Draytek Vigor3900 Series User manual

Vigor3900 Series User’s Guide
ii
Vigor3900
Multi-WAN Security Appliance
User’s Guide
Version: 1.8
Firmware Version: V1.0.8
(For future update, please visit DrayTek website)
Date: March 27, 2014

Vigor3900 Series User’s Guide iii
Copyright Information
Copyright
Declarations
Copyright 2014 All rights reserved. This publication contains information that is
protected by copyright. No part may be reproduced, transmitted, transcribed, stored in a
retrieval system, or translated into any language without written permission from the
copyright holders.
Trademarks
The following trademarks are used in this document:
Microsoft is a registered trademark of Microsoft Corp.
Windows, Windows 95, 98, Me, NT, 2000, XP, Vista and Explorer are
trademarks of Microsoft Corp.
Apple and Mac OS are registered trademarks of Apple Inc.
Other products may be trademarks or registered trademarks of their respective
manufacturers.
Safety Instructions and Approval
Safety
Instructions
Read the installation guide thoroughly before you set up the router.
The router is a complicated electronic unit that may be repaired only be
authorized and qualified personnel. Do not try to open or repair the router
yourself.
Do not place the router in a damp or humid place, e.g. a bathroom.
The router should be used in a sheltered area, within a temperature range of +5 to
+40 Celsius.
Do not expose the router to direct sunlight or other heat sources. The housing and
electronic components may be damaged by direct sunlight or heat sources.
Do not deploy the cable for LAN connection outdoor to prevent electronic shock
hazards.
Keep the package out of reach of children.
When you want to dispose of the router, please follow local regulations on
conservation of the environment.
Warranty
We warrant to the original end user (purchaser) that the router will be free from any
defects in workmanship or materials for a period of two (2) years from the date of
purchase from the dealer. Please keep your purchase receipt in a safe place as it serves
as proof of date of purchase. During the warranty period, and upon proof of purchase,
should the product have indications of failure due to faulty workmanship and/or
materials, we will, at our discretion, repair or replace the defective products or
components, without charge for either parts or labor, to whatever extent we deem
necessary tore-store the product to proper operating condition. Any replacement will
consist of a new or re-manufactured functionally equivalent product of equal value, and
will be offered solely at our discretion. This warranty will not apply if the product is
modified, misused, tampered with, damaged by an act of God, or subjected to abnormal
working conditions. The warranty does not cover the bundled or licensed software of
other vendors. Defects which do not significantly affect the usability of the product will
not be covered by the warranty. We reserve the right to revise the manual and online
documentation and to make changes from time to time in the contents hereof without
obligation to notify any person of such revision or changes.
Be a Registered
Owner Web registration is preferred. You can register your Vigor router via
http://www.draytek.com.
Firmware & Tools
Updates Due to the continuous evolution of DrayTek technology, all routers will be regularly
upgraded. Please consult the DrayTek web site for more information on newest
firmware, tools and documents.
http://www.draytek.com

Vigor3900 Series User’s Guide
iv
European Community Declarations
Manufacturer: DrayTek Corp.
Address: No. 26, Fu Shing Road, HuKou Township, HsinChu Industrial Park, Hsin-Chu County, Taiwan
303
Product: Vigor3900
DrayTek Corp. declares that Vigor3900 of routers are in compliance with the following essential requirements
and other relevant provisions of EC, Directive 2004/108/EC.
The product conforms to the requirements of Electro-Magnetic Compatibility (EMC) Directive 2004/108/EC by
complying with the requirements set forth in EN55022/Class A and EN55024/Class A.
The product conforms to the requirements of Low Voltage (LVD) Directive 2006/95/EC by complying with the
requirements set forth in EN60950-1.
Regulatory Information
Federal Communication Commission Interference Statement
This equipment has been tested and found to comply with the limits for a Class A digital device, pursuant to Part
15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a
residential installation. This equipment generates, uses and can radiate radio frequency energy and, if not installed
and used in accordance with the instructions, may cause harmful interference to radio communications. However,
there is no guarantee that interference will not occur in a particular installation. If this equipment does cause
harmful interference to radio or television reception, which can be determined by turning the equipment off and
on, the user is encouraged to try to correct the interference by one of the following measures:
Reorient or relocate the receiving antenna.
Increase the separation between the equipment and receiver.
Connect the equipment into an outlet on a circuit different from that to which the receiver is connected.
Consult the dealer or an experienced radio/TV technician for help.
This device complies with Part 15 of the FCC Rules. Operation is subject to the following two conditions:
(1) This device may not cause harmful interference, and
(2) This device may accept any interference received, including interference that may cause undesired operation.
Please visit http://www.draytek.com/user/SupportDLRTTECE.php

Vigor3900 Series User’s Guide v
T
Ta ab bl le e o of f C Co on nt te en nt ts s
Chapter 1: Introduction.....................................................................................................1
1.1 Web Configuration Buttons Explanation ...................................................................................... 2
1.2 LED Indicators and Connectors................................................................................................... 2
1.3 Hardware Installation.................................................................................................................... 5
1.3.1 Network Connection ................................................................................................................5
1.3.2 Rack-Mounted Installation.......................................................................................................6
Chapter 2: Initialing Settings............................................................................................7
2.1 Changing Password..................................................................................................................... 7
2.2 Quick Start Wizard........................................................................................................................ 9
2.2.1 Step 1 - Specifying the WAN Profile........................................................................................9
2.2.2 Step 2 - Configuring the Selected Protocol...........................................................................11
2.3 Register Vigor Router................................................................................................................. 18
Chapter 3: Application and Tutorial................................................................................21
3.1 How to Configure Load Balance with Multi-WAN on Vigor3900?.............................................. 21
3.2 How to Configure OSPF?........................................................................................................... 27
3.3 How to Configure LAN to LAN IPSec Tunnel between Vigor3900 and Other Router (Main Mode)
.......................................................................................................................................................... 33
3.4 How to run RDP service in the browser via logging in 3900's HTTPS Server?......................... 36
3.5 How to Configure VPN Load Balance between Vigor3900 and Other Router........................... 41
3.6 How to Setup 50 WANs on Vigor3900....................................................................................... 50
3.7 CVM Application - How to manage the CPE (router) through Vigor3900?................................ 55
3.8 CVM Application - How to build the VPN between remote devices and Vigor3900? ................ 60
3.9 CVM Application - How to upgrade CPE firmware through Vigor3900?.................................... 63
3.10 How to use High Availability for Vigor routers?........................................................................ 69
3.11 How to Configure DNS Inbound Load Balance on Vigor 3900? .............................................. 73
Chapter 4: Advanced Web Configuration......................................................................77
4.1 WAN Setup................................................................................................................................. 77
4.1.1 General Setup........................................................................................................................78
4.1.2 Default Route.........................................................................................................................98
4.1.3 Load Balance.........................................................................................................................99
4.1.4 Switch .............................................................................................................................113
4.2 LAN ...........................................................................................................................................117
4.2.1 General Setup......................................................................................................................117
4.2.2 PPPoE Server......................................................................................................................131
4.2.3 Switch .............................................................................................................................134
4.2.4Bind IP to MAC.....................................................................................................................141
4.2.5 LAN DNS.............................................................................................................................144
4.3 Routing..................................................................................................................................... 147

Vigor3900 Series User’s Guide
vi
4.3.1 Static Route.........................................................................................................................147
4.3.2 RIP Configuration ................................................................................................................154
4.3.3 OSPF Configuration.............................................................................................................156
4.3.4 BGP Configuration...............................................................................................................158
4.4 NAT........................................................................................................................................... 163
4.4.1 Port Redirection ...................................................................................................................163
4.4.2 DMZ Host.............................................................................................................................168
4.4.3 Address Mapping.................................................................................................................172
4.4.4 ALG .............................................................................................................................176
4.5 Firewall..................................................................................................................................... 177
4.5.1 Filter Setup ..........................................................................................................................177
4.5.2 DoS Defense .......................................................................................................................201
4.5.3 MAC Block...........................................................................................................................205
4.6 Objects Setting......................................................................................................................... 207
4.6.1 IP Object .............................................................................................................................208
4.6.2 IP Group .............................................................................................................................211
4.6.3 IPv6 Object..........................................................................................................................213
4.6.4 Country Object.....................................................................................................................215
4.6.5 Service Type Object ............................................................................................................217
4.6.6 Service Type Group.............................................................................................................220
4.6.7 Keyword /DNS Object..........................................................................................................222
4.6.8 File Extension Object...........................................................................................................226
4.6.9 APP Object..........................................................................................................................229
4.6.10 Web Category Object ........................................................................................................232
4.6.11 QQ Object..........................................................................................................................237
4.6.12 QQ Group..........................................................................................................................239
4.6.13 Time Object .......................................................................................................................242
4.6.14 Time Group........................................................................................................................245
4.6.15 SMS Service Object...........................................................................................................247
4.6.16 Mail Service Object............................................................................................................250
4.6.17 Notification Object..............................................................................................................253
4.7 User Management.................................................................................................................... 255
4.7.1 Web Portal...........................................................................................................................256
4.7.2 User Profile..........................................................................................................................261
4.7.3 User Group..........................................................................................................................268
4.7.4 Guest Profile........................................................................................................................270
4.7.5 RADIUS .............................................................................................................................276
4.7.6 LDAP/Active Directory.........................................................................................................277
4.8 Application................................................................................................................................ 280
4.8.1 Dynamic DNS......................................................................................................................280
4.8.2 GVRP .............................................................................................................................285
4.8.3 IGMP Proxy .........................................................................................................................286
4.8.4 UPnP .............................................................................................................................287
4.8.5 High Availability ...................................................................................................................289
4.8.6 Wake on LAN.......................................................................................................................301
4.8.7 SMS / Mail Alert Service......................................................................................................302
4.9 VPN and Remote Access......................................................................................................... 307
4.9.1 VPN Client Wizard...............................................................................................................307
4.9.2 VPN Server Wizard..............................................................................................................313
4.9.3 Remote Access Control.......................................................................................................317
4.9.4 PPP General Setup .............................................................................................................318
4.9.5 IPSec General Setup...........................................................................................................321
4.9.6 VPN Profiles ........................................................................................................................322
4.9.7 VPN Trunk Management.....................................................................................................333

Vigor3900 Series User’s Guide vii
4.9.8 Connection Management ....................................................................................................339
4.10 Certificate Management......................................................................................................... 341
4.10.1 Local Certificate.................................................................................................................342
4.10.2 Trusted Certificate .............................................................................................................345
4.10.3 Remote Certificate.............................................................................................................348
4.11 SSL VPN................................................................................................................................. 349
4.11.1 SSL Web Proxy .................................................................................................................349
4.11.2 SSL Application .................................................................................................................351
4.11.3 Online User Status.............................................................................................................356
4.12 Central VPN Management..................................................................................................... 357
4.12.1 General Setup....................................................................................................................357
4.12.2 CPE Management .............................................................................................................360
4.12.3 Log/Alert ............................................................................................................................369
4.13 Bandwidth Management ........................................................................................................ 370
4.13.1 Quality of Service...............................................................................................................371
4.13.2 QoS Rule...........................................................................................................................375
4.13.3 Sessions Limit....................................................................................................................381
4.13.4 Bandwidth Limit .................................................................................................................384
4.14 USB Application...................................................................................................................... 389
4.14.1 Temperature Sensor..........................................................................................................389
4.15 System Maintenance.............................................................................................................. 391
4.15.1 TR-069 .............................................................................................................................391
4.15.2 Administrator Password.....................................................................................................393
4.15.3 Configuration Backup ........................................................................................................394
4.15.4 Syslog / Mail Alert..............................................................................................................396
4.15.5 Time and Date...................................................................................................................399
4.15.6 Access Control...................................................................................................................400
4.15.7 SNMP Setup......................................................................................................................401
4.15.8 Reboot System..................................................................................................................403
4.15.9 Firmware Upgrade.............................................................................................................406
4.16 Diagnostics............................................................................................................................. 407
4.16.1 Routing Table ....................................................................................................................407
4.16.2 ARP Cache Table..............................................................................................................410
4.16.3 DHCP Table.......................................................................................................................413
4.16.4 NAT Session Table............................................................................................................415
4.16.5 Traffic Graph......................................................................................................................416
4.16.6 Web Console.....................................................................................................................418
4.16.7 Ping/Trace Route...............................................................................................................419
4.16.8 Data Flow Monitor..............................................................................................................420
4.17 External Devices .................................................................................................................... 421
4.18 Product Registration............................................................................................................... 422
Chapter 5: Trouble Shooting.........................................................................................423
5.1 Checking If the Hardware Status Is OK or Not......................................................................... 423
5.2 Checking If the Network Connection Settings on Your Computer Is OK or Not ...................... 424
5.3 Pinging the Router from Your Computer.................................................................................. 426
5.4 Checking If the ISP Settings are OK or Not............................................................................. 427
5.5 Backing to Factory Default Setting If Necessary...................................................................... 428

Vigor3900 Series User’s Guide
viii
5.6 Contacting Your Dealer ............................................................................................................ 429
Appendix I Release Note...............................................................................................431

Vigor3900 Series User’s Guide 1
C
Ch ha ap pt te er r 1 1: : I In nt tr ro od du uc ct ti io on n
The Vigor3900 Series integrates a rich suite of functions, including NAT, firewall, VPN,
load balance, and bandwidth management capability. These products are very suitable for
providing multi-integrated solutions to SME markets.
A Virtual Private Network (VPN) is an extension of a private network that encompasses
links across shared or public networks like an Intranet. A VPN enables you to send data
between two computers across a shared public Internet network in a manner that emulates
the properties of a point-to-point private link. The DrayTek Vigor3900 Series VPN router
supports Internet-industry standards technology to provide customers with open,
interoperable VPN solutions such as X.509, DHCP over Internet Protocol Security (IPSec)
up to 500 tunnels, and Point-to-Point Tunneling Protocol (PPTP).

Vigor3900 Series User’s Guide
2
1
1. .1 1 W We eb b C Co on nf fi ig gu ur ra at ti io on n B Bu ut tt to on ns s E Ex xp pl la an na at ti io on n
Several main buttons appeared on the web pages are defined as the following:
Save and apply current settings.
Cancel current settings and recover to the previous saved settings.
Clear all the selections and parameters settings, including selection from
drop-down list. All the values must be reset with factory default settings.
Add new settings for specified item.
Edit the settings for the selected item.
Delete the selected item with the corresponding settings.
Note: For the other buttons shown on the web pages, please refer to Chapter 4 for detailed
explanation.
1
1. .2 2 L LE ED D I In nd di ic ca at to or rs s a an nd d C Co on nn ne ec ct to or rs s
Before you use the Vigor router, please get acquainted with the LED indicators and
connectors first. The displays of LED indicators and connectors for the routers are different
slightly.