Page 3: Table Of Contents
Table of Contents CHAPTER 1 INTRODUCTION ..................... 1 Broadband VPN Gateway Features ................1 Package Contents ......................3 Physical Details ........................4 CHAPTER 2 INSTALLATION ....................6 Requirements ........................6 Procedure ........................... 6 CHAPTER 3 SETUP ........................ 8 Overview ..........................8 Configuration Program ....................
Page 4 VPN Examples ......................... 81 Certificates ........................99 CRL ..........................103 VPN Status ........................104 Add Certificate ..............Error! Bookmark not defined. Get Certificate ID ..............Error! Bookmark not defined. CHAPTER 9 MICROSOFT VPN ..................105 Overview ........................105 Server Setup ........................105 User ..........................
Page 5: Chapter 1 Introduction
Chapter 1 Introduction This Chapter provides an overview of the Broadband VPN Gateway's features and capabilities. Congratulations on the purchase of your new Broadband VPN Gateway. The Broadband VPN Gateway is a multi-function device providing the following services: • Shared Broadband Internet Access for all LAN users.
Page 6: Lan Features
Broadband VPN Gateway User Guide • Virtual Servers. This feature allows Internet users to access Internet servers on your LAN. The required setup is quick and easy. • Multi-DMZ. For each WAN (Internet) IP address allocated to you, one (1) PC on your local LAN can be configured to allow unrestricted 2-way communication with Servers or individual users on the Internet.
Page 7: Package Contents
Introduction Security Features • Password - protected Configuration . Optional password protection is provided to prevent unauthorized users from modifying the configuration data and settings. • NAT Protection. An intrinsic side effect of NAT (Network Address Translation) technology is that by allowing all LAN users to share a single IP address, the location and even the existence of each PC is hidden.
Page 8: Physical Details
Broadband VPN Gateway User Guide Physical Details Front-mounted LEDs Figure 2: Front Panel Power On - Power on. Off - No power. Status (Red) On - Error condition. Off - Normal operation. Blinking - This LED blinks during start up. WAN ports Connect the DSL or Cable Modem here.
Page 9: Rear Panel
Introduction Rear Panel Figure 3: Rear Panel Connect the DSL or Cable Modem here. If your modem came with a WAN port 1/2 cable, use the supplied cable. Otherwise, use a standard LAN cable. (10/100BaseT) Use standard LAN cables (RJ45 connectors) to connect your PCs to 10/100BaseT LAN connections these ports.
Page 10: Chapter 2 Installation
Chapter 2 Installation This Chapter covers the physical installation of the Broadband VPN Gateway. Requirements • Network cables. Use standard 10/100BaseT network (UTP) cables with RJ45 connectors. • TCP/IP protocol must be installed on all PCs. • For Internet Access, an Internet Access account with an ISP, and a Broadband modem (usually, DSL or Cable modem). Procedure Figure 4: Installation Diagram 1.
Page 11 Installation 5. Check the LEDs • The Power LED should be ON. • The Status LED should blink during start up, then turn Off. If it stays on, there is a hardware error. • For each LAN (PC) connection, the LAN Link/Act LED should be ON (provided the PC is also ON.) •...
Page 12: Chapter 3 Setup
Chapter 3 Setup This Chapter provides Setup details of the Broadband VPN Gateway. Overview This chapter describes the setup procedure for: • Internet Access • LAN configuration PCs on your local LAN may also require configuration. For details, see Chapter 4 - PC Configuration. Other configuration may also be required, depending on which features and functions of the Broadband VPN Gateway you wish to use.
Page 13: Configuration Program
Setup Use the Microsoft VPN feature: Chapter 9: Microsoft VPN • PPTP Server in the Broadband VPN Gateway. • User and Client setup. • Checking VPN connection Status. Configure or use any of the following: Chapter 9: • Other Features and Settings Configuration File backup and restore.
Page 14 Broadband VPN Gateway User Guide 3. In the Address box, enter "HTTP://" and the IP Address of the Broadband VPN Gateway, as in this example, which uses the Broadband VPN Gateway 's default IP Address: HTTP://192.168.0.1 If you can't connect If the Broadband VPN Gateway does not respond, check the following: •...
Page 15: Home Screen
Setup Home Screen After logging, you will see the Home screen. When you connect in future, you will see this screen when you connect. An example screen is shown below. Figure 6: Home Screen Navigation & Data Input • Use the menu bar on the left of the screen, and the "Back" button on your Browser, for navigation. •...
Page 16: Wan Port Configuration
Broadband VPN Gateway User Guide WAN Port Configuration The WAN Port option is on the Setup menu. Figure 7: WAN Port Screen Data - WAN Port Screen WAN Port Settings Normally, this can be left at "Automatic". If the device attached to Connections the WAN Port has problems making a connection, you can select the setting required or preferred by the other device.
Page 17 Setup The address of the router or gateway, as supplied by your ISP. Gateway PPPoE Dial-up User Name The User Name (or account name) provided by your ISP. Password Enter the password for the login name above. Normally, there is no need to change the default name, but if your Hostname ISP requests that you use a particular Hostname, enter it here.
Page 18: Port Options Screen
Broadband VPN Gateway User Guide Port Options Screen Use the Port Options link on the Setup menu. An example screen is shown below. Figure 8: Port Options Screen Data - Port Options Screen Port Options Symmetric NAT If Enabled, all requests from the same internal IP address and port to a specific destination IP address and port are mapped to a unique external source IP address and port.
Page 19 Setup • MTU (Maximum Transmission Unit) value should only be MTU Size changed if advised to do so by Technical Support. • Enter a value between 1 and 1500. • This device will still auto-negotiate with the remote server, to set the MTU size.
Page 20: Lan Port Screen
Broadband VPN Gateway User Guide LAN Port Screen Use the LAN Port link on the main menu to reach the LAN Port screen. An example screen is shown below. Figure 9: LAN Port Screen Data - LAN Port Screen LAN IP Address IP address for the Broadband VPN Gateway, as seen from the local LAN.
Page 21 Setup DHCP What DHCP Does A DHCP (Dynamic Host Configuration Protocol) Server allocates a valid IP address to a DHCP Client (PC or device) upon request. • The client request is made when the client device starts up (boots). • The DHCP Server provides the Gateway and DNS addresses to the client, as well as allocating an IP Address.
Page 22: Load/Backup Screen
Broadband VPN Gateway User Guide Load/Backup Screen Use the Load/Backup link on the Setup menu. An example screen is shown below. Figure 10: Load/Back Screen Data - Load/Backup Screen Administration There are 3 modes: 1. If Enable is selected for WAN 1, then choose Backup for WAN 2. 2.
Page 23 Setup...
Page 24: Chapter 4 Pc Configuration
Chapter 4 PC Configuration This Chapter details the PC Configuration required on the local ("Internal") LAN. Overview For each PC, the following may need to be configured: • TCP/IP network settings • Internet Access configuration Windows Clients This section describes how to configure Windows clients for Internet access via the Broadband VPN Gateway. The first step is to check the PC's TCP/IP settings.
Page 25 PC Configuration Checking TCP/IP Settings - Windows 9x/ME: 1. Select Control Panel - Network. You should see a screen like the following: Figure 11: Network Configuration 2. Select the TCP/IP protocol for your network card. 3. Click on the Properties button. You should then see a screen like the following. Figure 12: IP Address (Win 95) Ensure your TCP/IP settings are correct, as follows: Using DHCP...
Page 26 Broadband VPN Gateway User Guide Figure 13: Gateway Tab (Win 95/98) • On the DNS Configuration tab, ensure Enable DNS is selected. If the DNS Server Search Order list is empty, enter the DNS address provided by your ISP in the fields beside the Add button, then click Add. Figure 14: DNS Tab (Win 95/98)
Page 27 PC Configuration Checking TCP/IP Settings - Windows NT4.0 1. Select Control Panel - Network, and, on the Protocols tab, select the TCP/IP protocol, as shown below. Figure 15: Windows NT4.0 - TCP/IP 2. Click the Properties button to see a screen like the one below. Figure 16: Windows NT4.0 - IP Address 3.
Page 28 Broadband VPN Gateway User Guide Obtain an IP address from a DHCP Server This is the default Windows setting. Using this is recommended. By default, the Broadband VPN Gateway will act as a DHCP Server. Restart your PC to ensure it obtains an IP Address from the Broadband VPN Gateway. Specify an IP Address If your PC is already configured, check with your network administrator before making the following changes.
Page 29 PC Configuration Figure 18: Windows NT4.0 - DNS...
Page 30 Broadband VPN Gateway User Guide Checking TCP/IP Settings - Windows 2000: 1. Select Control Panel - Network and Dial-up Connection. 2. Right - click the Local Area Connection icon and select Properties. You should see a screen like the following: Figure 19: Network Configuration (Win 2000) 3.
Page 31 PC Configuration Using DHCP To use DHCP, select the radio button Obtain an IP Address automatically. This is the default Windows setting. Using this is recom- mended. By default, the Broadband VPN Gateway will act as a DHCP Server. Restart your PC to ensure it obtains an IP Address from the Broadband VPN Gateway. Using a fixed IP Address ("Use the following IP Address") If your PC is already configured, check with your network administrator before making the following changes.
Page 32 Broadband VPN Gateway User Guide Checking TCP/IP Settings - Windows XP 1. Select Control Panel - Network Connection. 2. Right click the Local Area Connection and choose Properties. You should see a screen like the following: Figure 21: Network Configuration (Windows XP) 3.
Page 33 PC Configuration Figure 22: TCP/IP Properties (Windows XP) 5. Ensure your TCP/IP settings are correct. Using DHCP To use DHCP, select the radio button Obtain an IP Address automatically. This is the default Windows setting. Using this is recom- mended. By default, the Broadband VPN Gateway will act as a DHCP Server. Restart your PC to ensure it obtains an IP Address from the Broadband VPN Gateway.
Page 34 Broadband VPN Gateway User Guide Checking TCP/IP Settings - Windows Vista From the Start menu, right-click Network, then click Properties. Now, the Network and Sharing Center displays. Under Tasks located on the left-hand side of the window, click Manage network connections. In Network Connections window displays, right click on the correct Local Area Connection, then click Properties.
Page 35 PC Configuration...
Page 36: Internet Access
Broadband VPN Gateway User Guide Internet Access To configure your PCs to use the Broadband VPN Gateway for Internet access: • Ensure that the DSL modem, Cable modem, or other permanent connection is functional. • Use the following procedure to configure your Browser to access the Internet via the LAN, rather than by a Dial-up connection. For Windows 9x/ME/2000 1.
Page 37: Macintosh Clients
PC Configuration Macintosh Clients From your Macintosh, you can access the Internet via the Broadband VPN Gateway. The procedure is as follows. 1. Open the TCP/IP Control Panel. 2. Select Ethernet from the Connect via pop-up menu. 3. Select Using DHCP Server from the Configure pop-up menu. The DHCP Client ID field can be left blank. 4.
Page 38: Chapter 5 Operation And Status
Chapter 5 Operation and Status This Chapter details the operation of the Broadband VPN Gateway and the status screens. Operation Once both the Broadband VPN Gateway and the PCs are configured, operation is automatic. However, there are some situations where additional Internet configuration may be required: •...
Page 39 Operation and Status Figure 23: General Status Screen...
Page 40 Broadband VPN Gateway User Guide Data - General Status Screen WAN1/2 Connection Method This indicates the current connection method. IP Address This IP Address is allocated by the ISP (Internet Service Provid- er). Subnet Mask The Subnet Mask associated with the IP Address above. Gateway The IP Address of the remote Gateway or Router associated with the IP Address above.
Page 41: Port Status
Operation and Status Display the usage of the CPU and Memory in a sub-window. Show Status Port Status Click the "Port Status" button on the Status Log menu. An example screen is shown below. Figure 24: Port Status Screen Data - Port Status Screen Port Status The picture shows the current network flow.
Page 42: Event Log
Broadband VPN Gateway User Guide Event Log An example screen is shown below. Figure 25: Event Log Screen Data - Event Log Screen Event Log It displays the time when the event occurred. Time Event It describes the details of the event. Host It displays the IP Address of the server.
Page 43: Url Log
Operation and Status URL Log An example screen is shown below. Figure 26: URL Log Data - URL Log Internet Time It displays the time when the log occurred. It describes the address of the URL. Event It displays the IP Address of the PC. Buttons Refresh Update the data shown on screen.
Page 44: System Log
Broadband VPN Gateway User Guide System Log An example screen is shown below. Figure 27: System Log Data - System Log Screen System Log Select the desired options of search type. Click the “Search” button Search Type to see the logs in the following log table. Time It displays the time when the system log occurred.
Page 45: Chapter 6 Internet Features
Chapter 6 Internet Features This Chapter explains when and how to use the Broadband VPN Gateway's "Internet" Features. Overview The following advanced features are provided. • Address List • PC Database • URL Filter • Dynamic DNS • Static Routing •...
Page 46: Address List
Broadband VPN Gateway User Guide Address List Click the "Address List" on the Advanced menu to access the screen. An example screen is shown below. Figure 28: Address List Screen Data - Address List Screen Address List Address List This lists any existing entries. If you have not entered any values, this list will be empty.
Page 47: Pc Database
Internet Features PC Database The PC Database is used whenever you need to select a PC (e.g. for the "DMZ" PC). It eliminates the need to enter IP addresses. Also, you do not need to use fixed IP addresses on your LAN. PC Database Screen An example PC Database screen is shown below.
Page 48 Broadband VPN Gateway User Guide Data - PC Database Screen This lists all current entries. Data displayed is PC Name, MAC Ad- PC List dress, IP Address and Certify. Buttons Edit To Edit or modify an existing entry, select it and click the "Edit" button.
Page 49: Url Filter
Internet Features URL Filter The URL Filter allows you to block access to undesirable Web site. An example screen is shown below. Figure 30: URL Filter Screen Data - URL Filter Screen Filter Strings Current Entries This lists any existing entries. If you have not entered any values, this list will be empty.
Page 50 Broadband VPN Gateway User Guide Add Key Words To add an entry to the list, enter it here, and click the "Add" button. An entry may be a Domain name (e.g. www.trash.com) or simply a string. (e.g. ads/ ) Any URL which contains ANY entry ANYWHERE in the URL will be blocked.
Page 51: Dynamic Dns
Internet Features Dynamic DNS This free service is very useful when combined with the Virtual Server feature. It allows Internet users to connect to your Virtual Servers using a URL, rather than an IP Address. This also solves the problem of having a dynamic IP address. With a dynamic IP address, your IP address may change whenever you connect, which makes it difficult to connect to you.
Page 52 Broadband VPN Gateway User Guide Data - Dynamic DNS Screen WAN1/2 DDNS Service Select the desired DDNS Service provider. Web Site Button Click this button to open a new window and connect to the Web site for the selected DDNS service provider. •...
Page 53: Static Routing
Internet Features Static Routing Overview • If you don't have other Routers or Gateways on your LAN, you can ignore the "Routing" page completely. • If the Broadband VPN Gateway is only acting as a Gateway for the local LAN segment, ignore the "Routing" page even if your LAN has other Routers.
Page 54 Broadband VPN Gateway User Guide Figure 32: Static Routing Screen Data - Static Routing Screen RIP Version Select the desired option from the drop-down list. Static Routing This list shows all entries in the Routing Table. Static Routing Table Entries •...
Page 55: Configuring Other Routers On Your Lan
Internet Features Buttons Save Save the RIP setting. This has no effect on the Static Routing Table. Add Route Add a new entry to the Static Routing table, using the data shown in the "Properties" area on screen. The entry selected in the list is ignored, and has no effect.
Page 56 Broadband VPN Gateway User Guide Static Routing - Example Figure 33: Routing Example For the Broadband VPN Gateway 's Routing Table For the LAN shown above, with 2 routers and 3 LAN segments, the Broadband VPN Gateway requires 2 entries as follows. Entry 1 (Segment 1) Destination IP Address 192.168.1.0...
Page 57 Internet Features Network Mask 0.0.0.0 Gateway IP Address 192.168.1.80 (Broadband VPN Gateway 's local router) Interface...
Page 58: Qos
Broadband VPN Gateway User Guide Quality of Service (QoS) ensures better service to high-priority service. Figure 34: QoS Screen Data - QoS Screen QoS Setting Select the desired option. QoS Method • Disabled • Based on data packet type...
Page 59 Internet Features • QoS Queue: It displays the queue type. • Priority: Enter the priority value (1~20) of the policy. • Reliability: Select the desired option from the drop-down list. • Speed Limit: Enter the desired values for the inbound and outbound traffic limitation.
Page 60: Chapter 7 Security Configuration
Chapter 7 Security Configuration This Chapter explains the settings available via the security configuration section of the "Security" menu. Overview The following advanced configurations are provided. • Rules • Schedules • Log Setting • Services • Security • • E-Mail Rules For normal operation and LAN protection, it is not necessary to use this screen.
Page 61 Security Configuration Data - Rules Screen Outbound/Inbound Connection View Rules for.. Select the desired option; the screen will update and list any current rules. If you have not defined any rules, the list will be empty. For each rule, the following data is shown: Data •...
Page 62 Broadband VPN Gateway User Guide Define Firewall Rule (Inbound/Outbound) Clicking the "Add" button in the Firewall Rules screen will display a screen like the example below. Figure 36: Define Firewall Rule Data - Define Firewall Rule Screen Name Enter a suitable name for this rule. Port Select the desired port as required.
Page 63 Security Configuration These settings determine which traffic, based on their destination Dest IP IP address, is covered by this rule. Select the desired option: • Any - All traffic from the source port is covered by this rule. • Single address - Enter the required IP address in the "Start IP address"...
Page 64: Schedules
Broadband VPN Gateway User Guide Schedules • Blocking will be performed during the scheduled time (between the "Begin" and "End" times.) • Two (2) separate sessions or periods can be defined. • Times must be entered using a 24 hr clock. •...
Page 65: Firewall -- Log
Security Configuration Firewall -- Log The Logs record various types of activity on the Broadband VPN Gateway. This data is useful for troubleshooting, but enabling all logs will generate a large amount of data and adversely affect performance. Since only a limited amount of log data can be stored in the Broadband VPN Gateway, log data can also be E-mailed to your PC or sent to a Syslog Server.
Page 66 Broadband VPN Gateway User Guide This is optional. Second Server Name/IP Address System Log Enable System Log If enabled, log data will be sent to your system log Server. System Log Server Enter the IP address of your System Log Server. Select the logs you wish to be included in the data sent to the Include System Log Server.
Page 67: Services
Security Configuration Services Services are used in defining traffic to be blocked or allowed by the Firewall Rules features. Many common Services are pre-defined, but you can also define your own services if required. To view the Services screen, select the Services link on the Firewall menu. Figure 39: Services Screen Data - Services Screen Available Services...
Page 68: Security
Broadband VPN Gateway User Guide Security This screen allows you to set Firewall and other security-related options. Figure 40: Security Screen Data - Security Screen Firewall The ICMP protocol is used by the "ping" and "trace route" programs, Echo ICMP on and by network monitoring and diagnostic programs.
Page 69 Security Configuration Enter the maximum value for the connections of each PC. Maximum Con- nections per PC Enter the maximum value for the applications of each host. Maximum Appli- cations per host Set the value to control the speed of the internet. Set New Connec- tion(s) not upto: There are 2 options to set the priority:...
Page 70: Dmz
Broadband VPN Gateway User Guide This feature, if enabled, allows the DMZ computer or computers on your LAN to be exposed to all users on the Internet. • This allows almost any application to be used on the "DMZ PC". •...
Page 71: E-Mail
Security Configuration E-Mail Figure 42: E-Mail Screen Data - E-Mail Screen E-Mail Alert If enabled, an E-Mail will be sent immediately if a DoS (Denial Send E-Mail alert of Service) attack is detected. If enabled, the E-mail address information must be provided. If enabled, an E-Mail will be sent immediately if an application Send E-Mail alert…...
Page 72 Broadband VPN Gateway User Guide Select the desired option for sending the log by E-mail. Send • When the log is full - The time is not fixed. The log will be sent when the log is full, which will depend on the volume of traffic.
Page 73: Chapter 8 Vpn (Ipsec)
Chapter 8 VPN (IPSec) This Chapter describes the VPN capabilities and configuration required for common situations. Overview This section describes the VPN (Virtual Private Network) support provided by your Broadband VPN Gateway. A VPN (Virtual Private Network) provides a secure connection between 2 points, over an insecure network - typically the Internet. This secure connection is called a VPN Tunnel.
Page 74: Vpn Configuration
Broadband VPN Gateway User Guide Note that different vendors use different terms. Generally, the terms "VPN Policy", "IPSec Policy", and "IPSec Proposal" have the same meaning. However, some vendors separate IKE Policies (Phase 1 parameters) from IPSec Policies (Phase 2 parameters). For the Broadband VPN Gateway;...
Page 75: Common Vpn Situations
Microsoft VPN Common VPN Situations VPN Pass-through Figure 43: VPN Pass-through Here, a PC on the LAN behind the Router/Gateway is using VPN software, but the Router/Gateway is NOT acting as a VPN endpoint. It is only allowing the VPN connection. •...
Page 76 Broadband VPN Gateway User Guide Connecting 2 LANs via VPN Figure 45: Connecting 2 VPN Gateways This allows two (2) LANs to be connected. PCs on each endpoint gain secure access to the remote LAN. • The 2 LANs MUST use different IP address ranges. •...
Page 77: Vpn Configuration
Microsoft VPN VPN Configuration This section covers the configuration required on the Broadband VPN Gateway when using Manual Key Exchange (Manual Policies) or IKE (Automatic Policies). Details of using Certificates are covered in a later section. Policies Screen To view this screen, select Policies from the VPN menu. This screen lists all existing VPN policies. If no policies exist, the list will be empty.
Page 78 Broadband VPN Gateway User Guide The order in which policies are listed is only important if you have Move multiple polices for the same remote site. In that case, the first matching policy is used. There are 2 ways to change the order of policies: •...
Page 79 Microsoft VPN Adding a New Policy To create a new VPN Policy, click the Add New Policy button on the Policies screen.
Page 80 Broadband VPN Gateway User Guide Figure 47: VPN Wizard - Start Screen...
Page 81 Microsoft VPN General Settings Policy Name Enter a suitable name. This name is not supplied to the remote VPN. It is used only to help you manage the policies. Enable Policy Enable or disable the policy as required. For each remote VPN, only 1 policy can be enabled at any time.
Page 82 Broadband VPN Gateway User Guide ESP (Encapsulating Security Payload) provides security for the ESP Encryption payload (data) sent through the VPN tunnel. Generally, you will want to enable both Encryption and Authentication. Authentication Algorithm • The 3DES algorithm provides greater security than DES, but is slower.
Page 83 Microsoft VPN Generally, you should enable ESP Authentication. There is little ESP Authentication difference between the available algorithms. Just ensure each endpoint use the same setting. • The "In" key here must match the "Out" key on the remote VPN, and the "Out" key here must match the "In" key on the remote VPN.
Page 84 Broadband VPN Gateway User Guide • RSA Signature requires that both VPN endpoints have valid Authentication Certificates issued by a CA (Certification Authority). • For Pre-shared key, enter the same key value in both end- points. The key should be at least 8 characters (maximum is 128 characters).
Page 85: Vpn Examples
Microsoft VPN VPN Examples This section describes some examples of using the Broadband VPN Gateway in common VPN situations. Example 1: Connecting 2 Broadband VPN Gateways In this example, 2 LANs are connected via VPN. Figure 48: Connecting 2 Broadband VPN Gateways Note •...
Page 86 Broadband VPN Gateway User Guide IKE Authentication Must match algorithm IKE Encryption Must match IKE Exchange Main Mode Main Mode Must match mode DH Group Group 1 (768 bit) Group 1 (768 bit) Must match IKE SA Life time 28800 28800 Does not have to match.
Page 87 Microsoft VPN Example 2: Windows 2000/XP Client to LAN In this example, a Windows 2000/XP client connects to the Broadband VPN Gateway and gains access to the local LAN. Figure 49: Windows 2000/XP Client to Broadband VPN Gateway To use 3DES encryption on Windows 2000, you need Service Pack 3 or later installed.
Page 88 Broadband VPN Gateway User Guide period will be used. IKE PFS Disable Must match client PC IPSec SA Parameters IPSec SA Life time 28800 Do not have to match. Shorter period will be used. IPSec PFS Disable Must match client PC AH authentication Disabled AH is rarely used...
Page 89 Microsoft VPN Figure 51: Windows 2000/XP - Policy Properties • Note that no rules are in use. Two 2 rules are required - incoming and outgoing. • The outgoing rule will be added first. 6. Deselect the "Use Add Wizard" checkbox, then click "Add" to view the screen below. Figure 52: IP Filter List 7.
Page 90 Broadband VPN Gateway User Guide Figure 53: Filter Properties: Addressing 8. Enter the Source IP address and the Destination IP address. • Since this is the outgoing filter, the Source IP address is "My IP address" and the Destination IP address is the address range used on the remote LAN.
Page 91 Microsoft VPN Figure 55: New Rule Properties: Filter Action 11. Select Require Security, then click the "Edit" button, to view the Require Security Properties screen. Figure 56: Require Security Properties 12. Select Negotiate security (this selects IKE), then click "Add".
Page 92 Broadband VPN Gateway User Guide Figure 57: Modify Security Method 13. On the resulting screen (above), select High [ESP] then click "OK" to save your changes and return to the Require Security Properties screen. Figure 58: Require Security Properties 14. Ensure the following settings are correct, then click "OK" to return to the Filter Action tab of the Edit Rule Properties screen. VPN Setting Windows Setting IKE enabled...
Page 93 Microsoft VPN Figure 59: Tunnel Setting 16. Click the Authentication Methods tab, then click the "Edit" to see the screen like the example below. Figure 60: Authentication Method 17. Select Use this string to protect the key exchange (preshared key), then enter your preshared key in the field provided. 18.
Page 94 Broadband VPN Gateway User Guide Figure 61: Windows 2000/XP Client to Broadband VPN Gateway 20. To add the second (incoming) rule, click "Add". For the name, enter "To Win2K", then click "Add". Figure 62: Windows 2000/XP Client to Broadband VPN Gateway 21.
Page 95 Microsoft VPN Figure 63: Filter Properties: Addressing 22. Click "OK" to save your changes, then "Close". Figure 64: Filter List 23. Ensure the "To Win2K" filter is selected, then click the Filter Action tab.
Page 96 Broadband VPN Gateway User Guide Figure 65: Filter Action 24. Select Require Security, then click "Edit". On the Require Security Methods screen below, select Negotiate security. Figure 66: Security Methods 25. Click the "Add" button. On the resulting Modify Security Method screen below, select High [ESP].
Page 97 Microsoft VPN Figure 67: Modify Security Method 26. Click "OK" to save your changes, then click "OK" again to return to the Filter Action screen. 27. Select the Tunnel Setting tab, and enter the WAN (Internet) IP address of this PC (172.16.9.10 in this example). Figure 68: Tunnel Setting 28.
Page 98 Broadband VPN Gateway User Guide Figure 69: Authentication Method 29. Select Use this string to protect the key exchange (preshared key), then enter your preshared key in the field provided. 30. Click "OK" to save your settings, then "Close" to return to the DUT to Win2K Properties screen. There should now be 2 IP Filers listed, as shown below.
Page 99 Microsoft VPN Figure 71: Properties - General Tab 32. Click the "Advanced" button to see the screen below. Figure 72: Key Exchange Settings 33. Click the "Methods" button to see the screen below. Figure 73: Key Exchange Security Methods...
Page 100 Broadband VPN Gateway User Guide 34. Select the first entry, and click the "Edit" button to see the following screen. Figure 74: IKE Security Algorithms 35. Select "SHA1" for Integrity Algorithm, "3DES" for Encryption algorithm, and "Low(1)" for the Diffie-Hellman Group. 36.
Page 101 Microsoft VPN Remote 172.16.9.10 Subnet address: IP addresses 11.5.0.0 For a single client, this is the 255.255.0.0 same as the Gateway address Address range used on the remote LAN.
Page 102 Broadband VPN Gateway User Guide Windows 2000 Server Configuration Configuration is the same as for Example 2: Windows 2000/XP Client to except for specifying the Source and Destination addresses for the "Filter Properties". Instead, for both IP Filters, the Filter Properties- Addressing should be completed as follows. Figure 77: Windows 2000 Server - Addressing •...
Page 103: Certificates
Microsoft VPN Certificates Certificates are used to authenticate users. Certificates are issued to you by various CAs (Certification Authorities). These Certificates are called "Self Certificates". Each CA also issues a certificate to itself. This Certificate is required in order to validate communication with the CA. These certifi- cates are called "Trusted Certificates."...
Page 104 Broadband VPN Gateway User Guide 3. Click the "Browse" button, and locate the certificate file on your PC 4. Select the file. The name will appear in the "Certificate File" field. 5. Click "Upload" to upload the certificate file to the Broadband VPN Gateway. 6.
Page 105 Microsoft VPN After you have received a Certificate, use this to upload the certifi- Upload Button cate to the Broadband VPN Router. You must select the correct certificate request, so the Broadband VPN Router can correctly match the request and the certificate. Use this to generate a new request to be supplied to a CA (Certifica- New Request tion Authority).
Page 106 Broadband VPN Gateway User Guide Select the desired option. RSA is recommended. Authentication Algo- rithm Key Size Select the desired option. Normally, 1024 bits provides adequate security. Enter your public (Internet) IP address. IP address This is optional. If you have a domain name, enter it here. Domain Name E-mail This is optional.
Page 107: Crl
Microsoft VPN • When prompted for the request data, supply the data you copied and saved in step 5 above. • Submit the CA's form. • If there are no problems, the Certificate will then be issued. 8. After obtaining a new Certificate, as described above, you need to upload it the Broadband VPN Gateway. •...
Page 108: Vpn Status
Broadband VPN Gateway User Guide Figure 85: Upload CRL 4. Upload the CRL file: • Click the "Browse" button, and locate the CRL file on your PC • Select the file. The name will appear in the "Upload File" field. •...
Page 109: Chapter 9 Microsoft Vpn
Microsoft VPN Open a new window and view the contents of the VPN log. Check Log Chapter 9 Microsoft VPN This Chapter explains the screens and settings available for the Microsoft VPN function. Overview Microsoft VPN uses the Microsoft VPN Adapter which is provided in recent versions of Windows. This feature can be used to provide remote access to your LAN by individual PCs.
Page 110: User
Broadband VPN Gateway User Guide Data - VPN Adapter Screen PPTP Service Enable PPTP Use this checkbox to enable or disable this feature as required. To allow connection by remote Windows clients, you must enable this feature, and enter the client details (on the Clients screen) to allow them to login to this Server.
Page 111 Microsoft VPN Data - User Screen Existing Users User List All existing users are listed. If you have not added any users, this list will be empty. When a user is selected, their details are displayed in the Properties panel. You can then edit the user's information as required; click Update Selected User to save your changes.
Page 112: Status Log Screen
Broadband VPN Gateway User Guide Status Log Screen The Status Log screen is accessed by selecting the Status Log option on the VPN (PPTP) menu. Figure 89: Status Log Screen Data - Status Log Screen Status Log Status This indicates whether or not the PPTP (VPN) Server is enabled. Current Connec- This indicates the number of remote clients currently logged into the PPTP (VPN) Server.
Page 113: Windows Client Setup
Microsoft VPN Windows Client Setup To connect to the PPTP (VPN) Server in the VPN Broadband Gateway: • The Microsoft VPN feature in the VPN Broadband Gateway must be enabled and configured, as described in the previous sec- tion. • Each user must have a login (username and password) on the VPN client database on the VPN Broadband Gateway.
Page 114 Broadband VPN Gateway User Guide To force all outgoing traffic to be sent via VPN, enable the setting This is the default Internet connection on the Dialing tab. (Do NOT enable this setting if using Dial-up or PPPoE client software.) Windows ME VPN Dialing Properties To establish a connection: 1.
Page 115: Windows 2000
Microsoft VPN Windows 2000 Ensure you have logged on with Administrator rights before attempting this procedure. 1. Open "Network Connections", and start the "New Connection" Wizard. Figure 92: Windows 2000 Network Connection 2. Select the VPN option ("Connect to a private network through the Internet"), as shown above, and click Next. Figure 93: Windows 2000 Public Network 3.
Page 116 Broadband VPN Gateway User Guide Figure 94: Windows 2000 VPN Host 4. On the screen above, enter the Domain Name or Internet IP address of the Broadband VPN Gateway you wish to connect to. Click Next to continue. Figure 95: Windows 2000 Connection Availability 5.
Page 117 Microsoft VPN Figure 96: Windows 2000 Finish Wizard 6. Enter a suitable name, and click "Finish" to save and exit. Setup is now complete. To establish a connection: 1. Right-click the connection in "Network Connections", and select "Connect". 2. You will then be prompted for the username and password. Enter the username and password assigned to you, as recorded in the VPN client database on the Broadband VPN Gateway.
Page 118 Broadband VPN Gateway User Guide Windows XP Ensure you have logged on with Administrator rights before attempting this procedure. 1. Open Network Connections (Start-Settings-Network Connections), and start the New Connection Wizard. Figure 97: Windows XP Network Connection Type 2. Select the option "Connect to the network at my workplace", as shown above, and click Next. Figure 98: Windows XP Network Connection 3.
Page 119 Microsoft VPN Figure 99: Windows XP Connection Name 4. Enter a suitable name for this connection. Click Next to continue. Figure 100: Windows XP Public Network 5. On the screen above, select "Do not dial the initial connection". Click Next to continue. Figure 101: Windows XP VPN Server 6.
Page 120 Broadband VPN Gateway User Guide Figure 102: Windows XP Connection Availability 7. Choose whether to allow this connection for everyone, or only for yourself, as required. Click Next to continue. 8. On the final screen, click Finish to save and exit. Setup is now complete.
Page 121: Chapter 10 Other Features & Settings
Chapter 10 Other Features & Settings This Chapter explains the screens and settings available via the "Other" menu. Overview Normally, it is not necessary to use these screens, or change any settings. These screens and settings are provided to deal with non- standard situations, or to provide additional options for advanced users.
Page 122: Diagnostics
Broadband VPN Gateway User Guide Diagnostics This screen allows you to perform a "Ping" or a "DNS lookup". These activities can be useful in solving network problems. An example Diagnostics screen is shown below. Figure 103: Diagnostics Screen Data - Diagnostics Screen Ping Ping This IP Enter the IP address you wish to ping.
Page 123 Other Features and Settings After entering the Domain name/URL, click this button to start the Search Button "DNS Search" procedure. The results will be displayed in the DNS Search Result pane.
Page 124: Password Screen
Broadband VPN Gateway User Guide Password Screen The password screen allows you to assign a password to the Wireless Router. Figure 104: Account Management Screen Data - Account Management Screen Password It displays the current existing user names. User Name User Rights It describes the rights of the current user.
Page 125: Web Management
Other Features and Settings Web Management Web Management allows you to connect to this interface via the Internet, using your Web browser. Figure 106: Web Management Screen Data - Web Management Screen Settings Web Management Select WAN1, WAN2 or LAN to allow administration/management via the Internet.
Page 126 Broadband VPN Gateway User Guide The default value is 8080. External Port Number Allow Web Login This allows you to restrict remote access by IP address. Select the desired option. • Anyone - Remote user's IP address is not checked. •...
Page 127: Firmware Upgrade
Other Features and Settings Firmware Upgrade Use this screen to upgrade your Broadband VPN Gateway's firmware. • You must download the required firmware file, and store it on your PC. • During the upgrade process, all existing Internet connections will be terminated. •...
Page 128: Backup/Restore
Broadband VPN Gateway User Guide Backup/Restore This feature allows you to backup (download) the current settings from the Broadband VPN Gateway, and save them to a file on your You can restore a previously-downloaded configuration file to the Broadband VPN Gateway, by uploading it to the Broadband VPN Gateway.
Page 129 Other Features and Settings Enable the Restore the default language if required. Clicking the Default Configu- Factory Defaults button will reset the Broadband VPN Gateway to its ration factory default settings. WARNING ! This will delete ALL of the existing settings.
Page 130: Appendix A Troubleshooting
Appendix A Troubleshooting This Appendix covers the most likely problems and their solutions. Overview This chapter covers some common problems that may be encountered while using the Broadband VPN Gateway and some possible solutions to them. If you follow the suggested steps and the Broadband VPN Gateway still does not function properly, contact your dealer for further advice.
Page 131 Appendix A - Troubleshooting Solution 2: The Broadband VPN Gateway processes the data passing through it, so it is not transparent. Use the Special Applications feature to allow the use of Internet applications which do not function correctly. If this does solve the problem you can use the DMZ function. This should work with almost every application, but: •...
Page 132: Appendix B Specifications
Appendix B Specifications Broadband VPN Gateway Model Broadband VPN Gateway Dimensions 235mm(W) * 147mm(D) * 33mm(H) Operating Temperature 0° C to 40° C Storage Temperature -10° C to 70° C Network Protocol: TCP/IP Network Interface: 6 Ethernet: 4 * 10/100BaseT (RJ45) LAN connection 2 * 10/100BaseT (RJ45) for WAN LEDs Power Adapter...
Page 133: Ce Marking Warning
Appendix B - Specifications This transmitter must not be co-located or operating in conjunction with any other antenna or transmitter. CE Marking Warning CE Standards This product complies with the 99/5/EEC directives, including the following safety and EMC standards: • EN301489-1/-17 •...
Page 134 Broadband VPN Gateway User Guide...
Page 135 Appendix B - Specifications...

TRENDnet TW100-BRV324 User Manual

Chapter 1 Introduction

Chapter 2 Installation

Chapter 3 Setup

Chapter 4 Pc Configuration

Chapter 5 Operation and Status

Chapter 6 Internet Features

Chapter 7 Security Configuration

Chapter 8 Vpn (Ipsec)

Chapter 9 Microsoft Vpn

Chapter 10 Other Features & Settings

Appendix A Troubleshooting

Appendix B Specifications

Quick Links

Need help?

Questions and answers

Related Manuals for TRENDnet TW100-BRV324

Summary of Contents for TRENDnet TW100-BRV324

Table of Contents