Draytek Vigor2920 Series, User Manual

Page 1: ......

Page 2: ...Vigor2920 Series User s Guide ii Vigor2920 Series Dual WAN Security Router User s Guide Version 3 1 Firmware Version V3 6 7 For future update please visit DrayTek website Date May 6 2014 ...

Page 3: ...servation of the environment Warranty We warrant to the original end user purchaser that the router will be free from any defects in workmanship or materials for a period of two 2 years from the date of purchase from the dealer Please keep your purchase receipt in a safe place as it serves as proof of date of purchase During the warranty period and upon proof of purchase should the product have in...

Page 4: ...es These limits are designed to provide reasonable protection against harmful interference in a residential installation This equipment generates uses and can radiate radio frequency energy and if not installed and used in accordance with the instructions may cause harmful interference to radio communications However there is no guarantee that interference will not occur in a particular installati...

Page 5: ...e 19 1 6 Changing Password 20 1 7 Online Status 21 1 7 1 Physical Connection 21 1 7 2 Virtual WAN 24 1 8 Saving Configuration 24 QUICK SETUP 25 2 1 Quick Start Wizard 25 2 1 1 For WAN1 WAN2 Ethernet 26 2 1 2 For WAN3 USB 35 2 2 Service Activation Wizard 37 2 3 VPN Client Wizard 41 2 4 VPN Server Wizard 47 2 5 Wireless Wizard 52 2 6 VoIP Wizard 55 2 7 Registering Vigor Router 56 TUTORIALS AND APPLI...

Page 6: ...or MyVigor 111 3 12 1 Creating an Account via Vigor Router 111 3 12 2 Creating an Account via MyVigor Web Site 115 ADVANCED WEB CONFIGURATION 119 4 1 WAN 119 4 1 1 Basics of Internet Protocol IP Network 119 4 1 2 General Setup 121 4 1 3 Internet Access 126 4 1 4 Multi VLAN 146 4 2 LAN 149 4 2 1 Basics of LAN 149 4 2 2 General Setup 151 4 2 3 Static Route 159 4 2 4 VLAN 164 4 2 5 Bind IP to MAC 167...

Page 7: ...t 256 4 9 2 Bandwidth Limit 258 4 9 3 Quality of Service 260 4 9 4 APP QoS 268 4 10 Applications 270 4 10 1 Dynamic DNS 270 4 10 2 LAN DNS 273 4 10 3 Schedule 275 4 10 4 RADIUS 278 4 10 5 Active Directory LDAP 278 4 10 6 UPnP 281 4 10 7 IGMP 284 4 10 8 Wake on LAN 285 4 10 9 SMS Mail Alert Service 286 4 11 VPN and Remote Access 288 4 11 1 Remote Access Control 288 4 11 2 PPP General Setup 288 4 11...

Page 8: ...on Setup 369 4 16 3 TR 069 370 4 16 4 Administrator Password 371 4 16 5 User Password 374 4 16 6 Login Page Greeting 376 4 16 7 Configuration Backup 377 4 16 8 Syslog Mail Alert 379 4 16 9 Time and Date 382 4 16 10 SNMP 383 4 16 11 Management 385 4 16 12 Reboot System 388 4 16 13 Firmware Upgrade 389 4 16 14 Activation 390 4 17 Diagnostics 391 4 17 1 Dial out Triggering 392 4 17 2 Routing Table 39...

Page 9: ...t 408 5 3 Pinging the Router from Your Computer 410 5 4 Checking If the ISP Settings are OK or Not 412 5 5 Problems for 3G Network Connection 412 5 6 Backing to Factory Default Setting If Necessary 413 5 7 Contacting Your Dealer 414 APPENDIX I VLAN APPLICATIONS ON VIGOR ROUTER 415 APPENDIX II RELEASE NOTE 423 ...

Page 10: ......

Page 11: ...ease CSM Content Security Management provides users control and management in IM Instant Messenger and P2P Peer to Peer more efficiency than before By the way DoS DDoS prevention and URL Web content filter strengthen the security outside and control inside Object based firewall is flexible and allows your network be safe In addition Vigor2920 series supports USB interface for connecting USB printe...

Page 12: ...ngs Cancel current settings and recover to the previous saved settings Clear all the selections and parameters settings including selection from drop down list All the values must be reset with factory default settings Add new settings for specified item Edit the settings for the selected item Delete the selected item with the corresponding settings Note For the other buttons shown on the web page...

Page 13: ... The WAN1 or WAN2 connection is ready WAN1 2 Blinking It will blink while transmitting data On The DoS DDoS function is active DoS Blinking It will blink while an attack is detected VPN On The VPN tunnel is active QoS On The QoS function is active LED on Connector On The port is connected Off The port is disconnected Left LED Green Blinking The data is transmitting On The port is connected with 10...

Page 14: ...for more than 5 seconds When you see the ACT LED begins to blink rapidly than usual release the button Then the router will restart with the factory default configuration GigaLAN 1 4 Connecters for local networked devices WAN1 WAN2 Giga Connecters for remote networked devices USB Connecter for 3G Modem or printer PWR Connecter for a power adapter ON OFF Power Switch ...

Page 15: ... On The WAN1 or WAN2 connection is ready WAN1 2 Blinking It will blink while transmitting data On The DoS DDoS function is active DoS Blinking It will blink while an attack is detected VPN On The VPN tunnel is active QoS On The QoS function is active LED on Connector On The port is connected Off The port is disconnected Left LED Green Blinking The data is transmitting On The port is connected with...

Page 16: ...ection Factory Reset Restore the default settings Usage Turn on the router ACT LED is blinking Press the hole and keep for more than 5 seconds When you see the ACT LED begins to blink rapidly than usual release the button Then the router will restart with the factory default configuration GigaLAN 1 4 Connecters for local networked devices WAN1 WAN2 Giga Connecters for remote networked devices USB ...

Page 17: ...er two minutes You need to setup WPS within 2 minutes On The WAN1 or WAN2 connection is ready WAN1 2 Blinking It will blink while transmitting data On A PSTN phone call comes in and out However when the phone call is disconnected the LED will be off Line Off There is no PSTN phone call On The phone connected to this port is off hook Off The phone connected to this port is on hook Phone 1 2 Blinkin...

Page 18: ...ettings Usage Turn on the router ACT LED is blinking Press the hole and keep for more than 5 seconds When you see the ACT LED begins to blink rapidly than usual release the button Then the router will restart with the factory default configuration Phone 1 2 Connecter for analog phone s Line Connector for PSTN life line GigaLAN 1 4 Connecters for local networked devices WAN1 WAN2 Giga Connecters fo...

Page 19: ... connection is ready WAN1 2 Blinking It will blink while transmitting data On The DoS DDoS function is active DoS Blinking It will blink while deleting an attack On The phone connected to this port is off hook Off The phone connected to this port is on hook Phone 1 2 Blinking A phone call comes LED on Connector On The port is connected Off The port is disconnected Left LED Green Blinking The data ...

Page 20: ...hen you see the ACT LED begins to blink rapidly than usual release the button Then the router will restart with the factory default configuration Phone 1 2 Connecters for analog phone s GigaLAN 1 4 Connecters for local networked devices WAN1 WAN2 Giga Connecters for remote networked devices USB Connecter for Mobile HDD 3G Modem or printer PWR Connecter for a power adapter ON OFF Power Switch ...

Page 21: ...n Ethernet cable RJ 45 to one of the LAN ports of the router and the other end of the cable RJ 45 into the Ethernet port on your computer 3 Connect one end of the power adapter to the router s power port on the rear panel and the other side into a wall outlet 4 Power on the device by pressing down the power switch on the rear panel 5 The system starts to initiate After completing the system test t...

Page 22: ...ter can print documents via the router The example provided here is made based on Windows 7 For installation on other Windows systems please visit www DrayTek com Before using it please follow the steps below to configure settings for connected computers or wireless clients 1 Connect the printer with the router through USB parallel port 2 Open All Programs Getting Started Devices and Printers ...

Page 23: ... 13 3 Click Add a printer 4 A dialog will appear Click Add a local printer and click Next 5 In this dialog choose Create a new port In the field of Type of port use the drop down list to select Standard TCP IP Port Then click Next ...

Page 24: ... User s Guide 14 6 In the following dialog type 192 168 1 1 router s LAN IP in the field of Hostname or IP Address and type 192 168 1 1 as the Port name Then click Next 7 Click Standard and choose Generic Network Card ...

Page 25: ... your system will ask you to choose right name of the printer that you installed onto the router Such step can make correct driver loaded onto your PC When you finish the selection click Next 9 Type a name for the chosen printer Click Next ...

Page 26: ...Vigor2920 Series User s Guide 16 10 Choose Do not share this printer and click Next 11 Then in the following dialog click Finish ...

Page 27: ...Guide 17 12 The new printer has been added and displayed under Printers and Faxes Click the new printer icon and click Printer server properties 13 Edit the property of the new printer you have added by clicking Configure Port ...

Page 28: ...ol type p1 number 1 as Queue Name Then click OK Next please refer to the red rectangle for choosing the correct protocol and LPR name The printer can be used for printing now Most of the printers with different manufacturers are compatible with vigor router ...

Page 29: ...i in ng g W We eb b U Us se er r I In nt te er rf fa ac ce e 1 Make sure your PC connects to the router correctly Notice You may either simply set up your computer to get IP dynamically from the router or set up the IP address of the computer to be the same subnet as the default IP address of Vigor router 192 168 1 1 For the detailed information please refer to the later section Trouble Shooting o...

Page 30: ...a as ss sw wo or rd d Please change the password for the original security of the router 1 Open a web browser on your PC and type http 192 168 1 1 A pop up window will open to ask for username and password 2 Please type admin admin as Username Password for accessing into the web user interface with admin mode 3 Now the Main Screen will appear Note The home page will change slightly in accordance w...

Page 31: ...t time use the new password to access the Web user interface for this router 1 1 7 7 O On nl li in ne e S St ta at tu us s 1 1 7 7 1 1 P Ph hy ys si ic ca al l C Co on nn ne ec ct ti io on n Such page displays the physical connection status such as LAN connection status WAN connection status ADSL information and so on P Ph hy ys si ic ca al l C Co on nn ne ec ct ti io on n f fo or r I IP Pv v4 4 P...

Page 32: ...the total transmitted packets at the LAN interface RX Packets Displays the total number of received packets at the LAN interface WAN 1 Status WAN 3 Status Line Displays the physical connection of this interface Name Displays the name set in WAN1 WAN web page Mode Displays the type of WAN connection e g PPPoE Up Time Displays the total uptime of the interface IP Displays the IP address of the WAN i...

Page 33: ...l transmitted octets at the LAN interface RX Bytes Displays the total received octets at the LAN interface WAN IPv6 Status Enable No in red means such interface is available but not enabled Yes in green means such interface is enabled No in red means such interface is not available Mode Displays the type of WAN connection e g TSPC Up Time Displays the total uptime of the interface IP Displays the ...

Page 34: ...e Application field will list the purpose of such WAN connection 1 1 8 8 S Sa av vi in ng g C Co on nf fi ig gu ur ra at ti io on n Each time you click OK on the web page for saving the configuration you can find messages showing the system interaction with you Ready indicates the system is ready for you to input settings Settings Saved means your settings are saved once you click Finish or OK but...

Page 35: ...ed for building wireless LAN connection VoIP Wizard used for establishing VoIP profile 2 2 1 1 Q Qu ui ic ck k S St ta ar rt t W Wi iz za ar rd d If your router can be under an environment with high speed NAT the configuration provide here can help you to deploy and use the router quickly The first screen of Quick Start Wizard is entering login password After typing the password please click Next ...

Page 36: ...hen click Next for next step 2 2 1 1 1 1 1 1 P PP PP Po oE E PPPoE stands for Point to Point Protocol over Ethernet It relies on two widely accepted standards PPP and Ethernet It connects users through an Ethernet to the Internet with a common broadband medium such as wireless device or cable modem All the users over the Ethernet can share a common connection PPPoE is used for most of modem users ...

Page 37: ... Click PPPoE as the Internet Access Type Then click Next to open the following page Available settings are explained as follows Item Description Service Name Optional Type the description of the specific network service User Name Assign a specific valid user name provided by the ISP Password Assign a valid password provided by the ISP Confirm Password Retype the password ...

Page 38: ...e Cancel Click it to give up the quick start wizard 3 Please manually Type the Username Password provided by your ISP Click Next for viewing summary of such connection 4 Click Finish A page of Quick Start Wizard Setup OK will appear Then the system status of this protocol will be shown 5 Now you can enjoy surfing on the Internet ...

Page 39: ... the protocol Type in all the information that your ISP provides for this protocol 1 Choose WAN1 WAN2 as the WAN Interface and click the Next button The following page will be open for you to specify Internet Access Type 2 Click PPTP L2TP as the Internet Access Type Then click Next to continue ...

Page 40: ...tings manually IP Address Type the IP address Subnet Mask Type the subnet mask Gateway Type the IP address of the gateway Primary DNS Type in the primary IP address for the router Second DNS Type in secondary IP address for necessity in the future PPTP Server L2TP Server Type the IP address of the server Back Click it to return to previous setting page Next Click it to get into the next setting pa...

Page 41: ...be open for you to specify Internet Access Type 2 Click Static IP as the Internet Access Type Then click Next to continue Available settings are explained as follows Item Description WAN IP Type the IP address Subnet Mask Type the subnet mask Gateway Type the IP address of gateway Primary DNS Type in the primary IP address for the router Secondary DNS Type in secondary IP address for necessity in ...

Page 42: ... next setting page Cancel Click it to give up the quick start wizard 3 After finishing the settings in this page click Next to see the following page 4 Click Finish A page of Quick Start Wizard Setup OK will appear Then the system status of this protocol will be shown 5 Now you can enjoy surfing on the Internet ...

Page 43: ...and click the Next button The following page will be open for you to specify Internet Access Type 2 Click DHCP as the Internet Access Type Then click Next to continue Available settings are explained as follows Item Description Host Name Type the name of the host MAC Some Cable service providers specify a specific MAC address for access authentication In such cases you need to Type the MAC address...

Page 44: ...e next setting page Cancel Click it to give up the quick start wizard 3 After finishing the settings in this page click Next to see the following page 4 Click Finish A page of Quick Start Wizard Setup OK will appear Then the system status of this protocol will be shown 5 Now you can enjoy surfing on the Internet ...

Page 45: ...ou to specify Internet Access Type 2 Then click Next to continue Available settings are explained as follows Item Description Internet Access Choose one of the selections as the protocol of accessing the internet 3G 4G USB Modem PPP mode SIM Pin code Type PIN code of the SIM card that will be used to access Internet The maximum length of the pin code you can set is 15 characters Modem Initial Stri...

Page 46: ... card that will be used to access Internet Network Mode Force Vigor router to connect Internet with the mode specified here If you choose 4G 3G 2G as network mode the router will choose a suitable one according to the actual wireless signal automatically APN Name APN means Access Point Name which is provided and required by some ISPs 3 Then click Next for viewing summary of such connection 4 Click...

Page 47: ... version or update the license of WCF directly without accessing into the server MyVigor located on http myvigor draytek com For using Web Content Filter Profile please refer to later section Web Content Filter Profile for detailed information Now follow the steps listed below to activate WCF feature for your router 1 Open Service Activation Wizard 2 The screen of Service Activation Wizard will be...

Page 48: ...can purchase DrayTek s prepared Commtouch GlobalView WCF package from retailing outlets BPjM is WCF for German Speaking users The fragfINN is whitelist for German Speaking users The BPjM is ideal for your family to provide more Internet security for youngsters The fragFINN is designed for protecting kids from inadequate web sites More info is available at http www draytek de jugendschutz 4 Setting...

Page 49: ... in Firewall General Setup 6 Now the web page will display the service that you have activated according to your selection s The valid time for the free trial of these services is 30 day Later if you need to extend the license valid time for the same service you can also use the Service Activation Wizard again to reach your goal by clicking the radio button of Formal edition with license key and c...

Page 50: ...Vigor2920 Series User s Guide 40 ...

Page 51: ...er to client step by step 1 Open VPN and Remote Access VPN Client Wizard The following page will appear Available settings are explained as follows Item Description LAN to LAN Client Mode Selection Choose the client mode Route Mode NAT Mode If the remote network only allows you to dial in with single IP please choose this mode otherwise please choose Route Mode Please choose a LAN to LAN Profile T...

Page 52: ... the following page In this page you have to select suitable VPN type for the VPN client profile There are six types provided here Different type will lead to different configuration page After making the choices for the client profile please click Next You will see different configurations based on the selection s you made ...

Page 53: ...Vigor2920 Series User s Guide 43 When you choose PPTP None Encryption or PPTP Encryption you will see the following graphic When you choose IPSec you will see the following graphic ...

Page 54: ...ollowing graphic When you choose L2TP over IPSec Nice to Have or L2TP over IPSec Must you will see the following graphic Available settings are explained as follows Item Description Profile Name Type a name for such profile The length of the file is limited to 10 characters ...

Page 55: ...red Key IKE Authentication Method usually applies to those are remote dial in user or node LAN to LAN which uses dynamic IP address and IPSec related VPN connections such as L2TP over IPSec and IPSec tunnel Pre Shared Key Specify a key for IKE authentication Confirm Pre Shared Key Confirm the pre shared key Digital Signature X 509 Click Digital Signature to invoke this function Use the drop down l...

Page 56: ...st for building VPN connection 3 After finishing the configuration please click Next The confirmation page will be shown as follows If there is no problem you can click one of the radio buttons listed on the page and click Finish to execute the next action Available settings are explained as follows Item Description Go to the VPN Connection Management Click this radio button to access VPN and Remo...

Page 57: ...ollows Item Description VPN Server Mode Selection Choose the direction for the VPN server Site to Site VPN To set a LAN to LAN profile automatically please choose Site to Site VPN Remote Dial in User You can manage remote access by maintaining a table of remote user profile so that users can be authenticated to dial in via VPN connection Please choose a LAN to LAN Profile This item is available wh...

Page 58: ...les Next you have to select suitable dial in type for the VPN server profile There are several types provided here similar to VPN Client Wizard Different Dial in Type will lead to different configuration page 1 Here we take the example of choosing Remote Dial in User as the VPN Server Mode 2 Check the Allowed Dial in Type for the VPN server profile 3 After making the choices for the server profile...

Page 59: ...ies User s Guide 49 When you check PPTP you will see the following graphic When you check PPTP IPSec L2TP three types or PPTP IPSec two types or L2TP with Policy Nice to Have Must you will see the following graphic ...

Page 60: ... Confirm Pre Shared Key Type the pre shared key again for confirmation Digital Signature X 509 Check the box of Digital Signature to invoke this function Use the drop down list to choose one of the certificates for using You have to configure one certificate at least previously in Certificate Management Local Certificate Otherwise the setting you choose here will not be effective Peer IP VPN Clien...

Page 61: ...ss VPN and Remote Access Connection Management for viewing VPN Connection status Do another VPN Server Wizard Setup Click this radio button to set another profile of VPN Server through VPN Server Wizard View more detailed configuration Click this radio button to access VPN and Remote Access LAN to LAN for viewing detailed configuration 5 If there is no problem you can click one of the radio button...

Page 62: ...r n model only Follow the steps listed below 1 Open Wireless Wizard 2 The screen of wireless wizard will be shown as follows This page will be used for internal users in a company or your home Available settings are explained as follows Item Description Name Type the SSID name of this router The default name is defined with DrayTek Mode At present the router can connect to 11n Only 11g Only Mixed ...

Page 63: ...ually in this field below or automatically negotiated via 802 1x authentication Either 8 63 ASCII characters such as 012345678 or 64 Hexadecimal digits leading by 0x such as 0x321253abcde Next Click it to get into the next setting page Cancel Exit the wireless wizard without saving any changes 3 After typing the required information click Next The settings in the page limit the wireless station gu...

Page 64: ...h as 0x321253abcde Rate Control It controls the data transmission rate through wireless connection Upload Check Enable and type the transmitting rate for data upload Default value is 30 000 kbps Download Type the transmitting rate for data download Default value is 30 000 kbps Next Click it to get into the next setting page Cancel Exit the wireless wizard without saving any changes 4 After typing ...

Page 65: ...rovider Use the drop down list to choose the ISP which offers the VoIP service for your router If you cannot find the name of your ISP simply type it in the right box SIP Port Use the default setting 5060 Set Account quickly Account Number Name Type the account number name registered to your ISP Password Type the password for the account registered to your ISP Use the same Account as phone 1 If yo...

Page 66: ...ou ut te er r You have finished the configuration of Quick Start Wizard and you can surf the Internet at any time Now it is the time to register your Vigor router to MyVigor website for getting more service Please follow the steps below to finish the router registration 1 Please login the web configuration interface of Vigor router by typing admin admin as User Name Password 2 Click Support Area P...

Page 67: ...word that you created previously And click Login 4 The following page will be displayed after you logging in MyVigor From this page please click Add or Product Registration Note Below the field of Your Device List all the Vigor routers that you have registered to MyVigor website will be displayed in sequence ...

Page 68: ...lowing page appears please type in Nickname for the router and choose the right registration date from the popup calendar it appears when you click on the box of Registration Date After adding the basic information for the router please click Submit ...

Page 69: ...lowing page appears your router information has been added to the database Click OK to leave this web page and return to My Information web page 7 Take a look at the page of My Information the new added Vigor rotuer is listed under Your Device List ...

Page 70: ...Vigor2920 Series User s Guide 60 This page is left blank ...

Page 71: ...vironment The IPv6 packets will be encapsulated with the header of IPv4 first Later the packets will be transformed and adjusted as IPv4 payload Once the packets arrive the border between IPv4 and IPv6 the header of IPv4 on the packets will be removed Then the packets with IPv6 address will be forwarded to the destination of IPv6 network Translation Such feature is active only for the user who use...

Page 72: ...required information Click OK to save the settings and return to previous setting page 3 Click IPv6 4 In the following figure use the drop down list to choose a proper connection type Different connection types will bring out different configuration page Refer to the following PPP Dual Stack application Choose PPP to access into the setting page for IPv6 service It is not necessary for you to conf...

Page 73: ...Vigor2920 Series User s Guide 63 Click OK and open Online Status If the connection is successful you will get the IP address for IPv4 and IPv6 at the same time ...

Page 74: ...nformation for TSPC service Note While using such mode you have to make sure the IPv4 network connection is normal In the following figure the TSPC information is obtained from http gogo6 com after applied for the service Click OK and open Online Status If the connection is successful the physical connection will be shows as follows ...

Page 75: ...ote While using such mode you have to make sure the IPv4 network connection is normal In the following figure the AICCU information is obtained from https www sixxs net main after applied for the service Click OK and open Online Status If the connection is successful the physical connection will be shows as follows ...

Page 76: ... s Guide 66 DHCPv6 Client Choose DHCPv6 Client Click one of the identity associations and type the IAID number Click OK and open Online Status If the connection is successful the physical connection will be shows as follows ...

Page 77: ...ies User s Guide 67 Static IPv6 Choose Static IPv6 Type IPv6 address Prefix Length and Gateway Address Click OK and open Online Status If the connection is successful the physical connection will be shows as follows ...

Page 78: ...y the subnet of LAN1 supports IPv6 feature 2 In the field of RADVD Configuration the default setting is Enable The client s PC will ask RADVD service for the Prefix of IPv6 address automatically and generate an Interface ID by itself to compose a full and unique IPv6 address 3 In the field of HCPv6 Server Configuration when DHCPv6 service is enabled you can assign available IPv6 address for the cl...

Page 79: ... command of ipconfig Refer to the following figure From the above figure we can see IPv6 IP address has been detected by the system 2 Use the Ping command to ping any IPv6 address indicating an IPv6 website For example www kame net is a website supporting IPv4 IP and IPv6 IP services Its IPv6 address is seen with a format of 2001 200 dff fff1 216 3eff feb1 44d7 After getting the above message it m...

Page 80: ...ype an URL of IPv6 e g www kame net If your computer accesses into the website by using IPv6 address you may see a turtle dancing on the screen If not only a steady turtle will be seen If you can see a turtle dancing on the screen that means IPv6 service is ready for you to access and utilize ...

Page 81: ...terface of Vigor router 2 Configure relational objects first Open Object Settings SMS Mail Server Object to get the following page Index 1 to Index 8 allows you to choose the built in SMS service provider If the SMS service provider is not on the list you can configure Index 9 and Index 10 to add the new service provider to Vigor router 3 Choose any index number e g Index 1 in this case to configu...

Page 82: ...rofile setting 5 Open Object Settings Notification Object to configure the event conditions of the notification 6 Choose any index number e g Index 1 in this case to configure conditions for sending the SMS In the following page type the name of the profile and check the Disconnected and Reconnected boxes for WAN to work in concert with the topic of this paper ...

Page 83: ...o choose SMS Provider and the Notify Profile specify the time of sending SMS Then type the phone number in the field of Recipient the one who will receive the SMS 9 Click OK to save the settings Later if one of the WAN connections fails in your router the system will send out SMS to the phone number specified If the router has only one WAN interface the system will send out SMS to the phone number...

Page 84: ...ne of the Index numbers 9 or 10 allowing you to customize the SMS Provider In the web page type the URL string of the SMS provider and type the username and password After clicking OK the new added SMS provider will be added and will be available for you to specify for sending SMS out ...

Page 85: ...t to or ra ag ge e d de ev vi ic ce e c co on nn ne ec ct ti in ng g t to o V Vi ig go or r r ro ou ut te er r 1 Plug the USB device to the USB port on the router Make sure Disk Connected appears on the Connection Status as the figure shown below 2 Open USB Application USB General Settings to check the general settings Click OK ...

Page 86: ... User Management Click Enable to enable FTP Samba User account Here we add a new account user1 and assign authorities Read Write and List to it 4 Click OK to save the configuration 5 Make sure the FTP service is running properly Please open a browser and type ftp 192 168 1 1 Use the account user1 to login ...

Page 87: ...SB Application USB Disk Status The information for FTP server will be shown as below Now users in LAN of Vigor2920 can access into the USB storage device by typing ftp 192 168 1 1 on any browser They can add or remove files directories depending on the Access Rule for FTP account settings in USB Application USB User Management ...

Page 88: ...he internal departments of a company into three different groups Each group uses different network segment See the following graphic for an example Group 0 VLAN0 Human Resource LAN Port 1 IP 192 168 1 0 24 Group 1 VLAN1 Finance Dept LAN Port 2 IP 192 168 2 0 24 Group 2 VLAN2 Sales Dept LAN Port 3 Port 4 IP 192 168 3 0 24 C Co on nf fi ig gu ur ra at ti io on n 1 In the page of LAN VLAN Configurati...

Page 89: ...etwork segment The equipment connecting to Vigor2920 LAN Port 1 LAN1 can get the IP address of 192 168 1 0 24 The equipment connecting to Vigor2920 LAN Port 2 LAN2 can get the IP address of 192 168 2 0 24 The equipment connecting to Vigor2920 LAN Port 3 and Port 4 LAN3 can get the IP address of 192 168 3 0 24 For the detailed settings of the network segment open LAN General Setup and click Details...

Page 90: ... s Guide 80 6 To make any two of VLAN groups linked with each other just check the boxes of the ones in the field of Inter LAN Routing in the page of LAN General Setup Refer to the following figure LAN2 and LAN3 are linked ...

Page 91: ...rce LAN Port 4 IP 192 168 1 0 24 Group 1 VLAN1 Finance Dept LAN Port 4 IP 192 168 2 0 24 Group 2 VLAN2 Sales Dept LAN Port 4 IP 192 168 3 0 24 Group 3 VLAN3 R D LAN Port 4 IP 192 168 4 0 24 C Co on nf fi ig gu ur ra at ti io on n 1 In the page of LAN VLAN Configuration check the box of Enable to enable the function of VLAN Configuration 2 To activate the function of VLAN Tag for VLAN0 setting chec...

Page 92: ...e 10 for VID setting Then check P4 and set LAN4 as the Subnet 6 In the page of LAN General Setup check the Status box of LAN2 LAN3 and LAN4 and enable the function of DHCP For the detailed settings of the network segment open LAN General Setup and click Details Page Adjust the settings for your request Refer to the following figure ...

Page 93: ...ID8 Port Members 16 23 VLAN Name 2920 VID9 Port Members 17 23 VLAN Name 2920 VID10 Port Members 18 23 3 Open Vlan Ports and set the VID value with role for each Port Port 15 VID 7 Role Access Port 16 VID 8 Role Access Port 17 VID 9 Role Access Port 18 VID 10 Role Access Port 23 VID 1 Role Trunk Port 23 is set with Trunk in this example and will transfer the packets with VLAN Tag information That i...

Page 94: ... equipment connecting to VigorSwitch Port 16 can get the IP address of 192 168 2 0 24 The equipment connecting to VigorSwitch Port 17 can get the IP address of 192 168 3 0 24 The equipment connecting to VigorSwitch Port 18 can get the IP address of 192 168 4 0 24 7 To make any two of VLAN groups of Tag Based VLAN linked with each other just check the boxes of the ones in the field of Inter LAN Rou...

Page 95: ...gin page can be customized to fit the request of the administrator 1 Open User Management General Setup Set User Based as the Mode and click OK to save teh settings 2 Open User Management User Profile to create a new user profle 3 Click any link e g 3 to access into the following page Type a User Name and a Password Then click OK ...

Page 96: ...ype URL redirect link in Bulletin box 5 Open a new tab in the same browser for IE 7 0 FireFox and above or open a new web browser 6 Try to access into the web user interface e g 192 168 1 1 of Vigor router Please note Just for Carrie is displayed as a heading on the login dialog box 7 After typing the username and password defined in User Management User Profile click Login You can access into Int...

Page 97: ... of Vigor2920 for using SmartMonitor 1 Please go to LAN LAN Port Mirror to setup the mirror port 2 Please enable the Port Mirror function first 3 Select the Mirror port and Mirrored port the traffics of mirrored ports will be forwarded to mirror port For example if we select P2 as mirror port and mirrored ports are P1 P3 and P4 then P1 P3 and P4 will forward the traffic to P2 When the LAN Port Mir...

Page 98: ...hown in the below illustration you may follow the steps to create a LAN to LAN profile These two networks LANs should NOT have the same network address Settings in Router A in headquarter 1 Go to VPN and Remote Access and select Remote Access Control to enable the necessary VPN service and click OK 2 Then For using PPP based services such as PPTP L2TP you have to set general settings in PPP Genera...

Page 99: ... User s Guide 89 3 Go to LAN to LAN Click on one index number to edit a profile 4 Set Common Settings as shown below You should enable both of VPN connections because any one of the parties may start the VPN connection ...

Page 100: ...od If an IPSec based service is selected you should further specify the remote peer IP Address IKE Authentication Method and IPSec Security Method for this Dial Out connection If a PPP based service is selected you should further specify the remote peer IP Address Username Password PPP Authentication and VJ Compression for this Dial Out connection ...

Page 101: ...ed you may further specify the remote peer IP Address IKE Authentication Method and IPSec Security Method for this Dial In connection Otherwise it will apply the settings defined in IPSec General Setup above If a PPP based service is selected you should further specify the remote peer IP Address Username Password and VJ Compression for this Dial In connection ...

Page 102: ...er B in the remote office 1 Go to VPN and Remote Access and select Remote Access Control to enable the necessary VPN service and click OK 2 Then for using PPP based services such as PPTP L2TP you have to set general settings in PPP General Setup For using IPSec based service such as IPSec or L2TP with IPSec Policy you have to set general settings in IPSec General Setup such as the pre shared key t...

Page 103: ...N connections because any one of the parties may start the VPN connection 5 Set Dial Out Settings as shown below to dial to connect to Router A aggressively with the selected Dial Out method If an IPSec based service is selected you should further specify the remote peer IP Address IKE Authentication Method and IPSec Security Method for this Dial Out connection ...

Page 104: ...pression for this Dial Out connection 6 Set Dial In settings to as shown below to allow Router A dial in to build VPN connection If an IPSec based service is selected you may further specify the remote peer IP Address IKE Authentication Method and IPSec Security Method for this Dial In connection Otherwise it will apply the settings defined in IPSec General Setup above ...

Page 105: ...urther specify the remote peer IP Address Username Password and VJ Compression for this Dial In connection 7 At last set the remote network IP subnet in TCP IP Network Settings so that Router B can direct the packets destined to the remote network to Router A via the VPN connection ...

Page 106: ... as shown in the below illustration you may follow the steps to create a Remote User Profile and install Smart VPN Client on the remote host Settings in VPN Router in the enterprise office 1 Go to VPN and Remote Access and select Remote Access Control to enable the necessary VPN service and click OK 2 Then for using PPP based services such as PPTP L2TP you have to set general settings in PPP Gener...

Page 107: ...tings to as shown below to allow the remote user dial in to build VPN connection If an IPSec based service is selected you may further specify the remote peer IP Address IKE Authentication Method and IPSec Security Method for this Dial In connection Otherwise it will apply the settings defined in IPSec General Setup above ...

Page 108: ...or Win2000 XP please use Network and Dial up connections or Smart VPN Client complimentary software to help you create PPTP L2TP and L2TP over IPSec tunnel You can find it in CD ROM in the package or go to www DrayTek com download center Install as instructed 2 After successful installation for the first time user you should click on the Step 0 Configure button Reboot the host 3 In Step 2 Connect ...

Page 109: ...P based service is selected you should further specify the remote VPN server IP address Username Password and encryption method The User Name and Password should be consistent with the one set up in the VPN router To use default gateway on remote network means that all the packets of remote host will be directed to VPN server then forwarded to Internet This will make the remote host seem to be wor...

Page 110: ...t tt ti in ng g E Ex xa am mp pl le e Assume a teleworker sometimes works at home and takes care of children When working time he would use Vigor router at home to connect to the server in the headquarter office downtown via either HTTPS or VPN to check email and access internal database Meanwhile children may chat on Skype in the restroom 1 Go to Bandwidth Management Quality of Service ...

Page 111: ...idth Note The rate of outbound inbound must be smaller than the real bandwidth to ensure correct calculation of QoS It is suggested to set the bandwidth value for inbound outbound as 80 85 of physical network speed provided by ISP to maximize the QoS performance 4 Return to previous page Type the Name of Index Class 1 by clicking Edit link Type the name E mail for Class 1 ...

Page 112: ...ser will set reserved bandwidth e g 25 for E mail using protocol POP3 and SMTP 6 Return to previous page Type the Name of Index Class 2 by clicking Edit link In this index the user will set reserved bandwidth for HTTPS And click OK 7 Click Setup link for WAN ...

Page 113: ... 9 If the worker has connected to the headquarter using host to host VPN tunnel Please refer to Chapter 3 VPN for detail instruction he may set up an index for it Type the Class Name of Index 3 In this index he will set reserved bandwidth for 1 VPN tunnel 10 Click Edit to open a new window 11 Click Edit to open the following window Check the ACT box first ...

Page 114: ...Vigor2920 Series User s Guide 104 12 Then click Edit of Local Address to set a worker s subnet address Click Edit of Remote Address to set headquarter s IP address Leave other fields and click OK ...

Page 115: ...105 3 3 1 10 0 R Re eq qu ue es st t a a c ce er rt ti if fi ic ca at te e f fr ro om m a a C CA A s se er rv ve er r o on n W Wi in nd do ow ws s C CA A S Se er rv ve er r 1 Go to Certificate Management and choose Local Certificate ...

Page 116: ...t Type the information in the certificate request 3 Copy and save the X509 Local Certificate Requet as a text file and save it for later use 4 Connect to CA server via web browser Follow the instruction to submit the request Below we take a Windows 2000 CA server for example Select Request a Certificate ...

Page 117: ...est using a base64 encoded PKCS 7 file Import the X509 Local Certificate Requet text file Select Router Offline request or IPSec Offline request below Then you have done the request and the server now issues you a certificate Select Base 64 encoded certificate and Download CA certificate Now you should get a certificate cer file and save it ...

Page 118: ...tificate Click IMPORT button and browse the file to import the certificate cer file into Vigor router When finished click refresh and you will find the below window showing BEGINE CERTIFICATE 6 You may review the detail information of the certificate by clicking View button ...

Page 119: ...rt ti if fi ic ca at te e a an nd d S Se et t a as s T Tr ru us st te ed d o on n W Wi in nd do ow ws s C CA A S Se er rv ve er r 1 Use web browser connecting to the CA server that you would like to retrieve its CA certificate Click Retrive the CA certificate or certificate recoring list ...

Page 120: ...ed CA Certificate Click IMPORT button and browse the file to import the certificate cer file into Vigor router When finished click refresh and you will find the below illustration 4 You may review the detail information of the certificate by clicking View button Note Before setting certificate configuration please go to System Maintenance Time and Date to reset current time of the router first ...

Page 121: ... Wizard can activate WCF service for the router by using simple steps However if you for example a company purchase several different routers and activate the services respectively you might need an account to achieve the goal of management Please follow the sections below to create an account for MyVigor 3 3 1 12 2 1 1 C Cr re ea at ti in ng g a an n A Ac cc co ou un nt t v vi ia a V Vi ig go or ...

Page 122: ...ies User s Guide 112 2 Click the Activate link A login page for MyVigor web site will pop up automatically 3 Click the link of Create an account now 4 Check to confirm that you accept the Agreement and click Accept ...

Page 123: ...Vigor2920 Series User s Guide 113 5 Type your personal information in this page and then click Continue 6 Choose proper selection for your computer and click Continue ...

Page 124: ...TART 8 Check to see the confirmation email with the title of New Account Confirmation Letter from myvigor draytek com 9 Click the Activate my Account link to enable the account that you created The following screen will be shown to verify the register process is finished Please click Login ...

Page 125: ...click Login Your account has been activated You can access into MyVigor server to activate the service e g WCF that you want 3 3 1 12 2 2 2 C Cr re ea at ti in ng g a an n A Ac cc co ou un nt t v vi ia a M My yV Vi ig go or r W We eb b S Si it te e 1 Access into http myvigor draytek com Find the line of Not registered yet Then click the link Click here to access into next page ...

Page 126: ...s User s Guide 116 2 Check to confirm that you accept the Agreement and click Accept 3 Type your personal information in this page and then click Continue 4 Choose proper selection for your computer and click Continue ...

Page 127: ...TART 6 Check to see the confirmation email with the title of New Account Confirmation Letter from myvigor draytek com 7 Click the Activate my Account link to enable the account that you created The following screen will be shown to verify the register process is finished Please click Login ...

Page 128: ... password that you just created in the fields of UserName and Password Then type the code in the box of Auth Code according to the value displayed on the right side of it Now click Login Your account has been activated You can access into MyVigor server to activate the service e g WCF that you want ...

Page 129: ...offers user an easy method to quick setup the connection mode for the router Moreover if you want to adjust more settings for different WAN modes please go to WAN group 4 4 1 1 1 1 B Ba as si ic cs s o of f I In nt te er rn ne et t P Pr ro ot to oc co ol l I IP P N Ne et tw wo or rk k IP means Internet Protocol Every device in an IP based Network including routers print server and host PCs needs a...

Page 130: ...uthentication and authorization is required for bridging customer premises equipment CPE Point to Point Protocol over Ethernet PPPoE connects a network of hosts via an access device to a remote access concentrator or aggregation concentrator This implementation provides users with significant ease of use Meanwhile it provides access control billing and type of service according to user requirement...

Page 131: ... existing IPv4 network environment The IPv6 packets will be encapsulated with the header of IPv4 first Later the packets will be transformed and judged by IPv4 router Once the packets arrive the border between IPv4 and IPv6 the header of IPv4 on the packets will be removed Then the packets with IPv6 address will be forwarded to the destination of IPv6 network Translation Such feature is active onl...

Page 132: ...ing to Line Speed Otherwise please choose Auto Weight to let the router reach the best load balance Index Click the WAN interface link under Index to access into the WAN configuration page Enable V means such WAN interface is enabled and ready to be used Physical Mode Type Display the physical mode and physical type of such WAN interface Line Speed Display the downstream and upstream rate of such ...

Page 133: ...tings for this WAN interface Display Name Type the description for such WAN interface Physical Mode Display the physical mode of such WAN interface Physical Type You can change the physical type for WAN2 or choose Auto negotiation for determined by the system Line Speed Type the real line speed for downloading and uploading for such WAN interface The unit is kbps VLAN Tag insertion Enable Enable t...

Page 134: ...nction enabled will balance the data transmission automatically among all of the WAN interfaces in connection status Backup Type If you choose Backup as the Active Mode Backup WAN will be changed into Backup Type You have to specify which role the WAN interface should play if you want to backup multiple WANs However ignore this setting if you want to backup a single WAN When any of selected WAN di...

Page 135: ... Type In such WAN interface no type can be selected Line Speed Type the line speed for downloading and uploading for such WAN interface The unit is kbps Active Mode Choose Always On to make such WAN connection being activated always Load Balance Check this box to enable auto load balance function for such WAN interface When the data traffic is large the WAN interface with the function enabled will...

Page 136: ...nly when all master WAN interfaces disconnect After finished the above settings click OK to save the settings 4 4 1 1 3 3 I In nt te er rn ne et t A Ac cc ce es ss s For the router supports multi WAN function the users can set different WAN settings for WAN1 WAN2 WAN3 for Internet Access Due to different Physical Mode for WAN interfaces the Access Mode for these connections also varies Refer to th...

Page 137: ...de that you choose in WAN interface IPv6 This button will open different web page based on Physical Mode to setup IPv6 Internet Access Mode for WAN interface If IPv6 service is active on this WAN interface the color of IPv6 will become green Advanced This button allows you to configure DHCP client options DHCP packets can be processed by adding option number and data information when such function...

Page 138: ... protocol of the internet please select PPPoE from the Internet Access menu The following web page will be shown Available settings are explained as follows Item Description PPPoE Client Mode Click Enable for activating this function If you click Disable this function will be closed and all the settings that you adjusted in this page will be invalid ISP Access Setup Enter your allocated username p...

Page 139: ...o WAN server Thus the PC can access Internet through such direction For Wired LAN If you check this box PCs on the same network can use another set of PPPoE session different with the Host PC to access into Internet For Wireless LAN If you check this box PCs on the same wireless network can use another set of PPPoE session different with the Host PC to access into Internet PPP MP Setup PPP Authent...

Page 140: ...P address in the box of Fixed IP Address Default MAC Address You can use Default MAC Address or specify another MAC address by typing on the boxes of MAC Address for the router Specify a MAC Address Type the MAC address for the router manually After finishing all the settings here please click OK to activate them ...

Page 141: ...web page will be shown Available settings are explained as follows Item Description Static or Dynamic IP Click Enable for activating this function If you click Disable this function will be closed and all the settings that you adjusted in this page will be invalid Keep WAN Connection Normally this function is designed for Dynamic IP environments because some ISPs will drop connections if there is ...

Page 142: ...ion Bridge Mode If you check this box to invoke the function the router will work as a bridge WAN IP Network Settings This group allows you to obtain an IP address automatically and allows you type in IP address manually WAN IP Alias If you have multiple public IP addresses and would like to utilize them on the WAN interface please use WAN IP Alias You can set up to 8 public IP addresses other tha...

Page 143: ...ress for necessity in the future After finishing all the settings here please click OK to activate them D De et ta ai il ls s P Pa ag ge e f fo or r P PP PT TP P L L2 2T TP P i in n W WA AN N1 1 W WA AN N2 2 To use PPTP L2TP as the accessing protocol of the internet please choose PPTP L2TP from Internet Access menu The following web page will be shown Available settings are explained as follows It...

Page 144: ...nly or PAP or CHAP for PPP Idle Timeout Set the timeout for breaking down the Internet after passing through the time without any action IP Address Assignment Method IPCP Fixed IP Usually ISP dynamically assigns IP address to you each time you connect to it and request In some case your ISP provides service to always assign you the same IP address whenever you request In this case you can fill in ...

Page 145: ...y an IP address Click this radio button to specify some data IP Address Type the IP address Subnet Mask Type the subnet mask After finishing all the settings here please click OK to activate them D De et ta ai il ls s P Pa ag ge e f fo or r 3 3G G 4 4G G U US SB B M Mo od de em m P PP PP P M Mo od de e i in n W WA AN N3 3 To use PPP for 3G USB Modem as the accessing protocol of the internet please...

Page 146: ...ntact to your ISP PPP Username Type the PPP username optional PPP Password Type the PPP password optional PPP Authentication Select PAP only or PAP or CHAP for PPP Index 1 15 in Schedule Setup You can type in four sets of time schedule for your request All the schedules can be set previously in Application Schedule web page and you can use the number that you have set in that web page WAN Connecti...

Page 147: ...nvalid SIM PIN code Type PIN code of the SIM card that will be used to access Internet Network Mode Force Vigor router to connect Internet with the mode specified here If you choose 4G 3G 2G as network mode the router will choose a suitable one according to the actual wireless signal automatically APN Name APN means Access Point Name which is provided and required by some ISPs MTU It means Max Tra...

Page 148: ...ection mode you have to type IP address in this field for pinging TTL Time to Live Displays value for your reference TTL value is set by telnet command Modem Support List It lists all of the modems supported by such router After finishing all the settings here please click OK to activate them ...

Page 149: ... 1 W WA AN N2 2 During the procedure of IPv4 PPPoE connection we can get the IPv6 Link Local Address between the gateway and Vigor router through IPv6CP Later use DHCPv6 or Accept RA to acquire the IPv6 prefix address such as 2001 B010 7300 200 64 offered by the ISP In addition PCs under LAN also can have the public IPv6 address for Internet access by means of the generated prefix No need to type ...

Page 150: ...y Please make sure your IPv4 WAN connection is OK and apply one free account from hexago http gogonet gogo6 com page freenet6 account before you try to use TSPC for network connection TSPC would connect to tunnel broker and requests a tunnel according to the specifications inside the configuration file It gets a public IPv6 IP address and an IPv6 prefix from the tunnel broker and then monitors the...

Page 151: ...e settings are explained as follows Item Description Always On Check this box to keep the network connection always Username Type the name obtained from the broker Please apply new account at http www sixxs net It is suggested for you to apply another username and password Password Type the password assigned with the user name Confirm Password Type the password again to make the confirmation Tunne...

Page 152: ...ble settings are explained as follows Item Description Identify Association Choose Prefix Delegation or Non temporary Address as the identify association IAID Type a number as IAID After finishing all the settings here please click OK to save the configuration D De et ta ai il ls s P Pa ag ge e f fo or r I IP Pv v6 6 S St ta at ti ic c I IP Pv v6 6 i in n W WA AN N1 1 W WA AN N2 2 This type allows...

Page 153: ...fo or r I IP Pv v6 6 6 6i in n4 4 S St ta at ti ic c T Tu un nn ne el l i in n W WA AN N1 1 W WA AN N2 2 This type allows you to setup 6in4 Static Tunnel for WAN interface Such mode allows the router to access IPv6 network through IPv4 network However 6in4 offers a prefix outside of 2002 0 16 So you can use a fixed endpoint rather than any cast endpoint The mode has more reliability Available sett...

Page 154: ...e e f fo or r I IP Pv v6 6 6 6r rd d i in n W WA AN N1 1 W WA AN N2 2 This type allows you to setup 6rd for WAN interface Available settings are explained as follows Item Description 6rd Mode Auto 6rd Retrieve 6rd prefix automatically from 6rd service provider The IPv4 WAN must be set as DHCP Static 6rd Set 6rd options manually IPv4 Border Relay Type the IPv4 addresses of the 6rd Border Relay for ...

Page 155: ...sses within a given 6rd domain It may be any value between 0 and 32 6rd Prefix Type the 6rd IPv6 address 6rd Prefix Length Type the IPv6 prefix length for the 6rd IPv6 prefix in number of bits After finished the above settings click OK to save the settings Below shows an example for successful IPv6 connection based on 6rd mode ...

Page 156: ... page of Internet Access Though you can enable eight channels in this page yet only one channel can be chosen on the web page of Internet Access Add Tag To identify the usage of VLAN check this box to invoke this setting And type the number for VLAN ID number Priority To add the packet priority number for such VLAN The range is from 0 to 7 After finishing all the settings here please click OK to s...

Page 157: ...figuration telnet TR 069 VoIP It can be specified for VoIP only If you choose VoIP the configuration for this VLAN will be effective for VoIP data transmitting and receiving IPTV Packets from IGMP proxy will be sent out from such WAN interface Therefore the setting for IGMP shall be configured with PVC in the page of Application IGMP For other settings refer to Details Page for PPPoE in WAN1 B Br ...

Page 158: ... to 2 are reserved for NAT using P1 to P4 It means the LAN port 1 to 4 Check the box to designate the LAN port for channel 3 to 8 Transport VLAN Check the box to make the packets keeping their VLAN headers when being sent to the LAN port s Click Clear to remove all the configurations in this page if you do not satisfy it When you finish the configuration please click OK to save and exit this page ...

Page 159: ...T does is to translate the packets from public IP address to private IP address to forward the right packets to the right host and vice versa Besides Vigor router has a built in DHCP server that assigns private IP address to each local host See the following diagram for a briefly understanding In some special case you may have a public IP subnet from your ISP such as 220 135 240 0 24 This means th...

Page 160: ... St ta at ti ic c R Ro ou ut te e When you have several subnets in your LAN sometimes a more effective and quicker way for connection is the Static routes function rather than other method You may simply set rules to forward data from one specified subnet to another specified subnet without the presence of RIP W Wh ha at t a ar re e V Vi ir rt tu ua al l L LA AN Ns s a an nd d R Ra at te e C Co on...

Page 161: ...gs for each subnet respectively Index Display all of the LAN items Status Basically LAN1 status is enabled in default LAN2 LAN3 LAN3 and IP Routed Subnet can be observed by checking the box of Status DHCP LAN1 is configured with DHCP in default If required please check the DHCP box for each LAN IP Address Display the IP address for each LAN item Such information is set in default and you can not m...

Page 162: ...es the size of the network Default 255 255 255 0 24 RIP Protocol Control Disable deactivates the RIP protocol It will lead to a stoppage of the exchange of routing information between routers Default Enable can activate the RIP protocol DHCP Server Configuration DHCP stands for Dynamic Host Configuration Protocol The router by factory default acts a DHCP server for your network so it automatically...

Page 163: ...if this client only uses the IP for say 5 minutes the server still reserves 1 day for that client Because a DHCP server only has a limited number of IPs to lease to its DHCP clients soon enough all the IPs will be used out and then no one will be able to get any IPs from this server anymore Therefore this feature is used to get the IP back from inactive clients i e doesn t use the IP but the serve...

Page 164: ...ased on IPv4 and IPv6 Setup Click the tab for each type and refer to the following explanations for detailed information Below shows the settings page for IPv6 It provides 2 daemons for LAN side IPv6 address configuration One is RADVD stateless and the other is DHCPv6 Server Stateful Available settings are explained as follows Item Description RADVD Configuration Enable Click it to enable RADVD se...

Page 165: ...ration Disable Server Click it to disable DHCPv6 server Start IPv6 Address End IPv6 Address Type the start and end address for IPv6 server DNS Server IPv6 Address Primary DNS Sever Type the IPv6 address for Primary DNS server Secondary DNS Server Type another IPv6 address for DNS server if required Static IPv6 Address configuration IPv6 Address Type static IPv6 address for LAN Prefix Length Type t...

Page 166: ...e Server Let you manually assign IP address to every host in the LAN Enable Relay Agent Specify which subnet that DHCP server is located the relay agent should redirect the DHCP request to DHCP Server IPAddress Type the IP address of the DHCP Server Start IPAddress Type a value of the IP address pool for the DHCP server to start with when issuing IP addresses If the 1st IP address of your router i...

Page 167: ... not provide it the router will automatically apply default DNS Server IP address 194 109 6 66 to this field Secondary IPAddress You can specify secondary DNS server IP address here because your ISP often provides you more than one DNS Server If your ISP does not provide it the router will automatically apply default secondary DNS Server IP address 194 98 0 1 to this field The default DNS Server I...

Page 168: ...lead to a stoppage of the exchange of routing information between routers Default Enable Activate the RIP protocol DHCP Server Configuration DHCP stands for Dynamic Host Configuration Protocol The router by factory default acts a DHCP server for your network so it automatically dispatch related IP settings to any local user configured as a DHCP client It is highly recommended that you leave the ro...

Page 169: ... will help router to assign the correct IP address of the correct subnet to the correct host So those hosts in 2nd subnet won t get an IP address belonging to 1st subnet Add Type the MAC address in the boxes and click this button to add Delete Click it to delete the selected MAC address Edit Click it to edit the selected MAC address Cancel Click it to cancel the job of adding deleting and editing ...

Page 170: ...static route Click the IPv6 tab to open the following page Each item is explained as follows Item Description Index The number 1 to 40 under Index allows you to open next page to set up static route Destination Address Displays the destination address of the static route Status Displays the status of the static route Set to Factory Default Clear all of the settings and return to factory default se...

Page 171: ...e a an nd d P Pu ub bl li ic c N Ne et tw wo or rk ks s b ba as se ed d o on n I IP Pv v4 4 Here is an example of setting Static Route in Main Router so that user A and B locating in different subnet can talk to each other via the router Assuming the Internet access has been configured and the router works properly use the Main Router to surf the Internet create a private subnet 192 168 10 0 using...

Page 172: ...packets with the neighboring routers via the 1st subnet 192 168 1 0 24 The second is that those hosts on the internal private subnets ex 192 168 10 0 24 can access the Internet via the router and continuously exchange of IP routing information with different subnets 2 Click the LAN Static Route and click on the Index Number 1 Check the Enable box Please add a static route as shown below which regu...

Page 173: ...c Route Setup page Click on another Index Number to add another static route as show below which regulates all packets destined to 211 100 88 0 will be forwarded to 192 168 1 3 4 Go to Diagnostics and choose Routing Table to verify current routing table ...

Page 174: ...rities for LAN side QoS and can assign each of the VLANs to each of the different IP subnets that the router may also be operating in order to provide even more isolation This functionality is tag based multi subnet P Po or rt t B Ba as se ed d V VL LA AN N Relative to tag based VLAN which groups clients with an identifier port based VLAN uses physical ports to separate the clients into different ...

Page 175: ...ven though configuring wrong VLAN tag setting For Vigor router has one LAN physical port only it is recommended to enable the management port LAN 1 to ensure the data transmission is unimpeded After finishing all the settings here please click OK to save the configuration Vigor2830 series features a hugely flexible VLAN system In its simplest form each of the Gigabit LAN ports can be isolated from...

Page 176: ...AN Routing by checking the box between LAN1 and LAN2 Vigor router supports up to six private IP subnets on LAN Each can be independent isolated or common able to communicate with each other This is ideal for departmental or multi occupancy applications Note As for the VLAN applications refer to Appendix I VLAN Application on Vigor Router for more detailed information ...

Page 177: ...n Enable Click this radio button to invoke this function However IP MAC which is not listed in IP Bind List also can connect to Internet Disable Click this radio button to disable this function All the settings on this page will be invalid Strict Bind Click this radio button to block the connection of the IP MAC which is not listed in IP Bind List ARP Table This table is the LAN ARP table of this ...

Page 178: ...Note Before you select Strict Bind you have to bind one set of IP MAC address for one PC If not no one of the PCs can access into Internet And the web user interface of the router might not be accessed 4 4 2 2 6 6 L LA AN N P Po or rt t M Mi ir rr ro or r LAN port mirror can be applied for the users in LAN Generally speaking this function copies traffic from one or more specific ports to a target ...

Page 179: ...r the device that is attached to a LAN or WLAN Wired 802 1x provides authentication for one network device on each LAN port The RADIUS Server settings must be configured before enabling 802 1x because the EAP Extensible Authentication Protocol Authenticator relies on the RADIUS Server in its authentication process Each LAN port with Wired 802 1x configured will only forward 802 1x packets and bloc...

Page 180: ...e desired web page through this router That is a company which wants to have an advertisement for its products to users can specify the URL in this page to reach its goal Each item is explained as follows Item Description Profile Display the number link which allows you to configure the profile Status Display the content Disable URL Redirect or Message of the profile Interface Display the applied ...

Page 181: ...ed Interfaces Check the box es representing different interfaces to be applied by such profile The advantage is that each LAN 1 2 3 4 interface and or each SSID 1 2 3 4 for wireless network can be applied with different web portal separately After finishing all the settings here please click OK to save the configuration 4 4 3 3 L Lo oa ad d B Ba al la an nc ce e R Ro ou ut te e P Po ol li ic cy y ...

Page 182: ...rt Dest Port End Displays the IP address for the end of the destination port Move UP Move Down Use Up or Down link to move the order of the policy Wizard Mode This mode will guide you to configure the common settings with several pages Advance Mode This mode allows you to modify all the settings in one page Click Index 1 to access into the following page for configuring load balance policy Here we...

Page 183: ... WAN interface 3 Click Next to get the following page Available settings are explained as follows Item Description Interface Use the drop down list to choose a WAN or LAN interface or VPN profile Packets match with the above criteria will be transferred to the interface chosen here 4 After specifying the interface click Next to get the following page Available settings are explained as follows Ite...

Page 184: ...ies User s Guide 174 6 If there is no error click Finish to complete wizard setting To use Advance Mode do the following steps 1 Click the Advance Mode radio button 2 Click Index 1 to access into the following page ...

Page 185: ... means that all the destination IPs will be passed through the WAN interface Destination Port Any Any port number can be treated as the destination port Dest Port Start Type the destination port start for the destination IP Dest Port End Type the destination port end for the destination IP If this field is blank it means that all the destination ports will be passed through the WAN interface Send ...

Page 186: ...age of IP address NAT allows the internal IP addresses of local hosts to be translated into one public IP address thus you can have only one IP address on behalf of the entire internal hosts Enhance security of the internal network by obscuring the IP address There are many attacks aiming victims based on the IP address Since the attacker cannot be aware of any private IP addresses the NAT functio...

Page 187: ...unction please go to NAT page and choose Port Redirection web page The Port Redirection Table provides 20 port mapping entries for the internal hosts Each item is explained as follows Item Description Index Display the number of the profile Service Name Display the description of the specific network service WAN Interface Display the WAN IP address used by the profile Protocol Display the transpor...

Page 188: ... port start port and end port and the starting IP of private IP had been entered the system will calculate and display the ending IP of private IP automatically Service Name Type the description of the specific network service Protocol Select the transport layer protocol TCP or UDP WAN IP Select the WAN IP used for port redirection There are eight WAN IP alias that can be selected and used for por...

Page 189: ... Note that the router has its own built in services servers such as Telnet HTTP and FTP etc Since the common port numbers of these services servers are all the same you may need to reset the router in order to avoid confliction For example the built in web user interface in the router is with default port 80 which may conflict with the web server in the local network http 192 168 1 13 80 Therefore...

Page 190: ...LAN Regular web surfing and other such Internet activities from other clients will continue to work without inappropriate interruption DMZ Host allows a defined internal user to be totally exposed to the Internet which usually helps some special applications such as Netmeeting or Internet Games etc The security properties of NAT are somewhat bypassed if you set up DMZ host We suggest you to add ad...

Page 191: ...elect one private IP address in the list to be the DMZ host When you have selected one private IP from the above dialog the IP address will be shown on the screen Click OK to save the setting DMZ Host for WAN2 and WAN3 is slightly different with WAN1 Active True IP selection is available for WAN1 only See the following figure See the following figure If you previously have set up WAN Alias for PPP...

Page 192: ... this button and then a window will automatically pop up as depicted below The window consists of a list of private IP addresses of all hosts in your LAN network Select one private IP address in the list to be the DMZ host When you have selected one private IP from the above dialog the IP address will be shown on the following screen Click OK to save the setting After finishing all the settings he...

Page 193: ...ription Index Indicate the relative number for the particular entry that you want to offer service in a local host You should click the appropriate index number to edit or clear the corresponding entry Comment Specify the name for the defined network service WAN Interface Display the WAN interface of the profile Local IP Address Display the private IP address of the local host offering the service...

Page 194: ...ose PC to select one Choose PC Click this button and subsequently a window having a list of private IP addresses of local hosts will automatically pop up Select the appropriate IP address of the local host in the list Protocol Specify the transport layer protocol It could be TCP UDP or none for selection Start Port Specify the starting port number of the service offered by the local host End Port ...

Page 195: ...e ports are opened depends on the type of protocol used The default durations are shown below and these duration values can be modified via telnet commands TCP 86400 sec UDP 180 sec IGMP 10 sec TCP WWW 60 sec TCP SYN 60 sec Available settings are explained as follows Item Description Comment Display the text which memorizes the application of this rule Triggering Protocol Display the protocol of t...

Page 196: ... trigger profile Comment Type the text to memorize the application of this rule Triggering Protocol Select the protocol TCP UDP or TCP UDP for such triggering profile Triggering Port Type the port or port range for such trigger profile Incoming Protocol When the triggering packets received it is expected the incoming packets will use the selected protocol Select the protocol TCP UDP or TCP UDP for...

Page 197: ...Vigor2920 Series User s Guide 187 Incoming Port Type the port or port range for the incoming packets After finishing all the settings here please click OK to save the configuration ...

Page 198: ...ction SPI tracks packets and denies unsolicited incoming data Selectable Denial of Service DoS Distributed DoS DDoS attacks protection I IP P F Fi il lt te er rs s Depending on whether there is an existing Internet connection or in other words the WAN link status is up or down the IP filter architecture categorizes traffic into two Call Filter and Data Filter Call Filter When there is no existing ...

Page 199: ...em s resource while the vulnerability attacks will try to paralyze the system by offending the vulnerabilities of the protocol or operation system The DoS Defense function enables the Vigor router to inspect every incoming packet based on the attack signature database Any malicious packet that might duplicate itself to paralyze the host in the secure LAN will be strictly blocked and a Syslog messa...

Page 200: ...ign a start filter set for the Call Filter Data Filter Check Enable to activate the Data Filter function Assign a start filter set for the Data Filter Accept large incoming Some on line games for example Half Life will use lots of fragmented UDP packets to transfer game data Instinctively as a secure firewall Vigor router will reject these fragmented packets to prevent attack unless you enable Acc...

Page 201: ... It is effective only for the packets routed but not for packets translated by NAT IPv4 Check the box to make the incoming packets via IPv4 being accepted by such router It is effective only for the packets routed but not for packets translated by NAT After finishing all the settings here please click OK to save the configuration D De ef fa au ul lt t R Ru ul le e P Pa ag ge e Such page allows you...

Page 202: ...file existed Create New User or Create New Group item will appear for you to click to create a new one APP Enforcement Select an APP Enforcement profile for global IM P2P application blocking If there is no profile for you to select please choose Create New from the drop down list in this page to create a new profile All the hosts in LAN must follow the standard configured in the APP Enforcement p...

Page 203: ...ds you can specify to record information for Web Content Filter by checking the Log box It will be sent to Syslog server Please refer to section Syslog Mail Alert for more detailed information Advance Setting Click Edit to open the following window However it is strongly recommended to use the default settings here Codepage This function is used to compare the characters among different languages ...

Page 204: ...ions can make the best utilization of network resources After finishing all the settings here please click OK to save the configuration 4 4 5 5 3 3 F Fi il lt te er r S Se et tu up p Click Firewall and click Filter Setup to open the setup page To edit or add a filter click on the set number to edit the individual set The following page will be shown Each filter set contains up to 7 rules Click on ...

Page 205: ...er to the following page Active Enable or disable the filter rule Comment Enter filter set comments description Maximum length is 23 character long Move Up Down Use Up or Down link to move the order of the filter rules Next Filter Set Set the link to the next filter set to be executed after the current filter run Do not make a loop with many filter sets To edit Filter Rule click the Filter Rule in...

Page 206: ...n time interval only You may choose up to 4 schedules out of the 15 schedules pre defined in Applications Schedule setup The default setting of this field is blank and the function will always work Clear sessions when schedule ON Check this box to clear all the sessions when the schedule is configured and specified above Direction Set the direction of packet flow It is for Data Filter only For the...

Page 207: ...Address Single Address Range Address Subnet Address as the Address Type and type them in this dialog In addition if you want to use the IP range from defined groups or objects please choose Group and Objects as the Address Type From the IP Group drop down list choose the one that you want to apply Or use the IP Object drop down list to choose the object that you want Service Type Click Edit to acc...

Page 208: ...t the port defined here when the first and last values are different it indicates that all the ports except the range defined here are available for this service type the port number greater than this value is available the port number less than this value is available for this profile Service Group Object Use the drop down list to choose the one that you want Fragments Specify the action for frag...

Page 209: ...ngs configured in IP Object for Source IP and Destination IP be bound for applying such filter rule No Strict no limitation Quality of Service Choose one of the QoS rules to be applied as firewall rule For detailed information of setting QoS please refer to the related section later Load Balance policy Choose the WAN interface for applying Load Balance Policy User Management Such item is available...

Page 210: ...ing with this router Please set at least one profile for anti virus in CSM Web Content Filter web page first Or choose Create New from the drop down list in this page to create a new profile For troubleshooting needs you can specify to record information for Web Content Filter by checking the Log box It will be sent to Syslog server Please refer to section Syslog Mail Alert for more detailed infor...

Page 211: ... rule DrayTek Banner Please uncheck this box and the following screen will not be shown for the unreachable web page The default setting is Enabled Strict Security Checking All the packets while transmitting through Vigor router will be filtered by firewall settings configured by Vigor router When the resource is inadequate the packets will be blocked if Strict Security Checking is enabled If Stri...

Page 212: ...f two IP filters call filter or data filter You may preset 12 call filters and data filters in Filter Setup and even link them in a serial manner Each filter set is composed by 7 filter rules which can be further defined After that in General Setup you may specify one set for call filter and one set for data filter to execute first ...

Page 213: ...hold of the TCP SYN packets from the Internet has exceeded the defined value the Vigor router will start to randomly discard the subsequent TCP SYN packets for a period defined in Timeout The goal for this is prevent the TCP SYN packets attempt to exhaust the limited resource of Vigor router By default the threshold and timeout values are set to 2000 packets per second and 10 seconds respectively ...

Page 214: ...attack event Block IP options Check the box to activate the Block IP options function The Vigor router will ignore any IP packets with IP option field in the datagram header The reason for limitation is IP option appears to be a vulnerability of the security for the LAN because it will carry significant information such as security TCC closed user group parameters a series of Internet addresses ro...

Page 215: ...those target hosts will hang once they re construct the packets The Vigor routers will block any packets realizing this attacking activity Block ICMP Fragment Check the box to activate the Block ICMP fragment function Any ICMP packets with more fragment bit set are dropped Block Unassigned Numbers Check the box to activate the Block Unknown Protocol function Individual IP packet has a protocol fie...

Page 216: ...policies or rules for different hosts with different User Management accounts This is more flexible and convenient for network management Not only offering the basic checking for Internet access User Management also provides additional firewall rules e g CSM checking for protecting hosts Note Filter rules configured under Firewall usually are applied to the host the one that the router installed o...

Page 217: ...for you to choose Each mode will bring different filtering effect to the users involved User Based If you choose such mode the router will apply the filter rules configured in User Management User Profile to the users Rule Based If you choose such mode the router will apply the filter rules configured in Firewall General Setup and Filter Rule to the users Display IP Address on tracking window On T...

Page 218: ...r r P Pr ro of fi il le e This page allows you to set customized profiles up to 200 which will be applied for users controlled under User Management Simply open User Management User Profile To set the user profile please click any index number link to open the following page Notice that profile 1 admin and profile 2 System Reservation are factory default settings Profile 2 is reserved for future u...

Page 219: ...router However the accessing operation will be restricted with the conditions configured in this user profile Password Type a password for such profile e g lug123 wug123 wug456 etc When a user tries to access Internet through this router an authentication step must be performed first The user has to type the password specified here to pass the authentication When the user passes the authentication...

Page 220: ...p for you to define another filter rule as a new policy For the detailed configuration simply refer to Firewall Filter Rule The firewall filter rules that are not selected in Firewall General Default rule can be available for use in User Management User Profile External Service Authentication The router will authenticate the dial in user by itself or by external service such as LDAP server or Radi...

Page 221: ...h any browser on Windows Note that Alert Tool can be downloaded from DrayTek web site Telnet If it is selected the user can use Telnet command to perform the authentication job Landing Page When a user tries to access into the web user interface of Vigor2920 series with the user name and password specified in this profile he she will be lead into the web page configured in Landing Page field in Us...

Page 222: ...ch profile Click this box to decrease the data quota for such profile Reset quota to default when scheduling time expired Set default time quota and data quota for such profile When the scheduling time is up the router will use the default quota settings automatically Enable Check it to use the default setting for time quota and data quota Default Time Quota Type the value for the time manually De...

Page 223: ...Item Description Name Type a name for this user group Available User Objects You can gather user profiles objects from User Profile page within one user group All the available user objects that you have created will be shown in this box Notice that user object Admin and Dial In User are factory settings User defined profiles will be numbered with 3 4 5 and so on Selected User Objects Click button...

Page 224: ...refresh this page manually Index Display the number of the data flow Active User Display the users which connect to Vigor router currently You can click the link under the username to open the user profile setting page for that user IP Address Display the IP address of the device Last Login Time Display the login time that such user connects to the router last time Expired Time Display the expired...

Page 225: ... select that object group that can apply it For example all the IPs in the same department can be defined with an IP object a range of IP address 4 4 7 7 1 1 I IP P O Ob bj je ec ct t You can set up to 192 sets of IP Objects with different conditions Available settings are explained as follows Item Description Set to Factory Default Clear all profiles Index Display the profile number that you can ...

Page 226: ... Edit Filter Rule will ask you specify IP or IP range for WAN or LAN or any IP address If you choose LAN as the Interface here and choose LAN as the direction setting in Edit Filter Rule then all the IP addresses specified with LAN interface will be opened for you to choose in Edit Filter Rule page Address Type Determine the address type for the IP address Select Single Address if this object cont...

Page 227: ... be controlled Start IP Address Type the start IP address for Single Address type End IP Address Type the end IP address if the Range Address type is selected Subnet Mask Type the subnet mask if the Subnet Address type is selected Invert Selection If it is checked all the IP addresses except the ones listed above will be applied later while it is chosen 3 After finishing all the settings here plea...

Page 228: ...oup Available settings are explained as follows Item Description Set to Factory Default Clear all profiles Index Display the profile number that you can configure Name Display the name of the group profile To set a new profile please do the steps listed below 1 Click the number e g 1 under Index column for configuration in details ...

Page 229: ...acters are allowed Interface Choose WAN LAN or Any to display all the available IP objects with the specified interface Available IP Objects All the available IP objects with the specified interface chosen above will be shown in this box Selected IP Objects Click button to add the selected IP objects in this box 3 After finishing all the settings here please click OK to save the configuration ...

Page 230: ...gs are explained as follows Item Description Set to Factory Default Clear all profiles Index Display the profile number that you can configure Name Display the name of the object profile To set a new profile please do the steps listed below 1 Click the number e g 1 under Index column for configuration in details 2 The configuration page will be shown as follows ...

Page 231: ...Pv6 address Select Any Address if this object contains any IPv6 address Select Mac Address if this object contains Mac address MAC Address Type the MAC address of the network card which will be controlled Start IP Address Type the start IP address for Single Address type End IP Address Type the end IP address if the Range Address type is selected Subnet Mask Type the subnet mask if the Subnet Addr...

Page 232: ...gs are explained as follows Item Description Set to Factory Default Clear all profiles Index Display the profile number that you can configure Name Display the name of the group profile To set a new profile please do the steps listed below 1 Click the number e g 1 under Index column for configuration in details 2 The configuration page will be shown as follows ...

Page 233: ...rofile Maximum 15 characters are allowed Available IPv6 Objects All the available IPv6 objects with the specified interface chosen above will be shown in this box Selected IPv6 Objects Click button to add the selected IPv6 objects in this box 3 After finishing all the settings here please click OK to save the configuration ...

Page 234: ...th different conditions Available settings are explained as follows Item Description Set to Factory Default Clear all profiles Index Display the profile number that you can configure Name Display the name of the object profile To set a new profile please do the steps listed below 1 Click the number e g 1 under Index column for configuration in details ...

Page 235: ... number when the first and last value are the same it indicates one port when the first and last values are different it indicates a range for the port and available for this profile when the first and last value are the same it indicates all the ports except the port defined here when the first and last values are different it indicates that all the ports except the range defined here are availab...

Page 236: ...es into one group Available settings are explained as follows Item Description Set to Factory Default Clear all profiles Index Display the profile number that you can configure Name Display the name of the group profile To set a new profile please do the steps listed below 1 Click the number e g 1 under Group column for configuration in details ...

Page 237: ...me Type a name for this profile Available Service Type Objects All the available service objects that you have added on Objects Setting Service Type Object will be shown in this box Selected Service Type Objects Click button to add the selected IP objects in this box 3 After finishing all the settings here please click OK to save the configuration ...

Page 238: ...r Profile Available settings are explained as follows Item Description Set to Factory Default Clear all profiles Index Display the profile number that you can configure Name Display the name of the object profile To set a new profile please do the steps listed below 1 Click the number e g 1 under Index column for configuration in details 2 The configuration page will be shown as follows ...

Page 239: ...le e g game Contents Type the content for such profile For example type gambling as Contents When you browse the webpage the page with gambling information will be watched out and be passed blocked based on the configuration on Firewall settings 3 After finishing all the settings here please click OK to save the configuration ...

Page 240: ...osen as black white list in CSM URL Web Content Filter Profile Available settings are explained as follows Item Description Set to Factory Default Clear all profiles Index Display the profile number that you can configure Name Display the name of the group profile To set a new profile please do the steps listed below 1 Click the number e g 1 under Index column for configuration in details ...

Page 241: ...this group Available Keyword Objects You can gather keyword objects from Keyword Object page within one keyword group All the available Keyword objects that you have created will be shown in this box Selected Keyword Objects Click button to add the selected Keyword objects in this box 3 After finishing all the settings here please click OK to save the configuration ...

Page 242: ...with name of default is the default profile some files with the file extensions specified in this profile will be ignored and not be scanned by Vigor router Each item is explained as follows Item Description Set to Factory Default Clear all of the settings and return to factory default settings Index Display the profile number that you can configure Name Display the name of the object profile To s...

Page 243: ...lable settings are explained as follows Item Description Profile Name Type a name for this profile 3 Type a name for such profile and check all the items of file extension that will be processed in the router 4 After finishing all the settings here please click OK to save the configuration ...

Page 244: ...ch item is explained as follows Item Description Set to Factory Default Clear all of the settings and return to factory default settings Index Display the profile number that you can configure Profile Name Display the name for such SMS profile SMS Provider Display the service provider which offers SMS service To set a new profile please do the steps listed below 1 Click the SMS Provider tab and cl...

Page 245: ...register to selected SMS provider Quota Type the number e g 5 10 etc of the SMS text message allowed to be sent out by this profile When WAN interface disconnects frequently the text message will be sent for several time e g 5 10 etc within the time interval Once the quota ran out no SMS will be sent out Note The number of the credit can be purchased from the service provider chosen above One cred...

Page 246: ...to make customized SMS service The profile name for Index 9 and Index 10 are fixed You can click the number e g 9 under Index column for configuration in details Available settings are explained as follows Item Description Profile Name Display the name of this profile It cannot be modified Service Provider Type the website of the service provider Type the URL string in the box under the filed of S...

Page 247: ...nterval for the system to send SMS After finishing all the settings here please click OK to save the configuration M Ma ai il l S Se er rv vi ic ce e O Ob bj je ec ct t This page allows you to set ten profiles which will be applied in Application SMS Mail Alert Service Each item is explained as follows Item Description Set to Factory Default Clear all of the settings and return to factory default ...

Page 248: ...ype a name for such mail service profile SMTP Server Type the IP address of the mail server SMTP Port Type the port number for SMTP server Sender Address Type the e mail address of the sender Authentication The mail server must be authenticated with the correct username and password to have the right of sending message out Check the box to enable the function Username Type a name for authenticatio...

Page 249: ...ice You can set an object with different monitoring situation Each item is explained as follows Item Description Set to Factory Default Clear all of the settings and return to factory default settings Index Display the profile number that you can configure Profile Name Display the name for such mail server profile To set a new profile please do the steps listed below 1 Open Object Setting Notifica...

Page 250: ...lained as follows Item Description Profile Name Type a name for such notification profile Category Display the types that will be monitored Status Display the status for the category You can check the box you want to be monitored 3 After finishing all the settings here please click OK to save the configuration ...

Page 251: ...nal firewall in the field of filtering Because it checks the URL strings or some of HTTP data hiding in the payload of TCP packets while legacy firewall inspects packets based on the fields of TCP IP headers only On the other hand Vigor router can prevent user from accidentally downloading malicious codes from web pages It s very common that malicious codes conceal in the executable objects such a...

Page 252: ...ile will be applied in Default Rule of Firewall General Setup for filtering Each item is explained as follows Item Description Set to Factory Default Clear all profiles Profile Display the number of the profile which allows you to click to set different policy Name Display the name of the APP Enforcement Profile Click the number under Index column for settings in detail There are four tabs IM P2P ...

Page 253: ...rofile Select All Click it to choose all of the items in this page Clear All Uncheck all the selected boxes After finishing all the settings here please click OK to save the configuration The profiles configured here can be applied in the Firewall General Setup and Firewall Filter Setup pages as the standard for the host s to follow ...

Page 254: ...Vigor2920 Series User s Guide 244 The items categorized under P2P Below shows the items which are categorized under IM The items categorized under Protocol ...

Page 255: ...Vigor2920 Series User s Guide 245 The items categorized under OTHERS ...

Page 256: ...ts based on the fields of TCP IP headers only On the other hand Vigor router can prevent user from accidentally downloading malicious codes from web pages It s very common that malicious codes conceal in the executable objects such as ActiveX Java Applet compressed files and other executable files Once downloading these types of files from websites you may risk bringing threat to your system For e...

Page 257: ...is page for URL Access Control and Web Feature will be inactive Both Block The router will block all the packages that match with the conditions specified in URL Access Control and Web Feature below When you choose this setting both configuration set in this page for URL Access Control and Web Feature will be inactive Either URL Access Control First When all the packages matching with the conditio...

Page 258: ...nt someone dodges the URL Access Control You must clear your browser cache first so that the URL content filtering facility operates properly on a web page that you visited before Action This setting is available only when Either URL Access Control First or Either Web Feature First is selected Pass Allow accessing into the corresponding webpage with the keywords listed on the box below Block Restr...

Page 259: ...into the corresponding webpage with the keywords listed on the box below If the web pages do not match with the specified feature set here it will be processed with reverse action Cookie Check the box to filter out the cookie transmission from inside to outside world to protect the local user s privacy Proxy Check the box to reject any proxy transmission To control efficiently the limited bandwidt...

Page 260: ...F feature or getting a new license for web content filter you have to click Activate to satisfy your request Be aware that service provider matching with Vigor router currently offers a period of time for trial version for users to experiment If you want to purchase a formal edition simply contact with the channel partner or your dealer Click CSM and click Web Content Filter Profile to open the pr...

Page 261: ...another qualified and suitable server Set to Factory Default Click this link to retrieve the factory settings Default Message You can type the message manually for your necessity or click this button to get the default message which will be displayed on the field of Administration Message Cache None the router will check the URL that the user wants to access via WCF precisely however the processin...

Page 262: ...with the fastest rate L1 L2 Cache the router will check the URL with fast processing rate combining the feature of L1 and L2 Eight profiles are provided here as Web content filters Simply click the index number under Profile to open the following web page The items listed in Categories will be changed according to the different service providers If you have and activate another web content filter ...

Page 263: ...llow accessing into the corresponding webpage with the categories listed on the box below Block restrict accessing into the corresponding webpage with the categories listed on the box below If the web pages do not match with the specified feature set here it will be processed with reverse action Log None There is no log file will be recorded for this profile Pass Only the log about Pass will be re...

Page 264: ... no log file will be recorded for this profile Pass Only the log about Pass will be recorded in Syslog Block Only the log about Block will be recorded in Syslog All All the actions Pass and Block will be recorded in Syslog Service Set the filtering conditions Specify one of the WCF profiles as Service Choose the WCF profiles to apply DNS filter Cache Time hour Set the time for DNS query Enable Blo...

Page 265: ...o save the configuration 4 4 8 8 5 5 A AP PP PE E S Su up pp po or rt t L Li is st t This page offers the software versions for each applications managed by APP Enforcement Profiles by Vigor router Click the IM P2P PROTOCOL OTHERS tab to open the information page for different APP type ...

Page 266: ...for such connection The P2P Peer to Peer applications e g BitTorrent always need many sessions for procession and also they will occupy over resources which might result in important accesses impacted To solve the problem you can use limit session to limit the session procession for specified Hosts In the Bandwidth Management menu click Sessions Limit to open the web page To activate the function ...

Page 267: ...ssion number in this field the system will use the default session limit for the specific limitation you set for each index Add Adds the specific session limitation onto the list above Edit Allows you to edit the settings for the selected limitation Delete Remove the selected settings existing on the limitation list Administration Message Type the words which will be displayed when reaches the max...

Page 268: ...th Management menu click Bandwidth Limit to open the web page Available settings are explained as follows Item Description Bandwidth Limit Enable Click this button to activate the function of limit bandwidth IP Routed Subnet Check this box to apply the bandwidth limit to the second subnet specified in LAN General Setup Disable Click this button to close the function of limit bandwidth Default TX l...

Page 269: ...set the limit in this field the system will use the default speed for the specific limitation you set for each index Add Add the specific speed limitation onto the list above Update Allow you to edit the settings for the selected limitation Delete Remove the selected settings existing on the limitation list Smart Bandwidth Limit Check this box to have the bandwidth limit determined by the system a...

Page 270: ... to queues and associated service types The basic QoS implementation in Vigor routers is to classify and schedule packets based on the service type information in the IP header For instance to ensure the connection with the headquarter a teleworker may enforce an index of QoS Control to reserve bandwidth for HTTPS connection while using lots of application at the same time One more larger scale im...

Page 271: ... edit Status Display if the WAN interface is available for such function or not Bandwidth Display the inbound and outbound bandwidth setting for the WAN interface Direction Display which direction that such function will influence Class 1 Class2 Class 3 Others Display the bandwidth percentage for each class UDP Bandwidth Control Display the UDP bandwidth control is enabled or not Online Statistics...

Page 272: ...he WAN interface edit the Class Rule and edit the Service Type for the Class Rule for your request O On nl li in ne e S St ta at ti is st ti ic cs s Display an online statistics for quality of service for your reference This feature is available only when the Quality of Service for WAN interface is enabled G Ge en ne er ra al l S Se et tu up p f fo or r W WA AN N I In nt te er rf fa ac ce e When y...

Page 273: ...cting rate of data output for WAN For example if your ADSL supports 1M of downstream and 256K upstream please set 256kbps for this box The default value is 10000kbps Note The rate of outbound inbound must be smaller than the real bandwidth to ensure correct calculation of QoS It is suggested to set the bandwidth value for inbound outbound as 80 85 of physical network speed provided by ISP to maxim...

Page 274: ... Class 1 to Class 3 class rules can be adjusted for your necessity To add edit or delete the class rule please click the Edit link of that one 2 After you click the Edit link you will see the following page Now you can define the name for that Class In this case Test is used as the name of Class Index 1 Available settings are explained as follows Item Description Name Display the name of such clas...

Page 275: ...o open the following page Available settings are explained as follows Item Description ACT Check this box to invoke these settings Ethernet Type Please specify which protocol IPv4 or IPv6 will be used for this rule Local Address Click the Edit button to set the local IP address on LAN for the rule Remote Address Click the Edit button to set the remote IP address on LAN WAN for the rule Edit It all...

Page 276: ...service type from the Service Type drop down list Those types are predefined in factory Simply choose the one that you want for using by current QoS 4 After finishing all the settings here please click OK to save the configuration By the way you can set up to 20 rules for one Class If you want to edit an existed rule please select the radio button of that one and click Edit to open the rule edit p...

Page 277: ...4 By the way you can set up to 10 service types If you want to edit delete an existed service type please select the radio button of that one and click Edit Edit for modification R Re et ta ag g t th he e P Pa ac ck ke et ts s f fo or r I Id de en nt ti if fi ic ca at ti io on n Packets coming from LAN IP can be retagged through QoS setting When the packets sent out through WAN interface all of th...

Page 278: ...of bandwidth management on the service such as IM or P2P without fixed IP or port number APP QoS employs the function of APP Enforcement to detect several types of software in application layer By combining the function of QoS Vigor router can perform the bandwidth management for the application of VoIP Streaming IM P2P and so on Open Bandwidth Management APP QoS to display the following page ...

Page 279: ...eactivate APP QoS function Use Default Setting The packets will be transmitted with the default settings That is VoIP packets will be the first to be sent out and P2P packets will be the last to be sent out Enable for Application There are four applications VoIP Streaming IM Tunneling Remote Control Web HD and P2P which can be specified with different QoS Class ...

Page 280: ... Internet It is particularly helpful if you host a web server FTP server or other server behind the router Before you use the Dynamic DNS feature you have to apply for free DDNS service to the DDNS service providers The router provides up to three accounts from three different DDNS service providers Basically Vigor routers are compatible with the DDNS services supplied by most popular DDNS service...

Page 281: ...nt is active or inactive 3 Select Index number 1 to add an account for the router Check Enable Dynamic DNS Account and choose correct Service Provider dyndns org type the registered hostname hostname and domain name suffix dyndns org in the Domain Name block The following two blocks should be typed your account Login Name test and Password test Available settings are explained as follows Item Desc...

Page 282: ...mail server will be used as backup mail exchange Determine Real WAN IP If a Vigor router is installed behind any NAT router you can enable such function to locate the real WAN IP When the WAN IP used by Vigor router is private IP this function can detect the public IP used by the NAT router and use the detected IP address for DDNS update There are two methods offered for you to choose WAN IP If it...

Page 283: ... specify specific private IP address es to correspondent servers Thus even the remote PC is adopting public DNS as the DNS server the LAN DNS resolution on Vigor2830 series will respond the specified private IP address Open Application LAN DNS to get the following page Available settings are explained as follows Item Description Set to Factory Default Clear all profiles and recover to factory sett...

Page 284: ... settings are explained as follows Item Description Enable Check the box to enable such profile Profile Type a name for such profile Domain Name Type a domain name e g FTP Mail or Web server for such profile IP Address List Add Click it to open the following dialog You have to give an IP address representing the host Only responds Disable it to apply this profile to all of the LAN subnets Or enabl...

Page 285: ...pplicable to other functions You have to set your time before set schedule In System Maintenance Time and Date menu press Inquire Time button to set the Vigor router s clock to current time of your PC The clock will reset once if you power down or reset the router There is another way to set up time You can inquiry an NTP server a time server on the Internet to synchronize the router s clock This ...

Page 286: ...e schedule Start Time hh mm Specify the starting time of the schedule Duration Time hh mm Specify the duration or period for the schedule Action Specify which action Call Schedule should apply during the period of the schedule Force On Force the connection to be always on Force Down Force the connection to be always down Enable Dial On Demand Specify the connection to be dial on demand and the val...

Page 287: ...o control the PPPoE Internet access connection to be always on Force On from 9 00 to 18 00 for whole week Other time the Internet access connection should be disconnected Force Down Office Hour Force On Mon Sun 9 00 am to 6 00 pm 1 Make sure the PPPoE connection and Time Setup is working properly 2 Configure the PPPoE always on from 9 00 to 18 00 for whole week 3 Configure the Force Down from 18 0...

Page 288: ...to authenticate the messages sent between them Both sides must be configured to use the same shared secret Confirm Shared Secret Re type the Shared Secret for confirmation After finished the above settings click OK button to save the settings 4 4 1 10 0 5 5 A Ac ct ti iv ve e D Di ir re ec ct to or ry y L LD DA AP P Lightweight Directory Access Protocol LDAP is a communication protocol for using i...

Page 289: ...n Regular Mode Mostly it is the same with anonymous mode The different is that the server will firstly check if you have the search authority For the regular mode you ll need to type in the Regular DN and Regular Password Server Address Enter the IP address of LDAP server Destination Port Type a port number as the destination port for LDAP server Use SSL Check the box to use the port number specif...

Page 290: ...e 280 After finished the above settings click OK button to save the settings P Pr ro of fi il le es s You can configure eight AD LDAP profiles These profiles would be used with User Management for different purposes in management ...

Page 291: ...to save and exit this page A new profile will be created For detailed information about LDAP application refer to section 4 14 How to Implement the AD LDAP Authentication for User Management 4 4 1 10 0 6 6 U UP Pn nP P The UPnP Universal Plug and Play protocol is supported to bring to network connected devices the ease of installation and configuration which is already available for directly conne...

Page 292: ...ection status and control status will be able to be activated The NAT Traversal of UPnP enables the multimedia features of your applications to operate This has to manually set up port mappings or use other similar methods The screenshots below show examples of this facility The UPnP facility on the router enables UPnP aware applications such as MSN Messenger to discover what are behind a NAT rout...

Page 293: ...ction on your network may incur some security threats You should consider carefully these risks before activating the UPnP function Some Microsoft operating systems have found out the UPnP weaknesses and hence you need to ensure that you have applied the latest service packs and patches Non privileged users can control some router functions including removing and adding port mappings The UPnP func...

Page 294: ...ddition such function is available in NAT mode Enable IGMP Snooping Check this box to enable this function Multicast traffic will be forwarded to ports that have members of that group Disabling IGMP snooping will make multicast traffic treated in the same manner as broadcast traffic Group ID This field displays the ID port for the multicast group The available range for IGMP starts from 224 0 0 0 ...

Page 295: ...ble settings are explained as follows Item Description Wake by Two types provide for you to wake up the bound IP If you choose Wake by MAC Address you have to type the correct MAC address of the host in MAC Address boxes If you choose Wake by IP Address you have to choose the correct IP address IP Address The IP addresses that have been configured in Firewall Bind IP to MAC will be shown in this d...

Page 296: ...Available settings are explained as follows Item Description Set to Factory Default Clear all profiles and recover to factory settings Index Check the box to enable such profile SMS Provider Use the drop down list to choose SMS service provider You can click SMS Provider link to define the SMS server Recipient Type the name of the one who will receive the SMS Notify Use the drop down list to choos...

Page 297: ...down list to choose mail service provider You can click Mail Service link to define the mail server Recipient Type the e mail address of the one who will receive the notification message Notify Profile Use the drop down list to choose a message profile The recipient will get the content stated in the message profile You can click the Notify Profile link to define the content of the mail message Sc...

Page 298: ...te link Below shows the menu items for VPN and Remote Access 4 4 1 11 1 1 1 R Re em mo ot te e A Ac cc ce es ss s C Co on nt tr ro ol l Enable the necessary VPN service as you need If you intend to run a VPN server inside your LAN you should disable the VPN service of Vigor Router to allow VPN tunnel pass through as well as the appropriate NAT settings such as DMZ or open port After finishing all ...

Page 299: ...will transmit no MPPE encrypted packets Otherwise the MPPE encryption scheme will be used to encrypt the data Require MPPE 40 128bits Selecting this option will force the router to encrypt packets by using the MPPE encryption algorithm In addition the remote dial in user will use 40 bit to perform encryption prior to using 128 bit for encryption In other words if 128 bit MPPE encryption method is ...

Page 300: ... Pre Shared Key or Digital Signature x 509 The peer that starts the negotiation proposes all its policies to the remote peer and then remote peer tries to find a highest priority match with its policies Eventually to set up a secure tunnel for IKE Phase 2 Phase 2 negotiation IPSec security methods including Authentication Header AH or Encapsulating Security Payload ESP for the following IKE exchan...

Page 301: ...uthentication Pre Shared Key Specify a key for IKE authentication Confirm Pre Shared Key Retype the characters to confirm the pre shared key IPSec Security Method Medium Authentication Header AH means data will be authenticated but not be encrypted By default this option is active High ESP Encapsulating Security Payload ESP means payload data will be encrypted and authenticated You may select encr...

Page 302: ...al certificates for peer dial in users Each item will be explained as follows Item Description Set to Factory Default Click it to clear all indexes Index Click the number below Index to access into the setting page of IPSec Peer Identity Name Display the profile name of that index Click each index to edit one peer digital certificate There are three security levels of digital signature authenticat...

Page 303: ...pt the peer with matching value The field can be IP Address Domain or E mail Address The box under the Type will appear according to the type you select and ask you to fill in corresponding setting Accept Subject Name Click to check the specific fields of digital signature to accept the peer with matching value The field includes Country C State ST Location L Organization O Organization Unit OU Co...

Page 304: ...ws the summary table Each item will be explained as follows Item Description Set to Factory Default Click to clear all indexes Index Click the number below Index to access into the setting page of Remote Dial in User User Display the username for the specific dial in user of the LAN to LAN profile The symbol represents that the profile is empty Active Check the box to enable the selected profile S...

Page 305: ...me and Password of remote dial in user below IPSec Tunnel Allow the remote dial in user to make an IPSec VPN connection through Internet L2TP with IPSec Policy Allow the remote dial in user to make a L2TP VPN connection through the Internet You can select to use L2TP alone or with IPSec Select from below None Do not apply the IPSec policy Accordingly the VPN connection employed the L2TP without IP...

Page 306: ...cked by the router Subnet Vigor2920 offers multiple subnets in default LAN1 to LAN4 for different purposes Simply use the drop down list to specify which subnet will be applied by this profile Assign Static IP Address If you want to specify an IP address as the subnet for this profile Check this box to enable it and type an IP address in this field User Name This field is applicable when you selec...

Page 307: ... specify the remote node Check the Medium DES 3DES or AES box as the security method Medium Authentication Header AH means data will be authenticated but not be encrypted By default this option is invoked You can uncheck it to disable it High Encapsulating Security Payload ESP means payload data will be encrypted and authenticated You may select encryption algorithm from Data Encryption Standard D...

Page 308: ... IPSec Tunnel and L2TP by itself or over IPSec and corresponding security methods etc The router supports up to 32 VPN tunnels simultaneously The following figure shows the summary table The following shows profiles joined into VPN Backup mechanism Each item will be explained as follows Item Description Set to Factory Default Click to clear all indexes View All Click it to show all of profiles Tru...

Page 309: ...ofile includes 4 subgroups If the fields gray out it means you may leave it untouched The following explanations will guide you to fill all the necessary fields For the web page is too long we divide the page into several sections for explanation Available settings are explained as follows Item Description Common Settings Profile Name Specify a name for the profile of the LAN to LAN connection Ena...

Page 310: ... Packet Pass click it to have an inquiry for data transmission between the hosts located on both sides of VPN Tunnel while connecting Block When there is conflict occurred between the hosts on both sides of VPN Tunnel in connecting such function can block data transmission of Netbios Naming Packet inside the tunnel Multicast via VPN Some programs might send multicast packets via VPN connection Pas...

Page 311: ...ion to the server through the Internet You should set the identity like User Name and Password below for the authentication of remote server IPSec Tunnel Build an IPSec VPN connection to the server through Internet L2TP with IPSec Policy Build a L2TP VPN connection through the Internet You can select to use L2TP alone or with IPSec Select from below None Do not apply the IPSec policy Accordingly t...

Page 312: ...Sec Tunnels and L2TP with IPSec Policy Medium AH Authentication Header means data will be authenticated but not be encrypted By default this option is active High ESP Encapsulating Security Payload means payload data will be encrypted and authenticated Select from below DES without Authentication Use DES encryption algorithm and not apply any authentication scheme DES with Authentication Use DES e...

Page 313: ...se 2 proposal To propose the local available algorithms to the VPN peers and get its feedback to find a match Three combinations are available for both modes We suggest you select the combination that covers the most algorithms IKE phase 1 key lifetime For security reason the lifetime of key should be defined The default value is 28800 seconds You may specify a value in between 900 and 86400 secon...

Page 314: ...rough Internet L2TP with IPSec Policy Allow the remote dial in user to make a L2TP VPN connection through the Internet You can select to use L2TP alone or with IPSec Select from below None Do not apply the IPSec policy Accordingly the VPN connection employed the L2TP without IPSec policy can be viewed as one pure L2TP connection Nice to Have Apply the IPSec policy first if it is applicable during ...

Page 315: ...the IP address of the remote node Pre Shared Key Check the box of Pre Shared Key to invoke this function and type in the required characters 1 63 as the pre shared key Digital Signature X 509 Check the box of Digital Signature to invoke this function and select one predefined Profiles set in the VPN and Remote Access IPSec Peer Identity Local ID Specify which one will be inspected first Alternativ...

Page 316: ...ress is fixed by remote side specify the fixed IP address here Do not change the default value if you do not select PPTP or L2TP Remote Gateway IP This field is only applicable when you select PPTP or L2TP with or without IPSec policy above The default value is 0 0 0 0 which means the Vigor router will get a remote Gateway PPP IP address from the remote router during the IPCP negotiation phase If ...

Page 317: ...net to remote network you have to do If the remote network only allows you to dial in with single IP please choose NAT otherwise choose Route Change default route to this VPN tunnel Check this box to change the default route with this VPN tunnel Note that this setting is available only for one WAN interface is enabled It is not available when both WAN interfaces are enabled 2 After finishing all t...

Page 318: ...ut connection types contain IPSec PPTP L2TP L2TP over IPSec and ISDN depends on hardware specification The web page is simple to understand and easy to configure Filly compliant with VPN Server LAN Sit Single Multi Network Mail Alert support please refer to System Maintenance SysLog Mail Alert for detailed configuration Syslog support please refer to System Maintenance SysLog Mail Alert for detail...

Page 319: ... so on Advanced This button is only available when there is one profile or more created in this page Detailed information for this dialog see later section Advanced Backup General Setup Status After choosing one of the profile listed above please click Enable to activate this profile If you click Disable the selected or current used VPN TRUNK Backup Load Balance mechanism profile will not have any...

Page 320: ...N web page VPN TRUNK VPN Backup mechanism backup profile will process and handle everything unless it is off line once it is activated H Ho ow w c ca an n y yo ou u s se et t a a V VP PN N T TR RU UN NK K V VP PN N B Ba ac ck ku up p m me ec ch ha an ni is sm m p pr ro of fi il le e 1 First of all go to VPN and Remote Access LAN to LAN Set two or more LAN to LAN profiles first that will be used fo...

Page 321: ...ter will be used as the VPN Server i e with virtual address 192 168 50 200 Please type 192 168 50 200 in the field of My GRE IP Type IP address 192 168 50 100 of the client in the field of Peer GRE IP See the following graphic for an example 3 Later on peer side as VPN Client please type 192 168 50 100 in the field of My GRE IP and type IP address of the server 192 168 50 200 in the field of Peer ...

Page 322: ...explanation Available settings are explained as follows Item Description Profile Name List the backup profile name ERD Mode ERD means Environment Recovers Detection Normal choose this mode to make all dial out VPN TRUNK backup profiles being activated alternatively Resume when VPN connection breaks down or disconnects Member 1 will be the top priority for the system to do VPN connection Detail Inf...

Page 323: ...l and clicking Dial button Available settings are explained as follows Item Description Dial out Tool General Mode This filed displays the profile configured in LAN to LAN with Index number and VPN Server IP address The VPN connection built by General Mode does not support VPN backup function Backup Mode This filed displays the profile name saved in VPN TRUNK Management with Index number and VPN S...

Page 324: ...tus VPN Display the name of the VPN profile Type Display the VPN connection mode such as PPTP or IPSec Remote IP Display the IP address of remote peer Virtual Network Display the remote network IP address with subnet address Tx Pkts Display the transmission packets passing through such VPN channel Tx Rate Display the transmission rate for data through such VPN tunnel Rx Pkts Display the receiving ...

Page 325: ...henticate the peer with certificates issued by those trusted CA servers Here you can manage generate and manage the local digital certificates and set trusted CA certificates Remember to adjust the time of Vigor router before using the certificate so that you can get the correct valid period of certificate Below shows the menu items for Certificate Management 4 4 1 12 2 1 1 L Lo oc ca al l C Ce er...

Page 326: ...ow request such as certifcate name used for identifying different certificate subject alternative name type and relational settings for subject name Then click GENERATE again Note Please be noted that Common Name must be configured with rotuer s WAN IP or domain name After clicking GENERATE the generated information will be displayed on the window below ...

Page 327: ...ate with a private key Click this button to import a saved file as the certification information REFRESH Click this button to refresh the information listed below View Click this button to view the detailed settings for certificate request Note You have to copy the certificate request information from above window Next access your CA server and enter the page of certificate request copy the inform...

Page 328: ...lick IMPORT to open the following window Use Browse to find out the saved text file Then click Import The one you imported will be listed on the Trusted CA Certificate window Then click Import to use the pre saved file For viewing each trusted CA certificate click View to open the certificate detail information window If you want to delete a CA certificate choose the one and click Delete to remove...

Page 329: ...ed SIP is an end to end signaling protocol that establishes user presence and mobility in VoIP structure Every one who wants to talk using his her SIP Uniform Resource Identifier SIP Address The standard format of SIP URI is sip user password host port Some fields may be optional in different use In general host refers to a domain The userinfo includes the user field the password field and the sig...

Page 330: ...ead of that you will only have to using dial plan or directly dial your friend s account name if you are with the same SIP Registrar Peer to Peer Before calling you have to know your friend s IP Address The Vigor VoIP Routers will build connection between each other Our Vigor V models firstly apply efficient codecs designed to make the best use of available bandwidth but Vigor V models also equip ...

Page 331: ...ablished vigor router A will send SAS voice prompt to A and vigor router B will send the SAS voice prompt to B 2 Then the RTP traffic is secured until the call ends 3 If vigor router A wants to call vigor router B again next time both A and B will not hear any voice prompt again even checking Enable SAS Voice Prompt on web UI It means only the first call between them will have voice prompt Enable ...

Page 332: ...mbers SIP addresses Loop through and Backup Phone Number will be displayed if you are using Vigor 2920V for setting the phone book Click any index number to display the dial plan setup page Available settings are explained as follows Item Description Enable Check it to enable this entry Phone Number The speed dial number of this index This can be any number you choose using digits 0 9 and Display ...

Page 333: ...ll will be changed from VoIP phone into PSTN call according to the loop through direction chosen Note that during the phone switch the blare of phone will appear for a short time And when the VoIP phone is switched into the PSTN phone the telecom co might charge you for the connection fee Please type in backup phone number PSTN number ISDN number for this VoIP phone setting Secure Phone ZRTP SRTP ...

Page 334: ...the OP number will be added with the prefix number for calling out through the specific VoIP interface Strip When you choose this mode the OP number will be deleted by the prefix number for calling out through the specific VoIP interface Take the above picture Prefix Table Setup web page as an example the OP number of 886 will be deleted completely for the prefix number is set with 886 Replace Whe...

Page 335: ...hat number can apply the prefix number settings here Max Len Set the maximum length of the dial number for applying the prefix number settings Route Choose the one that you want to enable the prefix number settings from the saved SIP accounts Please set up one SIP account first to make this interface available This item will be changed according to the port settings configured in VoIP Phone Settin...

Page 336: ...ry is enabled or not Block Anonymous Block the incoming calls without caller ID on the interface Block Unknown Domain Block incoming calls through Phone port from unrecognized domain that is not specified in SIP accounts Block IP Address Block incoming calls through Phone port coming from IP address Simply click any index number to display the dial plan setup page Available settings are explained ...

Page 337: ...as Block Anonymous Block Unknown Domain or Block IP Address Simply click the relational links to open the web page For Block Anonymous this function can block the incoming calls without caller ID on the interface Phone port specified in the following window Such control also can be done based on preconfigured schedules For Block Unknown Domain this function can block incoming calls through Phone p...

Page 338: ...em Description Enable Regional Check this box to enable this function Last Call Return Miss Sometimes people might miss some phone calls Please dial number typed in this field to know where the last phone call comes from and call back to that one Last Call Return In You have finished an incoming phone call however you want to call back again for some reason Please dial number typed in this field t...

Page 339: ...hone number ID not displayed on the display panel of remote end Hide caller ID Deact Dial the number typed in this field to release this function Call Waiting Act Dial the number typed in this field to make all the incoming calls waiting for your answer Call Waiting Deact Dial the number typed in this field to release this function Block Anonymous Act Dial the number typed in this field to block a...

Page 340: ...by using VoIP and can be called out through PSTN line only To solve this problem this page allows you to set five sets of PSTN number for dialing without passing through Internet Please type the number in the field of phone number for PSTN relay Then check the Enable box to make the PSTN number available for dial whenever you need ...

Page 341: ...lm After that your call will be bypassed by SIP Proxy to the destination using AccountName Domain Realm as identity Note Selection items for Ring Port will differ according to the router you have Available settings are explained as follows Item Description Index Click this link to access into next page for setting SIP account Profile Display the profile name of the account Domain Realm Display the...

Page 342: ... status for the corresponding SIP account R means such account is registered on SIP server successfully means the account is failed to register on SIP server STUN Server Type in the IP address or domain of the STUN server External IP Type in the gateway IP address SIP PING interval The default value is 150 sec It is useful for a Nortel server NAT Traversal Support Available settings are explained ...

Page 343: ... draytel org 5065 Act as Outbound Proxy Check this box to make the proxy acting as outbound proxy Display Name The caller ID that you want to be displayed on your friend s screen Account Number Name Enter your account name of SIP Address e g every text before Authentication ID Check the box to invoke this function and Type the name or number used for SIP Authorization with SIP Registrar If this se...

Page 344: ...ut SIP URL Type in the SIP URL e g aaa draytel org or abc iptel org as the site for call forwarded Time Out Set the time out for the call forwarding The default setting is 30 sec Ring Port Set Phone 1 and or Phone 2 as the default ring port s for this SIP account Ring Pattern Choose a ring tone type for the VoIP phone call Prefer Codec Select one of five codecs as the default for your VoIP calls T...

Page 345: ...n ng gs s This page allows user to set phone settings for Phone 1 and Phone 2 respectively However it changes slightly according to different model you have Available settings are explained as follows Item Description Phone List Port there are two phone ports provided here for you to configure Phone1 Phone2 allows you to set general settings for PSTN phones Call Feature A brief description for cal...

Page 346: ...nction To make the data transmission going through on both ends of local router and remote router not misleading due to IP lost for example sending data from the public IP of remote router to the private IP of local router you can check this box to solve this problem Dynamic RTP Port Start Specifies the start port for RTP stream The default value is 10050 Dynamic RTP Port End Specifies the end por...

Page 347: ...de choose a mode for error correction DND Do Not Disturb mode Set a period of peace time without disturbing by VoIP phone call During the period the one who dial in will listen busy tone yet the local user will not listen any ring tone Index 1 15 in Schedule Type the index of schedule profiles to control when the phone will ring and when will not according to the preconfigured schedules Refer to s...

Page 348: ... for the local area of the router installed Wrong tone settings might cause inconvenience for users To set the sound pattern of the phone set simply choose a proper region to let the system find out the preset tone settings and caller ID type automatically Or you can adjust tone settings manually if you choose User Defined TOn1 TOff1 TOn2 and TOff2 mean the cadence of the tone pattern TOn1 and TOn...

Page 349: ... number is the louder the dial tone is It is recommended for you to use the default setting Ring Frequency This setting is used to drive the frequency of the ring tone It is recommended for you to use the default setting Call Waiting Tone Power Level This setting is used to adjust the loudness of the call waiting tone The smaller the number is the louder the tone is It is recommended for you to us...

Page 350: ...eceive This function is very useful when the network traffic congestion occurs and it still can remain the accuracy of DTMF tone SIP INFO Choose this one then the Vigor will capture the DTMF tone and transfer it into SIP form Then it will be sent to the remote end with SIP message Payload Type rfc2833 Choose a number from 96 to 127 the default value was 101 This setting is available for the OutBan...

Page 351: ... when the Refresh button is clicked Port It shows current connection status for Phone s and ISDN ports Status It shows the VoIP connection status IDLE Indicates that the VoIP function is idle HANG_UP Indicates that the connection is not established busy tone CONNECTING Indicates that the user is calling out WAIT_ANS Indicates that a connection is launched and waiting for remote user s answer ALERT...

Page 352: ...The Vigor n model a k a Vigor wireless router is designed for maximum flexibility and efficiency of a small office home Any authorized staff can bring a built in WLAN client PDA or notebook into a meeting room for conference without laying a clot of LAN cable or drilling holes everywhere Wireless LAN enables high mobility so WLAN users can simultaneously access all LAN facilities just like on a wi...

Page 353: ...nism in industry is separated into two categories WPA personal or called WPA Pre Share Key WPA PSK and WPA Enterprise or called WPA 802 1x In WPA Personal a pre defined key is used for encryption during data transmission WPA applies Temporal Key Integrity Protocol TKIP for data encryption while WPA2 applies AES The WPA Enterprise combines not only encryption but also authentication Since WEP has b...

Page 354: ...s of their connection Below shows the menu items for Wireless LAN 4 4 1 14 4 2 2 G Ge en ne er ra al l S Se et tu up p By clicking the General Settings a new web page will appear so that you could configure the SSID and the wireless channel Please refer to the following figure for more information Available settings are explained as follows Item Description Enable Wireless LAN Check the box to ena...

Page 355: ...ee the information except SSID or just cannot see any thing about Vigor wireless router while site surveying The system allows you to set four sets of SSID for different usage In default the first set of SSID will be enabled You can hide it for your necessity SSID Means the identification of the wireless LAN SSID can be any text numbers or various special characters The default SSID is DrayTek We ...

Page 356: ...figuring the correct settings please click OK to save and invoke it The default security mode is Mixed WPA WPA2 PSK Default Pre Shared Key PSK is provided and stated on the label pasted on the bottom of the router For the wireless client who wants to access into Internet through such router please input the default PSK value for connection By clicking the Security Settings a new web page will appe...

Page 357: ...rver with 802 1X protocol Mixed WPA WPA2 802 1x only Accepts WPA and WPA2 clients simultaneously and the encryption key is obtained dynamically from RADIUS server with 802 1X protocol WPA PSK Accepts only WPA clients and the encryption key should be entered in PSK WPA2 PSK Accepts only WPA2 clients and the encryption key should be entered in PSK Mixed WPA WPA2 PSK Accepts WPA and WPA2 clients simu...

Page 358: ...ntered in ASCII or Hexadecimal Check the key you wish to use 4 4 1 14 4 4 4 A Ac cc ce es ss s C Co on nt tr ro ol l For additional security of wireless access the Access Control facility allows you to restrict the network access right by controlling the wireless LAN MAC address of client Only the valid MAC address that has been configured can access the wireless LAN interface By clicking the Acce...

Page 359: ...s control set up OK Click it to save the access control list Clear All Clean all entries in the MAC address list 4 4 1 14 4 5 5 W WP PS S WPS Wi Fi Protected Setup provides easy procedure to make network connection between wireless station and wireless access point vigor router with the encryption of WPA and WPA2 Note Such function is available for the wireless station with WPS supported It is the...

Page 360: ...eless client Then provide the PIN code of the wireless client you wish to connect to the vigor router For WPS is supported in WPA PSK or WPA2 PSK mode if you do not choose such mode in Wireless LAN Security you will see the following message box Please click OK and go back Wireless LAN Security to choose WPA PSK or WPA2 PSK mode and access WPS again Below shows Wireless LAN WPS web page ...

Page 361: ...nly WPA2 PSK and WPA PSK support WPS Configure via Push Button Click Start PBC to invoke Push Button style WPS setup procedure The router will wait for WPS requests from wireless clients about two minutes The WPS LED on the router will blink fast when WPS is in progress It will return to normal condition after two minutes You need to setup WPS within two minutes Configure via Client PinCode Please...

Page 362: ...ually it can be used for the following application Provide bridge traffic between two LANs through the air Extend the coverage range of a WLAN To meet the above requirement two WDS modes are implemented in Vigor router One is Bridge the other is Repeater Below shows the function of WDS bridge interface The application for the WDS Repeater mode is depicted as below ...

Page 363: ...from a WDS link will only be forwarded to local wired or wireless hosts In other words only Repeater mode can do WDS to WDS packet forwarding In the following examples hosts connected to Bridge 1 or 3 can communicate with hosts connected to Bridge 2 through WDS links However hosts connected to Bridge 1 CANNOT communicate with hosts connected to Bridge 3 through Bridge 2 Click WDS from Wireless LAN...

Page 364: ...lish your WDS system between AP and the router Key Type 8 63 ASCII characters or 64 hexadecimal digits leading by 0x Bridge If you choose Bridge as the connecting mode please type in the peer MAC address in these fields Four peer MAC addresses are allowed to be entered in this page at one time Yet please disable the unused link to get better performance If you want to invoke the peer MAC address r...

Page 365: ...and receiving between the AP and the stations 20 40 the router will use 20Mhz or 40Mhz for data transmission and receiving according to the station capability Such channel can increase the performance for data transit Guard Interval It is to assure the safety of propagation delays and reflections for the sensitive digital data If you choose auto as guard interval the AP router will choose short gu...

Page 366: ...is the wireless client must support this feature and invoke the function too Note Vigor N61 wireless adapter supports this function Therefore you can use and install it into your PC for matching with Packet OVERDRIVE refer to the following picture of Vigor N61 wireless utility window choose Enable for TxBURST on the tab of Option Note means the real transmission rate depends on the environment of ...

Page 367: ...ined as follows Item Description WMM Capable To apply WMM parameters for wireless data transmission please click the Enable radio button APSD Capable The default setting is Disable Aifsn It controls how long the client waits for each data transmission Please specify the value ranging from 1 to 15 Such parameter will influence the time delay for WMM accessing categories For the service of voice or ...

Page 368: ...he box means the AP router will answer the response request while transmitting WMM packets through wireless connection It can assure that the peer must receive the WMM packets Check the box means the AP router will not answer any response request for the transmitting packets It will have better performance with lower reliability 4 4 1 14 4 9 9 A AP P D Di is sc co ov ve er ry y Vigor router can sc...

Page 369: ... shown on the box above this button Statistics It displays the statistics for the channels used by APs Add to If you want the found AP applying the WDS settings please type in the AP s MAC address on the bottom of the page and click Bridge or Repeater Next click Add to Later the MAC address of the AP will be added to Bridge or Repeater field of WDS settings page ...

Page 370: ... with its status code There is a code summary below for explanation For convenient Access Control you can select a WLAN station and click Add to Access Control below Available settings are explained as follows Item Description Refresh Click this button to refresh the status of station list Add Click this button to add current typed MAC address into Access Control ...

Page 371: ... 30 000 kbps All the wireless stations share the bandwidth for uploading without exceeding the valued typed here Total Download Limit Default value is 30 000 kbps All the wireless stations share the bandwidth for downloading without exceeding the valued typed here Per Station Limit If you choose Per Station Limit the router will offer the bandwidth for each wireless station based on the values con...

Page 372: ...r ra al l S Se et tt ti in ng gs s This page will determine the number of concurrent FTP connection default charset for FTP server and enable Samba service At present the Vigor router can support USB storage disk with formats of FAT16 and FAT32 only Therefore before connecting the USB storage disk into the Vigor router please make sure the memory format for the USB storage disk is FAT16 or FAT32 I...

Page 373: ... name must not be the same as the host name The workgroup name can have as many as 15 characters and the host name can have as many as 23 characters Both them cannot contain any of the following Workgroup Name Type a name for the workgroup Host Name Type the host name for the router After finishing all the settings here please click OK to save the configuration 4 4 1 15 5 2 2 U US SB B U Us se er ...

Page 374: ...e disk Be aware that users cannot access into USB storage disk in anonymity Later you can open FTP client software and type the username specified here for accessing into USB storage disk Note Admin could not be typed here as username for the word is specified for accessing into web pages of Vigor router only Also it is reserved for FTP firmware upgrade usage Note FTP Passive mode is not supported...

Page 375: ...the Home Folder Access Rule It determines the authority for such profile Any user who uses such profile for accessing into USB storage disk must follow the rule specified here File Check the items Read Write and Delete for such profile Directory Check the items List Create and Remove for such profile Before you click OK you have to insert a USB storage disk into the USB interface of the Vigor rout...

Page 376: ...emove the storage disk from USB port in router please click Disconnect USB Disk first And then remove the USB storage disk later Each item is explained as follows Item Description Connection Status If there is no USB storage disk connected to Vigor router No Disk Connected will be shown here Disk Capacity Display the total capacity of the USB storage disk Free Capacity Display the free space of th...

Page 377: ...er 4 4 1 16 6 S Sy ys st te em m M Ma ai in nt te en na an nc ce e For the system setup there are several items that you have to know the way of configuration System Status HTTPS Encryption Setup TR 069 Administrator Password User Password Login Page Greeting Configuration Backup Syslog Mail Alert Time and Date SNMP Management Reboot System Firmware Upgrade and Activation Below shows the menu item...

Page 378: ...ollows Item Description Model Name Display the model name of the router Firmware Version Display the firmware version of the router Build Date Time Display the date and time of the current firmware build LAN MAC Address Display the MAC address of the LAN Interface IP Address Display the IP address of the LAN interface Subnet Mask Display the subnet mask address of the LAN interface DHCP Server Dis...

Page 379: ...erface Connection Display the connection type IP Address Display the IP address of the WAN interface Default Gateway Display the assigned IP address of the default gateway IPv6 Address Display the IPv6 address for LAN Scope Display the scope of IPv6 address For example IPv6 Link Local could only be used for direct IPv6 link It can t be used for IPv6 internet Internet Access Mode Display the connec...

Page 380: ... a TR 069 device through an Auto Configuration Server e g VigorACS Available parameters are explained as follows Item Description ACS Server On Choose the interface for the router connecting to ACS server ACS Server URL Username Password Such data must be typed according to the ACS Auto Configuration Server you want to link Please refer to Auto Configuration Server user s manual for detailed infor...

Page 381: ...Server Port Type the port number of the STUN server Minimum Keep Alive Period If STUN is enabled the CPE must send binding request to the server for the purpose of maintaining the binding in the Gateway Please type a number as the minimum period The default setting is 60 seconds Maximum Keep Alive Period If STUN is enabled the CPE must send binding request to the server for the purpose of maintain...

Page 382: ...ord again Administrator Local User The administrator can login web user interface of Vigor router to modify all of the settings to fit the requirements This feature allows other user in LAN who can access into the web user interface with the same privilege of the administrator Local User Check the box to enable the local user configuration Local User List It displays the username of the local user...

Page 383: ...name and modify it on the field of User Name Later click Edit to update the information Delete If the local user listed on the box above is not satisfied simply click the username and click Delete to remove it Administrator LDAP Setting Enable LDAP AD login for Admin users If it is enabled any user can access into the web user interface of Vigor router through the LDAP server authentication LDAP S...

Page 384: ...box to enable user mode operation If you do not check this box you cannot access into the user mode operation even if you enter user password in login page Password Type in new password in this field Confirm Password Type in the new password again When you click OK the login window will appear Please use the new password to access into the web user interface again Below shows an example for access...

Page 385: ...l appear Simply click OK 4 Log out Vigor router Web user interface 5 The following window will be open to ask for username and password Type the new user password in the filed of Password and click Login 6 The main screen with User Mode will be shown as follows ...

Page 386: ... Admin Mode 4 4 1 16 6 6 6 L Lo og gi in n P Pa ag ge e G Gr re ee et ti in ng g When you want to access into the web user interface of Vigor router the system will ask you to offer username and password first At that moment the background of the web page is blank and no heading will be displayed on the Login window This page allows you to specify background message and the heading on the Login wi...

Page 387: ... at the bottom Note that do not type URL redirect link here Preview Click it to display the preview of the login window based on the settings on this web page Set to Factory Default Click to return to the factory default setting Below shows an example of login customization with the information typed in Login Description and Bulletin 4 4 1 16 6 7 7 C Co on nf fi ig gu ur ra at ti io on n B Ba ac c...

Page 388: ...e it another name by yourself 4 Click Save button the configuration will download automatically to your computer as a file named config cfg The above example is using Windows platform for demonstrating examples The Mac or Linux platform will appear different windows but the backup function is still available Note Backup for Certification must be done independently The Configuration Backup does not...

Page 389: ...er 3 Click Restore button and wait for few seconds the following picture will tell you that the restoration procedure is successful 4 4 1 16 6 8 8 S Sy ys sl lo og g M Ma ai il l A Al le er rt t SysLog function is provided for users to monitor router There is no bother to directly get into the Web user interface of the router or borrow debug equipments Available parameters are explained as follows...

Page 390: ... is 514 Mail Alert Setup Check Enable to activate function of mail alert Send a test e mail Make a simple test for the e mail address specified in this page Please assign the mail address first and click this button to execute a test for verify the mail address is available or not SMTP Server The IP address of the SMTP server Mail To Assign a mail address for sending mails out Return Path Assign a...

Page 391: ...81 3 From the Syslog screen select the router you want to monitor Be reminded that in Network Information select the network adapter used to connect to the router Otherwise you won t succeed in retrieving information from the router ...

Page 392: ...rom the remote administrator PC host as router s system time Use Internet Time Select to inquire time information from Time Server on the Internet using assigned protocol Time Protocol Select a time protocol Server IP Address Type the IP address of the time server Time Zone Select the time zone where the router is located Enable Daylight Saving Check the box to enable the daylight saving Such feat...

Page 393: ...secure than SNMP through the encryption method support AES and DES and authentication method support MD5 and SHA for the management needs Available settings are explained as follows Item Description Enable SNMP Agent Check it to enable this function Get Community Set the name for getting community by typing a proper character The default setting is public ...

Page 394: ...IP IPv4 Set the IPv4 address of the host that will receive the trap community Notification Host IP IPv6 Set the IPv6 address of the host that will receive the trap community Trap Timeout The default setting is 10 seconds Enable SNMPV3 Agent Check it to enable this function USM User USM means user based security mode Type a username which will be used for authentication Auth Algorithm Choose one of...

Page 395: ...ss List from the Internet Management Port Setup and External Device Control The management pages for IPv4 and IPv6 protocols are different F Fo or r I IP Pv v4 4 Available parameters are explained as follows Item Description Router Name Type in the router name provided by ISP Default Disable Auto Logout The web user interface will not log out if it is enabled ...

Page 396: ... from Internet Check the box es to specify Apply To Choose the subnet s for the administrator to access Access List from the Internet You could specify that the system administrator can only login from a specific host or network defined in the list A maximum of three IPs subnet masks is allowed List IP Indicate an IP address allowed to login to the router Subnet Mask Represent a subnet mask allowe...

Page 397: ...nternet Check the box es to specify Enable PING from the Internet Check the checkbox to enable all PING packets from the Internet For security issue this function is disabled by default Access List You could specify that the system administrator can only login from a specific host or network defined in the list A maximum of three IPs subnet masks is allowed IPv6 Address Prefix Length Indicate the ...

Page 398: ...le web page and you can use the number that you have set in that web page If you want to reboot the router using the current configuration check Using current configuration and click Reboot Now To reset the router settings to default values check Using factory default configuration and click Reboot Now The router will take several seconds to reboot the system Note When the system pops up Reboot Sy...

Page 399: ...ew released firmware offered for your Vigor router to have newest features If yes download the file into your computer first Next access into web interface of this router and open System Maintenance Firmware Upgrade In the following web page click Browse to locate file downloaded from DrayTek web site Then click the Upgrade button to perform the firmware upgrade operation ...

Page 400: ... Click System Maintenance Activation to open the following page for accessing http myvigor draytek com Note that such service mechanism is powered by Commtouch Available parameters are explained as follows Item Description Activate via Interface Choose WAN interface used by such device for activating Web Content Filter Activate The Activate link brings you accessing into www vigorpro com to finish...

Page 401: ...elow shows the successful activation of Web Content Filter 4 4 1 17 7 D Di ia ag gn no os st ti ic cs s Diagnostic Tools provide a useful way to view or diagnose the status of your Vigor router Below shows the menu items for Diagnostics ...

Page 402: ...out Triggering to open the web page The internet connection e g PPPoE is triggered by a package sending from the source IP address Each item is explained as follows Item Description Decoded Format It shows the source IP address local destination IP remote address the protocol and length of the package Refresh Click it to reload the page ...

Page 403: ...er s Guide 393 4 4 1 17 7 2 2 R Ro ou ut ti in ng g T Ta ab bl le e Click Diagnostics and click Routing Table to open the web page or Each item is explained as follows Item Description Refresh Click it to reload the page ...

Page 404: ...xplained as follows Item Description Clear Click it to clear the whole table Refresh Click it to reload the page 4 4 1 17 7 4 4 I IP Pv v6 6 N Ne ei ig gh hb bo ou ur r T Ta ab bl le e The table shows a mapping between an Ethernet hardware address MAC Address and an IPv6 address This information is helpful in diagnosing network problems such as IP address conflicts etc Click Diagnostics and click ...

Page 405: ...Table to open the web page or Available settings are explained as follows Item Description Index It displays the connection item number IP Address It displays the IP address assigned by this router for specified PC MAC Address It displays the MAC address for the specified PC that DHCP assigned IP address for it Leased Time It displays the leased time of the specified PC HOST ID It displays the hos...

Page 406: ...h item is explained as follows Item Description Private IP Port It indicates the source IP address and port of local PC Pseudo Port It indicates the temporary port of the router used for NAT Peer IP Port It indicates the destination IP address and port of remote host Interface It displays the representing number for different interface Refresh Click it to reload the page ...

Page 407: ...nd IP session limit before invoke Data Flow Monitor If not a notification dialog box will appear to remind you enabling it Click Diagnostics and click Data Flow Monitor to open the web page You can click IP Address TX rate RX rate or Session link for arranging the data display Each item is explained as follows Item Description Enable Data Flow Monitor Check this box to enable this function Refresh...

Page 408: ...on number that you specified in Limit Session web page Action Block can prevent specified PC accessing into Internet within 5 minutes Unblock the device with the IP address will be blocked in five minutes The remaining time will be shown on the session column Current Peak Speed Current means current transmission rate and receiving rate for WAN interface Peak means the highest peak value detected b...

Page 409: ...g different traffic graph Click Refresh to renew the graph at any time or The horizontal axis represents time Yet the vertical axis has different meanings For WAN1 WAN2 WAN3 Bandwidth chart the numbers displayed on vertical axis represent the numbers of the transmitted and received packets in the past For Sessions chart the numbers displayed on vertical axis represent the numbers of the NAT sessio...

Page 410: ... and click Ping Diagnosis to pen the web page or Each item is explained as follows Item Description IPV4 IPV6 Choose the protocol for such function Ping through Use the drop down list to choose the WAN interface that you want to ping through or choose Unspecified to be determined by the router automatically ...

Page 411: ...ng Run Click this button to start the ping work The result will be displayed on the screen Clear Click this link to remove the result on the window 4 4 1 17 7 1 10 0 T Tr ra ac ce e R Ro ou ut te e Click Diagnostics and click Trace Route to open the web page This page allows you to trace the routes from router to the host Simply type the IP address of the host in the box and click Run The result o...

Page 412: ...route tracing work Clear Click this link to remove the result on the window 4 4 1 17 7 1 11 1 S Sy ys sl lo og g E Ex xp pl lo or re er r Such page provides real time syslog and displays the information on the screen F Fo or r W We eb b S Sy ys sl lo og g This page displays the time and message for User Firewall call WAN VPN settings You can check Enable Web Syslog specify the type of Syslog and c...

Page 413: ...newest events will be recorded by the system Time Display the time of the event occurred Message Display the information for each event F Fo or r U US SB B S Sy ys sl lo og g This page displays the syslog recorded on the USB storage disk Available parameters are explained as follows Item Description Time Display the time of the event occurred Log Type Display the type of the record Message Display...

Page 414: ... page could help you to diagnose the connection status of TSPC If TSPC has configured properly the router will display the following page when the user connects to tunnel broker successfully Available settings are explained as follows Item Description Refresh Click this link to refresh this page manually ...

Page 415: ...ernal Devices to make detailed configuration From this web page check the box of External Device Auto Discovery Later all the available devices will be displayed in this page with icons and corresponding information You can change the device name if required or remove the information for off line device whenever you want When you finished the configuration click OK to save it Note Only DrayTek pro...

Page 416: ...Vigor2920 Series User s Guide 406 This page is left blank ...

Page 417: ...ting if necessary If all above stages are done and the router still cannot run normally it is the time for you to contact your dealer for advanced help 5 5 1 1 C Ch he ec ck ki in ng g I If f t th he e H Ha ar rd dw wa ar re e S St ta at tu us s I Is s O OK K o or r N No ot t Follow the steps below to verify the hardware status 1 Check the power line and WLAN LAN cable connections Refer to 1 3 Har...

Page 418: ...stilled failed please do the steps listed below to make sure the network connection settings is OK F Fo or r W Wi in nd do ow ws s The example is based on Windows 7 Professional Edition As to the examples for other operation systems please refer to the similar steps or find support notes in www DrayTek com 1 Open All Programs Getting Started Control Panel Click Network and Sharing Center 2 In the ...

Page 419: ...or2920 Series User s Guide 409 4 Select Internet Protocol Version 4 TCP IP and then click Properties 5 Select Obtain an IP address automatically and Obtain DNS server address automatically Finally click OK ...

Page 420: ... router is 192 168 1 1 For some reason you might need to use ping command to check the link status of the router The most important thing is that the computer will receive a reply from 192 168 1 1 If not please check the IP address of your computer We suggest you setting the network connection as get IP automatically Please refer to the section 5 2 Please follow the steps below to ping the router ...

Page 421: ...check the IP address setting of your computer F Fo or r M Ma ac c O OS S T Te er rm mi in na al l 1 Double click on the current used Mac OS on the desktop 2 Open the Application folder and get into Utilities 3 Double click Terminal The Terminal window will appear 4 Type ping 192 168 1 1 and press Enter If the link is OK the line of 64 bytes from 192 168 1 1 icmp_seq 0 ttl 255 time xxxx ms will app...

Page 422: ...o of ff f You have to wait about 15 seconds after inserting 3G USB Modem into your Vigor2920 Later the USB LED will light on which means the installation of USB Modem is successful If the USB LED does not light on please remove and reinsert the modem again If it still fails restart Vigor2920 U US SB B L LE ED D l li ig gh ht ts s o on n b bu ut t t th he e n ne et tw wo or rk k c co on nn ne ec ct...

Page 423: ...y y D De ef fa au ul lt t S Se et tt ti in ng g I If f N Ne ec ce es ss sa ar ry y Sometimes a wrong connection can be improved by returning to the default settings Try to reset the router by software or hardware Warning After pressing factory default setting you will loose all settings you did before Make sure you have recorded all useful settings before you pressing S So of ft tw wa ar re e R Re...

Page 424: ... Then the router will restart with the default configuration After restore the factory default setting you can configure the settings for the router again to fit your personal request 5 5 7 7 C Co on nt ta ac ct ti in ng g Y Yo ou ur r D De ea al le er r If the router still cannot work correctly after trying many efforts please contact your dealer for further help right away For any questions plea...

Page 425: ... an isolate network but not a flexible way to maintain a growing network Because the idea of port based VLAN is grouping by physical ports but the difficulty is how to handle the traffics between two or more Ethernet switches Thus VLAN is suitable for some circumstances for example the rental apartment SOHO office and so on These clients may need two or three isolated networks only and setup a net...

Page 426: ... router Note Broadband router Vigor2920 Vigor3200 Vigor2925 Vigo2960 Vigor3900 Modem router Vigor2850 Vigor2860 V VL LA AN N P Pa ac ck ke et ts s o on n V Vi ig go or r r ro ou ut te er rs s Trunk mode of LAN Trunk Port can carry the packets with VID but replace the Non VID packet as the VID of Trunk port while forwarding the packets to another switch Bridge mode of WAN P1 and P2 are doing NAT fl...

Page 427: ...m is going to be introduced to you because it is the most stable and superfast booting system in DrayTek products If the UI style of yours is different from the following It may not DrayOS system with new web style or maybe the Linux like model WAN ...

Page 428: ...Vigor2920 Series User s Guide 418 LAN V VL LA AN N a ap pp pl li ic ca at ti io on ns s o on n V Vi ig go or r r ro ou ut te er r Multi Subnet VLAN of LAN ...

Page 429: ...rvers LAN1 LAN2 LAN3 LAN4 However the traffics of the LAN port or SSID that are NOT being grouped in the same VLAN are unable to forward to each other The benefit of Port based is able to extend the wired ports by installing a cheaper dumb switch as many as you need but Tag based offers you a flexible and well managed network The networks are isolated secured and reduce the broadcasting storm effe...

Page 430: ... which serves your guests the internet accessibility but the traffics have to be isolated from your private network due to the security considerations it can be done by above settings However a switch support VLAN function is need if VLAN Tag enabled Triple Play Multi WAN NAT mode with VLAN ...

Page 431: ...Vigor2920 Series User s Guide 421 Following settings the set top box STB is able to attach with any LAN port Video streaming which your ISP provided will be played on your monitor ...

Page 432: ...idge mode with VLAN Set top box STB or the other kinds of media devices are able to attach with Port4 or Port5 of LAN Those devices that attached with Port4 or Port5 are able to access the services network directly which your ISP provided ...

Page 433: ...nable disable DHCP relay IP address and Device hostname LAN Bind IP to MAC VPN Create Phase2 SA for each subnet IPSec VPN Netbios Naming Packets Pass Block Firewall IPv6 Group IPv6 Object SNMP and Diagnostics Ping Diagnosis Improved Support to block Tor tunnel ver 0 2 3 25 hotspot shield with ver 3 19 telnet protocol by using putty or pietty and LINE app in 3 5 1 36 for PC version and in 4 1 1 ver...

Page 434: ...e Brasilia GMT 03 00 Corrected SSH didn t work with Macintosh while it can work on Windows and Linux Corrected VigorACS SI couldn t show Network information when DNS Filter was enabled for Vigor2920 Corrected Some error on External Device Status page Corrected Remove Mhaha getMessenger IMUnitive Wablet from WebIM on CSM APP Enforcement Profile ...