Cisco QuickVPN - PC Instruction Manual

Cisco Small Business
WRVS4400N Wireless-N Gigabit Security Router
with VPN
ADMINISTRATION
GUIDE

© 2009 Cisco Systems, Inc. All rights reserved. OL-20048-01
CCDE, CCSI, CCENT, Cisco Eos, Cisco HealthPresence, the Cisco logo, Cisco Lumin, Cisco Nexus, Cisco Nurse Connect, Cisco Stackpower,
Cisco StadiumVision, Cisco TelePresence, Cisco WebEx, DCE, and Welcome to the Human Network are trademarks; Changing the Way We Work, Live, Play, and
Learn and Cisco Store are service marks; and Access Registrar, Aironet, AsyncOS, Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA,
CCNP, CCSP, CCVP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems
logo, Cisco Unity, Collaboration Without Limitation, EtherFast, EtherSwitch, Event Center, Fast Step, Follow Me Browsing, FormShare, GigaDrive, HomeLink,
Internet Quotient, IOS, iPhone, iQuick Study, IronPort, the IronPort logo, LightStream, Linksys, MediaTone, MeetingPlace, MeetingPlace Chime Sound, MGX,
Networkers, Networking Academy, Network Registrar, PCNow, PIX, PowerPanels, ProConnect, ScriptShare, SenderBase, SMARTnet, Spectrum Expert,
StackWise, The Fastest Way to Increase Your Internet Quotient, TransPath, WebEx, and the WebEx logo are registered trademarks of Cisco Systems, Inc. and/
or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or website are the property of their respective owners. The use of the word partner does not imply a
partnership relationship between Cisco and any other company. (0903R)

Cisco WRVS4400N Wireless-N Gigabit Security Router with VPN Administration Guide iii
Contents
About This Document ix
How to Use This Guide ix
Organization ix
Finding Information in PDF Files xi
Finding Text in a PDF xi
Finding Text in Multiple PDF Files xii
Chapter 1: Introduction 14
Chapter 2: Networking and Security Basics 16
An Introduction to LANs 16
The Use of IP Addresses 17
The Intrusion Prevention System (IPS) 19
Chapter 3: Planning Your Virtual Private Network (VPN) 21
Why do I need a VPN? 21
MAC Address Spoofing 22
Data Sniffing 22
Man in the Middle Attacks 22
What is a VPN? 23
VPN Router to VPN Router 24
Computer to VPN Router 25
Chapter 4: Getting Started with the WRVS4400N Router 26
Front Panel 27
Back Panel 28
WRVS4400N Antennas 28
Placement Options 29
Desktop Option 29
Stand Option 30
Wall Option 31

Cisco WRVS4400N Wireless-N Gigabit Security Router with VPN Administration Guide iv
Contents
Installing the Router 32
Configuring the Router 34
Chapter 5: Setting Up and Configuring the WRVS4400N Wireless-N Router 36
Accessing the Web-Based Utility 37
Navigating the Utility 38
Setup 39
Wireless 40
Firewall 40
ProtectLink 41
VPN 41
QoS 41
Administration 42
IPS 42
L2 Switch 43
Status 43
Setting Up Your Wireless-N Router 44
Configuring Basic Setup Settings 45
Displaying A Read-Only Summary of the Basic Router Information 46
Configuring Internet Connection Settings 48
Configuring Local Area Network (LAN) Settings 60
Using The DMZ (Demilitarized Zone) Host Feature to
Access Special Purpose Internet Services 63
Cloning Your Network Adapter’s MAC Address onto Your Router 65
Configuring the Router’s Advanced Settings 66
Changing the Router’s Time Settings 70
Selecting IPv4 Mode or Dual Stack IPv4 And IPv6 Mode 72
Configuring Wireless Settings 76
Configuring Basic Settings 76
Configuring Wireless Security 80
Configuring Connection Control 88
Configuring Advanced Wireless Settings 89

Cisco WRVS4400N Wireless-N Gigabit Security Router with VPN Administration Guide v
Contents
Configuring VLAN & QoS Settings 92
Configuring Router WDS Settings 94
Configuring Firewall Settings 96
Configuring Basic Settings 97
Configuring IP Based ACL 99
Editing IP ACL Rules 101
Configuring Internet Access Policy 102
Configuring Single Port Forwarding 107
Configuring Port Range Forwarding 108
Configuring Port Range Triggering 110
Configuring the ProtectLink Gateway service 112
Configuring the VPN Settings 113
Displaying A VPN Status Summary of the IPSec Tunnel and Clients 113
Configuring IPSec VPN 116
Configuring VPN Client Accounts 123
Configuring VPN Passthrough 125
Configuring the QoS Settings 126
Managing Bandwidth 127
Configuring QoS 129
Configuring DSCP 130
Configuring the Administration Settings 131
Configuring Management Settings 132
Configuring System Logs 134
Diagnosing Router Problems 137
Backing Up and Restoring Configurations 139
Restoring Factory Default Settings 140
Rebooting the Router 141
Upgrading the Router Firmware 142

Cisco WRVS4400N Wireless-N Gigabit Security Router with VPN Administration Guide vi
Contents
Configuring IPS Settings 143
Configuring IPS 143
Setting P2P/IM Policy 145
Viewing Reports 147
Viewing Protection Information 148
Configuring the L2 Switch Settings 149
Configuring Virtual LANs (VLANs) 150
Configuring VLAN Membership and Port Assignment 152
Configuring RADIUS Mode 154
Configuring Port Settings 155
Viewing Statistics Overview 157
Mirroring Ports 158
Configuring RSTP 159
Viewing Status 160
Viewing WAN/Gateway Status 161
Viewing Local Network Status 163
Viewing Wireless LAN Status 165
Viewing System Performance 166
Chapter 6: Using the VPN Setup Wizard 168
VPN Setup Wizard 168
Before You Begin 168
Running the VPN Router Software Wizard 169
Building Your VPN Connection Remotely 178
Appendix A: Troubleshooting 186
Frequently Asked Questions 199

Cisco WRVS4400N Wireless-N Gigabit Security Router with VPN Administration Guide vii
Contents
Appendix B: Using Cisco QuickVPN for Windows 2000, XP, or Vista 203
Overview 203
Before You Begin 204
Installing the Cisco QuickVPN Software 205
Installing from the CD-ROM 205
Downloading and Installing from the Internet 207
Using the Cisco QuickVPN Software 207
Distributing Certificates to QuickVPN Users 210
Appendix C: Configuring a Gateway-to-Gateway IPSec Tunnel 211
Introduction 211
Environment 212
Configuring the VPN Settings for the VPN Routers 212
Configuring the VPN Settings for VPN Router 1 212
Configuring the VPN Settings for VPN Router 2 213
Configuring the Key Management Settings 214
Configuring the Key Management Settings for VPN Router 1 214
Configuring the Key Management Settings for VPN Router 2 215
Configuring PC 1 and PC 2 215
Appendix D: Finding Out MAC and IP Addresses 216
Windows 98 or Me Instructions 216
Windows 2000 or XP Instructions 217
For the Router’s Web-based Utility 217
Appendix E: Trend Micro ProtectLink Gateway Service 218
Overview 218
How to Access the Web-Based Utility 218
How to Purchase, Register, or Activate the Service 219
ProtectLink 219

Cisco WRVS4400N Wireless-N Gigabit Security Router with VPN Administration Guide viii
Contents
How to Use the Service 222
ProtectLink > Web Protection 222
ProtectLink > Email Protection 226
ProtectLink > License 226
Appendix F: Specifications 228
General 228
Performance 229
Management 229
Security 230
QoS 230
Layer 2 231
Environmental 231
Appendix G: Where to Go From Here 232
Product Resources 232
Related Documentation 233

Preface
Cisco WRVS4400N Wireless-N Gigabit Security Router with VPN Administration Guide ix
About This Document
This guide describes the Cisco Small Business WRVS4400N Wireless-N Gigabit
Security Router with VPN device and how to configure it.
How to Use This Guide
Look for the following items when reading this guide:
!
CAUTION This exclamation point indicates that caution should be used when performing a
step or a serious error may occur.
NOTE This checkmark indicates there is a note of interest and is something you should
pay special attention to while using the router.
Organization
This table describes the contents of each chapter in this document.
Chapter Title Description
Chapter 1 Introduction Introduces the product and this user
manual.
Chapter 2 Networking and
Security Basics
Introduces basic networking and
security concepts.
Chapter 3 Planning Your Virtual
Private Network (VPN)
Describes how to connect the
product.
Chapter 4 Getting Started with
the WRVS4400N
Router
Describes the physical features of
the WRVS4400N router and
provides information for installing the
router.

Preface
Cisco WRVS4400N Wireless-N Gigabit Security Router with VPN Administration Guide x
Chapter 5 Setting Up and
Configuring the
WRVS4400N Wireless-
N Router
Describes how to set up the product
software.
Chapter 6 Using the VPN Setup
Wizard
Describes how to configure a
gateway-to-gateway VPN tunnel
between two VPN routers.
Appendix A Troubleshooting Provides solutions to problems that
may occur during the installation and
operation of the router.
Appendix B Using Cisco QuickVPN
for Windows 2000, XP,
or Vista
Explains how to install and use the
Cisco QuickVPN software
Appendix C Configuring a Gateway-
to-Gateway IPSec
Tunnel
Explains how to establish a secure
IPSec tunnel using preshared keys to
join a private network inside the
router and a Windows 2000 or XP
computer.
Appendix D Finding Out MAC and IP
Addresses
Describes how to find the MAC
address for your computer’s Ethernet
adapter so you can use the MAC
address cloning feature of the router.
Appendix E Trend Micro
ProtectLink Gateway
Service
Explains how to use the Trend Micro
ProtectLink Gateway service
Appendix F Specifications Lists product specifications.
Chapter Title Description

Preface
Cisco WRVS4400N Wireless-N Gigabit Security Router with VPN Administration Guide xi
Finding Information in PDF Files
The Cisco WRVS4400N router documents are published as PDF files. The PDF
Find/Search tool within Adobe® Reader® lets you find information quickly and
easily online. You can perform the following tasks:
•Search an individual PDF file.
•Search multiple PDF files at once (for example, all PDFs in a specific folder
or disk drive).
•Perform advanced searches.
Finding Text in a PDF
Follow this procedure to find text in a PDF file.
STEP 1 Enter your search terms in the Find text box on the toolbar.
NOTE By default, the Find tool is available at the right end of the Acrobat toolbar. If the
Find tool does not appear, choose Edit > Find.
STEP 2 Optionally, click the arrow next to the Find text box to refine your search by
choosing special options such as Whole Words Only.
STEP 3 Press Enter.
STEP 4 Acrobat displays the first instance of the search term.
STEP 5 Press Enter again to continue to more instances of the term.

Preface
Cisco WRVS4400N Wireless-N Gigabit Security Router with VPN Administration Guide xii
Finding Text in Multiple PDF Files
The Search window lets you search for terms in multiple PDF files that are stored
on your computer or local network. The PDF files do not need to be open.
STEP 1 Start Acrobat Professional or Adobe Reader.
STEP 2 Choose Edit > Search, or click the arrow next to the Find box and then choose
Open Full Acrobat Search.
STEP 3 In the Search window, complete the following steps:
a. Enter the text that you want to find.
b. Choose All PDF Documents in.
From the drop-down box, choose Browse for Location. Then choose the
location on your computer or local network, and click OK.
c. If you want to specify additional search criteria, click Use Advanced Search
Options, and choose the options you want.

Preface
Cisco WRVS4400N Wireless-N Gigabit Security Router with VPN Administration Guide xiii
d. Click Search.
STEP 4 When the Results appear, click + to open a folder, and then click any link to open
the file where the search terms appear.
For more information about the Find and Search functions, see the Adobe Acrobat
online help.

1
Cisco WRVS4400N Wireless-N Gigabit Security Router with VPN Administration Guide 14
Introduction
Thank you for choosing the Cisco WRVS4400N Wireless-N Gigabit Security
Router with VPN. The Wireless-N Gigabit Security Router with VPN is an advanced
Internet-sharing network solution for your small business needs. WRVS4400N lets
multiple computers in your office share an Internet connection through both wired
and wireless connections.
The WRVS4400N wireless router features a built-in 4-Port full-duplex 10/100/
1000 Ethernet switch, which allows you to connect four personal computers
directly, or you can connect more hubs and switches to create as big a network as
you need.
You can use the WRVS4400N wireless router as an intranet router to aggregate
traffic to a company backbone network.
The WRVS4400N wireless router has a built-in access point that supports the
latest 802.11n draft specification by IEEE. The WRVS4400N wireless router also
supports 802.11g and 802.11b clients in a mixed environment.
The built-in access point can support an 11n data rate of up to 300 Mbps. In
addition to having a higher data rate, 802.11n technology also promises longer
coverage by using multiple antennas to transmit and receive data streams in
different directions. U
The Cisco WRVS4400N Wireless-N Gigabit Security Router with VPN is equipped
with advanced security technologies like Intrusion Prevention System (IPS),
Stateful Packet Inspection (SPI) Firewall, IP based Access List (IP ACL), and
Network Address Port Translation (NAPT, also called NAT as a more generic term).
These technologies work together by providing self-defensive strategy. They
identify, classify, and stop malicious attack traffic in real time while passing
through the WRVS4400N wireless router.
The SPI Firewall provides deep packet inspection to analyze packets in network
layer (IP) and transport layer (TCP, UDP) to block illegal packet transactions. You
can also use IP based ACL to limit traffic to a specific source, destination and
protocol.

Introduction
Cisco WRVS4400N Wireless-N Gigabit Security Router with VPN Administration Guide 15
1
NAPT allows you to open specific TCP/UDP port numbers to the Internet to
provide limited service while minimizing harmful traffic at the same time.
The Virtual Private Network (VPN) capability is another security feature that
creates encrypted “tunnels” through the Internet, allowing up to five remote offices
and five traveling users to securely connect into your office network from off-site.
Users connecting through a VPN tunnel are attached to your company’s network
with secure access to files, e-mail, and your intranet as if they were in the building.
You can also use the VPN capability to allow users on your small office network to
securely connect out to a corporate network.
The QoS features of the Cisco WRVS4400N Wireless-N Gigabit Security Router
with VPN provide consistent voice and video quality throughout your business.
This administration guide gives you all the information you need to connect, set up,
and configure your router.

2
Cisco WRVS4400N Wireless-N Gigabit Security Router with VPN Administration Guide 16
Networking and Security Basics
This chapter describes networking and security basics. It includes the following
sections:
•“An Introduction to LANs” on page 16
•“The Use of IP Addresses” on page 17
•“The Intrusion Prevention System (IPS)” on page 19
An Introduction to LANs
A router is a network device that connects two networks together.
The router connects your local area network (LAN), or the group of personal
computers in your home or office, to the Internet. The router processes and
regulates the data that travels between these two networks.
The router’s Network Address Translation (NAT) technology protects your network
of personal computers so users on the Internet cannot “see” your personal
computers. This is how your LAN remains private. The router protects your
network by inspecting the first packet coming in through the Internet port before
delivery to the final destination on one of the Ethernet ports. The router inspects
Internet port services like the web server, FTP server, or other Internet
applications, and, if allowed, it will forward the packet to the appropriate personal
computer on the LAN side.
You can use multiple Cisco WRVS4400N Wireless-N Gigabit Security Routers to
connect multiple LANs together. This usually applies to a medium-sized or larger
company where you want to divide your network into multiple IP subnets to
increase the intranet throughput and reduce the size of the IP broadcast domain
and its interference. In this case, you need one WRVS4400N wireless router for
each subnetwork and you can connect all the WAN ports to a second level router
or switch to the Internet.

Networking and Security Basics
The Use of IP Addresses
Cisco WRVS4400N Wireless-N Gigabit Security Router with VPN Administration Guide 17
2
The second level router only forwards data packets through a wired network so
you don’t have to use the Cisco WRVS4400N Wireless-N Gigabit Security Router.
You can use any wired router in the Cisco family such as RVS4000 that has 4 LAN
ports and 1 WAN port.
The Use of IP Addresses
IP stands for Internet Protocol. Every device in an IP-based network, including
personal computers, print servers, and routers, requires an IP address to identify
its location, or address, on the network. This applies to both the Internet and LAN
connections.
There are two ways of assigning IP addresses to your network devices.
A static IP address is a fixed IP address that you assign manually to a personal
computer or other device on the network. Since a static IP address remains valid
until you disable it, static IP addressing ensures that the device assigned it will
always have that same IP address until you change it. Static IP addresses are
commonly used with network devices such as server personal computers or print
servers.

Networking and Security Basics
The Use of IP Addresses
Cisco WRVS4400N Wireless-N Gigabit Security Router with VPN Administration Guide 18
2
If you use the router to share your cable or DSL Internet connection, contact your
ISP to find out if they have assigned a static IP address to your account. If so, you
will need that static IP address when configuring the router. You can get the
information from your ISP.
A dynamic IP address is automatically assigned to a device on the network. These
IP addresses are called dynamic because they are only temporarily assigned to
the personal computer or other device. After a certain time period, they expire and
may change. If a personal computer logs onto the network (or the Internet) and its
dynamic IP address has expired, the DHCP server will assign it a new dynamic IP
address.
A DHCP server can either be a designated personal computer on the network or
another network device, such as the router. By default, the router’s Internet
Connection Type is Obtain an IP automatically (DHCP).
The personal computer or network device obtaining an IP address is called the
DHCP client. DHCP frees you from having to assign IP addresses manually every
time a new user is added to your network.
For DSL users, many ISPs may require you to log on with a user name and
password to gain access to the Internet. This is a dedicated, high-speed
connection type called Point to Point Protocol over Ethernet (PPPoE). PPPoE is
similar to a dial-up connection, but PPPoE does not dial a phone number when
establishing a connection. It also will provide the router with a dynamic IP address
to establish a connection to the Internet.
By default, a DHCP server (on the LAN side) is enabled on the router. If you already
have a DHCP server running on your network, you MUST disable one of the two
DHCP servers. If you run more than one DHCP server on your network, you will
experience network errors, such as conflicting IP addresses. To disable DHCP on
the router, see the Basic Setup section in Chapter 5, “Setting Up and
Configuring the WRVS4400N Wireless-N Router.”
NOTE Since the router is a device that connects two networks, it needs two IP
addresses—one for the LAN, and one for the Internet. In this Administration
Guide, you’ll see references to the “Internet IP address” and the “LAN IP
address”.
Since the router uses NAT technology, the only IP address that can be seen
from the Internet for your network is the router’s Internet IP address.
However, even this Internet IP address can be blocked so the router and
network seem invisible to the Internet.

Networking and Security Basics
The Intrusion Prevention System (IPS)
Cisco WRVS4400N Wireless-N Gigabit Security Router with VPN Administration Guide 19
2
The Intrusion Prevention System (IPS)
IPS is an advanced technology to protect your network from malicious attacks. IPS
works together with your SPI Firewall, IP Based Access Control List (ACL),
Network Address Port Translation (NAPT), and Virtual Private Network (VPN) to
achieve the highest level of security. IPS works by providing real-time detection
and prevention as an in-line module in a router.
The WRVS4400N wireless router has hardware-based acceleration for real-time
pattern matching for detecting malicious attacks. It actively filters and drops
malicious TCP/UDP/ICMP/IGMP packets and can reset TCP connections. This
protects your client personal computers and servers running various operating
systems including Windows, Linux, and Solaris from network worm attacks.
However, this system does not prevent viruses contained in e-mail attachments.
The P2P (peer to peer) and IM (instant messaging) control allows you to prevent
network users from using those protocols to communicate with people over the
Internet. This helps the administrators to set up company policies on how to use
their Internet bandwidth wisely.
The signature file is the heart of the IPS system. It is similar to the virus definition
files on your personal computer’s Anti-Virus programs. IPS uses this file to match
against packets coming in to the Router and performs actions accordingly. As of
today, the Wireless-N Router is shipped with signature file version 1.3.8 and with a
total of 1101 rules. The rules cover the following categories: DDoS, Buffer
Overflow, Access Control, Scan, Trojan Horse, Misc., P2P, IM, Virus, Worm, and
Web Attacks.
It is recommended that you update your IPS signature file regularly to thwart new
attack types.
The following diagram illustrates a number of IPS scenarios.

Networking and Security Basics
The Intrusion Prevention System (IPS)
Cisco WRVS4400N Wireless-N Gigabit Security Router with VPN Administration Guide 20
2