Draytek Vigor3900 Series User manual

Vigor3900 Series User’s Guide
ii
Vigor3900
Multi-WAN Security Appliance
User’s Guide
Version: 1.7
Firmware Version: V1.0.7
(For future update, please visit DrayTek website)
Date: 17/09/2013

Vigor3900 Series User’s Guide iii
Copyright Information
Copyright
Declarations
Copyright 2013 All rights reserved. This publication contains information that is
protected by copyright. No part may be reproduced, transmitted, transcribed, stored in a
retrieval system, or translated into any language without written permission from the
copyright holders.
Trademarks
The following trademarks are used in this document:
zMicrosoft is a registered trademark of Microsoft Corp.
zWindows, Windows 95, 98, Me, NT, 2000, XP, Vista and Explorer are
trademarks of Microsoft Corp.
zApple and Mac OS are registered trademarks of Apple Inc.
zOther products may be trademarks or registered trademarks of their respective
manufacturers.
Safety Instructions and Approval
Safety
Instructions
zRead the installation guide thoroughly before you set up the router.
zThe router is a complicated electronic unit that may be repaired only be
authorized and qualified personnel. Do not try to open or repair the router
yourself.
zDo not place the router in a damp or humid place, e.g. a bathroom.
zThe router should be used in a sheltered area, within a temperature range of +5 to
+40 Celsius.
zDo not expose the router to direct sunlight or other heat sources. The housing and
electronic components may be damaged by direct sunlight or heat sources.
zDo not deploy the cable for LAN connection outdoor to prevent electronic shock
hazards.
zKeep the package out of reach of children.
zWhen you want to dispose of the router, please follow local regulations on
conservation of the environment.
Warranty
We warrant to the original end user (purchaser) that the router will be free from any
defects in workmanship or materials for a period of two (2) years from the date of
purchase from the dealer. Please keep your purchase receipt in a safe place as it serves
as proof of date of purchase. During the warranty period, and upon proof of purchase,
should the product have indications of failure due to faulty workmanship and/or
materials, we will, at our discretion, repair or replace the defective products or
components, without charge for either parts or labor, to whatever extent we deem
necessary tore-store the product to proper operating condition. Any replacement will
consist of a new or re-manufactured functionally equivalent product of equal value, and
will be offered solely at our discretion. This warranty will not apply if the product is
modified, misused, tampered with, damaged by an act of God, or subjected to abnormal
working conditions. The warranty does not cover the bundled or licensed software of
other vendors. Defects which do not significantly affect the usability of the product will
not be covered by the warranty. We reserve the right to revise the manual and online
documentation and to make changes from time to time in the contents hereof without
obligation to notify any person of such revision or changes.
Be a Registered
Owner Web registration is preferred. You can register your Vigor router via
http://www.draytek.com.
Firmware & Tools
Updates Due to the continuous evolution of DrayTek technology, all routers will be regularly
upgraded. Please consult the DrayTek web site for more information on newest
firmware, tools and documents.
http://www.draytek.com

Vigor3900 Series User’s Guide
iv
European Community Declarations
Manufacturer: DrayTek Corp.
Address: No. 26, Fu Shing Road, HuKou Township, HsinChu Industrial Park, Hsin-Chu County, Taiwan
303
Product: Vigor3900
DrayTek Corp. declares that Vigor3900 of routers are in compliance with the following essential requirements
and other relevant provisions of EC, Directive 2004/108/EC.
The product conforms to the requirements of Electro-Magnetic Compatibility (EMC) Directive 2004/108/EC by
complying with the requirements set forth in EN55022/Class A and EN55024/Class A.
The product conforms to the requirements of Low Voltage (LVD) Directive 2006/95/EC by complying with the
requirements set forth in EN60950-1.
Regulatory Information
Federal Communication Commission Interference Statement
This equipment has been tested and found to comply with the limits for a Class A digital device, pursuant to Part
15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a
residential installation. This equipment generates, uses and can radiate radio frequency energy and, if not installed
and used in accordance with the instructions, may cause harmful interference to radio communications. However,
there is no guarantee that interference will not occur in a particular installation. If this equipment does cause
harmful interference to radio or television reception, which can be determined by turning the equipment off and
on, the user is encouraged to try to correct the interference by one of the following measures:
zReorient or relocate the receiving antenna.
zIncrease the separation between the equipment and receiver.
zConnect the equipment into an outlet on a circuit different from that to which the receiver is connected.
zConsult the dealer or an experienced radio/TV technician for help.
This device complies with Part 15 of the FCC Rules. Operation is subject to the following two conditions:
(1) This device may not cause harmful interference, and
(2) This device may accept any interference received, including interference that may cause undesired operation.
Please visit http://www.draytek.com/user/SupportDLRTTECE.php

Vigor3900 Series User’s Guide v
T
Ta ab bl le e o of f C Co on nt te en nt ts s
Chapter 1: Preface.............................................................................................................1
1.1 Web Configuration Buttons Explanation ...................................................................................... 2
1.2 LED Indicators and Connectors................................................................................................... 2
1.3 Hardware Installation.................................................................................................................... 5
1.3.1 Network Connection ................................................................................................................5
1.3.2 Rack-Mounted Installation.......................................................................................................6
Chapter 2: Initialing Settings ............................................................................................7
2.1 Changing Password..................................................................................................................... 7
2.2 Quick Start Wizard........................................................................................................................ 9
2.2.1 Step 1 - Specifying the WAN Profile........................................................................................9
2.2.2 Step 2 - Configuring the Selected Protocol...........................................................................11
2.3 Register Vigor Router................................................................................................................. 18
Chapter 3: Application and Tutorial................................................................................21
3.1 How to Configure Load Balance with Multi-WAN on Vigor2960, Vigor300B or Vigor3900?...... 21
3.2 How to Configure OSPF?........................................................................................................... 27
3.3 How to Configure LAN to LAN IPSec Tunnel between Vigor3900 and Other Router (Main Mode)
.......................................................................................................................................................... 33
3.4 How to run RDP service in the browser via logging in 3900's HTTPS Server?......................... 36
3.5 How to Configure VPN Load Balance between Vigor3900 and Other Router........................... 41
3.6 How to Setup 50 WANs on Vigor3900....................................................................................... 50
3.7 CVM Application - How to manage the CPE (router) through Vigor3900?................................ 55
3.8 CVM Application - How to build the VPN between remote devices and Vigor3900? ................ 60
3.9 CVM Application - How to upgrade CPE firmware through Vigor3900?.................................... 63
3.10 How to use High Availability for Vigor routers?........................................................................ 69
Chapter 4: Advanced Web Configuration......................................................................73
4.1 WAN Setup................................................................................................................................. 73
4.1.1 General Setup........................................................................................................................74
4.1.2 Default Route.........................................................................................................................92
4.1.3 Load Balance.........................................................................................................................93
4.1.4 Switch .............................................................................................................................107
4.2 LAN ...........................................................................................................................................112
4.2.1 General Setup......................................................................................................................112
4.2.2 PPPoE Server......................................................................................................................125
4.2.3 IP Routing............................................................................................................................128
4.2.4 Static Route.........................................................................................................................130
4.2.5 Switch .............................................................................................................................136
4.2.6 Bind IP to MAC....................................................................................................................143
4.2.7 RIP Configuration ................................................................................................................146
4.2.8 OSPF Configuration.............................................................................................................148

Vigor3900 Series User’s Guide
vi
4.3 NAT........................................................................................................................................... 149
4.3.1 Port Redirection...................................................................................................................149
4.3.2 DMZ Host.............................................................................................................................153
4.3.3 Address Mapping.................................................................................................................157
4.3.4 ALG .............................................................................................................................161
4.4 Firewall..................................................................................................................................... 162
4.4.1 Filter Setup ..........................................................................................................................162
4.4.2 DoS Defense .......................................................................................................................179
4.4.3 MAC Block...........................................................................................................................182
4.5 Objects Setting......................................................................................................................... 184
4.5.1 IP Object .............................................................................................................................185
4.5.2 IP Group .............................................................................................................................188
4.5.3 Service Type Object ............................................................................................................190
4.5.4 Service Type Group.............................................................................................................193
4.5.5 Keyword Object ...................................................................................................................195
4.5.6 File Extension Object...........................................................................................................197
4.5.7 IM Object .............................................................................................................................200
4.5.8 P2P Object...........................................................................................................................203
4.5.9 Protocol Object....................................................................................................................205
4.5.10 Web Category Object ........................................................................................................207
4.5.11 QQ Object..........................................................................................................................212
4.5.12 QQ Group..........................................................................................................................214
4.5.13 Time Object .......................................................................................................................217
4.5.14 Time Group........................................................................................................................220
4.5.15 SMS Service Object...........................................................................................................222
4.5.16 Mail Service Object............................................................................................................225
4.5.17 Notification Object..............................................................................................................228
4.6 User Management.................................................................................................................... 230
4.6.1 General Setup......................................................................................................................231
4.6.2 User Profile..........................................................................................................................234
4.6.3 User Group..........................................................................................................................239
4.6.4 RADIUS .............................................................................................................................241
4.6.5 LDAP/Active Directory.........................................................................................................242
4.7 Application................................................................................................................................ 246
4.7.1 Dynamic DNS......................................................................................................................246
4.7.2 GVRP .............................................................................................................................251
4.7.3 IGMP Proxy .........................................................................................................................253
4.7.4 UPnP .............................................................................................................................253
4.7.5 High Availability ...................................................................................................................256
4.7.6 Wake on LAN.......................................................................................................................264
4.7.7 SMS / Mail Alert Service......................................................................................................265
4.8 VPN and Remote Access......................................................................................................... 270
4.8.1 VPN Client Wizard...............................................................................................................270
4.8.2 VPN Server Wizard..............................................................................................................276
4.8.3 Remote Access Control.......................................................................................................280
4.8.4 PPP General Setup .............................................................................................................281
4.8.5 IPSec General Setup...........................................................................................................284
4.8.6 VPN Profiles ........................................................................................................................285
4.8.7 VPN Trunk Management.....................................................................................................296
4.8.8 Connection Management ....................................................................................................303
4.9 Certificate Management........................................................................................................... 304
4.9.1 Local Certificate...................................................................................................................305
4.9.2 Trusted Certificate ...............................................................................................................308

Vigor3900 Series User’s Guide vii
4.9.3 Remote Certificate...............................................................................................................311
4.10 SSL VPN ................................................................................................................................ 312
4.10.1 SSL Tunnel (OpenVPN) ....................................................................................................312
4.10.2 SSL Web Proxy .................................................................................................................314
4.10.3 SSL Application .................................................................................................................316
4.10.4 Online User Status.............................................................................................................321
4.11 Central VPN Management ..................................................................................................... 322
4.11.1 General Setup....................................................................................................................322
4.11.2 CPE Management .............................................................................................................325
4.11.3 Log/Alert ............................................................................................................................334
4.12 Bandwidth Management ........................................................................................................ 335
4.12.1 Quality of Service...............................................................................................................336
4.12.2 QoS Rule...........................................................................................................................338
4.12.3 Sessions Limit....................................................................................................................343
4.12.4 Bandwidth Limit .................................................................................................................346
4.13 USB Application...................................................................................................................... 350
4.13.1 Temperature Sensor..........................................................................................................350
4.14 System Maintenance.............................................................................................................. 352
4.14.1 TR-069 .............................................................................................................................352
4.14.2 Administrator Password.....................................................................................................353
4.14.3 Configuration Backup ........................................................................................................354
4.14.4 Syslog / Mail Alert..............................................................................................................357
4.14.5 Time and Date...................................................................................................................360
4.14.6 Access Control...................................................................................................................361
4.14.7 SNMP Setup......................................................................................................................362
4.14.8 Reboot System..................................................................................................................363
4.14.9 Firmware Upgrade.............................................................................................................364
4.15 Diagnostics............................................................................................................................. 365
4.15.1 Routing Table ....................................................................................................................365
4.15.2 ARP Cache Table..............................................................................................................368
4.15.3 DHCP Table.......................................................................................................................371
4.15.4 NAT Session Table............................................................................................................373
4.15.5 Traffic Graph......................................................................................................................374
4.15.6 Web Console.....................................................................................................................376
4.15.7 Ping/Trace Route...............................................................................................................377
4.15.8 Data Flow Monitor..............................................................................................................378
4.16 External Devices .................................................................................................................... 379
4.17 Product Registration............................................................................................................... 380
Chapter 5: Trouble Shooting.........................................................................................381
5.1 Checking If the Hardware Status Is OK or Not......................................................................... 381
5.2 Checking If the Network Connection Settings on Your Computer Is OK or Not ...................... 382
5.3 Pinging the Router from Your Computer.................................................................................. 384
5.4 Checking If the ISP Settings are OK or Not............................................................................. 385
5.5 Backing to Factory Default Setting If Necessary...................................................................... 386
5.6 Contacting Your Dealer ............................................................................................................ 387

Vigor3900 Series User’s Guide 1
C
Ch ha ap pt te er r 1 1: : P Pr re ef fa ac ce e
The Vigor3900 Series integrates a rich suite of functions, including NAT, firewall, VPN,
load balance, and bandwidth management capability. These products are very suitable for
providing multi-integrated solutions to SME markets.
A Virtual Private Network (VPN) is an extension of a private network that encompasses
links across shared or public networks like an Intranet. A VPN enables you to send data
between two computers across a shared public Internet network in a manner that emulates
the properties of a point-to-point private link. The DrayTek Vigor3900 Series VPN router
supports Internet-industry standards technology to provide customers with open,
interoperable VPN solutions such as X.509, DHCP over Internet Protocol Security (IPSec)
up to 500 tunnels, and Point-to-Point Tunneling Protocol (PPTP).

Vigor3900 Series User’s Guide
2
1
1. .1 1 W We eb b C Co on nf fi ig gu ur ra at ti io on n B Bu ut tt to on ns s E Ex xp pl la an na at ti io on n
Several main buttons appeared on the web pages are defined as the following:
Save and apply current settings.
Cancel current settings and recover to the previous saved settings.
Clear all the selections and parameters settings, including selection from
drop-down list. All the values must be reset with factory default settings.
Add new settings for specified item.
Edit the settings for the selected item.
Delete the selected item with the corresponding settings.
Note: For the other buttons shown on the web pages, please refer to Chapter 4 for detailed
explanation.
1
1. .2 2 L LE ED D I In nd di ic ca at to or rs s a an nd d C Co on nn ne ec ct to or rs s
Before you use the Vigor router, please get acquainted with the LED indicators and
connectors first. The displays of LED indicators and connectors for the routers are different
slightly.

Vigor3900 Series User’s Guide 3
D
De es sc cr ri ip pt ti io on n f fo or r L LE ED D
LED Status Explanation
On The router is powered on.PWR
Off The router is powered off.
Blinking The system is active.ACT On/Off The system is hanged.
On The fiber connection is established.SFP 1/2
Off No fiber connection is established.
On The USB device is installed and ready.USB 1/2
Off No USB device is installed.
On The Ethernet link is established on corresponding port.
Blinking The data transmission is done through the corresponding
port.
L
N
K
Off No Ethernet link is established.
On It means that a normal 1000 Mbps connection is through
its corresponding port.
GigaLAN1
/LAN 2)
1000
Off It means that a normal 10/100 Mbps connection is
through its corresponding port.
On The Ethernet link is established.
Blinking The data transmission is done through the corresponding
port.
L
N
K
Off No Ethernet link is established.
On It means that a normal 1000Mbps connection is through
its corresponding port.
Giga
WAN1/2/3/4
1000
Off It means that a normal 10/100Mbps connection is through
its corresponding port.

Vigor3900 Series User’s Guide
4
C
Co on nn ne ec ct to or rs s
Interface Description
GigaLAN1 / 2 Connecter for local network devices.
3(SFP) Connecter for fiber cable.
GigaWAN1/2/3/4 Connecter for remote network devices.
5(SFP) Connecter for fiber cable.
Console Provided for technician use.
USB1 / USB2 Connecter for the USB device.
Factory Reset Used to restore the default settings. Press it and keep for
more than 5 seconds. When you see the ACT LED begins
to blink, release the button. Then the router will restart with
the factory default configuration.
Connecter for a power cord.
ON/OFF - Power switch.

Vigor3900 Series User’s Guide 5
1
1. .3 3 H Ha ar rd dw wa ar re e I In ns st ta al ll la at ti io on n
1
1. .3 3. .1 1 N Ne et tw wo or rk k C Co on nn ne ec ct ti io on n
Before starting to configure the router, you have to connect your devices correctly.
1. Connect one end of an Ethernet cable (RJ-45) to one of the LAN ports of Vigor3900s.
2. Connect the other end of the cable (RJ-45) to the Ethernet port on your computer (that
device also can connect to other computers to form a small area network). The LAN
LED for that port on the front panel will light up.
3. Connect a server/modem/router (depends on your requirement) to any WAN port of
Vigor3900 with Ethernet cable (RJ-45). The WAN1 (to WAN4) LED will light up.
4. Connect the power cord to Vigor3900’s power port on the rear panel, and the other side
into a wall outlet.
5. Power on the device by pressing down the power switch on the rear panel. The PWR
LED should be ON.
6. The system starts to initiate. After completing the system test, the ACT LED will light
up and start blinking.
Below shows an outline of the hardware installation for your reference.

Vigor3900 Series User’s Guide
6
1
1. .3 3. .2 2 R Ra ac ck k- -M Mo ou un nt te ed d I In ns st ta al ll la at ti io on n
The Vigor3900 Series can be mounted on a rack by using standard brackets in a 19-inch rack
or optional larger brackets on 23-inch rack (not included). The bracket for 19- and 23-inch
racks are shown below.
Attach the brackets to the chassis of a 19- or a 23-inch rack. The second bracket attaches the
other side of the chassis as above procedure.
After the bracket installation, the Vigor3900 Series chassis can be installed in a rack by using
four screws for each side of the rack.
D
De es sk kt to op p T Ty yp pe e I In ns st ta al ll la at ti io on n
Rubber pads are included with the Vigor3900 Series. These rubber pads improve the air
circulation and decrease unnecessary rubbing on the desktop.

Vigor3900 Series User’s Guide 7
C
Ch ha ap pt te er r 2 2: : I In ni it ti ia al li in ng g S Se et tt ti in ng gs s
For use the router properly, it is necessary for you to change the password of web
configuration for security and adjust primary basic settings.
This chapter explains how to setup a password for an administrator and how to adjust basic
settings for accessing Internet successfully. Be aware that only the administrator can change
the router configuration.
2
2. .1 1 C Ch ha an ng gi in ng g P Pa as ss sw wo or rd d
To change the password for this device, you have to access into the web browse with default
password first.
1. Make sure your computer connects to the router correctly.
Notice: You may either simply set up your computer to get IP
dynamically from the router or set up the IP address of the computer to be
the same subnet as the default IP address of Vigor router 192.168.1.1.
For the detailed information, please refer to the later section - Trouble
Shooting of this guide.
2. Open a web browser on your PC and type http://192.168.1.1. A pop-up window will
open to ask for username and password. Please type default values on the window for
the first time accessing. The default value for user name is admin and the password is
admin. Next, click Login.

Vigor3900 Series User’s Guide
8
3. Now, the Main Screen will pop up.
4. Go to System Maintenance page and choose Administrator Password.
5. Enter the login password (admin) on the field of Original Password. Type a new one
in the field of New Password and retype it on the field of Confirm Password. Then
click Apply to continue.
6. Now, the password has been changed. Next time, use the new password to access the
Web User Interface for this router.

Vigor3900 Series User’s Guide 9
2
2. .2 2 Q Qu ui ic ck k S St ta ar rt t W Wi iz za ar rd d
Quick Start Wizard is a wizard which is designed for configuring your router accessing
Internet with simply steps. In the Quick Start Wizard group, you can configure the router to
access the Internet with different modes such as Static, DHCP, PPPoE, or PPTP modes.
For most users, Internet access is the primary application. The router supports the Ethernet
WAN interface for Internet access.
Click Quick Start Wizard from the home page. Quick Start Wizard will guide the user to
establish LAN interface profile, WAN interface profile and select proper protocol for
connection. The following will explain in more detail for the various broadband access
configurations.
2
2. .2 2. .1 1 S St te ep p 1 1 - - S Sp pe ec ci if fy yi in ng g t th he e W WA AN N P Pr ro of fi il le e
In the first page of Quick Start Wizard, please create a WAN profile.
Available settings are explained as follows:
Item Description
Profile Use the drop down list to choose one WAN profile.
IPv4 Protocol Use the drop down list to choose a connection mode for such
WAN profile.

Vigor3900 Series User’s Guide
10
Item Description
Static - If Static is selected, you can manually assign a static
IP address to the WAN interface and complete the
configuration by applying the settings.
DHCP - It allows a user to obtain an IP address automatically
from a DHCP server on the Internet. If you choose
DHCP mode, the DHCP server of your ISP will
assign a dynamic IP address for Vigor3900
automatically. It is not necessary for you to assign
any setting. (Host Name and Domain Name are
required for some ISPs).
PPTP - This mode lets user get the IP group information by a
DSL modem with PPTP service from ISP. Your
service provider will give you user name, password,
and authentication mode for a PPTP setting. Click
PPTP as the protocol. Type in all the information
that your ISP provides for this protocol.
If your ISP offers you PPTP (Point-to-Point
Tunneling Protocol) mode, please select PPTP for
this router. Next, enter the required information
provided by your ISP on the web page.
PPPoE - PPPoE stands for Point-to-Point Protocol over
Ethernet. It relies on two widely accepted standards:
PPP and Ethernet. It connects users through an
Ethernet to the Internet with a common broadband
medium, such as a single DSL line, wireless device
or cable modem. All the users over the Ethernet can
share a common connection.
PPPoE is used for most of DSL modem users. All
local users can share one PPPoE connection for
accessing the Internet. Your service provider will
provide you information about user name, password,
and authentication mode.
If your ISP provides you the PPPoE (Point-to-Point
Protocol over Ethernet) connection, please select
PPPoE for this router to get the following page.
Enter the username and password provided by your
ISP on the web page.
Note: After you creating the WAN profile(s) by using Quick Start Wizard, you can
select the existing WAN profiles for next time. Simply use the drop down list to choose
the WAN profile available for modifying.
When you finish the above settings, please click Next to go to next page.

Vigor3900 Series User’s Guide 11
2
2. .2 2. .2 2 S St te ep p 2 2 - - C Co on nf fi ig gu ur ri in ng g t th he e S Se el le ec ct te ed d P Pr ro ot to oc co ol l
This page will be changed according to the IPv4 Protocol Type selected on last page.
I
If f S St ta at ti ic c i is s s se el le ec ct te ed d
If Static is selected, the following screen will appear. You can manually assign a static IP
address to the WAN interface and complete the configuration by applying the settings.
Available parameters are listed as follows:
Item Description
IP Address Type a public IP address for such WAN profile.
Subnet Mask Choose the static mask from the drop down list.
Gateway IP Address Type a public gateway address for such WAN profile.
- click it to remove the IP address if you are not satisfied
with it.

Vigor3900 Series User’s Guide
12
DNS Server IP
Address Add – Click this button to display the IP address field for
adding a new IP address. Type the IP address on the tiny boxes
one by one.
Save – After finished the IP address configuration, click Save
to save the setting onto the router.
– Click the icon to remove the selected entry.
Previous Click it to return to previous setting page.
Finish Click it to finish the configuration.
Cancel Click it to discard the settings configured in this page.
When you finished the above settings, please click Finish.