Page 2 Vigor3900 Multi-WAN Security Appliance User’s Guide Version: 1.5 Firmware Version: V1.0.5 (For future update, contact DrayTek) Date: 30/08/2012 Vigor3900 Series User’s Guide...
Page 3: Copyright Information
Web registration is preferred. You can register your Vigor router via Owner http://www.draytek.com. Firmware & Tools Due to the continuous evolution of DrayTek technology, all routers will be regularly Updates upgraded. Please consult the DrayTek web site for more information on newest firmware, tools and documents.
Page 4: Regulatory Information
No. 26, Fu Shing Road, HuKou Township, HsinChu Industrial Park, Hsin-Chu County, Taiwan Product: Vigor3900 DrayTek Corp. declares that Vigor3900 of routers are in compliance with the following essential requirements and other relevant provisions of EC, Directive 2004/108/EC. The product conforms to the requirements of Electro-Magnetic Compatibility (EMC) Directive 2004/108/EC by complying with the requirements set forth in EN55022/Class A and EN55024/Class A.
Page 5: Table Of Contents
3.1 How to Configure Load Balance with Multi-WAN on Vigor2960, Vigor300B or Vigor3900?..21 3.2 How to Configure OSPF?......................27 3.3 How to Configure LAN to LAN IPSec Tunnel between Vigor3900 and Other Router (Main Mode) ................................33 3.4 How to run RDP service in the browser via logging in 3900's HTTPS Server?......36 3.5 How to Configure VPN Load Balance between Vigor3900 and Other Router......
Page 6 4.10 SSL VPN ..........................245 4.10.1 SSL Web Proxy .........................245 4.10.2 SSL Application .........................247 4.10.3 Online User Status......................251 4.11 Bandwidth Management......................252 4.11.1 Incoming Class ........................253 4.11.2 Incoming Filter ........................256 4.11.3 Outgoing Class ........................259 4.11.4 Outgoing Filter ........................264 Vigor3900 Series User’s Guide...
Page 7 5.3 Pinging the Router from Your Computer .................. 300 5.4 Checking If the ISP Settings are OK or Not ................301 5.5 Backing to Factory Default Setting If Necessary..............302 5.6 Contacting Your Dealer ......................303 Vigor3900 Series User’s Guide...
Page 9: Chapter 1: Preface
The Vigor3900 Series integrates a rich suite of functions, including NAT, firewall, VPN, load balance, and bandwidth management capability. These products are very suitable for providing multi-integrated solutions to SME markets. A Virtual Private Network (VPN) is an extension of a private network that encompasses links across shared or public networks like an Intranet.
Page 10 The data transmission is done through the corresponding Giga port. WAN1/2/3/4 No Ethernet link is established. 1000 It means that a normal 1000Mbps connection is through its corresponding port. It means that a normal 10/100Mbps connection is through its corresponding port. Vigor3900 Series User’s Guide...
Page 11 Used to restore the default settings. Press it and keep for more than 5 seconds. When you see the ACT LED begins to blink, release the button. Then the router will restart with the factory default configuration. Connecter for a power cord. ON/OFF - Power switch. Vigor3900 Series User’s Guide...
Page 12: Hardware Installation
Connect a server/modem/router (depends on your requirement) to any WAN port of Vigor3900 with Ethernet cable (RJ-45). The WAN1 (to WAN4) LED will light up. Connect the power cord to Vigor3900’s power port on the rear panel, and the other side into a wall outlet.
Page 13: Rack-Mounted Installation
The Vigor3900 Series can be mounted on a rack by using standard brackets in a 19-inch rack or optional larger brackets on 23-inch rack (not included). The bracket for 19- and 23-inch racks are shown below. Attach the brackets to the chassis of a 19- or a 23-inch rack. The second bracket attaches the other side of the chassis as above procedure.
Page 14 This page is left blank. Vigor3900 Series User’s Guide...
Page 15: Chapter 2: Initialing Settings
Open a web browser on your PC and type http://192.168.1.1. A pop-up window will open to ask for username and password. Please type default values on the window for the first time accessing. The default value for user name is admin and the password is admin. Next, click Login. Vigor3900 Series User’s Guide...
Page 16 New Password and retype it on the field of Confirm Password. Then click Apply to continue. Now, the password has been changed. Next time, use the new password to access the Web Configurator for this router. Vigor3900 Series User’s Guide...
Page 17: Quick Start Wizard
Available settings are explained as follows: Item Description Profile Use the drop down list to choose one WAN profile. IPv4 Protocol Type Use the drop down list to choose a connection mode for such WAN profile. Vigor3900 Series User’s Guide...
Page 18 DHCP server on the Internet. If you choose DHCP mode, the DHCP server of your ISP will assign a dynamic IP address for Vigor3900 automatically. It is not necessary for you to assign any setting. (Host Name and Domain Name are required for some ISPs).
Page 19: Step 2 - Configuring The Selected Protocol
Choose the static mask from the drop down list. Gateway IP Address Type a public gateway address for such WAN profile. - click it to remove the IP address if you are not satisfied with it. Vigor3900 Series User’s Guide...
Page 20 Previous Click it to return to previous setting page. Finish Click it to finish the configuration. Cancel Click it to discard the settings configured in this page. When you finished the above settings, please click Finish. Vigor3900 Series User’s Guide...
Page 21 If your ISP provides you the PPPoE (Point-to-Point Protocol over Ethernet) connection, please select PPPoE for this router to get the following page. Enter the username and password provided by your ISP on the web page. Vigor3900 Series User’s Guide...
Page 22 Click it to return to previous setting page. Previous Click it to finish the configuration. Finish Cancel Click it to discard the settings configured in this page. When you finished the above settings, please click Finish. Vigor3900 Series User’s Guide...
Page 23 In this case, you can fill in this IP address in the Fixed IP field. Please contact your ISP before you want to use this function. Static – specify the IP address. DHCP - obtain the IP address automatically. Vigor3900 Series User’s Guide...
Page 24 – Click the icon to remove the selected entry. Previous Click it to return to previous setting page. Finish Click it to finish the configuration. Cancel Click it to discard the settings configured in this page. Vigor3900 Series User’s Guide...
Page 25 When you finished the above settings, please click Finish. Later, you can surf the Internet at any time. When the following screen appears, it means you have finished the Quick Start Wizard configuration. Vigor3900 Series User’s Guide...
Page 26: Register Vigor Router
Please follow the steps below to register the router. Before using such function, please register your router online first. Log into the web configurator of Vigor3900 and click Product Registration. A Login page will be shown on the screen. Please type the account and password that you created previously.
Page 27 When the following page appears, please type in Nick Name (for the router) and choose the right registration date from the popup calendar (it appears when you click on the box of Registration Date). After adding the basic information for the router, please click Submit. Vigor3900 Series User’s Guide...
Page 28 Now, your router information has been added to the database. Click OK to leave this web page and return to My Information web page. Take a look at the page of My Information, the new added Vigor3900 is listed under Your Device List.
Page 29: Chapter 3: Application And Tutorial
Sale's LAN will automatically failover to WAN1. Access into the web configurator page of Vigor router (here, we take Vigor300B as an example). Go to LAN>>General Setup to create a profile for LAN1 (192.168.1.1/24). Vigor3900 Series User’s Guide...
Page 30 Click Add to open the following page. Type the information specified for LAN1 profile, then click Apply to save the settings and exit the screen. Click Add again to create a profile for LAN2 (192.168.2.1/24). Vigor3900 Series User’s Guide...
Page 31 Type the information specified for LAN2 profile, then click Apply to save the settings and exit the screen. Open WAN >> Load Balance and click the Pool tab. Vigor3900 Series User’s Guide...
Page 32 WAN1 and WAN2 is 1:1. Also, you can type 2 and 1 for WAN1 and WAN2, then the ratio of line speed of WAN 1and line speed of WAN 2 will be 2:1. After clicking Apply, the created profile will be shown on the screen. Vigor3900 Series User’s Guide...
Page 33 Internet via WAN1 when WAN1 is up. Type the information specified for such rule. (e.g., Rule1 for Profile; 192.168.1.0 for Source IP Address; wan1 for Load Balance Pool/WAN Profile and so on). Next, click Apply to save and exit. Vigor3900 Series User’s Guide...
Page 34 Note: The priority of WAN >> Load Balance>>Rule is higher than WAN >> Default Route. Now, you have completed the configuration. Next time, when WAN1 is down, the connection for PCs behind Sale's LAN (192.168.1.1/24) will automatically failover to WAN2. Vigor3900 Series User’s Guide...
Page 35: How To Configure Ospf
It is suitable for large network and complicated data exchange. Both Vigor2960 and Vigor3900 support up to OSPF version 2(only for IPv4). The Autonomous System (AS) used in OSPF indicates the largest entity and can be divided into several areas.
Page 36 2. Next, continue to create a LAN (192.168.3.1/24) profile named lan2 with the settings shown below. 3. Open LAN >> Static Route and click the Inter-LAN Route tab to enable this profile. Vigor3900 Series User’s Guide...
Page 37 Profiles lan2 area setting as 11 and lan1 area as 11. (As shown in the topology diagram.) 1. Open LAN >> General Setup to create a LAN (192.168.2.1/24) profile named lan1 with the settings shown below. 2. Next, continue to create a LAN (192.168.3.2/24) profile named lan2 with the settings shown below. Vigor3900 Series User’s Guide...
Page 38 Profiles lan2 area setting as 11 and lan1 area as 11. (As shown in the topology diagram.) 1. Open LAN >> General Setup to create a LAN (192.168.4.1/24) profile named lan1 with the settings shown below. Vigor3900 Series User’s Guide...
Page 39 3. Open LAN >> Static Route and click the Inter-LAN Route tab to enable this profile. 4. Open LAN >> OSPF Configuration to enable this profile. Click Add to make the LAN Profiles lan2 area setting as 11 and lan1 area as 11. (As shown in the topology diagram.) Vigor3900 Series User’s Guide...
Page 40 5. After setting, check the routing information (marked with red line) which is created by OSPF. Vigor3900 Series User’s Guide...
Page 41: How To Configure Lan To Lan Ipsec Tunnel Between Vigor3900 And Other Router (Main Mode)
Here provides an example about LAN to LAN IPSec tunnel established between Vigor3900 and Vigor2710. Access into the web configurator of Vigor3900 and open VPN and Remote Access >> LAN to LAN Profiles to add a new VPN configuration. Type the Pre-shared key and choose a WAN Profile. Specify Local IP/Subnet Mask with 192.168.29.0/24.
Page 42 Choose Dial-Out as Call Direction and check the box of Always on. For Dial-Out Settings, please choose IPSec Tunnel and type WAN IP address of Vigor3900 in the field of Server IP/Host Name for VPN (e.g., 1.169.162.1). Type the same IKE Pre-Shared Key configured in Vigor3900.
Page 43 For the role of Vigor2710 is dialing-out, please skip Dial-In setting. Type the Remote Network IP and Remote Network Mask of Vigor3900 to complete configuration. Please check if the VPN connection is built successfully in both devices respectively. For Vigor3900, open VPN and Remote Access>>IPSec>>Status for viewing the result.
Page 44: How To Run Rdp Service In The Browser Via Logging In 3900'S Https Server
Microsoft Terminal Services. An easy way is provided to establish connection between the router and the RDP Server via any browser. Open the web configurator of Vigor3900. Enable the HTTPS service from System Maintenance >> Access Control by clicking Enable for HTTPS Allow and type 443 as the value of HTTPS Port.
Page 45 Open User Management >> User Profile to create a new profile named “7788”. Set the Password as 7788 and choose the profile of Win7 as SSL Application (RDP). Click Apply. Logout Vigor3900. Login Vigor3900 HTTPS Server with 7788 for both Username and Password. Vigor3900 Series User’s Guide...
Page 46 A screen like the following figure will appear. Simply click the SSL Application link. In the following screen, click Connect for connecting to Win7, the RDP server. Vigor3900 Series User’s Guide...
Page 47 After that, you can access into Windows 7 via a browser. Note the message below the window. In which, TLS means Transport Layer Security. Vigor3900 Series User’s Guide...
Page 48: Troubleshooting
If you have installed Java Runtime Environment edition 6 but still cannot establish the connection, please make sure you have disabled “Use TLS 1.0” in the Java Control Panel as figure shown below. Then, try to connect again. Vigor3900 Series User’s Guide...
Page 49: How To Configure Vpn Load Balance Between Vigor3900 And Other Router
Vigor3900. We will build VPN connection with load balance between Vigor3900 and two WANs of Vigor2950 respectively. Access into the web configurator of Vigor3900 and open VPN and Remote Access >> VPN Profiles to add new VPN profiles. Click Add.
Page 50 Create a profile for WAN 1 (named 2950WAN1). Type the settings as shown below: Vigor3900 Series User’s Guide...
Page 51 Click Apply to save the settings and exit the dialog. Create a profile for WAN 2 (named 2950WAN2). Vigor3900 Series User’s Guide...
Page 52 Balance Pool tab. Click Add to add a Load Balance Pool profile. The following window will pop up. Give a name for the profile. Click the Load Balance tab. Select the IPSec GRE profiles (e.g., 2950WAN1) set for Vigor2950 then click Apply. Vigor3900 Series User’s Guide...
Page 53 10. Enable this profile and input the following settings then click Apply. Type the local network IP address and Mask of Vigor3900 as Source IP Address and Source Mask; type the network IP and Mask of Vigor2950 as Destination IP Address &...
Page 54 In Vigor2950, it is necessary to build two VPN connections (for two WANs) to connect with Vigor3900. Please open the web configurator of Vigor2950 and open VPN and Remote Access >> LAN to LAN. First, please type the name of such VPN connection in the field of Profile Name (e.g., 3900WAN1).
Page 55 Please type the network IP address and subnet of Vigor3900 in the field of Remote Network IP and Remote Network Mask. Type the network IP address and subnet of Vigor2950 in the field of Local Network IP and Local Network Mask.
Page 56 VPN profiles in Member 1 and Member 2 respectively. Then, choose Load Balance as the Active Mode. Click Add. After finished the settings for Vigor3900 and Vigor2950, please check if the VPN connection is built successfully in both devices respectively. Take Vigor3900 for an example, open VPN and Remote Access>>...
Page 57 As to Vigor2950, please open VPN and Remote Access>>Connection Management to confirm the result. Vigor3900 Series User’s Guide...
Page 58: How To Setup 50 Wans On Vigor3900
Vigor3900 has 5 physical WANs; however, it can be extended to 50 WANs at most by using VLAN Tagging technology. Below will show how to achieve 50 WANs setup by one Vigor3900 and two VigorSwitch2260s. Refer to the following application illustration: Change mode from Basic to Advance via WAN>>General Setup page.
Page 59 Click OK. Vigor3900 will ask you to re-login. Delete default wan profiles for wan3, wan4 and wan5 by selecting the wan profile then click Delete. Click Add to add new WANs. Vigor3900 Series User’s Guide...
Page 60 VLAN ID (112~ 134 and 211~ 234) by repeating step 4 ~ step 5. Setup VLAN mode as Tag VLAN. Click Add to create a New VLAN GROUP via VLAN>>TAG-based Group page. Vigor3900 Series User’s Guide...
Page 61 Port 26 must be selected as the member for each group, for it is the channel for any packets coming from Vigor3900. As to Untag, when you check Port 2 and Port 26, you have to untag Port 2; when you check Port 3 and Port 26, you have to untag Port 3;...
Page 62 ISP modem 1 which connects to Port 1 doesn’t support VLAN Tag. While the switch receives packets from Port 1, it will add VLAN Tag 111 to the packets Then Vigor3900 wan1_1 will receive the packets. After finishing the configuration for one VigorSwitch, please set for another VigorSwitch with the same procedure.
Page 63: Chapter 4: Advanced Web Configuration
When a router begins to connect to your ISP, a serial of discovery process will occur to ask for a connection. Then a session will be created. Your user ID and password is authenticated Vigor3900 Series User’s Guide...
Page 64: General Setup
WAN profile. When you switch the Mode setting from Advance to Basic or from Basic to Advance, the system will ask you to re-login web configuration interface to activate some parameters. Below shows settings in Basic mode: Vigor3900 Series User’s Guide...
Page 65 If the data transmitted with tag, Enable will be displayed in this field. Otherwise, Disable will be shown instead. Display the IPv4 protocol selected by the profile. IPv4 Protocol Type IPv6 Protocol Type Display the IPv6 protocol selected by the profile. Vigor3900 Series User’s Guide...
Page 66 Description Profile Type a name for such profile. Enable This Profile Check this box to enable such profile. Description Give the brief description for such profile. VLAN ID Type the VLAN ID number for such profile. Vigor3900 Series User’s Guide...
Page 67 General Settings allows you to enable the profile, give a brief explanation for such profile, specify the VLAN ID, specify MAC address, choose IPv4 and IPv6 protocol, and specify the mode of the data transmission (NAT or Routing). Vigor3900 Series User’s Guide...
Page 68 – click the icon to remove the selected entry. IP Alias Type other IP addresses to be bound to this interface. This setting is optional. If you have typed addresses here, you can see and choose it in later web page settings (e.g., Vigor3900 Series User’s Guide...
Page 69 Assign detecting times to ensure the connection of the WAN Detection Retry interface. After passing the times you set in this field and no reply received by the router, the connection of WAN interface will be regarded as breaking down. Vigor3900 Series User’s Guide...
Page 70 Next, click Save. The new one will be added and displayed on the field under the box. Add – click this button to have a field for adding a new IP Vigor3900 Series User’s Guide...
Page 71 WAN interface will be regarded as breaking down. Click it to save the configuration and exit the dialog. Apply Click it to exit the dialog without saving the configuration. Cancel Vigor3900 Series User’s Guide...
Page 72 PING and HTTP supported in Vigor router for you to choose to send the request out. Connection If you choose PING/HTTP as Connection Detection Mode, Detection Host you have to specify the detection host address in this field. Use the default setting. Vigor3900 Series User’s Guide...
Page 73 Save –click this button to save the setting. – click the icon to remove the selected entry. Click it to save the configuration and exit the dialog. Apply Cancel Click it to exit the dialog without saving the configuration. Vigor3900 Series User’s Guide...
Page 74 Disable – Click it to disable the function of Always On. Connection Select a detecting mode for this WAN interface. There are Detection Mode two ways PING and HTTP supported in Vigor router for you to choose to send the request out. Vigor3900 Series User’s Guide...
Page 75 Link-Local address is used for communicating with neighbouring nodes on the same link. It is defined by the address prefix fe80::/64. You don't need to setup Link-Local address manually for it is generated automatically according to your MAC Address. Vigor3900 Series User’s Guide...
Page 76 Save – click this button to save the setting. – click the icon to remove the selected entry. Apply Click it to save the configuration and exit the dialog. Cancel Click it to exit the dialog without saving the configuration. Vigor3900 Series User’s Guide...
Page 77 Click it to save the configuration and exit the dialog. Cancel Click it to exit the dialog without saving the configuration. If you choose DHCP-IA_PD as IPv6 protocol type It is not necessary for you to configure any web page. Vigor3900 Series User’s Guide...
Page 78: Default Route
Display the WAN profiles for user to choose as a default /Load Balance Pool route. Name In which, wan1 to wan5 are factory default settings. Refresh Renew the page configuration. Apply Click it to save the configuration. Vigor3900 Series User’s Guide...
Page 79: Load Balance Policy
Vigor3900 supports a load balancing function. It can assign traffic with protocol type, IP address for specific host, a subnet of hosts, and port range to be allocated in WAN interface. User can assign traffic category and force it to go to dedicate network interface based on the following web page setup.
Page 80 Load Balance Display the WAN profile used by such rule. Pool/WAN Profile Open WAN>>Load Balance and click the tab of Rule. Simply click the Add button. The following dialog will appear. Available parameters are listed as follows: Vigor3900 Series User’s Guide...
Page 81 WAN>>Load Balance Policy>> Pool page also will be displayed here. To have user-defined WAN profile, please refer to WAN<<General Setup for detailed information. Apply Click it to save the configuration. Cancel Click it to return to the factory setting. Vigor3900 Series User’s Guide...
Page 82 Remove the selected rule profile. Delete To delete a rule, simply select the one you want to delete and click the Delete button. Refresh Renew current web page. Profile Display the name of the load balance profile. Vigor3900 Series User’s Guide...
Page 83 Pool setting. Open WAN>>Load Balance Policy and click the tab of Pool. Simply click the Add button to open the following dialog. Type a name (e.g., LB_1) for such profile. Choose Load_Balance as the Mode selection. Vigor3900 Series User’s Guide...
Page 84 Use the drop down list of Interface to choose the WAN profiles that will be in the Load Balance Pool. Type the value for Weight. Click Apply. A new profile will be added on the page. Vigor3900 Series User’s Guide...
Page 85 Simply click the Add button to open the following dialog. Type a name (e.g., FL_1) for such profile. Choose Failover as the Mode selection. Click the Failover Tab. In default, the system will apply Primary Profile. If Primary Profile cannot be used any more, the Backup Profile will be used instead. Vigor3900 Series User’s Guide...
Page 86: Switch
Packets passing through the WAN interface might be tagged or untagged with VLAN ID number. It depends on the setting configured in this page for VLAN ID configured in WAN >>General Setup>>Profile relates to the VLAN ID setting configured here. Vigor3900 Series User’s Guide...
Page 87 Display number of the WAN interface for the packets Member tagged with such VLAN ID number to pass through. Display number of the WAN interface for the VLAN ID Untag will be untagged for packets passing through the WAN interface selected. Vigor3900 Series User’s Guide...
Page 88 Mirrored Port Select a port to make the packets passing through it monitored by the administrator. Apply Click it to save the configuration. Cancel Click it to discard the settings configured in this page. Vigor3900 Series User’s Guide...
Page 89 Cancel – Click it to exit the dialog without saving anything. Refresh Renew current web page. Interface Display the name of the WAN port on the router. Enable This Profile Display the status of the profile. False means disabled; True Vigor3900 Series User’s Guide...
Page 90 Up means the network is connected; Down means the network is not connected. Speed Display the transmission rate (10M, 100M, 1000M or Auto) of the date for such WAN interface. Duplex Display the duplex used (full or half) by such WAN interface. Vigor3900 Series User’s Guide...
Page 91: Lan
This page allows you to enable the profile, give a brief explanation for such profile, specify the VLAN ID, specify MAC address, and choose protocol type for such profile. Each item will be explained as follows: Item Description Add a new LAN profile. Vigor3900 Series User’s Guide...
Page 92 Display the IPv6 protocol type for the LAN profile. Open LAN>>General Setup and click the General Setup tab. Click the Add button to open the following dialog. Different protocol type selected will bring up different configuration web page. Vigor3900 Series User’s Guide...
Page 93 Gateway IP Such IP address is ready for matching with the function of Address Virtual System. – click the icon to clear the IP setting. Subnet Specify one 2 subnet which might be needed in the future. Vigor3900 Series User’s Guide...
Page 94 The ID number set here is used by an individual organization to create its own local addressing hierarchy and to identify subnets. Apply Click it to save and exit the dialog. Click it to exit the dialog without saving anything. Cancel Vigor3900 Series User’s Guide...
Page 95 When you finish the above settings, please click Apply to save the configuration and exit the dialog. In the Vigor3900 router, there are some IP address settings for the LAN interface. The IP address/subnet mask is for private users or NAT users. The IP address of the default gateway on other local PCs should be set as the Vigor3900 server IP address.
Page 96 Display the ending IP address of the IP address pool for DHCP server. Display the IP address for DNS. In general, this box will be blank. It means Vigor3900 will Routers be regarded as the gateway for the user. Display the lease time for the DHCP server.
Page 97 Set the private IP address for DNS server. If this field is blank, users on LAN will treat Vigor3900 as the DNS server. Add – Click it to add a new IP address for DNS server. Save – Click it to save the setting.
Page 98 Specify Remote Enable – Enable this function that remote clients within the Dial-in IP range specified below can access into Vigor3900 WUI. Disable – Disable this function. Remote Dial-in Specify the start IP address for an IP range. The DHCP...
Page 99 Check this box to enable this profile. DHCP Server Type the LAN or WAN profile for the DHCP server Location DHCP Server IP Type the IP address of DHCP Server. Apply Click it to save and exit the dialog. Vigor3900 Series User’s Guide...
Page 100 To edit a profile, simply select the one you want to modify and click the Edit button. The edit window will appear for you to modify the corresponding settings for the selected rule. Refresh Renew current web page. Vigor3900 Series User’s Guide...
Page 101 10 ~ 150. It is used to control the lifetime of the prefix. A lifetime of 0 indicates that the router is not a default router and should not appear on the default router list. Apply Click it to save and exit the dialog. Vigor3900 Series User’s Guide...
Page 102 Refresh Renew current web page. Profile Display the name of the LAN profile. Enable This Profile Display the status of the profile. False means disabled; True Vigor3900 Series User’s Guide...
Page 103 Display the name of the LAN profile. Enable This Profile Check this box to enable this profile. Start IP Set the starting IP address of the IP address pool for DHCP server. The format the IP address shall be similar to the Vigor3900 Series User’s Guide...
Page 104 2000:0000:0000:0000:0000:0000:0000:10 or 2000::10. Set the private IP address for DNS server. If this field is blank, users on LAN will treat Vigor3900 as the DNS server. Add – Click it to add a new IP address for DNS server. Save – Click it to save the setting.
Page 105: Ip Routing
WAN. When the local device tries to transmit the data packets out, Vigor3900 will send it out through that certain WAN interface without passing through NAT. Meanwhile, remote device also can access the local device directly without any difficulty.
Page 106 Choose one of WAN profiles for sending data out. Choose one of LAN profiles for the local device. LAN Profile Type the private IP address for such IP routing profile. Mask Type the subnet mask for such IP routing profile. Vigor3900 Series User’s Guide...
Page 107: Static Route
Remove the selected static route setting. To delete a static route setting, simply select the one you want to delete and click the Delete button. Refresh Renew current web page. Rename Allow to modify the selected profile name. Vigor3900 Series User’s Guide...
Page 108 Click the Add button. The following dialog will appear. Available parameters are listed as follows: Item Description Profile Type the name of the static route profile. Enable This Profile Check this box to enable such profile. Vigor3900 Series User’s Guide...
Page 109 Type the distance to the target (usually counted in hops). Apply Click it to save and exit the dialog. Cancel Click it to exit the dialog without saving anything. Enter all the settings and click Apply. The new profile will be added on the screen. Vigor3900 Series User’s Guide...
Page 110 Display the prefix length of the profile. Nexthop Display the nexthop address for such static route profile. WAN / LAN Profile Display the subnet LAN or WAN profile of the gateway. Metric Display the distance to the target. Vigor3900 Series User’s Guide...
Page 111 Choose one of the LAN/WAN profiles of the gateway for such static route. Metric Type the distance to the target (usually counted in hops). Apply Click it to save and exit the dialog. Cancel Click it to exit the dialog without saving anything. Vigor3900 Series User’s Guide...
Page 112 Enter all the settings and click Apply. The new profile will be added on the screen. To make the users in different LAN communicating with each other, please check the box to enable Inter-LAN route function. Vigor3900 Series User’s Guide...
Page 113: Switch
Modify the selected VLAN ID setting. Edit To edit VALN ID setting, simply select the one you want to modify and click the Edit button. The edit window will appear for you to modify the corresponding settings for the Vigor3900 Series User’s Guide...
Page 114 VLAN for your computer. Later, you have to type the same ID number for each PC which wants to be grouped within the same VLAN group. Member Determine which LAN interface can be used to access into Vigor3900 Series User’s Guide...
Page 115 Click it to exit the dialog without saving anything. Enter all the settings and click Apply. The new profile will be added on the screen. Vigor3900 supports port mirroring function in LAN interfaces. This mechanism helps manager track the network errors or abnormal packets transmission without interrupting the flow of data access the network.
Page 116 Each item will be explained as follows: Item Description Edit Choose the interface listed below and click the Edit button to modify the settings. A pop up window will appear for you to change the settings. Vigor3900 Series User’s Guide...
Page 117 Please select a profile and click the Edit button. The following dialog will appear. Available parameters are listed as follows: Item Description Interface Display the name of LAN interface profile. Enable This Profile Check the box to enable the Mirror function for the switch. Vigor3900 Series User’s Guide...
Page 118 Display the status (up or down) for the interface. Status Speed Display the transmission rate (10M, 100M, 1000M or Auto) of the date for such profile. Duplex Display the duplex used (full or half) by such profile. Vigor3900 Series User’s Guide...
Page 119: Bind Ip To Mac
It allows you to add one pair of IP/MAC address and display on the table of IP Bind List. Edit It allows you to edit and modify the selected IP address and MAC address that you create before. Vigor3900 Series User’s Guide...
Page 120 Strict_Bind – Only specified IP addresses will be assigned to the device with bind MAC address. Other devices which are not listed on the Bind Table shall still NOT get the IP address from DHCP server. Vigor3900 Series User’s Guide...
Page 121 IP address. Click it to save and exit the dialog. Apply Cancel Click it to exit the dialog without saving anything. Enter all the settings and click Apply. A new profile has been added onto Bind Table. Vigor3900 Series User’s Guide...
Page 122: Rip Configuration
B will tell A "if you want to send packets to C, please send it to me first", then A will create a routing rule to forward packet that destination is C to B. In another direction, C will do the same thing. Vigor3900 Series User’s Guide...
Page 123: Ospf Configuration
Click it to save the settings. Cancel Click it to discard the settings configured in this page. OSPF uses the algorithm of SPF (Shortest Path First) to calculate the route metric. It is suitable for large network and complicated data exchange. Vigor3900 Series User’s Guide...
Page 124 Type a new name for such profile. Apply Click it to save the settings. Cancel Click it to cancel the settings configuration. Open LAN>>OSPF Configuration. Check Enable This Profile. Click the space of Profile. A pop-up dialog will appear. Click Add. Vigor3900 Series User’s Guide...
Page 125 If you are not satisfied the settings, simply click to remove the entry, and then re-type the settings. Click Apply to save the settings and exit the dialog. A new profile is created and displayed on the screen. Vigor3900 Series User’s Guide...
Page 126: Nat
Series is NAT-enabled by default and gets one globally routable IP addresses from the ISP by Static, PPPoE, or DHCP mechanism. The Vigor3900 Series assigns private network IP addresses according to RFC-1918 protocol and translates the private network addresses to a globally routable IP address so that local hosts can communicate with the router and access the Internet.
Page 127 Public Port End Display the ending number of the public port. Private Port Display the number of the private port. Public IP Display what kind of IP is used. IP Alias Display the selected WAN IP address. Vigor3900 Series User’s Guide...
Page 128 The following dialog will appear. Available parameters are listed as follows: Item Description Profile Type the name of the profile. Enable This Profile Check the box to enable this profile. Specify the WAN profile for such profile. Interface Vigor3900 Series User’s Guide...
Page 129 Apply Click it to save and exit the dialog. Cancel Click it to exit the dialog without saving anything. Enter all the settings and click Apply. A new profile has been added onto Port Redirection table. Vigor3900 Series User’s Guide...
Page 130: Dmz Host
Modify the selected profile. To edit a profile, simply select the one you want to modify and click the Edit button. The edit window will appear for you to modify the corresponding settings for the selected Vigor3900 Series User’s Guide...
Page 131 Display the private IP used for this entry. Use IP Alias Display the using status (enabled or disabled) for WAN IP alias. IP Alias Display the selected WAN IP address. Open NAT>> DMZ Host. Simply click the Add button. Vigor3900 Series User’s Guide...
Page 132 Apply Click it to save and exit the dialog. Cancel Click it to exit the dialog without saving anything. Enter all the settings and click Apply. A new profile has been added onto DMZ Host table. Vigor3900 Series User’s Guide...
Page 133: Address Mapping
Allow to modify the selected profile name. Profile Display the name of the profile. Enable The Profile Display the status of the profile. False means disabled; True means enabled. Display the WAN profile that such address mapping profile WAN Profile Vigor3900 Series User’s Guide...
Page 134 Type the name of the profile. Enable This Profile Check the box to enable the Address Mapping profile. WAN Profile Choose a WAN profile for such entry. Private IP Type the private IP used for this entry. Vigor3900 Series User’s Guide...
Page 135 Apply Click it to save and exit the dialog. Cancel Click it to exit the dialog without saving anything. Enter all the settings and click Apply. A new profile has been added onto Address Mapping table. Vigor3900 Series User’s Guide...
Page 136: Sip Alg
Check the box to enable the Mirror function for the switch. Choose one of the LAN profiles. LAN Interface WAN Interface Choose one of the WAN profiles. Refresh Renew current web page. Apply Click it to save the settings. Click Apply to save the settings. Vigor3900 Series User’s Guide...
Page 137: Firewall
The firewall controls the allowance and denial of packets through the router. Firewall Setup in the Vigor3900 Series mainly consists of packet filtering, Denial of Service (DoS) and URL (Universal Resource Locator) content filtering facilities. These firewall filters help to protect your local network against attack from outsiders. A firewall...
Page 138 Renew current web page. Rename Allow to modify the selected profile name. Group Display the name of the IP filter group profile. Enable The Profile Display the status of the profile. False means disabled; True means enabled. Vigor3900 Series User’s Guide...
Page 139 Display the status (enable or disable) of the Syslog function. Syslog To build an IP group containing IP filter rules, please follow the steps: Open Firewall>>Filter Setup and click the IP Filter tab. Simply click the Add button. Vigor3900 Series User’s Guide...
Page 140 Enable This Profile Check the box to enable this profile. Comment Give a brief description for the profile. Enter all the settings and click Apply. A new filter group has been added onto Address Mapping table. Vigor3900 Series User’s Guide...
Page 141 Choose the IP filter group first and then click the Add tab (the lower one in this page). The following page for configuration will appear. Available parameters are listed as follows: Item Description Rule Type the name of the IP filter rule. Enable This Profile Check the box to enable this profile. Vigor3900 Series User’s Guide...
Page 142 Pass_If_No_Further_Match - A packet matching the rule, and that does not match further rules, will be passed through. Syslog Click Enable to make the history of firewall actions appearing on the System Maintenance >> Syslog/Mail Alert >> Syslog File. Vigor3900 Series User’s Guide...
Page 143 Note: You can create multiple IP filter groups. Each IP Filter Rules of Selected Group belongs to an IP Filter Rule Group. Click an IP Filter Rule Group to show its members in the lower display window. Vigor3900 Series User’s Guide...
Page 144 Display the status of the profile. False means disabled; True means enabled. Time Profile If no time schedule is set, None will be shown in this field. Source IP Display the source IP object profile selected for such group. Vigor3900 Series User’s Guide...
Page 145 Display the P2P object profile selected for such application profile. Protocol Block Display the protocol object profile selected for such application profile. Open Firewall>>Filter Setup and click the Application Filter tab. Simply click the Add button. The following dialog will appear. Vigor3900 Series User’s Guide...
Page 146 Apply Click it to save and exit the dialog. Cancel Click it to exit the dialog without saving anything. Enter all the settings and click Apply. A new Application filter profile has been added. Vigor3900 Series User’s Guide...
Page 147 If no time schedule is set, None will be shown in this field. Source IP Display the source IP object profile selected for each rule. Keyword Pass Display the keyword object profile selected for each rule which is allowed to pass through the router. Vigor3900 Series User’s Guide...
Page 148 Apply Click it to save and exit the dialog. Cancel Click it to discard the settings configured in this page. Open Firewall>>Filter Setup and click the URL Filter tab. Simply click the Add button. Vigor3900 Series User’s Guide...
Page 149 You can click to create another new file extension object profile. Web Category Choose one or more WCF object profiles from the drop Block down list which will not be allowed to pass through the router. Vigor3900 Series User’s Guide...
Page 150 WCF object profile. Apply Click it to save and exit the dialog. Cancel Click it to exit the dialog without saving anything. Enter all the settings and click Apply. A new URL filter profile has been added. Vigor3900 Series User’s Guide...
Page 151: Dos Defense
Click Enable to block the packets attacks coming from Storm Defense unknown multicast storm. Storm Filtering Rate Type a number (1~4096, unit of 64Kpbs) as for the filtering rate. Refresh Renew current web page. Apply Click it to save the configuration. Vigor3900 Series User’s Guide...
Page 152 Click Enable to activate the UDP flood defense function. If the amount of UDP packets from the Internet exceeds the user-defined threshold value, the router will be forced to randomly discard the subsequent UDP packets within the Vigor3900 Series User’s Guide...
Page 153 Any ICMP packets with fragmented bit sets are dropped. Block Unknown Click Enable to activate the Block Unknown Protocol Protocol function. The router will block any packets with unknown protocol types. Refresh Renew current web page. Apply Click it to save the configuration. Vigor3900 Series User’s Guide...
Page 154: Mac Block
Allow to modify the selected profile name. Profile Display the name of the profile. Enable The Profile Display the status of the profile. False means disabled; True means enabled. MAC Address Display the MAC address for such profile. Vigor3900 Series User’s Guide...
Page 155 Type the MAC address which will be blocked by the system for such profile. Apply Click it to save and exit the dialog. Cancel Click it to exit the dialog without saving anything. Enter all the settings and click Apply. Vigor3900 Series User’s Guide...
Page 156: Objects Setting
A new MAC Block profile has been created. Vigor3900 allows users to set different filter profiles based on IP, service type, keyword, file extension, instant message application, P2P application, protocol application, web category and time setting. These objects setting profiles can be applied in Firewall.
Page 157: Ip Object
Display the category (any, source or destination) of the IP Interface Object. Address Type Display the address type (single, range or subnet) for such profile. Start IP Address Display the IP address of the starting point for such profile. Vigor3900 Series User’s Guide...
Page 158 Type the name of such profile. Interface Determine the category (any, source or destination) of this IP object. If an IP object is set to Source, it will only appear in the field of Source IP on Firewall>>IP Filter Rule. Vigor3900 Series User’s Guide...
Page 159 Subnet as Address Type. Apply Click it to save and exit the dialog. Cancel Click it to exit the dialog without saving anything. Enter all the settings and click Apply. A new IP object profile has been created. Vigor3900 Series User’s Guide...
Page 160: Ip Group
Group Name Display the name of the object group. Interface Display the category (any, source or destination) of the IP group. Description Display the description for such profile. Objects Display the object profiles grouped under such group. Vigor3900 Series User’s Guide...
Page 161 Use the drop down list to check the IP object profiles under such group. All the available IP objects that you have added on Objects Setting>>IP Object will be seen here. Apply Click it to save the configuration. Vigor3900 Series User’s Guide...
Page 162: Service Type Object
Edit button. The edit window will appear for you to modify the corresponding settings for the selected rule. Delete Remove the selected profile. To delete a rule, simply select the one you want to delete and click the Delete button. Vigor3900 Series User’s Guide...
Page 163 Open Objects Setting>> Service Type Object. Simply click the Add button. The following dialog will appear. Available parameters are listed as follows: Item Description Profile Type a name for such profile. The number of the characters Vigor3900 Series User’s Guide...
Page 164 ICMP. Type a port number (0 – 65535) as the ending destination port. Apply Click it to save the configuration. Cancel Click it to exit the dialog without saving anything. Enter all the settings and click Apply. A new Service Type Object profile has been created. Vigor3900 Series User’s Guide...
Page 165: Service Type Group
Display the total number (32) of the object profiles to be created. Group Name Display the name of the service type group. Description Display the description for such profile. Objects Display the service type object profiles grouped under such group. Vigor3900 Series User’s Guide...
Page 166 Objects Setting>>Service Type Object will be seen here. Apply Click it to save the configuration. Cancel Click it to exit the dialog without saving the configuration. Enter all the settings and click Apply. A new Service Type Group profile has been created. Vigor3900 Series User’s Guide...
Page 167: Keyword Object
Keyword can be set as a filter rule to be applied in Firewall. Vigor3900 allows users to set keyword profile with several keywords. Even, it allows users to group several keyword profiles within a keyword group. Each item will be explained as follows:...
Page 168 Add – Type the word in the box of Member and click this button to add the new word as keyword object. Save – Click it to save the setting. – click the icon to remove the selected entry. Apply Click it to save the configuration. Vigor3900 Series User’s Guide...
Page 169: Keyword Group
Remove the selected profile. Delete To delete a rule, simply select the one you want to delete and click the Delete button. Refresh Renew current web page. Vigor3900 Series User’s Guide...
Page 170 Use the drop down list to check the keyword object profiles under such group. All the available keyword objects that you have added on Objects Setting>>Keyword Object will be seen here. Apply Click it to save the configuration. Vigor3900 Series User’s Guide...
Page 171: File Extension Object
Edit button. The edit window will appear for you to modify the corresponding settings for the selected rule. Delete Remove the selected profile. To delete a rule, simply select the one you want to delete and click the Delete button. Vigor3900 Series User’s Guide...
Page 172 Display the selected file extension of activeX. Compression Display the selected file extension of compression. Execution Display the selected file extension of execution. Open Objects Setting>>File Extension Object. Simply click the Add button. The following dialog will appear. Vigor3900 Series User’s Guide...
Page 173 Apply Click it to save the configuration. Click it to exit the dialog without saving the configuration. Cancel Enter all the settings and click Apply. A new File Extension Object profile has been created. Vigor3900 Series User’s Guide...
Page 174: Im Object
Profile Display the name of the IM object profile. Display the IM application specified in such profile. Member WebIM Display the status of IM object whether including the specified set of web IM or not. Vigor3900 Series User’s Guide...
Page 175 Type the name of the IM object group. The number of the characters allowed to be typed here is 10. Member Several IM applications offered for you to choose. Check the one(s) you want to add for such profile. Vigor3900 Series User’s Guide...
Page 176 Apply Click it to save the configuration. Click it to exit the dialog without saving the configuration. Cancel Enter all the settings and click Apply. A new IM Object profile has been created. Vigor3900 Series User’s Guide...
Page 177: P2P Object
Vigor3900 can block P2P application for users, especially for the ones who always upload or download improper files to Internet. P2P object setting lists all of the point to point application for you to choose to block. Choose the one(s) you want to block and save as a P2P Object profile. Later, it can be applied to Firewall as a filter rule and reach the purpose of block.
Page 178 Several P2P applications offered for you to choose. Check the one(s) you want to add for such profile. Apply Click it to save the configuration. Cancel Click it to exit the dialog without saving the configuration. Enter all the settings and click Apply. Vigor3900 Series User’s Guide...
Page 179: Protocol Object
A new P2P Object profile has been created. Network services, e.g., DNS, FTP, HTTP, POP3, for LAN users can be blocked by Vigor3900. Common services will be listed in this function and can be selected to be blocked by the router.
Page 180 Type the name of the protocol object profile. The number of the characters allowed to be typed here is 10. Member Several protocols offered for you to choose. Check the one (s) you want to add for such profile. Vigor3900 Series User’s Guide...
Page 181: Web Category Object
If you want to purchase a formal edition, simply contact with your DrayTek dealer. Note: Web Content Filter (WCF) is not a built-in service of Vigor router but a service powered by Commtouch.
Page 182 Business Display the items under certain category that you choose to block. Chatting Display the items under certain category that you choose to block. Computer Display the items under certain category that you choose to block. Vigor3900 Series User’s Guide...
Page 183 Simply click the Add button. The following dialog will appear. Available parameters are listed as follows: Item Description Profile Type the name of the web category object profile. The number of the characters allowed to be typed here is 10. Vigor3900 Series User’s Guide...
Page 184 Simply check the one(s) that you don’t want the user to visit. Click it to save the configuration. Apply Cancel Click it to exit the dialog without saving the configuration. Enter all the settings and click Apply. A new Web Category Object profile has been created. Vigor3900 Series User’s Guide...
Page 185 Move your mouse to the link of Activate URL and click it. The system will guide you to access into MyVigor website. After finishing the activation for the trial version of WCF, remember to purchase “Silver Card” for WCF service from your DrayTek dealer or distributor. Vigor3900 Series User’s Guide...
Page 186: Time Object
Display the starting time of the time object profile. End Date Display the ending date of the time object profile. End Time Display the ending time of the time object profile. Weekdays Display the frequency of such time object profile. Vigor3900 Series User’s Guide...
Page 187 Specify the starting date of the time object profile. Specify the starting time of the time object profile. Start Time End Date Specify the ending date of the time object profile. End Time Specify the ending time of the time object profile. Vigor3900 Series User’s Guide...
Page 188 Specify which days in one week should perform the schedule. Click it to save the configuration. Apply Cancel Click it to exit the dialog without saving the configuration. Enter all the settings and click Apply. A new Time Object profile has been created. Vigor3900 Series User’s Guide...
Page 189: Time Group
Display the total number (8) of the object profiles to be created. Group Name Display the name of the group. Description Display the brief explanation for such group. Objects Display the time objects selected by such group. Vigor3900 Series User’s Guide...
Page 190 All the available time objects that you have added on Objects Setting>>Time Object will be seen here. Apply Click it to save the configuration. Cancel Click it to exit the dialog without saving the configuration. Enter all the settings and click Apply. Vigor3900 Series User’s Guide...
Page 191: User Management
Available parameters will be explained as follows: Item Description Mode There are two modes offered here for you to choose. Each mode will bring different filtering effect to the users Vigor3900 Series User’s Guide...
Page 192 User-based Firewall Status will start to record each authentication event of specified users including authentication failure or success, user’s IP, when or how much time the user uses, and how much rest time for the user. Vigor3900 Series User’s Guide...
Page 193 Display the ending time of the wireless station. Rest Time Display the rest time for the wireless station to browse the Internet. Delete – It is available for the administrator to turn off a specific user’s connection immediately. Vigor3900 Series User’s Guide...
Page 194: User Profile
Item Description This function allows to configure all accounts (user profiles) in Vigor3900, including PPTP/L2TP, System user, and so on. Each item will be explained as follows: Item Description Add a new profile. Edit Modify the selected profile. To edit a profile, simply select the one you want to modify and click the Edit button.
Page 195 Static IP Address Display the IP address for such user profile which accesses Internet with PPTP/L2TP connection. Use mOTP Display if mOTP is activated (enable or disable) or not. Open User Management>>User Profile. Simply click the Add button. Vigor3900 Series User’s Guide...
Page 196 Idle Timeout If the user is idle over the limitation of the timer, the network connection will be stopped for such user. By default, the Idle Timeout is set to 300 seconds. Vigor3900 Series User’s Guide...
Page 197 Usage Time is 480 minutes. System User Choose True to allow the user accessing into WUI of Vigor3900 via the username and password above. If you choose False, you can set SSL for such profile. PPTP/L2TP Click Enable to make network connection through PPTP/L2TP protocol for users who access into Internet via such profile.
Page 198: Usergroup
Display the total number (200) of the object profiles to be created. Usergroup Display the name of the user group. Enable This Profile Display the status of the profile. False means disabled; True means enabled. Member Display the user profiles under such group. Vigor3900 Series User’s Guide...
Page 199 Use the drop down list to check the user profile(s) under such group. Apply Click it to save the configuration. Cancel Click it to exit the dialog without saving the configuration. Enter all the settings and click Apply. A new User Profile has been created. Vigor3900 Series User’s Guide...
Page 200: Radius
The RADIUS server and client share a secret that is used to authenticate the messages sent between them. Both sides must be configured to use the same shared secret. Refresh Renew current web page. Apply Click it to save the configuration. Vigor3900 Series User’s Guide...
Page 201: Ldap/Active Directory
LDAP server. The default value is 389. It means “Base Distinguished Name”. Type or edit the Base DN distinguished name used to look up entries on the LDAP server. Refresh Renew current web page. Apply Click it to save the configuration. Vigor3900 Series User’s Guide...
Page 202: Application
Basically, Vigor routers are compatible with the DDNS services supplied by most popular DDNS service providers such as www.dyndns.org, www.no-ip.com, www.dtdns.com, www.changeip.com, www.dynamic- nameserver.com. You should visit their websites to register your own domain name for the router. Vigor3900 Series User’s Guide...
Page 203 The information will update immediately when the Refresh button is clicked. Profile Display the name of the DDNS. Display the connection status for the DDNS sever. Status Domain Name Display the domain name for the DDNS server. Vigor3900 Series User’s Guide...
Page 204 Display current WAN profile used by such DDNS profile. Display the name of service provider used by such profile. Service Provider Service Type Display the type for such profile. Domain Name Display the domain name of such profile. Vigor3900 Series User’s Guide...
Page 205 Domain Name field. Domain Name Type in one domain name that you applied previously. Use the drop down list to choose the desired domain. Type in the login name that you set for applying domain. User Login Name Vigor3900 Series User’s Guide...
Page 206: Gvrp
With supporting GVRP, the device can receive the VLAN information coming from other devices. Available parameters are listed as follows: Item Description Enable This Profile Check this box to enable GVRP function. Interface Choose a LAN or WAN profile. Vigor3900 Series User’s Guide...
Page 207: Upnp
Upload Enter the maximum sustained WAN upload speed in kilobits/second. Such information can be requested by UPnP clients. Select a WAN profile for UPnP protocol. External Interface Internal Interface Select a LAN profile for UPnP protocol. Vigor3900 Series User’s Guide...
Page 208 Subsequently, such a facility forwards packets from the external ports of the router to the internal ports used by the application. The reminder as regards concern about Firewall and UPnP Can't work with Firewall Software Vigor3900 Series User’s Guide...
Page 209: High Availability
Slave (backup) device could replace the Master role to take over all jobs as soon as possible. However, once the original Master is working again, the Slave would be changed to original role to stand by. Vigor3900 Series User’s Guide...
Page 210 Available parameters are listed as follows: Item Description Enable This Profile Check this box to enable UPnP function. Vigor3900 Series User’s Guide...
Page 211 Peer IP Type the IP address of the peer side. If Master is chosen as the role for Vigor3900, please type the LAN IP address of the backup device. If Backup is chosen as the role of Vigor3900, please type the LAN IP address of the master device.
Page 212: Wake On Lan
Type any one of the MAC address of the binded PCs. Wake Up Click this button to wake up the selected IP. See the following figure. The result will be shown on the box. Delete Click this button to remove all the settings. Vigor3900 Series User’s Guide...
Page 213: Vpn And Remote Access
Below shows the menu items for VPN and Remote Access. Such wizard is used to configure VPN settings for VPN client. Such wizard will guide to set the LAN-to-LAN profile for VPN dial out connection step by step. Vigor3900 Series User’s Guide...
Page 214 Create New VPN Profile – It allows you to create a new VPN LAN to LAN profile. Simply type the name in the field of Profile Name. The field of Profile Name is available only when you click this setting. Vigor3900 Series User’s Guide...
Page 215 Specify the type. Click Create New VPN Profile and type the name of the profile. Then, click Next. If you choose PPTP as the Type, you will get the following screen: Available parameters are listed as follows: Item Description Profile Display the name of the VPN profile. Vigor3900 Series User’s Guide...
Page 216 The authentication to be used by Pre-Shared Key or RSA Signature. Choose PSK or RSA for such profile. Certificate Choose a local certificate from the drop down list. Type a pre-shared key for authentication if PSK is selected Preshared Key Vigor3900 Series User’s Guide...
Page 217 The virtual IP address of the remote client, specified for this tunnel. Fill in the required information on this page and click Finish. Later, the system will ask if you want to display the new created VPN file. Vigor3900 Series User’s Guide...
Page 218 Click OK. A new profile has been created. Vigor3900 Series User’s Guide...
Page 219: Vpn Server Wizard
Such wizard is used to configure VPN settings for VPN server. Such wizard will guide to set the LAN-to-LAN profile for VPN dial in connection step by step. Open VPN and Remote Access >> VPN Server Wizard. The following dialog will appear. Available parameters are listed as follows: Item Description Vigor3900 Series User’s Guide...
Page 220 The router will authenticate the dial-in user with the protocol Protocol selected here. PAP - It means the router will attempt to authenticate dial-in users with the PAP protocol. CHAP - It means the router will attempt to authenticate Vigor3900 Series User’s Guide...
Page 221 Profile previously. Otherwise, there are no selections displayed here. Local IP / Subnet Type the IP address and subnet mask of local host. Mask Remote IP / Subnet Type the LAN IP address and LAN subnet mask for the Mask remote host. Vigor3900 Series User’s Guide...
Page 222 Type the WAN IP address for the remote host. Remote IP / Subnet Type the LAN IP address and LAN subnet mask for the Mask remote host. Local GRE IP The virtual IP address of the router, specified for this tunnel. Vigor3900 Series User’s Guide...
Page 223 The virtual IP address of the remote client, specified for this tunnel. Fill in the required information on this page and click Finish. After clicking OK, the new added VPN server profile will be displayed on the screen. Vigor3900 Series User’s Guide...
Page 224: Remote Access Control
This page display current status for VPN tunnel built with PPTP protocol. Available parameters are listed as follows: Item Description Authenticate Protocol The router will authenticate the dial-in user with the protocol Vigor3900 Series User’s Guide...
Page 225 Apply Click it to save the configuration. Cancel Click it to discard the settings configured in this page. This page display current status for VPN tunnel built with L2TP protocol. Available parameters are listed as follows: Vigor3900 Series User’s Guide...
Page 226: Ipsec General Setup
These objectives are met through the use of two traffic security protocols, the Authentication Header (AH) and the Encapsulating Security Payload (ESP), and through the use of cryptographic key management procedures and protocols. Available parameters are listed as follows: Item Description Vigor3900 Series User’s Guide...
Page 227: Vpn Profiles
Modify the selected profile. To edit a profile, simply select the one you want to modify and click the Edit button. The edit window will appear for you to modify the corresponding settings for the selected Vigor3900 Series User’s Guide...
Page 228 (ESP), and through the use of cryptographic key management procedures and protocols. Open VPN and Remote Access >> LAN to LAN. Simply click the Add button. The following dialog will appear. Click the Basic tab to configure the settings. Vigor3900 Series User’s Guide...
Page 229 WAN Profile- Choose a wan profile to be used by such profile. Local IP/Subnet Mask - Type the IP address and subnet mask of local host. Local Next Hop - Specify the gateway for WAN interface. Vigor3900 Series User’s Guide...
Page 230 Enable – Click it to enable Aggressive Mode. Disable – Click it to disable Aggressive Mode. Local Peer ID Type the ID for Vigor3900 which can be configured by the remote end. Remote Peer ID Peer ID is on behalf of the IP address while identity authenticating with remote VPN server.
Page 231 The virtual IP address of the router, specified for this tunnel. Local GRE IP Remote GRE IP The virtual IP address of the remote client, specified for this tunnel. Auto Generate Click Enable to generate the GRE key by the system Vigor3900 Series User’s Guide...
Page 232 Proposal (Dial-Out) encryption algorithms to the VPN peers, and get its feedback to find a match. IKE Phase2 Propose the local available algorithms to the VPN peers, and Authentication get its feedback to find a match. (Dial-Out) Vigor3900 Series User’s Guide...
Page 233 Enter all the settings and click Apply. A new IPSec LAN-to-LAN profile has been created. Below will guide you to create a PPTP dial-out profile for VPN connection: Open VPN and Remote Access >> VPN Profiles. Simply click the Add button. Vigor3900 Series User’s Guide...
Page 234 LAN subnet mask for the remote host. Route / NAT Mode - Specify the purpose for such profile. Apply Click it to save the configuration. Cancel Click it to exit the page without saving the configuration. Vigor3900 Series User’s Guide...
Page 235 Enter all the settings and click Apply. A new PPTP Dial-Out profile has been created. Below will guide you to create a PPTP dial-in profile for VPN connection: Open VPN and Remote Access >>VPN Profiles. Simply click the Add button. Vigor3900 Series User’s Guide...
Page 236 Click it to create a new user profile or to modify an existing For User Profile profile. See the explanation later. PPTP User Name Choose a PPTP user profile for authentication in PPTP connection. Such profile shall be created in User Management>>User Vigor3900 Series User’s Guide...
Page 237 Management>>User Profile, or click Set PPTP Dial-In For User Profile in this page to configure a new one for choosing for authentication in PPTP connection. Below shows the window of Set PPTP Dial-In For User Profile. For the configuration and detailed information, simply refer to 4.6.2 User Profile. Vigor3900 Series User’s Guide...
Page 238: Vpn Trunk Management
To build VPN load balance connection with other router, you can define the load balance rule in this page. Each item will be explained as follows: Vigor3900 Series User’s Guide...
Page 239 Display the end point specified in the Dest Port Range for this entry. Load Balance Pool Display the selection of load balance pool. Open VPN and Remote Access >>VPN TRUNK Management and click the Load Balance Rule tab. Simply click the Add button. Vigor3900 Series User’s Guide...
Page 240 Destination IP Type the destination IP address specified for this entry. Address Destination Mask Type the subnet mask address specified for the destination Destination Port Type the start point. Start Destination Port Type the end point. Vigor3900 Series User’s Guide...
Page 241 Enter all the settings and click Apply. A new profile has been created. This page allows the user to integrate several VPN IPSec profiles as a pool profile for VPN Load Balance. Each item will be explained as follows: Item Description Vigor3900 Series User’s Guide...
Page 242 Open VPN and Remote Access >>VPN TRUNK Management and click the Load Balance Pool tab. Simply click the Add button. The following dialog will appear. Type the name of the profile (e.g., LB_Pool_1, within 10 characters including digit, letter, and underline) under the Mode tab. Vigor3900 Series User’s Guide...
Page 243 Enter all the settings and click Apply. A new profile has been created. Refer to Chapter 3, How to Configure VPN Load Balance between Vigor3900 and Other Router for getting more detailed information about Load Balance application. Vigor3900 Series User’s Guide...
Page 244: Connection Management
Display the virtual network established by such VPN profile. Up Time Display the connection time of this VPN tunnel. RX (Packets) Display the total received packets through this VPN. TX (Packets) Display the total transmitted packets through this VPN. Disconnect Terminate the VPN connection. Vigor3900 Series User’s Guide...
Page 245: Certificate Management
Local certificate is created by the end user and must be signed by a trusted CA center. Vigor3900 can serve as a trusted CA and is called with “Root CA”. Therefore, any user can ask for certificate signed by Vigor3900.
Page 246: Local Certificate
This page allows users to generate certificate based on different work requests. Local certificate can be signed by itself or signed by a root CA (e.g., root CA on Vigor3900). Each item will be explained as follows: Item Description Upload Allow you to upload current configuration to the host as a CA certificate.
Page 247 Simply click the Generate button. The following dialog will appear. Available parameters are listed as follows: Item Description Certificate Name Type the name of the local certificate. ID Type The ID type for such certificate. There are four types: Vigor3900 Series User’s Guide...
Page 248 Click it to create a new local certificate based on the configuration here. Cancel Click it to exit the web page without saving the configuration. Enter all the settings and click Apply. A new generated Local Certificate has been created. Vigor3900 Series User’s Guide...
Page 249: Trusted Certificate
This page allows you to build a RootCA certificate for Vigor3900. RootCA can be deleted but not edited. If you want to modify the settings for a RootCA, please delete the one and create another one by clicking Build RootCA.
Page 250 The following dialog will appear. Available parameters are listed as follows: Item Description Display the name of the trusted CA certificate. Certificate Name Organization Unit Type a description for the organization unit. Organization Type the name of the organization. Vigor3900 Series User’s Guide...
Page 251 Click it to create a new local certificate based on the configuration here. Cancel Click it to exit the web page without saving the configuration. Enter all the settings and click Apply. A new RootCA Certificate has been created. Vigor3900 Series User’s Guide...
Page 252: Remote Certificate
Vigor3900, as a Root CA, can sign any certificate coming from end users locally or remotely. The selected user-defined certificate must be uploaded to Root CA. Also, the processing result will be displayed on this page. Each item will be explained as follows:...
Page 253: Ssl Vpn
To edit a profile, simply select the one you want to modify and click the Edit button. The edit window will appear for you to modify the corresponding settings for the selected profile. Delete Remove the selected profile. Vigor3900 Series User’s Guide...
Page 254 If you type function variation as URL, you have to type corresponding IP address in this filed. Such field must match with URL setting. Enter all the settings and click Apply. A new SSL Web Proxy profile has been created. Vigor3900 Series User’s Guide...
Page 255: Ssl Application
Edit button. The edit window will appear for you to modify the corresponding settings for the selected profile. Delete Remove the selected profile. To delete a profile, simply select the one you want to delete and click the Delete button. Vigor3900 Series User’s Guide...
Page 256 Type the IP address for this protocol. Port Specify the port used for this protocol. The default setting is 5900. Scaling Chose the percentage (100%, 80%, 60) for such application. Enter all the settings and click Apply. Vigor3900 Series User’s Guide...
Page 257 To delete a profile, simply select the one you want to delete and click the Delete button. Refresh Renew current web page. Profile Display the name of the profile that you create. Display the IP address for this protocol. IP Address Vigor3900 Series User’s Guide...
Page 258 Type the name of the profile that you create. IP Address Type the IP address for this protocol. Specify the port used for this protocol. Port Screen Size Chose the screen size for such application. Enter all the settings and click Apply. Vigor3900 Series User’s Guide...
Page 259: Online User Status
A new SSL Application profile has been created. If you have finished the configuration of SSL Web Proxy (server), users can find out corresponding settings when they access into Draytek SSL VPN portal interface. Each item will be explained as follows:...
Page 260: Bandwidth Management
Internet infrastructure. In Vigor router, DSCP (Differentiated Service Code Point) support is also taken into consideration in the design of the QoS-guaranteed control module. The QoS function handles incoming and outgoing classes independently. Users can configure incoming or outgoing separately without any impact on the other. Vigor3900 Series User’s Guide...
Page 261: Incoming Class
Available parameters are listed as follows: Item Description Mode Click Enable to enable such function. Rate Type the number as the total transmission rate for the incoming data. Refresh Renew current web page. Apply Click it to save the configuration. Vigor3900 Series User’s Guide...
Page 262 Refresh Renew current web page. QoS Policer Display the name of the QoS Policer. Display the status of QoS Policer. Mode Rate Display the rate of QoS Policer. Vigor3900 Series User’s Guide...
Page 263 Type the number of rate for such profile. Apply Click it to save the configuration and exit the page. Cancel Click it to exit the dialog without saving the configuration. Enter all the settings and click Apply. Vigor3900 Series User’s Guide...
Page 264: Incoming Filter
Display the name of the filter rule. Display the name of filter Policer. Policer Drop Display the status for the packet to be discarded or not. Reserved Display the status for the packet to be kept in the buffer or not. Vigor3900 Series User’s Guide...
Page 265 Open Bandwidth Management>> Incoming Filter. Choose one of the filter rules and click the Edit button. The following dialog will appear. Vigor3900 Series User’s Guide...
Page 266 Type the starting port number (0 - 65535) in the range of the Start destination port. Destination Port Type the ending port number (0 - 65535) in the range of the destination port. Click it to save the configuration and exit the page. Apply Vigor3900 Series User’s Guide...
Page 267: Outgoing Class
Type the rate for outgoing data. The range can be set from Rate 64000 to 10000000. Apply Click it to save the configuration and exit the page. Cancel Click it to discard the settings configured in this page. Vigor3900 Series User’s Guide...
Page 268 Display the name of the outgoing class rate profile. Status Display the status (enable or disable) of such profile. Rate Display the limitation (from 64000 to 10000000) for the rate of queue. Description Display the description for such profile. Vigor3900 Series User’s Guide...
Page 269 Such information is offered by the system automatically. It is not necessary to change it. Apply Click it to save the configuration and exit the page. Cancel Click it to exit the page without saving the configuration. Enter all the settings and click Apply. Vigor3900 Series User’s Guide...
Page 270 Edit button. The edit window will appear for you to modify the corresponding settings for the selected policy. Refresh Renew current web page. QoS Queue Display the name of the QoS queue. Weight Display the weight of the QoS queue. Vigor3900 Series User’s Guide...
Page 271 Click it to save the configuration and exit the page. Cancel Click it to exit the page without saving the configuration. Enter all the settings and click Apply. The outgoing queue 1-5 weight for QoS Policer has been modified. Vigor3900 Series User’s Guide...
Page 272: Outgoing Filter
Destination IP Display the destination IP address for the filter. Service Type Display the service type (e.g., IKE, HTTP, AUTH and etc) for the filter. Display the queue number that such filter is categorized. Queue Number Vigor3900 Series User’s Guide...
Page 273 Type the destination IP address with subnet mask value to be Destination IP applied for this filter. Service Type Choose one of the service types from the drop down list. If you want to create a new service type, simply click open the following dialog. Vigor3900 Series User’s Guide...
Page 274 Click it to save the configuration and exit the page. Cancel Click it to exit the page without saving the configuration. Enter all the settings and click Apply. The outgoing filter for QoS Policer has been created. Vigor3900 Series User’s Guide...
Page 275: Sessions Limit
Display the IP address with subnet mask of the profile. Display the maximum sessions used by the profile. Max Sessions Use Default Message Enable – Use the default message to display on the page that the user tries to access into the blocked web page.. Vigor3900 Series User’s Guide...
Page 276 Max Sessions Defines the available session number for each host in the specific range of IP addresses. If you do not set the session number in this field, the system will use the default session Vigor3900 Series User’s Guide...
Page 277: Bandwidth Limit
Each item will be explained as follows: Item Description Add a new profile. Edit Modify the selected profile. To edit a profile, simply select the one you want to modify and click the Edit button. The edit window will appear for Vigor3900 Series User’s Guide...
Page 278 Bandwidth Limit. Apply Click it to save and exit the dialog. Cancel Click it to discard the settings configured in this page. Open Bandwidth Management>>Bandwidth Limit. Simply click the Add button. The following dialog will appear. Vigor3900 Series User’s Guide...
Page 279 Apply Click it to save the configuration and exit the dialog. Cancel Click it to exit the dialog without saving the configuration. Enter all the settings and click Apply. A bandwidth limit profile has been created. Vigor3900 Series User’s Guide...
Page 280: System Maintenance
Check this box to enable such profile. ACS Server Such data must be typed according to the ACS (Auto Configuration Server) you want to link. Please refer to Auto URL/Username /Password Configuration Server user’s manual for detailed information. Vigor3900 Series User’s Guide...
Page 281: Administrator Password
WAN Profile Choose one of the WAN profiles which will be recognized by VigorACS. Port Type the port number for Vigor3900 which will be recognized by VigorACS. CPE URL Display the URL of such CPE. Periodic Status The default setting is Enable. Please set periodic time for VigorACS to send notification to CPE.
Page 282: Configuration Backup
You must select which file you want to store. Config File Name Display the configuration file name. You can change the name if required. Backup Execute the file downloading job to the computer. Vigor3900 Series User’s Guide...
Page 283 Use the Browse.. button to locate the file for uploading to the router. Restore Click it to upload the selected file to the router. After finishing the restoration, the system will ask you to reboot the router. Vigor3900 Series User’s Guide...
Page 284: Syslog / Mail Alert
Click Enable to make the firewall log recorded in the Syslog. VPN Log Click Enable to make the VPN log recorded in the Syslog. User Access Log Click Enable to make the user access log recorded in the Syslog. Vigor3900 Series User’s Guide...
Page 285 Click this button to save the configuration and exit the web page. Click it to discard the settings configured in this page. Cancel Available parameters are listed as follows: Item Description Refresh Renew the web page. Vigor3900 Series User’s Guide...
Page 286 Type the user name for authentication. User Password Type the password for authentication. Apply Click this button to save the configuration and exit the web page. Cancel Click it to discard the settings configured in this page. Vigor3900 Series User’s Guide...
Page 287: Time And Date
Click Enable to enable the daylight saving. Such feature is available for certain area. Apply Click this button to save the configuration and exit the web page. Cancel Click it to discard the settings configured in this page. Vigor3900 Series User’s Guide...
Page 288: Access Control
If you enable such function, the system can be managed by these three IP addresses via WAN. Allowed IP1 - Allowed Type the first IP address for the system administrator to login. The former box indicates an IP address allowed to login to the Vigor3900 Series User’s Guide...
Page 289: Snmp Setup
Manager Host IP Type the IP address for the manager host. Apply Click this button to save the configuration and exit the web page. Click it to discard the settings configured in this page. Cancel Vigor3900 Series User’s Guide...
Page 290: Reboot System
Reboot with Customized Click it to reboot the router using the current configuration (only the configuration settings listed and selected below). If Configurations you choose this option, Select Config File will be available for you to select. Vigor3900 Series User’s Guide...
Page 291: Firmware Upgrade
The following web page will guide you to upgrade firmware by using such page. Download the newest firmware from DrayTek's web site or FTP site. The DrayTek web site is www.DrayTek.com (or local DrayTek's web site) and FTP site is ftp.DrayTek.com.
Page 292: Diagnostics
In some cases, a user may need to know some information about the router, such as static or dynamic databases, or other routing information. The Vigor3900 supports five functions, Routing Table, ARP Cache Table, DHCP Assignment Table, NAT Sessions Table and Traffic Graph for the user to review such information.
Page 293 Display the destination IP address for various routings. Display the next hop address for such route。 Next Hop Flags Display the flag of the routing entry. Possible flags include: U (route is up) H (target is a host) G (use gateway) Vigor3900 Series User’s Guide...
Page 294: Arp Cache Table
Each complete entry in the ARP cache will be marked with Flags the flag of 0x2. Permanent entries are marked with 0x4 and published entries have the 0x8 flag. Profile Display the direction of such route represented with Vigor3900 Series User’s Guide...
Page 295 PROBE - The neighbor is no longer to be reachable, and unicast Neighbor Solicitation probes are being sent to verify Vigor3900 Series User’s Guide...
Page 296: Dhcp Table
Display the starting time that DHCP server is activated. End Date Display the end date that DHCP server is closed. End Time Display the end time that DHCP server is closed. Mac Address Display the MAC address of the static DHCP server. Vigor3900 Series User’s Guide...
Page 297: Nat Session Table
Display the destination IP address and port of remote host. Display the WAN IP address of the router. Protocol Display the protocol of such NAT session used. State Display the actual state of the TCP connection. Display how long the conntrack entry has to live. Vigor3900 Series User’s Guide...
Page 298: Traffic Graph
Recent 24 Hours – Display the information of memory operation about recent 24 hours. Recent 7 Days – Display the information of memory operation about recent 7 days. Recent 4 Weeks – Display the information of memory Vigor3900 Series User’s Guide...
Page 299 Recent 7 Days – Display the information of WAN operation about recent 7 days. Recent 4 Weeks – Display the information of WAN operation about recent 4 weeks. Network Interface – Display the information of WAN operation. Below show a graphic for CPU: Vigor3900 Series User’s Guide...
Page 300: Web Console
Click Diagnostics and click Web Console to pen the web page for typing commands used in console connection. A remote user can operate Vigor3900 from this web page without installing and opening other connection utility. This page allows you to trace the routes from router to the host. Simply type the IP address of the host in the box and click Run.
Page 301: Data Flow Monitor
Display the records with 1 hour/24 hours/7 days recently. 24 Hours / Recent 7 Days Auto Refresh Specify the interval of refresh time to obtain the latest status. The information will update immediately when the Refresh button is clicked. Vigor3900 Series User’s Guide...
Page 302: External Devices
Display the model name of the external product. Display the IP address of the external product. IP Address Connection Time Display the connection time that the external product connecting to Vigor3900. Clear Allow to delete the selected profile. Vigor3900 Series User’s Guide...
Page 303: Product Registration
Note: Only DrayTek products can be detected by this function. Please refer to section 2.3 Register Vigor Router for more detailed information. Vigor3900 Series User’s Guide...
Page 304 This page is left blank. Vigor3900 Series User’s Guide...
Page 305: Chapter 5: Trouble Shooting
Turn on the router. Make sure the ACT LED blink once per second and the correspondent LAN LED is bright. If not, it means that there is something wrong with the hardware status. Simply back to “1.3 Hardware Installation” to execute the hardware installation again. And then, try again. Vigor3900 Series User’s Guide...
Page 306 Go to Control Panel and then double-click on Network Connections. Right-click on Local Area Connection and click on Properties. Select Internet Protocol (TCP/IP) and then click Properties. Vigor3900 Series User’s Guide...
Page 307 Select Obtain an IP address automatically and Obtain DNS server address automatically. Double click on the current used Mac OS on the desktop. Open the Application folder and get into Network. On the Network screen, select Using DHCP from the drop down list of Configure IPv4. Vigor3900 Series User’s Guide...
Page 308: Pinging The Router From Your Computer
Open the Application folder and get into Utilities. Double click Terminal. The Terminal window will appear. Type ping 192.168.1.1 and press [Enter]. If the link is OK, the line of “64 bytes from 192.168.1.1: icmp_seq=0 ttl=255 time=xxxx ms” will appear. Vigor3900 Series User’s Guide...
Page 309: Checking If The Isp Settings Are Ok Or Not
Open Online Status to check current network status. Be careful to check if the settings coming from your ISP have been typed correctly or not. If there is something wrong with the configuration, please go to WAN page and choose General Setup again to modify the WAN connection. Vigor3900 Series User’s Guide...
Page 310: Backing To Factory Default Setting If Necessary
Go to System Maintenance and choose Reboot System on the web page. The following screen will appear. Choose Reboot with Factory Default Configuration and click Reboot. After few seconds, the router will return all the settings to the factory settings. Vigor3900 Series User’s Guide...
Page 311: Contacting Your Dealer
If the router settings are correct at all, and the router still does not connect to internet, please contact your ISP technical support representative to help you for configuration. Also, if the router still cannot work correctly, please contact your dealer for help. For any further questions, please send e-mail to support@draytek.com. Vigor3900 Series User’s Guide...

Draytek Vigor3900 Series User Manual

Chapter 1: Preface

Chapter 2: Initialing Settings

Chapter 3: Application and Tutorial

Chapter 4: Advanced Web Configuration

Chapter 5: Trouble Shooting

Quick Links

Troubleshooting

Related Manuals for Draytek Vigor3900 Series

Summary of Contents for Draytek Vigor3900 Series

Table of Contents