TP-Link TL-ER604W manual

TL-ER604W Wireless N Gigabit Broadband VPN Router Rev1.0.1 1910010844[...]

-I- COPYRIGHT & TRADEMARKS Specifications are subjec t to change without notice. is a registered trademark of TP-LINK TECHNOLOGIES CO., L TD. Other brands and product names are trademarks of their respective holders. No part of the specificat ions may be reproduced in any form or by any means or used to make any derivative such as translation, [...]

-II- CONTENTS Package Contents .................................................................................................................. 1 Chapter 1 About this Guide ................................................................................................... 2 1.1 Intended Re aders ...................................................[...]

-III- 3.4 Advanc ed ....................................................................................................................... ......55 3.4.1 NA T .......................................................................................................................... 55 3.4.2 T raf fic C ontrol .......................................[...]

-IV- 3.8.7 Logs ....................................................................................................................... 128 Chapter 4 Application ........................................................................................................ 130 4.1 Network Requ irement s.....................................................[...]

-1- Package Content s The following items should be found in your package:  One TL-ER604W Router  One Power Adapter  One RJ45 Ethernet Cable  Quick Installation Guide  Resource CD Note: Make sure that the package contains the above items. If any of t he listed items is damaged or missing, please contact with your distributor .[...]

-2- Chapter 1 About this Guide This User Guide contains information for set up and managem ent of TL-ER604W Router . Please read this guide carefully before operation. 1.1 Intended Readers This Guide is intended for Network Engineer and Network Administrator. 1.2 Conventions In this Guide the following conventions are used:  The Router or TL-ER6[...]

-3- Chapter 2 Introduction Thanks for choosing the SafeS tream Wireless N Gigabit Broadband VPN Router TL-ER604W. 2.1 Overview of the Router The SafeS tream Wireless N Gigabit Broadband VPN Router TL-ER604W from TP-LINK supports Wireless N speed and Gigabit wired speeds on all ports . It integrates multiple VPN protocols, high-security and high-per[...]

-4- + Possessing MAC Filtering function to block the access of illegal hosts.  Flexible T raffic Control + Featured Bandwidth Control with flexible band width management to automatically control the bandwidth of the host in bi-direction to avoid ban dwidth over occup ation, as well as optimize bandwidth usage. + Supporting Session Limit to avoid[...]

-5-  Supports Virtual Server , Port T rigger ing, ALG , S tatic Route and RIP v1/v2  Built-in Switch supporting Port Mirror , Port VLAN, Rate Control and so on  Supports to change the MAC address of LAN and W AN port  Supports Logs, S tatistics, T ime setting  Supports Remote and Web management  Supports Diagnostic (Ping/T r acert[...]

-6- 2.3 Appearance 2.3.1 Front Panel The front panel of TL-ER604W is shown as the following figure. Figure 2-1 Front Panel  LEDs LED Status Indication On The Router is powered on PWR Off The Router is powered off or power supply is abnormal Flashing The Router works properly SYS On/Off The Router works improperly On(Green) The wireless function [...]

-7-  Reset button Use the button to restore the Router to the factory defaults. With the Router powered on, use a pin to press and hold the Reset button (about 4~5 seconds). After the SYS LED goes out, release the Reset button. If the SYS LED is flashing with a high frequency about two or th ree seconds, it means the Router is restored successfu[...]

-8- Chapter 3 Configuration 3.1 Network 3.1.1 S t atus The S tatus page shows the system information, the port connection st atus and other information related to this Router . Choose the menu Network → Stat us to load the following page. Figure 3-1 S t atus 3.1.2 System Mode The TL-ER604W Router can work in th ree modes: NA T , Non-NA T and Clas[...]

-9- Figure 3-2 Network T opology - NA T Mode If your Router is connecting the two networks of di fferent areas in a large network environment with a network topology as the Figure 3-3 shown, and forwards the packets betwe en these two networks by the Routing rules, you can set it to Non-NA T mode. Figure 3-3 Network T opology – Non-NA T Mode If y[...]

-10- Figure 3-5 System Mode Y ou can select a System Mode for your R outer according to your network need.  NA T Mode NA T (Network Address T r anslation) mode allows the Router to translate private IP addresses within internal networks to public IP addresses for traf fi c transport over external networks, such as the Internet. Incoming traffic [...]

-1 1- Figure 3-6 W AN Mode  W AN Mode W AN Ports: Select the total number of W AN port s you prefer to use. The Router support one W AN and dual W AN. The Router will adjust the physical ports accordingly , which can be illustr ated on the following port sketch. Note: By default, TL-ER604W is set to work in the mode of dual W A N port s. 3.1.3.2[...]

-12- Figure 3-7 W AN – S tatic IP The following items are displayed on this screen:  St atic IP Connection T ype: Select S tatic IP if your ISP has assigned a static IP address for your computer . IP Address: Enter the IP address assigned by your ISP . If you are not clear , please consult your ISP . Subnet Mask: Enter the Subnet Mask assigned[...]

-13- Downstream Bandwid th: S pecify the b andwidth for receiving p ackets on the port. 2) Dynamic IP If your ISP (Internet Service Provider) assigns the IP address automatic ally , please choose the Dynamic IP connection type to obt ain the parameters for W AN port automatically . Figure 3-8 W AN – Dynamic IP The following items are displayed on[...]

-14- the default value if no other MTU va lue is provided by your ISP . Get IP Address b y Unicast: The broadcast requirement may not be supported by a few ISPs. Select this option if you can not get the IP address from your ISP even if with a normal network c onnection. This option is not required generally . Use the following DNS Server: Select t[...]

-15- Gateway Address: Displays the Gateway Address assigned by your ISP . Primary DNS: Displays the IP address of your ISP’ s Primary DNS. Secondary DNS: Displays the IP address of your ISP’ s Secondary DNS. 3) PPPoE If your ISP (Internet Service Provider) has provid ed the account information for the PPPoE connection, please choose the PPPoE c[...]

-16- The following items are displayed on this screen:  PPPoE Settings Connection T ype: Select PPPoE if your ISP provides xDSL Vir tual Dial-up connection. Click <Connect> to dial-up to the Internet and obtain the IP address. Click <Disconnect> to disconnec t the Internet connection and release the current IP address. Account Name: [...]

-17- ISP Address: Optional. Enter the ISP address provided by your ISP . It's null by default. Service Name: Optional. Enter the Service Name prov ided by your ISP . It's null by default. Primary DNS: Enter the IP address of y our ISP’s Primary DNS. Secondary DNS: Optional. Enter the IP address of your ISP’ s Secondary DNS. Secondary [...]

-18-  “Connected” indicates that the Router has successfully obtained the IP parameters from your ISP .  “Disconnected” indicates t hat the connection has been manually terminated or the request of the Router has no response from your ISP . Please ensure that your settings are correct and your network is connec ted well. Consult your [...]

-19- Figure 3-10 W AN - L2TP The following items are displayed on this screen:  L2TP Settings Connection T ype: Select L2TP if your ISP provides a L2TP connection. Click <Connect> to dial-up to the Internet and obtain the IP address. Click <Disconnect> to disconnect the In ternet connection and release the current IP address. Account[...]

-20- MTU: MTU (Maximum T ransmission Unit) is the maximum data unit transmitted by the physical network . It can be set in the range of 576-1460. The default MTU is 1460. It is recommended to keep the default value if no other MTU va lue is provided by your ISP . Active Mode: Y ou can select the proper Active Mode according to your need.  Manual[...]

-21-  L2TP S t atus Statu s: Displays the status of PPPoE connection.  “Disabled” indicates that the L2TP connection type is not applied.  “Connecting” indicates that t he Router is obtaining the IP parameters from your ISP .  “Connected” indicates that the Router has successfully obtained the IP p arameters from your ISP . [...]

-22- Figure 3-1 1 W AN - PPTP The following items are displayed on this screen:  PPTP Settings Connection T ype: Select PPTP if your ISP pr ovides a PPTP connection. Click <Connect> to dial-up to the Internet and obtain the IP address. Click <Disconnect> to disconnec t the Internet connection and release the current IP address. Accou[...]

-23- MTU: MTU (Maximum T ransmission Unit) is the maximum dat a unit transmitted by the physical network. It can be set in the range of 576-1460. The default MTU is 1460. It is recommended to keep the default value if no other MTU va lue is provided by your ISP . Active Mode: Y ou can select the proper Active mode according to your need.  Manual[...]

-24-  PP TP Statu s Statu s: Displays the status of PPTP connection.  “Disabled” indicates that t he PPTP connection type is no t applied.  “Connecting” indicates that t he Router is obtaining the IP parameters from your ISP .  “Connected” indicates that the Router has successfully obtained the IP p arameters from your ISP .[...]

-25- Figure 3-12 W AN – Bigpond The following items are displayed on this screen:  BigPond Settings Connection T ype: Select BigPond if your ISP prov ides a BigPond connection. Click <Connect> to dial-up to the Internet and obtain the IP address. Click <Disconnect> to disconnect the Inte rnet connection and release the current IP a[...]

-26- Auth Mode: Y ou can select the proper Active mode according to your n eed.  Manual: Select this option to manually activate or terminate the Internet connection by the <Connec t> or <Disconn ect> button. It is optimum for the dial-u p connection charged on time.  Always-on: Select this option to keep the connec tion always on[...]

-27- Note: T o ensure the BigPond connection re-established norma lly , please restart the connection at least 5 seconds after the connection is of f. 3.1.4 LAN 3.1.4.1 LAN On this page, you can configure the p a rameters for LAN port of this router . Choose the menu Network → LAN → LAN to load the following p age. Figure 3-13 LAN The following[...]

-28- Figure 3-14 DHCP Settings The following items are displayed on this screen:  DHCP Settings DHCP Server: Enable or disable the DHCP server on your Router . T o enable the Router to assign the TCP/IP paramete rs to the computers in the LAN automatically , please select Enable. St art IP Address: Enter the S tart IP address to define a range f[...]

-29- 3.1 Secondary DNS: Optional. If a Secondary DNS Server address is available, enter it. .4.3 DHCP Client On this page, you can view the information about all the DHCP clients c onnected to the Router . Choose the menu Network → LAN → DHCP Client to load the following page. Figure 3-15 DHCP Client Y ou can view the informati on of the DHCP c[...]

-30- Statu s: Activate or Inactivate the corresponding entry .  List of Reserved Address In this table, you can view the information of the entries and edit them by the Action buttons. The first entry in Figure 3-16 indicates: The IP address 192.168.0.101 is reserved for the computer with the MAC address 00-19 -66-83- 53-CF , and this entry is a[...]

-31-  MAC Address Port: Displays the port type of the Router . Current MAC Address: Displays the current MAC address of the port. MAC Clone: It’s only available for W AN port. Cl ick the <Restore Factory MAC> button to restore the MAC address to the factory default value or click the <Clone Current PC’s MAC> button to clone the M[...]

-32- The following items are displayed on this screen:  St atistics Unicast: Displays the number of normal unica st p acket s received or transmitted on the port. Broadcast: Displays the number of normal broadcast packet s received or transmitted on the port. Pause: Displays the number of flow contro l frames received or transmitted on the port.[...]

-33- Choose the menu Network → Sw itc h → Port Mirror to load the following page. Figure 3-19 Port Mirror The following items are displayed on this screen:  General Enable Port Mirror: Check the box to enable the Port Mirr or function. If unchecked, it will be disabled. Mode: Select the mode for the port mirror function. Options include: [...]

-34- Application Example: T o monitor all the traffic and analyze the network abnormity for an ent erprise’s network, please set the Port Mirror function as below: 1) Check the box before Enable Port Mirror to enable the Port Mirro r function and select the Ingress & Egress mode. 2) Select Port 3 to be the Mirroring Port to monitor all the p [...]

-35- 3.1 Port: Displays the port number . Ingress Limit: S pecify whether to enable t he Ingress Limit feature. Ingress Rate: S pecify the limit rate for the ingress packet s. Egress Limit: S pecify whether to enabl e Egress Limit feature. Egress Rate: S pecify the limit rate for the egress packe ts. The first entry in Figure 3-20 indicates: The In[...]

-36- 3.1.6.5 Port St atus On this page, you can view t he current status of each port. Choose the menu Network → Sw itc h → Port St atus to load the following page. Figure 3-22 Port S t atus 3.1.6.6 Port VLAN A VLAN (Virtual Local Area Network) is a network topology configured accord ing to a logical scheme rather than the physical layout, whic[...]

-37- VLAN: Select the desired VLAN for the port. Tips: The Port VLAN can only be created among the LAN ports. 3.2 Wireless 3.2.1 Wireless Setting 3.2.1.1 Wireless Setting On this page you can configure the basi c parameters of the wireless network. Choose the menu Wi rele ss → Wireless Setting → W ireless Setting to load the following page. Fig[...]

-38- Region: Select your region from the drop-dow n lis t. This field specifies the region where the wireless function of the Ro uter can be used. It may be illegal to use the wireless function of the Router in a region other than one of those specified in this field. If your country or region is not lis ted, please contact your local government ag[...]

-39- SSID: Enter a name for the wireless network. The same name of SSID(Service Set Identification) must be assigned to all wireless device in your network. Considering your wireless network secu rity , the default SSID is set to be TP-LINK _ XXXXXX (XXXXXX indicates the last unique six numbers of each Router ’s MAC address). This value is ca se-[...]

-40- Auth T ype: Choose the Auth type of the WPA-PSK/WPA2-PSK security on the drop-down list. The default setting is Automatic , which can select WP A-PSK (Pre-shared key of WPA) or WP A2-PSK (Pre-shared key of WPA) automatically based on the wire less station's capability and request. Encryption: Select the Encryption type ， including Autom[...]

-41- Encryption: Select the Encryption type. which including Automatic , TKIP , AES . The default setting is Automatic , which can select TKIP (T emporal Key Integrity Protocol) or AES （ Advanced Encryption S tandard ） automatically based on the wireless station's capability and request. TKIP – TKIP is a security protocol us ed in the IE[...]

-42- Key Format: Hexadecimal and ASCII formats are provided . Hexadecimal format stands for any combination of hexadecimal digits (0-9, a-f, A-F) in the specified length. ASCII format stands for any combination of keyboard characters in t he specified length. Key Selected: You can select the key based on need. WEP Key : Select which of the four key[...]

-43- Figure 3- 25 Multi-SSID The following items are displayed on this screen:  General Multi-SSID: Enable or d isable the Multi-SSID. Y ou can establish multiple wireless networks if Multi-SSID is enabled. SSID Insulation: Enable or disable the SSID Insulation. If enabled, the hosts accessing to the different SSID cannot be communicate with eac[...]

-44- Security: Specify the security optio n of the wireless network. If you do not want to use wireless security, select “Disable Security”, otherwise select one Security option from the drop-down list. It’ s strongly recommended to choose one of the security options to enable security. There are three wireless security options supported by t[...]

-45- Encryption: Select the Encryption type, which including Automatic , TKIP , AES . The default setting is Automatic , which can select TKIP (T emporal Key Integrity Protocol) or AES （ Advanced Encryption S tandard ） automatically based on the wireless station's capability and request. TKIP – TKIP is a security protocol us ed in the IE[...]

-46- Encryption: Select the Encryption type. which including Automatic , TKIP , AES . The default setting is Automatic , which can select TKIP (T emporal Key Integrity Protocol) or AES （ Advanced Encryption S tandard ） automatically based on the wireless station's capability and request. TKIP – TKIP is a security protocol us ed in the IE[...]

-47- Key Selected: You can select the key based on need. WEP Key : Select which of the four keys w ill be u sed and enter the matching WEP key that you create. Make sure these values are identical on all wireless stations in your network. Key T ype: You can select the WEP key length (64-bit, or 128-bit, or 152-bit.) for encryption. "Disabled&q[...]

-48- Choose the menu Wi rele ss → Wireless Setting → WDS to load the following page. Figure 3-26 WDS Configuration  General WDS: Enable or disable the WDS function. With this f unction, the Router can bridge two or more WLANs. Scan: Click this button; you can search the AP which runs in the current channel.  Parameter SSID(to be bridged):[...]

-49- Key ： If the AP your Router is going to connect needs p assword, you need to fill the key in this blank. Tips: The Multi-SSID function will be disabled if WDS is enabled. 3.2.1.4 Wireless Advanced On this page, you can configure the wireless advanced parameters. Choose the menu Wi rele ss → Wireless Setting → W ireless Advanced to load t[...]

-50- Beacon Interval: Enter a value between 40-1000 millis econds for Beacon Interval here. The beacons are the packets sent by the router to synchronize a wireless network. Beacon Interval val ue determines the time interval of the beacons. The default value is 100. RTS Threshold: Here you can specify the RTS (Request to Se nd) Threshold. If the p[...]

-51- Figure 3-28 MAC Filtering  General Each SSID can be configured the MAC Address Filt ering rules. Y ou can select a SSID in the SSID drop-down list. T o create a new SSID, please refer to 3.2.1.2 Multi-SSID . T o control some of the host s to access the wi reless network, it is recommended to select “ Enable Wireless MAC Address Filtering [...]

-52- Figure 3-29 Host S tatus  General Select a SSID, the status of t he host in this wireless network will display on the following table.  Host St atus MAC Address: Displays the MAC address of the host wh ich access the Router by wireless connection. SSID: Displays the name of the SSID to which the host connects. Current St atus: Displays t[...]

-53- Figure 3-30 Group Configuration The following items are displayed on this screen:  Group Config Group Name: S pecify a unique name for the group. Description: Give a description for the group. It's optional.  List of Group In this table, you can view the information of the Groups and edit them by the Action buttons. 3.3.2 User On th[...]

-54- Description: Give a description to the user fo r identification. It's optional.  List of User In this table, you can view the information of the Users and edit them by the Action buttons. 3.3.3 Vi ew On this page, you can configur e the User View or Group V iew . Choose the menu User Group → Vi ew to load the following page. Figure 3[...]

-55- 3.4 Group Structure: Click this button to view the tree struct ure of this group. All the members of this group will be displayed, includi ng Users and sub-Groups. The Group Names are displayed in bold. A vailable Member: Displays the Users and the Groups which can be added into this group. Selected Member: Displays the members of this group, [...]

-56- 3.4 NA T -DMZ: Enable or disable NA T -DMZ. NA T DM Z is a special service of NA T application, which can be considered as a default forwardin g rule. When NA T DMZ ( Pseudo DMZ) is enabled, all the data initiated by external network falling short of the current connections or forwarding rules will be forwarded to the preset NA T DMZ host. Hos[...]

-57- Statu s: Activate or inactivate the entry .  List of Rules In this table, you can view the information of the entries and edit them by the Action buttons. The first entry in Figure 3-34 indicates: The IP address of host1 in local network is 192.16 8.0.128 and the W AN IP address after NA T mapping is spec ified to be 222.135.48.128. The dat[...]

-58- The first entry in Figure 3-35 indicates that: This is a Multi-Ne ts NA T entry named tplink1. The subnet under the LAN port of the Router is 192.168.2.0/24 and this ent ry is activated. After the co rresponding S tatic Route entry is set, the hos ts within this subnet can access the Internet through the Router via NA T . Note: ● Multi-Nets [...]

-59- The configured entries are as follows: 2. Then set the corresponding S tatic Route entry , en ter the IP address of t he interface connecting the Router and the three layer swit ch into the Next Hop field. Choose the menu Advanced → Routi ng → S t atic Route to load the following page. The S t atic Route entry is as follows: 3.4.1.4 V irtu[...]

-60- Figure 3-36 Virtual Server The following items are displayed on this screen:  Virtual Server Name: Enter a name for Virtual Server ent ries. Up to 28 characters can be entered. Interface: Select an interface for forwarding data pa ckets. External Port: Enter the service port or port range the Router provided for accessing external network. [...]

-61- 3.4  List of Rules In this table, you can view the information of the entries and edit them by the Action buttons. The first entry in Figure 3-36 indicates: This is a V irtual Serv er entry named host, all the TCP dat a packet s from W AN1 to port 65534-65535 of the Rout er will be redirected to the port 65534-65535 of the LAN host with IP [...]

-62- T rigger Protocol: Select the protocol used for trigger port. Incoming Port: Enter the incoming port number or range of port numbers. The incoming port will open for follow-up connection after the trigger port initiates connection. Incoming Protocol: Select the protocol used for incoming port. Statu s: Activate or inactivate the entry . Note: [...]

-63- 3.4.2.1 Setup  ALG FTP ALG: Enable or disable FTP ALG . The default setting is enabled. It is recommended to keep the def ault setting if no special requirement. H.323 ALG: Enable or disable H.323 ALG . The default setting is enabled. H.323 is used for various applicat ions such as NetMeeting and V oIP . SIP ALG: Enable or disable SIP ALG .[...]

-64- The following items are displayed on this screen:  General Disable Bandwidth Control: Select this option to disable Bandwidth Control. Enable Bandwidth Control all the time: Select this option to enable Bandwidth Control all the time. Enable Bandwidth Control When: With this option selected, the Bandwidth Control will take ef fect when the [...]

-65- 3.4.2.2 Bandwid th Control On this page, you can configure the Bandwid th Control function. Choose the menu Advanced → T raffic Control → Band width Control to loa d the following page. Figure 3-40 Bandwidth Control The following items are displayed on this screen:  Bandwidth Control Rule Direction: Select the dat a stream direction for[...]

-66- Limited Bandwid th (Down): S pecify the L imited Downstream Bandwidth for this entry . Effective Time: S pecify the time for the entry to ta ke ef fect. Description: Give a description for the entry . Statu s: Activate or inactivate the entry .  List of Rules Y ou can view the informati on of the entries and edit t hem by the Action buttons[...]

-67- Figure 3-41 Session Limit The following items are displayed on this screen:  General Enable Session Limit: Check here to enable Session Limit, otherwise all the Session Limit entries will be disabled.  Session Limit Group: Select a group to define the controlled users. Max. Sessions: Enter the max. Sessions for the users. Description: Gi[...]

-68- Figure 3-42 Session List In this table, you can view the session limit inform ation of users configured with Session Limit. Click the <Refresh> button to get the latest information. 3.4.4 Load Balance In this part, you can configure the traf fic sharing mode of the W A N ports to optimize the resource utilization. 3.4.4.1 Configuration C[...]

-69- Figure 3-44 Policy Routing The following items are displayed on this screen:  General Protocol: Select the protocol for the entry in the drop-down list. If the protocol you want to set is not in the lis t, you can add it to the list on 3.4.4.4 Protocol p age. Source IP: Enter the source IP range for the entry . 0.0.0.0 - 0.0.0.0 means any I[...]

-70- 3.4  List of Rules Y ou can view the informati on of the entries and edit t hem by the Action buttons. The first entry in Figure 3-44 indicates: All the packe ts with Source IP between 192.168.0.100 and 192.168.0.199 and Destinat ion IP between 1 16.10.20.28 and 1 16.10.20.29 will be forwarded from W AN1 port, regardless of the port and pro[...]

-71- W AN Config: The W AN port in the secondary WAN list will share the traf fic for the W AN in the primary W AN list under the specified condition. Mode: Y ou can select T iming or Failover Mode. Timing: Link Backup will be enabled if the spec ified effectiv e time is reached. All the traf fic on the primary W AN will switch to the backup W AN a[...]

-72- Figure 3-46 Protocol The following items are displayed on this screen:  Protocol Name: Enter a name to indicate a protocol. The name will display in the drop-down list of Protocol on Access Rule page. Number: Enter the Number of the prot ocol in the range of 0-255.  List of Protocol Y ou can view the informati on of the entries and edit [...]

-73- Figure 3-47 Static Route The following items are displayed on this screen:  St atic Route Destination: Enter the destination hos t the route leads to. Subnet Mask: Enter the Subnet Mask of the destination network. Next Hop: Enter the gateway IP address to which the p acket should be sent next. Interface: Select the physical network interf a[...]

-74- Application Example There is a network topology as the following figure shown: If the LAN port of TL-ER604W （ with Non-NAT or Classic system mode ） is connected to LAN1 with subnet of 192.168.0.0/24, while the LAN por t of another Router R1 is c onnected to LAN2 with network of 192.168.2.0/24. Meanwhile, the W A N ports of the two routers [...]

-75- TL-ER604W supports both RIPv1 vers ion and RIPv2 version, thus you can configure the RIP version based on the actual need to improve the network performance. Choose the menu Advanced → Routi ng → RIP to load the following page. Figure 3-48 RIP The following items are displayed on this screen:  General Interface: Displays the interfaces [...]

-76- data via this port. The IP address of next hop is 116.10.1.254 and the hop count is 1. The effective time of this entry is 1 second. Note: ● RIP function cannot be set if t he Router is in NA T Mode. T o set RIP function, please change the System Mode to Routing or Full Mode. ● The RIP function of W AN port t akes effect s onl y when the C[...]

-77- 3.5 3.5 Firewall 3.5.1 Anti ARP S poofing ARP (Address Resolution Protocol) is used for analyzing and mapping IP addresses to the corresponding MAC addresses so that packet s can be delivered to their destinations correctly . ARP functio ns to translate the IP address into the corresponding MAC address and maintain an ARP T able in which the l[...]

-78- It is recommended to check all the options. Y ou s hould import the IP and MAC address of the host to IP-MAC Binding List and enable the corresponding entr y before enabling “Permit the packet s matching the IP-MAC Binding entries only”. When suffered ARP attack, the correct ARP informat ion will be sent to the device suf fering attack ini[...]

-79- Figure 3-51 ARP Scanning Enter the start and the end IP addresses into the Scanning IP Range field. Then click the <Scan> button, the Router will scan all the active host s with in the scanning range and di splay the result in the list. The entries displayed on the Li st of Scanning Result do not m ean the IP and MAC addresses are alread[...]

-80- Figure 3-52 ARP List The configurations for t he entries is the same as the confi guration of List of Scanning Re sult on 3.5.1.2 ARP Scanning p age. The unbound IP-MAC inform ation will be replaced by new IP-MAC information or be automatically removed from the list if it has not been communica ted with others for a long time. This period is r[...]

-81- Figure 3-53 Attack Defense The following items are displayed on this screen:  General Flood Defense: Flood attack is a commonly used DoS (Denial of Service) att ack, including TCP SYN, UDP , ICMP and so on. It is recommended to select all the Flood Defens e options and specify the corresponding thresholds. Keep the def ault settings if you [...]

-82- 3.5.3 MAC Filtering On this page, you can control the Internet access of local hosts by spec ifying their MAC addresses. Choose the menu Firewall → MAC Filtering → MAC Filtering to load the following page. Figure 3-54 MAC Filtering The following items are displayed on this screen:  General T o control the access to Internet for hosts in[...]

-83- Figure 3-55 URL Filtering The following items are displayed on this screen:  General T o control the access to Internet for host s in your private network, you are recommended to check the box before Enable URL Filtering and select a filtering rule based on the actual situation.  URL Filtering Rule Object: Select the range in which the U[...]

-84- Application Example: Network Requirements: Prevent the local hosts fr om accessing Internet website www .aabbcc.com and downloading the files with suffix of “exe”. Configuration Procedure: Select Keywords mode and type ”exe“ in the field, select URL mode and type “www .aabbcc.com” a s the following figure shows, and then click the [...]

-85- Figure 3-57 Access Rule The following items are displayed on this screen:  Access Rules Policy: Select a policy for the entry:  Block: When this option is selected, the p ackets obeyed the rule will not be permitted to pass through the Router .  Allow: When this option is selected, the packet s obeyed the rule will be allowed to pass [...]

-86- means any IP).  Group: Sele ct a predefined group of users. Y ou can set the group on 3.3.1 Group .  ANY : means for any users. Destination: Select the Destination IP R ange for the entries, including the following two ways:  IP/MASK: Enter an IP address or su bnet mask. ("0.0.0.0/32" means any IP is accept able).  ANY : [...]

-87- services if needed. Choose the menu Firewall → Access Control → Service to loa d the following p age. Figure 3-58 Service The following items are displayed on this screen:  Service Name: Enter a name for the service. T he name should not be more than 28 characters. The name will display in the drop-down list of Protocol on Access Rule p[...]

-88- 3.5 3.5.5 App Control .5.1 Control Rules On this page, you can enable t he Application Rules function. Choose the menu Firewall → App Control → Control Rules to load the following page. Figure 3-59 Application Rules The following items are displayed on this screen:  General Check the box before Enable Application Control to make the App[...]

-89- and Proxy . The default setting is to limit all the applications in the application list except for Basic and Proxy . Effective Time: S pecify the time for the entry to take ef fect. Description: Give a description for the entry . Statu s: Activate or inactiva te the entry .  List of Rules Y ou can view the informati on of the entries and e[...]

-90- cause the private data to be exposed to all the user s on the Internet. The VPN (Virtual Private Network) technology is developed and used to establish the private network through the public network, which can guarantee a secured data exchange. VPN adopts the tunneling technology to establish a private connection between tw o endpoints. It is [...]

-91- Figure 3-62 IKE Policy The following items are displayed on this screen:  IKE Policy Policy Name: S pecify a unique name to the I KE policy for identification and management purposes. The IKE policy can be applied to IPsec policy . Exchange Mode: Select the IKE Exchange Mode in phase 1, and en sure the remote VPN peer uses the same mode. ?[...]

-92- 3.6 Local ID: The local W AN IP will be inputted aut omatically if IP Address type is selected. If Name type is selected, e nter a name for the local device as the ID in IKE negotiation Remote ID T ype: Select the remote ID ty pe for IKE n egotiation. IP Address: uses an IP address as the ID in IKE negotiation. FQDN: uses a name as the ID. Rem[...]

-93- Figure 3-63 IKE Proposal The following items are displayed on this screen:  IKE Proposal Proposal Name: S pecify a unique name to the IKE proposal for identification and management purposes. The IKE proposal can be applied to IPsec proposal. Authentication: Select the authentication algorithm for IKE negotia tion. Options include:  MD5: [...]

-94- 3.6  DH1: 768 bits  DH2: 1024 bits  DH3: 1536 bits  List of IKE Proposal In this table, you can view the information of IKE Proposals and edit them by the action buttons. 3.6.2 IPsec IPsec (IP Security) is a set of services and protocols defined by IETF (Internet Engineering T ask Force) to provide high security for IP p ackets and[...]

-95- Figure 3-64 IPsec Policy The following items are displayed on this screen:  General Y ou can enable/disable IPsec func tion for the Router here.  IPsec Policy Policy Name: S pecify a unique name to the IPsec policy . Up to 28 characters can be entered. Mode: Select the network mode for IP sec policy . Options include:  LAN-to-LAN: Sel[...]

-96- Remote Subnet: S pecify IP address range on your r emote network to identify which PCs on the remote network are covered by this policy . It's formed by IP address and subnet mask. WA N : S pecify the local W AN port for this Policy . The "Remote Gateway" of the remote peer should be set to the IP address of this W AN port. Remo[...]

-97- Statu s: Activate or inactivate the entry .  Manual Mode IPsec Proposal: Select the IPsec Proposal. Only one proposal can be selected on Manual mode. Y ou need to first create the IPsec Proposal. Incoming SPI: S pecify the Incoming SPI (Security Parameter Index) manually . The Incoming SPI here must matc h the Outgoing SPI value at the othe[...]

-98- ESP Encry ption Key-Out: S pecify the outbound ESP Encryption Key manually if ESP protocol is used in the co rresponding IPsec Proposal. The outbound key here must match the inbound ESP encryption key at the other end of the tunnel, and vice versa.  List of IPsec Policy IPsec In this table, you can view the information of IPsec policies and[...]

-99- Security Protocol: Select the security protocol to be used. Options include:  AH: AH (Authentication Header) provides data origin authentication, data integrity and anti-replay services.  ESP: ESP (Encapsula ting Security Payload) provides data encryption in addition to origin aut hentication, data integrity , and anti-replay services. A[...]

-100- 3.6.2.3 IPsec SA This page displays the information of the IPsec SA (Security Association). Choose the menu VPN → IPsec → IPsec SA to load the following page. Figure 3-66 IPsec SA Figure 3-66 displays the connection status of the NO.1 entry in t he List of IPsec policy in Figure 3-64 . As shown in the figure, the Rout er is using W AN2 fo[...]

-101- 3.6.3.1 L2TP/PPTP T unnel On this page, you can conf igure the L2TP/PPTP VPN. Choose the menu VPN → L2TP/PPTP → L2TP/PPTP T unnel to load the following page. Figure 3-67 L2TP/PPTP T unnel The following items are displayed on this screen:  General Enable VPN-to-Internet: S pecify whether to enable VPN-to-In ternet function. If enabled, [...]

-102- Account Name: Enter the account nam e of L2TP/PPTP tunnel. It should be configured identically on server and client. Password: Enter the password of L2TP/PPT P tunnel. It should be configured identically on server and client. T unnel: Select the network mode for the tunnel. Options include:  LAN-to-LAN: Select this option w hen the L2TP/PP[...]

-103- 3.6 Statu s Activate or inactivate the entry .  List of Configurations In this table, you can view your configurations of the tunnels and edit them by the action buttons. The No.1 entry in Figure 3-67 indicates: this tunnel is encapsula ted by using L2TP . It s user name is test, the password can be configur ed, and the Router is configure[...]

-104- Figure 3-69 List of L2TP/PPTP T unnel Figure 3-69 displays the connection st atus of the NO.1 entry in the list of tunnel in Figure 3-68 . This tunnel has been successfully established. Each tunnel has a T unnel ID and a Session ID. The ID value in client corresponds to that in se rver . The connection information of this tunnel in the server[...]

-105- Figure 3-70 General The following items are displayed on this screen:  General PPPoE Server: S pecify whether to enable t he PPPoE Server function. Dial-up Access Only: S pecify whether to enabl e the Dial-up Access Only func tion. If enabled, only the Dial-in Users and the user with Excepti onal IP can access the Internet. PPPoE User Isol[...]

-106- 3.7 Authentication: Select the Authentication type. It can be Local authentication and Remote authentication. Select Loc al authentication for authentication in PPPoE server and select Remo te authentication for authentication in the remote server . Auth Protocol: Select at least one authent ication protocol for Loc al Authentication.  P A[...]

-107- 3.7.1.3 Account IP Address Range: S pecify the start and the end IP address for IP Pool. The start IP address should not exceed the end address and the IP address ranges must not overlap.  List of IP Po ol In this table, you can view the information of IP Address Pools and edit them by the Action buttons. On this page, you can c onfigure t[...]

-108- 3.7 IP Address Pool: It's available on Dynamic mode. Select an IP Address Pool to make a range to assign dynamic IPs. Max Sessions: S pecify the maximum number of se ssions for the client. The default value is 1. Expiration Date: S pecify the Expiration Date of t he acco unt. The default is 2099-1-1. Description: Enter the description fo[...]

-109- Figure 3-73 Exceptional IP The following items are displayed on this screen:  Exceptional IP IP Address Range: S pecify the start and the end IP address to make an exceptional IP address range. This range should be in the same IP range with LAN port of the Router . The start IP address should not exceed the end address and the IP address r[...]

-1 10- Choose the menu Services → E-Bulletin to load the following page. Figure 3-75 E-Bulletin The following items are displayed on this screen:  General Enable E-Bulletin: S pecify whether to enabl e el ectronic bulletin function. Interval: S pecify the interval to release the bulletin. Enable Logs: S pecify whether to log the E-Bulletin. ?[...]

- 111 - Object: Select the object of this bulletin. Options include:  ANY: The bulletin will be released to all the users and the PCs on the LAN.  Group: The bulletin will be released to the users in the selected group. You can click < > button to add a group to the selected group and click < > to remove a group from the selected [...]

-1 12- 3.7.3.1 DynDNS if the IP address of the DDNS cli ent has changed. DDNS is usually us ed for the Internet users to access the private website and FTP server , both of which are established based on W eb server . The Router , as a DDNS client, cannot provide DDN S service. Prior to using this function, be sure you have registered on the offici[...]

-1 13- 3.7.3.2 No-IP W AN Port: Displays the W AN port for which Dyndns DDNS is selected. DDNS St atus: Dis plays the current status of DDNS service  Offline: DDNS service is disabled.  Connecting: client is connecting to the server.  Online: DDNS works normally.  Authorization fails: The Account Name or Password is incorrect. Please ch[...]

-1 14- 3.7 DDNS Service: Activate or inactivate DDNS service here. W AN Port: Displays the W AN port for which No-IP DDNS is selected. DDNS St atus: Dis plays the current status of DDNS service  Offline: DDNS service is disabled.  Connecting: client is connecting to the server.  Online: DDNS works normally.  Authorization fails: The Acc[...]

-1 15- 3.7.3.4 Comexe Password: Enter the password of your DDNS account. DDNS Service: Activate or inactivate DDNS service here. W AN Port: Displays the W AN port for whic h PeanutHull DDNS is selected. Service T ype: Displays the DDNS service type, including Professional service and S tandard service. DDNS St atus: Dis plays the current status of [...]

-1 16-  Comexe DDNS Account Name: Enter the Account Name of y our DDNS account. If you have no t registered, click <Go to register> to go to the website of Comexe for register . Password: Enter the password of your DDNS account. DDNS Service: Activate or inactivate DDNS service here. W AN Port: Displays the W AN port for which Comexe DDNS [...]

-1 17- Figure 3-80 UPnP The following items are displayed on this screen:  General UPnP Funct ion: Enable or disable the UPnP function globally .  List of UPnP Mappin g After UPnP is enabled, all UPnP connection rules will be displayed in the list of UPnP Mapping. Up to 64 UPnP service connections are supported in TL-ER604W. The NO.1 entry in[...]

-1 18- Figure 3-81 Administrator The following items are displayed on this screen:  Administrator Current User Name: Enter the current user name of the Router . Current Password: Enter the current p assword of the Router . New User Name: Enter a new user name for the Router . New Password: Enter a new password for the Router . Confirm New Pass w[...]

-1 19- The following items are displayed on this screen:  General Web Management Port: Enter the Web Management Port for the Router . T elnet Management Port: Enter the T elnet Management Port for the Router . Web Idle T imeout: Enter a timeout period that the Router will log you out of the Web-based Utility af ter a specified period (W eb Idle [...]

-120- Subnet/Mask: S pecify a single IP address or network address for the hosts d esired to access the Router from external network. Statu s: Activate or inactiva te the entry .  List of Subnet In this list, you can view the Remote Management entries and edit them by the Action buttons. The first entry in Figure 3-83 indicates that: The hosts w[...]

-121- 3.8.2.2 Click the <Restore to Factory Defaults> button to rese t all configuration settings to their default values. The default IP address is 192.168. 0.1; the default login user nam e and p assword are both admin. Export and Import Choose the menu Maintenance → Management → Export and Import to load the following page. Figure 3-85[...]

-122- Figure 3-86 Reboot Click the <Reboot> button to reboot the Router . The configuration will not be lost after rebooting. The Internet connection will be temporarily interrupted while rebooting. Note: T o avoid damage, please don't turn off the device while rebooting. 3.8.2.4 Firmware Upgrade Choose the menu Maintenance → Managemen[...]

-123- Figure 3-88 License 3.8.4 S t atistics 3.8.4.1 Interface T raffic St atistics Interface T raf fic S tatistics screen displays the det ailed traf fic information of each port and extra information of W AN ports. Choose the menu Maintenance → St atistics → Interface T raffic Statistics to load the following p age. Figure 3-89 Interface T ra[...]

-124- 3.8 Packets Rx: Displays the number of p acket s received on the interface. Packets Tx: Displays the number of packets transmitted on the interface. Bytes Rx: Displays the bytes of packet s received on the interface. Bytes Tx: Displays the bytes of packet s transmitted on the interface.  Advanced W AN Information Interface: Displays the in[...]

-125-  T raffic St atistics Direction: Select the direction in the drop-dow n list to get the Flow S tatistics o f the specified direction.  IP T raffic St atistics This table displays the det ailed traf fic information of corresponding PCs. Sorted by: Select the rule for displayi ng the traf fic information. 3.8.5 Diagnostics 3.8.5.1 Diagnos[...]

-126- 3.8  Ping Destination IP/Domain: Enter destination IP address or Domain name here. Then select a port for testing, if you select “Auto”, the Router will select the interface of destination automatically . Af ter clicking <S tart> button, the Router will send Ping packet s to test the network connectivity and reachability of the h[...]

-127- dial-up status. Mode: Detect automatically or Manually . In Auto mode, gateway will be selected as destination for PING detection, DNS server of W AN port will be selected as destinati on for DNS Lookup. In Manual Mode, you can conf igure the destinati on for PING and DNS Lookup manually . Ping: Enter the destination IP for Pi ng in Manual mo[...]

-128-  Current Time Syst em T ime : Displays the current date and time of the Router . Time Zone: Displays the current time zone of the Router . Statu s: Displays the status of time capturing  Config Get GMT : When this option is selected, you can configure the time zone and the IP Address for the NTP Server . The Router will get GMT automati[...]

-129- Figure 3-94 Logs  List of Logs List of Logs displays the system l og information in log buf fer . An entry of log contains the following four part s:  Config Enable Auto-refresh: With this option selected, the page will refresh automatically every 5 seconds. Severity: Displays the severity level of the log information. Y ou can select a[...]

-130- Chapter 4 Application 4.1 Network Requirement s The company has established the server farms in the headquarters to provide the Web, Mail and FTP services for all the staf f in the headquarters an d the branch offices, and to transmit the commercial confidential data to it s p artners. The dedicated line access service wa s used by this comp [...]

-131- 4.2 Network T opology 4.3 Configurations Y ou can configure the Router via th e PC connected to the LAN port of this Router . T o log in to the Router , the IP address of your PC should be in the same subnet of the LAN por t of this Router . (The default subnet of LAN port is 192.168.0.0/24.). The IP ad dress of your PC can be obtained automa[...]

-132- Figure 4-1 System Mode 4.3.1.2 Internet Connection Configure the St atic IP connection type for the W A N1 and W AN2 ports of the Router . Choose the menu Netw ork → WA N → WA N 1 to load the following page. Select the St atic IP connection type and enter the IP address , Subnet Mask and Default Gateway provided by your ISP . Set both the[...]

-133- Figure 4-3 Link Backup 4.3.2 VPN Setting T o enable the hosts in the remote branch of fice (W AN: 1 16.31.85.133, LAN: 172.31.10.1) to access the servers in the headquarters, you can create the VPN tunnel via the TP-LINK VPN routers between t he headquarters and the remote branch office to guar antee a secured communication. The following tak[...]

-134- Click the <Add> button to apply . Figure 4-4 IKE Proposal  IKE Policy Choose the menu VPN → IKE → IKE Policy to load the configuration p age. Settings: Policy Name: IKE_1 Exchange Mode: Main IKE Proposal: proposal_I KE_1 (you just created) Pre-shared Key: aabbccddee SA Lifetime: 3600 DPD: Enable DPD Interval: 10 Click the <Add[...]

-135- Figure 4-5 IKE Policy Tips: For the VPN Router in the remote branch office, t he IKE settings should be the same as the Router in the headquarters. 2) IPsec Setting T o configure the IPsec function, you sh ould create an IPsec Proposal firstly .  IPsec Proposal Choose the menu VPN → IPsec → IPsec Proposal to load the following page. Se[...]

-136- Figure 4-6 IPsec Proposal  IPsec Policy Choose the menu VPN → IPsec → IPsec Policy to load the configuration p age. Settings: IPsec: Enable Policy Name: IPsec_1 S tatus: Activate Mode LAN-to-LAN Local Subnet: 192.168.0.0/24 Remote Subnet: 172.31.10.0/24 WA N : WA N1 Remote Gateway: 1 16.31.85.133 Exchange Mode IKE IKE Policy: IKE_1 IPs[...]

-137- Figure 4-7 IPsec Policy Tips: For the VPN Router in the remote branch office, the IPsec settings should be consistent with the Router in the headquarters. The Remote Gateway of the remote Router should be set to the IP address of the Router in the headquarters. After the IPsec VPN tunnel of the two peers is est ablished successfully , y ou ca[...]

-138-  L2TP/PPTP T unnel Choose the menu VPN → L2TP/PPTP → L2TP/PPTP T unnel to load the following page. Check the box of Enable VPN-to-Internet to allow the PPTP clients to access the local enterprise network and the Internet. Then continue with the following settings for the PPTP T unnel. Settings: L2TP/PPTP: Enable Protocol: PPTP Mode: Se[...]

-139- 4.3.3 Network Management T o manage the enterprise network effectively and forbid the Hosts within the IP range of 192.168.0.30-192.168.0.50 to use IM/P2P application, you can set up a User Group and specify the network bandwidth limit and session limit for this group. The det ailed configur ations are as follows. 4.3.3.1 User Group Create a [...]

-140- Action: Add S tart IP Address: 192.168.0.30 End IP Address: 192.168.0.50 Prefix Username: User S tart No.: 1 S tep: 1 Click the OK button to add the Users in bulk. Figure 4-10 User Config - Batch  View Choose the menu User Group → Vie w to load the configuration page. Add all the Users you just created into the Group 1 and click the <[...]

-141- Figure 4-1 1 App Rules 4.3.3.3 Bandwid th Control T o enable Bandwidth Control, you s hould configure the total bandwid th of interfaces and the detailed bandwidth control rule first. 1) Enable Bandwid th Control Choose the menu Advanced → T raffic Control → Setup to load the configuration page. Check the box before Enable Bandwidt h Cont[...]

-142- 3) Bandwidth Control Rule Choose the menu Advanced → T raffic Control → Bandwid th Control to load the configuration p age. Then continue with the following settings: Settings: Direction: LAN -> W AN1 Group: group1 Mode: Individual Guaranteed Bandwidth (Up/Down): 100 Limited Bandwidth (Up/Down): 800 Effective T ime: Keep the default va[...]

-143- Figure 4-15 Session Limit 4.3.4 Network Security Y ou can enable the IP-MAC Binding f unction to defend the ARP attack fr om local or public network and enable Sending GARP packet s function to defend ARP attack. Moreover , you can enable DoS Defense function to implement fl ood defense and Packet Anomaly Def ense. Moreover , you can ena ble [...]

-144- Choose the menu Firewall → Anti ARP S poofing → IP-MAC Binding to load the configuration p age. Select the ARP entries needed to be bound or c lick the <Select All> button, and then click the <Import>button. The ARP List will di splay as the following figure shows. Figure 4-18 ARP List 2) Set IP-MAC Binding Entry Manually Conf[...]

-145- Choose the menu Firewall → Anti ARP Spoofin g → ARP Scanning to lo ad the configuration page. Enter the default gateway of the W AN port such as 58.51.128.254 in t he Scanning Range field and click the <Scan> button, the MAC address of the W A N port will display in the Scanning Result table. After obt aining the MAC address of W AN[...]

-146- 4.3.4.4 T raffic Monitoring 1) Port Mirror Choose the menu Network → Sw itch → Port Mirror to load the configuration page. Check the bo x before Enable Port Mirror and select the Ingress&Egress mode. Select the Port 5 for the Mirroring Port and the Port 3 and the Port 4 for the Mirrored ports. Click the <Save> button to apply . [...]

-147- Figure 4-23 IP T raf fic S tatistics After all the above step s, the enterpris e network will be operated based on planning.[...]

-148- Appendix A Hardware Specifications General S tandards IEEE 802.3, IEEE 802.3u, IEEE 802. 3ab, IEEE 802.3x, IEEE 802.1 1b, IEEE 802.1 1g and IEEE 802.1 1n, TCP/ IP , DHCP , ICMP , NA T , PPPoE, SNTP , HTTP , DNS, L2TP , PPTP , IPsec One fixed 10/100/1000Mbps Auto -Negotiation W AN RJ45 port (Auto MDI/MDIX) One interchangeable 10/100/1000Mbp s [...]

-149- Appendix B F AQ Q1. What can I do if I cannot access the web-based configuration page? 1. For the first login, pl ease try the following steps: 1) Make sure the cable is well connected to t he LAN port of the Router . The corresponding LED should flash or be solid light. 2) Make sure the IP address of your PC is set in the same subnet address[...]

-150- Q3: What can I do if the Router with the re mote management function enabled cannot be accessed by the remote computer? 1. Make sure that the IP address of the remote com puter is in the subnet allowed to remotely access the router . 2. If the router ’s management por t has been modified, please log in to the Router with the new address, su[...]

-151- Appendix C Glossary Glossary Description ALG （ Application Layer Gateway ） Application Level Gateway (A LG) is application specifi c translation agent that allows an application on a host in one address realm to connect to its counterpart running on a host in different realm transparently . ARP （ Address Resolution Protocol ） Internet[...]

-152- Glossary Description H.323 H.323 allows dissimilar communica tion devices to communicate with each other by using a standardized communication protocol. H.323 defines a comm on set of CODECs, call setup and negotiating procedures, and basic data transport methods. H HTTP （ Hypertext Transfer Protocol ） The protocol used by Web browsers an[...]

-153- Glossary Description MAC address （ Media Access Control address ） S tandardized data link layer address that is required for every port or device that connects to a LAN. Other devices in th e network use these addresses to lo cate specific ports in the network and to create and update routing tables and data structures. MAC addresses are [...]

-154- Glossary Description Network protocol ） log in to remote systems and us e resources as if they were connected to a local system. UDP （ User Datagram Protocol ） UDP is a simple protocol that exchanges datagram without acknowledgments or guaranteed del ivery, requiri ng that error processing and retransmission be handled by other protocol[...]