Draytek VIGOR2950 User manual

Vigor2950
Security VPN Router
User’s Guide
Version: 2.0
Date: 2006/10/03
Copyright 2006 All rights reserved.
This publication contains information that is protected by copyright. No part may be reproduced, transmitted,
transcribed, stored in a retrieval system, or translated into any language without written permission from the copyright
holders. The scope of delivery and other details are subject to change without prior notice.
Microsoft is a registered trademark of Microsoft Corp.
Windows, Windows 95, 98, Me, NT, 2000, XP and Explorer are trademarks of Microsoft Corp.
Apple and Mac OS are registered trademarks of Apple Computer Inc.
Other products may be trademarks or registered trademarks of their respective manufacturers.

Vigor2910 Series User’s Guide
ii
T
Ta ab bl le e o of f C Co on nt te en nt ts s
1
Preface ...............................................................................................................1
1.1 Web Configuration Buttons Explanation................................................................................. 1
1.2 LED Indicators and Connectors.............................................................................................. 1
1.2.1 For Vigor2950................................................................................................................... 2
1.2.2 For Vigor2950G................................................................................................................ 3
1.2.3 For Vigor2950i.................................................................................................................. 4
1.2.4 For Vigor2950Gi ............................................................................................................... 5
1.3 Hardware Installation .............................................................................................................. 6
2
Configuring Basic Settings ..............................................................................7
2.1 Changing Password................................................................................................................ 7
2.2 Quick Start Wizard .................................................................................................................. 9
2.2.1 PPPoE ............................................................................................................................ 10
2.2.2 PPTP............................................................................................................................... 12
2.2.3 Static IP........................................................................................................................... 13
2.2.4 DHCP.............................................................................................................................. 14
2.3 Online Status......................................................................................................................... 15
2.4 Saving Configuration............................................................................................................. 17
3
AdvancedWebConfiguration..................................................................................19
3.1 WAN...................................................................................................................................... 19
3.1.1 Basics of Internet Protocol (IP) Network......................................................................... 19
3.1.2 General Setup................................................................................................................. 20
3.1.3 Internet Access............................................................................................................... 22
3.1.4 Load-Balance Policy.......................................................................................................28
3.2 LAN ....................................................................................................................................... 31
3.2.1 Basics of LAN................................................................................................................. 31
3.2.2 General Setup................................................................................................................. 33
3.2.3 Static Route.................................................................................................................... 35
3.2.4 Bind IP to MAC............................................................................................................... 38
3.3 NAT ....................................................................................................................................... 39
3.3.1 Port Redirection.............................................................................................................. 40
3.3.2 DMZ Host........................................................................................................................ 42
3.3.3 Open Ports...................................................................................................................... 44
3.4 Firewall.................................................................................................................................. 46
3.4.1 Basics for Firewall........................................................................................................... 46
3.4.2 General Setup................................................................................................................. 49
3.4.3 Filter Setup ..................................................................................................................... 50
3.4.4 DoS Defense .................................................................................................................. 55

Vigor2910 Series User’s Guide iii
3.4.5 URL Content Filter.......................................................................................................... 57
3.4.6 Web Content Filter.......................................................................................................... 60
3.5 Objects Settings.................................................................................................................... 60
3.5.1 IP Object......................................................................................................................... 61
3.5.2 IP Group ......................................................................................................................... 62
3.5.3 Service Type Object .......................................................................................................64
3.5.4 Service Type Group........................................................................................................65
3.5.5 CSM Profile..................................................................................................................... 66
3.6 Bandwidth Management ....................................................................................................... 67
3.6.1 Sessions Limit................................................................................................................. 67
3.6.2 Bandwidth Limit .............................................................................................................. 69
3.6.3 Quality of Service............................................................................................................ 70
3.7 Applications........................................................................................................................... 77
3.7.1 Dynamic DNS................................................................................................................. 77
3.7.2 Schedule......................................................................................................................... 79
3.7.3 RADIUS .......................................................................................................................... 81
3.7.4 UPnP............................................................................................................................... 82
3.7.5 Wake On LAN................................................................................................................. 83
3.8 VPN and Remote Access...................................................................................................... 85
3.8.1 Remote Access Control.................................................................................................. 85
3.8.2 PPP General Setup ........................................................................................................ 85
3.8.3 IPSec General Setup...................................................................................................... 87
3.8.4 IPSec Peer Identity......................................................................................................... 88
3.8.5 Remote Dial-in User .......................................................................................................90
3.8.6 LAN to LAN..................................................................................................................... 93
3.8.7 Connection Management.............................................................................................. 101
3.9 Certificate Management...................................................................................................... 102
3.9.1 Local Certificate............................................................................................................ 102
3.9.2 Trusted CA Certificate .................................................................................................. 104
3.9.3 Certificate Backup......................................................................................................... 105
3.10 ISDN.................................................................................................................................. 105
3.10.1 Basic Concept............................................................................................................. 105
3.10.2 General Settings......................................................................................................... 106
3.10.3 Dial to Single/Dual ISPs.............................................................................................. 107
3.10.4 Virtual TA.................................................................................................................... 110
3.10.5 Call Control................................................................................................................. 113
3.11 Wireless LAN......................................................................................................................115
3.11.1 Basic Concepts........................................................................................................... 115
3.11.2 General Setup............................................................................................................. 118
3.11.3 Security....................................................................................................................... 120
3.11.4 Access Control............................................................................................................ 122
3.11.5 WDS............................................................................................................................ 123
3.11.6 AP Discovery.............................................................................................................. 125
3.11.7 Station List.................................................................................................................. 126
3.11.8 Station Rate Control ................................................................................................... 127
3.12 VLAN................................................................................................................................. 127
3.12.1 Wired VLAN................................................................................................................ 127
3.12.2 Wireless VLAN............................................................................................................ 128
3.12.3 VLAN Cross Setup...................................................................................................... 132
3.12.4 Wireless Rate Control................................................................................................. 133
3.13 System Maintenance......................................................................................................... 134

Vigor2910 Series User’s Guide
iv
3.13.1 System Status............................................................................................................. 134
3.13.2 Administrator Password.............................................................................................. 135
3.13.3 Configuration Backup ................................................................................................. 135
3.13.4 Syslog/Mail Alert......................................................................................................... 137
3.13.5 Time and Date............................................................................................................ 139
3.13.6 Management............................................................................................................... 140
3.13.7 Reboot System........................................................................................................... 141
3.13.8 Firmware Upgrade...................................................................................................... 142
3.14 Diagnostics........................................................................................................................ 143
3.14.1 Dial-out Trigger........................................................................................................... 143
3.14.2 Routing Table ............................................................................................................. 144
3.14.3 ARP Cache Table....................................................................................................... 144
3.14.4 DHCP Table................................................................................................................ 145
3.14.5 NAT Sessions Table................................................................................................... 145
3.14.6 Wireless VLAN Online Station Table.......................................................................... 146
3.14.7 Data Flow Monitor....................................................................................................... 147
3.14.8 Traffic Graph............................................................................................................... 148
3.14.9 Ping Diagnosis............................................................................................................ 149
3.14.10 Trace Route.............................................................................................................. 150
4
Application and Examples............................................................................151
4.1 Create a LAN-to-LAN Connection Between Remote Office and Headquarter................... 151
4.2 Create a Remote Dial-in User Connection Between the Teleworker and Headquarter...... 158
4.3 QoS Setting Example.......................................................................................................... 162
4.4 LAN – Created by Using NAT ............................................................................................. 164
4.5 Upgrade Firmware for Your Router..................................................................................... 166
4.6 Request a certificate from a CA server on Windows CA Server......................................... 168
4.7 Request a CA Certificate and Set as Trusted on Windows CA Server............................... 172
5
Trouble Shooting...........................................................................................175
5.1 Checking If the Hardware Status Is OK or Not.................................................................... 175
5.2 Checking If the Network Connection Settings on Your Computer Is OK or Not ................. 175
5.3 Pinging the Router from Your Computer............................................................................. 178
5.4 Checking If the ISP Settings are OK or Not........................................................................ 180
5.5 Backing to Factory Default Setting If Necessary ................................................................ 182
5.6 Contacting Your Dealer....................................................................................................... 183

Vigor2950 Series User’s Guide 1
1
P Pr re ef fa ac ce e
The Vigor2950 series router provides Dual-WAN interface (which is a configuration second
WAN) for Internet access to make the Internet connection more reliable. The wireless LAN
supports more secure features and the transmission speed is up to 108Mbps (SuperGTM).
Object-oriented firewall is flexible and allows your network be safe. In addition, through
VoIP function, the communication fee for you and remote people can be reduced.
1
1. .1 1 W We eb b C Co on nf fi ig gu ur ra at ti io on n B Bu ut tt to on ns s E Ex xp pl la an na at ti io on n
Several main buttons appeared on the web pages are defined as the following:
Save and apply current settings.
Canncel current settings and recover to the previous saved settings.
Clear all the selections and parameters settings, including selection from
drop-down list. All the values must be reset with factory default settings.
Add new settings for specified item.
Edit the settings for the selected item.
Delete the selected item with the corresponding settings.
Note: For the other buttons shown on the web pages, please refer to Chapter 4 for
detailed explanation.
1
1. .2 2 L LE ED D I In nd di ic ca at to or rs s a an nd d C Co on nn ne ec ct to or rs s
Before you use the Vigor router, please get acquainted with the LED indicators and
connectors first.
The displays of LED indicators and connectors for the routers are different slightly. The
following sections will introduce them respectively.

Vigor2950 Series User’s Guide
2
1
1. .2 2. .1 1 F Fo or r V Vi ig go or r2 29 95 50 0
LED Status Explanation
Blinking The router is powered on and running normally.ACT (Activity) Off The router is powered off.
DMZ On DMZ Host is specified in certain site.
Monitor On LAN traffic monitor is active.
On The VPN tunnel is launched.VPN Off The VPN tunnel is closed.
QoS On The QoS function is active.
LED on Connector
On The port is connected with 10Mbps.
Off The port is disconnected.
10
(left LED)
Blinking The data is transmitting.
On The port is connected with 100Mbps.
Off The port is disconnected.
WAN
100
(right LED)
Blinking The data is transmitting.
On The port is connected with 100Mbps.
Off The port is disconnected.
100
(left LED)
Blinking The data is transmitting.
On The port is connected with 1000Mbps.
Off The port is disconnected.
LAN/Monitor
LAN
1000
(right LED)
Blinking The data is transmitting.
Interface Description
RST
(Factory Reset) Restore the default settings. Usage: Turn on the router (ACT LED is blinking). Press the hole and keep for
more than 5 seconds. When you see the ACT LED begins to blink rapidly than
usual, release the button. Then the router will restart with the factory default
configuration.
WAN(1/2) Connecter for remote networked devices.
LAN/Monitor Connecter for local networked devices.
LAN (1-4) Connecter for local networked devices.
Connecter for a power cord with 100-240VAC (inlet).
Power Switch. “1” is ON; “0” is OFF.

Vigor2950 Series User’s Guide 3
1
1. .2 2. .2 2 F Fo or r V Vi ig go or r2 29 95 50 0G G
LED Status Explanation
Blinking The router is powered on and running normally.ACT (Activity) Off The router is powered off.
DMZ On DMZ Host is specified in certain site.
Monitor On LAN traffic monitor is active.
On The VPN tunnel is launched.VPN Off The VPN tunnel is closed.
QoS On The QoS function is active.
On Wireless access point is ready.
Blinking Ethernet packets are transmitting over wireless LAN.
WLAN
Off The WLAN function is inactive.
LED on Connector
On The port is connected with 10Mbps.
Off The port is disconnected.
10
(left LED)
Blinking The data is transmitting.
On The port is connected with 100Mbps.
Off The port is disconnected.
WAN
100
(right LED)
Blinking The data is transmitting.
On The port is connected with 100Mbps.
Off The port is disconnected.
100
(left LED)
Blinking The data is transmitting.
On The port is connected with 1000Mbps.
Off The port is disconnected.
LAN/Monitor
LAN
1000
(right LED)
Blinking The data is transmitting.
Interface Description
RST
(Factory Reset) Restore the default settings. Usage: Turn on the router (ACT LED is blinking). Press the hole and keep for
more than 5 seconds. When you see the ACT LED begins to blink rapidly than
usual, release the button. Then the router will restart with the factory default
configuration.
WAN(1/2) Connecter for remote networked devices.
LAN/Monitor Connecter for local networked devices.
LAN (1-4) Connecter for local networked devices.
Connecter for a power cord with 100-240VAC (inlet).
Power Switch. “1” is ON; “0” is OFF.

Vigor2950 Series User’s Guide
4
1
1. .2 2. .3 3 F Fo or r V Vi ig go or r2 29 95 50 0i i
LED Status Explanation
Blinking The router is powered on and running normally.ACT (Activity) Off The router is powered off.
DMZ On DMZ Host is specified in certain site.
Monitor On LAN traffic monitor is active.
On The VPN tunnel is launched.VPN Off The VPN tunnel is closed.
QoS On The QoS function is active.
On The ISDN service function is active.
ISDN Blinking A successful connection on the ISDN BRI B1/B2
channel.
LED on Connector
On The port is connected with 10Mbps.
Off The port is disconnected.
10
(left LED)
Blinking The data is transmitting.
On The port is connected with 100Mbps.
Off The port is disconnected.
WAN
100
(right LED)
Blinking The data is transmitting.
On The port is connected with 100Mbps.
Off The port is disconnected.
100
(left LED)
Blinking The data is transmitting.
On The port is connected with 1000Mbps.
Off The port is disconnected.
LAN/Monitor
LAN
1000
(right LED)
Blinking The data is transmitting.
Interface Description
RST
(Factory Reset) Restore the default settings. Usage: Turn on the router (ACT LED is blinking). Press the hole and keep for
more than 5 seconds. When you see the ACT LED begins to blink rapidly than
usual, release the button. Then the router will restart with the factory default
configuration.
ISDN Connect for NT1 (or NT1+) box provided by ISDN service provider.
WAN(1/2) Connecter for remote networked devices.
LAN/Monitor Connecter for local networked devices.
LAN (1- 4) Connecter for local networked devices.
Connecter for a power cord with 100-240VAC (inlet).
Power Switch. “1” is ON; “0” is OFF.

Vigor2950 Series User’s Guide 5
1
1. .2 2. .4 4 F Fo or r V Vi ig go or r2 29 95 50 0G Gi i
LED Status Explanation
Blinking The router is powered on and running normally.ACT (Activity) Off The router is powered off.
DMZ On DMZ Host is specified in certain site.
Monitor On LAN traffic monitor is active.
On The VPN tunnel is launched.VPN Off The VPN tunnel is closed.
QoS On The QoS function is active.
On Wireless access point is ready.
Blinking Ethernet packets are transmitting over wireless LAN.
WLAN
Off The WLAN function is inactive.
On The ISDN service function is active.
ISDN Blinking A successful connection on the ISDN BRI B1/B2
channel.
LED on Connector
On The port is connected with 10Mbps.
Off The port is disconnected.
10
(left LED)
Blinking The data is transmitting.
On The port is connected with 100Mbps.
Off The port is disconnected.
WAN
100
(right LED)
Blinking The data is transmitting.
On The port is connected with 100Mbps.
Off The port is disconnected.
100
(left LED)
Blinking The data is transmitting.
On The port is connected with 1000Mbps.
Off The port is disconnected.
LAN/Monitor
LAN
1000
(right LED)
Blinking The data is transmitting.
Interface Description
RST
(Factory Reset) Restore the default settings. Usage: Turn on the router (ACT LED is blinking). Press the hole and keep for
more than 5 seconds. When you see the ACT LED begins to blink rapidly than
usual, release the button. Then the router will restart with the factory default
configuration.
ISDN Connect for NT1 (or NT1+) box provided by ISDN service provider.
WAN(1/2) Connecter for remote networked devices.
LAN/Monitor Connecter for local networked devices.
LAN (1- 4) Connecter for local networked devices.
Connecter for a power cord with 100-240VAC (inlet).
Power Switch. “1” is ON; “0” is OFF.

Vigor2950 Series User’s Guide
6
1
1. .3 3 H Ha ar rd dw wa ar re e I In ns st ta al ll la at ti io on n
Before starting to configure the router, you have to connect your devices correctly.
1. Connect the power cord to the router’s power port on the rear panel, and the other side
into a wall outlet.
2. Power on the device by pressing down the power switch on the rear panel.
3. The system starts to initiate. After completing the system test, the ACT LED will light
up and start blinking.
4. Connect one end of an Ethernet cable (RJ-45) to one of the LAN ports of the router and
the other end of the cable (RJ-45) into the Ethernet port on your computer (that device
also can connect to other computers to form a small area network). The LAN LED
(Left or Right) will light up according to the network card feature (1000 or 100) of the
device that it connected.
5. Connect a cable Modem/DSL Modem/Media Converter (depends on your requirement)
to any WAN port of router with Ethernet cable (RJ-45). The WAN1/WAN2 LED (Left
or Right) will light up according to the network card feature (100 or 10) of the device
that it connected.
(For the detailed information of LED status, please refer to section 1.1.)

Vigor2950 Series User’s Guide 7
2
C Co on nf fi ig gu ur ri in ng g B Ba as si ic c S Se et tt ti in ng gs s
For use the router properly, it is necessary for you to change the password of web
configuration for security and adjust primary basic settings.
This chapter explains how to setup a password for an administrator and how to adjust basic
settings for accessing Internet successfully. Be aware that only the administrator can change
the router configuration.
2
2. .1 1 C Ch ha an ng gi in ng g P Pa as ss sw wo or rd d
To change the password for this device, you have to access into the web browse with default
password first.
1. Make sure your computer connects to the router correctly.
Notice: You may either simply set up your computer to get IP dynamically
from the router or set up the IP address of the computer to be the same
subnet as the default IP address of Vigor router 192.168.1.1. For the
detailed information, please refer to the later section - Trouble Shooting of
this guide.
2. Open a web browser on your PC and type http://192.168.1.1. A pop-up window will
open to ask for username and password. Please type default values (both username and
password are Null) on the window for the first time accessing and click OK for next
screen.
3. Now, the Main Screen will pop up.

Vigor2950 Series User’s Guide
8
4. Go to System Maintenance page and choose Administrator Password.
5. Enter the login password (the default is blank) on the field of Old Password. Type a
new one in the field of New Password and retype it on the field of Retype New
Password. Then click OK to continue.
6. Now, the password has been changed. Next time, use the new password to access the
Web Configurator for this router.

Vigor2950 Series User’s Guide 9
2
2. .2 2 Q Qu ui ic ck k S St ta ar rt t W Wi iz za ar rd d
If your router can be under an environment with high speed NAT, the configuration provide
here can help you to deploy and use the router quickly. The first screen of Quick Start
Wizard is entering login password. After typing the password, please click Next.
On the next page as shown below, please select the WAN interface that you use. Choose
Auto negotiation as the physical type for your router. Then click Next for next step.
On the next page as shown below, please select the appropriate Internet access type
according to the information from your ISP. For example, you should select PPPoE mode if
the ISP provides you PPPoE interface. Then click Next for next step.

Vigor2950 Series User’s Guide
10
In the Quick Start Wizard, you can configure the router to access the Internet with different
protocol/modes such as PPPoE, PPTP, Static IP or DHCP. The router supports the DSL
WAN interface for Internet access.
2
2. .2 2. .1 1 P PP PP Po oE E
PPPoE stands for Point-to-Point Protocol over Ethernet. It relies on two widely accepted
standards: PPP and Ethernet. It connects users through an Ethernet to the Internet with a
common broadband medium, such as a single DSL line, wireless device or cable modem. All
the users over the Ethernet can share a common connection.
PPPoE is used for most of DSL modem users. All local users can share one PPPoE
connection for accessing the Internet. Your service provider will provide you information
about user name, password, and authentication mode.
If your ISP provides you the PPPoE connection, please select PPPoE for this router. The
following page will be shown:
User Name Assign a specific valid user name provided by the ISP.
Password Assign a valid password provided by the ISP.
Retype Password Retype the password.
Click Next for viewing summary of such connection.

Vigor2950 Series User’s Guide 11
Click Finish. A page of Quick Start Wizard Setup OK!!! will appear. Then, the system
status of this protocol will be shown.

Vigor2950 Series User’s Guide
12
2
2. .2 2. .2 2 P PP PT TP P
Click PPTP as the protocol. Type in all the information that your ISP provides for this
protocol.
Click Next for viewing summary of such connection.
Click Finish. A page of Quick Start Wizard Setup OK!!! will appear. Then, the system
status of this protocol will be shown.

Vigor2950 Series User’s Guide 13
2
2. .2 2. .3 3 S St ta at ti ic c I IP P
Click Static IP as the protocol. Type in all the information that your ISP provides for this
protocol.
After finishing the settings in this page, click Next to see the following page.
Click Finish. A page of Quick Start Wizard Setup OK!!! will appear. Then, the system
status of this protocol will be shown.

Vigor2950 Series User’s Guide
14
2
2. .2 2. .4 4 D DH HC CP P
Click DHCP as the protocol. Type in all the information that your ISP provides for this
protocol.
After finishing the settings in this page, click Next to see the following page.
Click Finish. A page of Quick Start Wizard Setup OK!!! will appear. Then, the system
status of this protocol will be shown.

Vigor2950 Series User’s Guide 15
2
2. .3 3 O On nl li in ne e S St ta at tu us s
The online status shows the system status, WAN status, ADSL Information and other status
related to this router within one page. If you select PPPoE/PPTP as the protocol, you will
find out a link of Dial PPPoE/PPPoA or Drop PPPoE/PPPoA in the Online Status web
page.
Online status for PPPoE
Online status for PPTP (for WAN2)
Online status for Static IP (for WAN1)

Vigor2950 Series User’s Guide
16
Online status for DHCP
Detailed explanation is shown below:
Primary DNS Displays the IP address of the primary DNS.
Secondary DNS Displays the IP address of the secondary DNS.
LAN Status
IP Address Displays the IP address of the LAN interface.
TX Packets Displays the total transmitted packets at the LAN interface.
RX Packets Displays the total number of received packets at the LAN interface.
WAN1/2 Status
Line Displays the physical connection (Ethernet) of this interface.
Name Displays the name set in WAN1/WAN web page.
Mode Displays the type of WAN connection (e.g., PPPoE).
Up Time Displays the total uptime of the interface.
IP Displays the IP address of the WAN interface.
GW IP Displays the IP address of the default gateway.
TX Packets Displays the total transmitted packets at the WAN interface.
TX Rate Displays the speed of transmitted octets at the WAN interface.
RX Packets Displays the total number of received packets at the WAN
interface.
RX Rate Displays the speed of received octets at the WAN interface.
ISDN Status
Channel Active Conn. Displays the active connection status for each channel.
TX Pkts Displays the total transmitted packets at the ISDN interface.
TX Rate Displays the speed of transmitted octets at the ISDN interface.
RX Pkts Displays the total number of received packets at the ISDN
interface.
RX Rate Displays the speed of received octets at the ISDN interface.
Up Time Displays the total uptime of the interface.
AOC Displays the charge information of the interface.