface TX Packets Displays the total transmitted packets at the LAN interface RX Packets Displays the total received packets at the LAN interface TX Bytes Displays the speed of transmitted octets at the LAN interface RX Bytes Displays the speed of received octets at the LAN interface WAN IPv6 Status Enable No in red means such interface is available but not enabled Yes in green means such interface is enabled No in red means such interface 1s not available Dr ay Te k 27 Vigor2860 Series User s Guide Item Description Mode Displays the type of WAN connection e g TSPC Up Time Displays the total uptime of the interface IP Displays the IP address of the WAN interface Gateway IP Displays the IP address of the default gateway Note The words in green mean that the WAN connection of that interface is ready for accessing Internet the words in red mean that the WAN connection of that interface 1s not ready for accessing Internet 1 8 2 Virtual WAN Such page displays the virtual WAN connection information Virtual WAN are used by TR 069 management VoIP service and so on The field of Application will list the purpose of such WAN connection 1
547. umber to all packets on the WAN while sending them out Please type the tag value and specify the priority for the packets sending by WANI Disable Disable the function of VLAN with tag Tag value Type the value as the VLAN ID number The range is form 0 to 4095 Priority Type the packet priority number for such VLAN The range is from 0 to 7 77 Vigor2860 Series User s Guide Active Mode Backup Type Choose Always On to make the WANI1 connection being activated always Always On Aly T 5 D n Backup Load Balance Check this box to enable auto load balance function for such WAN interface When the data traffic is large the WAN interface with the function enabled will balance the data transmission automatically among all of the WAN interfaces in connection status If you choose Backup as the Active Mode Backup Type will appear Please specify which WAN will be the Backup interface Active Mode Load Balance Wan iO wan Owan sO WAN 4 ea Ae e backup ia When any of selected WAN disconnect multiple WANS O when all of selected WAN disconnect When any of WAN disconnect Such backup WAN will be activated when any master WAN interface disconnects When all of selected WAN disconnect Such backup WAN will be activated only when all master WAN interfaces disconnect After finished the above settings click OK to save the settings WAN2 with Ethernet WAN is fixed with physic
548. unction Any TCP packet with anomaly flag setting is dropped Those scanning activities include no flag scan FIN without ACK scan SYN FINscan Xmas scan and full Xmas scan Check the box to activate the Block Tear Drop function Many machines may crash when receiving ICMP datagrams packets that exceed the maximum length To avoid this type of attack the Vigor router is designed to be capable of discarding any fragmented ICMP packets with a length greater than 1024 octets Check the box to activate the Block Ping of Death function This attack involves the perpetrator sending overlapping packets to the target hosts so that those target hosts will hang once they re construct the packets The Vigor routers will block any packets realizing this attacking activity Check the box to activate the Block ICMP fragment function Any ICMP packets with more fragment bit set are dropped Check the box to activate the Block Unknown Protocol function Individual IP packet has a protocol field in the datagram header to indicate the protocol type running over the upper layer However the protocol types greater than 100 are reserved and undefined at this time Therefore the router should have ability to detect and reject this kind of packets We provide Syslog function for user to retrieve message from Vigor router The user as a Syslog Server shall receive the report sending from Vigor router which is a Syslog Client All the warning messages re
549. unity Notification Host IP IP 4 Notification Host IP IPw6 Trap Timeout C Enable SNMPV3 Agent USM User Auth Algorithm Auth Password Privacy Algorithm Privacy Password public 0 Available settings are explained as follows Item Enable SNMP Agent Get Community Set Community Manager Host IP IPv4 Manager Host IP IPv6 Trap Community Notification Host IP IPv4 Dray Tek Description Check it to enable this function Set the name for getting community by typing a proper character The default setting is public The maximum length of the text is limited to 23 characters Set community by typing a proper name The default setting is private The maximum length of the text is limited to 23 characters Set one host as the manager to execute SNMP function Please type in IPv4 address to specify certain host Set one host as the manager to execute SNMP function Please type in IPv6 address to specify certain host Set trap community by typing a proper name The default setting is public The maximum length of the text is limited to 23 characters Set the Pv4 address of the host that will receive the trap community 411 Vigor2860 Series User s Guide Notification Host IP Set the IPv6 address of the host that will receive the trap IPv6 community Trap Timeout The default setting is 10 seconds Enable SNMPV3 Agent Check it to enable this function USM User USM means user ba
550. ur Computer Is OK or Not 0 520 5 3 Pinging the Router from Your Computer cccccccsseeseeeceeeeeeaeeeeeeeeeeeeaueaeeeeeeeeeessaaaeeseeeess 522 5 4 Checking If the ISP Settings are OK or Not cccceceeeceeeeeeeeeeeeeeeeeeeeeeaaaaaaaaaaeeeeeeeeeeeeees 523 5 5 Problems for 3G Network Connection ccccccccceseseseeeceeeeeeeeeeeeeeeeeeeeseaeeeeeeeessseaageeeeeeees 523 5 6 Backing to Factory Default Setting If Necessary c ccceeeeeeeeeeeeeeeeeeeeeeaaeaeeeeeeeeeeeeeeeeees 524 On GOO TO VOUF CANO i a cccegastconntensecedeeeaccnqeasascncdy aconeseuaneatas arecesesevedioawccuosdse aseeesecevosaunenate 525 Appendix I VLAN Applications on Vigor Router ccccsscssssseeeeeseeeeeseneeeneeeeseeeaeees 527 Appendix IIE Release NOTE aisiccssicccciccceiteswiteee veces cect ce seca aaa aeaaeae Eaa aean Eaa aaa 535 Dr ay Tek ix Vigor2860 Series User s Guide Vigor2860 Series User s Guide x Dr ay Te k Introduction Vigor2860 series is a VDSL2 router It integrates IP layer QoS NAT session bandwidth management to help users control works well with large bandwidth By adopting hardware based VPN platform and hardware encryption of AES DES 3DES the router increases the performance of VPN greatly and offers several protocols such as Psec PPTP L2TP with up to 32 VPN tunnels The object based design used in SPI Stateful Packet Inspection firewall allows users to set firewall policy with ease CSM
551. urn a category to your router Your Vigor router will then decide whether to allow access to this site according to the categories you have selected Please note that this action will not introduce any delay in your Web surfing because each of multiple load balanced database servers can handle millions of requests for categorization Note The priority of URL Content Filter is higher than Web Content Filter Vigor2860 Series User s Guide 218 Dr ay Tek 3 8 1 APP Enforcement Profile You can define policy profiles for IM Instant Messenger P2P Peer to Peer Protocol Misc application This page allows you to set 32 profiles for different requirements The APP Enforcement Profile will be applied in Default Rule of Firewall gt gt General Setup for filtering CSM gt APP Enforcement Profile APP Enforcement Profile Table Set to Factory Default Profile Name Profile Name 1 17 2 18 19 5 21 6 22 7 23 8 24 9 25 if 27 14 30 15 31 16 32 Available settings are explained as follows Item Description Set to Factory Default Clear all profiles Profile Display the number of the profile which allows you to click to set different policy Name Display the name of the APP Enforcement Profile Click the number under Index column for settings in detail There are four tabs IM P2P Protocol and Misc displayed on this page Each tab wi
552. use of available bandwidth but Vigor V models also equip with automatic QoS assurance QoS Assurance assists to assign high priority to voice traffic via Internet You will always have the required inbound and outbound bandwidth that is prioritized exclusively for Voice traffic over Internet but you just get your data a little slower and it is tolerable for data traffic Vigor2860 Series User s Guide 330 Dr ay Te k 3 15 1 DialPlan This page allows you to set phone book digit map call barring regional settings and PSTN setup for the VoIP function Click the links on this page to access into next pages for detailed settings VoIP gt gt DialPlan Setup DialPlan Configuration Phone Book Digit Map Call Barring Regional PSTN Setup Secure Phone configuration Enable Secure Phone 2RTP SRTP3 Enable SAS Yoice Prompt Available settings are explained as follows Item Description Enable Secure Phone It allows users to have encrypted RTP stream with the peer side using the same protocol ZRTP SRTP Check this box to have secure call Enable SAS Voice Prompt If it is enabled SAS prompt will be heard for both ends every time If it is disabled no SAS prompt will be heard any more Application for Secure Phone Enable SAS Voice Prompt for ex if vigor router A calls vigor router B with checking Enable Secure Phone and Enable SAS Voice Prompt then 1 After the connection established vigor router A will send SAS
553. uter Please set at least one profile for anti virus in CSM gt gt Web Content Filter web page first Or choose Create New from the drop down list in this page to create a new profile For troubleshooting needs you can specify to record information for Web Content Filter by checking the Log box It will be sent to Syslog server Please refer to section Syslog Mail Alert for more detailed information Advance Setting Click Edit to open the following window However it is strongly recommended to use the default settings here Firewall gt gt General Setup Advance Setting Codepage ANSI1252 Latin Window size Session timeout 1440 Minute Codepage This function is used to compare the characters among different languages Choose correct codepage can help the system obtaining correct ASCII after decoding data from URL and enhance the correctness of URL Content Filter The default value for this setting is ANSI 1252 Latin I If you do not choose any codepage no decoding job of URL will be processed Please use the drop down list to choose a codepage If you do not have any idea of choosing suitable codepage please open Syslog From Codepage Information of Setup dialog you will see the recommended codepage listed on the dialog box Dray Te k 171 Vigor2860 Series User s Guide Dray Tek P Syslog Utility Tol Zetun Tele Remon deio Codepage infoemaies Recovery Hetecak lnfannabon Heitini Coad page To Select W
554. uthentication Web Alert Tool Telnet Landing Page Index 1 15 in Schedule Setup Reset quota to default when scheduling time expired C Enable Default Time Quota bo mir Default Data Quota bo e 515 Vigor2860 Series User s Guide 4 If the Time Quota is set with 0 minute you will get the following message which means this account has no time quota teconntiuger Faseyvord eer se time is up or it has not enough time quota If the Time Quota is enabled and time is not 0 minute User Management gt gt User Profile Profi le Index 3 Enable He oui Wiser Name Password Confirm Password Idle Timeout mings O Unlimited Mas User Login O Unlimited Policy Default The selection of items could be created as rules and which not set to active External Server Authentication Log Pop Browser Tracking Window Authentication Landing Page Indes 1 151in Schedule Setup Reset quota to default when scheduling time expired C Enable Default Time Quota lo min Default Data Quota o MB ok Refresh ciar _ _Cancel_ You will get the following message The expired time is shown after you login uger P a P Saor d EEEE bot kot User login successful expired time ig 12 23 10 21 33 After you run out the available time you can t use this account
555. utton the configuration will download automatically to your computer as a file named config cfg The above example is using Windows platform for demonstrating examples The Mac or Linux platform will appear different windows but the backup function is still available Note Backup for Certification must be done independently The Configuration Backup does not include information of Certificate Restore Configuration 1 Goto System Maintenance gt gt Configuration Backup The following windows will be popped up as shown below System Maintenance gt gt Configuration Backup Configuration Backup Restoration Restoration Select a configuration file rw Click Restore to upload the file Backup Click Backup to download current running configurations as a file 2 Click Browse button to choose the correct configuration file for uploading to the router 3 Click Restore button and wait for few seconds the following picture will tell you that the restoration procedure is successful Vigor2860 Series User s Guide 406 Dr ay Tek 3 19 7 Syslog Mail Alert SysLog function is provided for users to monitor router There is no bother to directly get into the Web user interface of the router or borrow debug equipments System Maintenance gt gt SysLog Mail Alert Setup SysLog Mail Alert Setup SysLog Access Setup Enable Syslog Save to Syslog Server LIUSB Disk Mail Alert Setup LJ Enable SMTP Server SMTP P
556. ved Lease time setting is supported by LAN2 to LAN6 Improved Add the function of Retrieve IPs from inactive clients periodically on the page of LAN gt gt General Setup Improved VLAN header is supported in LAN for Multi VLAN bridge connection Improved Support more LTE modems such as Huawei E398 Huawei E3276 novatel 5511 uml290vw c samsung B3730 LG vl600 ZTE MF820D and ZTE MF880D Improved Display the status of two USB modems Improved Add WAN DHCP option configuration in the page of WAN gt gt Internet Access Improved Increase more port number settings for Port Redirection and Open ports gt IP Alias Number 32 original 8 gt Port Redirection Number 40 original 20 Dray Te k 535 Vigor2860 Series User s Guide gt Open Port Number 40 original 20 Improved Move license wizard for WCF to portal Improved Out of date control for license is processed on portal Improved Modify the items under LAN Access Control on System Maintenance gt gt Management Improved Modification for management port setup for TR 069 Improved The IP pool count changes from 10 to 32 for IP Routed subnet Improved Disable warning message for GW IP in IP assignment range when DHCP server is disabled Improved The router doesn t need to reboot to make the IP range setting take effect after finished PPTP general setup Corrected WLAN client cannot access into Internet when IGMP P
557. voke this function and Select one predefined Profiles set in the VPN and Remote Access gt gt IPsec Peer Identity This group of fields is a must for Psec Tunnels and L2TP with IPsec Policy when you specify the remote node Check the Medium DES 3DES or AES box as the security method Medium Authentication Header AH means data will be authenticated but not be encrypted By default this option is invoked You can uncheck it to disable it High Encapsulating Security Payload ESP means payload data will be encrypted and authenticated You may select encryption algorithm from Data Encryption Standard DES Triple DES 3DES and AES Local ID Optional Specify a local ID to be used for Dial in setting in the LAN to LAN Profile setup This item is optional and can be used only in IKE aggressive mode After finishing all the settings here please click OK to save the configuration 3 11 6 LAN to LAN Here you can manage LAN to LAN connections by maintaining a table of connection profiles You may set parameters including specified connection direction dial in or dial out connection peer ID connection type VPN connection including PPTP IPsec Tunnel and L2TP by itself or over IPsec and corresponding security methods etc The router supports up to 32 VPN tunnels simultaneously The following figure shows the summary table The following figure shows the summary table according to the item All Trunk selected for View
558. which uses dynamic IP address and IPsec related VPN connections such as L2TP over IPsec and IPsec tunnel There are two methods offered by Vigor router for you to authenticate the incoming data coming from remote dial in user Certificate X 509 and Pre Shared Key Certificate for Dial in Choose one of the local certificates from the drop down list Pre Shared Key Specify a key for IKE authentication Confirm Pre Shared Key Retype the characters to confirm the pre shared key Note Any packets from the remote dial in user which does not match the rule defined in VPN and Remote Access gt gt Remote Dial In User will be applied with the method specified here IPsec Security Method Medium Authentication Header AH means data will be authenticated but not be encrypted By default this option 1S active High ESP Encapsulating Security Payload ESP means payload data will be encrypted and authenticated You may select encryption algorithm from Data Encryption Standard DES Triple DES 3DES and AES After finishing all the settings here please click OK to save the configuration Dray Te k 271 Vigor2860 Series User s Guide 3 11 4 IPsec Peer Identity To use digital certificate for peer authentication in either LAN to LAN connection or Remote User Dial In connection here you may edit a table of peer certificate for selection As shown below the router provides 32 entries of digital certificates for peer dial in
559. window location http www draytek com lt script gt lt body gt Available settings are explained as follows Item Description Mode There are two modes offered here for you to choose Each mode will bring different filtering effect to the users involved User Based If you choose such mode the router will apply the filter rules configured in User Management gt gt User Profile to the users Rule Based If you choose such mode the router will apply the filter rules configured in Firewall gt gt General Setup and Filter Rule to the users Web Authentication Choose the protocol for web authentication Landing Page Type the information to be displayed on the first web page when the LAN user accessing into Internet via such router After finishing all the settings here please click OK to save the configuration Vigor2860 Series User s Guide 186 Dr ay Te k 3 6 2 User Profile This page allows you to set customized profiles up to 200 which will be applied for users controlled under User Management Simply open User Management gt gt User Profile User Management gt gt User Profile User Profile Table Setto Factory Default Profile Name Profile Name admin Dial In User LAN User_Group_1 WLAN User Group amp WLAN User Group B FEBBREBBEBEBERBEBEEE i Pt 33 64 65 96 97 128 129 160 161 192 193 200 gt Next gt gt A A TE k k k k k k k SERRE BREBrEPrRP PrP rE e Pe
560. with SIP Registrar If this setting value is the same as Account Name it is not necessary for you to check the box and set any value in this field The password provided to you when you registered with a SIP service The time duration that your SIP Registrar server keeps your registration record Before the time expires the router will send another register request to SIP Registrar again If the router e g broadband router you use connects to internet by other device you have to set this function for your necessity NAT Traversal Support None Disable this function Stun Choose this option if there is Stun server provided for your router Manual Choose this option if you want to specify an external IP address as the NAT transversal support Nortel If the soft switch that you use supports Nortel solution you can choose this option 343 Vigor2860 Series User s Guide Call Forwarding Ring Port Ring Pattern Prefer Codec Packet Size Vigor2860 Series User s Guide There are four options for you to choose Disable is to close call forwarding function Always means all the incoming calls will be forwarded into SIP URL without any reason Busy means the incoming calls will be forwarded into SIP URL only when the local system is busy No Answer means if the incoming calls do not receive any response they will be forwarded to the SIP URL by the time out Mo Answer Busy or Mo Answer SI
561. xecute the next action Dray Tek VPN and Remote Access gt gt VPN Client Wizard Please confirm your settings LAN to LAN Index Profile Name VPN Connection Type VPN Dial OQut Through Always on Server IP Host Name IKE Authentication Method IPsec Security Method Remote Network IP Remote Network Mask 20 VPN 2 L2TP over IPsec Nice to Have WANI First No 172 16 3 8 Pre Shared Key AH SHA1 0 0 0 0 255 255 255 0 Click Back to modify changes if necessary Otherwise click Finish to save the current settings and proceed to the following action Go to the VPN Connection Management Do another VPN Client Wizard setup view more detailed configurations Available settings are explained as follows Item Go to the VPN Connection Management Do another VPN Server Wizard Setup View more detailed configuration Description Click this radio button to access VPN and Remote Access gt gt Connection Management for viewing VPN Connection status Click this radio button to set another profile of VPN Server through VPN Server Wizard Click this radio button to access VPN and Remote Access gt gt LAN to LAN for viewing detailed configuration 57 Vigor2860 Series User s Guide 2 4 VPN Server Wizard Such wizard is used to configure VPN settings for VPN server Such wizard will guide to set the LAN to LAN profile for VPN dial in connection from client to server step by step 1
562. xplained as follows Item Description Enable Check this box to enable such profile Profile Type a name for such profile Domain Name Type the domain name for such profile Vigor2860 Series User s Guide 250 Dr ay Tek IP Address List The IP address listed here will be used for mapping with the domain name specified above In general one domain name maps with one IP address If required you can configure two IP addresses mapping with the same domain name Add Click it to open a dialog to type the host s IP address 172 16 3 133 2860 doc landnshost htn 4 Host s IP Address 172 16 3 8 LJonly responds to the DNS request when the sender is in the same subnet Only responds to the DNS Different LAN PCs can share the same domain name However you have to check this box to make the router identify amp respond the IP address for the DNS query coming from different LAN PC Delete Click it to remove an existed IP address on the list Click OK button to save the settings 4 Anew LAN DNS profile has been created Applications gt gt LAN DNS LAN DNS Resolution Set to Factory Default Enable Index Profile Domain Name MAIL ms draytek com a m d m d d LI m d ol B e e m oe Pee Pe Dray Te k 251 Vigor2860 Series User s Guide 3 10 3 Schedule The Vigor router has a built in clock which can update itself manually or automatically by means of Network Time Protocols NTP As a r
563. y reasons tt is suggested for you to notice the medications or changes at any time If you still use MyVigor service after knowing the modifications and changes of this service it means you have read understand and agree to accept the modifications and changes If you do not agree the content of this agreement please stop using Myvigor service 2 Registration To use this service you have to agree the following conditions a Provide your complete and correct information according to the registration steps of this service 3 Type your personal information in this page and then click Continue Register Create an account Please enter personal profile Fields marked by are required Account Information UserName May sd Check Account acen ES occo Password aa 4 20 characters Do not set the same as the username Confirm Password sooo Personal Information First Name Mary Last Name Ted Company Name Tech Ltd E Please note that a valid E mail address is required to receive the Subscription Code You will need this code to activate your account Tel 0 Country SWITZERLAND v Career Supervisor v 4 Choose proper selection for your computer and click Continue Create an account Please enter personal profile Dray Tek Gasreement Personal Information Sdcomptetion How did you find out about this website
564. y the profile number that you can configure Name Display the name of the object profile Dr ay Te k 209 Vigor2860 Series User s Guide To set a new profile please do the steps listed below 1 Click the number e g 1 under Profile column for configuration in details 2 The configuration page will be shown as follows Objects Setting gt File Extension Object Setup Profile Index 1 Profile Name Categories File Extensions Image Select All O bmp O dib Cl aif O jpeg C jpg Ol jpa2 Ol jp2 LJ pet Cl pex J pic C pict Cl png F tif E tiff Clear All Select All L ast l avi O mov O mpe O mpeg O mpg O mp4 F qt C rm Owmy O 39p CF 3qpp O 39pp2 0 392 Select All F aac P aiff F au O mp3 O m4a C m4p D ogg F ra O ram Ol vox O wav Cl wma r lt a e Clear All Java Select All Fl dass fl jad Cl jar Ol jav Ojava C jcm Ol js Clear All O jse E jsp F jtk ActiveX Selec All O alx Ol apb DO axs C ocx O olb O ole C tlb O viv C vrm Clear All Compression Available settings are explained as follows Item Description Profile Name Type a name for this profile The maximum length of the name you can set is 7 characters 3 Type a name for such profile and check all the items of file extension that will be processed in the router Finally click OK to save this profile Vigor2860 Series User s Guide 210 Dr ay Te k 3 7 10 SMS Mail Service Object
565. ype VPN Server and check the box of Enable This Profile For Vigor router will be set as a server the call direction shall be set as Dial in and set 0 as Idle Timeout VPN and Remote Access gt gt LAN to LAN Profile Index 1 Call Direction VEN Sener Profile Name O Always on Idle Timeout o second s VPN Dial Out Through WAN1 First M C Enable PING to keep alive Netbios Naming Packet Pass O Block PING to the IP fs Multicast via VPN Pass OBlock for some IGMP IP Camera DHCP Relay etc 2 Dial Out Settings Enable this profile 449 Vigor2860 Series User s Guide 4 Now navigate to the next section Dial In Settings to check PPTP IPsec Tunnel and L2TP boxes Check the box of Specify Remote and type the Peer VPN Server IP e g 218 242 130 19 in this case Press the IKE Pre Shared Key button to set the PSK and select Medium AH or High ESP as the security method 3 Dial In Settings Allowed Dial In Type Username 777 PPTP Password IPsec Tunnel VJ Compression On off L2TP with IPsec Policy Specify Remote VPN Gateway IKE Authentication Method Pre Shared Key Peer VPN Server IP IKE Pre Shared Key Siaubas Digital Signature xX 509 Local ID Alternative Subject Name First Subject Name First iPsec Security Method Medium AH High ESP DES MV 3DES M AES 4 Gre over IPsec Settings 5 Continue to navigate to the TCP
566. yped in this field to know where the last phone call comes from and call back to that one You have finished an incoming phone call however you want to call back again for some reason Please dial number typed in this field to call back to that one Dial the number typed in this field to call the previous outgoing phone call again Dial the number typed in this field to forward all the incoming calls to the specified place Dial the number typed in this field to release the call forward function Dial the number typed in this field to forward all the incoming calls to the specified place while the phone is busy Dial the number typed in this field to forward all the incoming calls to the specified place while there is no 33s DrayTek Ans Act Do Not Disturb Act Do Not Distrub Deact Hide caller ID Act Hide caller ID Deact Call Waiting Act Call Waiting Deact Block Anonymous Act Block Anonymous Deact Block Unknown Domain Act Block Unknown Domain Deact Block IP Calls Act Block IP Calls Deact Block Last Calls Act answer of the connected phone Dial the number typed in this field to invoke the function of DND Dial the number typed in this field to release the DND function Dial the number typed in this field to make your phone number ID not displayed on the display panel of remote end Dial the number typed in this field to release this function Dial the number type

User Guide

Contents

Download Pdf Manuals

Related Search

Related Contents