manualshive.com logo in svg

TRENDnet TW100-BRV304 - Advanced VPN Firewall Router, Руководство пользователя, Страница: 84 / 123

Поделиться
Скачать
TRENDnet TW100-BRV304 - Advanced VPN Firewall Router Скачать руководство пользователя страница 84

VPN 

81 

Examples 

This section describes some examples of using the TW100-BRV304 in common VPN situa-
tions. 

Example 1: Connecting 2 TW100-BRV304s  

In this example, 2 LANs are connected via VPN. 

 

Figure 54: Connecting 2 TW100-BRV304s  

Note 

• 

The LANs MUST use different IP address ranges. 

• 

Both endpoints have fixed WAN (Internet) IP addresses. 

Configuration Settings 

Setting 

LAN A Gate-
way 

LAN B Gate-
way 

Notes 

Name 

Policy 1 

Policy 1 

Name does not affect 
operation. Select a mean-
ingful name. 

Remote Endpoint 

205.17.11.43 

202.11.13.211 

Other endpoint's WAN 
(Internet) IP address. 

Local 
IP addresses 

Any 

Any 

Use a more restrictive 
definition if possible. 

Remote  
IP addresses 

192.168.1.1 to 
192.168.1.254 

192.168.0.1 to 
192.168.0.254 

Address range on other 
endpoint. 
Use a more restrictive 
definition if possible. 

Key Exchange 

IKE 

IKE 

Must match 

IKE SA Parameters 

IKE Direction 

Both ways 

Both ways 

Does not have to match. 
Either endpoint can block 
1 direction. 

Local Identity 

IP address 

IP address 

IP address is the most 
common ID method 

Remote Identity 

IP address 

IP address 

IP address is the most 
common ID method 

IKE Authentication  Pre-shared Key 

Pre-shared Key 

Certificates are not widely 

Содержание TW100-BRV304 - Advanced VPN Firewall Router

Страница 1: ...TW100 BRV304 Advanced VPN Firewall Router Cable DSL Internet Access 4 Port Switching Hub User s Guide...

Страница 2: ...HAPTER 5 OPERATION AND STATUS 31 Operation 31 Status Screen 31 Connection Status PPPoE 33 Connection Status PPTP 35 Connection Status Telstra Big Pond 36 Connection Details SingTel RAS 37 Connection D...

Страница 3: ...g 111 Firmware Upgrade 115 UPNP 116 APPENDIX A TROUBLESHOOTING 117 Overview 117 General Problems 117 Internet Access 117 APPENDIX B SPECIFICATIONS 119 TW100 BRV304 119 FCC Statement 119 CE Marking War...

Страница 4: ...ugh the TW100 BRV304 using only a single external IP Address The local invalid IP Addresses are hidden from external sources This process is called NAT Network Ad dress Translation DSL Cable Modem Sup...

Страница 5: ...asy to create or extend your LAN DHCP Server Support Dynamic Host Configuration Protocol provides a dynamic IP address to PCs and other devices upon request The TW100 BRV304 can act as a DHCP Server f...

Страница 6: ...attacks Rule based Policy Firewall To provide additional protection against malicious pack ets you can define your own firewall rules This can also be used to control the Internet services available...

Страница 7: ...ing LAN hub port Flashing Data is being transmitted or received via the corre sponding LAN hub port 100 On Corresponding LAN hub port is using 100BaseT Off Corresponding LAN hub port connection is usi...

Страница 8: ...ower On 3 Keep holding the Reset Button for a few seconds until the RED LED has flashed TWICE 4 Release the Reset Button The TW100 BRV304 is now using the factory default values WAN port 10 100BaseT C...

Страница 9: ...the TW100 BRV304 Ensure the TW100 BRV304 and the DSL Cable modem are powered OFF 2 Connect LAN Cables Use standard LAN cables to connect PCs to the Switching Hub ports on the TW100 BRV304 Both 10BaseT...

Страница 10: ...a normal port not an uplink port PCs connected to the DMZ port are on the same LAN segment as PCs connected to the Hub ports They must use the same IP address range PCs connected to the DMZ port are...

Страница 11: ...the required functions To Do this Refer to Configure PCs on your LAN Chapter 4 PC Configuration Check TW100 BRV304 operation and Status Chapter 5 Operation and Status Use any of the following Internet...

Страница 12: ...be installed and powered ON If the TW100 BRV304 s default IP Address 192 168 0 1 is already used by another device the other device must be turned OFF until the TW100 BRV304 is allocated a new IP Add...

Страница 13: ...ing or your PC s IP address is not compatible with the TW100 BRV304 s IP Address See next item If your PC is using a fixed IP Address its IP Address must be within the range 192 168 0 2 to 192 168 0 2...

Страница 14: ...d dress button to copy the MAC address from your PC to the TW100 BRV304 Common Connection Types Cable Modems Type Details ISP Data required Dynamic IP Address Your IP Address is allocated automaticall...

Страница 15: ...IP Address is allocated automatically when you connect to you ISP Usually none However some ISP s may require you to use a particular Hostname Domain name or MAC physical address Static Fixed IP Addre...

Страница 16: ...igation Data Input Use the menu bar on the top of the screen and the Back button on your Browser for navigation Changing to another screen without clicking Save does NOT save any changes you may have...

Страница 17: ...IP Address This is the default and the most common Leave this selected if your ISP allocates an IP Address to the Wire less Router upon connection Specified IP Address Also called Static IP Address S...

Страница 18: ...ou are on Server IP Address If using PPTP or Big Pond Cable enter the IP address of your ISP s server Connect automatically If Enabled default a connection will automatically be made as required If di...

Страница 19: ...ame value as the PCs on that LAN segment DHCP Server If Enabled the TW100 BRV304 will allocate IP Addresses to PCs DHCP clients on your LAN when they start up The default and recommended value is Enab...

Страница 20: ...our LAN Using the TW100 BRV304 s DHCP Server This is the default setting The DHCP Server settings are on the LAN screen On this screen you can Enable or Disable the TW100 BRV304 s DHCP Server function...

Страница 21: ...each PC TCP IP Settings Overview If using the default TW100 BRV304 settings and the default Windows TCP IP settings no changes need to be made By default the TW100 BRV304 will act as a DHCP Server au...

Страница 22: ...owing Figure 10 IP Address Win 95 Ensure your TCP IP settings are correct as follows Using DHCP To use DHCP select the radio button Obtain an IP Address automatically This is the default Windows setti...

Страница 23: ...AN administrator can advise you of the IP Address they assigned to the TW100 BRV304 Figure 11 Gateway Tab Win 95 98 On the DNS Configuration tab ensure Enable DNS is selected If the DNS Server Search...

Страница 24: ...ng TCP IP Settings Windows NT4 0 1 Select Control Panel Network and on the Protocols tab select the TCP IP protocol as shown below Figure 13 Windows NT4 0 TCP IP 2 Click the Properties button to see a...

Страница 25: ...CP Server Restart your PC to ensure it obtains an IP Address from the TW100 BRV304 Specify an IP Address If your PC is already configured check with your network administrator before making the follow...

Страница 26: ...dows NT4 0 Add Gateway 2 The DNS should be set to the address provided by your ISP as follows Click the DNS tab On the DNS screen shown below click the Add button under DNS Service Search Order and en...

Страница 27: ...TW100 BRV304 User Guide 24 Figure 16 Windows NT4 0 DNS...

Страница 28: ...up Connection 2 Right click the Local Area Connection icon and select Properties You should see a screen like the following Figure 17 Network Configuration Win 2000 3 Select the TCP IP protocol for y...

Страница 29: ...o ensure it obtains an IP Address from the TW100 BRV304 Using a fixed IP Address Use the following IP Address If your PC is already configured check with your network administrator before making the f...

Страница 30: ...nnection 2 Right click the Local Area Connection and choose Properties You should see a screen like the following Figure 19 Network Configuration Windows XP 3 Select the TCP IP protocol for your netwo...

Страница 31: ...it obtains an IP Address from the TW100 BRV304 Using a fixed IP Address Use the following IP Address If your PC is already configured check with your network administrator before making the following...

Страница 32: ...and Internet Connections 2 Select Set up or change your Internet Connection 3 Select the Connection tab and click the Setup button 4 Cancel the pop up Location Information screen 5 Click Next on the N...

Страница 33: ...changes Fixed IP Address By default most Unix installations use a fixed IP Address If you wish to continue using a fixed IP Address make the following changes to your configuration Set your Default Ga...

Страница 34: ...receives an incoming connection Refer to Chapter 6 Internet Features for fur ther details Applications which use non standard connections or port numbers may be blocked by the TW100 BRV304 s built in...

Страница 35: ...k for the IP Address above DHCP Server This shows the status of the DHCP Server function either Enabled or Disabled For additional information about the PCs on your LAN and the IP addresses allocated...

Страница 36: ...s This address is allocated by your ISP Internet Service Provider Network Mask The Network Mask associated with the IP Address above PPPoE Link Status This indicates whether or not the connection is c...

Страница 37: ...lly Able to login to ISP s Server and establish a PPP connection Idle time out reached The connection has been idle for the time period specified in the Idle Time out field The connection will now be...

Страница 38: ...t users This address is allocated by your ISP Internet Service Provider PPTP Status This indicates whether or not the connection is currently established If the connection does not exist the Connect b...

Страница 39: ...t to the hardware address seen by devices on the local LAN IP Address The IP Address of this device as seen by Internet users This address is allocated by your ISP Internet Service Provider Connection...

Страница 40: ...sier to read new messages Refresh Update the data on screen Connection Details SingTel RAS If using the SingTel RAS access method a screen like the following example will be displayed when the Connect...

Страница 41: ...button if you wish to manually renew the lease immediately Buttons Release Renew Button will display EITHER Release OR Renew This button is only useful if the IP address shown above is allocated auto...

Страница 42: ...Mask The Network Mask associated with the IP Address above Default Gateway The IP Address of the remote Gateway or Router associated with the IP Address above DNS IP Address The IP Address of the Doma...

Страница 43: ...icking the Renew button will attempt to re establish the connection and obtain an IP Address from the ISP s DHCP Server If an IP Address has been allocated to the TW100 BRV304 by the ISP s DHCP Server...

Страница 44: ...features are provided Advanced Internet Communication Applications Special Applications DMZ URL filter Dynamic DNS Virtual Servers Options Advanced Internet Screen Figure 27 Internet Screen This scre...

Страница 45: ...n on the advanced menu For each application listed above you can choose a destina tion PC There is no need to Save after each change you can set the destination PC for each application then click Save...

Страница 46: ...data you receive Outgoing Ports Type Select the protocol TCP or UDP used when you send data to the remote system or service Start Enter the beginning of the range of port numbers used by the applicat...

Страница 47: ...as the DMZ PC The DMZ feature can be Enabled and Disabled on the Advanced Internet screen The DMZ PC is effectively outside the Firewall mak ing it more vulnerable to attacks For this reason you shou...

Страница 48: ...ill be empty Add Filter String To add an entry to the list enter it here and click the Add button An entry may be a Domain name e g www trash com or simply a string e g ads Any URL which contains ANY...

Страница 49: ...ired Domain name 3 Enter your data from www dyndns org in the TW100 BRV304 s DDNS screen 4 The TW100 BRV304 will then automatically ensure that your current IP Address is recorded at http www dyndns o...

Страница 50: ...g The name should consist only of letters and the hyphen dash Using any other characters may cause problems DDNS Status This message is returned by the DDNS Server at www dyndns org Normally this mess...

Страница 51: ...nternet users to connect to your servers as illustrated below Figure 31 Virtual Servers IP Address seen by Internet Users Note that in this illustration both Internet users are connecting to the same...

Страница 52: ...the standard port on the hub Virtual Servers Screen The Virtual Servers screen is reached by the Virtual Servers link on the Internet menu An example screen is shown below Figure 32 Virtual Servers S...

Страница 53: ...http 203 70 212 52 ftp 203 70 212 52 It is more convenient if you are using a Fixed IP Address from your ISP rather than Dynamic However you can use the Dynamic DNS feature described in the following...

Страница 54: ...advised to do so by Technical Support Enter a value between 1 and 1500 This device will still auto negotiate with the remote server to set the MTU size The smaller of the 2 values auto negotiated or...

Страница 55: ...urity Options Scheduling Services Admin Login The Admin Login screen allows you to assign a user name and password to the TW100 BRV304 Figure 34 Admin Login Screen 1 The default login name is admin Ch...

Страница 56: ...Security Configuration 53 Figure 35 Password Dialog Enter the User Name and Password you set on the Admin Login screen above...

Страница 57: ...group 2 Set the desired restrictions on the other groups Group 1 Group 2 Group 3 and Group 4 as needed 3 Assign PC to the groups as required Restrictions are imposed by blocking Services or types of...

Страница 58: ...a group Block by Schedule If Internet access is being blocked you can choose to apply the blocking only during scheduled times If access is not blocked no Scheduling is possible and this setting has...

Страница 59: ...fault group Access Control Log To check the operation of the Access Control feature an Access Control Log is provided Click the View Log button on the Access Control screen to view this log This log s...

Страница 60: ...anced administrators only Firewall Rules Screen Click the Firewall Rules option on the Security menu to see a screen like the following exam ple This example contains two 2 rules for outgoing traffic...

Страница 61: ...section for more details Edit To Edit or modify an existing rule select it and click the Edit button Move There are 2 ways to change the order of rules Use the up and down indicators on the right to...

Страница 62: ...ewall Rules screen will display a screen like the example below Figure 39 Define Firewall Rule Data Define Firewall Rule Screen Name Enter a suitable name for this rule Type This determines the source...

Страница 63: ...Select the desired option Any All traffic from the source port is covered by this rule Single address Enter the required IP address in the Start IP address field You can ignore the Subnet Mask field...

Страница 64: ...t to a Syslog Server Figure 40 Logs Screen Data Logs Screen Enable Logs DoS Attacks If enabled this log will show details of DoS Denial of Service attacks which have been blocked by the built in Firew...

Страница 65: ...the Send setting Send Select the desired option for sending the log by E mail When log is full The time is not fixed The log will be sent when the log is full which will depend on the volume of traf f...

Страница 66: ...u can not use it the service is unavailable This device uses Stateful Inspection technology This system can detect situations where individual TCP IP packets are valid but collectively they become a D...

Страница 67: ...re allowed If not checked IPSec connections are blocked Allow PPTP PPTP Point to Point Tunneling Protocol is widely used by VPN Virtual Private Networking programs If checked PPTP connections are allo...

Страница 68: ...the time for a particular day is blank no action will be performed Define Schedule Screen This screen is accessed by the Scheduling link on the Security menu Figure 42 Define Schedule Screen Data Def...

Страница 69: ...te any Service you have added Pre defined Services can not be deleted Add New Service Name Enter a descriptive name to identify this service Type Select the protocol TCP UDP ICMP used to the remote sy...

Страница 70: ...ns Delete Delete the selected service from the list Add Add a new entry to the Service list using the data shown in the Add New Service area on screen Cancel Clear the Add New Service area ready for e...

Страница 71: ...SAs one in each direction If IKE Internet Key Exchange is used to generate and exchange keys there are also SA s for the IKE connection as well as the IPsec connection There are two security modes po...

Страница 72: ...and the first matching policy will be used VPN Configuration The general rule is that each endpoint must have matching Policies as follows Remote VPN address Each VPN endpoint must be configured to in...

Страница 73: ...eway requires no VPN configuration since it is not acting as a VPN endpoint Client PC to VPN Gateway Figure 45 Client PC to VPN Server In this situation the PC must run appropriate VPN client software...

Страница 74: ...t gain secure access to the remote LAN The 2 LANs MUST use different IP address ranges The VPN Policies at each end determine when a VPN tunnel will be established and what systems on the remote LAN c...

Страница 75: ...or particular traffic In that case the first matching policy for the traffic under consideration will be used Data VPN Policies Screen VPN List Policy Name The name of the policy When creating a polic...

Страница 76: ...click the Copy button Remember that the new policy must have a different name and there can only be one active enabled policy for each remote VPN endpoint Delete To delete an exiting policy select it...

Страница 77: ...e enabled at any time Remote VPN Endpoint The Internet IP address of the remote VPN endpoint Gateway or client Dynamic Select this if the Internet IP address is unknown In this case only incoming conn...

Страница 78: ...t would not be forwarded to the Gateway Local IP addresses Type Any no additional data is required Any IP address is accept able For outgoing connections this allows any PC on the LAN to use the VPN t...

Страница 79: ...ess in the Finish IP ad dress field Subnet address enter the desired IP address in the Start IP address field and the network mask in the Subnet Mask field The remote VPN should have these IP addresse...

Страница 80: ...ble both Encryption and Authentication The 3DES algorithm provides greater security than DES but is slower The in key here must match the out key on the remote VPN and the out key here must match the...

Страница 81: ...ocal Identity on the remote VPN IP address is the more common method Authentication RSA Signature requires that both VPN endpoints have valid Certificates issued by a CA Certification Authority For Pr...

Страница 82: ...should match the remote endpoint Click Next to see the following IKE Phase 2 screen Figure 53 VPN Wizard IKE Phase 2 IKE Phase 2 IPsec SA IPsec SA Life Time This setting does not have to match the rem...

Страница 83: ...ensure the remote VPN endpoint uses the same method The 3DES algorithm provides greater security than DES but is slower ESP Authentication Generally you should enable ESP Authentication There is littl...

Страница 84: ...ndpoint 205 17 11 43 202 11 13 211 Other endpoint s WAN Internet IP address Local IP addresses Any Any Use a more restrictive definition if possible Remote IP addresses 192 168 1 1 to 192 168 1 254 19...

Страница 85: ...it Group 1 768 bit Must match IKE SA Life time 28800 28800 Does not have to match Shorter period will be used IKE PFS Disable Disable Must match IPSec SA Parameters IPSec SA Life time 28800 28800 Does...

Страница 86: ...Subnet address 192 168 0 0 255 255 255 0 Allows access to entire LAN Use a more restrictive definition if possible Remote IP addresses 172 16 9 10 For a single client this address is the same as the...

Страница 87: ...tication Enable MD5 Must match client PC ESP encryption Enable DES Must match client PC Windows Client Configuration 1 Select Start Programs Administrative Tools Local Security Policy 2 Right click IP...

Страница 88: ...in use Two 2 rules are required incoming and outgoing The outgoing rule will be added first 6 Deselect the Use Add Wizard checkbox then click Add to view the screen below Figure 58 IP Filter List 7 T...

Страница 89: ...address is My IP address and the Destination IP address is the address range used on the remote LAN Ensure the Mirrored option is checked 9 Click OK to save your settings and close this dialog Figure...

Страница 90: ...Properties Filter Action 11 Select Require Security then click the Edit button to view the Require Security Proper ties screen Figure 62 Require Security Properties 12 Select Negotiate security this s...

Страница 91: ...ity Properties screen Figure 64 Require Security Properties 14 Ensure the following settings are correct then click OK to return to the Filter Action tab of the Edit Rule Properties screen VPN Setting...

Страница 92: ...then click the Edit to see the screen like the example below Figure 66 Authentication Method 17 Select Use this string to protect the key exchange preshared key then enter your pre shared key in the...

Страница 93: ...r To Win2K then click Add Figure 68 Windows 2000 XP Client to Broadband VPN Gateway 21 Enter the Source IP address and the Destination IP address as shown below Since this is the incoming filter the S...

Страница 94: ...VPN 91 Figure 69 Filter Properties Addressing 22 Click OK to save your changes then Close Figure 70 Filter List 23 Ensure the To Win2K filter is selected then click the Filter Action tab...

Страница 95: ...r Action 24 Select Require Security then click Edit On the Require Security Methods screen below select Negotiate security Figure 72 Security Methods 25 Click the Add button On the resulting Modify Se...

Страница 96: ...click OK again to return to the Filter Action screen 27 Select the Tunnel Setting tab and enter the WAN Internet IP address of this PC 172 16 9 10 in this example Figure 74 Tunnel Setting 28 Select th...

Страница 97: ...ct the key exchange preshared key then enter your pre shared key in the field provided 30 Click OK to save your settings then Close to return to the DUT to Win2K Properties screen There should now be...

Страница 98: ...VPN 95 Figure 77 Properties General Tab 32 Click the Advanced button to see the screen below Figure 78 Key Exchange Settings 33 Click the Methods button to see the screen below...

Страница 99: ...s 35 Select SHA1 for Integrity Algorithm 3DES for Encryption algorithm and Low 1 for the Diffie Hellman Group 36 Click OK to save then OK again and then Close to return to the Local Security Settings...

Страница 100: ...82 TW100 BRV304 to Windows 2000 Server TW100 BRV304 Configuration This is the same as for the client setup earlier with the exception of the IP address range for the remote endpoint Setting Single Cli...

Страница 101: ...for both IP Filters the Filter Properties Addressing should be completed as follows Figure 83 Windows 2000 Server Addressing The Source Address should be set to A specific IP Subnet and the IP address...

Страница 102: ...suer Name The CA Certification Authority which issued the Certificate Expiry Time The date on which the Certificate expires You should renew the Certificate before it expires Delete button Use this bu...

Страница 103: ...ad the certificate file to the TW100 BRV304 6 Click Back to return to the Trusted Certificate list The new Certificate will appear in the list Adding a Self Certificate This process is different to ob...

Страница 104: ...data displayed in the Certificate Details section is correct This data is used to generate the Certificate request If the data is not correct click the Back button and correct the previous screen 5 I...

Страница 105: ...e only necessary if using Certificates CRL Certificate Revocation List files show Certificates which have been revoked and are no longer valid Each CA issues their own CRLs It is VERY IMPORTANT to kee...

Страница 106: ...e the CRL file on your PC Select the file The name will appear in the File to Upload field Click Upload to upload the CRL file to the TW100 BRV304 Click Back to return to the CRL list The new CRL will...

Страница 107: ...r This file contains all the configuration data PC Database This is the list of PCs shown when you select the DMZ PC Virtual Server or Internet Application This database is maintained automati cally b...

Страница 108: ...below Figure 91 Config Screen Data Config File Screen Backup Config Use this to download a copy of the current configuration and store the file on your PC Click Download to start the download Restore...

Страница 109: ...ents are automatically added to the database and updated as required By default non Server versions of Windows act as DHCP Clients this setting is called Obtain an IP Address automatically The TW100 B...

Страница 110: ...connected or not powered On you will not be able to add it Buttons Add This will add the new PC to the list The PC will be sent a ping to determine its hardware address If the PC is not available not...

Страница 111: ...control than the standard PC Database screen Figure 93 PC Database Admin Data PC Database Admin Screen Known PCs This lists all current entries Data displayed is name IP Address type The type indicate...

Страница 112: ...his to have the TW100 BRV304 contact the PC and find its MAC address This is only possible if the PC is connected to the LAN and powered On MAC is Enter the MAC address on the PC The MAC address is al...

Страница 113: ...will prevent the use of a Web Virtual Server on your LAN See Advanced Internet Virtual Servers Current IP Address You must use this IP Address to connect see below This IP Address is allocated by you...

Страница 114: ...BRV304 and ensure the following Windows 2000 settings are correct Open Routing and Remote Access In the console tree select Routing and Remote Access server name IP Routing RIP In the Details pane rig...

Страница 115: ...o the selected entry Properties Destination Network The network address of the remote LAN segment For standard class C LANs the network address is the first 3 fields of the Destination IP Address The...

Страница 116: ...to use the TW100 BRV304 as the Default Route or Default Gateway Local Router The local router is the Router installed on the same LAN segment as the TW100 BRV304 This router requires that the Default...

Страница 117: ...ndard Class C Gateway IP Address 192 168 0 100 TW100 BRV304 s local Router Metric 2 Entry 2 Segment 2 Destination IP Address 192 168 2 0 Network Mask 255 255 255 0 Standard Class C Gateway IP Address...

Страница 118: ...Figure 97 Upgrade Firmware Screen To perform the Firmware Upgrade 1 Click the Browse button and navigate to the location of the upgrade file 2 Select the upgrade file It s name will appear in the Upg...

Страница 119: ...sers can change the configuration If Disabled UPnP users can only view the configuration But currently this restriction only applies to users running Windows XP who access the Properties via UPnP e g...

Страница 120: ...68 0 254 and thus com patible with the TW100 BRV304 s default IP Address of 192 168 0 1 Also the Network Mask should be set to 255 255 255 0 to match the TW100 BRV304 In Windows you can check these se...

Страница 121: ...rent Use the Special Applications feature to allow the use of Internet applications which do not function correctly If this does solve the problem you can use the DMZ function This should work with al...

Страница 122: ...ructions may cause harmful interference to radio communica tions However there is no guarantee that interference will not occur in a particular installation If this equipment does cause harmful interf...

Страница 123: ...15 of the FCC Rules Operation is subject to the following two conditions 1 This device may not cause harmful interference and 2 this device must accept any interference received including interferenc...

Отзывы:

Нет отзывов