Vigor 3100 Series G.SHDSL Security Router User’s Guide Version: 2.
Copyright Information Copyright Declarations Copyright 2009 All rights reserved. This publication contains information that is protected by copyright. No part may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language without written permission from the copyright holders. Trademarks The following trademarks are used in this document: z Microsoft is a registered trademark of Microsoft Corp.
European Community Declarations Manufacturer: Address: Product: DrayTek Corp. No. 26, Fu Shing Road, HuKou Township, HsinChu Industrial Park, Hsin-Chu, Taiwan 303 Vigor3100 Series G.SHDSL Routers DrayTek Corp. declares that Vigor3100 series of routers are in compliance with the following essential requirements and other relevant provisions of R&TTE Directive 1999/5/EEC.
Table of Contents 1 Preface ...............................................................................................................1 1.1 Panel Description .................................................................................................................... 2 1.1.1 Vigor3100 ......................................................................................................................... 2 1.1.2 Vigor3100G........................................................................
3.3.1 Port Redirection .............................................................................................................. 48 3.3.2 DMZ Host........................................................................................................................ 50 3.3.3 Open Ports...................................................................................................................... 52 3.4 Firewall ......................................................................................
3.11.8 Station Rate Control ................................................................................................... 134 3.12 VLAN ................................................................................................................................. 134 3.12.1 Wired VLAN ................................................................................................................ 134 3.12.2 Wireless VLAN.................................................................................
5.4 Checking If the ISP Settings are OK or Not ........................................................................ 187 5.5 Problems for 3G Network Connection ................................................................................ 188 5.6 Backing to Factory Default Setting If Necessary ................................................................ 189 5.7 Contacting Your Dealer .......................................................................................................
1 Preface Targeting requirement for residential, SOHO (Small Office and Home Office) and business users, the Vigor3100 series are G.SHDSL enabled integrated access device. G.SHDSL is going to be a prevailing standard for business and residential SDSL (Symmetrical DSL) in the rapidly growing worldwide marketplace. Vigor3100/G provides data upto 2.3Mbps through one single pair; Vigor3120 offers data upto 4.6Mbps through two pairs. The Vigor3100G models are embedded 802.
1.1 Panel Description 1.1.1 Vigor3100 Front Panel LED Status Explanation ACT (Activity) Blinking The router is powered on and running properly. VPN On The VPN tunnel is launched. QoS On The QoS function is active. PRN On The USB interface printer is ready. DSL On The G.SHDSL line is connected LAN LNK (1, 2, 3, 100 4) Blinking It means that Ethernet packets are transmitting. On It means that a normal 100Mbps connection is through its corresponding port.
1.1.2 Vigor3100G Front Panel LED Status Explanation ACT (Activity) Blinking The router is powered on and running properly. VPN On The VPN tunnel is launched. QoS On The QoS function is active. PRN On The USB interface printer is ready. WLAN On The wireless LAN function is enabled. Blinking Wireless traffic goes through. On The G.SHDSL line is connected. Blinking It means that Ethernet packets are transmitting.
1.1.3 Vigor3100i Front Panel LED Status Explanation ACT (Activity) Blinking The router is powered on and running properly. VPN On The VPN tunnel is launched. QoS On The QoS function is active. PRN On On Blinking On The USB interface printer is ready. The ISDN service function is active. It means that data is transmitting. The G.SHDSL line is connected LNK Blinking It means that Ethernet packets are transmitting.
1.1.4 Vigor3100V Front Panel LED Status Explanation ACT (Activity) Blinking The router is powered on and running properly. VPN On The VPN tunnel is launched. QoS On The QoS function is active. PRN On The USB interface printer is ready. VoIP (2,1) On The phone is off hook (the handset of phone is hanging). Blinking A phone call is incoming or on-line. On The G.SHDSL line is connected LNK Blinking It means that Ethernet packets are transmitting.
1.1.5 Vigor3120 Front Panel LED Status Explanation ACT (Activity) Blinking The router is powered on and running properly. VPN On The VPN tunnel is launched. QoS On The QoS function is active. PRN On The USB interface printer is ready. DSL On The G.SHDSL line is connected. Blinking It means that Ethernet packets are transmitting. On It means that a normal 100Mbps connection is through its corresponding port.
1.2 Hardware Installation 1.2.1 For Vigor3100/Vigor3100G/Vigor3100V/Vigor3100i Before starting to configure the router, you have to connect your devices correctly. 1. Connect the DSL port of the router to the wall outlet with a RJ-11 to RJ-45 (or RJ-45 to RJ-45) cable. For Vigor3120, please refer to 1.2.2. 2. Connect one port of 4-port switch to your computer with a RJ-45 cable. 3. Connect the printer/3G USB Modem to the router with the USB cable and connect the power cord.
1.2.2 Hardware Installation for Vigor3120 Vigor3120 provides Flat Module Cable (RJ-45, 4x4) for bonding bandwidth for data transmission. Please apply two-pair of circuit from your ISP first for hardware connection. Then, open the cover of surface jack and use a screw driver to loosen the screws inside the surface jack. Notice that lines wrapped with same color tape mean one pair. Please connect them to one surface jack (that will be used to connect to DSL connector of the router).
1.2.3 Pin Definition for Flat Module Cable Below shows the pin definition of flat module cable. One pair is composed by Pin4 and Pin5. The other pair is composed by Pin3 and Pin6.
1.3 Rack Mount Instruction The Vigor3100 series can be mounted on a rack by using standard brackets in a 19-inch rack or optional larger brackets on 23-inch rack (not included). The bracket for the racks are shown below. Use brackets to set the Vigor router on the rack as shown below. After the bracket installation, the Vigor router chassis can be installed in a rack by using four screws for each side of the rack.
1.4 Printer Installation You can install a printer onto the router for sharing printing. All the PCs connected this router can print documents via the router. The example provided here is made based on Windows XP/2000. For Windows 98/SE, please visit www.draytek.com. Before using it, please follow the steps below to configure settings for connected computers (or wireless clients). 1. Connect the printer with the router through USB/parallel port. 2. Open Start->Settings-> Printer and Faxes. 3.
4. Click Local printer attached to this computer and click Next. 5. In this dialog, choose Create a new port Type of port and use the drop down list to select Standard TCP/IP Port. Click Next. 6. In the following dialog, type 192.168.1.1 (router’s LAN IP) in the field of Printer Name or IP Address and type IP_192.168.1.1 as the port name. Then, click Next.
7. Click Standard and choose Generic Network Card. 8. Then, in the following dialog, click Finish. 9. Now, your system will ask you to choose right name of the printer that you installed onto the router. Such step can make correct driver loaded onto your PC. When you finish the selection, click Next.
10. For the final stage, you need to go back to Control Panel-> Printers and edit the property of the new printer you have added. 11. Select "LPR" on Protocol, type p1 (number 1) as Queue Name. Then click OK. Next please refer to the red rectangle for choosing the correct protocol and UPR name. The printer can be used for printing now. Most of the printers with different manufacturers are compatible with vigor router.
Note 1: Some printers with the fax/scanning or other additional functions are not supported. If you do not know whether your printer is supported or not, please visit www.draytek.com to find out the printer list. Open Support >FAQ; find out the link of Printer Server and click it; then click the What types of printers are compatible with Vigor router? link. Note 2: Vigor router supports printing request from computers via LAN ports but not WAN port.
This page is left blank.
2 Configuring Basic Settings For use the router properly, it is necessary for you to change the password of web configuration for security and adjust primary basic settings. This chapter explains how to setup a password for an administrator and how to adjust basic settings for accessing Internet successfully. Be aware that only the administrator can change the router configuration. 2.
Note: The home page will change slightly in accordance with the router you have. 4. Go to System Maintenance page and choose Administrator Password. 5. Enter the login password (the default is blank) on the field of Old Password. Type a new one in the field of New Password and retype it on the field of Confirm Password. Then click OK to continue. 6. Now, the password has been changed. Next time, use the new password to access the Web Configurator for this router.
2.2 Quick Start Wizard If your Vigor router can be under an environment with high speed NAT, the configuration provide here can help you to deploy and use the router quickly. There are two phases of quick setup, one is protocol/encapsulation configuration; and the other is LAN configuration. 2.2.1 Adjusting Protocol/Encapsulation In the Quick Start Wizard, you can configure the router to access the Internet with different protocols/modes such as PPPoE, PPPoA, Bridged IP, or Routed IP.
travels through the network. A virtual channel is a logical connection between two end devices on the network. Protocol/Encapsulation Select an IP mode for this WAN interface. There are several available modes for Internet access such as PPPoE, PPPoA, Bridged IP and Routed IP. Fixed IP Click Yes to specify a fixed IP for the router. Otherwise, click No (Dynamic IP) to allow the router choosing a dynamic IP. If you choose No, the following IP Address, Subnet Mask and Default Gateway will not be changed.
Idle Timeout Type in the value (unit is second) as the idle timeout of the connection. Click Next for viewing summary of such connection. Click Finish. The online status of this protocol will be shown as below. 2.2.3 Bridged IP Click 1483 Bridged IP as the protocol. Type in all the information that your ISP provides for this protocol. After finishing the settings in this page, click Next to see the following page.
Click Finish. The online status of this protocol will be shown as below. 2.2.4 Routed IP Click 1483 Routed IP as the protocol. Type in all the information that your ISP provides for this protocol.
After finishing the settings in this page, click Next to see the following page. Click Finish. The online status of this protocol will be shown as below. 2.3 Selecting Correct Annex Type After finishing Quick Start Wizard, please go to Internet Access and choose DSL Settings for making sure you have chosen correct annex type for your router. Use the drop down list of Annex Type for choosing A or B according to the annex type of your router.
2.4 Online Status Now, check the online status for your router. The online status shows the system status, WAN status, ADSL Information and other status related to this router within one page. If you select PPPoE or PPPoA as the protocol, you will find out a button of Dial PPPoE or Dial PPPoE in the Online Status web page. Primary DNS Displays the assigned IP address of the primary DNS. Secondary DNS Displays the assigned IP address of the secondary DNS.
2.5 Saving Configuration Each time you click OK on the web page for saving the configuration, you can find messages showing the system interaction with you. Ready indicates the system is ready for you to input settings. Settings Saved means your settings are saved once you click Finish or OK button.
This page is left blank.
3 Advanced Web Configuration After finished basic configuration of the router, you can access Internet with ease. For the people who want to adjust more setting for suiting his/her request, please refer to this chapter for getting detailed information about the advanced configuration of this router. As for other examples of application, please refer to chapter 4. 3.1 Internet Access 3.1.1 Basics of Internet Protocol (IP) Network IP means Internet Protocol.
When a router begins to connect to your ISP, a serial of discovery process will occur to ask for a connection. Then a session will be created. Your user ID and password is authenticated via PAP or CHAP with RADIUS authentication system. And your IP address, DNS server, and other related information will usually be assigned by your ISP.
PPPoE/PPPoA Client Click Enable for activating this function. If you click Disable, this function will be closed and all the settings that you adjusted in this page will be invalid. DSL Modem Settings Set up the DSL parameters required by your ISP. These are vital for building DSL connection to your ISP. Multi-PVC channel – The selections displayed here are determined by the page of Internet Access – Multi PVCs. Select M-PVCs Channel means no selection will be chosen.
None - Disable the backup function. Packet Trigger -The backup line is not on until a packet from a local host triggers the router to establish a connection. Always On - If the broadband connection is no longer available, the backup line will be activated automatically and always on until the broadband connection is restored. We recommend you to enable this feature if you host a web server for your customers’ access. ISDN - This setting is available for the routers supporting ISDN function only.
only. You may choose up to 4 schedules out of the 15 schedules pre-defined in Applications >> Schedule setup. The default setting of this filed is blank and the function will always work. ISP Access Setup Enter your allocated username, password and authentication parameters according to the information provided by your ISP. If you want to connect to Internet all the time, you can check Always On. ISP Name – Type in the ISP Name provided by ISP in this field.
If you do not check Join NAT IP Pool, you can still use these public IP addresses for other purpose, such as DMZ host, Open Ports. Default MAC Address Type in MAC address for the router. You can use Default MAC Address or specify another MAC address for your necessity. MAC Address – Type in the MAC address for the router manually. Index (1-15) in Schedule Setup You can type in four sets of time schedule for your request.
MPoA(RFC1483/2684) Click Enable for activating this function. If you click Disable, this function will be closed and all the settings that you adjusted in this page will be invalid. DSL Modem Settings Set up the DSL parameters required by your ISP. These are vital for building DSL connection to your ISP. Multi-PVC channel - The selections displayed here are determined by the page of Internet Access – Multi PVCs. Select M-PVCs Channel means no selection will be chosen.
ISDN - This setting is available for the routers supporting ISDN function only. Before utilizing the ISDN dial backup feature, you must create a dial backup profile first. Please click Internet Access Setup > Dialing to a Single ISP to enter the backup profile. Due to the absence of the ISDN interface in some models, the ISDN dial backup feature and its associated setup options are not available to them. Please refer to the previous part for further information. None - Disable the backup function.
Bridge Mode If you choose Bridged IP as the protocol, you can check this box to invoke the function. WAN IP Network Settings This group allows you to obtain an IP address automatically and allows you type in IP address manually. Obtain an IP address automatically – Click this button to obtain the IP address automatically. Router Name – Type in the router name provided by ISP. Domain Name – Type in the domain name that you have assigned.
Enable Type in the primary IP address for the router. If necessary, type VPI Type in the value provided by your ISP. VCI Type in the value provided by your ISP. QoS Type Select a proper QoS type for the channel. Protocol Select a proper protocol for this channel. Encapsulation Choose a proper type for this channel. The types will be different according to the protocol setting that you choose. 3.1.
Below shows settings for Vigor3100/Vigor3100G/Vigor3100i. AdaptiveRate Set the connection rate for the network. MaxRate Select the maximum rate for this setting. Use the drop down list to select the one that suits your router. The default value is 2312. MinRate Select the minimum rate for this setting. Use the drop down list to select the one that suits your router. The default value is 72. FixedRate If you select this one, only the fixed value is useful.
FixedRate If you select Standard mode or Enhanced mode on 4-wire bundle mode, only the fixed rate is available for line speed. Please use the drop down list to choose the one that you subscribe. Terminal Type Determine the role of this device as a CPE or CO. Annex Type Choose the correct annex type (A or B) for your router. 3.2 LAN Local Area Network (LAN) is a group of subnets regulated and ruled by router.
What is Routing Information Protocol (RIP) Vigor router will exchange routing information with neighboring routers using the RIP to accomplish IP routing. This allows users to change the information of the router such as IP address and the routers will automatically inform for each other. What is Static Route When you have several subnets in your LAN, sometimes a more effective and quicker way for connection is the Static routes function rather than other method.
3.2.2 General Setup This page provides you the general settings for LAN. Click LAN to open the LAN settings page and choose General Setup. 1st IP Address Type in private IP address for connecting to a local private network (Default: 192.168.1.1). 1st Subnet Mask Type in an address code that determines the size of the network. (Default: 255.255.255.0/ 24) For IP Routing Usage Click Enable to invoke this function. The default setting is Disable.
Start IP Address: Enter a value of the IP address pool for the DHCP server to start with when issuing IP addresses. If the 2nd IP address of your router is 220.135.240.1, the starting IP address must be 220.135.240.2 or greater, but smaller than 220.135.240.254. IP Pool Counts: Enter the number of IP addresses in the pool. The maximum is 10. For example, if you type 3 and the 2nd IP address of your router is 220.135.240.1, the range of IP address by the DHCP server will be from 220.135.240.2 to 220.135.240.
the DHCP server you are going to use so the Relay Agent can help to forward the DHCP request to the DHCP server. DNS Server Configuration DNS stands for Domain Name System. Every Internet host must have a unique IP address, also they may have a human-friendly, easy to remember name such as www.yahoo.com. The DNS server converts the user-friendly name into its equivalent IP address.
Viewing Routing Table Displays the routing table for your reference. Add Static Routers to Private and Public Networks Here is an example of setting Static Route in Main Router so that user A and B locating in different subnet can talk to each other via the router. Assuming the Internet access has been configured and the router works properly: z use the Main Router to surf the Internet. z create a private subnet 192.168.10.0 using an internal Router A (192.168.1.2) z create a public subnet 211.100.88.
2. Click the LAN - Static Route and click on the Index Number 1. Please add a static route as shown below, which regulates all packets destined to 192.168.10.0 will be forwarded to 192.168.1.2. Click OK. 3. Return to Static Route Setup page. Click on another Index Number to add another static route as show below, which regulates all packets destined to 211.100.88.0 will be forwarded to 192.168.1.3. 4. Go to Diagnostics and choose Routing Table to verify current routing table.
Disable Static Route 1. Click the Index Number that you want to disable from the Static Route Configuration page. 2. Select Inactive/Disable from the drop-down menu, and then click the OK button to disable the route. 3.2.4 VLAN Note: This menu is available for Vigor3100, Vigor3100i, Vigor3100V and Vigor3120 model. For Vigor3100G, please refer to 3.10. Virtual LAN function provides you a very convenient way to manage hosts by grouping them based on the physical port.
To add or remove a VLAN, please refer to the following example. 1. If, VLAN 0 is consisted of hosts linked to P1 and P2 and VLAN 1 is consisted of hosts linked to P3 and P4. 2. After checking the box to enable VLAN function, you will check the table according to the needs as shown below. 3. To remove VLAN, uncheck the needed box and click OK to save the results.
3.2.5 Bind IP to MAC This function is used to bind the IP and MAC address in LAN to have a strengthen control in network. When this function is enabled, all the assigned IP and MAC address binding together cannot be changed. If you modified the binding IP or MAC address, it might cause you not access into the Internet. Click LAN and click Bind IP to MAC to open the setup page. Enable Click this radio button to invoke this function.
Add It allows you to add the one you choose from the ARP table or the IP/MAC address typed in Add and Edit to the table of IP Bind List. Edit It allows you to edit and modify the selected IP address and MAC address that you create before. Remove You can remove any item listed in IP Bind List. Simply click and select the one, and click Remove. The selected item will be removed from the IP Bind List. Note: Before you select Strict Bind, you have to bind one set of IP/MAC address for one PC.
The port redirection can only apply to incoming traffic. The server users inside the LAN can not access public IP address of the server. The correct route is to access the server using the local private IP address of the server, or you should set up an alias in a Windows hosts file. Please only redirect the ports you know you have to forward rather than forward all ports. Otherwise, you will compromise the firewall-type security initially deployed by the NAT facility.
WAN IP will be transferred to the IP address specified in this web page. Public Port Specify which port can be redirected to the specified Private IP and Port of the internal host. Private IP Specify the private IP address of the internal host providing the service. Private Port Specify the private port number of the service offered by the internal host. Active Check this box to activate the port-mapping entry you have defined.
The inherent security properties of NAT are somewhat bypassed if you set up DMZ host. We suggest you to add additional filter rules or a secondary firewall. Click DMZ Host to open the following page: Enable Check to enable the DMZ Host function. Private IP Enter the private IP address of the DMZ host, or click Choose PC to select one. Choose PC Click this button and then a window will automatically pop up, as depicted below.
3.3.3 Open Ports Open Ports allows you to open a range of ports for the traffic of special applications. Common application of Open Ports includes P2P application (e.g., BT, KaZaA, Gnutella, WinMX, eMule and others), Internet Camera etc. Ensure that you keep the application involved up-to-date to avoid falling victim to any security exploits. Click Open Ports to open the following page: Index Indicate the relative number for the particular entry that you want to offer service in a local host.
However, if you previously have set up WAN Alias in Internet Access>>PPPoE/PPPoA or Internet Access>>MPoA, you will find that WAN IP appeared for your selection. Enable Open Ports Check to enable this entry. Comment Make a name for the defined network application/service. Local Computer Enter the private IP address of the local host or click Choose PC to select one. Choose PC Click this button and, subsequently, a window having a list of private IP addresses of local hosts will automatically pop up.
3.4 Firewall 3.4.1 Basics for Firewall While the broadband users demand more bandwidth for multimedia, interactive applications, or distance learning, security has been always the most concerned. The firewall of the Vigor router helps to protect your local network against attack from unauthorized outsiders. It also restricts users in the local network from accessing the Internet. Furthermore, it can filter out specific packets that trigger the router to build an unwanted outgoing connection.
IP Filters Depending on whether there is an existing Internet connection, or in other words “the WAN link status is up or down”, the IP filter architecture categorizes traffic into two: Call Filter and Data Filter. z Call Filter - When there is no existing Internet connection, Call Filter is applied to all traffic, all of which should be outgoing. It will check packets according to the filter rules. If legal, the packet will pass.
Instant Messenger (IM) and Peer-to-Peer (P2P) Application Blocking As the popularity of all kinds of instant messenger application arises, communication cannot become much easier. Nevertheless, while some industry may leverage this as a great tool to connect with their customers, some industry may take reserve attitude in order to reduce employee misusage during office hour or prevent unknown security leak.
ActiveX control object is usually used for providing interactive web feature. If malicious code hides inside, it may occupy user’s system. Web Content Filtering We all know that the content on the Internet just like other types of media may be inappropriate sometimes. As a responsible parent or employer, you should protect those in your trust against the hazards.
Block - All blocked packets will be logged. Pass - All passed packets will be logged. No Match - The log function will record all packets that are not matched. Note that the filter log will be displayed on the Telnet terminal when you type the log -f command. Some on-line games (for example: Half Life) will use lots of fragmented UDP packets to transfer game data.
Comment Enter filter set comments/description. Maximum length is 23–character long Next Filter Set Set the link to the next filter set to be executed after the current filter set. Do not make many filter sets a loop. To edit Filter Rule, click the Filter Rule index button to enter the Filter Rule setup page. Comments Enter filter set comments/description. Maximum length is 14character long. Check to enable the Filter Rule Check this box to enable the filter rule.
Subnet Mask Select the Subnet Mask for the IP Address column for this filter rule to apply from the drop-down menu. Operator, Start Port and End Port The operator column specifies the port number settings. If the Start Port is empty, the Start Port and the End Port column will be ignored. The filter rule will filter out any port number. (=) If the End Port is empty, the filter rule will set the port number to be the value of the Start Port.
Example As stated before, all the traffic will be separated and arbitrated using on of two IP filters: call filter or data filter. You may preset 12 call filters and data filters in Filter Setup and even link them in a serial manner. Each filter set is composed by 7 filter rules, which can be further defined. After that, in General Setup you may specify one set for call filter and one set for data filter to execute first. 3.4.4 IM Blocking IM Blocking means instant messenger blocking.
3.4.5 P2P Blocking P2P is the short name of peer to peer. Click Firewall and click P2P Blocking to open the setup page. You will see a list of common P2P applications. Check Enable P2P Blocking and select the one(s) to block. To block selected P2P applications during specific periods, enter the number of the scheduler predefined in Applications>>Call Schedule. Action Vigor3100 Series User’s Guide Specify the action for each protocol.
3.4.6 DoS Defense As a sub-functionality of IP Filter/Firewall, there are 15 types of detect/ defense function in the DoS Defense setup. The DoS Defense functionality is disabled for default. Click Firewall and click DoS Defense to open the setup page. Enable Dos Defense Check the box to activate the DoS Defense Functionality. Enable SYN flood defense Check the box to activate the SYN flood defense function.
detecting this malicious exploration behavior by monitoring the port-scanning Threshold rate, the Vigor router will send out a warning. By default, the Vigor router sets the threshold as 150 packets per second. Block IP options Check the box to activate the Block IP options function. The Vigor router will ignore any IP packets with IP option field in the datagram header.
indicate the protocol type running over the upper layer. However, the protocol types greater than 100 are reserved and undefined at this time. Therefore, the router should have ability to detect and reject this kind of packets. Warning Messages We provide Syslog function for user to retrieve message from Vigor router. The user, as a Syslog Server, shall receive the report sending from Vigor router which is a Syslog Client. (Refer to Chapter 13 System Maintenance Syslog Access Setup for detail information.
3.4.7 URL Content Filter Based on the list of user defined keywords, the URL Content Filter facility in Vigor router inspects the URL string in every outgoing HTTP request. No matter the URL string is found full or partial matched with a keyword, the Vigor router will block the associated HTTP connection. For example, if you add key words such as “sex”, Vigor router will limit web access to web sites or web pages such as “www.sex.com”, ”www.backdoor.net/images/sex/p_386.html”.
addition, the maximal length of each frame is 32-character long. After specifying keywords, the Vigor router will decline the connection request to the website whose URL string matched to any user-defined keyword. It should be noticed that the more simplified the blocking keyword list, the more efficiently the Vigor router perform. Prevent web access from IP address Check the box to deny any web surfing activity using IP address, such as http://202.6.3.2.
3.4.8 Web Content Filter Click Firewall and click Web Content Filter to open the setup page. For this section, please refer to Web Content Filter user’s guide.
3.5 Bandwidth Management 3.5.1 Sessions Limit A PC with private IP address can access to the Internet via NAT router. The router will generate the records of NAT sessions for such connection. The P2P (Peer to Peer) applications (e.g., BitTorrent) always need many sessions for procession and also they will occupy over resources which might result in important accesses impacted. To solve the problem, you can use limit session to limit the session procession for specified Hosts.
Remove Remove the selected settings existing on the limitation list. Index (1-15) in Schedule Setup You can type in four sets of time schedule for your request. All the schedules can be set previously in Application – Schedule web page and you can use the number that you have set in that web page. 3.5.2 Bandwidth Limit The downstream or upstream from FTP, HTTP or some P2P applications will occupy large of bandwidth and affect the applications for other programs.
TX limit Define the limitation for the speed of the upstream. If you do not set the limit in this field, the system will use the default speed for the specific limitation you set for each index. RX limit Define the limitation for the speed of the downstream. If you do not set the limit in this field, the system will use the default speed for the specific limitation you set for each index. Add Add the specific speed limitation onto the list above.
Best Effort (BE). AF defines the four classes of delivery (or forwarding) classes and three levels of drop precedence in each class. Vigor routers as edge routers of DS domain shall check the marked DSCP value in the IP header of bypassing traffic, thus to allocate certain amount of resource execute appropriate policing, classification or scheduling.
Setup There are two-level of settings: Basic - setup Reserved Bandwidth Ratio according to the traffic service type. We provide a list of common service types. Advance - custom setting of Reserved Bandwidth Ratio based on the source address, destination address, DiffServ CodePoint, and service type. Enable UDP Bandwidth Control Check this and set the limited bandwidth ratio on the right field.
on the right box. To remove the selected on from the right box, simply choose the one again and click <
DiffServ CodePoint All the packets of data will be divided with different levels and will be processed according to the level type by the system. Please assign one of the levels of the data for processing with QoS control. Service Type It determines the service type of the data for processing with QoS control. It can also be edited. You can choose the predefined service type from the Service Type drop down list. Those types are predefined in factory.
Service Name – Type in a new service for your request. Service Type – Choose the type (TCP, UDP or TCP/UDP) for the new service. Type for Port Configuration – Click Single or Range. If you select Range, you have to type in the starting port number and the end porting number on the boxes below. Port Number – Type in the starting port number and the end porting number here if you choose Range as the type. You can add a new service name for your necessity.
3. 4. Select Index number 1 to add an account for the router. Check Enable Dynamic DNS Account, and choose correct Service Provider: dyndns.org, type the registered hostname: hostname and domain name suffix: dyndns.org in the Domain Name block. The following two blocks should be typed your account Login Name: test and Password: test. Service Provider Select the service provider for the DDNS account. Service Type Select a service type (Dynamic, Custom, Static).
You have to set your time before set schedule. In System Maintenance>> Time and Date menu, press Inquire Time button to set the Vigor router’s clock to current time of your PC. The clock will reset once if you power down or reset the router. There is another way to set up time. You can inquiry an NTP server (a time server) on the Internet to synchronize the router’s clock. This method can only be applied when the WAN connection has been built up. You can set up to 15 schedules.
when it has traffic on the line. Once there is no traffic over idle timeout, the connection will be down and never up again during the schedule. Idle Timeout Specify the duration (or period) for the schedule. How often -Specify how often the schedule will be applied Once -The schedule will be applied just once Weekdays -Specify which days in one week should perform the schedule.
Enable Check to enable RADIUS client feature Server IP Address Enter the IP address of RADIUS server Destination Port The UDP port number that the RADIUS server is using. The default value is 1812 , based on RFC 2138. Shared Secret The RADIUS server and client share a secret that is used to authenticate the messages sent between them. Both sides must be configured to use the same shared secret. Re-type Shared Secret Re-type the Shared Secret for confirmation. 3.6.
The UPnP facility on the router enables UPnP aware applications such as MSN Messenger to discover what are behind a NAT router. The application will also learn the external IP address and configure port mappings on the router. Subsequently, such a facility forwards packets from the external ports of the router to the internal ports used by the application.
The UPnP function dynamically adds port mappings on behalf of some UPnP-aware applications. When the applications terminate abnormally, these mappings may not be removed. 3.6.5 Wake on LAN A PC client on LAN can wake up specified PC through the router. Yet the specified PC must have installed a network card supporting WOL function. By the way, WOL function must be set as “Enable” on the BIOS setting of the specified PC. Wake by Two types provide for you to wake up the binded IP.
3.7 VPN and Remote Access A Virtual Private Network (VPN) is the extension of a private network that encompasses links across shared or public networks like the Internet. In short, by VPN technology, you can send data between two computers across a shared or public network in a manner that emulates the properties of a point-to-point private link. 3.7.1 Remote Access Control Enable the necessary VPN service as you need.
3.7.2 PPP General Setup This submenu only applies to PPP-related VPN connections, such as PPTP, L2TP, L2TP over IPSec. Dial-In PPP Authentication PAP Only Select this option to force the router to authenticate dial-in users with the PAP protocol. PAP or CHAP Selecting this option means the router will attempt to authenticate dial-in users with the CHAP protocol first. If the dial-in user does not support this protocol, it will fall back to use the PAP protocol for authentication.
3.7.3 IPSec General Setup In IPSec General Setup, there are two major parts of configuration. There are two phases of IKE/IPSec. ¾ Phase 1: negotiation of IKE parameters including encryption, hash, Diffie-Hellman parameter values, and lifetime to protect the following IKE exchange, authentication of both peers using either a Pre-Shared Key or Digital Signature (x.509).
active. High - Encapsulating Security Payload (ESP) means payload (data) will be encrypted and authenticated. You may select encryption algorithm from Data Encryption Standard (DES), Triple DES (3DES), and AES. 3.7.4 IPSec Peer Identity To use digital certificate for peer authentication in either LAN-to-LAN connection or Remote User Dial-In connection, here you may edit a table of peer certificate for selection. As shown below, the router provides 32 entries of digital certificates for peer dial-in users.
Accept Subject Alternative Click to check one specific field of digital signature to accept the peer with matching value. The field can be IP Address, Name Domain, or E-mail Address. The box under the Type will appear according to the type you select and ask you to fill in corresponding setting. Accept Subject Name Click to check the specific fields of digital signature to accept the peer with matching value.
Enable this account Check the box to enable this function. Idle Timeout- If the dial-in user is idle over the limitation of the timer, the router will drop this connection. By default, the Idle Timeout is set to 300 seconds. ISDN Allow the remote ISDN dial-in connection. You can further set up Callback function below. You should set the User Name and Password of remote dial-in user below PPTP Allow the remote dial-in user to make a PPTP VPN connection through the Internet.
further specify the corresponding security methods on the right side. Uncheck the checkbox-This means the connection type you select above will apply the authentication methods and security methods in the general settings. User Name This field is applicable when you select PPTP or L2TP w/ or w/out IPSec policy above. This field is also applicable if you select ISDN. Password This field is applicable when you select PPTP or L2TP w/ or w/out IPSec policy above.
3.7.6 LAN to LAN Here you can manage LAN-to-LAN connections by maintaining a table of connection profiles. You may set parameters including specified connection direction (dial-in or dial-out), connection peer ID, connection type (ISDN, VPN including PPTP, IPSec Tunnel, and L2TP by itself or over IPSec) and corresponding security methods, etc. The router provides up to 32 profiles, which also means supporting 32 VPN tunnels simultaneously. The following figure shows the summary table.
Profile Name Specify a name for the profile of the LAN-to-LAN connection. Enable this profile Check here to activate this profile. Call Direction Specify the allowed call direction of this LAN-to-LAN profile. Both:-initiator/responder Dial-Out- initiator only Dial-In- responder only. Always On or Idle Timeout Always On-Check to enable router always keep VPN connection. Idle Timeout: The default value is 300 seconds. If the connection has been idled over the value, the router will drop the connection.
procedure to inform each other. However, if the remote peer disconnect without notice, Vigor router will by no where to know this situation. To resolve this dilemma, by continuously sending PING packets to the remote host, the Vigor router can know the true existence of this VPN connection and react accordingly. ISDN Build ISDN dial-out connection to the server. You should set up Link Type and identity like User Name and Password for the authentication of remote server.
High Encapsulating Security Payload (ESP)- means payload (data) will be encrypted and authenticated. Select from below: DES without Authentication -Use DES encryption algorithm and not apply any authentication scheme. DES with Authentication-Use DES encryption algorithm and apply MD5 or SHA-1 authentication algorithm. 3DES without Authentication-Use triple DES encryption algorithm and not apply any authentication scheme.
reused to avoid the computation complexity in phase 2. The default value is inactive this function. Local ID -In Aggressive mode, Local ID is on behalf of the IP address while identity authenticating with remote VPN server. For Main mode, the length of the ID is limited to 47 characters. Callback Function (for i models only) The callback function provides a callback service as a part of PPP suite only for the ISDN dial-in user. The router owner will be charged the connection fee by the telecom.
L2TP Allow the remote dial-in user to make a L2TP VPN connection through the Internet. You can select to use L2TP alone or with IPSec. Select from below: None- Do not apply the IPSec policy. Accordingly, the VPN connection employed the L2TP without IPSec policy can be viewed as one pure L2TP connection. Nice to Have- Apply the IPSec policy first, if it is applicable during negotiation. Otherwise, the dial-in VPN connection becomes one pure L2TP connection.
Callback Function The callback function provides a callback service only for the ISDN dial-in user. The router owner will be charged the connection fee by the telecom. Check to enable Callback function-Enables the callback function. Callback number-The option is for extra security. Once enabled, the router will ONLY call back to the specified Callback Number. Callback budget- By default, the callback function has limitation of callback period.
packets with the router’s public IP address. Change default route to this VPN tunnel Check this box to change the default route with this VPN tunnel. Be aware that this setting is available only for one WAN interface is enabled. It is not available when both WAN interfaces are enabled. 3.7.7 Connection Management You can find the summary table of all VPN connections. You may disconnect any VPN connection by clicking Drop button.
3.8 Certificate Management A digital certificate works as an electronic ID, which is issued by a certification authority (CA). It contains information such as your name, a serial number, expiration dates etc., and the digital signature of the certificate-issuing authority so that a recipient can verify that the certificate is real. Here Vigor router support digital certificates conforming to standard X.509.
Refresh Click this button to refresh the information listed below. View Click this button to view the detailed settings for certificate request. After clicking Generate, the generated information will be displayed on the window below: 3.8.2 Trusted CA Certificate Trusted CA certificate lists three sets of trusted CA certificate. To import a pre-saved trusted CA certificate, please click IMPORT to open the following window. Use Browse.. to find out the saved text file. Then click Import.
3.9 VoIP (for V model only) Voice over IP network (VoIP) enables you to use your broadband Internet connection to make toll quality voice calls over the Internet. There are many different call signaling protocols, methods by which VoIP devices can talk to each other. The most popular protocols are SIP, MGCP, Megaco and H.323. These protocols are not all compatible with each other (except via a soft-switch server).
The major benefit of this mode is that you don’t have to memorize your friend’s IP address, which might change very frequently if it’s dynamic. Instead of that, you will only have to using dial plan or directly dial your friend’s account name if you are with the same SIP Registrar. Please refer to the Example 1 and 2 in the Calling Scenario. z Peer-to-Peer Before calling, you have to know your friend’s IP Address. The Vigor VoIP Routers will build connection between each other.
total 60 index entries in the DialPlan for you to store all your friends and family members’ SIP addresses. Click any index number to display the dial plan setup page. Enable Click this to enable this entry. Phone Number The speed-dial number of this index. This can be any number you choose, using digits 0-9 and * . Display Name The Caller-ID that you want to be displayed on your friend’s screen. This let your friend can easily know who’s calling without memorizing lots of SIP URL Address.
Digit Map For the convenience of user, this page allows users to edit prefix number for the SIP account with adding number, stripping number or replacing number. It is used to help user having a quick and easy way to dial out through VoIP interface. Enable Check this box to invoke this setting. Prefix Number The phone number set here is used to add, strip, or replace the OP number. Mode None - No action.
replaced by the prefix number for calling out through the specific VoIP interface. Take the above picture (Prefix Table Setup web page) as an example, the prefix number of 03 will be replaced by 8863. For example: dial number of “031111111” will be changed to “88631111111” and sent to SIP server. OP Number The front number you type here is the first part of the account number that you want to execute special function (according to the chosen mode) by using the prefix number.
Index Click this link to access into next page for setting SIP account. Profile Display the profile name of the account. Domain/Realm Display the domain name or IP address of the SIP registrar server. Proxy Display the domain name or IP address of the SIP proxy server. Account Name Display the account name of SIP address before @. Ring Port Specify which port will ring when receiving a phone call. STUN Server Type in the IP address of the STUN server.
VoIP call. SIP Port Set the port number for sending/receiving SIP message for building a session. The default value is 5060. Your peer must set the same value in his/her Registrar. Domain/Realm Set the domain name or IP address of the SIP Registrar server. Proxy Set domain name or IP address of SIP proxy server. By the time you can type:port number after the domain name to specify that port as the destination of data transmission (e.g., nat.draytel.
Ring Pattern Choose a ring tone type for the VoIP phone call. Below shows successful SIP accounts for your reference. 3.9.3 Phone Settings This page allows user to set phone settings for VoIP 1 and VoIP 2 respectively. RTP Symmetric RTP – Check this box to invoke the function.
RTP TOS – It decides the level of VoIP package. Use the drop down list to choose any one of them. Click the number 1 or 2 link under Index column, you can access into the following page for configuring Phone settings. Hotline Check the box to enable it. Type in the SIP URL in the field for dialing automatically when you pick up the phone set. Session Timer Check the box to enable the function.
the incoming calls will be forwarded into SIP URL only when the local system is busy. No answer means if the incoming calls do not receive any response, they will be forwarded to the SIP URL by the time out. SIP URL – Type in the SIP URL (e.g., aaa@draytel.org or abc@iptel.org) as the site for call forwarded. Time Out – Set the time out for the call forwarding. The default setting is 30 sec. DND (Do Not Disturb) mode Set a period of peace time without disturbing by VoIP phone call.
Voice Active Detector - This function can detect if the voice on both sides is active or not. If not, the router will do something to save the bandwidth for other using. Click On to invoke this function; click off to close the function. Default SIP Account There are six groups of SIP accounts that you can set. Use the drop down list to choose the profile name of the account as the default one. Play dial tone only when account registered - Check this box to invoke the function.
Region Select the proper region which you are located. The common settings of Caller ID Type, Dial tone, Ringing tone, Busy tone and Congestion tone will be shown automatically on the page. If you cannot find out a suitable one, please choose User Defined and fill out the corresponding values for dial tone, ringing tone, busy tone, congestion tone by yourself for VoIP phone. Also, you can specify each field for your necessity. It is recommended for you to use the default settings for VoIP communication.
the dial tone is. It is recommended for you to use the default setting. DTMP DTMF mode – There are four selections provided here: InBand:Choose this one then the Vigor will send the DTMF tone as audio directly when you press the keypad on the phone OutBand: Choose this one then the Vigor will capture the keypad number you pressed and transform it to digital form then send to the other side; the receiver will generate the tone according to the digital form it receive.
when the Refresh button is clicked. Port It shows current connection status for the port of VoIP1, VoIP2, ISDN1 and ISDN2. Status of ISDN is available for VGi model only. Status It shows the VoIP connection status. IDLE - Indicates that the VoIP function is idle. HANG_UP - Indicates that the connection is not established (busy tone). CONNECTING - Indicates that the user is calling out. WAIT_ANS - Indicates that a connection is launched and waiting for remote user’s answer.
ISDN Port Click Enable to open the ISDN port and Disable to close it. Country Code For proper operation on your local ISDN network, you should choose the correct country code. Own Number Enter your ISDN number. Every outgoing call will carry the number to the receiver. Blocked MSN Numbers for the Enter the specified MSN number into the fields to prevent the router from dialing the specific MSN router number.
3.10.2 Dialing to a Single ISP If you access the Internet via a single ISP, press this link. ISP Name Enter your ISP name. Dial Number Enter the ISDN access number provided by your ISP. Username Enter the username provided by your ISP. Password Enter the password provided by your ISP. Require ISP Callback If your ISP supports the callback function, check this box to activate the Callback Control Protocol during the PPP negotiation.
this function and enter the IP address in the field of Fixed IP Address. Fixed IP Address Type the IP address. 3.10.3 Dialing to Dual ISPs If you have more than one ISP, press this link to configure two ISP dialup profiles. You will be able to dial to both ISPs at the same time. This is mainly for those ISPs that do not support Multiple-Link PPP (ML-PPP) function. In such cases, dialing to two ISPs can increase the bandwidth utilization of the ISDN channels to 128kbps data speed.
As depicted in the above application scenario, the Virtual TA client can make an outgoing call or accept an incoming call to/from a peer FAX machine or ISDN TA, etc. Before describing the configuration of Virtual TA in the Vigor routers, please heed the following limitations. z The Virtual TA client only supports MicrosoftTM Windows 98/SE/2000/XP platforms. z The Virtual TA client only supports the CAPI 2.0 protocol and has no built-in FAX engine. z One ISDN BRI interface has two B channels.
from your telecom. Specify the MSN numbers for a specific client. If you have no MSN services, leave this field blank. Active - Check it to enable the client to access the server. Install a Virtual TA Client 1. Insert the CD-ROM bundled with your Vigor router. Find VTA Client tool in the Utility menu and click on the Install button. 2. Follow the on-screen instructions of the installer. The last step will ask you to restart your computer. Click OK to restart your computer. 3.
Click the Virtual TA Login tab to launch the login box. Enter the Username/Password and then click OK. After a short time, the VT icon text will turn green. MSN Configuration If you have applied to an MSN number service, the Virtual TA server can assign which client has the specified MSN number. When an incoming call arrives, the server will inform the appropriate client. Now we set an example to describe the configuration of the MSN number.
3.10.5 Call Control Some applications require that the router (only for the ISDN models) be remotely activated, or be able to dial up to the ISP via the ISDN interface. Vigor routers provide this feature by allowing user to make a phone call to the router and then ask it to dial up to the ISP. Accordingly, a teleworker can access the remote network to retrieve resources.
utilization. Idle Timeout Because our ISDN link type is “Dial On Demand”, the connection will be initiated only when needed. High Water Mark and High Water Time BOD stands for bandwidth-on-demand for Multiple-Link PPP (ML-PPP or MP). High Water Mark/ High Water Time/ Low Water Mark/Low Water Time parameters are applied when you set the Link Type to Dialup BOD. The ISDN usually uses one B channel to access the Internet or remote network when you choose the Dialup BOD link type.
Note: * The actual data throughput will vary according to the network conditions and environmental factors, including volume of network traffic, network overhead and building materials. In an Infrastructure Mode of wireless network, Vigor wireless router plays a role as an Access Point (AP) connecting to lots of wireless clients or Stations (STA). All the STAs will share the same Internet connection via Vigor wireless router.
Example 1 Example 2 Example 3 Separate the Wireless and the Wired LAN- WLAN Isolation enables you to isolate your wireless LAN from wired LAN for either quarantine or limit access reasons. To isolate means neither of the parties can access each other. To elaborate an example for business use, you may set up a wireless LAN for visitors only so they can connect to Internet without hassle of the confidential information leakage.
3.11.2 General Setup By clicking the General Settings, a new web page will appear so that you could configure the SSID and the wireless channel. Please refer to the following figure for more information. Enable Wireless LAN Check the box to enable wireless function. Mode Select an appropriate wireless mode. Mixed (11b+11g+SuperG) - The radio can support IEEE802.11b, IEEE802.11g and SuperG protocols simultaneously. Mixed (11b+11g) - The radio can support both IEEE802.11b and IEEE802.
SSID The default SSID is "default". We suggest you change it to a particular name. It is the identification of the wireless LAN. SSID can be any text numbers or various special characters. Channel The channel of frequency of the wireless LAN. The default channel is 6. You may switch channel if the selected channel is under serious interference. Hide SSID Check it to prevent from wireless sniffing and make it harder for unauthorized clients or STAs to join your wireless LAN.
3.11.3 Security By clicking the Security Settings, a new web page will appear so that you could configure the settings of WEP and WPA. Mode There are several modes provided for you to choose. Disable - Turn off the encryption mechanism. WEP Only - Accept only WEP clients and the encryption key should be entered in WEP Key. WEP/802.1x Only - Accept WEP clients with 802.1x authentication.
auto-negotiated during authentication, the field of key setting below will be not available for input. WPA The WPA encrypts each frame transmitted from the radio using the key, which either PSK entered manually in this field below or automatically negotiated via 802.1x authentication. Type - Select from Mixed (WPA+WPA2) or WPA2 only. Pre-Shared Key (PSK) - Either 8~63 ASCII characters, such as 012345678..(or 64 Hexadecimal digits leading by 0x, such as "0x321253abcde...").
3.11.4 Access Control For additional security of wireless access, the Access Control facility allows you to restrict the network access right by controlling the wireless LAN MAC address of client. Only the valid MAC address that has been configured can access the wireless LAN interface. By clicking the Access Control, a new web page will appear, as depicted below, so that you could edit the clients' MAC addresses to control their access rights.
3.11.5 WDS WDS means Wireless Distribution System. It is a protocol for connecting two access points (AP) wirelessly. Usually, it can be used for the following application: y y Provide bridge traffic between two LANs through the air. Extend the coverage range of a WLAN. To meet the above requirement, two WDS modes are implemented in Vigor router. One is Bridge, the other is Repeater.
In the following examples, hosts connected to Bridge 1 or 3 can communicate with hosts connected to Bridge 2 through WDS links. However, hosts connected to Bridge 1 CANNOT communicate with hosts connected to Bridge 3 through Bridge 2. Click WDS from Wireless LAN menu. The following page will be shown. Mode Choose the mode for WDS setting. Disable mode will not invoke any WDS setting. Bridge mode is designed to fulfill the first type of application. Repeater mode is for the second one.
following WEP or Pre-shared key field valid or not. Choose one of the types for the router. WEP Check this box to use the same key set in Security Settings page. If you did not set any key in Security Settings page, this check box will be dimmed. Encryption Mode - If you checked the box of Use the same WEP key …, you do not need to choose 64-bit or 128-bit as the Encryption Mode. If you do not check that box, you can set the WEP key now in this page.
3.11.6 AP Discovery Vigor router can scan all regulatory channels and find working APs in the neighborhood. Based on the scanning result, users will know which channel is clean for usage. Also, it can be used to facilitate finding an AP for a WDS link. Notice that during the scanning process (about 5 seconds), no client is allowed to connect to Vigor. This page is used to scan the existence of the APs on the wireless LAN. Yet, only the AP which is in the same channel of this router can be found.
3.11.7 Station List Station List provides the knowledge of connecting wireless clients now along with its status code. There is a code summary below for explanation. For convenient Access Control, you can select a WLAN station and click Add to Access Control below. Refresh Click this button to refresh the status of station list. Add Click this button to add current selected MAC address into Access Control.
3.11.8 Station Rate Control This page allows you to control the upload and download rate of each wireless client (station). Please check the box of Enable to invoke this setting. The range for the rate is between 100 ~ 30,000 kbps. 3.12 VLAN Note: This menu is available for Vigor3100G model only. For Vigor3100 and Vigor3120, please refer to 3.2.4. Virtual LAN function provides you a very convenient way to manage hosts by grouping them based on the physical port. 3.12.
Enable Check this box to enable this function (for VLAN Configuration). P1 – P4 Check the box to make the computer connecting to the port being grouped in specified VLAN. Be aware that each port can be grouped in different VLAN at the same time only if you check the box. For example, if you check the boxes of VLAN0-P1 and VLAN1-P1, you can make P1 to be grouped under VLAN0 and VLAN1 simultaneously. VLAN0-3 This router allows you to set 4 groups of virtual LAN. 3.12.
7890 in the boxes of W_VLAN1. Users can configure fifteen groups of wireless VLAN in this page. Enable Check this box to invoke wireless VLAN function. Login ID Type Login ID for different groups of W_VLAN with 1 to 11 characters. Password Type password for different groups of W_VLAN with 1 to 11 characters. Details Click this button to set additional attributes settings for W_VLAN. Activated Date – Use the drop down lists to set the activated date for the wireless VLAN.
Disable broadcast and multicast traffic Check this box to prevent broadcast and multicast traffic forwarding to all W_VLAN. How can you (wireless client) access into Internet? After finishing the configuration of wireless VLAN, the wireless clients connecting to this router must do the following steps to access into Internet. 1. Open a browser and type http://www.draytek.vlan/login.htm or http://(vigor router’s IP address)/login.htm on the address line. 2. The following screen will appear. 3.
5. You can go to Diagnostics>>Wireless VLAN Online Station for viewing the connection status whenever you want. 3.12.3 VLAN Cross Setup This function allows the router to integrate VLAN and W_VLAN for managing different computers (notebooks). See the following picture for an example. With VLAN Cross Setup, notebook A/B and PCs on VLAN0 can share resources without difficulty. The VLAN >> VALN Cross Setup allows you to set a communication bridge between computers in Wireless VLAN and wired VLAN.
Enable Check this box to invoke VLAN Cross Setup function. VLAN0-3 It represents the groups of virtual LAN connected by Ethernet interface. W_VLAN0-15 It represents the groups of wireless VLAN communicated by wireless interface.
3.12.4 Wireless Rate Control Rate Control manages the transmission rate of data in and out through the router. You can also manage the in/out rate of each wireless VLAN. Go to VLAN menu and select Wireless Rate Control. The following page will appear. Click Enable to invoke VLAN function. For the rate control of wireless connection, please open VLAN menu and choose Wireless Rate Control. The following page will be shown for you to adjust. Enable Check this box to enable this function (for Rate Control).
Model Name Displays the model name of the router. Firmware Version Displays the firmware version of the router. Build Date/Time Displays the date and time of the current firmware build. MAC Address Displays the MAC address of the LAN Interface. st 1 IP Address Displays the IP address of the LAN interface. 1st Subnet Mask Displays the subnet mask address of the LAN interface. DHCP Server Displays the current status of DHCP server of the LAN interface.
Retype New Password Type in the new password again. When you click OK, the login window will appear. Please use the new password to access into the web configurator again. 3.13.3 Configuration Backup Backup the Configuration Follow the steps below to backup your configuration. 1. Go to System Maintenance >> Configuration Backup. The following windows will be popped-up, as shown below. 2. Click Backup button to get into the following dialog.
4. Click Save button, the configuration will download automatically to your computer as a file named config.cfg. The above example is using Windows platform for demonstrating examples. The Mac or Linux platform will appear different windows, but the backup function is still available. Restore Configuration 1. Go to System Maintenance >> Configuration Backup. The following windows will be popped-up, as shown below. 2.
3.13.4 Syslog/Mail Alert SysLog function is provided to help users to monitor router. There is no bother to directly get into the Web Configurator of the router or borrow debug equipments. Enable Click “Enable” to activate this function. Server IP Address The IP address of the Syslog server. Destination Port Assign a port for the Syslog protocol. Enable syslog message Check the box to display the specified log. SMTP Server The IP address of the SMTP server.
3.13.5 Time and Date It allows you to specify where the time of the router should be inquired from. Current System Time Click Inquire Time to get the current time. Use Browser Time Select this option to use the browser time from the remote administrator PC host as router’s system time. Use Internet Time Select to inquire time information from Time Server on the Internet using assigned protocol. Time Protocol Select a time protocol. Server IP Address Type the IP address of the time server.
Automatically Update Select a time interval for updating from the NTP server. Interval Click OK to save these settings. 3.13.6 Management The port number used to send/receive SIP message for building a session. The default value is 5060 and this must match with the peer Registrar when making VoIP calls. Enable remote firmware upgrade Chick the checkbox to allow remote firmware upgrade through FTP (File Transfer Protocol).
Set Community Set community by typing a proper name. The default setting is private. Manager Host IP Set one host as the manager to execute SNMP function. Please type in IP address to specify certain host. Trap Community Set trap community by typing a proper name. The default setting is public. Notification Host IP Set the IP address of the host that will receive the trap community. Trap Timeout The default setting is 10 seconds. 3.13.
3.14 Diagnostics Diagnostic Tools provide a useful way to view or diagnose the status of you Vigor router. 3.14.1 WAN Connection Click Diagnostics and click WAN Connection to open the web page. Such page will be different slightly based on the model of your router. Refresh To obtain the latest information, click here to reload the page. Broadband Access Mode/Status Display the broadband access mode and status. If the broadband connection is active, it will show Internet access mode is enabled.
3.14.3 Routing Table Click Diagnostics and click Routing Table to open the web page. Refresh Click it to reload the page. 3.14.4 ARP Cache Table Click Diagnostics and click ARP Cache Table to view the content of the ARP (Address Resolution Protocol) cache held in the router. The table shows a mapping between an Ethernet hardware address (MAC Address) and an IP address. Refresh Click it to reload the page. Clear Click it to clear the whole table.
3.14.5 DHCP Table The facility provides information on IP address assignments. This information is helpful in diagnosing network problems, such as IP address conflicts, etc. Click Diagnostics and click DHCP Table to open the web page. Index It displays the connection item number. IP Address It displays the IP address assigned by this router for specified PC. MAC Address It displays the MAC address for the specified PC that DHCP assigned IP address for it.
Ifno It indicates the interface of the WAN connection. Refresh Click it to reload the page. 3.14.7 Wireless VLAN Online Station Table This function is available for G model only. Click Diagnostics and click Wireless VLAN Online Station Table to open the web page. It will display the IP address, MAC address and Login ID information for all the Wireless VLAN stations. IP Address Display the IP address of the wireless station. MAC Address Display the MAC address of the wireless station.
Enable Data Flow Monitor Order by Check this box to enable this function. Refresh Seconds Use the drop down list to choose the time interval of refreshing data flow that will be done by the system automatically. Refresh Click this link to refresh this page manually. Index Display the number of the data flow. IP Address Display the IP address of the monitored device. TX rate (kbps) Display the transmission speed of the monitored device.
Unblock – the device with the IP address will be blocked in five minutes. The remaining time will be shown on the session column. 3.14.9 Traffic Graph Click Diagnostics and click Traffic Graph to pen the web page. Choose WAN1 Bandwidth/WAN2 Bandwidth or Sessions for viewing different traffic graph. Click Refresh to renew the graph at any time. The horizontal axis represents time. Yet the vertical axis has different meanings.
3.14.10 Ping Diagnosis Click Diagnostics and click Ping Diagnosis to pen the web page. Ping to Use the drop down list to choose the destination that you would like to ping. IP Address Type in the IP address of the Host/IP that you want to ping. Run Click this button to start the ping work. The result will be displayed on the screen. Clear Click this link to remove the result on the window. 3.14.11 Trace Route Click Diagnostics and click Trace Route to open the web page.
4 Application and Examples 4.1 Create a LAN-to-LAN connection between remote office and headquarter The most common case is that you may want to connect to network securely, such as the remote branch office and headquarter. According to the network structure as shown in the below illustration, you may follow the steps to create a LAN-to-LAN profile. These two networks (LANs) should NOT have the same network address. Settings in Router A in headquarter: 1.
3. Go to LAN-to-LAN. Click on one index number to edit a profile. 4. Set Common Settings as shown below. You should enable both of VPN connections because any one of the parties may start the VPN connection. 5. Set Dial-Out Settings as shown below to dial to connect to Router B aggressively with the selected Dial-Out method. If an IPSec-based service is selected, you should further specify the remote peer IP Address, IKE Authentication Method and IPSec Security Method for this Dial-Out connection.
6. Set Dial-In settings to as shown below to allow Router B dial-in to build VPN connection. If an IPSec-based service is selected, you may further specify the remote peer IP Address, IKE Authentication Method and IPSec Security Method for this Dial-In connection. Otherwise, it will apply the settings defined in IPSec General Setup above. If a PPP-based service is selected, you should further specify the remote peer IP Address, Username, Password, and VJ Compression for this Dial-In connection.
7. At last, set the remote network IP/subnet in TCP/IP Network Settings so that Router A can direct the packets destined to the remote network to Router B via the VPN connection. Settings in Router B in the remote office: 1. Go to Remote Access Control to enable the necessary VPN service. 2. Then, for using PPP based services, such as PPTP, L2TP, or ISDN, you have to set general settings in PPP General Setup.
3. Go to LAN-to-LAN. Click on one index number to edit a profile. 4. Set Common Settings as shown below. You should enable both of VPN connections because any one of the parties may start the VPN connection. 5. Set Dial-Out Settings as shown below to dial to connect to Router B aggressively with the selected Dial-Out method. If an IPSec-based service is selected, you should further specify the remote peer IP Address, IKE Authentication Method and IPSec Security Method for this Dial-Out connection.
connection. 6. Set Dial-In settings to as shown below to allow Router A dial-in to build VPN connection. If an IPSec-based service is selected, you may further specify the remote peer IP Address, IKE Authentication Method and IPSec Security Method for this Dial-In connection. Otherwise, it will apply the settings defined in IPSec General Setup above.
7. At last, set the remote network IP/subnet in TCP/IP Network Settings so that Router B can direct the packets destined to the remote network to Router A via the VPN connection.
4.2 Create a remote dial-in user connection between the teleworker and headquarter The other common case is that you, as a teleworker, may want to connect to the enterprise network securely. According to the network structure as shown in the below illustration, you may follow the steps to create a Remote User Profile and install Smart VPN Client on the remote host. Settings in VPN Router in the enterprise office: 1. Go to Remote Access Control to enable the necessary VPN service. 2.
3. Go to Remote Dial-In Users. Click on one index number to edit a profile. 4. Set Dial-In settings to as shown below to allow the remote user dial-in to build VPN connection. If an IPSec-based service is selected, you may further specify the remote peer IP Address, IKE Authentication Method and IPSec Security Method for this Dial-In connection. Otherwise, it will apply the settings defined in IPSec General Setup above.
Settings in the remote host: 1. For Win98/ME, you may use "Dial-up Networking" to create the PPTP tunnel to Vigor router. For Win2000/XP, please use "Network and Dial-up connections" or “Smart VPN Client”, complimentary software to help you create PPTP, L2TP, and L2TP over IPSec tunnel. You can find it in CD-ROM in the package or go to www.draytek.com download center. Install as instructed. 2. After successful installation, for the first time user, you should click on the Step 0. Configure button.
You may further specify the method you use to get IP, the security method, and authentication method. If the Pre-Shared Key is selected, it should be consistent with the one set in VPN router. If a PPP-based service is selected, you should further specify the remote VPN server IP address, Username, Password, and encryption method. The User Name and Password should be consistent with the one set up in the VPN router.
4. Click Connect button to build connection. When the connection is successful, you will find a green light on the right down corner. 4.3 QoS Setting Example Assume a teleworker sometimes works at home and takes care of children. When working time, he would use Vigor router at home to connect to the server in the headquarter office downtown via either HTTPS or VPN to check email and access internal database. Meanwhile, children may chat on VoIP or Skype in the restroom. 1.
HTTPS. And click Basic button on the right. 5. Select HTTPS in the list on the left column and click on ADD to add to right column. Click OK to exit. 6. Check the Enable UDP Bandwidth Control on the bottom to prevent enormous UDP traffic of VoIP influent other application. 7. If the worker has connected to the headquarter using host to host VPN tunnel. (Please refer to Chapter 8 VPN for detail instruction), he may set up an index for it. Enter the Class Name of Index 3.
4.4 LAN – Created by Using NAT An example of default setting and the corresponding deployment are shown below. The default Vigor router private IP address/Subnet Mask is 192.168.1.1/255.255.255.0. The built-in DHCP server is enabled so it assigns every local NATed host an IP address of 192.168.1.x starting from 192.168.1.10. You can just set the settings wrapped inside the red rectangles to fit the request of NAT usage.
You can just set the settings wrapped inside the red rectangles to fit the request of NAT usage.
4.5 Calling Scenario for VoIP function 4.5.1 Calling via SIP Sever Example 1: Both John and David have SIP Addresses from different service providers. John’s SIP URL: 1234@draytel.org, David’s SIP URL: 4321@iptel.org Settings for John DialPlan index 1 Phone Number: 1111 Display Name: David SIP URL: 4321@iptel.org SIP Accounts Settings --Profile Name: draytel1 Register via: Auto SIP Port: 5060 (default) Domain/Realm: draytel.org Proxy: draytel.
Example 2: Both John and David have SIP Addresses from the same service provider. John’s SIP URL: 1234@draytel.org , David’s SIP URL: 4321@draytel.org Settings for John DialPlan index 1 Phone Number: 1111 Display Name: David SIP URL: 4321@draytel.org SIP Accounts Settings --Profile Name: draytel 1 Register via: Auto SIP Port: 5060 (default) Domain/Realm: draytel.org Proxy: draytel.
4.5.2 Peer-to-Peer Calling Example 3: Arnor and Paulin have Vigor routers respectively, they can call each other without SIP Registrar. First they must have each other’s IP address and assign an Account Name for the port used for calling. Arnor’s SIP URL: 1234@214.61.172.53 Paulin’s SIP URL: 4321@ 203.69.175.24 Settings for Arnor DialPlan index 1 Phone Number: 1111 Display Name: paulin SIP URL: 4321@ 203.69.175.
4.6 Upgrade Firmware for Your Router Before upgrading your router firmware, you need to install the Router Tools. The Firmware Upgrade Utility is included in the tools. 1. Insert CD of the router to your CD ROM. 2. From the webpage, please find out Utility menu and click it. 3. On the webpage of Utility, click Install Now! (under Syslog description) to install the corresponding program. 4. The file RTSxxx.exe will be asked to copy onto your computer. Remember the place of storing the execution file. 5.
9. Double click on the icon of router tool. The setup wizard will appear. 10. Follow the onscreen instructions to install the tool. Finally, click Finish to end the installation. 11. From the Start menu, open Programs and choose Router Tools XXX >> Firmware Upgrade Utility. 12. Type in your router IP, usually 192.168.1.1. 13. Click the button to the right side of Firmware file typing box. Locate the files that you download from the company web sites.
14. Click Send. 15. Now the firmware update is finished.
4.7 Request a certificate from a CA server on Windows CA Server 1. Go to Certificate Management and choose Local Certificate.
2. You can click GENERATE button to start to edit a certificate request. Enter the information in the certificate request. 3. Copy and save the X509 Local Certificate Requet as a text file and save it for later use. 4. Connect to CA server via web browser. Follow the instruction to submit the request. Below we take a Windows 2000 CA server for example. Select Request a Certificate.
Select Advanced request. Select Submit a certificate request a base64 encoded PKCS #10 file or a renewal request using a base64 encoded PKCS #7 file Import the X509 Local Certificate Requet text file. Select Router (Offline request) or IPSec (Offline request) below. Then you have done the request and the server now issues you a certificate. Select Base 64 encoded certificate and Download CA certificate. Now you should get a certificate (.cer file) and save it. 5.
you will find the below window showing “------BEGINE CERTIFICATE------.....” 6. You may review the detail information of the certificate by clicking View button. 4.
1. Use web browser connecting to the CA server that you would like to retrieve its CA certificate. Click Retrive the CA certificate or certificate recoring list. 2. In Choose file to download, click CA Certificate Current and Base 64 encoded, and Download CA certificate to save the .cer. file. 3. Back to Vigor router, go to Trusted CA Certificate. Click IMPORT button and browse the file to import the certificate (.cer file) into Vigor router.
4. You may review the detail information of the certificate by clicking View button.
Vigor3100 Series User’s Guide 182
5 Trouble Shooting This section will guide you to solve abnormal situations if you cannot access into the Internet after installing the router and finishing the web configuration. Please follow below sections to check your basic installation stage by stage. ¾ Checking if the hardware status is OK or not. ¾ Checking if the Network Connection Settings on your computer is OK or not. ¾ Pinging the Router from your computer. ¾ Checking if the ISP Settings are OK or not.
5.2 Checking If the Network Connection Settings on Your Computer Is OK or Not Sometimes the link failure occurs due to the wrong network connection settings. After trying the above section, if the link is stilled failed, please do the steps listed below to make sure the network connection settings is OK. For Windows The example is based on Windows XP. As to the examples for other operation systems, please refer to the similar steps or find support notes in www.draytek.com. 1.
4. Select Obtain an IP address automatically and Obtain DNS server address automatically. For MacOs 1. Double click on the current used MacOs on the desktop. 2. Open the Application folder and get into Network. 3. On the Network screen, select Using DHCP from the drop down list of Configure IPv4.
5.3 Pinging the Router from Your Computer The default gateway IP address of the router is 192.168.1.1. For some reason, you might need to use “ping” command to check the link status of the router. The most important thing is that the computer will receive a reply from 192.168.1.1. If not, please check the IP address of your computer. We suggest you setting the network connection as get IP automatically. (Please refer to the section 5.2) Please follow the steps below to ping the router correctly.
5.4 Checking If the ISP Settings are OK or Not Click Internet Access Setup group and then check whether the ISP settings are set correctly. For PPPoE/PPPoA Users 1. Check if the Enable option is selected. 2. Check if all parameters of DSL Modem Settings are entered with correct values that you got from your ISP. 3. Check if Username and Password are entered with correct values that you got from your ISP.
For MPoA (RFC1483/2684) Users 1. Check if the Enable option is selected. 2. Check if all parameters of DSL Modem Settings are entered with correct values that you got from your ISP. 3. Check if IP Address, Subnet Mask and Gateway are set correctly, or use DHCP server to obtain IP automatically by clicking Obtain an IP address automatically. 5.
Transmission Rate is not fast enough Please connect your Notebook with 3G USB Modem to test the connection speed to verify if the problem is caused by Vigor3100. In addition, please refer to the manual of 3G USB Modem for LED Status to make sure if the modem connects to Internet via HSDPA mode. If you want to use the modem indoors, please put it on the place near the window to obtain better signal receiving. 5.
Hardware Reset While the router is running (ACT LED blinking), press the RST button and hold for more than 5 seconds. When you see the ACT LED blinks rapidly, please release the button. Then, the router will restart with the default configuration. After restore the factory default setting, you can configure the settings for the router again to fit your personal request. 5.
