TRENDnet TW100-BRV324 User Manual Download Page 76

Page: 76 / 135

Broadband VPN Gateway User Guide

Connecting 2 LANs via VPN

Figure 45: Connecting 2 VPN Gateways

This allows two (2) LANs to be connected. PCs on each endpoint gain secure access to the remote LAN.

•

The 2 LANs MUST use different IP address ranges.

•

The VPN Policies at each end determine when a VPN tunnel will be established, and what systems on the remote LAN can be
accessed once the VPN connection is established.

•

It is possible to have simultaneous VPN connections to many remote sites.

Summary of Contents for TW100-BRV324

Page 1: ......

Page 2: ......

Page 3: ...verview 20 Windows Clients 20 Macintosh Clients 33 Linux Clients 33 Other Unix Systems 33 CHAPTER 5 OPERATION AND STATUS 34 Operation 34 Status Screen 34 Port Status 37 Event Log 38 URL Log 39 System...

Page 4: ...10 OTHER FEATURES SETTINGS 117 Overview 117 Diagnostics 118 Password Screen 120 Web Management 121 Firmware Upgrade 123 Backup Restore 124 APPENDIX A TROUBLESHOOTING 126 Overview 126 General Problems...

Page 5: ...local invalid IP Addresses are hidden from external sources This process is called NAT Network Address Translation Dual WAN Support Dual 10 100 WAN ports let you have a second link to your ISP providi...

Page 6: ...handle packets so that more important connections receive priority over less important one LAN Features 4 Port Switching Hub The Broadband VPN Gateway incorporates a 4 port 10 100BaseT switching hub...

Page 7: ...VPN Gateway incorporates protection against DoS attacks Rule based Policy Firewall To provide additional protection against malicious packets you can define your own firewall rules This can also be u...

Page 8: ...cable LAN Each port has 2 LEDs Link Act On Corresponding LAN hub port is active Off No active connection on the corresponding LAN hub port Flashing Data is being transmitted or received via the corres...

Page 9: ...d LAN cable Console Port Use the supplied cable to connect the router to a terminal or PC Reset Button This button has two 2 functions Reboot When pressed and released the Broadband VPN Gateway will r...

Page 10: ...ndard LAN cables to connect PCs to the Switching Hub ports on the Broadband VPN Gateway Both 10BaseT and 100BaseT connections can be used simultaneously If required you can connect any LAN port to ano...

Page 11: ...ED should blink during start up then turn Off If it stays on there is a hardware error For each LAN PC connection the LAN Link Act LED should be ON provided the PC is also ON The WAN1 or WAN2 LED shou...

Page 12: ...ow to locate detailed instructions for the required functions To Do this Refer to Configure PCs on your LAN Chapter 4 PC Configuration Check Broadband VPN Gateway operation and Status Chapter 5 Operat...

Page 13: ...nected using the Hub ports on the Broadband VPN Gateway or on the same LAN segment The Broadband VPN Gateway must be installed and powered ON If the Broadband VPN Gateway s default IP Address 192 168...

Page 14: ...nd VPN Gateway s IP Address See next item If your PC is using a fixed IP Address its IP Address must be within the range 192 168 0 2 to 192 168 0 254 to be compatible with the Broadband VPN Ga teway s...

Page 15: ...t An example screen is shown below Figure 6 Home Screen Navigation Data Input Use the menu bar on the left of the screen and the Back button on your Browser for navigation Changing to another screen w...

Page 16: ...his if your ISP has allocated you a fixed IP Address If this option is selected you must enter the data in the Static IP Settings section Dynamic IP This is the default and the most common Leave this...

Page 17: ...ogin name above Hostname Normally there is no need to change the default name but if your ISP requests that you use a particular Hostname enter it here DNS DNS 1 Enter the IP address of the DNS Domain...

Page 18: ...tname Normally there is no need to change the default name but if your ISP requests that you use a particular Hostname enter it here Domain Name If your ISP provided a domain name enter it here Otherw...

Page 19: ...eriod specified by the Discon nect after Idling Disconnect After Idling This field has no effect unless using the Automatic Dial up setting If using this setting enter the desired idle time out period...

Page 20: ...ue as the PCs on that LAN segment DHCP Server If Enabled the Broadband VPN Gateway will allocate IP Ad dresses to PCs DHCP clients on your LAN when they start up The default and recommended value is E...

Page 21: ...Broadband VPN Gateway s DHCP Server This is the default setting The DHCP Server settings are on the LAN screen On this screen you can Enable or Disable the Broadband VPN Gateway s DHCP Server function...

Page 22: ...r WAN 2 2 If Load Balance is selected for WAN 1 then choose Load Bal ance for WAN 2 3 If Backup is selected for WAN 1 then choose Enable for WAN 2 Auto Equilibrium Type has 2 options Determine by Band...

Page 23: ...Setup 19...

Page 24: ...h PC TCP IP Settings Overview If using the default Broadband VPN Gateway settings and the default Windows TCP IP settings no changes need to be made By default the Broadband VPN Gateway will act as a...

Page 25: ...radio button Obtain an IP Address automatically This is the default Windows setting Using this is recom mended By default the Broadband VPN Gateway will act as a DHCP Server Restart your PC to ensure...

Page 26: ...ateway Tab Win 95 98 On the DNS Configuration tab ensure Enable DNS is selected If the DNS Server Search Order list is empty enter the DNS address provided by your ISP in the fields beside the Add but...

Page 27: ...e TCP IP protocol as shown below Figure 15 Windows NT4 0 TCP IP 2 Click the Properties button to see a screen like the one below Figure 16 Windows NT4 0 IP Address 3 Select the network card for your L...

Page 28: ...ault Gateway must be set to the IP address of the Broadband VPN Gateway To set this Click the Advanced button on the screen above On the following screen click the Add button in the Gateways panel and...

Page 29: ...PC Configuration 25 Figure 18 Windows NT4 0 DNS...

Page 30: ...ea Connection icon and select Properties You should see a screen like the following Figure 19 Network Configuration Win 2000 3 Select the TCP IP protocol for your network card 4 Click on the Propertie...

Page 31: ...way Using a fixed IP Address Use the following IP Address If your PC is already configured check with your network administrator before making the following changes Enter the Broadband VPN Gateway s I...

Page 32: ...twork Connection 2 Right click the Local Area Connection and choose Properties You should see a screen like the following Figure 21 Network Configuration Windows XP 3 Select the TCP IP protocol for yo...

Page 33: ...an IP Address from the Broadband VPN Gateway Using a fixed IP Address Use the following IP Address If your PC is already configured check with your network administrator before making the following ch...

Page 34: ...3 In Network Connections window displays right click on the correct Local Area Connection then click Properties 4 Pop up window displays that states Windows needs your permission to continue Click Co...

Page 35: ...PC Configuration 31...

Page 36: ...nd Internet Connections 2 Select Set up or change your Internet Connection 3 Select the Connection tab and click the Setup button 4 Cancel the pop up Location Information screen 5 Click Next on the Ne...

Page 37: ...changes Fixed IP Address By default most Unix installations use a fixed IP Address If you wish to continue using a fixed IP Address make the following changes to your configuration Set your Default G...

Page 38: ...specify which PC receives an incoming connection Refer to Chapter 6 Internet Features for further details Applications which use non standard connections or port numbers may be blocked by the Broadba...

Page 39: ...Operation and Status 35 Figure 23 General Status Screen...

Page 40: ...sk The Subnet Mask for the IP Address above MAC Address Also called Network Adapter Address or Physical Address DHCP Server This shows the status of the DHCP Server function For additional information...

Page 41: ...Status button on the Status Log menu An example screen is shown below Figure 24 Port Status Screen Data Port Status Screen Port Status Network Flow The picture shows the current network flow Buttons...

Page 42: ...e 25 Event Log Screen Data Event Log Screen Event Log Time It displays the time when the event occurred Event It describes the details of the event Host It displays the IP Address of the server Button...

Page 43: ...w Figure 26 URL Log Data URL Log Internet Time It displays the time when the log occurred Event It describes the address of the URL PC It displays the IP Address of the PC Buttons Refresh Update the d...

Page 44: ...n System Log Search Type Select the desired options of search type Click the Search button to see the logs in the following log table Time It displays the time when the system log occurred Event It de...

Page 45: ...Features This Chapter explains when and how to use the Broadband VPN Gateway s Internet Features Overview The following advanced features are provided Address List PC Database URL Filter Dynamic DNS...

Page 46: ...dress List This lists any existing entries If you have not entered any values this list will be empty Select All Cancel Use this to select deselect all the entries in the list Delete Button Use this b...

Page 47: ...automatically added to the database and updated as required By default non Server versions of Windows act as DHCP Clients this setting is called Obtain an IP Address automatically The Broadband VPN G...

Page 48: ...ry select it and click the Edit button Delete Delete the selected PC from the list This should be done in 2 situa tions The PC has been removed from your LAN The entry is incorrect Add This will add t...

Page 49: ...er Screen Data URL Filter Screen Filter Strings Current Entries This lists any existing entries If you have not entered any values this list will be empty URL Filter Rule List Select the desired rule...

Page 50: ...ANY entry ANYWHERE in the URL will be blocked Buttons Delete Se lected Delete All Use these buttons to delete the selected entry or all entries as required Multiple entries can be selected by holding...

Page 51: ...ed DDNS Service providers 2 After registration follow the Service Provider s procedure to request a Domain Name and have it allocated to you 3 Enter your DDNS data on the Broadband VPN Gateway s DDNS...

Page 52: ...returned by the DDNS Server Normally this message should be something like Update successful or IP address updated If the message indicates some problem you need to connect to the DDNS Service provid...

Page 53: ...sing Windows 2000 Data center Server as a software Router enable RIP on the Broadband VPN Gateway and ensure the following Windows 2000 settings are correct Open Routing and Remote Access In the conso...

Page 54: ...N segment For standard class C LANs the network address is the first 3 fields of the Destination IP Address The 4th last field can be left at 0 Subnet Mask The Subnet Mask for the remote LAN segment F...

Page 55: ...ult Route or Default Gateway Local Router The local router is the Router installed on the same LAN segment as the Broadband VPN Gateway This router requires that the Default Route is the Broadband VPN...

Page 56: ...k Mask 255 255 255 0 Standard Class C Gateway IP Address 192 168 0 100 Broadband VPN Gateway s local Router Interface LAN Metric 2 Entry 2 Segment 2 Destination IP Address 192 168 2 0 Network Mask 255...

Page 57: ...Internet Features 53 Network Mask 0 0 0 0 Gateway IP Address 192 168 1 80 Broadband VPN Gateway s local router Interface LAN...

Page 58: ...teway User Guide 54 QoS Quality of Service QoS ensures better service to high priority service Figure 34 QoS Screen Data QoS Screen QoS Setting QoS Method Select the desired option Disabled Based on d...

Page 59: ...Enter the desired values for the inbound and outbound traffic limitation Based on QoS rules set below Policy Name It displays the name for the policy Throughput It displays the information of the traf...

Page 60: ...ys block DoS Denial of Service attacks A DoS attack does not attempt to steal data or damage your PCs but overloads your Internet connection so you can not use it the service is unavailable As well yo...

Page 61: ...na tion IP address If the IP address is followed by this indicates there is range of IP addresses rather than a single address Action Action will be Forward or Block Add To add a new rule click the Ad...

Page 62: ...rt as required Type This determines the source and destination ports for traffic covered by this rule Select the desired option Source IP These settings determine which traffic based on their source I...

Page 63: ...option Services Select the desired Service or Services This determines which packets are covered by this rule based on the protocol TPC or UDP and port number If necessary you can define a new Service...

Page 64: ...lar day is blank no action will be performed Schedules Screen This screen is accessed by the Schedules link on the Firewall menu Figure 37 Schedules Screen Data Schedules Screen Day Each day of the we...

Page 65: ...ed to your PC or sent to a Syslog Server Figure 38 Log Screen Data Log Screen Log Log Contents Select the desired option s if needed Through put Connection Interval Enter the desired time for the inte...

Page 66: ...ss This is optional System Log Enable System Log If enabled log data will be sent to your system log Server System Log Server Enter the IP address of your System Log Server Include Select the logs you...

Page 67: ...ton Use this to delete the selected Service from the list Note that you can only delete Services you have added the pre defined services can not be deleted Add New Service Name Enter a suitable name f...

Page 68: ...ling this option provides a slight increase in security Allow VPN pass through If enabled PCs on the LAN can use VPN software to connect to remote clients via the Internet connection The protocols sup...

Page 69: ...e internet Connection Priori ty There are 2 options to set the priority Connection may be released after idling for The connection is automatically disconnected when idle for the time period speci fie...

Page 70: ...lays the IP address allocated to you by your ISP Enter the Corresponding IP to be the DMZ PC for traffic sent to this IP address If you have multiple Internet IP addresses you can assign one DMZ PC fo...

Page 71: ...ert If enabled an E Mail will be sent immediately if an application reaches 90 of its limited capacity Send E Mail alert If enabled an E Mail will be sent immediately if the PC s con nection reaches 9...

Page 72: ...og is full before the time specified to send it it will be sent regardless E mail Address Enter the E mail address the Log is to be sent to The E mail will also show this address as the Sender s addre...

Page 73: ...s the IPsec connection There are two security modes possible with IPSec Transport Mode the payload data part of the packet is encapsulated through encryption but the IP header remains in the clear unc...

Page 74: ...are listed and the first matching policy will be used While it is possible to change the order of the policies it may not be easy to get the desired action from multiple policies VPN Configuration Th...

Page 75: ...N configuration since it is not acting as a VPN endpoint Client PC to VPN Gateway Figure 44 Client PC to VPN Server In this situation the PC must run appropriate VPN client software in order to connec...

Page 76: ...on each endpoint gain secure access to the remote LAN The 2 LANs MUST use different IP address ranges The VPN Policies at each end determine when a VPN tunnel will be established and what systems on t...

Page 77: ...a particular site In that case the first matching policy for the traffic under consideration will be used Data Policies Screen VPN List Policy Name The name of the policy When creating a policy you sh...

Page 78: ...ng OK click Cancel to reverse your changes Click Move to directly specify a new location for the selected policy Enable Disable Use this to toggle the On Off state of the selected policy Copy If you w...

Page 79: ...Microsoft VPN 75 Adding a New Policy To create a new VPN Policy click the Add New Policy button on the Policies screen...

Page 80: ...Broadband VPN Gateway User Guide 76 Figure 47 VPN Wizard Start Screen...

Page 81: ...r the Domain Name of the remote endpoint Local IP Address Any no additional data is required Any IP address is accept able For outgoing connections this allows any PC on the LAN to use the VPN tunnel...

Page 82: ...The in key here must match the out key on the remote VPN and the out key here must match the in key on the remote VPN Keys can be in ASCII or Hex 0 9 A F For MD5 the keys should be 32 hex 16 ASCII cha...

Page 83: ...will be accepted Outgoing traffic which would otherwise result in a connection will be ignored Both Directions Both incoming and outgoing connections are allowed Local ID Type This setting must match...

Page 84: ...remote VPN endpoint uses the same mode Main Mode provides identity protection for the hosts initiating the IPSec session but takes slightly longer to complete Aggressive Mode provides no identity prot...

Page 85: ...5 17 11 43 202 11 13 211 Other endpoint s WAN Internet IP address Local IP addresses Any Any Use a more restrictive definition if possible Remote IP addresses 192 168 1 1 to 192 168 1 254 192 168 0 1...

Page 86: ...atch IKE SA Life time 28800 28800 Does not have to match Shorter period will be used IKE PFS Disable Disable Must match IPSec SA Parameters IPSec SA Life time 28800 28800 Does not have to match Shorte...

Page 87: ...255 0 Allows access to entire LAN Use a more restrictive definition if possible Remote IP addresses 172 16 9 10 For a single client this address is the same as the endpoint address Key Exchange IKE Mu...

Page 88: ...ption Enable DES Must match client PC Windows Client Configuration 1 Select Start Programs Administrative Tools Local Security Policy 2 Right click IP Security Policy on Local Machine and select Creat...

Page 89: ...s are in use Two 2 rules are required incoming and outgoing The outgoing rule will be added first 6 Deselect the Use Add Wizard checkbox then click Add to view the screen below Figure 52 IP Filter Lis...

Page 90: ...IP address is My IP address and the Destination IP address is the address range used on the remote LAN Ensure the Mirrored option is checked 9 Click OK to save your settings and close this dialog Fig...

Page 91: ...Rule Properties Filter Action 11 Select Require Security then click the Edit button to view the Require Security Properties screen Figure 56 Require Security Properties 12 Select Negotiate security t...

Page 92: ...ng settings are correct then click OK to return to the Filter Action tab of the Edit Rule Properties screen VPN Setting Windows Setting IKE enabled Negotiate security AH disabled AH Integrity None ESP...

Page 93: ...ation Method 17 Select Use this string to protect the key exchange preshared key then enter your preshared key in the field provided 18 Click OK to save your changes and return to the Authentication M...

Page 94: ...enter To Win2K then click Add Figure 62 Windows 2000 XP Client to Broadband VPN Gateway 21 Enter the Source IP address and the Destination IP address as shown below Since this is the incoming filter...

Page 95: ...Microsoft VPN 91 Figure 63 Filter Properties Addressing 22 Click OK to save your changes then Close Figure 64 Filter List 23 Ensure the To Win2K filter is selected then click the Filter Action tab...

Page 96: ...ilter Action 24 Select Require Security then click Edit On the Require Security Methods screen below select Negotiate security Figure 66 Security Methods 25 Click the Add button On the resulting Modif...

Page 97: ...then click OK again to return to the Filter Action screen 27 Select the Tunnel Setting tab and enter the WAN Internet IP address of this PC 172 16 9 10 in this example Figure 68 Tunnel Setting 28 Sele...

Page 98: ...protect the key exchange preshared key then enter your preshared key in the field provided 30 Click OK to save your settings then Close to return to the DUT to Win2K Properties screen There should now...

Page 99: ...95 Figure 71 Properties General Tab 32 Click the Advanced button to see the screen below Figure 72 Key Exchange Settings 33 Click the Methods button to see the screen below Figure 73 Key Exchange Sec...

Page 100: ...DUT to Win2K Policy and select Assign to make your policy active Figure 75 Windows 2000 XP Client to Broadband VPN Gateway Configuration is now complete Example 3 Windows 2000 Server to VPN Gateway In...

Page 101: ...Microsoft VPN 97 Remote IP addresses 172 16 9 10 For a single client this is the same as the Gateway address Subnet address 11 5 0 0 255 255 0 0 Address range used on the remote LAN...

Page 102: ...for both IP Filters the Filter Properties Addressing should be completed as follows Figure 77 Windows 2000 Server Addressing The Source Address should be set to A specific IP Subnet and the IP address...

Page 103: ...always the company or person to whom the Certificate is issued For trusted certificates this will be a CA CA Issuer The CA Certification Authority which issued the Certificate Expiration Time The date...

Page 104: ...which issued the Certificate Expiration Time The date on which the Certificate expires You should renew the Certificate before it expires Delete button Use this button to delete a Self Certificate Sel...

Page 105: ...quest must then be supplied to the CA The procedure is as follows 1 On the Self Certificates screen click the New Request button to view the first screen of the Private Certificate Request procedure s...

Page 106: ...Certificate Request 2 4 Check that the data displayed in the Certificate Details section is correct This data is used to generate the Certificate request If the data is not correct click the Back butt...

Page 107: ...appear in the Certificate Document field Click the Upload button to upload the certificate file to the Broadband VPN Gateway Click Back to return to the Private Certificates screen The new Certificat...

Page 108: ...ill be empty To update the display click the Refresh button If using IKE there is one SA for the IKE connection and another SA for the IPSec connection For each VPN SA the following data is displayed...

Page 109: ...N which is described in the previous chapter Using Microsoft VPN provides easier setup than using IPSec VPN The following Microsoft VPN configuration screens are provided VPN Adapter Users Status Serv...

Page 110: ...e the desired authentication methods The methods are listed with the most secure first least secure last If multiple methods are checked the most secure will be tried first If the remote client does n...

Page 111: ...connect The name must not contain spaces punctuation or special characters Login Password Enter the login password The remote user must provide this password when they connect Confirm Pass word Re en...

Page 112: ...a Status Log Screen Status Log Status This indicates whether or not the PPTP VPN Server is enabled Current Connec tions This indicates the number of remote clients currently logged into the PPTP VPN S...

Page 113: ...p connection to the Internet Windows 98 ME 1 Click Start Settings Dial up Networking 2 Select Make New Connection Figure 90 Windows ME VPN Adapter 3 Type a name for this connection and ensure that Mic...

Page 114: ...is setting if using Dial up or PPPoE client software Windows ME VPN Dialing Properties To establish a connection 1 Ensure you are connected to the Internet 2 Select Start Settings Dial up Networking 3...

Page 115: ...00 Network Connection 2 Select the VPN option Connect to a private network through the Internet as shown above and click Next Figure 93 Windows 2000 Public Network 3 On the screen above Select Do not...

Page 116: ...above enter the Domain Name or Internet IP address of the Broadband VPN Gateway you wish to connect to Click Next to continue Figure 95 Windows 2000 Connection Availability 5 Choose whether to allow...

Page 117: ...database on the Broadband VPN Gateway 3 You can choose to have Windows remember the password if desired so you do not have to enter it again Changing the connection settings The PPTP VPN Server in th...

Page 118: ...ns Start Settings Network Connections and start the New Connection Wizard Figure 97 Windows XP Network Connection Type 2 Select the option Connect to the network at my workplace as shown above and cli...

Page 119: ...to continue Figure 100 Windows XP Public Network 5 On the screen above select Do not dial the initial connection Click Next to continue Figure 101 Windows XP VPN Server 6 On the screen above enter the...

Page 120: ...sername and password assigned to you as recorded in the VPN client database on the Broadband VPN Gateway 3 You can choose to have Windows remember the password if desired so you do not have to enter i...

Page 121: ...ditional options for advanced users The screens available are Diagnostics Ping DNS Lookup Password Only required if your LAN has other Routers or Gateways Web Manage ment This feature allows you to ma...

Page 122: ...e Internet Note that if the address is on the Internet and no connection currently exists you could get a Timeout error In that case wait a few seconds and try again Ping Button After entering the IP...

Page 123: ...Other Features and Settings 119 Search Button After entering the Domain name URL click this button to start the DNS Search procedure The results will be displayed in the DNS Search Result pane...

Page 124: ...Edit Button Click this button to modify the user settings User Name Enter the desired User Name New Password Enter the new password here Confirm Pass word Re enter the new password here Read Write Vie...

Page 125: ...ress of this device as seen from the Internet This IP Address is allocated by your ISP and is shown here if you are currently con nected to the Internet But if using a Dynamic IP Address this value ca...

Page 126: ...d IP address is allowed If selected you must enter an IP address in the field provided To connect from a remote PC via the Internet 1 Ensure your Internet connection is established and start your Web...

Page 127: ...rade file Select this file Start to Upgrade Click this button to start the Firmware upgrade Note than any users accessing the Internet via the Broadband VPN Gateway will lose their connection When the...

Page 128: ...will be deleted An example Backup Restore screen is shown below Figure 108 Backup Restore File Screen Data Backup Restore Screen Backup Use this to download a copy of the current configuration and sto...

Page 129: ...efault Configu ration Enable the Restore the default language if required Clicking the Factory Defaults button will reset the Broadband VPN Gateway to its factory default settings WARNING This will de...

Page 130: ...68 0 254 and thus com patible with the Broadband VPN Gateway s default IP Address of 192 168 0 1 Also the Network Mask should be set to 255 255 255 0 to match the Broadband VPN Gateway In Windows you...

Page 131: ...ransparent Use the Special Applications feature to allow the use of Internet applications which do not function correctly If this does solve the problem you can use the DMZ function This should work w...

Page 132: ...ng the equipment off and on the user is encouraged to try to correct the interference by one of the following measures Reorient or relocate the receiving antenna Increase the separation between the eq...

Page 133: ...transmitter CE Marking Warning CE Standards This product complies with the 99 5 EEC directives including the following safety and EMC standards EN301489 1 17 EN60950 This is a Class B product In a dom...

Page 134: ...Broadband VPN Gateway User Guide 130...

Page 135: ...Appendix B Specifications 131...

Search results

Summary of Contents for TW100-BRV324

Reviews:

Brands by name

Popular brands

TRENDnet TW100-BRV324, User Manual

Search results

Summary of Contents for TW100-BRV324

Reviews:

Brands by name

Popular brands