Draytek Vigor2830 Series User Manual Download Page 472

Page: 472 / 472

Vigor2830 Series User’s Guide

460



Corrected: Router dropped all DNS packets with unknown type.



Corrected: Daylight Saving didn't work with time zone Brasilia (GMT -03:00).



Corrected: SSH didn't work with Macintosh, while it can work on Windows and Linux.



Corrected: VigorACS SI couldn't show Network information when DNS Filter was
enabled for Vigor2830.



Corrected: Some error on External Device Status page.



Corrected: Remove Mhaha, getMessenger, IMUnitive, Wablet from WebIM on
CSM>>APP Enforcement Profile.

Summary of Contents for Vigor2830 Series

Page 1: ......

Page 2: ...Vigor2830 Series User s Guide ii ...

Page 3: ...Vigor2830 Series User s Guide iii Vigor2830 Series ADSL2 Security Firewall User s Guide Version 2 3 Firmware Version V3 6 7 Date May 6 2014 ...

Page 4: ...ervation of the environment Warranty We warrant to the original end user purchaser that the router will be free from any defects in workmanship or materials for a period of two 2 years from the date of purchase from the dealer Please keep your purchase receipt in a safe place as it serves as proof of date of purchase During the warranty period and upon proof of purchase should the product have ind...

Page 5: ... FCC Rules These limits are designed to provide reasonable protection against harmful interference in a residential installation This equipment generates uses and can radiate radio frequency energy and if not installed and used in accordance with the instructions may cause harmful interference to radio communications However there is no guarantee that interference will not occur in a particular in...

Page 6: ...Vigor2830 Series User s Guide vi ...

Page 7: ...ical Connection 19 1 6 2 Virtual WAN 21 1 7 Saving Configuration 21 Quick Setup 23 2 1 Quick Start Wizard 23 2 1 1 For WAN1 ADSL 24 2 1 2 For WAN2 Ethernet 29 2 1 3 For WAN3 USB 38 2 2 Service Activation Wizard 40 2 3 VPN Client Wizard 44 2 4 VPN Server Wizard 50 2 5 Wireless Wizard 55 2 6 VoIP Wizard 58 2 7 Registering Vigor Router 59 Advanced Configuration 63 3 1 WAN 63 3 1 1 Basics of Internet ...

Page 8: ...0 3 7 1 IP Object 170 3 7 2 IP Group 173 3 7 3 IPv6 Object 175 3 7 4 IPv6 Group 177 3 7 5 Service Type Object 179 3 7 6 Service Type Group 181 3 7 7 Keyword Object 183 3 7 8 Keyword Group 185 3 7 9 File Extension Object 187 3 7 10 SMS Mail Service Object 189 3 7 11 Notification Object 194 3 8 CSM Profile 196 3 8 1 APP Enforcement Profile 197 3 8 2 URL Content Filter Profile 200 3 8 3 Web Content F...

Page 9: ... 14 2 General Setup 297 3 14 3 Security 299 3 14 4 Access Control 302 3 14 5 WPS 303 3 14 6 WDS 306 3 14 7 Advanced Setting 309 3 14 8 WMM Configuration 311 3 14 9 AP Discovery 312 3 14 10 Station List 314 3 14 11 Bandwidth Management 315 3 15 SSL VPN 316 3 15 1 General Setup 316 3 15 2 SSL Web Proxy 317 3 15 3 SSL Application 318 3 15 4 User Account 321 3 15 5 User Group 325 3 15 6 Online User St...

Page 10: ...Vigor Router 382 4 4 How to Send a Notification to Specified Phone Number via SMS Service in WAN Disconnection 385 4 5 Web Portal Log In Application for Wireless Client 389 4 6 How to Customize Your Login Page 393 4 7 Create a LAN to LAN Connection Between Remote Office and Headquarter 396 4 8 Create a Remote Dial in User Connection Between the Teleworker and Headquarter 404 4 9 QoS Setting Exampl...

Page 11: ...n Settings on Your Computer Is OK or Not 444 5 3 Pinging the Router from Your Computer 447 5 4 Checking If the ISP Settings are OK or Not 448 5 5 Problems for 3G Network Connection 448 5 6 Backing to Factory Default Setting If Necessary 449 5 7 Contacting DrayTek 450 Appendix I VLAN Applications on Vigor Router 451 Appendix II Release Note 459 ...

Page 12: ......

Page 13: ...ease CSM Content Security Management provides users control and management in IM Instant Messenger and P2P Peer to Peer more efficiency than before By the way DoS DDoS prevention and URL Web content filter strengthen the security outside and control inside Object based firewall is flexible and allows your network be safe In addition Vigor2830 series supports USB interface for connecting USB printe...

Page 14: ...t is enabled from Firewall General Setup On The router is ready to access Internet through DSL link DSL Blinking Slowly The DSL connection is ready Quickly The connection is tranning On The WAN2 connection is ready WAN2 Blinking It will blink while transmitting data On The DoS DDoS function is active DoS Blinking It will blink while an attack is detected VPN On The VPN tunnel is active QoS On The ...

Page 15: ...the ACT LED begins to blink rapidly than usual release the button Then the router will restart with the factory default configuration GigaLAN 1 4 Connecters for local networked devices DSL Connecter for accessing the Internet through ADSL2 2 WAN2 Giga Connecters for remote networked devices USB Connecter for a USB device for 3G USB Modem or printer PWR Connecter for a power adapter ON OFF Power Sw...

Page 16: ... condition after two minutes You need to setup WPS within 2 minutes On The router is ready to access Internet through DSL link DSL Blinking Slowly The DSL connection is ready Quickly The data is transmitting On The WAN2 connection is ready WAN2 Blinking It will blink while transmitting data On The DoS DDoS function is active DoS Blinking It will blink while an attack is detected VPN On The VPN tun...

Page 17: ...fault settings Usage Turn on the router ACT LED is blinking Press the hole and keep for more than 5 seconds When you see the ACT LED begins to blink rapidly than usual release the button Then the router will restart with the factory default configuration GigaLAN 1 4 Connecters for local network devices DSL Connecter for accessing the Internet through ADSL2 2 WAN2 Giga Connecters for remote network...

Page 18: ...rmal condition after two minutes You need to setup WPS within 2 minutes On The router is ready to access Internet through DSL link DSL Blinking Slowly The DSL connection is ready Quickly The connection is tranning On The WAN2 connection is ready WAN2 Blinking It will blink while transmitting data On A PSTN phone call comes in and out However when the phone call is disconnected the LED will be off ...

Page 19: ... Reset Restore the default settings Usage Turn on the router ACT LED is blinking Press the hole and keep for more than 5 seconds When you see the ACT LED begins to blink rapidly than usual release the button Then the router will restart with the factory default configuration Phone 1 2 Connecter for analog phone s Line Connector for PSTN life line GigaLAN 1 4 Connecters for local networked devices ...

Page 20: ... to one of the LAN ports of the router and the other end of the cable RJ 45 into the Ethernet port on your computer 3 Connect the telephone set with phone lines for using VoIP function For the model without phone ports skip this step 4 Connect one end of the power adapter to the router s power port on the rear panel and the other side into a wall outlet 5 Power on the device by pressing down the p...

Page 21: ...er can print documents via the router The example provided here is made based on Windows 7 For installation on other Windows systems please visit www DrayTek com Before using it please follow the steps below to configure settings for connected computers or wireless clients 1 Connect the printer with the router through USB parallel port 2 Open All Programs Getting Started Devices and Printers ...

Page 22: ... 10 3 Click Add a printer 4 A dialog will appear Click Add a local printer and click Next 5 In this dialog choose Create a new port In the field of Type of port use the drop down list to select Standard TCP IP Port Then click Next ...

Page 23: ... User s Guide 11 6 In the following dialog type 192 168 1 1 router s LAN IP in the field of Hostname or IP Address and type 192 168 1 1 as the Port name Then click Next 7 Click Standard and choose Generic Network Card ...

Page 24: ... your system will ask you to choose right name of the printer that you installed onto the router Such step can make correct driver loaded onto your PC When you finish the selection click Next 9 Type a name for the chosen printer Click Next ...

Page 25: ...Vigor2830 Series User s Guide 13 10 Choose Do not share this printer and click Next 11 Then in the following dialog click Finish ...

Page 26: ...Guide 14 12 The new printer has been added and displayed under Printers and Faxes Click the new printer icon and click Printer server properties 13 Edit the property of the new printer you have added by clicking Configure Port ...

Page 27: ...ol type p1 number 1 as Queue Name Then click OK Next please refer to the red rectangle for choosing the correct protocol and LPR name The printer can be used for printing now Most of the printers with different manufacturers are compatible with vigor router ...

Page 28: ...s ss si in ng g W We eb b P Pa ag ge e 1 Make sure your PC connects to the router correctly You may either simply set up your computer to get IP dynamically from the router or set up the IP address of the computer to be the same subnet as the default IP address of Vigor router 192 168 1 1 For the detailed information please refer to the later section Trouble Shooting of the guide 2 Open a web brow...

Page 29: ...he web configuration system will logout after 5 minutes without any operation Change the setting for your necessity 1 1 5 5 C Ch ha an ng gi in ng g P Pa as ss sw wo or rd d Please change the password for the original security of the router 1 Open a web browser on your PC and type http 192 168 1 1 A pop up window will open to ask for username and password 2 Please type admin admin as the Username ...

Page 30: ... Enter the login password the default is blank on the field of Old Password Type New Password Then click OK to continue 5 Now the password has been changed Next time use the new password to access the Web user interface for this router ...

Page 31: ...ys the physical connection status such as LAN connection status WAN connection status ADSL information and so on P Ph hy ys si ic ca al l C Co on nn ne ec ct ti io on n f fo or r I IP Pv v4 4 P Pr ro ot to oc co ol l P Ph hy ys si ic ca al l C Co on nn ne ec ct ti io on n f fo or r I IP Pv v6 6 P Pr ro ot to oc co ol l Detailed explanation for IPv4 is shown below ...

Page 32: ...e WAN interface GW IP Displays the IP address of the default gateway TX Packets Displays the total transmitted packets at the WAN interface TX Rate Displays the speed of transmitted octets at the WAN interface RX Packets Displays the total number of received packets at the WAN interface RX Rate Displays the speed of received octets at the WAN interface Detailed explanation for IPv6 is shown below ...

Page 33: ...ccessing Internet 1 1 6 6 2 2 V Vi ir rt tu ua al l W WA AN N Such page displays the virtual WAN connection information Virtual WAN are used by TR 069 management VoIP service and so on The field of Application will list the purpose of such WAN connection 1 1 7 7 S Sa av vi in ng g C Co on nf fi ig gu ur ra at ti io on n Each time you click OK on the web page for saving the configuration you can fi...

Page 34: ...Vigor2830 Series User s Guide 22 This page is left blank ...

Page 35: ... VPN server Wireless Wizard used for building wireless LAN connection VoIP Wizard used for establishing VoIP profile 2 2 1 1 Q Qu ui ic ck k S St ta ar rt t W Wi iz za ar rd d If your router can be under an environment with high speed NAT the configuration provide here can help you to deploy and use the router quickly The first screen of Quick Start Wizard is entering login password After typing t...

Page 36: ...P PP Po oA A PPPoE PPPoA PPPoE stands for Point to Point Protocol over Ethernet It relies on two widely accepted standards PPP and Ethernet It connects users through an Ethernet to the Internet with a common broadband medium such as a single DSL line wireless device or cable modem All the users over the Ethernet can share a common connection PPPoE is used for most of DSL modem users All local user...

Page 37: ...ted by the system automatically VCI Type in the value provided by ISP Protocol Encapsulation There are several modes offered for you to choose for WAN1 interface Fixed IP Click Yes to enable Fixed IP feature IP Address Type the IP address if Fixed IP is enabled Primary DNS Type in the primary IP address for the router Secondary DNS Type in secondary IP address for necessity in the future Back Clic...

Page 38: ...pe in the valid user name maximum 63 characters provided by the ISP in this field Password Type a valid password provided by the ISP Confirm Password Retype the password Back Click it to return to previous setting page Next Click it to get into the next setting page Cancel Click it to give up the quick start wizard 3 Please manually enter the Username Password provided by your ISP Then click Next ...

Page 39: ...ill be shown 5 Now you can enjoy surfing on the Internet 1 14 48 83 3 B Br ri id dg ge ed d I IP P 1 14 48 83 3 R Ro ou ut te ed d I IP P 1 Choose WAN1 as WAN Interface and click the Next button you will get the following page Choose 1483 Bridged IP 1483 Routed IP as the protocol Available settings are explained as follows Item Description ...

Page 40: ...ask Type the subnet mask Primary DNS Type in the primary IP address for the router Secondary DNS Type in secondary IP address for necessity in the future Back Click it to return to previous setting page Next Click it to get into the next setting page Cancel Click it to give up the quick start wizard 2 Please type in the IP address mask gateway information originally provided by your ISP Then click...

Page 41: ...PPPoE interface Then click Next for next step P PP PP Po oE E PPPoE stands for Point to Point Protocol over Ethernet It relies on two widely accepted standards PPP and Ethernet It connects users through an Ethernet to the Internet with a common broadband medium such as a single DSL line wireless device or cable modem All the users over the Ethernet can share a common connection PPPoE is used for m...

Page 42: ... click Next to continue Available settings are explained as follows Item Description User Name Type in the valid user name maximum 63 characters provided by the ISP in this field Password Type a valid password provided by the ISP Confirm Password Retype the password Back Click it to return to previous setting page Next Click it to get into the next setting page Cancel Click it to give up the quick...

Page 43: ...uch connection 4 Click Finish A page of Quick Start Wizard Setup OK will appear Then the system status of this protocol will be shown 5 Now you can enjoy surfing on the Internet P PP PT TP P L L2 2T TP P 1 Choose WAN2 as the WAN Interface and click the Next button The following page will be open for you to specify Internet Access Type ...

Page 44: ...ecify an IP address you have to type relational settings manually IP Address Type the IP address Subnet Mask Type the subnet mask Gateway Type the IP address of the gateway Primary DNS Type in the primary IP address for the router Second DNS Type in secondary IP address for necessity in the future PPTP Server L2TP Server Type the IP address of the server Back Click it to return to previous setting...

Page 45: ... Setup OK will appear Then the system status of this protocol will be shown 5 Now you can enjoy surfing on the Internet S St ta at ti ic c I IP P 1 Choose WAN2 as the WAN Interface and click the Next button The following page will be open for you to specify Internet Access Type ...

Page 46: ...AN IP Type the IP address Subnet Mask Type the subnet mask Gateway Type the IP address of gateway Primary DNS Type in the primary IP address for the router Secondary DNS Type in secondary IP address for necessity in the future Back Click it to return to previous setting page Next Click it to get into the next setting page Cancel Click it to give up the quick start wizard ...

Page 47: ...the IP address information originally provided by your ISP Then click Next for next step 4 Click Finish A page of Quick Start Wizard Setup OK will appear Then the system status of this protocol will be shown 5 Now you can enjoy surfing on the Internet ...

Page 48: ...as the Internet Access type Simply click Next to continue Available settings are explained as follows Item Description Host Name Type the name of the host MAC Some Cable service providers specify a specific MAC address for access authentication In such cases you need to enter the MAC address Back Click it to return to previous setting page Next Click it to get into the next setting page ...

Page 49: ...uick start wizard 3 After finished the settings above click Next for viewing summary of such connection 4 Click Finish A page of Quick Start Wizard Setup OK will appear Then the system status of this protocol will be shown 5 Now you can enjoy surfing on the Internet ...

Page 50: ...n Available settings are explained as follows Item Description Internet Access Choose one of the selections as the protocol of accessing the internet 3G 4G USB Modem PPP mode SIM Pin code Type PIN code of the SIM card that will be used to access Internet The maximum length of the pin code you can set is 15 characters Modem Initial String Such value is used to initialize USB modem Please use the de...

Page 51: ... access Internet Network Mode Force Vigor router to connect Internet with the mode specified here If you choose 4G 3G 2G as network mode the router will choose a suitable one according to the actual wireless signal automatically APN Name APN means Access Point Name which is provided and required by some ISPs 3 Then click Next for viewing summary of such connection 4 Click Finish A page of Quick St...

Page 52: ...sing into the server MyVigor located on http myvigor draytek com For using Web Content Filter Profile please refer to later section Web Content Filter Profile for detailed information Now follow the steps listed below to activate WCF feature for your router 1 Open Service Activation Wizard 2 The screen of Service Activation Wizard will be shown as follows Choose the one you need and click Next In ...

Page 53: ...can purchase DrayTek s prepared Commtouch GlobalView WCF package from retailing outlets BPjM is WCF for German Speaking users The fragfINN is whitelist for German Speaking users The BPjM is ideal for your family to provide more Internet security for youngsters The fragFINN is designed for protecting kids from inadequate web sites More info is available at http www draytek de jugendschutz 4 Setting...

Page 54: ...r your necessity Then click Finish Note The service will be activated and applied as the default rule configured in Firewall General Setup 6 Now the web page will display the service that you have activated according to your selection s The valid time for the free trial of these services is one month ...

Page 55: ...e 43 Later if you need to extend the license valid time for the same service you can also use the Service Activation Wizard again to reach your goal by clicking the radio button of Formal edition with license key and clicking Next ...

Page 56: ...er to client step by step 1 Open VPN and Remote Access VPN Client Wizard The following page will appear Available settings are explained as follows Item Description LAN to LAN Client Mode Selection Choose the client mode Route Mode NAT Mode If the remote network only allows you to dial in with single IP please choose this mode otherwise please choose Route Mode Please choose a LAN to LAN Profile T...

Page 57: ...lowing page In this page you have to select suitable VPN type for the VPN client profile There are six types provided here Different type will lead to different configuration page After making the choices for the client profile please click Next You will see different configurations based on the selection s you made ...

Page 58: ...Vigor2830 Series User s Guide 46 When you choose PPTP None Encryption or PPTP Encryption you will see the following graphic When you choose IPSec you will see the following graphic ...

Page 59: ...ollowing graphic When you choose L2TP over IPSec Nice to Have or L2TP over IPSec Must you will see the following graphic Available settings are explained as follows Item Description Profile Name Type a name for such profile The length of the file is limited to 10 characters ...

Page 60: ...KE Authentication Method usually applies to those are remote dial in user or node LAN to LAN which uses dynamic IP address and IPSec related VPN connections such as L2TP over IPSec and IPSec tunnel Pre Shared Key Specify a key for IKE authentication Confirm Pre Shared Key Confirm the pre shared key Digital Signature X 509 Click Digital Signature to invoke this function Use the drop down list to ch...

Page 61: ...ilding VPN connection 3 After finishing the configuration please click Next The confirmation page will be shown as follows If there is no problem you can click one of the radio buttons listed on the page and click Finish to execute the next action Available settings are explained as follows Item Description Go to the VPN Connection Management Click this radio button to access VPN and Remote Access...

Page 62: ... step 1 Open VPN and Remote Access VPN Server Wizard The following page will appear Available settings are explained as follows Item Description VPN Server Mode Selection Choose the direction for the VPN server Site to Site VPN To set a LAN to LAN profile automatically please choose Site to Site VPN Remote Dial in User You can manage remote access by maintaining a table of remote user profile so t...

Page 63: ...choose any one of dial in user account profiles Next you have to select suitable dial in type for the VPN server profile There are several types provided here similar to VPN Client Wizard Different Dial in Type will lead to different configuration page In addition adjustable items for each dial in type will be changed according to the VPN Server Mode Site to Site VPN and Remote Dial in User select...

Page 64: ...ies User s Guide 52 When you check PPTP you will see the following graphic When you check PPTP IPSec L2TP three types or PPTP IPSec two types or L2TP with Policy Nice to Have Must you will see the following graphic ...

Page 65: ... Confirm Pre Shared Key Type the pre shared key again for confirmation Digital Signature X 509 Check the box of Digital Signature to invoke this function Use the drop down list to choose one of the certificates for using You have to configure one certificate at least previously in Certificate Management Local Certificate Otherwise the setting you choose here will not be effective Peer IP VPN Clien...

Page 66: ...ailable settings are explained as follows Item Description Go to the VPN Connection Management Click this radio button to access VPN and Remote Access Connection Management for viewing VPN Connection status Do another VPN Server Wizard Setup Click this radio button to set another profile of VPN Server through VPN Server Wizard View more detailed configuration Click this radio button to access VPN ...

Page 67: ...r n model only Follow the steps listed below 1 Open Wireless Wizard 2 The screen of wireless wizard will be shown as follows This page will be used for internal users in a company or your home Available settings are explained as follows Item Description Name Type the SSID name of this router The default name is defined with DrayTek Mode At present the router can connect to 11n Only 11g Only Mixed ...

Page 68: ...anually in this field below or automatically negotiated via 802 1x authentication Either 8 63 ASCII characters such as 012345678 or 64 Hexadecimal digits leading by 0x such as 0x321253abcde Next Click it to get into the next setting page Cancel Exit the wireless wizard without saving any changes 3 After typing the required information click Next The settings in the page limit the wireless station ...

Page 69: ...h as 0x321253abcde Rate Control It controls the data transmission rate through wireless connection Upload Check Enable and type the transmitting rate for data upload Default value is 30 000 kbps Download Type the transmitting rate for data download Default value is 30 000 kbps Next Click it to get into the next setting page Cancel Exit the wireless wizard without saving any changes 4 After typing ...

Page 70: ... Description Set VoIP service provider domain VoIP service provider Use the drop down list to choose the ISP which offers the VoIP service for your router SIP Port Use the default setting 5060 Set Account quickly Account Number Name Type the account number name registered to your ISP Password Type the password for the account registered to your ISP Use the same Account as phone 1 If you don t need...

Page 71: ...ou ut te er r You have finished the configuration of Quick Start Wizard and you can surf the Internet at any time Now it is the time to register your Vigor router to MyVigor website for getting more service Please follow the steps below to finish the router registration 1 Please login the web configuration interface of Vigor router by typing admin admin as User Name Password 2 Click Support Area P...

Page 72: ...en Please type the account and password that you created previously And click Login If not please refer to section 4 13 Creating an Account for MyVigor 4 The following page will be displayed after you logging in MyVigor From this page please click Add or Product Registration ...

Page 73: ...pears when you click on the box of Registration Date After adding the basic information for the router please click Submit 6 When the following page appears your router information has been added to the database 7 Now you have finished the product registration 8 After clicking OK you will see the following page Your router has been registered to myvigor website successfully ...

Page 74: ...Vigor2830 Series User s Guide 62 This page is left blank ...

Page 75: ...s s o of f I In nt te er rn ne et t P Pr ro ot to oc co ol l I IP P N Ne et tw wo or rk k IP means Internet Protocol Every device in an IP based Network including routers print server and host PCs needs an IP address to identify its location on the network To avoid address conflicts IP addresses are publicly registered with the Network Information Centre NIC Having a unique IP address is mandatory...

Page 76: ...When a router begins to connect to your ISP a serial of discovery process will occur to ask for a connection Then a session will be created Your user ID and password is authenticated via PAP or CHAP with RADIUS authentication system And your IP address DNS server and other related information will usually be assigned by your ISP N Ne et tw wo or rk k C Co on nn ne ec ct ti io on n b by y 3 3G G 4 ...

Page 77: ...on problem occurred on one of the ISP connections all the traffic will be guided and switched to the normal communication port for proper operation Please configure WAN1 WAN2 and WAN3 settings This webpage allows you to set general setup for WAN1 WAN2 and WAN3 respectively Available settings are explained as follows Item Description Load Balance Mode This option is available for multiple WAN for g...

Page 78: ...ixed with physical mode of ADSL Available settings are explained as follows Item Description Enable Choose Yes to invoke the settings for this WAN interface Choose No to disable the settings for this WAN interface Display Name Type the description for such WAN interface Physical Mode Display the physical mode of such WAN interface Physical Type In such WAN interface no type can be selected Line Sp...

Page 79: ...uto load balance function for such WAN interface When the data traffic is large the WAN interface with the function enabled will balance the data transmission automatically among all of the WAN interfaces in connection status Backup Type If you choose Backup as the Active Mode Backup WAN will be changed into Backup Type You have to specify which role the WAN interface should play if you want to ba...

Page 80: ...terface Physical type You can change the physical type for WAN2 or choose Auto negotiation for determined by the system Line Speed If your choose According to Line Speed as the Load Balance Mode please type the line speed for downloading and uploading for such WAN interface The unit is kbps VLAN Tag insertion Enable Enable the function of VLAN with tag The router will add specific VLAN number to a...

Page 81: ...ically among all of the WAN interfaces in connection status Backup Type If you choose Backup as the Active Mode Backup WAN will be changed into Backup Type You have to specify which role the WAN interface should play if you want to backup multiple WANs However ignore this setting if you want to backup a single WAN When any of selected WAN disconnect Such backup WAN will be activated when any maste...

Page 82: ...the physical mode of such WAN interface Physical type In such WAN interface no type can be selected Line Speed If your choose According to Line Speed as the Load Balance Mode please type the line speed for downloading and uploading for such WAN interface The unit is kbps Active Mode Choose Always On to make such WAN connection being activated always Load Balance Check this box to enable auto load ...

Page 83: ...ivated when any master WAN interface disconnects When all of selected WAN disconnect Such backup WAN will be activated only when all master WAN interfaces disconnect After finishing all the settings here please click OK to save the configuration 3 3 1 1 3 3 I In nt te er rn ne et t A Ac cc ce es ss s For the router supports multi WAN function the users can set different WAN settings for WAN1 WAN2 ...

Page 84: ...ils page of that mode will be popped up If not click Details Page for accessing the page to configure the settings Details Page This button will open different web page according to the access mode that you choose in WAN interface IPv6 This button will open different web page based on Physical Mode to setup IPv6 Internet Access Mode for WAN interface If IPv6 service is active on this WAN interface...

Page 85: ...l be seen in DHCP reply packets Interface Specify the WAN interface s that will be overwritten by such function WAN5 WAN7 can be located under WAN Multi PVCs Option Number Type a number for such function Note If you choose to configure option 61 here the detailed settings in WAN Interface Access will be overwritten DataType Choose the type ASCII or Hex for the data to be stored Data Type the conte...

Page 86: ...u click Disable this function will be closed and all the settings that you adjusted in this page will be invalid DSL Modem Settings Set up the DSL parameters required by your ISP These are vital for building DSL connection to your ISP Multi PVC channel The selections displayed here are determined by the page of Internet Access Multi PVCs Select M PVCs Channel means no selection will be chosen VPI ...

Page 87: ...of PPPoE session different with the Host PC to access into Internet Note To have PPPoA Pass through please choose PPPoA protocol and check the box es here The router will behave like a modem which only serves the PPPoE client on the LAN That s the router will offer PPPoA dial up connection WAN Connection Detection Such function allows you to verify whether network connection is alive or not throug...

Page 88: ...e Fixed IP field Please contact your ISP before you want to use this function WAN IP Alias If you have multiple public IP addresses and would like to utilize them on the WAN interface please use WAN IP Alias You can set up to 8 public IP addresses other than the current one you are using Fixed IP Click Yes to use this function and type in a fixed IP address in the box of Fixed IP Address Default M...

Page 89: ...s are explained as follows Item Description Enable Disable Click Enable for activating this function If you click Disable this function will be closed and all the settings that you adjusted in this page will be invalid DSL Modem Settings Set up the DSL parameters required by your ISP These are vital for building DSL connection to your ISP Multi PVC channel The selections displayed here are determi...

Page 90: ...ifying how routers exchange routing tables information Click Enable RIP for activating this function Bridge Mode If you choose Bridged IP as the protocol you can check this box to invoke the function The router will work as a bridge modem WAN IP Network Settings This group allows you to obtain an IP address automatically and allows you type in IP address manually WAN IP Alias If you have multiple ...

Page 91: ... is 63 characters Password Type a password The maximum length of the password you can set is 62 characters Specify an IP address Click this radio button to specify some data IP Address Type in the private IP address Subnet Mask Type in the subnet mask Gateway IP Address Type in gateway IP address Default MAC Address Type in MAC address for the router You can use Default MAC Address or specify anot...

Page 92: ...n this page will be invalid ISP Access Setup Enter your allocated username password and authentication parameters according to the information provided by your ISP Username Type in the valid user name maximum 63 characters provided by the ISP in this field Password Type in the password provided by ISP in this field Index 1 15 in Schedule Setup You can type in four sets of time schedule for your re...

Page 93: ...ays assign you the same IP address whenever you request In this case you can fill in this IP address in the Fixed IP field Please contact your ISP before you want to use this function WAN IP Alias If you have multiple public IP addresses and would like to utilize them on the WAN interface please use WAN IP Alias You can set up to 8 public IP addresses other than the current one you are using Type ...

Page 94: ...sing protocol of the internet please click the Static or Dynamic IP tab The following web page will be shown Available settings are explained as follows Item Description Enable Disable Click Enable for activating this function If you click Disable this function will be closed and all the settings that you adjusted in this page will be invalid Keep WAN Connection Normally this function is designed ...

Page 95: ...how routers exchange routing tables information Click Enable RIP for activating this function WAN IP Network Settings This group allows you to obtain an IP address automatically and allows you type in IP address manually WAN IP Alias If you have multiple public IP addresses and would like to utilize them on the WAN interface please use WAN IP Alias You can set up to 8 public IP addresses other tha...

Page 96: ...rvice providers specify a specific MAC address for access authentication In such cases you need to click the Specify a MAC Address and enter the MAC address in the MAC Address field DNS Server IP Address Type in the primary IP address for the router if you want to use Static IP mode If necessary type in secondary IP address for necessity in the future After finishing all the settings here please c...

Page 97: ...n Schedule Setup You can type in four sets of time schedule for your request All the schedules can be set previously in Application Schedule web page and you can use the number that you have set in that web page MTU It means Max Transmit Unit for packet The default setting is 1442 PPP Setup PPP Authentication Select PAP only or PAP or CHAP for PPP Idle Timeout Set the timeout for breaking down the...

Page 98: ... function Click Yes to use this function and type in a fixed IP address in the box Fixed IP Address Type a fixed IP address WAN IP Network Settings Obtain an IP address automatically Click this button to obtain the IP address automatically Specify an IP address Click this radio button to specify some data IP Address Type the IP address Subnet Mask Type the subnet mask After finishing all the setti...

Page 99: ...tings that you adjusted in this page will be invalid SIM PIN code Type PIN code of the SIM card that will be used to access Internet Modem Initial String Such value is used to initialize USB modem Please use the default value If you have any question please contact to your ISP APN Name APN means Access Point Name which is provided and required by some ISPs Type the name and click Apply Modem Initi...

Page 100: ...Ping Detect as detection mode you have to type IP address in this field for pinging TTL Time to Live Displays value for your reference TTL value is set by telnet command After finishing all the settings here please click OK to save the configuration D De et ta ai il ls s P Pa ag ge e f fo or r 4 4G G U US SB B M Mo od de em m D DH HC CP P i in n W WA AN N3 3 To use 4G USB Modem DHCP mode as the ac...

Page 101: ...ction Detection Such function allows you to verify whether network connection is alive or not through ARP Detect or Ping Detect Mode Choose ARP Detect or Ping Detect for the system to execute for WAN detection Ping IP If you choose Ping Detect as detection mode you have to type IP address in this field for pinging TTL Time to Live Displays value for your reference TTL value is set by telnet comman...

Page 102: ... via the PPPoE mode connection which is available for the areas such as Taiwan hinet the Netherlands Australia and UK D De et ta ai il ls s P Pa ag ge e f fo or r I IP Pv v6 6 T TS SP PC C i in n W WA AN N1 1 W WA AN N2 2 W WA AN N3 3 Tunnel setup protocol client TSPC is an application which could help you to connect to IPv6 network easily Please make sure your IPv4 WAN connection is OK and apply ...

Page 103: ...name Type the name obtained from the broker It is suggested for you to apply another username and password for http gogonet gogo6 com page freenet6 account Password Type the password assigned with the user name Confirm Password Type the password again to make the confirmation Tunnel Broker Type the address for the tunnel broker IP FQDN or an optional port number After finishing all the settings he...

Page 104: ...e obtained from the broker Please apply new account at http www sixxs net It is suggested for you to apply another username and password Password Type the password assigned with the user name Confirm Password Type the password again to make the confirmation Tunnel Broker Type the address for the tunnel broker IP FQDN or an optional port number Subnet Prefix Type the subnet prefix address getting f...

Page 105: ... AN N2 2 DHCPv6 client mode would use DHCPv6 protocol to obtain IPv6 address from server Available settings are explained as follows Item Description Identify Association Choose Prefix Delegation or Non temporary Address as the identify association IAID Type a number as IAID After finishing all the settings here please click OK to save the configuration ...

Page 106: ...lows Item Description Static IPv6 Address configuration IPv6 Address Type the IPv6 Static IP Address Prefix Length Type the fixed value for prefix length Add Click it to add a new entry Delete Click it to remove an existed entry Current IPv6 Address Table Display current interface IPv6 address Static IPv6 Gateway Configuration IPv6 Gateway Address Type your IPv6 gateway address here After finishin...

Page 107: ...002 0 16 So you can use a fixed endpoint rather than any cast endpoint The mode has more reliability Available settings are explained as follows Item Description Remote Endpoint IPv4 Address Type the static IPv4 address for the remote server 6in4 IPv6 Address Type the static IPv6 address for IPv4 tunnel with the value for prefix length LAN Routed Prefix Type the static IPv6 address for LAN routing...

Page 108: ...d d i in n W WA AN N1 1 W WA AN N2 2 This type allows you to setup 6rd for WAN interface Available settings are explained as follows Item Description 6rd Mode Auto 6rd Retrieve 6rd prefix automatically from 6rd service provider The IPv4 WAN must be set as DHCP Static 6rd Set 6rd options manually IPv4 Border Relay Type the IPv4 addresses of the 6rd Border Relay for a given 6rd domain ...

Page 109: ...sses within a given 6rd domain It may be any value between 0 and 32 6rd Prefix Type the 6rd IPv6 address 6rd Prefix Length Type the IPv6 prefix length for the 6rd IPv6 prefix in number of bits After finished the above settings click OK to save the settings Below shows an example for successful IPv6 connection based on 6rd mode ...

Page 110: ...sed as multi PVCs Available settings are explained as follows Item Description Enable Check this box to enable that channel The channels that you enabled here will be shown in the Multi PVC channel drop down list on the web page of Internet Access Though you can enable eight channels in this page yet only one channel can be chosen on the web page of Internet Access VPI Type in the value provided b...

Page 111: ...ccording to the protocol setting that you choose WAN link for Channel 5 6 and 7 are provided for router borne application such as TR 069 The settings must be applied and obtained from your ISP For your special request please contact with your ISP and then click WAN link of Channel 5 6 or 7 to configure your router ...

Page 112: ...ion for this PVC will be effective for VoIP data transmitting and receiving IPTV The IPTV configuration will allow the WAN interface to send IGMP packets to IPTV servers After finishing all the settings here please click OK to save the configuration For other settings refer to Details Page for PPPoE PPPoA in WAN1 A AT TM M Q Qo oS S Such configuration is applied to upstream packets Such informatio...

Page 113: ...follows Item Description Enable Check this box to enable that channel Only channel 3 to 8 can be set in this page for channel 1 to 2 are reserved for NAT using P1 to P4 It means the LAN port 1 to 4 Check the box to designate the LAN port for channel 3 to 8 Service Type Normally service type is used for the service of video stream e g IPTV It can divide the packets from remote control and from vide...

Page 114: ...ices such as Internet IPTV and so on from other channels into a single channel Available settings are explained as follows Item Description PVC Binding Data transmitted through the selected channel will be redirected and transmitted via the channel configured in the field of PVC Binding Add Tag To identify the usage of PVC check this box to invoke this setting And type the number for VLAN ID numbe...

Page 115: ...T does is to translate the packets from public IP address to private IP address to forward the right packets to the right host and vice versa Besides Vigor router has a built in DHCP server that assigns private IP address to each local host See the following diagram for a briefly understanding In some special case you may have a public IP subnet from your ISP such as 220 135 240 0 24 This means th...

Page 116: ... St ta at ti ic c R Ro ou ut te e When you have several subnets in your LAN sometimes a more effective and quicker way for connection is the Static routes function rather than other method You may simply set rules to forward data from one specified subnet to another specified subnet without the presence of RIP W Wh ha at t a ar re e V Vi ir rt tu ua al l L LA AN Ns s a an nd d R Ra at te e C Co on...

Page 117: ...General Setup Allow to configure settings for each subnet respectively Index Display all of the LAN items Status Basically LAN1 status is enabled in default LAN2 LAN3 LAN3 and IP Routed Subnet can be observed by checking the box of Status DHCP LAN1 is configured with DHCP in default If required please check the DHCP box for each LAN IP Address Display the IP address for each LAN item Such informat...

Page 118: ...rocessed by the function of DHCP option Force router to use DNS server IP address settings as specified in Force Vigor router to use DNS servers configured in LAN1 LAN2 LAN3 LAN4 instead of DNS servers given by the Internet Access server PPPoE PPTP L2TP or DHCP server Inter LAN Routing Check the box to link two or more different subnets LAN and LAN After finishing all the settings here please clic...

Page 119: ...igured as a DHCP client It is highly recommended that you leave the router enabled as a DHCP server if you do not have a DHCP server for your network If you want to use another DHCP server in the network other than the Vigor Router s you can let Relay Agent help you to redirect the DHCP request to the specified location Enable Server Let the router assign IP address to every host in the LAN Disabl...

Page 120: ...tands for Domain Name System Every Internet host must have a unique IP address also they may have a human friendly easy to remember name such as www yahoo com The DNS server converts the user friendly name into its equivalent IP address Primary IPAddress You must specify a DNS server IP address here because your ISP should provide you with usually more than one DNS Server If your ISP does not prov...

Page 121: ... are explained as follows Item Description RADVD Configuration Enable Click it to enable RADVD server The router advertisement daemon radvd sends Router Advertisement messages specified by RFC 2461 to a local Ethernet LAN periodically and when requested by a node sending a Router Solicitation message These messages are required for IPv6 stateless auto configuration Disable Click it to disable RADV...

Page 122: ...ation IPv6 Address Type static IPv6 address for LAN Prefix Length Type the fixed value for prefix length Add Click it to add a new entry Delete Click it to remove an existed entry Current IPv6 Address Table Display current used IPv6 addresses D De et ta ai il ls s P Pa ag ge e f fo or r L LA AN N2 2 L LA AN N3 3 L LA AN N4 4 Available settings are explained as follows Item Description Network Conf...

Page 123: ... 50 and the maximum is 253 Gateway IPAddress Enter a value of the gateway IP address for the DHCP server The value is usually as same as the 1st IP address of the router which means the router is the default gateway Lease Time Enter the time to determine how long the IP address assigned by DHCP server can be used Retrieve IPs from inactive clients periodically Whenever a DHCP client requests an IP...

Page 124: ...ft empty the router will use the DNS server assigned by ISP If not the router will assign its own IP address to local users as a DNS proxy server Force router to use address for DNS Force Vigor router to use DNS servers in this page instead of DNS servers given by the Internet Access server PPPoE PPTP L2TP or DHCP server After finishing all the settings here please click OK to save the configurati...

Page 125: ...th when issuing IP addresses If the 1st IP address of your router is 192 168 1 1 the starting IP address must be 192 168 1 2 or greater but smaller than 192 168 1 254 IP Pool Counts Enter the maximum number of PCs that you want the DHCP server to assign IP addresses to The default is 50 and the maximum is 253 Lease Time Enter the time to determine how long the IP address assigned by DHCP server ca...

Page 126: ... bring different web pages S St ta at ti ic c R Ro ou ut te e f fo or r I IP Pv v4 4 Available settings are explained as follows Item Description Set to Factory Default Clear all of the settings and return to factory default settings Viewing Routing Table Displays the routing table for your reference Index The number 1 to 10 under Index allows you to open next page to set up static route Destinati...

Page 127: ... and return to factory default settings Viewing IPv6 Routing Table Displays the routing table for your reference Index The number 1 to 40 under Index allows you to open next page to set up static route Destination Address Displays the destination address of the static route Status Displays the status of the static route Click any underline of index number to get the following page Available settin...

Page 128: ...d o on n I IP Pv v4 4 Here is an example of setting Static Route in Main Router so that user A and B locating in different subnet can talk to each other via the router Assuming the Internet access has been configured and the router works properly use the Main Router to surf the Internet create a private subnet 192 168 10 0 using an internal Router A 192 168 1 2 create a public subnet 211 100 88 0 ...

Page 129: ...x 192 168 10 0 24 can access the Internet via the router and continuously exchange of IP routing information with different subnets 2 Click the LAN Static Route and click on the Index Number 1 Check the Enable box Please add a static route as shown below which regulates all packets destined to 192 168 10 0 will be forwarded to 192 168 1 2 Click OK 3 Return to Static Route Setup page Click on anoth...

Page 130: ...s it passes to the LAN Users can set the priorities for LAN side QoS and can assign each of the VLANs to each of the different IP subnets that the router may also be operating in order to provide even more isolation This functionality is tag based multi subnet P Po or rt t B Ba as se ed d V VL LA AN N Relative to tag based VLAN which groups clients with an identifier port based VLAN uses physical ...

Page 131: ...gh configuring wrong VLAN tag setting For Vigor router has one LAN physical port only it is recommended to enable the management port LAN 1 to ensure the data transmission is unimpeded Note Leave one VLAN untagged at least to prevent from not connecting to Vigor router due to unexpected error Vigor2830 series features a hugely flexible VLAN system In its simplest form each of the Gigabit LAN ports...

Page 132: ...AN Routing by checking the box between LAN1 and LAN2 Vigor router supports up to six private IP subnets on LAN Each can be independent isolated or common able to communicate with each other This is ideal for departmental or multi occupancy applications Note As for the VLAN applications refer to Appendix I VLAN Application on Vigor Router for more detailed information ...

Page 133: ... to invoke this function However IP MAC which is not listed in IP Bind List also can connect to Internet Disable Click this radio button to disable this function All the settings on this page will be invalid Strict Bind Click this radio button to block the connection of the IP MAC which is not listed in IP Bind List ARP Table This table is the LAN ARP table of this router The information for IP an...

Page 134: ...AC address for one PC If not no one of the PCs can access into Internet And the web user interface of the router might not be accessed 3 3 2 2 6 6 L LA AN N P Po or rt t M Mi ir rr ro or r LAN port mirror can be applied for the users in LAN Generally speaking this function copies traffic from one or more specific ports to a target port This mechanism helps manager track the network errors or abnor...

Page 135: ...an authentication mechanism for the device that is attached to a LAN or WLAN Wired 802 1x provides authentication for one network device on each LAN port The RADIUS Server settings must be configured before enabling 802 1x because the EAP Extensible Authentication Protocol Authenticator relies on the RADIUS Server in its authentication process Each LAN port with Wired 802 1x configured will only f...

Page 136: ...configured here while trying to access into the Internet or the desired web page through this router That is a company which wants to have an advertisement for its products to users can specify the URL in this page to reach its goal Each item is explained as follows Item Description Profile Display the number link which allows you to configure the profile Status Display the content Disable URL Red...

Page 137: ... advertisement For example force the wireless user s in hotel to access into the web page that the hotel wants the user s to visit Message Type words or sentences here The message will be displayed on the screen for several seconds when the wireless users access into the web page through the router Applied Interfaces Check the box es representing different interfaces to be applied by such profile ...

Page 138: ...tocol Display the protocol used for this policy Interface Display the interface to send packets to once the policy is matched Interface Address Display the WAN IP or WAN IP alias address which is used as source IP of the outgoing packets Src IP Start Displays the IP address for the start of the source IP Src IP End Displays the IP address for the end of the source IP Dest IP Start Displays the IP ...

Page 139: ...xplained as follows Item Description Source IP Any Any IP can be treated as the source IP Src IP Start Type the source IP start for the specified WAN interface Src IP End Type the source IP end for the specified WAN interface If this field is blank it means that all the source IPs inside the LAN will be passed through the WAN interface Destination IP Any Any IP can be treated as the destination IP...

Page 140: ...with the above criteria will be transferred to the interface chosen here 4 After specifying the interface click Next to get the following page Available settings are explained as follows Item Description Force NAT Force Routing It determines which mechanism that the router will use to forward the packet to WAN 5 After choosing the mechanism click Next to get the summary page for reference ...

Page 141: ...nish to complete wizard setting To use Advance Mode do the following steps 1 Click the Advance Mode radio button 2 Click Index 1 to access into the following page Available settings are explained as follows Item Description Enable Check this box to enable this policy ...

Page 142: ...rough the WAN interface Destination Port Any Any port number can be treated as the destination port Dest Port Start Type the destination port start for the destination IP Dest Port End Type the destination port end for the destination IP If this field is blank it means that all the destination ports will be passed through the WAN interface Send to if criteria matched Interface Use the drop down li...

Page 143: ...age of IP address NAT allows the internal IP addresses of local hosts to be translated into one public IP address thus you can have only one IP address on behalf of the entire internal hosts Enhance security of the internal network by obscuring the IP address There are many attacks aiming victims based on the IP address Since the attacker cannot be aware of any private IP addresses the NAT functio...

Page 144: ...ncoming traffic To use this function please go to NAT page and choose Port Redirection web page The Port Redirection Table provides 20 port mapping entries for the internal hosts Each item is explained as follows Item Description Index Display the number of the profile Service Name Display the description of the specific network service WAN Interface Display the WAN IP address used by the profile ...

Page 145: ... In Range mode if the public port start port and end port and the starting IP of private IP had been entered the system will calculate and display the ending IP of private IP automatically Service Name Enter the description of the specific network service Protocol Select the transport layer protocol TCP or UDP WAN IP Select the WAN IP used for port redirection There are eight WAN IP alias that can...

Page 146: ...he local network http 192 168 1 13 80 Therefore you need to change the router s http port to any one other than the default port 80 to avoid conflict such as 8080 This can be set in the System Maintenance Management Setup You then will access the admin screen of by suffixing the IP address with 8080 e g http 192 168 1 1 8080 instead of port 80 3 3 4 4 2 2 D DM MZ Z H Ho os st t As mentioned above ...

Page 147: ... open the following page Available settings are explained as follows Item Description Choose Private IP or Active True IP first Active True IP selection is available for WAN1 only Private IP Enter the private IP address of the DMZ host or click Choose PC to select one Choose PC Click this button and then a window will automatically pop up as depicted below The window consists of a list of private ...

Page 148: ... the above dialog the IP address will be shown on the following screen Click OK to save the setting DMZ Host for WAN2 and WAN3 is slightly different with WAN1 Active True IP selection is available for WAN1 only See the following figure If you previously have set up WAN Alias for PPPoE or Static or Dynamic IP mode in WAN2 interface you will find them in Aux WAN IP for your selection ...

Page 149: ...k this button and then a window will automatically pop up as depicted below The window consists of a list of private IP addresses of all hosts in your LAN network Select one private IP address in the list to be the DMZ host When you have selected one private IP from the above dialog the IP address will be shown on the following screen Click OK to save the setting After finishing all the settings h...

Page 150: ... Description Index Indicate the relative number for the particular entry that you want to offer service in a local host You should click the appropriate index number to edit or clear the corresponding entry Comment Display the name for the defined network service WAN Interface Display the WAN interface of the profile Local IP Address Display the private IP address of the local host offering the se...

Page 151: ... select one Choose PC Click this button and subsequently a window having a list of private IP addresses of local hosts will automatically pop up Select the appropriate IP address of the local host in the list Protocol Specify the transport layer protocol It could be TCP UDP or none for selection Start Port Specify the starting port number of the service offered by the local host End Port Specify t...

Page 152: ...the type of protocol used The default durations are shown below and these duration values can be modified via telnet commands TCP 86400 sec UDP 180 sec IGMP 10 sec TCP WWW 60 sec TCP SYN 60 sec Available settings are explained as follows Item Description Comment Display the text which memorizes the application of this rule Triggering Protocol Display the protocol of the triggering packets Triggeri...

Page 153: ...the text to memorize the application of this rule Triggering Protocol Select the protocol TCP UDP or TCP UDP for such triggering profile Triggering Port Type the port or port range for such trigger profile Incoming Protocol When the triggering packets received it is expected the incoming packets will use the selected protocol Select the protocol TCP UDP or TCP UDP for the incoming data of such tri...

Page 154: ...Vigor2830 Series User s Guide 142 Incoming Port Type the port or port range for the incoming packets After finishing all the settings here please click OK to save the configuration ...

Page 155: ...ction SPI tracks packets and denies unsolicited incoming data Selectable Denial of Service DoS Distributed DoS DDoS attacks protection I IP P F Fi il lt te er rs s Depending on whether there is an existing Internet connection or in other words the WAN link status is up or down the IP filter architecture categorizes traffic into two Call Filter and Data Filter Call Filter When there is no existing ...

Page 156: ...em s resource while the vulnerability attacks will try to paralyze the system by offending the vulnerabilities of the protocol or operation system The DoS Defense function enables the Vigor router to inspect every incoming packet based on the attack signature database Any malicious packet that might duplicate itself to paralyze the host in the secure LAN will be strictly blocked and a Syslog messa...

Page 157: ...le disable Call Filter and Data Filter determine general rule for filtering the incoming and outgoing data Available settings are explained as follows Item Description Call Filter Check Enable to activate the Call Filter function Assign a start filter set for the Call Filter Data Filter Check Enable to activate the Data Filter function Assign a start filter set for the Data Filter Accept large inc...

Page 158: ...rewall to prevent remote client accessing into the PCs on LAN in default IPv6 Check the box to make the packets routed from WAN to LAN via IPv6 being accepted by such router It is effective only for the packets routed but not for packets translated by NAT IPv4 Check the box to make the incoming packets via IPv4 being accepted by such router It is effective only for the packets routed but not for p...

Page 159: ...user profile or group profile existed Create New User or Create New Group item will appear for you to click to create a new one APP Enforcement Select an APP Enforcement profile for global IM P2P application blocking If there is no profile for you to select please choose Create New from the drop down list in this page to create a new profile All the hosts in LAN must follow the standard configured...

Page 160: ...ds you can specify to record information for Web Content Filter by checking the Log box It will be sent to Syslog server Please refer to section Syslog Mail Alert for more detailed information Advance Setting Click Edit to open the following window However it is strongly recommended to use the default settings here Codepage This function is used to compare the characters among different languages ...

Page 161: ...better the performance will be However if the network is not stable small value will be proper Session timeout Setting timeout for sessions can make the best utilization of network resources After finishing all the settings here please click OK to save the configuration ...

Page 162: ...ule Available settings are explained as follows Item Description Filter Rule Click a button numbered 1 7 to edit the filter rule Click the button will open Edit Filter Rule web page For the detailed information refer to the following page Active Enable or disable the filter rule Comment Enter filter set comments description Maximum length is 23 character long Move Up Down Use Up or Down link to mo...

Page 163: ...er long Index 1 15 Set PCs on LAN to work at certain time interval only You may choose up to 4 schedules out of the 15 schedules pre defined in Applications Schedule setup The default setting of this field is blank and the function will always work Clear sessions when schedule ON Check this box to clear the sessions when the above schedule profiles are applied Direction Set the direction of packet...

Page 164: ...dress Single Address Range Address Subnet Address as the Address Type and type them in this dialog In addition if you want to use the IP range from defined groups or objects please choose Group and Objects as the Address Type From the IP Group drop down list choose the one that you want to apply Or use the IP Object drop down list to choose the object that you want Service Type Click Edit to acces...

Page 165: ...t defined here when the first and last values are different it indicates that all the ports except the range defined here are available for this service type the port number greater than this value is available the port number less than this value is available for this profile Service Group Object Use the drop down list to choose the one that you want Fragments Specify the action for fragmented pa...

Page 166: ...ddress and IP address settings configured in IP Object for Source IP and Destination IP be bound for applying such filter rule No Strict no limitation Quality of Service Choose one of the QoS rules to be applied as firewall rule For detailed information of setting QoS please refer to the related section later Load Balance policy Choose the WAN interface for applying Load Balance Policy User Manage...

Page 167: ...eb Content Filter for applying with this router Please set at least one profile for anti virus in CSM Web Content Filter web page first Or choose Create New from the drop down list in this page to create a new profile For troubleshooting needs you can specify to record information for Web Content Filter by checking the Log box It will be sent to Syslog server Please refer to section Syslog Mail Al...

Page 168: ...ter will be filtered by firewall settings configured by Vigor router When the resource is inadequate the packets will be blocked if Strict Security Checking is enabled If Strict Security Checking is not enabled then the packets will pass through the router APP Enforcement Check this box to execute the critical checking for all the files transferred via IM P2P After finishing all the settings here ...

Page 169: ...Vigor2830 Series User s Guide 157 ...

Page 170: ...eded the defined value the Vigor router will start to randomly discard the subsequent TCP SYN packets for a period defined in Timeout The goal for this is prevent the TCP SYN packets attempt to exhaust the limited resource of Vigor router By default the threshold and timeout values are set to 2000 packets per second and 10 seconds respectively That means when 2000 packets per second received they ...

Page 171: ...e the Block IP options function The Vigor router will ignore any IP packets with IP option field in the datagram header The reason for limitation is IP option appears to be a vulnerability of the security for the LAN because it will carry significant information such as security TCC closed user group parameters a series of Internet addresses routing messages etc An eavesdropper outside might learn...

Page 172: ...hose target hosts will hang once they re construct the packets The Vigor routers will block any packets realizing this attacking activity Block ICMP Fragment Check the box to activate the Block ICMP fragment function Any ICMP packets with more fragment bit set are dropped Block Unassigned Numbers Check the box to activate the Block Unknown Protocol function Individual IP packet has a protocol fiel...

Page 173: ...or rules for different hosts with different User Management accounts This is more flexible and convenient for network management Not only offering the basic checking for Internet access User Management also provides additional firewall rules e g CSM checking for protecting hosts Note Filter rules configured under Firewall usually are applied to the host the one that the router installed only With ...

Page 174: ...filtering effect to the users involved User Based If you choose such mode the router will apply the filter rules configured in User Management User Profile to the users Rule Based If you choose such mode the router will apply the filter rules configured in Firewall General Setup and Filter Rule to the users Display IP Address on tracking window On The IP address of the user accessing into Vigor ro...

Page 175: ... up to 200 which will be applied for users controlled under User Management Simply open User Management User Profile To set the user profile please click any index number link to open the following page Notice that profile 1 admin and profile 2 System Reservation are factory default settings Profile 2 is reserved for future use ...

Page 176: ...The user has to type the password specified here to pass the authentication When the user passes the authentication he she can access Internet via this router with the limitation configured in this user profile Confirm Password Type the password again for confirmation Idle Timeout If the user is idle over the limitation of the timer the network connection will be stopped for such user By default t...

Page 177: ...ed on the screen with time remaining for connection if Idle Timeout is set However the system will update the time periodically to keep the connection always on Thus Idle Timeout will not interrupt the network connection Authentication Any user from LAN side or WLAN side tries to connect to Internet via Vigor router must be authenticated by the router first There are three ways offered by the rout...

Page 178: ...hedule web page and you can use the number that you have set in that web page Enable Time Quota Time quota means the total connection time allowed by the router for the user with such profile Check the box to enable the function of time quota The first box displays the remaining time of the network connection The second box allows to type the number of time unit is minute which is available for th...

Page 179: ...ically Enable Check it to use the default setting for time quota and data quota Default Time Quota Type the value for the time manually Default Data Quota Type the value for the data manually After finishing all the settings here please click OK to save the configuration 3 3 6 6 3 3 U Us se er r G Gr ro ou up p This page allows you to bind several user profiles into one group These groups will be ...

Page 180: ...Profile page within one user group All the available user objects that you have created will be shown in this box Notice that user object Admin and Dial In User are factory settings User defined profiles will be numbered with 3 4 5 and so on Selected Keyword Objects Click button to add the selected user objects in this box After finishing all the settings here please click OK to save the configura...

Page 181: ...anually Index Display the number of the data flow Profile Display the authority of the account IP Address Display the IP address of the device User Display the users which connect to Vigor router currently You can click the link under the username to open the user profile setting page for that user Last Login Time Display the login time that such user connects to the router last time Expired Time ...

Page 182: ...g conveniently Later we can select that object group that can apply it For example all the IPs in the same department can be defined with an IP object a range of IP address 3 3 7 7 1 1 I IP P O Ob bj je ec ct t You can set up to 192 sets of IP Objects with different conditions Available settings are explained as follows Item Description Set to Factory Default Clear all profiles Index Display the p...

Page 183: ...on Name Type a name for this profile Maximum 15 characters are allowed Interface Choose a proper interface For example the Direction setting in Edit Filter Rule will ask you specify IP or IP range for WAN or LAN RT VPN or any IP address If you choose LAN RT VPN as the Interface here and choose LAN RT VPN as the direction setting in Edit Filter Rule then all the IP addresses specified with LAN RT V...

Page 184: ...ess Select Mac Address if this object contains Mac address MAC Address Type the MAC address of the network card which will be controlled Start IP Address Type the start IP address for Single Address type End IP Address Type the end IP address if the Range Address type is selected Subnet Mask Type the subnet mask if the Subnet Address type is selected Invert Selection If it is checked all the IP ad...

Page 185: ...oup Available settings are explained as follows Item Description Set to Factory Default Clear all profiles Index Display the profile number that you can configure Name Display the name of the group profile To set a new profile please do the steps listed below 1 Click the number e g 1 under Index column for configuration in details ...

Page 186: ...acters are allowed Interface Choose WAN LAN or Any to display all the available IP objects with the specified interface Available IP Objects All the available IP objects with the specified interface chosen above will be shown in this box Selected IP Objects Click button to add the selected IP objects in this box 3 After finishing all the settings here please click OK to save the configuration ...

Page 187: ...gs are explained as follows Item Description Set to Factory Default Clear all profiles Index Display the profile number that you can configure Name Display the name of the object profile To set a new profile please do the steps listed below 1 Click the number e g 1 under Index column for configuration in details 2 The configuration page will be shown as follows ...

Page 188: ...Pv6 address Select Any Address if this object contains any IPv6 address Select Mac Address if this object contains Mac address MAC Address Type the MAC address of the network card which will be controlled Start IP Address Type the start IP address for Single Address type End IP Address Type the end IP address if the Range Address type is selected Subnet Mask Type the subnet mask if the Subnet Addr...

Page 189: ...v6 group Available settings are explained as follows Item Description Set to Factory Default Clear all profiles Index Display the profile number that you can configure Name Display the name of the group profile To set a new profile please do the steps listed below 1 Click the number e g 1 under Index column for configuration in details ...

Page 190: ...me Type a name for this profile Maximum 15 characters are allowed Available IPv6 Objects All the available IPv6 objects with the specified interface chosen above will be shown in this box Selected IPv6 Objects Click button to add the selected IPv6 objects in this box 3 After finishing all the settings here please click OK to save the configuration ...

Page 191: ...vailable settings are explained as follows Item Description Set to Factory Default Clear all profiles Index Display the profile number that you can configure Name Display the name of the object profile To set a new profile please do the steps listed below 1 Click the number e g 1 under Index column for configuration in details 2 The configuration page will be shown as follows ...

Page 192: ...d last value are the same it indicates one port when the first and last values are different it indicates a range for the port and available for this profile when the first and last value are the same it indicates all the ports except the port defined here when the first and last values are different it indicates that all the ports except the range defined here are available for this service type ...

Page 193: ...es into one group Available settings are explained as follows Item Description Set to Factory Default Clear all profiles Index Display the profile number that you can configure Name Display the name of the group profile To set a new profile please do the steps listed below 1 Click the number e g 1 under Group column for configuration in details ...

Page 194: ...me Type a name for this profile Available Service Type Objects All the available service objects that you have added on Objects Setting Service Type Object will be shown in this box Selected Service Type Objects Click button to add the selected IP objects in this box 3 After finishing all the settings here please click OK to save the configuration ...

Page 195: ...CSM URL Web Content Filter Profile Available settings are explained as follows Item Description Set to Factory Default Clear all profiles Index Display the profile number that you can configure Name Display the name of the object profile To set a new profile please do the steps listed below 1 Click the number e g 1 under Index column for configuration in details ...

Page 196: ...ype a name for this profile e g game Contents Type the content for such profile For example type gambling as Contents When you browse the webpage the page with gambling information will be watched out and be passed blocked based on the configuration on Firewall settings 3 After finishing all the settings here please click OK to save the configuration ...

Page 197: ...osen as black white list in CSM URL Web Content Filter Profile Available settings are explained as follows Item Description Set to Factory Default Clear all profiles Index Display the profile number that you can configure Name Display the name of the group profile To set a new profile please do the steps listed below 1 Click the number e g 1 under Index column for configuration in details ...

Page 198: ...this group Available Keyword Objects You can gather keyword objects from Keyword Object page within one keyword group All the available Keyword objects that you have created will be shown in this box Selected Keyword Objects Click button to add the selected Keyword objects in this box 3 After finishing all the settings here please click OK to save the configuration ...

Page 199: ...cified in these profiles will be processed according to the chosen action Each item is explained as follows Item Description Set to Factory Default Clear all of the settings and return to factory default settings Index Display the profile number that you can configure Name Display the name of the object profile To set a new profile please do the steps listed below 1 Click the number e g 1 under Pr...

Page 200: ...lable settings are explained as follows Item Description Profile Name Type a name for this profile 3 Type a name for such profile and check all the items of file extension that will be processed in the router 4 After finishing all the settings here please click OK to save the configuration ...

Page 201: ... Each item is explained as follows Item Description Set to Factory Default Clear all of the settings and return to factory default settings Index Display the profile number that you can configure Profile Display the name for such SMS profile SMS Provider Display the service provider which offers SMS service To set a new profile please do the steps listed below 1 Click the SMS Provider tab and clic...

Page 202: ...e a user name that the sender can use to register to selected SMS provider Password Type a password that the sender can use to register to selected SMS provider Quota Type the number of the credit that you purchase from the service provider chosen above Note that one credit equals to one SMS text message on the standard route Sending Interval To avoid quota being exhausted soon type time interval ...

Page 203: ...to make customized SMS service The profile name for Index 9 and Index 10 are fixed You can click the number e g 9 under Index column for configuration in details Available settings are explained as follows Item Description Profile Name Display the name of this profile It cannot be modified Service Provider Type the website of the service provider Type the URL string in the box under the filed of S...

Page 204: ...e interval for the system to send SMS After finishing all the settings here please click OK to save the configuration M Ma ai il l S Se er rv vi ic ce e O Ob bj je ec ct t This page allows you to set ten profiles which will be applied in Application SMS Mail Alert Service Each item is explained as follows Item Description Set to Factory Default Clear all of the settings and return to factory defau...

Page 205: ...the IP address of the mail server SMTP Port Type the port number for SMTP server Sender Address Type the e mail address of the sender Use SSL Check this box to use port 465 for SMTP server for some e mail server uses https as the transmission method Authentication The mail server must be authenticated with the correct username and password to have the right of sending message out Check the box to ...

Page 206: ...ti io on n O Ob bj je ec ct t This page allows you to set ten profiles which will be applied in Application SMS Mail Alert Service You can set an object with different monitoring situation To set a new profile please do the steps listed below 1 Open Object Setting Notification Object and click the number e g 1 under Index column for configuration in details ...

Page 207: ...lained as follows Item Description Profile Name Type a name for such notification profile Category Display the types that will be monitored Status Display the status for the category You can check the box you want to be monitored 3 After finishing all the settings here please click OK to save the configuration ...

Page 208: ...g Because it checks the URL strings or some of HTTP data hiding in the payload of TCP packets while legacy firewall inspects packets based on the fields of TCP IP headers only On the other hand Vigor router can prevent user from accidentally downloading malicious codes from web pages It s very common that malicious codes conceal in the executable objects such as ActiveX Java Applet compressed file...

Page 209: ...lied in Default Rule of Firewall General Setup for filtering Available settings are explained as follows Item Description Set to Factory Default Clear all profiles Profile Display the number of the profile which allows you to click to set different policy Name Display the name of the APP Enforcement Profile Click the number under Index column for settings in detail There are four tabs IM P2P Proto...

Page 210: ...boxes Support List Display the all the information name version and note about IM P2P Protocol and others applications that Vigor router supports for APPE function Action Block Block all the packets passing with the settings configured in this page Pass Pass all the packets with the settings configured in this page The profiles configured here can be applied in the Firewall General Setup and Firew...

Page 211: ...Vigor2830 Series User s Guide 199 Below shows the items which are categorized under IM The items categorized under OTHERS ...

Page 212: ...ts based on the fields of TCP IP headers only On the other hand Vigor router can prevent user from accidentally downloading malicious codes from web pages It s very common that malicious codes conceal in the executable objects such as ActiveX Java Applet compressed files and other executable files Once downloading these types of files from websites you may risk bringing threat to your system For e...

Page 213: ...cified in URL Access Control and Web Feature below passing through When you choose this setting both configuration set in this page for URL Access Control and Web Feature will be inactive Both Block The router will block all the packages that match with the conditions specified in URL Access Control and Web Feature below When you choose this setting both configuration set in this page for URL Acce...

Page 214: ...he action specified under Restrict Web Feature Prevent web access from IP address Check the box to deny any web surfing activity using IP address such as http 202 6 3 2 The reason for this is to prevent someone dodges the URL Access Control You must clear your browser cache first so that the URL content filtering facility operates properly on a web page that you visited before Action This setting ...

Page 215: ...ywords listed on the box below Pass Allow accessing into the corresponding webpage with the keywords listed on the box below Block Restrict accessing into the corresponding webpage with the keywords listed on the box below If the web pages do not match with the specified feature set here it will be processed with reverse action Cookie Check the box to filter out the cookie transmission from inside...

Page 216: ...ider e g DrayTek No matter activating WCF feature or getting a new license for web content filter you have to click Activate to satisfy your request Be aware that service provider matching with Vigor router currently offers a period of time for trial version for users to experiment If you want to purchase a formal edition simply contact with the channel partner or your dealer Click CSM and click W...

Page 217: ...en you type URL in browser based on the web content filter profile Setup Test Server It is recommended for you to use the default setting auto selected Find more Click it to open http myvigor draytek com for searching another qualified and suitable server Set to Factory Default Click this link to retrieve the factory settings Default Message You can type the message manually for your necessity or ...

Page 218: ...ized for a short time about 1 second in the router When the user tries to access the same destination ID the router will check it by comparing the record stored If it matches the page will be retrieved quickly Such item can provide URL matching with the fastest rate L1 L2 Cache the router will check the URL with fast processing rate combining the feature of L1 and L2 Eight profiles are provided he...

Page 219: ...ons If the web pages do not match with the specified feature set here they will be processed with the categories listed on the box below Block restrict accessing into the corresponding webpage with the characters listed on Group Object Selections If the web pages do not match with the specified feature set here they will be processed with the categories listed on the box below Action Pass allow ac...

Page 220: ...ttings here please click OK to save the configuration 3 3 8 8 4 4 D DN NS S F Fi il lt te er r The DNS Filter monitors DNS queries on UDP port 53 and will pass the DNS query information to the WCF to help with categorizing HTTPS URL s Note For DNS filter must use the WCF service profile to filter the packets therefore WCF license must be activated first Otherwise DNS filter does not have any effec...

Page 221: ... one of the WCF profiles as Service Choose the WCF profiles to apply DNS filter Cache Time hour Set the time for DNS query Enable Block Page Check the box to enable such function After finishing all the settings please click OK to save the configuration 3 3 8 8 5 5 A AP PP PE E S Su up pp po or rt t L Li is st t This page offers the software versions for each applications managed by APP Enforcemen...

Page 222: ...te the records of NAT sessions for such connection The P2P Peer to Peer applications e g BitTorrent always need many sessions for procession and also they will occupy over resources which might result in important accesses impacted To solve the problem you can use limit session to limit the session procession for specified Hosts In the Bandwidth Management menu click Sessions Limit to open the web...

Page 223: ... you do not set the session number in this field the system will use the default session limit for the specific limitation you set for each index Add Adds the specific session limitation onto the list above Edit Allows you to edit the settings for the selected limitation Delete Remove the selected settings existing on the limitation list Administration Message Type the words which will be displaye...

Page 224: ...page To activate the function of limit bandwidth simply click Enable and set the default upstream and downstream limit Available settings are explained as follows Item Description Bandwidth Limit Enable Click this button to activate the function of limit bandwidth IP Routed Subnet Check this box to apply the bandwidth limit to the second subnet specified in LAN General Setup Disable Click this but...

Page 225: ...set the limit in this field the system will use the default speed for the specific limitation you set for each index Add Add the specific speed limitation onto the list above Update Allow you to edit the settings for the selected limitation Delete Remove the selected settings existing on the limitation list Smart Bandwidth Limit Check this box to have the bandwidth limit determined by the system a...

Page 226: ... to queues and associated service types The basic QoS implementation in Vigor routers is to classify and schedule packets based on the service type information in the IP header For instance to ensure the connection with the headquarter a teleworker may enforce an index of QoS Control to reserve bandwidth for HTTPS connection while using lots of application at the same time One more larger scale im...

Page 227: ...ou can edit Status Display the current QoS status of this WAN Bandwidth Display the inbound and outbound bandwidth setting for the WAN interface Direction Display which direction that such function will influence Class 1 Class2 Class 3 Others Display the bandwidth percentage for each class UDP Bandwidth Control Display the UDP bandwidth control is enabled or not Online Statistics Display an online...

Page 228: ...You can configure general setup for the WAN interface edit the Class Rule and edit the Service Type for the Class Rule for your request O On nl li in ne e S St ta at ti is st ti ic cs s Display an online statistics for quality of service for your reference G Ge en ne er ra al l S Se et tu up p f fo or r W WA AN N I In nt te er rf fa ac ce e When you click Setup you can configure the bandwidth rati...

Page 229: ...is 10000kbps WAN Outbound Bandwidth It allows you to set the connecting rate of data output for WAN2 WAN3 For example if your ADSL supports 1M of downstream and 256K upstream please set 256kbps for this box The default value is 10000kbps Note The rate of outbound inbound must be smaller than the real bandwidth to ensure correct calculation of QoS It is suggested to set the bandwidth value for inbo...

Page 230: ...ic Limited_bandwidth Ratio The ratio typed here is reserved for limited bandwidth of UDP application E Ed di it t t th he e C Cl la as ss s R Ru ul le e f fo or r Q Qo oS S 1 The first three Class 1 to Class 3 class rules can be adjusted for your necessity To add edit or delete the class rule please click the Edit link of that one 2 After you click the Edit link you will see the following page Now...

Page 231: ...ay the remote IP address on LAN WAN for the rule DiffServ CodePoint Display the levels of the data for processing with QoS control Service Type Display the service type of the data for processing with QoS control 3 For adding a new rule click Add to open the following page Available settings are explained as follows Item Description ACT Check this box to invoke these settings Ethernet Type Please ...

Page 232: ...ervice Type It determines the service type of the data for processing with QoS control It can also be edited You can choose the predefined service type from the Service Type drop down list Those types are predefined in factory Simply choose the one that you want for using by current QoS 4 After finishing all the settings here please click OK to save the configuration 5 By the way you can set up to...

Page 233: ...Description Service Name Type in a new service for your request Service Type Choose the type TCP UDP or TCP UDP or other for the new service Port Configuration Type Click Single or Range as the Type If you select Range you have to type in the starting port number and the end porting number on the boxes below Port Number Type in the starting port number and the end porting number here if you choose...

Page 234: ... ca at ti io on n Packets coming from LAN IP can be retagged through QoS setting When the packets sent out through WAN interface all the them will be tagged with certain header and that will be easily to be identified by server on ISP For example in the following illustration the VoIP packets in LAN go into Vigor router without any header However when they go forward to the Server on ISP through V...

Page 235: ...y helpful if you host a web server FTP server or other server behind the router Before you use the Dynamic DNS feature you have to apply for free DDNS service to the DDNS service providers The router provides up to three accounts from three different DDNS service providers Basically Vigor routers are compatible with the DDNS services supplied by most popular DDNS service providers such as www dynd...

Page 236: ...r the router Check Enable Dynamic DNS Account and choose correct Service Provider dyndns org type the registered hostname hostname and domain name suffix dyndns org in the Domain Name block The following two blocks should be typed your account Login Name test and Password test Available settings are explained as follows Item Description Enable Dynamic DNS Account Check this box to enable the curre...

Page 237: ...hange Determine Real WAN IP If a Vigor router is installed behind any NAT router you can enable such function to locate the real WAN IP When the WAN IP used by Vigor router is private IP this function can detect the public IP used by the NAT router and use the detected IP address for DDNS update There are two methods offered for you to choose WAN IP If it is selected and the WAN IP of Vigor router...

Page 238: ... specify specific private IP address es to correspondent servers Thus even the remote PC is adopting public DNS as the DNS server the LAN DNS resolution on Vigor2830 series will respond the specified private IP address Open Application LAN DNS to get the following page Available settings are explained as follows Item Description Set to Factory Default Clear all profiles and recover to factory sett...

Page 239: ... settings are explained as follows Item Description Enable Check the box to enable such profile Profile Type a name for such profile Domain Name Type a domain name e g FTP Mail or Web server for such profile IP Address List Add Click it to open the following dialog You have to give an IP address representing the host Only responds Disable it to apply this profile to all of the LAN subnets Or enabl...

Page 240: ...so applicable to other functions You have to set your time before set schedule In System Maintenance Time and Date menu press Inquire Time button to set the Vigor router s clock to current time of your PC The clock will reset once if you power down or reset the router There is another way to set up time You can inquiry an NTP server a time server on the Internet to synchronize the router s clock T...

Page 241: ...ule with index 1 are shown below Available settings are explained as follows Item Description Enable Schedule Setup Check to enable the schedule Start Date yyyy mm dd Specify the starting date of the schedule Start Time hh mm Specify the starting time of the schedule Duration Time hh mm Specify the duration or period for the schedule ...

Page 242: ...pplied Once The schedule will be applied just once Weekdays Specify which days in one week should perform the schedule 3 Click OK button to save the settings Example Suppose you want to control the PPPoE Internet access connection to be always on Force On from 9 00 to 18 00 for whole week Other time the Internet access connection should be disconnected Force Down Office Hour Force On Mon Sun 9 00 ...

Page 243: ...erver in performing mutual authentication It enables centralized remote access authentication for network management Available settings are explained as follows Item Description Enable Check to enable RADIUS client feature Server IP Address Enter the IP address of RADIUS server Destination Port The UDP port number that the RADIUS server is using The default value is 1812 based on RFC 2138 Shared S...

Page 244: ...complexity of other directory service protocols For LDAP is defined to perform inquire and modify the information within the directory and acquire the data in the directory securely therefore users can apply LDAP to search or list the directory object inquire or manage the active directory G Ge en ne er ra al l S Se et tu up p This page allows you to enable the function and specify general setting...

Page 245: ...estination Port Type a port number as the destination port for LDAP server Use SSL Check the box to use the port number specified for SSL Regular DN Type this setting if Regular Mode is selected as Bind Type Regular Password Specify a password if Regular Mode is selected as Bind Type After finished the above settings click OK button to save the settings P Pr ro of fi il le es s You can configure e...

Page 246: ...tinguished Name Group Distinguished Name Type or edit the distinguished name used to look up entries on the LDAP server Sometimes you may forget the Distinguished Name since it s too long Then you may click the button to list all the account information on the AD LDAP Server to assist you finish the setup Additional Filter This is an optional setting After finished the above settings click OK to s...

Page 247: ...or a DMZ UPnP is available on Windows XP and the router provide the associated support for MSN Messenger to allow full use of the voice video and messaging features Available settings are explained as follows Item Description Enable UPNP Service Accordingly you can enable either the Connection Control Service or Connection Status Service Default WAN It is used to specify the WAN interface for appl...

Page 248: ... the UPnP function not working properly This is because these applications will block the accessing ability of some network ports Security Considerations Activating the UPnP function on your network may incur some security threats You should consider carefully these risks before activating the UPnP function Some Microsoft operating systems have found out the UPnP weaknesses and hence you need to e...

Page 249: ...ddition such function is available in NAT mode Enable IGMP Snooping Check this box to enable this function Multicast traffic will be forwarded to ports that have members of that group Disabling IGMP snooping will make multicast traffic treated in the same manner as broadcast traffic Refresh Click this link to renew the working multicast group status Group ID This field displays the ID port for the...

Page 250: ...lable settings are explained as follows Item Description Wake by Two types provide for you to wake up the binded IP If you choose Wake by MAC Address you have to type the correct MAC address of the host in MAC Address boxes If you choose Wake by IP Address you have to choose the correct IP address IP Address The IP addresses that have been configured in Firewall Bind IP to MAC will be shown in thi...

Page 251: ...abnormal situations Vigor router allows you to set up to 10 SMS profiles which will be sent out according to different conditions S SM MS S P Pr ro ov vi id de er r This page allows you to specify SMS provider who will get the SMS what the content is and when the SMS will be sent Available settings are explained as follows Item Description Index Check the box to enable such profile SMS Provider Us...

Page 252: ...M Ma ai il l S Se er rv ve er r This page allows you to specify Mail Server profile who will get the notification e mail what the content is and when the message will be sent Available settings are explained as follows Item Description Index Check the box to enable such profile Mail Service Use the drop down list to choose mail service provider You can click Mail Service link to define the mail se...

Page 253: ...tion 3 3 1 11 1 V VP PN N a an nd d R Re em mo ot te e A Ac cc ce es ss s A Virtual Private Network VPN is the extension of a private network that encompasses links across shared or public networks like the Internet In short by VPN technology you can send data between two computers across a shared or public network in a manner that emulates the properties of a point to point private link Below sho...

Page 254: ... connections such as PPTP L2TP L2TP over IPSec Available settings are explained as follows Item Description Dial In PPP Authentication PAP Only elect this option to force the router to authenticate dial in users with the PAP protocol PAP or CHAP Selecting this option means the router will attempt to authenticate dial in users with the CHAP protocol first If the dial in user does not support this p...

Page 255: ... bi directional authentication in order to provide stronger security for example Cisco routers So you should enable this function when your peer router requires mutual authentication You should further specify the User Name and Password of the mutual authentication peer Assigned IP Start Enter a start IP address for the dial in PPP connection You should choose an IP address from the local private ...

Page 256: ...er to encapsulate the data payload only It can just apply to local packet e g L2TP over IPSec The Tunnel mode will not only add the AH ESP payload but also use a new IP header Tunneled IP header to encapsulate the whole original IP packet Authentication Header AH provides data authentication and integrity for IP packets passed between VPN peers This is achieved by a keyed one way hash function to ...

Page 257: ...urity Method Medium Authentication Header AH means data will be authenticated but not be encrypted By default this option is active High Encapsulating Security Payload ESP means payload data will be encrypted and authenticated You may select encryption algorithm from Data Encryption Standard DES Triple DES 3DES and AES ...

Page 258: ... certificates for peer dial in users Available settings are explained as follows Item Description Set to Factory Default Click it to clear all indexes Index Click the number below Index to access into the setting page of IPSec Peer Identity Name Display the profile name of that index Click each index to edit one peer digital certificate There are three security levels of digital signature authenti...

Page 259: ...cific field of digital signature to accept the peer with matching value The field can be IP Address Domain or E mail Address The box under the Type will appear according to the type you select and ask you to fill in corresponding setting Accept Subject Name Click to check the specific fields of digital signature to accept the peer with matching value The field includes Country C State ST Location ...

Page 260: ...s Besides you can extend the user accounts to the RADIUS server through the built in RADIUS client function The following figure shows the summary table Available settings are explained as follows Item Description Set to Factory Default Click to clear all indexes Index Click the number below Index to access into the setting page of Remote Dial in User User Display the username for the specific dia...

Page 261: ... Allowed Dial In Type PPTP Allow the remote dial in user to make a PPTP VPN connection through the Internet You should set the User Name and Password of remote dial in user below IPSec Tunnel Allow the remote dial in user to make an IPSec VPN connection through Internet L2TP with IPSec Policy Allow the remote dial in user to make a L2TP VPN connection through the Internet You can select to use L2T...

Page 262: ...ticast packets be blocked by the router Subnet Chose one of the subnet selections for such VPN profile Assign Static IP Address Please type a static IP address for the subnet you specified User Name This field is applicable when you select PPTP or L2TP with or without IPSec policy above The maximum length for username is 16 characters Password This field is applicable when you select PPTP or L2TP ...

Page 263: ... the security method Medium Authentication Header AH means data will be authenticated but not be encrypted By default this option is invoked You can uncheck it to disable it High Encapsulating Security Payload ESP means payload data will be encrypted and authenticated You may select encryption algorithm from Data Encryption Standard DES Triple DES 3DES and AES Local ID optional Specify a local ID ...

Page 264: ...PPTP IPSec Tunnel and L2TP by itself or over IPSec and corresponding security methods etc The router supports up to 32 VPN tunnels simultaneously The following figure shows the summary table according to the item All Trunk selected for View The following shows profiles joined into VPN Backup mechanism Available settings are explained as follows Item Description View All Click it to display the LAN...

Page 265: ...e following page Each LAN to LAN profile includes 4 subgroups If the fields gray out it means you may leave it untouched The following explanations will guide you to fill all the necessary fields For the web page is too long we divide the page into several sections for explanation Available settings are explained as follows Item Description Common Settings Profile Name Specify a name for the profi...

Page 266: ...cket Pass click it to have an inquiry for data transmission between the hosts located on both sides of VPN Tunnel while connecting Block When there is conflict occurred between the hosts on both sides of VPN Tunnel in connecting such function can block data transmission of Netbios Naming Packet inside the tunnel Multicast via VPN Some programs might send multicast packets via VPN connection Pass C...

Page 267: ...PTP VPN connection to the server through the Internet You should set the identity like User Name and Password below for the authentication of remote server IPSec Tunnel Build an IPSec VPN connection to the server through Internet L2TP with IPSec Policy Build a L2TP VPN connection through the Internet You can select to use L2TP alone or with IPSec Select from below None Do not apply the IPSec polic...

Page 268: ...ertificate IPSec Security Method This group of fields is a must for IPSec Tunnels and L2TP with IPSec Policy Medium AH Authentication Header means data will be authenticated but not be encrypted By default this option is active High ESP Encapsulating Security Payload means payload data will be encrypted and authenticated Select from below DES without Authentication Use DES encryption algorithm and...

Page 269: ...se 2 proposal To propose the local available algorithms to the VPN peers and get its feedback to find a match Three combinations are available for both modes We suggest you select the combination that covers the most algorithms IKE phase 1 key lifetime For security reason the lifetime of key should be defined The default value is 28800 seconds You may specify a value in between 900 and 86400 secon...

Page 270: ...o trigger an IPSec VPN connection through Internet L2TP with IPSec Policy Allow the remote dial in user to make a L2TP VPN connection through the Internet You can select to use L2TP alone or with IPSec Select from below None Do not apply the IPSec policy Accordingly the VPN connection employed the L2TP without IPSec policy can be viewed as one pure L2TP connection Nice to Have Apply the IPSec poli...

Page 271: ...igital Signature X 509 can be set when you select IPSec tunnel either with or without specify the IP address of the remote node Pre Shared Key Check the box of Pre Shared Key to invoke this function and type in the required characters 1 63 as the pre shared key Digital Signature X 509 Check the box of Digital Signature to invoke this function and select one predefined Profiles set in the VPN and R...

Page 272: ...outer during the IPCP negotiation phase If the PPP IP address is fixed by remote side specify the fixed IP address here Do not change the default value if you do not select PPTP or L2TP Remote Gateway IP This field is only applicable when you select PPTP or L2TP with or without IPSec policy above The default value is 0 0 0 0 which means the Vigor router will get a remote Gateway PPP IP address fro...

Page 273: ...net to remote network you have to do If the remote network only allows you to dial in with single IP please choose NAT otherwise choose Route Change default route to this VPN tunnel Check this box to change the default route with this VPN tunnel Note that this setting is available only for one WAN interface is enabled It is not available when both WAN interfaces are enabled 2 After finishing all t...

Page 274: ...iant with all WAN modes single multi Dial out connection types contain IPSec PPTP L2TP and L2TP over IPSec depends on hardware specification The web page is simple to understand and easy to configure Filly compliant with VPN Server LAN Sit Single Multi Network Mail Alert support please refer to System Maintenance SysLog Mail Alert for detailed configuration Syslog support please refer to System Ma...

Page 275: ...UST and so on Member2 Display the dial out profile selected from the Member2 drop down list below Advanced This button is available only when LAN to LAN profile or more is created Detailed information for this dialog see later section Advanced Backup General Setup Status After choosing one of the profile listed above please click Enable to activate this profile If you click Disable the selected or...

Page 276: ...e corresponding members LAN to LAN profiles grouped in the deleted VPN TRUNK profile will be released and that profiles in LAN to LAN will be displayed in black T Ti im me e f fo or r a ac ct ti iv va at ti in ng g V VP PN N T TR RU UN NK K V VP PN N B Ba ac ck ku up p m me ec ch ha an ni is sm m p pr ro of fi il le e VPN TRUNK VPN Backup mechanism will be activated automatically after the initial...

Page 277: ...rofiles from Member1 drop down list choose one of the LAN to LAN profiles from Member2 drop down list and click Add at last 4 Take a look for LAN to LAN profiles Index 1 is chosen as Member1 index 2 is chosen as Member2 For such reason LAN to LAN profiles of 1 and 2 will be expressed in red to indicate that they are fixed If you delete the VPN TRUNK VPN Backup mechanism profile the selected LAN to...

Page 278: ... Advanced for more detailed configuration Available settings are explained as follows Item Description Profile Name List the backup profile name ERD Mode ERD means Environment Recovers Detection Normal choose this mode to make all dial out VPN TRUNK backup profiles being activated alternatively Resume when VPN connection breaks down or disconnects Member 1 will be the top priority for the system t...

Page 279: ...l General Mode This filed displays the profile configured in LAN to LAN with Index number and VPN Server IP address The VPN connection built by General Mode does not support VPN backup function Backup Mode This filed displays the profile name saved in VPN TRUNK Management with Index number and VPN Server IP address The VPN connection built by Backup Mode supports VPN backup function Dial Click thi...

Page 280: ... certificates and set trusted CA certificates Remember to adjust the time of Vigor router before using the certificate so that you can get the correct valid period of certificate Below shows the menu items for Certificate Management 3 3 1 12 2 1 1 L Lo oc ca al l C Ce er rt ti if fi ic ca at te e Available settings are explained as follows Item Description Generate Click this button to open Genera...

Page 281: ...tive name type and relational settings for subject name Then click GENERATE again Note Please be noted that Common Name must be configured with rotuer s WAN IP or domain name After clicking GENERATE the generated information will be displayed on the window below ...

Page 282: ...fication information There are three types of local certificate supported by Vigor router Available settings are explained as follows Item Description Upload Local Certificate It allows users to import the certificate which is generated by vigor router and signed by CA server If you have done well in certificate generation the Status of the certificate will be shown as OK Upload PKCS12 Certificate...

Page 283: ...s And the password is needed if the private key is encrypted REFRESH Click this button to refresh the information listed below View Click this button to view the detailed settings for certificate request Note You have to copy the certificate request information from above window Next access your CA server and enter the page of certificate request copy the information into it and submit a request A...

Page 284: ...lick IMPORT to open the following window Use Browse to find out the saved text file Then click Import The one you imported will be listed on the Trusted CA Certificate window Then click Import to use the pre saved file For viewing each trusted CA certificate click View to open the certificate detail information window If you want to delete a CA certificate choose the one and click Delete to remove...

Page 285: ...rted SIP is an end to end signaling protocol that establishes user presence and mobility in VoIP structure Every one who wants to talk using his her SIP Uniform Resource Identifier SIP Address The standard format of SIP URI is sip user password host port Some fields may be optional in different use In general host refers to a domain The userinfo includes the user field the password field and the s...

Page 286: ...ead of that you will only have to using dial plan or directly dial your friend s account name if you are with the same SIP Registrar Peer to Peer Before calling you have to know your friend s IP Address The Vigor VoIP Routers will build connection between each other Our Vigor V models firstly apply efficient codecs designed to make the best use of available bandwidth but Vigor V models also equip ...

Page 287: ...ion established vigor router A will send SAS voice prompt to A and vigor router B will send the SAS voice prompt to B 2 Then the RTP traffic is secured until the call ends 3 If vigor router A wants to call vigor router B again next time both A and B will not hear any voice prompt again even checking Enable SAS Voice Prompt on web UI It means only the first call between them will have voice prompt ...

Page 288: ...phonebook for you to store all your friends and family members SIP addresses Loop through and Backup Phone Number will be displayed if you are using Vigor2830Vn for setting the phone book Click any index number to display the dial plan setup page Available settings are explained as follows Item Description Enable Click this to enable this entry Phone Number The speed dial number of this index This...

Page 289: ... obstructs or the Internet breaks down for some reasons the backup phone will be dialed out to replace the VoIP phone number At this time the phone call will be changed from VoIP phone into PSTN call according to the loop through direction chosen Note that during the phone switch the blare of phone will appear for a short time And when the VoIP phone is switched into the PSTN phone the telecom co ...

Page 290: ... When you choose this mode the OP number will be added with the prefix number for calling out through the specific VoIP interface Strip When you choose this mode the OP number will be deleted by the prefix number for calling out through the specific VoIP interface Take the above picture Prefix Table Setup web page as an example the OP number of 886 will be deleted completely for the prefix number ...

Page 291: ...the prefix number settings here Max Len Set the maximum length of the dial number for applying the prefix number settings Route Choose the one that you want to enable the prefix number settings from the saved SIP accounts Please set up one SIP account first to make this interface available This item will be changed according to the port settings configured in VoIP Phone Settings Move UP Move Down ...

Page 292: ...oute All means all the phone calls will be blocked with such mechanism Index 1 15 in Schedule Enter the index of schedule profiles to control the call barring according to the preconfigured schedules Refer to section Applications Schedule for detailed configuration Additionally you can set advanced settings for call barring such as Block Anonymous Block Unknown Domain or Block IP Address Simply cl...

Page 293: ...gh Phone port from unrecognized domain that is not specified in SIP accounts Such control also can be done based on preconfigured schedules For Block IP Address this function can block incoming calls through Phone port coming from IP address Such control also can be done based on preconfigured schedules ...

Page 294: ...l Return In You have finished an incoming phone call however you want to call back again for some reason Please dial number typed in this field to call back to that one Last Call Return Out Dial the number typed in this field to call the previous outgoing phone call again Call Forward All Act Dial the number typed in this field to forward all the incoming calls to the specified place Call Forward ...

Page 295: ...ped in this field to release this function Block Unknown Domain Act Dial the number typed in this field to block all the incoming calls from unknown domain Block Unknown Domain Deact Dial the number typed in this field to release this function Block IP Calls Act Dial the number typed in this filed to block all the incoming calls from IP address Block IP Calls Deact Dial the number typed in this fi...

Page 296: ...register with Registrar using AuthorizationUser Domain Realm After that your call will be bypassed by SIP Proxy to the destination using AccountName Domain Realm as identity Note Selection items for Ring Port will differ according to the router you have Available settings are explained as follows Item Description Index Click this link to access into next page for setting SIP account Profile Displa...

Page 297: ...f the STUN server External IP Type in the gateway IP address SIP PING interval The default value is 150 sec It is useful for a Nortel server NAT Traversal Support Click any index link to access into the following page for configuring SIP account Available settings are explained as follows Item Description Profile Name Assign a name for this profile for identifying You can type similar name with th...

Page 298: ...n e g nat draytel org 5065 Act as Outbound Proxy Check this box to make the proxy acting as outbound proxy Display Name The caller ID that you want to be displayed on your friend s screen Account Number Name Enter your account name of SIP Address e g every text before Authentication ID Check the box to invoke this function and enter the name or number used for SIP Authorization with SIP Registrar ...

Page 299: ...ls do not receive any response they will be forwarded to the SIP URL by the time out SIP URL Type in the SIP URL e g aaa draytel org or abc iptel org as the site for call forwarded Time Out Set the time out for the call forwarding The default setting is 30 sec Ring Port Set Phone 1 and or Phone 2 as the default ring port s for this SIP account Ring Pattern Choose a ring tone type for the VoIP phon...

Page 300: ...ctive Detector This function can detect if the voice on both sides is active or not If not the router will do something to save the bandwidth for other using Click On to invoke this function click off to close the function 3 3 1 13 3 3 3 P Ph ho on ne e S Se et tt ti in ng gs s This page allows user to set phone settings for Phone 1 and Phone 2 respectively However it changes slightly according to...

Page 301: ...an click the number below the Index field to change SIP account for each phone port DTMF Relay Display DTMF mode that configured in the advanced settings page of Phone Index RTP Symmetric RTP Check this box to invoke the function To make the data transmission going through on both ends of local router and remote router not misleading due to IP lost for example sending data from the public IP of re...

Page 302: ...d automatically T 38 Fax Function Check the box to enable T 38 fax function Error Correction Mode choose a mode for error correction DND Do Not Disturb mode Set a period of peace time without disturbing by VoIP phone call During the period the one who dial in will listen busy tone yet the local user will not listen any ring tone Index 1 15 in Schedule Enter the index of schedule profiles to contro...

Page 303: ...addition you can press the Advanced button to configure tone settings volume gain MISC and DTMF mode Advanced setting is provided for fitting the telecommunication custom for the local area of the router installed Wrong tone settings might cause inconvenience for users To set the sound pattern of the phone set simply choose a proper region to let the system find out the preset tone settings and ca...

Page 304: ...e larger of the number the louder the volume is MISC Dial Tone Power Level This setting is used to adjust the loudness of the dial tone The smaller the number is the louder the dial tone is It is recommended for you to use the default setting Ring Frequency This setting is used to drive the frequency of the ring tone It is recommended for you to use the default setting Call Waiting Tone Power Leve...

Page 305: ... the accuracy of DTMF tone SIP INFO Choose this one then the Vigor will capture the DTMF tone and transfer it into SIP form Then it will be sent to the remote end with SIP message Payload Type rfc2833 Type a number from 96 to 127 the default value was 101 This setting is available for the OutBand RFC2833 mode 3 3 1 13 3 4 4 S St ta at tu us s From this page you can find codec connection and other ...

Page 306: ... Indicates the voice codec employed by present channel PeerID The present in call or out call peer ID the format may be IP or Domain Elapse The format is represented as hours minutes seconds Tx Pkts Total number of transmitted voice packets during this connection session Rx Pkts Total number of received voice packets during this connection session Rx Losts Total number of lost packets during this ...

Page 307: ...The Vigor wireless routers are equipped with a wireless LAN interface compliant with the standard IEEE 802 11n draft 2 protocol To boost its performance further the Vigor Router is also loaded with advanced wireless technology to lift up data rate up to 300 Mbps Hence you can finally smoothly enjoy stream music and video Note The actual data throughput will vary according to the network conditions...

Page 308: ...ta encryption while WPA2 applies AES The WPA Enterprise combines not only encryption but also authentication Since WEP has been proved vulnerable you may consider using WPA for the most secure connection You should select the appropriate security mechanism according to your needs No matter which security suite you select they all will enhance the over the air data protection and or privacy on your...

Page 309: ...tem Description Enable Wireless LAN Check the box to enable wireless function Mode At present the router can connect to 11n Only 11g Only 11b Only Mixed 11b 11g Mixed 11a 11n Mixed 11g 11n and Mixed 11b 11g 11n stations simultaneously Simply choose Mixed 11b 11g 11n mode or In which 802 11b g operates on 2 4G band 802 11a operates on 5G band and 802 11n operates on either 2 4G or 5G band Channel M...

Page 310: ...t usage In default the first set of SSID will be enabled You can hide it for your necessity SSID Means the identification of the wireless LAN SSID can be any text numbers or various special characters The default SSID is DrayTek We suggest you to change it Isolate VPN Check this box to make the wireless clients stations with different VPN not accessing for each other Member Check this box to make ...

Page 311: ...e it The default security mode is Mixed WPA WPA2 PSK Default Pre Shared Key PSK is provided and stated on the label pasted on the bottom of the router For the wireless client who wants to access into Internet through such router please input the default PSK value for connection By clicking the Security Settings a new web page will appear so that you could configure the settings of WPA and WEP Avai...

Page 312: ... WPA WPA2 802 1x only Accepts WPA and WPA2 clients simultaneously and the encryption key is obtained dynamically from RADIUS server with 802 1X protocol WPA PSK Accepts only WPA clients and the encryption key should be entered in PSK WPA2 PSK Accepts only WPA2 clients and the encryption key should be entered in PSK Mixed WPA WPA2 PSK Accepts WPA and WPA2 clients simultaneously and the encryption k...

Page 313: ...ers such as ABCDEFGHIJKLM or 26 hexadecimal digits leading by 0x such as 0x4142434445464748494A4B4C4D All wireless devices must support the same WEP encryption bit size and have the same key Four keys can be entered here but only one key can be selected at a time The keys can be entered in ASCII or Hexadecimal Check the key you wish to use After finishing all the settings here please click OK to s...

Page 314: ...em Description Enable Mac Address Filter Select to enable the MAC Address filter for wireless LAN identified with SSID 1 to 4 respectively All the clients expressed by MAC addresses listed in the box can be grouped under different wireless LAN For example they can be grouped under SSID 1 and SSID 2 at the same time if you check SSID 1 and SSID 2 MAC Address Filter Display all MAC addresses that ar...

Page 315: ...ith WPS supported It is the simplest way to build connection between wireless network clients and vigor router Users do not need to select any encryption mode and type any long encryption passphrase to setup a wireless client every time He she only needs to press a button on wireless client and WPS will connect for client and router automatically There are two methods to do network connection thro...

Page 316: ...vide the PIN code of the wireless client you wish to connect to the vigor router For WPS is supported in WPA PSK or WPA2 PSK mode if you do not choose such mode in Wireless LAN Security you will see the following message box Please click OK and go back Wireless LAN Security to choose WPA PSK or WPA2 PSK mode and access WPS again ...

Page 317: ...ode of the router Only WPA2 PSK and WPA PSK support WPS Configure via Push Button Click Start PBC to invoke Push Button style WPS setup procedure The router will wait for WPS requests from wireless clients about two minutes The WPS LED on the router will blink fast when WPS is in progress It will return to normal condition after two minutes You need to setup WPS within two minutes Configure via Cl...

Page 318: ...two WDS modes are implemented in Vigor router One is Bridge the other is Repeater Below shows the function of WDS bridge interface The application for the WDS Repeater mode is depicted as below The major difference between these two modes is that while in Repeater mode the packets received from one peer AP can be repeated to another peer AP through WDS links Yet in Bridge mode packets received fro...

Page 319: ...ected to Bridge 2 through WDS links However hosts connected to Bridge 1 CANNOT communicate with hosts connected to Bridge 3 through Bridge 2 Click WDS from Wireless LAN menu The following page will be shown Available settings are explained as follows Item Description Mode Choose the mode for WDS setting Disable mode will not ...

Page 320: ... ASCII characters or 64 hexadecimal digits leading by 0x Bridge If you choose Bridge as the connecting mode please type in the peer MAC address in these fields Four peer MAC addresses are allowed to be entered in this page at one time Yet please disable the unused link to get better performance If you want to invoke the peer MAC address remember to check Enable box in the front of the MAC address ...

Page 321: ...ter will use 20Mhz or 40Mhz for data transmission and receiving according to the station capability Such channel can increase the performance for data transit Guard Interval It is to assure the safety of propagation delays and reflections for the sensitive digital data If you choose auto as guard interval the AP router will choose short guard interval increasing the wireless performance or long gu...

Page 322: ... support this feature and invoke the function too Note Vigor N61 wireless adapter supports this function Therefore you can use and install it into your PC for matching with Packet OVERDRIVE refer to the following picture of Vigor N61 wireless utility window choose Enable for TxBURST on the tab of Option Note means the real transmission rate depends on the environment of the network ...

Page 323: ...are explained as follows Item Description WMM Capable To apply WMM parameters for wireless data transmission please click the Enable radio button APSD Capable The default setting is Disable Aifsn It controls how long the client waits for each data transmission Please specify the value ranging from 1 to 15 Such parameter will influence the time delay for WMM accessing categories For the service of ...

Page 324: ...the box means the AP router will answer the response request while transmitting WMM packets through wireless connection It can assure that the peer must receive the WMM packets Check the box means the AP router will not answer any response request for the transmitting packets It will have better performance with lower reliability 3 3 1 14 4 9 9 A AP P D Di is sc co ov ve er ry y Vigor router can s...

Page 325: ... shown on the box above this button Statistics It displays the statistics for the channels used by APs Add to If you want the found AP applying the WDS settings please type in the AP s MAC address on the bottom of the page and click Bridge or Repeater Next click Add to Later the MAC address of the AP will be added to Bridge or Repeater field of WDS settings page ...

Page 326: ... with its status code There is a code summary below for explanation For convenient Access Control you can select a WLAN station and click Add to Access Control below Available settings are explained as follows Item Description Refresh Click this button to refresh the status of station list Add Click this button to add current typed MAC address into Access Control ...

Page 327: ... 30 000 kbps All the wireless stations share the bandwidth for uploading without exceeding the valued typed here Total Download Limit Default value is 30 000 kbps All the wireless stations share the bandwidth for downloading without exceeding the valued typed here Per Station Limit If you choose Per Station Limit the router will offer the bandwidth for each wireless station based on the values con...

Page 328: ...determines the general configuration for SSL VPN Server and SSL Tunnel Available settings are explained as follows Item Description Port Such port is set for SSL VPN server It will not affect the HTTPS Port configuration set in System Maintenance Management In general the default setting is 443 Server Certificate When the client does not set any certificate default certificate will be used for HTT...

Page 329: ...roxy will allow the remote users to access the internal web sites over SSL Each item is explained as follows Item Description Name Display the name of the profile that you create URL Display the URL Active Display current status active or inactive of such profile Click number link under Index filed to set detailed configuration Available settings are explained as follows Item Description Name Type...

Page 330: ...gured behind vigor router 2 web server gateway must be indicated to vigor router In addition users must execute Connect manually in SSL Client Portal page SSL if you choose such selection web proxy over SSL will be applied for VPN After finishing all the settings here please click OK to save the configuration 3 3 1 15 5 3 3 S SS SL L A Ap pp pl li ic ca at ti io on n It provides a secure and flexi...

Page 331: ...k the box to enable such profile Application Name Type a name for such application The length of the name is limited to 23 characters Application There are three types offered for you to create an application profile Virtual Network Computing VNC It allows you to access and control a remote PC through VNC protocol Remote Desktop Protocol RDP It allows you to access and control a remote PC through ...

Page 332: ...00 Idle Timeout If you choose VNC you have to specify the time for disconnecting the SSL VPN tunnel Scaling If you choose VNC you have to choose the percentage 100 80 60 for such application Screen Size If you choose RDP you have to choose the screen size for such application Samba Path If you choose Samba you have to specify the path of the Samba service 3 Enter the required information 4 After f...

Page 333: ...e The SSL technology is the same as the encryption that you use for secure web sites such as your online bank The SSL VPN can be operated in either full tunnel mode or proxy mode Now Vigor2830 series allows up to 16 simultaneous incoming users For SSL VPN identity authentication and power management are implemented through deploying user accounts Therefore the user account for SSL VPN must be set ...

Page 334: ... in user to make an IPSec VPN connection through Internet L2TP with IPSec Policy Allow the remote dial in user to make a L2TP VPN connection through the Internet You can select to use L2TP alone or with IPSec Select from below None Do not apply the IPSec policy Accordingly the VPN connection employed the L2TP without IPSec policy can be viewed as one pure L2TP connection Nice to Have Apply the IPS...

Page 335: ... Click this button to let multicast packets pass through the router Block This is default setting Click this button to let multicast packets be blocked by the router Subnet Chose one of the subnet selections for such VPN profile Assign Static IP Address Please type a static IP address for the subnet you specified User Name This field is applicable when you select PPTP or L2TP with or without IPSec...

Page 336: ... specify the remote node Check the Medium DES 3DES or AES box as the security method Medium Authentication Header AH means data will be authenticated but not be encrypted By default this option is invoked You can uncheck it to disable it High Encapsulating Security Payload ESP means payload data will be encrypted and authenticated You may select encryption algorithm from Data Encryption Standard D...

Page 337: ...h profiles will be used by applications such as User Management VPN and etc Each item is explained as follows Item Description Set to Factory Default Click to clear all indexes Index Display the number of the client which connecting to FTP server Name Display the name of the group profile Click any index number link to open the following page for detailed configuration ...

Page 338: ... account profiles in VPN and Remote Access Remote Dial In User The enabled profiles will be listed in the Available User Account on the left box To add a profile into a group simply choose the one from the left box and click the button It will be displayed in the Selected User Account on the right box For detailed information about configuring the profile setting refer to Objects Setting IP Group ...

Page 339: ...cess into DrayTek SSL VPN portal interface Next users can open SSL VPN Online Status to view logging status of SSL VPN Available settings are explained as follows Item Description Active User Display current user who visit SSL VPN server Host IP Display the IP address for the host Time out Display the time remaining for logging out Action You can click Drop to drop certain login user from the rout...

Page 340: ...gs s This page will determine the number of concurrent FTP connection default charset for FTP server and enable Samba service At present the Vigor router can support USB storage disk with formats of FAT16 and FAT32 only Therefore before connecting the USB storage disk into the Vigor router please make sure the memory format for the USB storage disk is FAT16 or FAT32 It is recommended for you to us...

Page 341: ...ame can have as many as 15 characters and the host name can have as many as 23 characters Both them cannot contain any of the following Workgroup Name Type a name for the workgroup Host Name Type the host name for the router After finished the above settings click OK to save the configuration 3 3 1 16 6 2 2 U US SB B U Us se er r M Ma an na ag ge em me en nt t This page allows you to set profiles ...

Page 342: ...ord is specified for accessing into web pages of Vigor router only Also it is reserved for FTP firmware upgrade usage Note FTP Passive mode is not supported by Vigor Router Please disable the mode on the FTP client Password Type the password for FTP Samba users for accessing FTP server Later you can open FTP client software and type the password specified here for accessing into USB storage disk C...

Page 343: ...such profile Any user who uses such profile for accessing into USB storage disk must follow the rule specified here File Check the items Read Write and Delete for such profile Directory Check the items List Create and Remove for such profile Before you click OK you have to insert a USB storage disk into the USB interface of the Vigor router Otherwise you cannot save the configuration ...

Page 344: ...router Available settings are explained as follows Item Description Refresh Click this icon to refresh files list Back Click this icon to return to the upper directory Create Click this icon to add a new folder Current Path Display current folder Upload Click this button to upload the selected file to the USB storage disk The uploaded file in the USB diskette can be shared for other user through F...

Page 345: ...ained as follows Item Description Connection Status If there is no USB storage disk connected to Vigor router No Disk Connected will be shown here Disk Capacity It displays the total capacity of the USB storage disk Free Capacity It displays the free space of the USB storage disk Click Refresh at any time to get new status for free capacity Index It displays the number of the client which connecti...

Page 346: ...orted by Vigor router 3 3 1 17 7 S Sy ys st te em m M Ma ai in nt te en na an nc ce e For the system setup there are several items that you have to know the way of configuration Status TR 069 Admin Password User Password Login Page Greeting Configuration Backup Syslog Mail Alert Time and Date SNMP Management Reboot System Firmware Upgrade and Activation Below shows the menu items for System Mainte...

Page 347: ...re explained as follows Item Description Model Name Display the model name of the router Firmware Version Display the firmware version of the router Build Date Time Display the date and time of the current firmware build LAN MAC Address Display the MAC address of the LAN Interface IP Address Display the IP address of the LAN interface Subnet Mask Display the subnet mask address of the LAN interfac...

Page 348: ...WLAN miniPCi card This also helps to provide availability of some features that are bound with some WLAN miniPCi SSID Display the SSID of the router WAN Link Status Display current connection status MAC Address Display the MAC address of the WAN Interface Connection Display the connection type IP Address Display the IP address of the WAN interface Default Gateway Display the assigned IP address of...

Page 349: ... interface for the router connecting to ACS server ACS Server URL Username Password Such data must be typed according to the ACS Auto Configuration Server you want to link Please refer to Auto Configuration Server user s manual for detailed information CPE Client Such information is useful for Auto Configuration Server Enable Disable Allow Deny the CPE Client to connect with Auto Configuration Ser...

Page 350: ... port number of the STUN server Minimum Keep Alive Period If STUN is enabled the CPE must send binding request to the server for the purpose of maintaining the binding in the Gateway Please type a number as the minimum period The default setting is 60 seconds Maximum Keep Alive Period If STUN is enabled the CPE must send binding request to the server for the purpose of maintaining the binding in t...

Page 351: ...n Add After typing the user name and password above simply click it to create a new local user The new one will be shown on the Local User List immediately Edit If the username listed on the box above is not satisfied simply click the username and modify it on the field of User Name Later click Edit to update the information Delete If the local user listed on the box above is not satisfied simply ...

Page 352: ...ferent with full web user interface accessed by using the administrator password Password Type in new password in this field Confirm Password Type in the new password again Set to Factory Default Click to return to the factory default setting When you click OK the login window will appear Please use the new password to access into the web user interface again Below shows an example for accessing i...

Page 353: ...41 3 The following screen will appear Simply click OK 4 Log out Vigor router Web user interface 5 The following window will be open to ask for username and password Type the new user password in the filed of Password and click Login ...

Page 354: ...ain screen with User Mode will be shown as follows Settings to be configured in User Mode will be less than settings in Admin Mode Only basic configuration settings will be available in User Mode and can be configured as same as in Admin Mode ...

Page 355: ...ollows Item Description Enable Check this box to enable the login customization function Login Page Title Type a brief description e g Welcome to DrayTek which will be shown on the heading of the login dialog Welcome Message and Bulletin Type words or sentences here It will be displayed for bulletin message In addition it can be displayed on the login dialog at the bottom Note that do not type URL...

Page 356: ...h he e C Co on nf fi ig gu ur ra at ti io on n Follow the steps below to backup your configuration 1 Go to System Maintenance Configuration Backup The following windows will be popped up as shown below 2 Click Backup button to get into the following dialog Click Save button to open another dialog for saving configuration as a file ...

Page 357: ... windows but the backup function is still available Note Backup for Certification must be done independently The Configuration Backup does not include information of Certificate R Re es st to or re e C Co on nf fi ig gu ur ra at ti io on n 1 Go to System Maintenance Configuration Backup The following windows will be popped up as shown below 2 Click Browse button to choose the correct configuration...

Page 358: ...to save the log to Syslog server Check USB Disk to save the log to the attached USB storage disk Router Name Display the name for such router configured in System Maintenance Management If there is no name here simply lick the link to access into System Maintenance Management to set the router name Server IP Address The IP address of the Syslog server Destination Port Assign a port for the Syslog ...

Page 359: ...entication Check this box to activate this function while using e mail application User Name Type the user name for authentication Password Type the password for authentication Enable E mail Alert Check the box to send alert message to the e mail box while the router detecting the item s you specify here Click OK to save these settings For viewing the Syslog please do the following 1 Just set your...

Page 360: ...uld be inquired from Available settings are explained as follows Item Description Current System Time Click Inquire Time to get the current time Use Browser Time Select this option to use the browser time from the remote administrator PC host as router s system time Use Internet Time Select to inquire time information from Time Server on the ...

Page 361: ...ically Update Interval Select a time interval for updating from the NTP server Click OK to save these settings 3 3 1 17 7 9 9 S SN NM MP P This page allows you to configure settings for SNMP and SNMPV3 services The SNMPv3 is more secure than SNMP through the encryption method support AES and DES and authentication method support MD5 and SHA for the management needs Available settings are explained...

Page 362: ...setting is public Notification Host IP IPv4 Set the IPv4 address of the host that will receive the trap community Notification Host IP IPv6 Set the IPv6 address of the host that will receive the trap community Trap Timeout The default setting is 10 seconds Enable SNMPV3 Agent Check it to enable this function USM User USM means user based security mode Type a username which will be used for authent...

Page 363: ...nt Port Setup and External Device Control The management pages for IPv4 and IPv6 protocols are different F Fo or r I IP Pv v4 4 Available settings are explained as follows Item Description Router Name Type in the router name provided by ISP Default Disable Auto Logout The web user interface will not log out if it is enabled Internet Access Control Allow management from the Internet Enable the ...

Page 364: ...Apply To Choose the subnet s for the administrator to access Access List from the Internet You could specify that the system administrator can only login from a specific host or network defined in the list A maximum of three IPs subnet masks is allowed List IP Indicate an IP address allowed to login to the router Subnet Mask Represent a subnet mask allowed to login to the router Management Port Se...

Page 365: ...17 7 1 11 1 R Re eb bo oo ot t S Sy ys st te em m The Web user interface may be used to restart your router Click Reboot System from System Maintenance to open the following page Index 1 15 in Schedule Setup You can type in four sets of time schedule for performing system reboot All the schedules can be set previously in Applications Schedule web page and you can use the number that you have set i...

Page 366: ...l guide you to upgrade firmware by using an example Note that this example is running over Windows OS Operating System Download the newest firmware from DrayTek s web site or FTP site The DrayTek web site is www DrayTek com or local DrayTek s web site and FTP site is ftp DrayTek com Click System Maintenance Firmware Upgrade to launch the Firmware Upgrade Utility Click OK The following screen will ...

Page 367: ...e mechanism for your computer Click System Maintenance Activation to open the following page for accessing http myvigor draytek com Available settings are explained as follows Item Description Activate via Interface Choose WAN interface used by such device for activating Web Content Filter Activate The Activate link brings you accessing into www vigorpro com to finish the activation of the account...

Page 368: ...Vigor2830 Series User s Guide 356 Below shows the successful activation of Web Content Filter ...

Page 369: ...i ia al l o ou ut t T Tr ri ig gg ge er ri in ng g Click Diagnostics and click Dial out Triggering to open the web page The internet connection e g PPPoE is triggered by a package sending from the source IP address Available settings are explained as follows Item Description Decoded Format It shows the source IP address local destination IP remote address the protocol and length of the package Ref...

Page 370: ...Guide 358 3 3 1 18 8 2 2 R Ro ou ut ti in ng g T Ta ab bl le e Click Diagnostics and click Routing Table to open the web page or Available settings are explained as follows Item Description Refresh Click it to reload the page ...

Page 371: ...s Available settings are explained as follows Item Description Clear Click it to clear the whole table Refresh Click it to reload the page 3 3 1 18 8 4 4 I IP Pv v6 6 N Ne ei ig gh hb bo ou ur r T Ta ab bl le e The table shows a mapping between an Ethernet hardware address MAC Address and an IPv6 address This information is helpful in diagnosing network problems such as IP address conflicts etc Cl...

Page 372: ...is helpful in diagnosing network problems such as IP address conflicts etc Click Diagnostics and click DHCP Table to open the web page or Each item is explained as follows Item Description Index It displays the connection item number IP Address It displays the IP address assigned by this router for specified PC MAC Address It displays the MAC address for the specified PC that DHCP assigned IP addr...

Page 373: ...Click Diagnostics and click NAT Sessions Table to open the list page Available settings are explained as follows Item Description Private IP Port It indicates the source IP address and port of local PC Pseudo Port It indicates the temporary port of the router used for NAT Peer IP Port It indicates the destination IP address and port of remote host Interface It displays the representing number for ...

Page 374: ...click Ping Diagnosis to pen the web page or Available settings are explained as follows Item Description IPV4 IPV6 Choose the interface for such function Ping through Use the drop down list to choose the WAN interface that you want to ping through or choose Unspecified to be determined by the router automatically ...

Page 375: ...e window 3 3 1 18 8 8 8 D Da at ta a F Fl lo ow w M Mo on ni it to or r This page displays the running procedure for the IP address monitored and refreshes the data in an interval of several seconds The IP address listed here is configured in Bandwidth Management You have to enable IP bandwidth limit and IP session limit before invoke Data Flow Monitor If not a notification dialog box will appear ...

Page 376: ... speed of the monitored device RX rate kbps Display the receiving speed of the monitored device Sessions Display the session number that you specified in Limit Session web page Action Block can prevent specified PC accessing into Internet within 5 minutes Unblock the device with the IP address will be blocked in five minutes The remaining time will be shown on the session column Current Peak Speed...

Page 377: ...ing different traffic graph Click Refresh to renew the graph at any time The horizontal axis represents time Yet the vertical axis has different meanings For WAN1 WAN2 WAN3Bandwidth chart the numbers displayed on vertical axis represent the numbers of the transmitted and received packets in the past For Sessions chart the numbers displayed on vertical axis represent the numbers of the NAT sessions...

Page 378: ... trace the routes from router to the host Simply type the IP address of the host in the box and click Run The result of route trace will be shown on the screen or Available settings are explained as follows Item Description IPv4 IPv6 Click one of them to display corresponding information for it Trace through Use the drop down list to choose the interface that you want ...

Page 379: ...ation on the screen F Fo or r W We eb b S Sy ys sl lo og g This page displays the time and message for User Firewall call WAN VPN settings You can check Enable Web Syslog specify the type of Syslog and choose the display mode you want Later the event of Syslog with specified type will be shown for your reference Available settings are explained as follows Item Description Enable Web Syslog Check t...

Page 380: ... the system Time Display the time of the event occurred Message Display the information for each event F Fo or r U US SB B S Sy ys sl lo og g This page displays the syslog recorded on the USB storage disk Available settings are explained as follows Item Description Time Display the time of the event occurred Log Type Display the type of the record Message Display the information for each event ...

Page 381: ...onnects to tunnel broker successfully Available settings are explained as follows Item Description Refresh Click this link to refresh this page manually 3 3 1 19 9 E Ex xt te er rn na al l D De ev vi ic ce es s This page allows you to enable or disable the function of detecting external devices Available settings are explained as follows Item Description External Device Auto Discovery Check this b...

Page 382: ...Vigor2830 Series User s Guide 370 This page is left blank ...

Page 383: ... shows how to bind the functions of NAT and Bridge processed with one PVC From the above figure Setop Box and DHCP server can reach for each other through WAN5 with Bridge mode LAN PC in P1 beneath Vigor router can reach to PPPoE Server through WAN1 with NAT Both NAT and Bridge are built through the same Channel 1 Follow the steps listed below to configure the settings 1 Log into the web user inte...

Page 384: ...nable and set Channel 1 as Multi PVC channel set 0 and 88 for VPI and VCI type the username e g pppoeuser and the password 4 Click OK to save the settings 5 Open WAN Multi PVCs Click the General tab to check the box of Enable for the 5th WAN Note Only 5th WAN to 7th WAN can be used for PVC to PVC Binding ...

Page 385: ...tocol and select 1483 Bridged IP LLC as Encapsulation In this case we want to redirect PVC channel 5 to PVC channel 1 we have to choose 1 as PVC Binding Check the box of Add Tag and type 405 as the tag number 7 Click OK to save the settings 8 The PVC Binding and the Tag setting can also be seen in WAN Multi PVCs PVC to PVC Binding Add Tag page Note Channel 1 and Channel 2 are reserved for WAN1 ser...

Page 386: ...box of P4 All of the traffic coming from LAN Port 4 will be directed to channel 5 first and then to channel 1 10 Click OK to save the settings 11 Now all the data from P1 transmitted to the remote PPPoE server via WAN1 and the data from P4 IPTV transmitted to the remote DHCP Server via WAN 5 are all processed by Channel 1 ...

Page 387: ... divide the internal departments of a company into three different groups Each group uses different network segment See the following graphic for an example Group 0 VLAN0 Human Resource LAN Port 1 IP 192 168 1 0 24 Group 1 VLAN1 Finance Dept LAN Port 2 IP 192 168 3 0 24 Group 2 VLAN2 Sales Dept LAN Port 3 Port 4 IP 192 168 5 0 24 Configuration 1 In the page of LAN VLAN Configuration check the box ...

Page 388: ...etwork segment The equipment connecting to Vigor2830 LAN Port 1 LAN1 can get the IP address of 192 168 1 0 24 The equipment connecting to Vigor2830 LAN Port 2 LAN2 can get the IP address of 192 168 3 0 24 The equipment connecting to Vigor2830 LAN Port 3 and Port 4 LAN3 can get the IP address of 192 168 5 0 24 For the detailed settings of the network segment open LAN General Setup and click Details...

Page 389: ... s Guide 377 6 To make any two of VLAN groups linked with each other just check the boxes of the ones in the field of Inter LAN Routing in the page of LAN General Setup Refer to the following figure LAN2 and LAN3 are linked ...

Page 390: ... Resource LAN Port 4 IP 192 168 1 0 24 Group 1 VLAN1 Finance Dept LAN Port 4 IP 192 168 3 0 24 Group 2 VLAN2 Sales Dept LAN Port 4 IP 192 168 5 0 24 Group 3 VLAN3 R D LAN Port 4 IP 192 168 7 0 24 Configuration for Vigor2830 1 In the page of LAN VLAN Configuration check the box of Enable to enable the function of VLAN Configuration 2 To activate the function of VLAN Tag for VLAN0 setting check the ...

Page 391: ...e 10 for VID setting Then check P4 and set LAN4 as the Subnet 6 In the page of LAN General Setup check the Status box of LAN2 LAN3 and LAN4 and enable the function of DHCP For the detailed settings of the network segment open LAN General Setup and click Details Page Adjust the settings for your request Refer to the following figure ...

Page 392: ...e 2830 VID9 Port Members 17 23 VLAN Name 2830 VID10 Port Members 18 23 3 Open Vlan Ports and set the VID value with role for each Port Port 15 VID 7 Role Access Port 16 VID 8 Role Access Port 17 VID 9 Role Access Port 18 VID 10 Role Access Port 23 VID 1 Role Trunk Port 23 is set with Trunk in this example and will transfer the packets with VLAN Tag information That is packets with VID 7 8 9 and 10...

Page 393: ...e equipment connecting to VigorSwitch Port 16 can get the IP address of 192 168 3 0 24 The equipment connecting to VigorSwitch Port 17 can get the IP address of 192 168 5 0 24 The equipment connecting to VigorSwitch Port 18 can get the IP address of 192 168 7 0 24 5 To make any two of VLAN groups of Tag Based VLAN linked with each other just check the boxes of the ones in the field of Inter LAN Ro...

Page 394: ...ion operation the administer can control the files on USB storage device through USB Application File Explorer FTP Use common FTP utility Samba Invoke Samba service and use 192 168 1 1 to access into the USB storage device Files on USB storage device can be reviewed by opening USB Applicaiton File Explorer Below shows the example of getting files from FTP 1 Plug the USB device to the USB port on t...

Page 395: ...FTP Samba User account Here we add a new account user1 and assign authorities Read Write and List to it 4 Click OK to save the configuration 5 Make sure the FTP service is running properly Please open a browser and type ftp 192 168 1 1 Use the account user1 to login 6 When the following screen appears it means the FTP service is running properly ...

Page 396: ...mation for FTP server will be shown as below Now users in LAN of Vigor2830 can access into the USB storage device by typing ftp 192 168 1 1 on any browser They can add or remove files directories depending on the Access Rule for FTP account settings in USB Application USB User Management ...

Page 397: ...terface of Vigor router 2 Configure relational objects first Open Object Settings SMS Mail Server Object to get the following page Index 1 to Index 8 allows you to choose the built in SMS service provider If the SMS service provider is not on the list you can configure Index 9 and Index 10 to add the new service provider to Vigor router 3 Choose any index number e g Index 1 in this case to configu...

Page 398: ...rofile setting 5 Open Object Settings Notification Object to configure the event conditions of the notification 6 Choose any index number e g Index 1 in this case to configure conditions for sending the SMS In the following page type the name of the profile and check the Disconnected and Reconnected boxes for WAN to work in concert with the topic of this paper ...

Page 399: ...o choose SMS Provider and the Notify Profile specify the time of sending SMS Then type the phone number in the field of Recipient the one who will receive the SMS 9 Click OK to save the settings Later if one of the WAN connections fails in your router the system will send out SMS to the phone number specified If the router has only one WAN interface the system will send out SMS to the phone number...

Page 400: ...selected Then click OK to save the settings When such WAN e g WAN2 in this example disconnects due to some reason the system will use other WAN for connection instead and send SMS to notify the user destination number 123456789 However if there is no available WAN for connection the system will send SMS to inform the user after reconnecting WAN2 successfully ...

Page 401: ...eless users to get onto the cyber space anywhere at anytime In contrast to the real wireless user s advantage earn from hotspot the Wi Fi connection providers may also earn placement marketing advantage via Vigor2830n as offering wireless connection service at its hotspot With the smart easy configuration of WLAN on Vigor2830n the free riders of Wi Fi connection at hotspot would be automatically d...

Page 402: ...Setup 2 Check Enable Wireless LAN and set the SSID Then click OK to save the settings W Wi ir re el le es ss s P Po or rt ta al l L Lo og g i in n S Se et tt ti in ng g 1 Open LAN Web Portal Setup 2 Click Redirect to URL and type the URL in the field below User s first HTTP request will be redirected to the URL defined here Here we take www draytek com for an example ...

Page 403: ...less clients will be redirected to the specified web sites when they open the browser through the wireless environment set by the restaurant hotel shopping store and so on It can gain the result of advertisement effectively 4 Use a Notebook or mobile device supporting Wireless function to connect Vigor2830 via Wireless LAN 5 Try to open a new tab in the same browser for IE 7 0 FireFox and above or...

Page 404: ...Vigor2830 Series User s Guide 392 However if open another new tab again in the same browser the browser will open default page based on the default setting ...

Page 405: ...iz ze e Y Yo ou ur r L Lo og gi in n P Pa ag ge e Login page can be customized to fit the request of the administrator 1 Open User Management General Setup Set User Based as the Mode and click OK to save teh settings 2 Open User Management User Profile to create a new user profle ...

Page 406: ... this function Type a brief description e g Just for Carrie in the field of Login Page Title which will be shown on the heading of the login dialog Next click OK 5 Open a new tab in the same browser for IE 7 0 FireFox and above or open a new web browser 6 Try to access into the web user interface e g 192 168 1 1 of Vigor router Please note Just for Carrie is displayed as a heading on the login dia...

Page 407: ... User s Guide 395 7 After typing the username and password defined in User Management User Profile click Login You can access into Internet or access into the Landing Page if configured in User Management General Setup ...

Page 408: ...hown in the below illustration you may follow the steps to create a LAN to LAN profile These two networks LANs should NOT have the same network address Settings in Router A in headquarter 1 Go to VPN and Remote Access and select Remote Access Control to enable the necessary VPN service and click OK 2 Then For using PPP based services such as PPTP L2TP you have to set general settings in PPP Genera...

Page 409: ...User s Guide 397 3 Go to LAN to LAN Click on one index number to edit a profile 4 Set Common Settings as shown below You should enable both of VPN connections because any one of the parties may start the VPN connection ...

Page 410: ...od If an IPSec based service is selected you should further specify the remote peer IP Address IKE Authentication Method and IPSec Security Method for this Dial Out connection If a PPP based service is selected you should further specify the remote peer IP Address Username Password PPP Authentication and VJ Compression for this Dial Out connection ...

Page 411: ...ed you may further specify the remote peer IP Address IKE Authentication Method and IPSec Security Method for this Dial In connection Otherwise it will apply the settings defined in IPSec General Setup above If a PPP based service is selected you should further specify the remote peer IP Address Username Password and VJ Compression for this Dial In connection ...

Page 412: ...er B in the remote office 1 Go to VPN and Remote Access and select Remote Access Control to enable the necessary VPN service and click OK 2 Then for using PPP based services such as PPTP L2TP you have to set general settings in PPP General Setup For using IPSec based service such as IPSec or L2TP with IPSec Policy you have to set general settings in IPSec General Setup such as the pre shared key t...

Page 413: ...N connections because any one of the parties may start the VPN connection 5 Set Dial Out Settings as shown below to dial to connect to Router B aggressively with the selected Dial Out method If an IPSec based service is selected you should further specify the remote peer IP Address IKE Authentication Method and IPSec Security Method for this Dial Out connection ...

Page 414: ...pression for this Dial Out connection 6 Set Dial In settings to as shown below to allow Router A dial in to build VPN connection If an IPSec based service is selected you may further specify the remote peer IP Address IKE Authentication Method and IPSec Security Method for this Dial In connection Otherwise it will apply the settings defined in IPSec General Setup above ...

Page 415: ...urther specify the remote peer IP Address Username Password and VJ Compression for this Dial In connection 7 At last set the remote network IP subnet in TCP IP Network Settings so that Router B can direct the packets destined to the remote network to Router A via the VPN connection ...

Page 416: ...e as shown in the below illustration you may follow the steps to create a Remote User Profile and install Smart VPN Client on the remote host Settings in VPN Router in the enterprise office 1 Go to VPN and Remote Access and select Remote Access Control to enable the necessary VPN service and click OK 2 Then for using PPP based services such as PPTP L2TP you have to set general settings in PPP Gene...

Page 417: ...ttings to as shown below to allow the remote user dial in to build VPN connection If an IPSec based service is selected you may further specify the remote peer IP Address IKE Authentication Method and IPSec Security Method for this Dial In connection Otherwise it will apply the settings defined in IPSec General Setup above ...

Page 418: ...For Win2000 XP please use Network and Dial up connections or Smart VPN Client complimentary software to help you create PPTP L2TP and L2TP over IPSec tunnel You can find it in CD ROM in the package or go to www DrayTek com download center Install as instructed 2 After successful installation for the first time user you should click on the Step 0 Configure button Reboot the host 3 In Step 2 Connect...

Page 419: ...P based service is selected you should further specify the remote VPN server IP address Username Password and encryption method The User Name and Password should be consistent with the one set up in the VPN router To use default gateway on remote network means that all the packets of remote host will be directed to VPN server then forwarded to Internet This will make the remote host seem to be wor...

Page 420: ...sometimes works at home and takes care of children When working time he would use Vigor router at home to connect to the server in the headquarter office downtown via either HTTPS or VPN to check email and access internal database Meanwhile children may chat on Skype in the restroom 1 Go to Bandwidth Management Quality of Service 2 Click Setup link of WAN 1 2 3 Make sure the QoS Control on the lef...

Page 421: ...han the real bandwidth to ensure correct calculation of QoS It is suggested to set the bandwidth value for inbound outbound as 80 85 of physical network speed provided by ISP to maximize the QoS performance 4 Return to previous page Enter the Name of Index Class 1 by clicking Edit link Type the name E mail for Class 1 ...

Page 422: ...er will set reserved bandwidth e g 25 for E mail using protocol POP3 and SMTP 6 Return to previous page Enter the Name of Index Class 2 by clicking Edit link In this index the user will set reserved bandwidth for HTTPS And click OK 7 Click Setup link for WAN2 ...

Page 423: ...fluent other application Click OK 9 If the worker has connected to the headquarter using host to host VPN tunnel Please refer to Chapter 3 VPN for detail instruction he may set up an index for it Enter the Class Name of Index 3 In this index he will set reserved bandwidth for 1 VPN tunnel 10 Click Edit to open a new window ...

Page 424: ...412 11 Click Add to open the following window Check the ACT box first 12 Then click Edit of Local Address to set a worker s subnet address Click Edit of Remote Address to set headquarter s IP address Leave other fields and click OK ...

Page 425: ...tall the Router Tools The Firmware Upgrade Utility is included in the tools 1 Go to www DrayTek com 2 Access into Support Downloads Please find out Firmware menu and click it Search the model you have and click on it to download the newly update firmware for your router 3 Access into Support Downloads Please find out Utility menu and click it 4 Click on the link of Router Tools to download the fil...

Page 426: ...n Programs and choose Router Tools XXX Firmware Upgrade Utility 8 Type in your router IP usually 192 168 1 1 9 Click the button to the right side of Firmware file typing box Locate the files that you download from the company web sites You will find out two files with different extension names xxxx all keep the old custom settings and xxxx rst reset all the custom settings to default settings Choo...

Page 427: ...ware Note that this example is running over Windows OS Operating System 1 Download the newest firmware from DrayTek s web site or FTP site The DrayTek web site is www DrayTek com or local DrayTek s web site and FTP site is ftp DrayTek com 2 Click System Maintenance Firmware Upgrade 3 Select a firmware file by clicking Browse 4 Click Upgrade to perform the firmware upgrade ...

Page 428: ...416 4 4 1 11 1 R Re eq qu ue es st t a a c ce er rt ti if fi ic ca at te e f fr ro om m a a C CA A s se er rv ve er r o on n W Wi in nd do ow ws s C CA A S Se er rv ve er r 1 Go to Certificate Management and choose Local Certificate ...

Page 429: ...t Enter the information in the certificate request 3 Copy and save the X509 Local Certificate Requet as a text file and save it for later use 4 Connect to CA server via web browser Follow the instruction to submit the request Below we take a Windows 2000 CA server for example Select Request a Certificate ...

Page 430: ...est using a base64 encoded PKCS 7 file Import the X509 Local Certificate Requet text file Select Router Offline request or IPSec Offline request below Then you have done the request and the server now issues you a certificate Select Base 64 encoded certificate and Download CA certificate Now you should get a certificate cer file and save it ...

Page 431: ...tificate Click IMPORT button and browse the file to import the certificate cer file into Vigor router When finished click refresh and you will find the below window showing BEGINE CERTIFICATE 6 You may review the detail information of the certificate by clicking View button ...

Page 432: ...rt ti if fi ic ca at te e a an nd d S Se et t a as s T Tr ru us st te ed d o on n W Wi in nd do ow ws s C CA A S Se er rv ve er r 1 Use web browser connecting to the CA server that you would like to retrieve its CA certificate Click Retrive the CA certificate or certificate recoring list ...

Page 433: ...ed CA Certificate Click IMPORT button and browse the file to import the certificate cer file into Vigor router When finished click refresh and you will find the below illustration 4 You may review the detail information of the certificate by clicking View button Note Before setting certificate configuration please go to System Maintenance Time and Date to reset current time of the router first ...

Page 434: ...am Web Content Filter Anti Intrusion and etc to filtering the web pages for the sake of protecting your system To access into MyVigor for getting more information please create an account for MyVigor 4 4 1 13 3 1 1 C Cr re ea at ti in ng g a an n A Ac cc co ou un nt t v vi ia a V Vi ig go or r R Ro ou ut te er r 1 Click CSM Web Content Filter Profile The following page will appear Or Click System ...

Page 435: ...ies User s Guide 423 2 Click the Activate link A login page for MyVigor web site will pop up automatically 3 Click the link of Create an account now 4 Check to confirm that you accept the Agreement and click Accept ...

Page 436: ...Vigor2830 Series User s Guide 424 5 Type your personal information in this page and then click Continue 6 Choose proper selection for your computer and click Continue ...

Page 437: ...TART 8 Check to see the confirmation email with the title of New Account Confirmation Letter from myvigor draytek com 9 Click the Activate my Account link to enable the account that you created The following screen will be shown to verify the register process is finished Please click Login ...

Page 438: ...click Login Your account has been activated You can access into MyVigor server to activate the service e g WCF that you want 4 4 1 13 3 2 2 C Cr re ea at ti in ng g a an n A Ac cc co ou un nt t v vi ia a M My yV Vi ig go or r W We eb b S Si it te e 1 Access into http myvigor draytek com Find the line of Not registered yet Then click the link Click here to access into next page ...

Page 439: ...s User s Guide 427 2 Check to confirm that you accept the Agreement and click Accept 3 Type your personal information in this page and then click Continue 4 Choose proper selection for your computer and click Continue ...

Page 440: ...TART 6 Check to see the confirmation email with the title of New Account Confirmation Letter from myvigor draytek com 7 Click the Activate my Account link to enable the account that you created The following screen will be shown to verify the register process is finished Please click Login ...

Page 441: ... password that you just created in the fields of UserName and Password Then type the code in the box of Auth Code according to the value displayed on the right side of it Now click Login Your account has been activated You can access into MyVigor server to activate the service e g WCF that you want ...

Page 442: ...erface of the Vigor router 2 Open Applications Active Directory LDAP to get the following page for configuring LDAP related settings There are three types of bind type supported Simple Mode Just simply do the bind authentication without any search action Anonymous Perform a search action first with Anonymous account then do the bind authentication Regular Mode Mostly it is the same with anonymous ...

Page 443: ...Vigor2830 Series User s Guide 431 and 4 Click OK to save the settings above ...

Page 444: ...Profile Click index 3 to create a new user profile 7 Check Enable this account choose LDAP as External Server Authentication and check the user profile you want 8 After finished above configurations click OK to save the settings Now users belong to either rd1 or shrd group can access Internet after inputting their credentials on LDAP server ...

Page 445: ...or router 2 Open Applications Active Directory LDAP to get the following page for configuring LDAP related settings There are three types of bind type supported Simple Mode Just simply do the bind authentication without any search action Anonymous Perform a search action first with Anonymous account then do the bind authentication Regular Mode Mostly it is the same with anonymous mode The differen...

Page 446: ...Vigor2830 Series User s Guide 434 and 4 Click OK to save the settings above 5 Open User Management General Setup Select User Based as the Mode option ...

Page 447: ...check the profile s that will be authenticated with LDAP server Choose PAP Only as Dial In PPP Authentication 7 After finished above configurations click OK to save the settings Now users belong to either rd1 or shrd group can access Internet after inputting their credentials on LDAP server ...

Page 448: ...nto either 202 211 100 10 or 203 98 200 10 which IP or mapping is decided by the internal load balancing algorithm With address mapping feature you can manually configure any host mapping to any WAN interface to fit the request In the above example you can configure NAT Host 1 to always map to 202 211 100 10 WAN1 Host 2 to always map to 202 211 100 11 WAN1 alias Host 3 always map to 203 98 200 10 ...

Page 449: ... of WAN 1 to open the following page From the above figure set main WAN IP address as 202 211 100 10 Click the WAN IP Alias button to configure the other P address which is 202 211 100 11 Make sure Join IP NAT Pool is not checked Click OK to save the settings ...

Page 450: ...es User s Guide 438 4 After finished configuration for WAN1 open Load Balance Route Policy 5 Click Index number 1 and 2 to configure the details After finished the settings click OK to save the settings respectively ...

Page 451: ... User s Guide 439 And 6 Upon completing the above configuration you have specified the outgoing IP address es for some specific computers 7 Now you bind some specific computers to some WAN IP alias for outgoing traffic ...

Page 452: ...t ts s The following figure shows a simple application of load balance WAN1 and WAN2 can be used to access into Internet The PC in LAN1 can send the data to the remote PC through the specified WAN1 1 Access into web user interface of Vigor2830 series Open Load Balance Route Policy 2 From the following web page simply click index number 1 ...

Page 453: ...g page check Enable set Dest IP Start and Dest IP End with 203 65 1 35 and 203 65 1 35 choose WAN1 as the Interface click default gateway do not check Auto Failover To The Other WAN 4 After finished the above settings click OK to save the configuration ...

Page 454: ...Vigor2830 Series User s Guide 442 Now the packets sent to the remote PC IP address 203 65 1 35 will be forcefully to pass through WAN1 ...

Page 455: ... to factory default setting if necessary If all above stages are done and the router still cannot run normally it is the time for you to contact your dealer for advanced help 5 5 1 1 C Ch he ec ck ki in ng g I If f t th he e H Ha ar rd dw wa ar re e S St ta at tu us s I Is s O OK K o or r N No ot t Follow the steps below to verify the hardware status 1 Check the power line and WLAN LAN cable conne...

Page 456: ...stilled failed please do the steps listed below to make sure the network connection settings is OK F Fo or r W Wi in nd do ow ws s The example is based on Windows 7 Professional Edition As to the examples for other operation systems please refer to the similar steps or find support notes in www DrayTek com 1 Open All Programs Getting Started Control Panel Click Network and Sharing Center 2 In the ...

Page 457: ...or2830 Series User s Guide 445 4 Select Internet Protocol Version 4 TCP IP and then click Properties 5 Select Obtain an IP address automatically and Obtain DNS server address automatically Finally click OK ...

Page 458: ...uide 446 F Fo or r M Ma ac c O OS S 1 Double click on the current used Mac OS on the desktop 2 Open the Application folder and get into Network 3 On the Network screen select Using DHCP from the drop down list of Configure IPv4 ...

Page 459: ...outer correctly F Fo or r W Wi in nd do ow ws s 1 Open the Command Prompt window from Start menu Run 2 Type command for Windows 95 98 ME or cmd for Windows NT 2000 XP Vista The DOS command dialog will appear 3 Type ping 192 168 1 1 and press Enter If the link is OK the line of Reply from 192 168 1 1 bytes 32 time 1ms TTL 255 will appear 4 If the line does not appear please check the IP address set...

Page 460: ...f ff f You have to wait about 15 seconds after inserting 3G USB Modem into your Vigor2830 Later the USB LED will light on which means the installation of USB Modem is successful If the USB LED does not light on please remove and reinsert the modem again If it still fails restart Vigor2830 U US SB B L LE ED D l li ig gh ht ts s o on n b bu ut t t th he e n ne et tw wo or rk k c co on nn ne ec ct ti...

Page 461: ...ng g I If f N Ne ec ce es ss sa ar ry y Sometimes a wrong connection can be improved by returning to the default settings Try to reset the router by software or hardware Such function is available in Admin Mode only Warning After pressing factory default setting you will loose all settings you did before Make sure you have recorded all useful settings before you pressing The password of factory de...

Page 462: ...utton Then the router will restart with the default configuration After restore the factory default setting you can configure the settings for the router again to fit your personal request 5 5 7 7 C Co on nt ta ac ct ti in ng g D Dr ra ay yT Te ek k If the router still cannot work correctly after trying many efforts please contact your dealer for further help right away For any questions please fe...

Page 463: ... an isolate network but not a flexible way to maintain a growing network Because the idea of port based VLAN is grouping by physical ports but the difficulty is how to handle the traffics between two or more Ethernet switches Thus VLAN is suitable for some circumstances for example the rental apartment SOHO office and so on These clients may need two or three isolated networks only and setup a net...

Page 464: ... router Note Broadband router Vigor2920 Vigor3200 Vigor2925 Vigo2960 Vigor3900 Modem router Vigor2850 Vigor2860 V VL LA AN N P Pa ac ck ke et ts s o on n V Vi ig go or r r ro ou ut te er rs s Trunk mode of LAN Trunk Port can carry the packets with VID but replace the Non VID packet as the VID of Trunk port while forwarding the packets to another switch Bridge mode of WAN P1 and P2 are doing NAT fl...

Page 465: ...m is going to be introduced to you because it is the most stable and superfast booting system in DrayTek products If the UI style of yours is different from the following It may not DrayOS system with new web style or maybe the Linux like model WAN ...

Page 466: ...Vigor2830 Series User s Guide 454 LAN V VL LA AN N a ap pp pl li ic ca at ti io on ns s o on n V Vi ig go or r r ro ou ut te er r Multi Subnet VLAN of LAN ...

Page 467: ...rvers LAN1 LAN2 LAN3 LAN4 However the traffics of the LAN port or SSID that are NOT being grouped in the same VLAN are unable to forward to each other The benefit of Port based is able to extend the wired ports by installing a cheaper dumb switch as many as you need but Tag based offers you a flexible and well managed network The networks are isolated secured and reduce the broadcasting storm effe...

Page 468: ... which serves your guests the internet accessibility but the traffics have to be isolated from your private network due to the security considerations it can be done by above settings However a switch support VLAN function is need if VLAN Tag enabled Triple Play Multi WAN NAT mode with VLAN ...

Page 469: ...Vigor2830 Series User s Guide 457 Following settings the set top box STB is able to attach with any LAN port Video streaming which your ISP provided will be played on your monitor ...

Page 470: ...idge mode with VLAN Set top box STB or the other kinds of media devices are able to attach with Port4 or Port5 of LAN Those devices that attached with Port4 or Port5 are able to access the services network directly which your ISP provided ...

Page 471: ...ios Naming Packets Pass Block Firewall IPv6 Group IPv6 Object SNMP and Diagnostics Ping Diagnosis Improved Support to block Tor tunnel ver 0 2 3 25 hotspot shield with ver 3 19 telnet protocol by using putty or pietty and LINE app in 3 5 1 36 for PC version and in 4 1 1 version for mobile for APP Enforcement Improved Support block page for DNS filter Improved Add SSL VPN setting in VPN Server Wiza...

Page 472: ...e Brasilia GMT 03 00 Corrected SSH didn t work with Macintosh while it can work on Windows and Linux Corrected VigorACS SI couldn t show Network information when DNS Filter was enabled for Vigor2830 Corrected Some error on External Device Status page Corrected Remove Mhaha getMessenger IMUnitive Wablet from WebIM on CSM APP Enforcement Profile ...

Search results

Summary of Contents for Vigor2830 Series

Reviews:

Related manuals for Vigor2830 Series

Brands by name

Popular brands

Draytek Vigor2830 Series, User Manual

Search results

Summary of Contents for Vigor2830 Series

Reviews:

Related manuals for Vigor2830 Series

Brands by name

Popular brands