Icom SR-VPN1 User manual

INSTRUCTION MANUAL
SR-VPN1
VPN ROUTER INTRODUCTION
1 BEFORE USING THE SR-VPN1
2 ABOUT THE INTERNET CONNECTION
3 IPsec Wizard
4 OTHER BASIC FUNCTIONS
5 ABOUT THE SETTING SCREEN
6 MAINTENANCE
7 FOR YOUR INFORMATION

INTRODUCTION
Thank you for purchasing this Icom product. The SR-VPN1 VPN ROUTER is designed and built with Icom’s IP
network technology.
We hope you agree with Icom’s philosophy of “technology first.” Many hours of research and development went
into the design of your SR-VPN1.
i
ALL RIGHTS RESERVED. This document contains material protected under International and Domestic
Copyright Laws and Treaties. Any unauthorized reprint or use of this material is prohibited. No part of this
document may be reproduced or transmitted in any form or by any means, electronic or mechanical, including
photocopying, recording, or by any information storage and retrieval system without express written permission
from Icom Incorporated.
All stated specifications and design are subject to change without notice or obligation.
Adobe and Reader are registered trademarks of Adobe Systems Incorporated in the United States and/or other
countries.
Icom, Icom Inc. and the Icom logo are registered trademarks of Icom Incorporated (Japan) in Japan, the United
States, the United Kingdom, Germany, France, Spain, Russia and/or other countries.
All other products or brands are registered trademarks or trademarks of their respective holders.

INTRODUCTION
ii
FEATURES
• Secure, protected IPsec tunneling connecting up to 32 locations.
• Proven to work with IDAS multi-site systems.
• Supports FTTH, xDSL line. (WAN)
Note: An interface converter is separately required.
• 10/100/1000 BASE-T Ethernet ports.
• 4 [LAN] ports with a switching HUB.
• WAN Failover function.
Dual WAN ports for fail safe configuration, maintains VPN connection if either of the two network connection is working.
Notes:
- This function is disabled as the default.
- When the same network address is assigned to the WAN1 (Main line) and WAN2 (Sub line), this function doesn’t
properly work.
- Icom is not responsible for any result of using this function.
• Supports SNMP.
• Access restriction with the IP Filter function.
• Automatic Restore using a USB flash drive
• Multicast packets (IPv4) will reach every other end point.
Note: For only VE-PG2 and VE-PG3.

INTRODUCTION
iii
DEFAULT VALUES
• See Section 5 for the default values other than above.
To prevent unauthorized access:
You must be careful when choosing your password, and change it occasionally.
• Choose one that is not easy to guess.
• Use numbers, characters and letters (both lower and upper case).
(As of February 2013)
Menu Screen Item Itemname Value
Network Settings IP Address IP Address IP Address 192.168.0.1
Subnet Mask 255.255.255.0
DHCP Server DHCP Server DHCP Server Enable
Router Settings WAN1/WAN2 Connection Type Connection Type None
WAN Failover WAN Failover WAN1 Failure Detection Disable
Management Administrator
Administrator Username admin (fixed)
Current Password admin
Firmware Update Automatic Update Automatic Update Enable

INTRODUCTION
iv
▼
▼
▼
▼
SETTING PROCEDURE
Set up the SR-VPN1 following the procedure below.
Step.1
Step.2
Step.3
Step.4
Step.5
Connect to a PC and turn ON the powerCONNECTION GUIDE (Separated)
Access the setting screenCONNECTION GUIDE (Separated)/Section 1
Configure the network connectionSection 2
Configure the internet connectionSection 3
Configure the VPN connection using the IPsec WizardSection 4

INTRODUCTION
ABOUT THE MAC ADDRESS
The WAN/LAN MAC addresses are printed on the sticker on the bottom.
• MAC addresses are also displayed on the setting screen. (☞P5-5)
In the following cases, you need to know the MAC addresses
• When cloning the SR-VPN1s settings using a USB flash drive, you need to create folders whose names are each SR-
VPN1’s LAN MAC address. (☞P6-11)
• When your ISP requires you to register the MAC address.
v
0090C7
0090C7
0090C7
WAN MAC addresses
LAN MAC address
(This is an example.)
Serial label
SR-VPN1

1-1
BEFORE USING THE SR-VPN1 Section 1
1. Panel description ………………………………………………………………………………………………………………………… 1-2
MFront panel …………………………………………………………………………………………………………………………… 1-2
MRear panel …………………………………………………………………………………………………………………………… 1-4
2. Feature description ……………………………………………………………………………………………………………………… 1-5
MAbout the Routing function ………………………………………………………………………………………………………… 1-5
MAbout the VPN function……………………………………………………………………………………………………………… 1-6

1BEFORE USING THE SR-VPN1
1-2
1. Panel description
MFront panel
qwertyui o
q[UPDATE] button ………… When [MSG] lights green, a firmware update is ready.
To download and install the new firmware, hold down this button until [MSG]
blinks.
• To use the Firmware Update function, an internet connection, DNS and
default gateway settings are necessary.
w[PWR]……………………… Doesn’t light: Power is OFF
Lights green: Power is ON
Lights orange: An error has occurred or the SR-VPN1 is booting.
Blinks orange: Initialization is in progress. (Green and Orange LEDs
alternately light.)
Firmware update is in progress.
e[MSG]……………………… Lights green: A firmware update is ready.
Blinks green: Downloading new firmware.
Lights orange: Accessing the USB flash drive.
r[WAN](1/2)………………… Doesn’t light: Not connected
[1000BASE-T connection]
Lights green: Connected to the WAN
Blinks green: The WAN line is communicating.
[10BASE-T/100BASE-TX connection]
Lights orange: Connected to the WAN
Blinks orange: The WAN line is communicating.
t[LAN] ……………………… Doesn’t light: Not connected
[1000BASE-T connection]
Lights green: Connected to the LAN
[10BASE-T/100BASE-TX connection]
Lights orange: Connected to the LAN
• You can check the communication status for each [LAN] port by the [LAN]
LED on the rear panel. (+P1-4)

1BEFORE USING THE SR-VPN1
1-3
qwertyui o
y[VPN] ……………………… Lights green: An IPsec connection is established.
u[PPP] ……………………… Lights green: PPP is established.
i[BACKUP] ………………… Lights green: The backup line is communicating.
o[USB] ports ……………… CAUTION: Turn OFF the power before inserting or removing the USB flash
drive.
1. Panel description (continued)
MFront panel (continued)
(USB2.0×2)
About the USB flash drive
• A USB flash drive such as one with biometric authentication,
or one with password protection is not supported.
• Turn OFF the SR-VPN1's power before inserting or
removing the USB flash drive, to prevent data corruption.
• Either one of the USB slots accepts the USB flash drive, but
insert only one USB flash drive at a time.
• Insert the USB flash drive securely.
• NEVER remove the USB flash drive or turn OFF the
SR-VPN1's power, while transferring data. It will cause data
corruption, or damage the USB flash drive.
• After the firmware updating is finished, check the firmware
version on the setting screen to verify that the update was
correctly done.
• When importing setting data from the USB flash drive to
the SR-VPN1, the originally programmed setting data is
automatically saved as “bakdata.sav” in the USB flash drive,
as a backup.

1BEFORE USING THE SR-VPN1
1-4
1. Panel description (continued)
MRear panel
weqrty
q[CONSOLE] port ………… Connect an RS-232C serial communication interface to externally configure
the SR-VPN1.
(Optional OPC-1402 is required.)
w[LAN] ports ……………… Connect the network devices such as a HUB.
[LED indication]
Lights：Connected to the LAN line.
Blinks：The LAN line is communicating.
qGreen：1000BASE-T
wYellow：10BASE-T/100BASE-TX
q w 
e[WAN] ports ………………
The Routing function is disabled as the default.
Connect the modem (ADSL, VDSL, CATV) or ONU (Optical Network Unit) to
the [WAN1] port, and then select the network line type (DHCP client/PPPoE/
Static IP) as specified by your internet service provider (ISP). (+P2-3)
• The [WAN2] port can be used as the backup line. (+P2-9)
r[INIT] button ……………… If you cannot access the setting screen, push this button to initialize the
SR-VPN1.
• See the "PRECAUTIONS" leaflet for details.
• Initializing clears all the settings.
tDC jack …………………… Connect the supplied AC adapter.
yGround terminal ………… Connect to the ground.
(RJ-45 type×4)
(RJ-11 type)
(RJ-45 type ×2)

1BEFORE USING THE SR-VPN1
1-5
2. Feature description
MAbout the Routing function
The SR-VPN1 has a router function that allows the devices on the LAN to access the internet.
• The Routing function is disabled as the default.
• Ask your internet provider (ISP) for the network line type.
[Connecting a Bridge modem]
Connect the modem (ADSL, VDSL, CATV) or ONU (Optical Network Unit) to the [WAN1] port, and then select the
network line type (DHCP client/PPPoE/Static IP) as specified by your ISP.
• The [WAN2] port can be used as the backup line. (+P2-9)
[Connecting a Router modem]
Connect the router modem to the [WAN1] port.
Select the network line type (DHCP client/PPPoE/Static IP) as specified by your ISP.
• The [WAN2] port can be used as the backup line. (+P2-9)
ISP
[WAN1]
[LAN1]
[LAN2]
SR-VPN1
INTERNETINTERNET
Bridge modem/DCE (FTTH)
ISP
[WAN1]
[LAN1]
[LAN2]
Router modem
SR-VPN1
INTERNETINTERNET
NOTE
If a private WAN IP address is assigned to the SR-VPN1*, you need to use a modem which has the IPsec Pass Through
function, or use the NAT Traversal function (+P5-64).
*Example; When using a router which doesn’t have the PPPoE Bridge function.

1BEFORE USING THE SR-VPN1
1-6
2. Feature description (continued)
MAbout the VPN function
A VPN (Virtual Private Network) enables a host computer to send and receive data across shared or public net-
works like the Internet as if it were a private network.
You can easily configure the VPN connection using the IPsec Wizard. (+P3-1)
• Connect the WAN line to the [WAN] port, and then configure the Router function to use the VPN function. (+P3-3)
• You can perform further settings on the [IPsec] or [IPsec Setting Details] screen. (+P5-51 to P5-65)
SR-VPN1 SR-VPN1
IPsec-based VPN
INTERNETINTERNET

2-1
ABOUT THE INTERNET CONNECTION Section 2
Step 1. About the ISP (Internet Service Provider) ……………………………………………………………………………………… 2-2
Step 2. About the type of modem ………………………………………………………………………………………………………… 2-2
Step 3. Selecting the internet connection method ……………………………………………………………………………………… 2-3
Step 4. Connecting the modem …………………………………………………………………………………………………………… 2-3
Step 5. Select the network line type ……………………………………………………………………………………………………… 2-4
MWhen the IP address is obtained by DHCP …………………………………………………………………………… 2-4
MWhen using a static IP address ………………………………………………………………………………………… 2-5
MWhen the IP address is obtained in the PPPoE method………………………………………………………………………… 2-7
Information About the WAN Failover function ………………………………………………………………………………………… 2-9
MAbout the problem detecting method ……………………………………………………………………………………………… 2-9

2ABOUT THE INTERNET CONNECTION
2-2
Step 1. About the ISP (Internet Service Provider)
Step 2. About the type of modem
Before configuring the SR-VPN1, ask your ISP or dealer for the required equipment and network connection method.
[Connecting a Bridge modem]
Connect a Bridge modem or DCE (FTTH) to the [WAN1] port.
• The [WAN2] port can be used as a backup line. (+P2-9)
[Connecting a Router modem]
Connect a Router modem to the [WAN1] port.
• The [WAN2] port can be used as a backup line. (+P2-9)
ISP
[WAN1]
[LAN1]
[LAN2]
SR-VPN1
INTERNETINTERNET
Bridge modem/
Terminal unit (TU)
ISP
[WAN1]
[LAN1]
[LAN2]
Router modem
SR-VPN1
INTERNETINTERNET

2ABOUT THE INTERNET CONNECTION
2-3
Step 3. Selecting the internet connection method
Step 4. Connecting the modem
Connect the modem to the [WAN1] port.
[Bridge modem]
Connect the Bridge modem or DCE (FTTH) to the [WAN1] port.
[Router modem]
Connect the Router modem to the [WAN1] port.
Select the internet connection method and settings, depending on your network environment.
• The connection method may be specified by your SIP.
[The IP address is obtained by DHCP] (+P2-4)
The WAN IP address is automatically obtained by a DHCP server.
[Using a static IP address] (+P2-5)
The WAN IP address is specified by your ISP.
[The IP address is obtained in the PPPoE method] (+P2-7)
The WAN IP address is specified by your ISP in the PPPoE method.
[When using a Router mode]
When the router modem’s LAN IP address is the same as that of the SR-VPN1, you need to change the SR-
VPN1’s LAN IP address (default: 192.168.0.1). (+P2-5)
• See the modem’s instruction manual for the LAN IP address.
[WAN1]
(Main)
[WAN2]
(Sub)
LAN cable
(Purchase separately)
To the [WAN] port
Bridge modem/
Terminal unit (TU)
SR-VPN1 (Rear view)
Router modem
[WAN1]
(Main)
[WAN2]
(Sub)
LAN cable
(Purchase separately)
To the [WAN] port
SR-VPN1 (Rear view)

2ABOUT THE INTERNET CONNECTION
2-4
Click [Router Settings], then [WAN1].
• The [WAN1] screen appears.
1
Select [DHCP Client] in the [Connection Type] item.
2
Click <Apply>.
3
Click <Reboot>.
• When you are asked to reboot the SR-VPN1, follow the instructions.
4
Select the network line type.
Step 5. Select the network line type
MWhen the IP address is obtained by DHCP
After rebooting, verify that "Connecting" appears in the [Connection Status] item.
• Click <Refresh> to update the screen.
5
Click
• If “Connected” doesn't appear, verify the setting.
Select
Click
Verify

2ABOUT THE INTERNET CONNECTION
2-5
(Continued on the next page.)
MWhen using a static IP address
Step 5. Select the network line type (continued)
Click [Router Settings], then [WAN1].
• The [WAN1] screen appears.
1
Select [Static IP] in the [Connection Type] item.
Enter the values into the items in the [Connection Settings] field, as specified by your ISP.
2
3
Click <Apply>.
4
Select
Enter
Click

2ABOUT THE INTERNET CONNECTION
2-6
MWhen using a static IP address (continued)
Step 5. Select the network line type (continued)
Click <Reboot>.
• When you are asked to reboot the SR-VPN1, follow the instructions.
5
After rebooting, verify that "Connecting" appears in the [Connection Status] item.
• Click <Refresh> to update the screen.
6
• If “Connected” doesn't appear, verify the setting.
Click
Verify

2ABOUT THE INTERNET CONNECTION
2-7
Click [Router Settings], then [WAN1].
• The [WAN1] screen appears.
1
Select [PPPoE] in the [Connection Type] item.
Select or enter the value into the items in the [Connection Settings] field.
2
3
Click <Apply>.
4
MWhen the IP address is obtained in the PPPoE method
Step 5. Select the network line type (continued)
(Continued on the next page.)
Select
Select or Enter
Click

2ABOUT THE INTERNET CONNECTION
2-8
After rebooting, select the destination and then click <Connect>.
Note: You cannot change the destination if one of the PPPoE connections is established.
6
Click <Refresh> to update the screen.
7
MWhen the IP address is obtained in the PPPoE method (continued)
Step 5. Select the network line type (continued)
Click <Reboot>.
• When you are asked to reboot the SR-VPN1, follow the instructions.
5
Note: If “Connected” doesn’t appear, check the entries set in Step 3.
Click
qSelect
wClick
qClick
wVerify