Draytek Vigor 2955 manual

[...]

Vigor2955 User’s Guide ii[...]

Vigor2955 User’s Guide iii Vigor 2955 Dual-WAN SSL VPN Appliance User’s Guide Version: 1.0 Date: 30/10/ 2009[...]

Vigor2955 User’s Guide iv Copyright Information Copyright Declarations Copyright 2009 All rights reserved. This pub lication contains information th at is protected by copyright. No part may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language without written permission f rom the co pyright hol de[...]

Vigor2955 User’s Guide v European Community Declarations Manufacturer: DrayTek Corp. Address: No. 26, Fu Shing Road, HuKou Town ship, HsinChu Industrial Park, Hsin-Chu, Taiwan 303 Product: Vigor2955 Ser ies Router DrayTek Cor p. declares that Vigor295 5 is in com pliance wit h the follo wing essenti al requirem ents and ot her relevant p rovision[...]

Vigor2955 User’s Guide vi[...]

Vigor2955 User’s Guide vii T T a a b b l l e e o o f f C C o o n n t t e e n n t t s s 1 Pref ace ............................................................................................................... 1 1.1 Web Conf iguration Bu ttons Explanation ................................................................................. 1 1.2 LED [...]

Vigor2955 User’s Guide viii 3.5 Object s Settings ........................................................................................................... ......... 65 3.5.1 IP Object ................................................................................................................ ......... 65 3.5.2 IP Group ....................[...]

Vigor2955 User’s Guide ix 3.12.8 Reboo t System ........................................................................................................... 161 3.12.9 Firmware Upgrade ...................................................................................................... 16 2 3.13 Diagno stics ......................................[...]

Vigor2955 User’s Guide x[...]

Vigor2955 User’s Guide 1 1 P P r r e e f f a a c c e e The Vigor2950 series router provides Dual-WAN interface (which is a configuration second WAN) for Internet access to make the Internet connection more reliable. The wireless LAN supports more secure features and the transmission speed is up to 108Mbps (SuperG TM ). Object-oriented firewall is[...]

Vigor2955 User’s Guide 2 1 1 . . 2 2 L L E E D D I I n n d d i i c c a a t t o o r r s s a a n n d d C C o o n n n n e e c c t t o o r r s s Before you use the Vigor router, please ge t acquainted with the LED indicators and connectors first. The displays of LED indicators and connectors for the routers are different slightly. The following secti[...]

Vigor2955 User’s Guide 3 Connecter for a power cord with 100-240VAC (inlet). Power Switch. 1 1 . . 3 3 H H a a r r d d w w a a r r e e I I n n s s t t a a l l l l a a t t i i o o n n Before starting to configure the router, you have to connect your devices correctly. 1. Connect the power cord to the router’s power port on the rear panel, and th[...]

Vigor2955 User’s Guide 4 1 1 . . 4 4 P P r r i i n n t t e e r r I I n n s s t t a a l l l l a a t t i i o o n n You can install a printer onto the router for sharing printing. All the PCs connected this router can print documents via the router. The exam ple provided here is made based on Windows XP/2000/Vista. For Windows 98/SE, please visit ww[...]

Vigor2955 User’s Guide 5 3. Open File->Add a New Computer . A welcome dialog will appear. Please click Next . 4. Click Local printer attached to this computer and click Next. 5. In this dialog, choose Create a new port Type of port and use the drop down list to select Standard TCP/IP Port . Click Next .[...]

Vigor2955 User’s Guide 6 6. In the following dialog, type 192.168.1.1 (router’s LAN IP) in the field of Printer Name or IP Address and type IP_192.168.1.1 as the port nam e. T hen, click Next . 7. Click Standard and choose Generic Network Card. 8. Then, in the following dialog, click Finish .[...]

Vigor2955 User’s Guide 7 9. Now, your system will ask you to choose right name of the printer that you installed onto the router. Such step can make correct driver loaded onto your PC. When you finish the selection, click Next . 10. For the final stage, you need to go back to Control Panel-> Printers and edit the property of the new printer yo[...]

Vigor2955 User’s Guide 8 Note 1: Some printers with the fax/scanning or other additional functions are not supported. If you do not know whether your prin ter is supported or not, please visit www.draytek.com to find out the printer list. Open Support >FAQ ; find out the link of Printer Server and click it; then click the What types of printer[...]

Vigor2955 User’s Guide 9 2 C C o o n n f f i i g g u u r r i i n n g g B B a a s s i i c c S S e e t t t t i i n n g g s s For use the router properly, it is necessary for you to change the password of web configuration for security and adjust primary basic settings. This chapter explains how to setup a password fo r an administrator and how to a[...]

Vigor2955 User’s Guide 10 3. Now, the Main Screen will pop up. 4. Go to System Maintenance page and choose Administrator Password . 5. Enter the login password (the defa ult is blank) on the field of Old Password . Type a new one in the field of New Password and retype it on the field of Confirm Password . Then click OK to continue. 6. Now, the p[...]

Vigor2955 User’s Guide 11 2 2 . . 2 2 Q Q u u i i c c k k S S t t a a r r t t W W i i z z a a r r d d If your router can be under an environment with high speed NAT, the configuration provide here can help you to deploy and use the router quickl y. The first screen of Quick Start Wizard is entering login password. After ty ping the password, plea[...]

Vigor2955 User’s Guide 12 In the Quick Start Wizard , you can configure the router to access the Internet with different protocol/modes such as PPPoE , PPTP , L2TP , Static IP or DHCP . 2 2 . . 2 2 . . 1 1 P P P P P P o o E E PPPoE stands for Point-to-Point Protocol over Ethernet . It relies on two widely accepted standards: PPP and Ethernet. It [...]

Vigor2955 User’s Guide 13 Confirm Password Retype the password to confirm it. Click Next for viewing summary of such connection. Click Finish. A page of Quick Start Wizard Setup OK!!! will appear. Then, the system status of this protocol will be shown.[...]

Vigor2955 User’s Guide 14 2 2 . . 2 2 . . 2 2 P P P P T T P P Click PPTP as the protocol. Type in all the information that your ISP provides for this protocol. Click Next for viewing summary of such connection. Click Finish. A page of Quick Start Wizard Setup OK!!! will appear. Then, the system status of this protocol will be shown.[...]

Vigor2955 User’s Guide 15 2 2 . . 2 2 . . 3 3 L L 2 2 T T P P Click L2TP as the protocol. Type in all the information that your ISP provi des for this protocol. After finishing the settings in this page, click Next to see the following page.[...]

Vigor2955 User’s Guide 16 2 2 . . 2 2 . . 4 4 S S t t a a t t i i c c I I P P Click Static IP as the protocol. Type in all the inform ation that your ISP provides for this protocol. After finishing the settings in this page, click Next to see the following page. Click Finish. A page of Quick Start Wizard Setup OK!!! will appear. Then, the system [...]

Vigor2955 User’s Guide 17 2 2 . . 2 2 . . 5 5 D D H H C C P P Click DHCP as the protocol. Type in all the information that your ISP provi des for this protocol. After finishing the settings in this page, click Next to see the following page. Click Finish. A page of Quick Start Wizard Setup OK!!! will appear. Then, the system status of this protoc[...]

Vigor2955 User’s Guide 18 2 2 . . 3 3 O O n n l l i i n n e e S S t t a a t t u u s s The online status shows the system status, WAN st atus, and other status related to this router within one page. If you select PPPoE/PPTP as the protocol, you w ill find out a link of Dial PPPoE or Drop PPPoE in the Online Status web page. Online status for PPPo[...]

Vigor2955 User’s Guide 19 Online status for DHCP Detailed explanation is shown below: Primary DNS Display the IP address of the primary DNS. Secondary DNS Display the IP address of the secondary DNS. LAN Status IP Address Display the IP address of the LAN interface. TX Packets Display the total transmitted packets at the LAN interface. RX Packets[...]

Vigor2955 User’s Guide 20 2 2 . . 4 4 S S a a v v i i n n g g C C o o n n f f i i g g u u r r a a t t i i o o n n Each time you click OK on the web page for saving the configurati on, you can find messages showing the system interaction with you. Ready indicates the system is ready for you to input settings. Settings Saved means your settings are[...]

Vigor2955 User’s Guide 21 3 A A d d v v a a n n c c e e d d W W e e b b C C o o n n f f i i g g u u r r a a t t i i o o n n After finished basic configuration of the router, you can access Internet with ease. For the people who want to adjust more setting for suitin g his/her request, please refer to this chapter for getting detailed information [...]

Vigor2955 User’s Guide 22 N N e e t t w w o o r r k k C C o o n n n n e e c c t t i i o o n n b b y y 3 3 G G U U S S B B M M o o d d e e m m For 3G mobile communication through Access Point is popular more and more, Vigor2955 adds the function of 3G network connection for such purpose. By connecting 3G USB Modem to the USB port of Vigor2955, it [...]

Vigor2955 User’s Guide 23 Enable Choose Yes to invoke the settings for this WAN interface. Choose No to disable the settings for this WAN interface. Display Name Type the description for the WAN1/WAN2 interface. Physical Mode For WAN1, the physical connection is done through Ethernet port; yet the physical connection for WAN2 is done through an E[...]

Vigor2955 User’s Guide 24 Physical Type You can change the physical type for WAN2 or choo se Auto negotiation for determined by the system. Load Balance Mode If you know the practical bandwidth for your WAN interface, please choose the setting of According to Line Speed . Otherwise, please choose Auto Weigh to let the router reach the best load b[...]

Vigor2955 User’s Guide 25 3 3 . . 1 1 . . 3 3 I I n n t t e e r r n n e e t t A A c c c c e e s s s s For the router supports dual WAN function, the users can set different WAN settings (for WAN1/WAN2) for Internet Access. Due to di fferent physical mode for WAN1 and WAN2, the Access Mode for these two connections also varies slightly. or Index I[...]

Vigor2955 User’s Guide 26 D D e e t t a a i i l l s s P P a a g g e e f f o o r r P P P P P P o o E E To use PPPoE as the accessing protocol of the internet, please choose Internet Acce ss from WAN menu. Then, select PPPoE mode. The following web page will be shown. PPPoE Client Mode Click Enable for activating this function. If you click Disable[...]

Vigor2955 User’s Guide 27 active only when the Active on demand option for Active Mode is selected in WAN>> General Setup page. MTU Mean maximum transmission unit of one packet. The default value is 1442. IP Address Assignment Method (IPCP) Usually ISP dynamically assigns IP address to you each time you connect to it and request. In some ca[...]

Vigor2955 User’s Guide 28 To use Static or Dynamic IP as the accessing protocol of the internet, please choose Internet Access from WAN menu. Then, select Static or Dynamic IP mode for WAN2. The following web page will be shown. Static or Dynamic IP (DHCP Client) Click Enable for activating this function. If you click Disable , this function will[...]

Vigor2955 User’s Guide 29 WAN IP Network Settings This group allows you to obtain an IP address automatically and allows you type in IP address manually. WAN IP Alias - If you have multiple public IP addresses and would like to utilize them on th e WAN interface, please use WAN IP Alias. You can set up to 32 public IP addresses other than the cur[...]

Vigor2955 User’s Guide 30 PPTP/L2TP Client Mode Click Enable PPTP to enable a PPTP client to establish a tunnel to a DSL modem on the WAN interface. Click Enable L2TP to enable a L2TP client to establish a tunnel to a DSL modem on the WAN interface. Click Disable to disable PPTP/L2TP client mode. All the settings configured in this page will be i[...]

Vigor2955 User’s Guide 31 IP Alias. You can set up to 32 public IP addresses other than the current one you are using. Notice that this setting is available for WAN1 only. Default MAC Address – Click this radio button to use default MAC address for the router. Specify a MAC Address - Some Cable service providers specify a specific MAC address f[...]

Vigor2955 User’s Guide 32 PPP Client Mode Click Enable to activate this mode for WAN2. SIM PIN code Type PIN code of the SIM card that will be used to access Internet. Modem Initial String Such value is used to initialize USB modem. Please use the default value. If you have any question, please contact to your ISP. APN Name APN(Access Point Name)[...]

Vigor2955 User’s Guide 33 Index Click the number of index to access into the load-balance policy configuration web page. Enable Check this box to enable this policy. Protocol Use the drop-down menu to change the protocol for t he WAN interface. WAN Use the drop-down menu to change the WAN interface. Src IP Start Display the IP address for the sta[...]

Vigor2955 User’s Guide 34 Enable Check this box to enable this policy. Protocol Use the drop-down menu to choose a proper protocol for the WAN interface. Binding WAN interface Choose the WAN interface (WAN1 or WAN2) for binding. Auto failover to other WAN – Check this button to lead the data passing through other WAN automatically when the sele[...]

Vigor2955 User’s Guide 35 3 3 . . 2 2 L L A A N N Local Area Network (LAN) is a group of subnets regulated and ruled by router . The design of network structure is related to what t ype of public IP addresses coming from your ISP . 3 3 . . 2 2 . . 1 1 B B a a s s i i c c s s o o f f L L A A N N The most generic function of V igor router is NA T .[...]

Vigor2955 User’s Guide 36 W W h h a a t t i i s s R R o o u u t t i i n n g g I I n n f f o o r r m m a a t t i i o o n n P P r r o o t t o o c c o o l l ( ( R R I I P P ) ) V igor router will exchange routing informati on with neighboring routers using the RIP to accomplish IP routing. This allows users to cha nge the information of the router s[...]

Vigor2955 User’s Guide 37 3 3 . . 2 2 . . 2 2 G G e e n n e e r r a a l l S S e e t t u u p p This page provides you the general settings for LAN. Click LAN to open the LAN settings page and choose General Setup . 1st IP Address T ype in private IP address for connecting to a local private network (Default: 192.168.1.1). 1st Subnet Mask T ype in [...]

Vigor2955 User’s Guide 38 S tart IP Address: Enter a value of the IP address pool for the DHCP server to start with when issuing IP addresses. If the 2nd IP address of your router is 220.1 35.240.1, the starting IP address must be 220.135.240.2 or greater , but smaller than 220.135.240. 254. IP Pool Counts: Enter the number of IP addresses in the[...]

Vigor2955 User’s Guide 39 of the router , which means the router is the default gateway . DHCP Se rver IP Address for Relay Agent - Set the IP address of the DHCP server you are going to use so the Relay Agent can help to forward the DHCP request to the DHCP server . DNS Server Configuration DNS stands for Domain Name System. Every Internet host [...]

Vigor2955 User’s Guide 40 Index The number (1 to 10) unde r Index allows you to open next page to set up static route. Destination Address Display the destination address of the static route. Status Display the status of the static route. Viewing Routing Table Display the routing table for your reference. A A d d d d S S t t a a t t i i c c R R o[...]

Vigor2955 User’s Guide 41 Note : There are two reasons that we have to apply RIP Protocol Control on 1st Subnet. The f irst is that the LAN inte rface can exchange RI P packets with the neighboring routers via the 1st subnet (192. 168.1.0/24). The second is that those hosts on the internal private subnets (e x. 192.168.10.0/24) can access the Int[...]

Vigor2955 User’s Guide 42 3 3 . . 2 2 . . 4 4 V V L L A A N N PCs connected to Ethernet ports of the router can be divided into different groups and formed VLAN. PCs under the same groups can share each other information through the router and will not be peeked by other groups. The LAN >> VALN allows you to configure VLAN settings through [...]

Vigor2955 User’s Guide 43 Enable Click this radio button t o invoke this function. However, IP/MAC which is not listed in IP Bind List also can connect to Internet. Disable Click this radio button to disable this function. All the settings on this page will be invalid. Strict Bind Click this radio butt on to block the connection of the IP/MAC whi[...]

Vigor2955 User’s Guide 44 Note: Before you select Strict Bind , you have to bind one set of IP/MAC address for one PC. If not, no one of the PCs can access into In ternet. And the web configurator of the router might not be accessed. 3 3 . . 3 3 N N A A T T Usually, the router serves as an NAT (Network Address Translation) router. NAT is a mechan[...]

Vigor2955 User’s Guide 45 3 3 . . 3 3 . . 1 1 P P o o r r t t R R e e d d i i r r e e c c t t i i o o n n Port Redirection is usually set up for server related service inside the local network (LAN), such as web servers, FTP servers, E-mail servers etc. Most of the case, you need a public IP address for each server and this public IP address/doma[...]

Vigor2955 User’s Guide 46 Enable Check this box to enable such port redirection setting. Mode Two options (Single and Range) are provided here for you to choose. To set a range for the specific service, select Range . In Range mode, if the public port (s tart port and end port) and the starting IP of private IP had been entered, the system will c[...]

Vigor2955 User’s Guide 47 3 3 . . 3 3 . . 2 2 D D M M Z Z H H o o s s t t As mentioned above, Port Redirection can redirect incoming TCP/UDP or othe r traffic on particular ports to the specific private IP address/port of host in the LAN. However, other IP protocols, for example Protocols 50 (ESP) and 51 (A H), do not travel on a fixed port. Vigo[...]

Vigor2955 User’s Guide 48 For WAN 1 WAN Selection In WAN 1, DMZ host can be specified with Private IP or Active True IP . Choose the one you want. Private IP Enter the private IP address of the DMZ host, or click Choose PC to select one. It will be available when you choose Private IP as the WAN interface. MAC Address of the True IP DMZ Host Ente[...]

Vigor2955 User’s Guide 49 save the setting. For WAN 2 Click WAN2 tab to open the following page: Enable Check to enable the DMZ Host function. Private IP Enter the private IP address of the DMZ host, or click Choose PC to select one. Choose PC Click this button and then a window will autom atically pop up, as depicted below. The window consists o[...]

Vigor2955 User’s Guide 50 save the setting. Note: If you previously have set up WAN Alias in Internet Access>>PPPoE/Static IP/PPTP, you will find them in Aux. WAN IP list for your selection.[...]

Vigor2955 User’s Guide 51 3 3 . . 3 3 . . 3 3 O O p p e e n n P P o o r r t t s s Open Ports allows you to open a range of ports for the traffic of special applications. Common application of Open Ports includes P2 P application (e.g., BT, KaZaA, Gnutella, WinMX, eMule and others), Internet Camera etc. Ensure that you keep the appl ication involv[...]

Vigor2955 User’s Guide 52 Enable Open Ports Check to enable this entry. Comment Make a name for the defined network application/service. WAN Interface Specify the WAN interface that will be used for this entry. WAN IP Such drop down list will be shown only if you have entered other WAN IP address in WAN IP Alias window. Choose one of them to appl[...]

Vigor2955 User’s Guide 53 Protocol Display the protocol used for this address mapping. Public IP Display the public IP address se lected for this entry, e.g., 86.123.123.2. Private IP Display the private IP set for this address mapping, e.g., 192.168.1.10 Mask Display the subnet mask selected fro this address mapping. Status Display the status fo[...]

Vigor2955 User’s Guide 54 If you want to choose any on of the Public IP settings, you must specify some IP addresses in the IP Alias List of the Static/DHCP Configuration page first. If you di d not type in any IP address in the IP Alias List, the Public IP setting will be empty in this field. When you click Apply , a message will appear to infor[...]

Vigor2955 User’s Guide 55 S S t t a a t t e e f f u u l l P P a a c c k k e e t t I I n n s s p p e e c c t t i i o o n n ( ( S S P P I I ) ) Stateful inspection is a firewall architecture that works at the network layer. Unlike legacy static packet filtering, which examines a p acket based on the information in its header, stateful inspection bu[...]

Vigor2955 User’s Guide 56 2. UDP flood attack 3. ICMP flood attack 4. Port Scan attack 5. IP options 6. Land attack 7. Smurf attack 8. Trace route 10. Fraggle attack 11. TCP flag scan 12. Tear dro p attack 13. Ping o f Death attack 14. ICMP fra gment 15. Unknow n protoc ol Below shows the menu items for Firewall. 3 3 . . 4 4 . . 2 2 G G e e n n e[...]

Vigor2955 User’s Guide 57 Please set at least one profile for choosing in CSM>> APP Enforcement Pr ofile web page first. For troubleshooting needs, you can specify to record information for APP Enforcement Profile by checking the Log box. It will be sent to S yslog server . Please refer to section Syslog/Mail Alert for more detailed informa[...]

Vigor2955 User’s Guide 58 Next Filter Set Set the link to the next filter set to be executed after the current filter run. Do not make a loop with many filter sets. To edit Filter Rule , click the Filter Rule index button to enter the Filter Rule setup page. Check to enable the Filter Rule Check this box to enable the filter rule. Comments Enter [...]

Vigor2955 User’s Guide 59 To set the IP address manually, please choose Any Address/Single Address/Range Address/Subnet Address as the Address Ty pe and type them in this dialog. In addition, if you want to use the IP range from defined groups or objects, please choose Group and Objects as the Address Type. From the IP Group drop down list, choos[...]

Vigor2955 User’s Guide 60 choose Group and Objects as the Service Type. Protocol - Specify the protocol(s) which this filter rule will apply to. Source/Destination Port - (=) – when the first and last value are the same, it indicates one port; when the first and last valu es are different, it indicates a range for the port and available for thi[...]

Vigor2955 User’s Guide 61 E E x x a a m m p p l l e e As stated before, all the traffic will be separate d and arbitrated using on of two IP filters: call filter or data filter. You may preset 12 call filters and data filters in Filter Setup and even link them in a serial manner. Each filter set is composed by 7 filter rules, which can be further[...]

Vigor2955 User’s Guide 62 3 3 . . 4 4 . . 4 4 D D o o S S D D e e f f e e n n s s e e As a sub-functionality of IP Filter/Firewall, th ere are 15 types of detect/ defense function in the DoS Defense setup. The DoS Defense functionality is disabled for default. Click Firewall and click DoS Defense to open the setup page. Enable Dos Defense Check t[...]

Vigor2955 User’s Guide 63 port-scanning Threshold rate, the Vigor router will send out a warning. By default, the Vigor router sets the threshold as 150 packets per second. Block IP options Check the box to activate the Block IP options function. The Vigor router will ignore any IP packets with IP option field in the datagram header. The reason f[...]

Vigor2955 User’s Guide 64 SYN packets with the identical source and destination addresses, as well as the port number to victims. Block Unknown Protocol Check the box to activate the Block Unknown Protocol function. Individual IP packet has a protocol field in the datagram header to indicate the protocol type running over the upper layer. However[...]

Vigor2955 User’s Guide 65 3 3 . . 5 5 O O b b j j e e c c t t s s S S e e t t t t i i n n g g s s For IPs in a range and service ports in a limited range usually will be applied in configuri ng router’s settings, therefore we can define them with objects and bind them with groups for using conveniently. Later, we can select that object/group th[...]

Vigor2955 User’s Guide 66 Name Type a name for this profile. Maximum 15 characters are allowed. Interface Choose a proper interface (WAN, LAN or Any). For example, the Direction setting in Edit Filter Rule will ask you specify IP or IP range for WAN or LAN or any IP address. If you choose LAN as the Interface here, and choose LAN as the direction[...]

Vigor2955 User’s Guide 67 3 3 . . 5 5 . . 2 2 I I P P G G r r o o u u p p This page allows you to bind several IP objects into one IP group. Set to Factory Default Clear all profiles. Click the number under Index colu mn for settings in detail. Name Type a name for this profile. Maximum 15 characters are allowed. Interface Choose WAN, LAN or Any [...]

Vigor2955 User’s Guide 68 3 3 . . 5 5 . . 3 3 S S e e r r v v i i c c e e T T y y p p e e O O b b j j e e c c t t You can set up to 96 sets of Service Type Objects with different conditions. Set to Factory Default Clear all profiles. Click the number under Index co lumn for settings in detail. Name Type a name for this profile. Protocol Specify t[...]

Vigor2955 User’s Guide 69 (!=) – when the first and last value are the same, it indicates all the ports except the port defined here; when th e first and last values are different, it indicates that all the ports except the range defined here are available for this service type. (>) – the port number greater than this value is available. ([...]

Vigor2955 User’s Guide 70 Name Type a name for this profile. Available Service Type Objects You can add IP objects from IP Objects page. All the available IP objects will be shown in this box. Selected Service Type Objects Click >> button to add the selected IP objects in this box. 3 3 . . 5 5 . . 5 5 I I M M O O b b j j e e c c t t This pa[...]

Vigor2955 User’s Guide 71 Profile Name Type a name for this profile. Type a name for such profile and check all the ite ms that not allowed to be used in the host. Finally, click OK to save this profile.[...]

Vigor2955 User’s Guide 72 3 3 . . 5 5 . . 6 6 P P 2 2 P P O O b b j j e e c c t t This page allows you to set 32 profiles for p eer-to-peer application. These profiles will be applied in CSM>>APP Enforcement Profile for filtering. Set to Factory Default Clear all profiles. Click the number under Profile column for conf iguration in details.[...]

Vigor2955 User’s Guide 73 Type a name for such profile and check all the protocols that not allowed to be used in the host. Finally, click OK to save this profile. 3 3 . . 5 5 . . 7 7 P P r r o o t t o o c c o o l l O O b b j j e e c c t t This page allows you to set 32 profiles for applications in protocol communication. These profiles will be a[...]

Vigor2955 User’s Guide 74 3 3 . . 5 5 . . 8 8 M M i i s s c c O O b b j j e e c c t t This page allows you to set 32 profiles for mi scellaneous applications. These profiles will be applied in CSM>> APP Enforcement Profile for filtering. Set to Factory Default Clear all profiles. Click the number under Profile column for c onfiguration in d[...]

Vigor2955 User’s Guide 75 Profile Name Type a name for this profile. Type a name for such profile and check all the protocols that not allowed to be used in the host. Finally, click OK to save this profile. 3 3 . . 6 6 C C S S M M CSM is an abbreviation of Content Security Management which is used to control IM/P2P usage, filter the web content a[...]

Vigor2955 User’s Guide 76 checks the URL strings or some of HTTP data hiding in the pa yload of TCP packets while legacy firewall inspects packets based on the fields of TCP/IP headers only. On the other hand, Vigor router can prevent user from accidentally downloading malicious codes from web pages. It’s very common that malicious codes concea[...]

Vigor2955 User’s Guide 77 Set to Factory Default Clear all profiles. Click the number under Index co lumn for settings in detail. Profile Name Type a name for the CSM profile. Each profile can contain three objects settings, IM Object, P2P Object and Misc Object. Such profile can be applied in the Firewall>>General Setup and Firewall>>[...]

Vigor2955 User’s Guide 78 3 3 . . 6 6 . . 2 2 U U R R L L C C o o n n t t e e n n t t F F i i l l t t e e r r P P r r o o f f i i l l e e Click CSM and click URL Content Filter Profile to open the profile setting page. Enable URL Access Control Check the box to activate URL Access Control. Black List (block those matching keyword) Click this butt[...]

Vigor2955 User’s Guide 79 Y ou must clear your browser cache first so that the URL content filtering facility operates properly on a web page that you visited before. Enable Restrict Web Feature Check the box to activate the function. Java - Check the checkbox to activate the Block Java object function. The Vigor router will discard the Java obje[...]

Vigor2955 User’s Guide 80 3 3 . . 6 6 . . 3 3 W W e e b b C C o o n n t t e e n n t t F F i i l l t t e e r r P P r r o o f f i i l l e e We all know that the content on the Internet just like other types of media may be inappropriate sometimes. As a responsible pare nt or employer, you should protect those in your trust against the hazards. With[...]

Vigor2955 User’s Guide 81 3 3 . . 7 7 B B a a n n d d w w i i d d t t h h M M a a n n a a g g e e m m e e n n t t Below shows the menu items for Bandwidth Management. 3 3 . . 7 7 . . 1 1 S S e e s s s s i i o o n n s s L L i i m m i i t t A PC with private IP address can access to the Internet via NAT router. The router will generate the records [...]

Vigor2955 User’s Guide 82 Maximum Sessions Defines the av ailable session number for each host in the specific range of IP addresses. If you do not set the session number in this field, the system will use the default session limit for the specific limitation you set for each index. Add Adds the specific session limitation onto the list above. Ed[...]

Vigor2955 User’s Guide 83 Default TX limit Define the default speed of the upstream for each computer in LAN. Default RX limit Define the default speed of the downstream for each computer in LAN. Allow auto adjustment to make the best utilization of available bandwidth Router will detect if there is enough bandwidth remained for using according t[...]

Vigor2955 User’s Guide 84 the overcrowded network. This is especially essen tial to those are low tolerant of loss, delay or jitter (delay variation). Another reason is due to congestions at network intersections where speeds of interconnected circuits mismatch or traffic a ggregates, packets will queue up and traffic can be throttled back to a l[...]

Vigor2955 User’s Guide 85 This page displays the QoS settings result of the WAN interface. Click the Setup link to access into next page for the general setup of WAN (1/2) interface. As to class rule, si mply click the Edit link to access into next for configuration. You can configure general setup for the WAN interface, edit the Class Rule, and [...]

Vigor2955 User’s Guide 86 Check this box and click OK , then click Setup link again. You will see the Online Statistics link appearing on this page. Note: Before enable QoS control, you should test the real bandwidth first. QoS may not work properly if the bandwidth is not accurate. You can visit www.speedtest.net or contact with your ISP to get [...]

Vigor2955 User’s Guide 87 After you click the Edit link, you will see the following page. Now you can define the name for that Class. In this case, “Test” is used as the name of Class Index #1. For adding a new rule, click Add to open the following page. ACT Check this box to invoke these settings. Local Address Click the Edit button to set t[...]

Vigor2955 User’s Guide 88 Edit It allows you to edit source address information. Address Type – Determine the address type for the source address. For Single Address , you have to fill in Start IP address. For Range Address , you have to fill in Start IP address and End IP address. For Subnet Address , you have to fill in Start IP address and S[...]

Vigor2955 User’s Guide 89 After you click the Edit link, you will see the following page. For adding a new service type, click Add to open the following pag e. Service Name Type in a new service for your request. Service Type Choose the type (TCP, UDP or TCP/UDP) for the new service. Port Configuration Click Single or Range . If you select Range,[...]

Vigor2955 User’s Guide 90 3 3 . . 8 8 A A p p p p l l i i c c a a t t i i o o n n s s Below shows the menu items for Applications. 3 3 . . 8 8 . . 1 1 D D y y n n a a m m i i c c D D N N S S The ISP often provides you with a dynamic IP address when you c onnect to the Internet via your ISP. It means that the public IP address assigned to your rou[...]

Vigor2955 User’s Guide 91 Active Display if this account is active or inactive. View Log Display DDNS log status. Force Update Force the router updates its information to DDNS server. 3. Select Index number 1 to add an account for the router. Check Enable Dynamic DNS Account , and choose correct Service Provider: dyndns.org, type the registered h[...]

Vigor2955 User’s Guide 92 3 3 . . 8 8 . . 2 2 S S c c h h e e d d u u l l e e The Vigor router has a built-in real time clock which can update itself manually or automatically by means of Network Time Protocols (NTP). As a re sult, you can not only schedule the router to dialup to the Internet at a specified time, but also restrict Internet acces[...]

Vigor2955 User’s Guide 93 Start Date (yyyy-mm-dd) Specify the starting date of the schedule. Start Time (hh:mm) Specify the starting time of the schedule. Duration Time (hh:mm) Specify the duration (or period) for the schedule. Action Specify which action Call Schedule should apply during the period of the schedule. Force On - Force the connectio[...]

Vigor2955 User’s Guide 94 3 3 . . 8 8 . . 3 3 R R A A D D I I U U S S / / L L D D A A P P Remote Authentication Dial-In User Servi ce (RADIUS) is a security authentication client/server protocol that supports authenti cation, authorization and accounting, which is widely used by Internet service providers. It is the most common method of authenti[...]

Vigor2955 User’s Guide 95 Common Name Identifier Type or edit the co mmon name identifier for the LDAP server. The common name identifier for most LDAP server is cn. Distinguished Name Type or edit the distinguished name used to look up e ntries on the LDAP server. 3 3 . . 8 8 . . 4 4 U U P P n n P P The UPnP (Universal Plug and Play) protocol is[...]

Vigor2955 User’s Guide 96 The UPnP facility on the router enables UPnP aware applications such as MSN Messenger to discover what are behind a NA T router . The application will also learn the external IP address and configure port mappings on the router . Subsequently , such a facility forwards packets from the external ports of the router to the[...]

Vigor2955 User’s Guide 97 Wake by Two types provide for you to wake up the binded IP. If you choose Wake by MAC Address, you have to type the correct MAC address of the host in MAC Address boxes. If you choose Wake by IP Address, you have to choose the correct IP address. IP Address The IP addresses that have been configured in Firewall>>Bi[...]

Vigor2955 User’s Guide 98 3 3 . . 9 9 V V P P N N a a n n d d R R e e m m o o t t e e A A c c c c e e s s s s A Virtual Private Network (VPN) is the extension of a private network that encompasses links across shared or public networks like th e Internet. In short, by VPN technology, you can send data between two computers across a shared or publ[...]

Vigor2955 User’s Guide 99 LAN-to-LAN Profile When you finish the mode and profile selection, please click Next to open the following page. In this page, you have to select suitable VPN type for the VPN client profile. Th ere are six types provided here. Different type will lead to different configura tion page. After making the choices for the cl[...]

Vigor2955 User’s Guide 100 z When you choose IPSec , you will see the following graphic: z When you choose L2TP , you will see the following graphic:[...]

Vigor2955 User’s Guide 101 z When you choose L2TP over IPSec (N ice to Have), you will see the following graphic: z When you choose L2TP over IPSec (Must), you will see the following graphic:[...]

Vigor2955 User’s Guide 102 Profile Name Type a name for such profile. The length of the file is limited to 10 characters. VPN Dial-Out Through Use the drop down menu to choose a proper WAN interface for this profile. This setting is useful for dial-out only. WAN1 First - While connecting, the router will use WAN1 as the first channel for VPN conn[...]

Vigor2955 User’s Guide 103 such as L2TP over IPSec and IPSec tunnel. Pre-Shared Key- Specify a key for IKE authentication Confirm Pre-Shared Key- Confirm the pre-shared key. Digital Signature (X.509) Check the box of Digital Signature to invoke this function. Peer ID – Select one predefined in the X.509 Peer ID Profiles (set from VPN and Remote[...]

Vigor2955 User’s Guide 104 Go to the VPN Connection Management Click this radio button to access VPN and Remote Access>>Connection Management for viewing VPN Connection status. Do another VPN Server Wizard Setup Click this radio button to set another profile of VPN Server through VPN Server Wizard. View more detailed configuration Click thi[...]

Vigor2955 User’s Guide 105 Selection Site to Site VPN/Remote Dial-in User – To set a LAN-to-LAN profile automatically, please choose Site to Site VPN. Remote Dial-in User –You can manage remote access by maintaining a table of remote user profile, so that users can be authenticated to dial-in via VPN connection. Please choose a LAN-to-LAN Pro[...]

Vigor2955 User’s Guide 106 page. After making the choices for the server profile, please click Next . You will see different configurations based on the selection you made. z When you check PPTP/IPSec/L2TP (three ty pes) or PPTP/IPSec (two types) or L2TP with Policy (Nice to Have/Must) , you will see the following graphic: z When you check PPTP/L[...]

Vigor2955 User’s Guide 107 Profile Name Type a name for such profile. The length of the file is limited to 10 characters. User Name This field is used to authenticate for connection when you select PPTP or L2TP with or without IPSec policy above. Password This field is used to authenticate for connection when you select PPTP or L2TP with or witho[...]

Vigor2955 User’s Guide 108 Remote Network IP Please type one LAN IP address (according to the real location of the remote host) for building VPN connection. Remote Network Mask Please type the network mask (according to the real location of the remote host) for building VPN connection. After finishing the configuration, please click Next. The con[...]

Vigor2955 User’s Guide 109 The Vigor router will not accept the ISDN dial-in connection if the box of Enable ISDN Dial-in is not checked. 3 3 . . 9 9 . . 4 4 P P P P P P G G e e n n e e r r a a l l S S e e t t u u p p This submenu only applies to PPP-related VPN connections, such as PPTP, L2TP, L2TP over IPSec. Dial-In PPP Authentication PAP Only[...]

Vigor2955 User’s Guide 110 use 40-bit to perform encryption prior to using 128-bit for encryption. In other words, if 128-bit MPPE encryption method is not available, then 40-bit encryption scheme will be applied to encrypt the data. Maximum MPPE - This option indicates that the router will use the MPPE encryption scheme with maximum bits (128-bi[...]

Vigor2955 User’s Guide 111 IKE Authentication Method This usually applies to those are remote dial-in user or node (LAN-to-LAN) which uses dynamic IP address and IPSec-related VPN connections such as L2TP over IPSec and IPSec tunnel. Certificate for Dial in -When the client executes remote dial-in with IPSec mode, the router will transfer the cer[...]

Vigor2955 User’s Guide 112 Set to Factory Default Click it to clear all indexes. Index Click the num ber below Index to access into the setting page of IPSec Peer Identity. Name Display the profile name of that index. Click each index to edit one peer digital certificate. There are three security levels of digital signature authentication: Fill e[...]

Vigor2955 User’s Guide 113 Accept Subject Alternative Name Click to check one specific field of digital signature to accept the peer with matching value. The field can be IP Address, Domain, or E-mail Address . The box under the Type will appear according to the type you select and ask you to fill in corresponding setting. Accept Subject Name Cli[...]

Vigor2955 User’s Guide 114 3 3 . . 9 9 . . 7 7 R R e e m m o o t t e e D D i i a a l l - - i i n n U U s s e e r r You can manage remote access by maintaining a table of remote user profile, so that users can be authenticated to dial-in via ISDN or build the VPN connection. You may set parameters including specified connection peer ID, connection[...]

Vigor2955 User’s Guide 115 Enable this account Check the box to enable this function. Idle Timeout- If the dial-in user is idle over the limitation of the timer, the router will drop this connection. By default, the Idle Timeout is set to 300 seconds. ISDN Allow the remote ISDN dial-in connection. You can further set up Callback function below. Y[...]

Vigor2955 User’s Guide 116 SSL Tunnel It allows the remote dial-in user to make an SSL VPN Tunnel connection through Internet, suitable for the application through network accessing (e.g., PPTP/L2TP/IPSec) If you check this box, the function of SS L Tunnel for this account will be activated immediately. To check if SSL Tunnel is activated or not,[...]

Vigor2955 User’s Guide 117 VPN>> SSL Web Proxy to set profiles. If you have set several profiles beforehand, you can check SSL Web Proxy and choose the one(s) you need as SSL VPN. To check if SSL Web Proxy is activated or not, please open Draytek SSL VPN portal interface. From the web page, you will see the message to indicate that you have[...]

Vigor2955 User’s Guide 118 remote node. The only exception is Digi tal Signature (X.509) can be set when you select IPSec tunnel either with or without specify the IP address of the remote node. Pre-Shared Key - Check the box of Pre-Shared Key to invoke this function and type in the required characters (1-63) as the pre-shared key. Digital Signat[...]

Vigor2955 User’s Guide 119 Set to Factory Default Click to clear all indexes. Name Indicate the name of the LAN-to-LAN profile. The symbol ??? represents that the profile is empty. Status Indicate the status of individual profiles. The symbol V and X represent the profile to be active and inactive, respectively. Click each index to edit each prof[...]

Vigor2955 User’s Guide 120 Profile Name Specify a name for the profile of the LAN-to-LAN connection. Enable this profile Check here to activate this profile. VPN Connection Through Use the drop down menu to choose a proper WAN interface for this profile. This setting is useful for dial-out only. WAN1 First - While connecting, the router will use [...]

Vigor2955 User’s Guide 121 WAN2 First - While connecting, the router will use WAN2 as the first channel for VPN connection. If WAN2 fails, the router will use another WAN interface instead. WAN2 Only - While connecting, the router will use WAN2 as the only channel for VPN connection. Netbios Naming Packet Pass – click it to have an inquiry for [...]

Vigor2955 User’s Guide 122 further set up Callback (CBCP) function below. This feature is useful for i model only. PPTP Build a PPTP VPN connection to the server through the Internet. You should set the identity like User Name and Password below for the authentication of remote server. IPSec Tunnel Build an IPSec VPN connection to the server thro[...]

Vigor2955 User’s Guide 123 Medium (AH, Authentication Header) means data will be authenticated, but not be encrypte d. By default, this option is active. High (ESP-Encapsulating Security Payload)- means payload (data) will be encrypted and authenticated. Select from below: DES without Authentication - Use DES encryption algorithm and not apply an[...]

Vigor2955 User’s Guide 124 IKE phase 2 proposal- To propose the local available algorithms to the VPN peers, and get its feedback to find a match. Three combinations are available for both modes. We suggest you select the combination that covers the most algorithms. IKE phase 1 key lifetime- For security reason, the lifetime of key should be defi[...]

Vigor2955 User’s Guide 125 here to allow the Vigor router to send the ISDN number to the remote router. This feature is useful for i model only. Allowed Dial-In Type Determine the dial-in connection with different types. ISDN - Allow the remote ISDN LAN-to-LAN connection. You should set the User Name and Password of remote dial-in user below. Thi[...]

Vigor2955 User’s Guide 126 None - Do not apply the IPSec policy. Accordingly, the VPN connection employed the L2TP without IPSec policy can be viewed as one pure L2TP connection. Nice to Have - Apply the IPSec policy first, if it is applicable during negotiation. Otherwise, the dial-in VPN connection becomes one pure L2TP connection. Must - Speci[...]

Vigor2955 User’s Guide 127 Callback number -The option is for extra security. Once enabled, the router will ONLY call back to the specified Callback Number. Callback Budget (Unit: minutes) - By default, the callback function has limitation of callback period. Once the callback budget is exhausted, the function will be disabled automatically. Plea[...]

Vigor2955 User’s Guide 128 find there are several subnets behind the remote VPN router. RIP Direction - The option specifies the direction of RIP (Routing Information Protoc ol) packets. You can enable/disable one of direction here. Herein, we provide four options: TX/RX Both, TX Only, RX Only, and Disable. From first subnet to remote network, yo[...]

Vigor2955 User’s Guide 129 ¾ Specific ERD (Environment Recovery Detecti on) mechanism which can be operated by using Telnet command V PN TRUNK-VPN Backup mechanism profile will be activated when initial connection of single VPN tunnel is off-line. Before setting VPN TRUNK -VPN Backup mechanism backup profile, please configure at least two sets o[...]

Vigor2955 User’s Guide 130 Backup Profile List Set to Factory Default - Click to clear all VPN TRUNK-VPN Backup mechanism profile. No - The order of VPN TRUNK-VPN Backup mechanism profile. Status (on Backup Profile field) - “v” means such profile is enabled; ”x” means such profile is disabled. Name (on Backup Profile field) - Display the [...]

Vigor2955 User’s Guide 131 Advanced – This button is only available when there is one profile (or more) created in this page. Detailed information for this dialog, see later section - Advanced Load Balance and Backup . Load Balance Profile List Set to Factory Default - Click to clear all VPN TRUNK-VPN Load Balance mechanism profile. No - The or[...]

Vigor2955 User’s Guide 132 Detailed information for this dialog, see later section - Advanced Load Balance and Backup . General Setup Status - After choosing one of the profile listed above, please click Enable to activate this profile. If you click Disable , the selected or current used VP N TRUNK-Backup/Load Balance mechanism profile will not h[...]

Vigor2955 User’s Guide 133 Delete Click this button to delete the selected VPN TRUNK profile. The corresponding members (LAN-to-LAN profiles) grouped in the deleted VPN TRUNK profile will be released and that profiles in LAN-to-LAN will be displayed in black. T T i i m m e e f f o o r r a a c c t t i i v v a a t t i i n n g g V V P P N N T T R R [...]

Vigor2955 User’s Guide 134 expressed in black. H H o o w w c c a a n n y y o o u u s s e e t t a a G G R R E E o o v v e e r r I I P P S S e e c c p p r r o o f f i i l l e e ? ? 1. Please go to LAN to LAN to set a profile with IPSec. 2. If the router will be used as the VPN Server (i.e., with virtual address 192.168.50.200). Please type 192.168.[...]

Vigor2955 User’s Guide 135 A A d d v v a a n n c c e e d d L L o o a a d d B B a a l l a a n n c c e e a a n n d d B B a a c c k k u u p p After setting profiles for load balance, you can choose any one of them and click Advance for more detailed configuration. The window s for advanced load balance and backup are different. Refer to the followin[...]

Vigor2955 User’s Guide 136 binding tunnel table. Tunnel Bind Table Index - 400 binding tunnel tables are provided by this device. Choose any one of them for such Load Balance profile. Active – In-active/Delete can delete this binding tunnel table. Active can activate this binding tunnel table. Binding Dial Out Index – Specify connection type [...]

Vigor2955 User’s Guide 137 Detail Information This field will display detailed information for Binding Tunnel Policy. Below shows a successful binding tunnel policy for load balance: Note : To configure a successful binding tunnel, you have to: A. Type Binding Src IP range (Start and End) and Binding Des IP range (Start and End) Choose YES or NO [...]

Vigor2955 User’s Guide 138 periodically and type the value for it (the unit is second). If VPN server for Member 1 has completed the network connection, current VPN Tunne l backup connection will be off. Resume – when VPN connection breaks down or disconnects, Member 1 will be the top priority for the system to do VPN connection. Detail Informa[...]

Vigor2955 User’s Guide 139 3 3 . . 9 9 . . 1 1 0 0 C C o o n n n n e e c c t t i i o o n n M M a a n n a a g g e e m m e e n n t t You can find the summary table of all VP N connections. You may disconnect any VPN connection by clicking Drop button. You may also aggressively Dial-out by using Dial-out Tool and clicking Dial button. After adding a[...]

Vigor2955 User’s Guide 140 VPN Load Balance function. Dial Click this button to execute dial out func tion under General Mode, Backup Mode or Load Balance Mode. Refresh Seconds Choose the time for refresh the dial inform ation among 5, 10, and 30. Refresh Click this button to refresh the whole connection status. 3 3 . . 1 1 0 0 C C e e r r t t i [...]

Vigor2955 User’s Guide 141 GENERATE Click this button to open G enerate Certificate Signing Request window. Type in all the information that the window request such as cer tifcate name (used for identifying different certificate), subject alternative name type and relational settings for subject name. Then click GENERATE again. Note: Please be no[...]

Vigor2955 User’s Guide 142 IMPORT Vigor router allows you to generate a certificate request and submit it the CA server, then import it as “Local Certificate”. If you have already gotten a certificate fro m a third party, you may import it directly. The supported t ypes are PKCS12 Certificate and Certificate with a private key. Click this but[...]

Vigor2955 User’s Guide 143 Upload Certificate and Private Key It is useful when users have separated certificates and private keys. And the password is needed if the private key is encrypted. REFRESH Click this button to refresh the information listed below. View Click this button to view the detailed settings for certificate request. Note: You h[...]

Vigor2955 User’s Guide 144 imported will be listed on the Trusted CA Certificate window. Then click Import to use the pre-saved file. For viewing each trusted CA certificate, click View to open the certificate detail information window. If you want to delete a CA cer tificate, choose the one and click Delete to rem ove all the certificate informa[...]

Vigor2955 User’s Guide 145 3 3 . . 1 1 0 0 . . 3 3 C C e e r r t t i i f f i i c c a a t t e e B B a a c c k k u u p p Local certificate and Trusted CA certificate for this router can be saved within one file. Please click Backup on the following screen to save them . If you want to set encryption password for these certificates, please type char[...]

Vigor2955 User’s Guide 146 Port Such port is set for SSL VPN server. It will not affect the HTTPS Port configuration set in System Maintenance>>Management . In general, the default setting is 443. Server Certificate When the client does not set any certificate, default certificate will be used for HTTPS and SSL VPN server. Choose any one of[...]

Vigor2955 User’s Guide 147 Name Type name of the profile. URL Type the address (function variati on or IP address) or path of the proxy server. Host IP Address If you type function variation as URL, you have to t ype corresponding IP address in this filed. Such field must match with URL setting. Access Method There are three modes for you to choo[...]

Vigor2955 User’s Guide 148 Name Display the application name of the profile that you create. Host Address Display the IP address for VNC/RDP or SAMBA pat h. Service Display the type of the service selected, e.g., VNC/RDP/SAMBA. Active Display current status (active or inactive) of the selected profile. Click number link under Index filed to make [...]

Vigor2955 User’s Guide 149 Scaling Chose the percentage (100%, 80%, 60) for such application. z Remote Desktop Protocol - Choose this item for accessing and controlling a remote PC through RDP protocol. IP Address Type the IP address for this protocol. Port Specify the port used for this protocol. The default setting is 5900. Screen Size Chose th[...]

Vigor2955 User’s Guide 150 You can find out the link of Set SSL Web Proxy on the profile setting page. If you haven’t set any SSL Web Proxy Profile in SSL VPN>> SSL Web Proxy web page, there is no check box but a link appeared below. However, if you have set several SSL Web Proxy Profiles in SSL VPN>> SSL Web Proxy web page: The SSL[...]

Vigor2955 User’s Guide 151 3 3 . . 1 1 1 1 . . 5 5 O O n n l l i i n n e e U U s s e e r r S S t t a a t t u u s s If you have finished the configuration of SSL Web Proxy (server), users can find out corresponding settings when they access in to Draytek SSL VPN portal interface. Next, users can open SSL VPN>> Online Status to view logging s[...]

Vigor2955 User’s Guide 152 3 3 . . 1 1 2 2 S S y y s s t t e e m m M M a a i i n n t t e e n n a a n n c c e e For the system setup, there are several items that you have to know the way of configuration: Status, Administrator Password, Configuration Backup, Syslog, Time setup, Reboot System, Firmware Upgrade. Below shows the menu items for Syste[...]

Vigor2955 User’s Guide 153 1 st IP Address Display the IP address of the LAN interface. 1 st Subnet Mask Display the subnet mask address of the LAN interface. DHCP Server Display the current status of DHCP server of the LAN interface. DNS Display the assigned IP address of the primary DNS. WAN1/WAN2 --- Link Status Display the connection status. [...]

Vigor2955 User’s Guide 154 ACS Server Such data m u st be typed according to the ACS ( Auto Configuration Server) you wa nt to link. Please refer to VigorACS user’s manual for detailed information. URL - Type the URL for VigorACS server. If the connected CPE needs to be authenticated, please set URL as the following and type usernam e and passw[...]

Vigor2955 User’s Guide 155 3 3 . . 1 1 2 2 . . 3 3 A A d d m m i i n n i i s s t t r r a a t t o o r r P P a a s s s s w w o o r r d d This page allows you to set new password. Old Password Type in the old password. The factory default setting for password is blank. New Password Type in new password in this filed. Confirm New Password Type in the[...]

Vigor2955 User’s Guide 156 3. In Save As dialog, the default filename is config.cfg . You could gi ve it another name by yourself. 4. Click Save button, the configuration will download a u tomatically to your computer as a file named config.cfg . The above example is using W indows platform for demonstrating examples. The Mac or Linux platform wi[...]

Vigor2955 User’s Guide 157 R R e e s s t t o o r r e e C C o o n n f f i i g g u u r r a a t t i i o o n n 1. Go to System Maintenance >> Configuration Backup . The following windows will be popped-up, as shown below. 2. Click Browse button to choose the correct confi guration file for uploading to the router. 3. Click Restore button and wa[...]

Vigor2955 User’s Guide 158 Mail To Assign a mail address for sending mails out. Return-Path Assign a path for receiving the mail from outside. Authentication Check this box to activate this function while using e-mail application. User Name Type the user name for authentication. Password Type the password for authentication. Click OK to save thes[...]

Vigor2955 User’s Guide 159 3 3 . . 1 1 2 2 . . 6 6 T T i i m m e e a a n n d d D D a a t t e e It allows you to specify where the time of the router should be inquired from. Current System Time Click Inquire Time to get the current time. Use Browser Time Select this option to use the browser time from the remote administrator PC host as router’[...]

Vigor2955 User’s Guide 160 3 3 . . 1 1 2 2 . . 7 7 M M a a n n a a g g e e m m e e n n t t This page allows you to manage the setti ngs for access control, access list, port setup, and SMP setup. For example, as to management access control, the port number is used to send/receive SIP message for building a session. The default value is 5060 and [...]

Vigor2955 User’s Guide 161 Set Community Set community b y typing a proper name . The default setting is private. Manager Host IP Set one host as the manager to execute SNMP function. Please type in IP address to specify certain host. Trap Community Set trap community by typing a pr oper name. The default setting is public. Notification Host IP S[...]

Vigor2955 User’s Guide 162 3 3 . . 1 1 2 2 . . 9 9 F F i i r r m m w w a a r r e e U U p p g g r r a a d d e e Before upgrading your router firmware, you need to install the Router Tools. The Firmware Upgrade Utility is included in the tools. The following web page will guide you to upgrade firmware by using an exam ple. Note that this example is[...]

Vigor2955 User’s Guide 163 3 3 . . 1 1 3 3 D D i i a a g g n n o o s s t t i i c c s s Diagnostic Tools provide a useful way to view or diagnose the status of your Vigor router. Below shows the menu items for Diagnostics. 3 3 . . 1 1 3 3 . . 1 1 D D i i a a l l - - o o u u t t T T r r i i g g g g e e r r Click Diagnostics and click Dial-out Trigg[...]

Vigor2955 User’s Guide 164 3 3 . . 1 1 3 3 . . 2 2 R R o o u u t t i i n n g g T T a a b b l l e e Click Diagnostics and click Routing Table to open t he web page. Refresh Click it to reload the page. 3 3 . . 1 1 3 3 . . 3 3 A A R R P P C C a a c c h h e e T T a a b b l l e e Click Diagnostics and click ARP Cache Table to view the content of the [...]

Vigor2955 User’s Guide 165 3 3 . . 1 1 3 3 . . 4 4 D D H H C C P P T T a a b b l l e e The facility provides information on IP address as signments. This information is helpful in diagnosing network problems, such as IP address conflicts, etc. Click Diagnostics and click DHCP Table to open the web page. Index It displays the connection item numbe[...]

Vigor2955 User’s Guide 166 #Pseudo Port It indicates the temporary port of the router used for NAT. Peer IP:Port It indicates the destination IP address and port of remote host. Interface It indicates the interface of the WAN connection. Refresh Click it to reload the page. 3 3 . . 1 1 3 3 . . 6 6 D D a a t t a a F F l l o o w w M M o o n n i i t[...]

Vigor2955 User’s Guide 167 Refresh Seconds Use the drop down list to choose the time interval of refreshing data flow that will be done by the system automatically. Refresh Click this link to refr esh th is page manually. Index Display the number of the data flow. IP Address Display the IP address of the monitored device. TX rate (kbps) Display t[...]

Vigor2955 User’s Guide 168 3 3 . . 1 1 3 3 . . 7 7 T T r r a a f f f f i i c c G G r r a a p p h h Click Diagnostics and click Traffic Graph to pen the web page. Choose WAN1 Bandwidth/WAN2 Bandwidth, VPN Bandwidth, Sessions, daily or weekly for viewing different traffic graph. Click Refresh to renew the graph at any time. The following two figure[...]

Vigor2955 User’s Guide 169 3 3 . . 1 1 3 3 . . 8 8 P P i i n n g g D D i i a a g g n n o o s s i i s s Click Diagnostics and click Ping Diagnosis to pen the web page. Ping through Use the drop down list to c hoose the WAN interface that you want to ping through or choose Unspecified to be determined by the router automatically. Ping to Use the dr[...]

Vigor2955 User’s Guide 170 3 3 . . 1 1 3 3 . . 9 9 T T r r a a c c e e R R o o u u t t e e Click Diagnostics and click Trace Route to open the web page. This page allows you to trace the routes from router to the host. Simply type the IP address of the host in the box and click Run . The result of route trace will be shown on the screen. Trace th[...]

Vigor2955 User’s Guide 171 3 3 . . 1 1 4 4 S S u u p p p p o o r r t t A A r r e e a a When you click the menu item under Support Area , you will be guided to visit www.draytek.com and open the corresponding pages directly. Click Support Area>>Application Note , the following web page will be displayed. Click Support Area>>FAQ , the f[...]

Vigor2955 User’s Guide 172 Click Support Area>>Product Registration , the following web page will be displayed.[...]

Vigor2955 User’s Guide 173 4 A A p p p p l l i i c c a a t t i i o o n n a a n n d d E E x x a a m m p p l l e e s s 4 4 . . 1 1 C C r r e e a a t t e e a a L L A A N N - - t t o o - - L L A A N N C C o o n n n n e e c c t t i i o o n n B B e e t t w w e e e e n n R R e e m m o o t t e e O O f f f f i i c c e e a a n n d d H H e e a a d d q q u u[...]

Vigor2955 User’s Guide 174 For using IPSec -based service, such as IPSec or L2 TP with IPSec Policy, you have to set general settings in IPSec General Setup , such as the pre-shared key that both parties have known. 3. Go to LAN-to-LAN . Click on one index number to edit a profile. 4. Set Common Settings as shown below. You should enable both of [...]

Vigor2955 User’s Guide 175 connection. If a PPP-based service is selected, you should further specify the remote peer IP Address, Username, Password, PPP Authen tication and VJ Compression for this Dial-Out connection. 6. Set Dial-In settings to as shown below to allow Router B dial-in to build VPN connection. If an IPSec-based service i s select[...]

Vigor2955 User’s Guide 176 connection. Otherwise, it will apply the settings defined in IPSec General Setup above. If a PPP-based service is selected, you should further specify the remote peer IP Address, Username, Password, and VJ Com p ression for this Dial-In connection. 7. At last, set the remote network IP/subnet in TCP/IP Network Settings [...]

Vigor2955 User’s Guide 177 Settings in Router B in the remote office: 1. Go to VPN and Remote Access and select Remote Access Cont rol to enable the necessary VPN service and click OK . 2. Then, for using PPP based services, such as PPTP, L2TP, you have to set general settings in PPP General Setup . For using IPSec-based service, such as IPSec or[...]

Vigor2955 User’s Guide 178 3. Go to LAN-to-LAN . Click on one index number to edit a profile. 4. Set Common Settings as shown below. You should enable both of VPN connections because any one of the parties may start the VPN connection. 5. Set Dial-Out Settings as shown below to dial to connect to Router B aggressively with the selected Dial-Out m[...]

Vigor2955 User’s Guide 179 Dial-Out connection. 6. Set Dial-In settings to as shown below to allow Router A dial-in to build VPN connection. If an IPSec-based service is selected, y ou may further specify the remote peer IP Address, IKE Authentication Method and I PSec Security Method for this Dial-In connection. Otherwise, it will apply the sett[...]

Vigor2955 User’s Guide 180 7. At last, set the remote network IP/subnet in TCP/IP Network Settings so that Router B can direct the packets des tined to the remote network to Router A via the VPN connection.[...]

Vigor2955 User’s Guide 181 4 4 . . 2 2 C C r r e e a a t t e e a a R R e e m m o o t t e e D D i i a a l l - - i i n n U U s s e e r r C C o o n n n n e e c c t t i i o o n n B B e e t t w w e e e e n n t t h h e e T T e e l l e e w w o o r r k k e e r r a a n n d d H H e e a a d d q q u u a a r r t t e e r r The other common case is that you, as[...]

Vigor2955 User’s Guide 182 3. Go to Remote Dial-In Users . Click on one index number to edit a profile. 4. Set Dial-In settings to as shown below to allow the remote user dial-in to build VPN connection. If an IPSec-based service is sele cted, you may further specify the remote peer IP Address, IKE Authentication Method and I PSec Security Method[...]

Vigor2955 User’s Guide 183 Settings in the remote host: 1. For Win98/ME, you may use "Dial-up Networking" to create the PPTP tunnel t o Vigor router. For Win2000/XP, please use "Network and Dial-up connections" or “Smart VPN Client”, complimentary software to help you create PPTP, L2TP, and L2TP over IPSec tunnel. You can [...]

Vigor2955 User’s Guide 184 You may further specify the method you use to get IP, the security method, and authentication method. If the Pre-Shared Key is selected, it should be consistent with the one set in VPN router. If a PPP-based service is selected, you should fu rther specify the remote VPN server IP address, Username, Password, and encryp[...]

Vigor2955 User’s Guide 185 4. Click Connect button to build connection. When the connection is successful, you will find a green light on the right down corner. 4 4 . . 3 3 Q Q o o S S S S e e t t t t i i n n g g E E x x a a m m p p l l e e Assume a teleworker someti mes works at hom e and takes care of children. When working time, he would use V[...]

Vigor2955 User’s Guide 186 3. Enter the Name of Index Class 2 by clicking Edit link. In this index, the user will set reserve bandwidth for HTTPS. And click Basic button on the right. 4. Click Setup link for W AN1. Check Enable UDP Bandwidth Control on the bottom to prevent enormous UDP traffic of V oIP influent other application. 5. If the worke[...]

Vigor2955 User’s Guide 187 4 4 . . 4 4 L L A A N N – – C C r r e e a a t t e e d d b b y y U U s s i i n n g g N N A A T T An example of default setting and the corr esponding deplo yment are shown below . The default V igor router private IP address/ Subnet Mask is 192.1 68.1.1/255.255.255.0. The built-in DHCP server is enabled so it assigns[...]

Vigor2955 User’s Guide 188 Y ou can just set the settings wrapped inside the red rectangles to fit the request of NA T usage.[...]

Vigor2955 User’s Guide 189 4 4 . . 5 5 U U p p g g r r a a d d e e F F i i r r m m w w a a r r e e f f o o r r Y Y o o u u r r R R o o u u t t e e r r Before upgrading your router firmware, you need to install the Router Tools. The file RTSxxx.exe will be asked to copy onto your computer. Remember the place of storing the execution file. 1. Go to[...]

Vigor2955 User’s Guide 190 5. Double click on the router tool icon. The setup wizard will appear. 6. Follow the onscreen instructions to install the tool. Finally, click Finish to end the installation. 7. From the Start menu, open Programs and choose Router Tools XXX >> Firmware Upgrade Utility . 8. Type in your router IP, usually 192.168. [...]

Vigor2955 User’s Guide 191 10. Click Send . 11. Now the firmware update is finished. 4 4 . . 6 6 R R e e q q u u e e s s t t a a c c e e r r t t i i f f i i c c a a t t e e f f r r o o m m a a C C A A s s e e r r v v e e r r o o n n W W i i n n d d o o w w s s C C A A S S e e r r v v e e r r[...]

Vigor2955 User’s Guide 192 1. Go to Certificate Management and choose Local Certificate . 2. You can click GENERATE button to start to edit a certificate request. Enter the information in the certificate request. 3. Copy and save the X509 Local Certificate Requet as a text file and save it for later use.[...]

Vigor2955 User’s Guide 193 4. Connect to CA server via web browser. Follo w the instruction to subm it the request. Below we take a Windows 2000 CA server for example. Select Request a Certificate . Select Advanced request . Select Submit a certificate request a base64 encoded PKCS #10 file or a renewal request using a base64 encoded PKCS #7 file[...]

Vigor2955 User’s Guide 194 Then you have done the request and the ser ver now issues you a certificate. Select Base 64 encoded certificate and Download CA certificate . Now you should get a certificate (.cer file) and save it. 5. Back to Vigor router, go to Local Certificate . Click IMPORT button and browse the file to import the certificate (.ce[...]

Vigor2955 User’s Guide 195 4 4 . . 7 7 R R e e q q u u e e s s t t a a C C A A C C e e r r t t i i f f i i c c a a t t e e a a n n d d S S e e t t a a s s T T r r u u s s t t e e d d o o n n W W i i n n d d o o w w s s C C A A S S e e r r v v e e r r 1. Use web browser connecting to the CA server that you would like to retrieve its CA certificate[...]

Vigor2955 User’s Guide 196 2. In Choose file to download , click CA Certificate Current and Base 64 encoded, and Download CA certificate to save the .cer. file. 3. Back to Vigor router, go to Trusted CA Certificate . Click IMPORT button and browse the file to import the certificate (.cer file) into Vigor router. When finished, click refresh and y[...]

Vigor2955 User’s Guide 197 4 4 . . 8 8 E E R R D D M M e e c c h h a a n n i i s s m m f f o o r r V V P P N N T T R R U U N N K K To use ERD (Environment Recovery Detection) mechanism for VPN TRUNK, please follow the steps listed below: 1. Click Start >> Run and type Telnet 192.168.1.1 in the Open box as below. Note that the IP address in [...]

Vigor2955 User’s Guide 198 When VPN connection breaks down, Member1 is a top priorit y for the system to do VPN connection again. Request Background: Some of users hope the connection can be continuous and n ot breaking down (maybe they will have thousa nds of orders coming within one m inute). If the network connection breaks down, the users mus[...]

Vigor2955 User’s Guide 199 4 4 . . 9 9 V V P P N N L L o o a a d d B B a a l l a a n n c c e e A A p p p p l l i i c c a a t t i i o o n n Here provides two situations that you can take advantages of VPN TRUNK Load Balance profile mechanism. Example 1: A VPN TRUNK profile with member 1 (GRE over IPSec type-LAN to LAN Router Mode) and Member 2(GRE[...]

Vigor2955 User’s Guide 200 ¾ Finish Member2 LAN-to-LAN Dial out Profile with GRE over IPSec configuration. Check Enable IPSec Dial-Out function GRE over IPSec. Type 192.168.100 .100 as My GRE IP and 192.168.100.200 as Peer GRE IP. After adding VpnLB1 under VPN TRUNK Mana gement, press Advanced for Load Balance Profile List and choose suitable al[...]

Vigor2955 User’s Guide 201 (3) Dialing from VPN Client site[...]

Vigor2955 User’s Guide 202 This page is left blank.[...]

Vigor2955 User’s Guide 203 5 T T r r o o u u b b l l e e S S h h o o o o t t i i n n g g This section will guide you to solve abnormal s ituations if you cannot access into the Internet after installing the router and finishing the web configuration. Please follow sections below to check your basic installation status stage by stage. z Checking i[...]

Vigor2955 User’s Guide 204 5 5 . . 2 2 C C h h e e c c k k i i n n g g I I f f t t h h e e N N e e t t w w o o r r k k C C o o n n n n e e c c t t i i o o n n S S e e t t t t i i n n g g s s o o n n Y Y o o u u r r C C o o m m p p u u t t e e r r I I s s O O K K o o r r N N o o t t Sometimes the link failure occurs due to the wrong network connec[...]

Vigor2955 User’s Guide 205 4. Select Obtain an IP address automatically and Obtain DNS server address automatically. F F o o r r M M a a c c O O s s 1. Double click on the current used MacOs on the desktop. 2. Open the Application folder and get into Network . 3. On the Network screen, select Using DHCP from the drop down list of Configure IPv4.[...]

Vigor2955 User’s Guide 206 5 5 . . 3 3 P P i i n n g g i i n n g g t t h h e e R R o o u u t t e e r r f f r r o o m m Y Y o o u u r r C C o o m m p p u u t t e e r r The default gateway IP address of the router is 192.168.1.1. For so me reason, you might need to use “ping” command to check the link status of the router. The most important th[...]

Vigor2955 User’s Guide 207[...]

Vigor2955 User’s Guide 208 5 5 . . 4 4 C C h h e e c c k k i i n n g g I I f f t t h h e e I I S S P P S S e e t t t t i i n n g g s s a a r r e e O O K K o o r r N N o o t t Click WAN>> Internet Access and then check whether the ISP settings are set correctly. Click Details Page of WAN1/WAN2 to review the settings that you configured previ[...]

Vigor2955 User’s Guide 209 F F o o r r S S t t a a t t i i c c o o r r D D y y n n a a m m i i c c I I P P U U s s e e r r s s 1. Check if the Enable option is selected. 2. Check if IP address, Subnet Mask and Gateway are entered with correct values that you got from your ISP . F F o o r r P P P P T T P P / / L L 2 2 T T P P U U s s e e r r s s 1[...]

Vigor2955 User’s Guide 210 5 5 . . 5 5 B B a a c c k k i i n n g g t t o o F F a a c c t t o o r r y y D D e e f f a a u u l l t t S S e e t t t t i i n n g g I I f f N N e e c c e e s s s s a a r r y y Sometimes, a wrong connection can be im proved by returning to the default settings. Tr y to reset the router by software or hardware. Warning: A[...]

Vigor2955 User’s Guide 211 After restore the factory default setting, you can configure the settings for the router again to fit your personal request. 5 5 . . 6 6 C C o o n n t t a a c c t t i i n n g g Y Y o o u u r r D D e e a a l l e e r r If the router still cannot work correctly after trying many efforts, please contact your dealer for furt[...]