TP-Link TL-ER604W manual

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159

Ir para a página of

Bom manual de uso

As regras impõem ao revendedor a obrigação de fornecer ao comprador o manual com o produto TP-Link TL-ER604W. A falta de manual ou informações incorretas fornecidas ao consumidor são a base de uma queixa por não conformidade do produto com o contrato. De acordo com a lei, pode anexar o manual em uma outra forma de que em papel, o que é frequentemente utilizado, anexando uma forma gráfica ou manual electrónicoTP-Link TL-ER604W vídeos instrutivos para os usuários. A condição é uma forma legível e compreensível.

O que é a instrução?

A palavra vem do latim "Instructio" ou instruir. Portanto, no manual TP-Link TL-ER604W você pode encontrar uma descrição das fases do processo. O objetivo do manual é instruir, facilitar o arranque, a utilização do equipamento ou a execução de determinadas tarefas. O manual é uma coleção de informações sobre o objeto / serviço, um guia.

Infelizmente, pequenos usuários tomam o tempo para ler o manual TP-Link TL-ER604W, e um bom manual não só permite conhecer uma série de funcionalidades adicionais do dispositivo, mas evita a formação da maioria das falhas.

Então, o que deve conter o manual perfeito?

Primeiro, o manual TP-Link TL-ER604W deve conte:
- dados técnicos do dispositivo TP-Link TL-ER604W
- nome do fabricante e ano de fabricação do dispositivo TP-Link TL-ER604W
- instruções de utilização, regulação e manutenção do dispositivo TP-Link TL-ER604W
- sinais de segurança e certificados que comprovam a conformidade com as normas pertinentes

Por que você não ler manuais?

Normalmente, isso é devido à falta de tempo e à certeza quanto à funcionalidade específica do dispositivo adquirido. Infelizmente, a mesma ligação e o arranque TP-Link TL-ER604W não são suficientes. O manual contém uma série de orientações sobre funcionalidades específicas, a segurança, os métodos de manutenção (mesmo sobre produtos que devem ser usados), possíveis defeitos TP-Link TL-ER604W e formas de resolver problemas comuns durante o uso. No final, no manual podemos encontrar as coordenadas do serviço TP-Link na ausência da eficácia das soluções propostas. Atualmente, muito apreciados são manuais na forma de animações interessantes e vídeos de instrução que de uma forma melhor do que o o folheto falam ao usuário. Este tipo de manual é a chance que o usuário percorrer todo o vídeo instrutivo, sem ignorar especificações e descrições técnicas complicadas TP-Link TL-ER604W, como para a versão papel.

Por que ler manuais?

Primeiro de tudo, contem a resposta sobre a construção, as possibilidades do dispositivo TP-Link TL-ER604W, uso dos acessórios individuais e uma gama de informações para desfrutar plenamente todos os recursos e facilidades.

Após a compra bem sucedida de um equipamento / dispositivo, é bom ter um momento para se familiarizar com cada parte do manual TP-Link TL-ER604W. Atualmente, são cuidadosamente preparados e traduzidos para sejam não só compreensíveis para os usuários, mas para cumprir a sua função básica de informação

Índice do manual

  • Página 1

    TL-ER604W Wireless N Gigabit Broadband VPN Router Rev1.0.1 1910010844[...]

  • Página 2

    -I- COPYRIGHT & TRADEMARKS Specifications are subjec t to change without notice. is a registered trademark of TP-LINK TECHNOLOGIES CO., L TD. Other brands and product names are trademarks of their respective holders. No part of the specificat ions may be reproduced in any form or by any means or used to make any derivative such as translation, [...]

  • Página 3

    -II- CONTENTS Package Contents .................................................................................................................. 1 Chapter 1 About this Guide ................................................................................................... 2 1.1 Intended Re aders ...................................................[...]

  • Página 4

    -III- 3.4 Advanc ed ....................................................................................................................... ......55 3.4.1 NA T .......................................................................................................................... 55 3.4.2 T raf fic C ontrol .......................................[...]

  • Página 5

    -IV- 3.8.7 Logs ....................................................................................................................... 128 Chapter 4 Application ........................................................................................................ 130 4.1 Network Requ irement s.....................................................[...]

  • Página 6

    -1- Package Content s The following items should be found in your package:  One TL-ER604W Router  One Power Adapter  One RJ45 Ethernet Cable  Quick Installation Guide  Resource CD Note: Make sure that the package contains the above items. If any of t he listed items is damaged or missing, please contact with your distributor .[...]

  • Página 7

    -2- Chapter 1 About this Guide This User Guide contains information for set up and managem ent of TL-ER604W Router . Please read this guide carefully before operation. 1.1 Intended Readers This Guide is intended for Network Engineer and Network Administrator. 1.2 Conventions In this Guide the following conventions are used:  The Router or TL-ER6[...]

  • Página 8

    -3- Chapter 2 Introduction Thanks for choosing the SafeS tream Wireless N Gigabit Broadband VPN Router TL-ER604W. 2.1 Overview of the Router The SafeS tream Wireless N Gigabit Broadband VPN Router TL-ER604W from TP-LINK supports Wireless N speed and Gigabit wired speeds on all ports . It integrates multiple VPN protocols, high-security and high-per[...]

  • Página 9

    -4- + Possessing MAC Filtering function to block the access of illegal hosts.  Flexible T raffic Control + Featured Bandwidth Control with flexible band width management to automatically control the bandwidth of the host in bi-direction to avoid ban dwidth over occup ation, as well as optimize bandwidth usage. + Supporting Session Limit to avoid[...]

  • Página 10

    -5-  Supports Virtual Server , Port T rigger ing, ALG , S tatic Route and RIP v1/v2  Built-in Switch supporting Port Mirror , Port VLAN, Rate Control and so on  Supports to change the MAC address of LAN and W AN port  Supports Logs, S tatistics, T ime setting  Supports Remote and Web management  Supports Diagnostic (Ping/T r acert[...]

  • Página 11

    -6- 2.3 Appearance 2.3.1 Front Panel The front panel of TL-ER604W is shown as the following figure. Figure 2-1 Front Panel  LEDs LED Status Indication On The Router is powered on PWR Off The Router is powered off or power supply is abnormal Flashing The Router works properly SYS On/Off The Router works improperly On(Green) The wireless function [...]

  • Página 12

    -7-  Reset button Use the button to restore the Router to the factory defaults. With the Router powered on, use a pin to press and hold the Reset button (about 4~5 seconds). After the SYS LED goes out, release the Reset button. If the SYS LED is flashing with a high frequency about two or th ree seconds, it means the Router is restored successfu[...]

  • Página 13

    -8- Chapter 3 Configuration 3.1 Network 3.1.1 S t atus The S tatus page shows the system information, the port connection st atus and other information related to this Router . Choose the menu Network → Stat us to load the following page. Figure 3-1 S t atus 3.1.2 System Mode The TL-ER604W Router can work in th ree modes: NA T , Non-NA T and Clas[...]

  • Página 14

    -9- Figure 3-2 Network T opology - NA T Mode If your Router is connecting the two networks of di fferent areas in a large network environment with a network topology as the Figure 3-3 shown, and forwards the packets betwe en these two networks by the Routing rules, you can set it to Non-NA T mode. Figure 3-3 Network T opology – Non-NA T Mode If y[...]

  • Página 15

    -10- Figure 3-5 System Mode Y ou can select a System Mode for your R outer according to your network need.  NA T Mode NA T (Network Address T r anslation) mode allows the Router to translate private IP addresses within internal networks to public IP addresses for traf fi c transport over external networks, such as the Internet. Incoming traffic [...]

  • Página 16

    -1 1- Figure 3-6 W AN Mode  W AN Mode W AN Ports: Select the total number of W AN port s you prefer to use. The Router support one W AN and dual W AN. The Router will adjust the physical ports accordingly , which can be illustr ated on the following port sketch. Note: By default, TL-ER604W is set to work in the mode of dual W A N port s. 3.1.3.2[...]

  • Página 17

    -12- Figure 3-7 W AN – S tatic IP The following items are displayed on this screen:  St atic IP Connection T ype: Select S tatic IP if your ISP has assigned a static IP address for your computer . IP Address: Enter the IP address assigned by your ISP . If you are not clear , please consult your ISP . Subnet Mask: Enter the Subnet Mask assigned[...]

  • Página 18

    -13- Downstream Bandwid th: S pecify the b andwidth for receiving p ackets on the port. 2) Dynamic IP If your ISP (Internet Service Provider) assigns the IP address automatic ally , please choose the Dynamic IP connection type to obt ain the parameters for W AN port automatically . Figure 3-8 W AN – Dynamic IP The following items are displayed on[...]

  • Página 19

    -14- the default value if no other MTU va lue is provided by your ISP . Get IP Address b y Unicast: The broadcast requirement may not be supported by a few ISPs. Select this option if you can not get the IP address from your ISP even if with a normal network c onnection. This option is not required generally . Use the following DNS Server: Select t[...]

  • Página 20

    -15- Gateway Address: Displays the Gateway Address assigned by your ISP . Primary DNS: Displays the IP address of your ISP’ s Primary DNS. Secondary DNS: Displays the IP address of your ISP’ s Secondary DNS. 3) PPPoE If your ISP (Internet Service Provider) has provid ed the account information for the PPPoE connection, please choose the PPPoE c[...]

  • Página 21

    -16- The following items are displayed on this screen:  PPPoE Settings Connection T ype: Select PPPoE if your ISP provides xDSL Vir tual Dial-up connection. Click <Connect> to dial-up to the Internet and obtain the IP address. Click <Disconnect> to disconnec t the Internet connection and release the current IP address. Account Name: [...]

  • Página 22

    -17- ISP Address: Optional. Enter the ISP address provided by your ISP . It's null by default. Service Name: Optional. Enter the Service Name prov ided by your ISP . It's null by default. Primary DNS: Enter the IP address of y our ISP’s Primary DNS. Secondary DNS: Optional. Enter the IP address of your ISP’ s Secondary DNS. Secondary [...]

  • Página 23

    -18-  “Connected” indicates that the Router has successfully obtained the IP parameters from your ISP .  “Disconnected” indicates t hat the connection has been manually terminated or the request of the Router has no response from your ISP . Please ensure that your settings are correct and your network is connec ted well. Consult your [...]

  • Página 24

    -19- Figure 3-10 W AN - L2TP The following items are displayed on this screen:  L2TP Settings Connection T ype: Select L2TP if your ISP provides a L2TP connection. Click <Connect> to dial-up to the Internet and obtain the IP address. Click <Disconnect> to disconnect the In ternet connection and release the current IP address. Account[...]

  • Página 25

    -20- MTU: MTU (Maximum T ransmission Unit) is the maximum data unit transmitted by the physical network . It can be set in the range of 576-1460. The default MTU is 1460. It is recommended to keep the default value if no other MTU va lue is provided by your ISP . Active Mode: Y ou can select the proper Active Mode according to your need.  Manual[...]

  • Página 26

    -21-  L2TP S t atus Statu s: Displays the status of PPPoE connection.  “Disabled” indicates that the L2TP connection type is not applied.  “Connecting” indicates that t he Router is obtaining the IP parameters from your ISP .  “Connected” indicates that the Router has successfully obtained the IP p arameters from your ISP . [...]

  • Página 27

    -22- Figure 3-1 1 W AN - PPTP The following items are displayed on this screen:  PPTP Settings Connection T ype: Select PPTP if your ISP pr ovides a PPTP connection. Click <Connect> to dial-up to the Internet and obtain the IP address. Click <Disconnect> to disconnec t the Internet connection and release the current IP address. Accou[...]

  • Página 28

    -23- MTU: MTU (Maximum T ransmission Unit) is the maximum dat a unit transmitted by the physical network. It can be set in the range of 576-1460. The default MTU is 1460. It is recommended to keep the default value if no other MTU va lue is provided by your ISP . Active Mode: Y ou can select the proper Active mode according to your need.  Manual[...]

  • Página 29

    -24-  PP TP Statu s Statu s: Displays the status of PPTP connection.  “Disabled” indicates that t he PPTP connection type is no t applied.  “Connecting” indicates that t he Router is obtaining the IP parameters from your ISP .  “Connected” indicates that the Router has successfully obtained the IP p arameters from your ISP .[...]

  • Página 30

    -25- Figure 3-12 W AN – Bigpond The following items are displayed on this screen:  BigPond Settings Connection T ype: Select BigPond if your ISP prov ides a BigPond connection. Click <Connect> to dial-up to the Internet and obtain the IP address. Click <Disconnect> to disconnect the Inte rnet connection and release the current IP a[...]

  • Página 31

    -26- Auth Mode: Y ou can select the proper Active mode according to your n eed.  Manual: Select this option to manually activate or terminate the Internet connection by the <Connec t> or <Disconn ect> button. It is optimum for the dial-u p connection charged on time.  Always-on: Select this option to keep the connec tion always on[...]

  • Página 32

    -27- Note: T o ensure the BigPond connection re-established norma lly , please restart the connection at least 5 seconds after the connection is of f. 3.1.4 LAN 3.1.4.1 LAN On this page, you can configure the p a rameters for LAN port of this router . Choose the menu Network → LAN → LAN to load the following p age. Figure 3-13 LAN The following[...]

  • Página 33

    -28- Figure 3-14 DHCP Settings The following items are displayed on this screen:  DHCP Settings DHCP Server: Enable or disable the DHCP server on your Router . T o enable the Router to assign the TCP/IP paramete rs to the computers in the LAN automatically , please select Enable. St art IP Address: Enter the S tart IP address to define a range f[...]

  • Página 34

    -29- 3.1 Secondary DNS: Optional. If a Secondary DNS Server address is available, enter it. .4.3 DHCP Client On this page, you can view the information about all the DHCP clients c onnected to the Router . Choose the menu Network → LAN → DHCP Client to load the following page. Figure 3-15 DHCP Client Y ou can view the informati on of the DHCP c[...]

  • Página 35

    -30- Statu s: Activate or Inactivate the corresponding entry .  List of Reserved Address In this table, you can view the information of the entries and edit them by the Action buttons. The first entry in Figure 3-16 indicates: The IP address 192.168.0.101 is reserved for the computer with the MAC address 00-19 -66-83- 53-CF , and this entry is a[...]

  • Página 36

    -31-  MAC Address Port: Displays the port type of the Router . Current MAC Address: Displays the current MAC address of the port. MAC Clone: It’s only available for W AN port. Cl ick the <Restore Factory MAC> button to restore the MAC address to the factory default value or click the <Clone Current PC’s MAC> button to clone the M[...]

  • Página 37

    -32- The following items are displayed on this screen:  St atistics Unicast: Displays the number of normal unica st p acket s received or transmitted on the port. Broadcast: Displays the number of normal broadcast packet s received or transmitted on the port. Pause: Displays the number of flow contro l frames received or transmitted on the port.[...]

  • Página 38

    -33- Choose the menu Network → Sw itc h → Port Mirror to load the following page. Figure 3-19 Port Mirror The following items are displayed on this screen:  General Enable Port Mirror: Check the box to enable the Port Mirr or function. If unchecked, it will be disabled. Mode: Select the mode for the port mirror function. Options include: [...]

  • Página 39

    -34- Application Example: T o monitor all the traffic and analyze the network abnormity for an ent erprise’s network, please set the Port Mirror function as below: 1) Check the box before Enable Port Mirror to enable the Port Mirro r function and select the Ingress & Egress mode. 2) Select Port 3 to be the Mirroring Port to monitor all the p [...]

  • Página 40

    -35- 3.1 Port: Displays the port number . Ingress Limit: S pecify whether to enable t he Ingress Limit feature. Ingress Rate: S pecify the limit rate for the ingress packet s. Egress Limit: S pecify whether to enabl e Egress Limit feature. Egress Rate: S pecify the limit rate for the egress packe ts. The first entry in Figure 3-20 indicates: The In[...]

  • Página 41

    -36- 3.1.6.5 Port St atus On this page, you can view t he current status of each port. Choose the menu Network → Sw itc h → Port St atus to load the following page. Figure 3-22 Port S t atus 3.1.6.6 Port VLAN A VLAN (Virtual Local Area Network) is a network topology configured accord ing to a logical scheme rather than the physical layout, whic[...]

  • Página 42

    -37- VLAN: Select the desired VLAN for the port. Tips: The Port VLAN can only be created among the LAN ports. 3.2 Wireless 3.2.1 Wireless Setting 3.2.1.1 Wireless Setting On this page you can configure the basi c parameters of the wireless network. Choose the menu Wi rele ss → Wireless Setting → W ireless Setting to load the following page. Fig[...]

  • Página 43

    -38- Region: Select your region from the drop-dow n lis t. This field specifies the region where the wireless function of the Ro uter can be used. It may be illegal to use the wireless function of the Router in a region other than one of those specified in this field. If your country or region is not lis ted, please contact your local government ag[...]

  • Página 44

    -39- SSID: Enter a name for the wireless network. The same name of SSID(Service Set Identification) must be assigned to all wireless device in your network. Considering your wireless network secu rity , the default SSID is set to be TP-LINK _ XXXXXX (XXXXXX indicates the last unique six numbers of each Router ’s MAC address). This value is ca se-[...]

  • Página 45

    -40- Auth T ype: Choose the Auth type of the WPA-PSK/WPA2-PSK security on the drop-down list. The default setting is Automatic , which can select WP A-PSK (Pre-shared key of WPA) or WP A2-PSK (Pre-shared key of WPA) automatically based on the wire less station's capability and request. Encryption: Select the Encryption type , including Autom[...]

  • Página 46

    -41- Encryption: Select the Encryption type. which including Automatic , TKIP , AES . The default setting is Automatic , which can select TKIP (T emporal Key Integrity Protocol) or AES ( Advanced Encryption S tandard ) automatically based on the wireless station's capability and request. TKIP – TKIP is a security protocol us ed in the IE[...]

  • Página 47

    -42- Key Format: Hexadecimal and ASCII formats are provided . Hexadecimal format stands for any combination of hexadecimal digits (0-9, a-f, A-F) in the specified length. ASCII format stands for any combination of keyboard characters in t he specified length. Key Selected: You can select the key based on need. WEP Key : Select which of the four key[...]

  • Página 48

    -43- Figure 3- 25 Multi-SSID The following items are displayed on this screen:  General Multi-SSID: Enable or d isable the Multi-SSID. Y ou can establish multiple wireless networks if Multi-SSID is enabled. SSID Insulation: Enable or disable the SSID Insulation. If enabled, the hosts accessing to the different SSID cannot be communicate with eac[...]

  • Página 49

    -44- Security: Specify the security optio n of the wireless network. If you do not want to use wireless security, select “Disable Security”, otherwise select one Security option from the drop-down list. It’ s strongly recommended to choose one of the security options to enable security. There are three wireless security options supported by t[...]

  • Página 50

    -45- Encryption: Select the Encryption type, which including Automatic , TKIP , AES . The default setting is Automatic , which can select TKIP (T emporal Key Integrity Protocol) or AES ( Advanced Encryption S tandard ) automatically based on the wireless station's capability and request. TKIP – TKIP is a security protocol us ed in the IE[...]

  • Página 51

    -46- Encryption: Select the Encryption type. which including Automatic , TKIP , AES . The default setting is Automatic , which can select TKIP (T emporal Key Integrity Protocol) or AES ( Advanced Encryption S tandard ) automatically based on the wireless station's capability and request. TKIP – TKIP is a security protocol us ed in the IE[...]

  • Página 52

    -47- Key Selected: You can select the key based on need. WEP Key : Select which of the four keys w ill be u sed and enter the matching WEP key that you create. Make sure these values are identical on all wireless stations in your network. Key T ype: You can select the WEP key length (64-bit, or 128-bit, or 152-bit.) for encryption. "Disabled&q[...]

  • Página 53

    -48- Choose the menu Wi rele ss → Wireless Setting → WDS to load the following page. Figure 3-26 WDS Configuration  General WDS: Enable or disable the WDS function. With this f unction, the Router can bridge two or more WLANs. Scan: Click this button; you can search the AP which runs in the current channel.  Parameter SSID(to be bridged):[...]

  • Página 54

    -49- Key : If the AP your Router is going to connect needs p assword, you need to fill the key in this blank. Tips: The Multi-SSID function will be disabled if WDS is enabled. 3.2.1.4 Wireless Advanced On this page, you can configure the wireless advanced parameters. Choose the menu Wi rele ss → Wireless Setting → W ireless Advanced to load t[...]

  • Página 55

    -50- Beacon Interval: Enter a value between 40-1000 millis econds for Beacon Interval here. The beacons are the packets sent by the router to synchronize a wireless network. Beacon Interval val ue determines the time interval of the beacons. The default value is 100. RTS Threshold: Here you can specify the RTS (Request to Se nd) Threshold. If the p[...]

  • Página 56

    -51- Figure 3-28 MAC Filtering  General Each SSID can be configured the MAC Address Filt ering rules. Y ou can select a SSID in the SSID drop-down list. T o create a new SSID, please refer to 3.2.1.2 Multi-SSID . T o control some of the host s to access the wi reless network, it is recommended to select “ Enable Wireless MAC Address Filtering [...]

  • Página 57

    -52- Figure 3-29 Host S tatus  General Select a SSID, the status of t he host in this wireless network will display on the following table.  Host St atus MAC Address: Displays the MAC address of the host wh ich access the Router by wireless connection. SSID: Displays the name of the SSID to which the host connects. Current St atus: Displays t[...]

  • Página 58

    -53- Figure 3-30 Group Configuration The following items are displayed on this screen:  Group Config Group Name: S pecify a unique name for the group. Description: Give a description for the group. It's optional.  List of Group In this table, you can view the information of the Groups and edit them by the Action buttons. 3.3.2 User On th[...]

  • Página 59

    -54- Description: Give a description to the user fo r identification. It's optional.  List of User In this table, you can view the information of the Users and edit them by the Action buttons. 3.3.3 Vi ew On this page, you can configur e the User View or Group V iew . Choose the menu User Group → Vi ew to load the following page. Figure 3[...]

  • Página 60

    -55- 3.4 Group Structure: Click this button to view the tree struct ure of this group. All the members of this group will be displayed, includi ng Users and sub-Groups. The Group Names are displayed in bold. A vailable Member: Displays the Users and the Groups which can be added into this group. Selected Member: Displays the members of this group, [...]

  • Página 61

    -56- 3.4 NA T -DMZ: Enable or disable NA T -DMZ. NA T DM Z is a special service of NA T application, which can be considered as a default forwardin g rule. When NA T DMZ ( Pseudo DMZ) is enabled, all the data initiated by external network falling short of the current connections or forwarding rules will be forwarded to the preset NA T DMZ host. Hos[...]

  • Página 62

    -57- Statu s: Activate or inactivate the entry .  List of Rules In this table, you can view the information of the entries and edit them by the Action buttons. The first entry in Figure 3-34 indicates: The IP address of host1 in local network is 192.16 8.0.128 and the W AN IP address after NA T mapping is spec ified to be 222.135.48.128. The dat[...]

  • Página 63

    -58- The first entry in Figure 3-35 indicates that: This is a Multi-Ne ts NA T entry named tplink1. The subnet under the LAN port of the Router is 192.168.2.0/24 and this ent ry is activated. After the co rresponding S tatic Route entry is set, the hos ts within this subnet can access the Internet through the Router via NA T . Note: ● Multi-Nets [...]

  • Página 64

    -59- The configured entries are as follows: 2. Then set the corresponding S tatic Route entry , en ter the IP address of t he interface connecting the Router and the three layer swit ch into the Next Hop field. Choose the menu Advanced → Routi ng → S t atic Route to load the following page. The S t atic Route entry is as follows: 3.4.1.4 V irtu[...]

  • Página 65

    -60- Figure 3-36 Virtual Server The following items are displayed on this screen:  Virtual Server Name: Enter a name for Virtual Server ent ries. Up to 28 characters can be entered. Interface: Select an interface for forwarding data pa ckets. External Port: Enter the service port or port range the Router provided for accessing external network. [...]

  • Página 66

    -61- 3.4  List of Rules In this table, you can view the information of the entries and edit them by the Action buttons. The first entry in Figure 3-36 indicates: This is a V irtual Serv er entry named host, all the TCP dat a packet s from W AN1 to port 65534-65535 of the Rout er will be redirected to the port 65534-65535 of the LAN host with IP [...]

  • Página 67

    -62- T rigger Protocol: Select the protocol used for trigger port. Incoming Port: Enter the incoming port number or range of port numbers. The incoming port will open for follow-up connection after the trigger port initiates connection. Incoming Protocol: Select the protocol used for incoming port. Statu s: Activate or inactivate the entry . Note: [...]

  • Página 68

    -63- 3.4.2.1 Setup  ALG FTP ALG: Enable or disable FTP ALG . The default setting is enabled. It is recommended to keep the def ault setting if no special requirement. H.323 ALG: Enable or disable H.323 ALG . The default setting is enabled. H.323 is used for various applicat ions such as NetMeeting and V oIP . SIP ALG: Enable or disable SIP ALG .[...]

  • Página 69

    -64- The following items are displayed on this screen:  General Disable Bandwidth Control: Select this option to disable Bandwidth Control. Enable Bandwidth Control all the time: Select this option to enable Bandwidth Control all the time. Enable Bandwidth Control When: With this option selected, the Bandwidth Control will take ef fect when the [...]

  • Página 70

    -65- 3.4.2.2 Bandwid th Control On this page, you can configure the Bandwid th Control function. Choose the menu Advanced → T raffic Control → Band width Control to loa d the following page. Figure 3-40 Bandwidth Control The following items are displayed on this screen:  Bandwidth Control Rule Direction: Select the dat a stream direction for[...]

  • Página 71

    -66- Limited Bandwid th (Down): S pecify the L imited Downstream Bandwidth for this entry . Effective Time: S pecify the time for the entry to ta ke ef fect. Description: Give a description for the entry . Statu s: Activate or inactivate the entry .  List of Rules Y ou can view the informati on of the entries and edit t hem by the Action buttons[...]

  • Página 72

    -67- Figure 3-41 Session Limit The following items are displayed on this screen:  General Enable Session Limit: Check here to enable Session Limit, otherwise all the Session Limit entries will be disabled.  Session Limit Group: Select a group to define the controlled users. Max. Sessions: Enter the max. Sessions for the users. Description: Gi[...]

  • Página 73

    -68- Figure 3-42 Session List In this table, you can view the session limit inform ation of users configured with Session Limit. Click the <Refresh> button to get the latest information. 3.4.4 Load Balance In this part, you can configure the traf fic sharing mode of the W A N ports to optimize the resource utilization. 3.4.4.1 Configuration C[...]

  • Página 74

    -69- Figure 3-44 Policy Routing The following items are displayed on this screen:  General Protocol: Select the protocol for the entry in the drop-down list. If the protocol you want to set is not in the lis t, you can add it to the list on 3.4.4.4 Protocol p age. Source IP: Enter the source IP range for the entry . 0.0.0.0 - 0.0.0.0 means any I[...]

  • Página 75

    -70- 3.4  List of Rules Y ou can view the informati on of the entries and edit t hem by the Action buttons. The first entry in Figure 3-44 indicates: All the packe ts with Source IP between 192.168.0.100 and 192.168.0.199 and Destinat ion IP between 1 16.10.20.28 and 1 16.10.20.29 will be forwarded from W AN1 port, regardless of the port and pro[...]

  • Página 76

    -71- W AN Config: The W AN port in the secondary WAN list will share the traf fic for the W AN in the primary W AN list under the specified condition. Mode: Y ou can select T iming or Failover Mode. Timing: Link Backup will be enabled if the spec ified effectiv e time is reached. All the traf fic on the primary W AN will switch to the backup W AN a[...]

  • Página 77

    -72- Figure 3-46 Protocol The following items are displayed on this screen:  Protocol Name: Enter a name to indicate a protocol. The name will display in the drop-down list of Protocol on Access Rule page. Number: Enter the Number of the prot ocol in the range of 0-255.  List of Protocol Y ou can view the informati on of the entries and edit [...]

  • Página 78

    -73- Figure 3-47 Static Route The following items are displayed on this screen:  St atic Route Destination: Enter the destination hos t the route leads to. Subnet Mask: Enter the Subnet Mask of the destination network. Next Hop: Enter the gateway IP address to which the p acket should be sent next. Interface: Select the physical network interf a[...]

  • Página 79

    -74- Application Example There is a network topology as the following figure shown: If the LAN port of TL-ER604W ( with Non-NAT or Classic system mode ) is connected to LAN1 with subnet of 192.168.0.0/24, while the LAN por t of another Router R1 is c onnected to LAN2 with network of 192.168.2.0/24. Meanwhile, the W A N ports of the two routers [...]

  • Página 80

    -75- TL-ER604W supports both RIPv1 vers ion and RIPv2 version, thus you can configure the RIP version based on the actual need to improve the network performance. Choose the menu Advanced → Routi ng → RIP to load the following page. Figure 3-48 RIP The following items are displayed on this screen:  General Interface: Displays the interfaces [...]

  • Página 81

    -76- data via this port. The IP address of next hop is 116.10.1.254 and the hop count is 1. The effective time of this entry is 1 second. Note: ● RIP function cannot be set if t he Router is in NA T Mode. T o set RIP function, please change the System Mode to Routing or Full Mode. ● The RIP function of W AN port t akes effect s onl y when the C[...]

  • Página 82

    -77- 3.5 3.5 Firewall 3.5.1 Anti ARP S poofing ARP (Address Resolution Protocol) is used for analyzing and mapping IP addresses to the corresponding MAC addresses so that packet s can be delivered to their destinations correctly . ARP functio ns to translate the IP address into the corresponding MAC address and maintain an ARP T able in which the l[...]

  • Página 83

    -78- It is recommended to check all the options. Y ou s hould import the IP and MAC address of the host to IP-MAC Binding List and enable the corresponding entr y before enabling “Permit the packet s matching the IP-MAC Binding entries only”. When suffered ARP attack, the correct ARP informat ion will be sent to the device suf fering attack ini[...]

  • Página 84

    -79- Figure 3-51 ARP Scanning Enter the start and the end IP addresses into the Scanning IP Range field. Then click the <Scan> button, the Router will scan all the active host s with in the scanning range and di splay the result in the list. The entries displayed on the Li st of Scanning Result do not m ean the IP and MAC addresses are alread[...]

  • Página 85

    -80- Figure 3-52 ARP List The configurations for t he entries is the same as the confi guration of List of Scanning Re sult on 3.5.1.2 ARP Scanning p age. The unbound IP-MAC inform ation will be replaced by new IP-MAC information or be automatically removed from the list if it has not been communica ted with others for a long time. This period is r[...]

  • Página 86

    -81- Figure 3-53 Attack Defense The following items are displayed on this screen:  General Flood Defense: Flood attack is a commonly used DoS (Denial of Service) att ack, including TCP SYN, UDP , ICMP and so on. It is recommended to select all the Flood Defens e options and specify the corresponding thresholds. Keep the def ault settings if you [...]

  • Página 87

    -82- 3.5.3 MAC Filtering On this page, you can control the Internet access of local hosts by spec ifying their MAC addresses. Choose the menu Firewall → MAC Filtering → MAC Filtering to load the following page. Figure 3-54 MAC Filtering The following items are displayed on this screen:  General T o control the access to Internet for hosts in[...]

  • Página 88

    -83- Figure 3-55 URL Filtering The following items are displayed on this screen:  General T o control the access to Internet for host s in your private network, you are recommended to check the box before Enable URL Filtering and select a filtering rule based on the actual situation.  URL Filtering Rule Object: Select the range in which the U[...]

  • Página 89

    -84- Application Example: Network Requirements: Prevent the local hosts fr om accessing Internet website www .aabbcc.com and downloading the files with suffix of “exe”. Configuration Procedure: Select Keywords mode and type ”exe“ in the field, select URL mode and type “www .aabbcc.com” a s the following figure shows, and then click the [...]

  • Página 90

    -85- Figure 3-57 Access Rule The following items are displayed on this screen:  Access Rules Policy: Select a policy for the entry:  Block: When this option is selected, the p ackets obeyed the rule will not be permitted to pass through the Router .  Allow: When this option is selected, the packet s obeyed the rule will be allowed to pass [...]

  • Página 91

    -86- means any IP).  Group: Sele ct a predefined group of users. Y ou can set the group on 3.3.1 Group .  ANY : means for any users. Destination: Select the Destination IP R ange for the entries, including the following two ways:  IP/MASK: Enter an IP address or su bnet mask. ("0.0.0.0/32" means any IP is accept able).  ANY : [...]

  • Página 92

    -87- services if needed. Choose the menu Firewall → Access Control → Service to loa d the following p age. Figure 3-58 Service The following items are displayed on this screen:  Service Name: Enter a name for the service. T he name should not be more than 28 characters. The name will display in the drop-down list of Protocol on Access Rule p[...]

  • Página 93

    -88- 3.5 3.5.5 App Control .5.1 Control Rules On this page, you can enable t he Application Rules function. Choose the menu Firewall → App Control → Control Rules to load the following page. Figure 3-59 Application Rules The following items are displayed on this screen:  General Check the box before Enable Application Control to make the App[...]

  • Página 94

    -89- and Proxy . The default setting is to limit all the applications in the application list except for Basic and Proxy . Effective Time: S pecify the time for the entry to take ef fect. Description: Give a description for the entry . Statu s: Activate or inactiva te the entry .  List of Rules Y ou can view the informati on of the entries and e[...]

  • Página 95

    -90- cause the private data to be exposed to all the user s on the Internet. The VPN (Virtual Private Network) technology is developed and used to establish the private network through the public network, which can guarantee a secured data exchange. VPN adopts the tunneling technology to establish a private connection between tw o endpoints. It is [...]

  • Página 96

    -91- Figure 3-62 IKE Policy The following items are displayed on this screen:  IKE Policy Policy Name: S pecify a unique name to the I KE policy for identification and management purposes. The IKE policy can be applied to IPsec policy . Exchange Mode: Select the IKE Exchange Mode in phase 1, and en sure the remote VPN peer uses the same mode. ?[...]

  • Página 97

    -92- 3.6 Local ID: The local W AN IP will be inputted aut omatically if IP Address type is selected. If Name type is selected, e nter a name for the local device as the ID in IKE negotiation Remote ID T ype: Select the remote ID ty pe for IKE n egotiation. IP Address: uses an IP address as the ID in IKE negotiation. FQDN: uses a name as the ID. Rem[...]

  • Página 98

    -93- Figure 3-63 IKE Proposal The following items are displayed on this screen:  IKE Proposal Proposal Name: S pecify a unique name to the IKE proposal for identification and management purposes. The IKE proposal can be applied to IPsec proposal. Authentication: Select the authentication algorithm for IKE negotia tion. Options include:  MD5: [...]

  • Página 99

    -94- 3.6  DH1: 768 bits  DH2: 1024 bits  DH3: 1536 bits  List of IKE Proposal In this table, you can view the information of IKE Proposals and edit them by the action buttons. 3.6.2 IPsec IPsec (IP Security) is a set of services and protocols defined by IETF (Internet Engineering T ask Force) to provide high security for IP p ackets and[...]

  • Página 100

    -95- Figure 3-64 IPsec Policy The following items are displayed on this screen:  General Y ou can enable/disable IPsec func tion for the Router here.  IPsec Policy Policy Name: S pecify a unique name to the IPsec policy . Up to 28 characters can be entered. Mode: Select the network mode for IP sec policy . Options include:  LAN-to-LAN: Sel[...]

  • Página 101

    -96- Remote Subnet: S pecify IP address range on your r emote network to identify which PCs on the remote network are covered by this policy . It's formed by IP address and subnet mask. WA N : S pecify the local W AN port for this Policy . The "Remote Gateway" of the remote peer should be set to the IP address of this W AN port. Remo[...]

  • Página 102

    -97- Statu s: Activate or inactivate the entry .  Manual Mode IPsec Proposal: Select the IPsec Proposal. Only one proposal can be selected on Manual mode. Y ou need to first create the IPsec Proposal. Incoming SPI: S pecify the Incoming SPI (Security Parameter Index) manually . The Incoming SPI here must matc h the Outgoing SPI value at the othe[...]

  • Página 103

    -98- ESP Encry ption Key-Out: S pecify the outbound ESP Encryption Key manually if ESP protocol is used in the co rresponding IPsec Proposal. The outbound key here must match the inbound ESP encryption key at the other end of the tunnel, and vice versa.  List of IPsec Policy IPsec In this table, you can view the information of IPsec policies and[...]

  • Página 104

    -99- Security Protocol: Select the security protocol to be used. Options include:  AH: AH (Authentication Header) provides data origin authentication, data integrity and anti-replay services.  ESP: ESP (Encapsula ting Security Payload) provides data encryption in addition to origin aut hentication, data integrity , and anti-replay services. A[...]

  • Página 105

    -100- 3.6.2.3 IPsec SA This page displays the information of the IPsec SA (Security Association). Choose the menu VPN → IPsec → IPsec SA to load the following page. Figure 3-66 IPsec SA Figure 3-66 displays the connection status of the NO.1 entry in t he List of IPsec policy in Figure 3-64 . As shown in the figure, the Rout er is using W AN2 fo[...]

  • Página 106

    -101- 3.6.3.1 L2TP/PPTP T unnel On this page, you can conf igure the L2TP/PPTP VPN. Choose the menu VPN → L2TP/PPTP → L2TP/PPTP T unnel to load the following page. Figure 3-67 L2TP/PPTP T unnel The following items are displayed on this screen:  General Enable VPN-to-Internet: S pecify whether to enable VPN-to-In ternet function. If enabled, [...]

  • Página 107

    -102- Account Name: Enter the account nam e of L2TP/PPTP tunnel. It should be configured identically on server and client. Password: Enter the password of L2TP/PPT P tunnel. It should be configured identically on server and client. T unnel: Select the network mode for the tunnel. Options include:  LAN-to-LAN: Select this option w hen the L2TP/PP[...]

  • Página 108

    -103- 3.6 Statu s Activate or inactivate the entry .  List of Configurations In this table, you can view your configurations of the tunnels and edit them by the action buttons. The No.1 entry in Figure 3-67 indicates: this tunnel is encapsula ted by using L2TP . It s user name is test, the password can be configur ed, and the Router is configure[...]

  • Página 109

    -104- Figure 3-69 List of L2TP/PPTP T unnel Figure 3-69 displays the connection st atus of the NO.1 entry in the list of tunnel in Figure 3-68 . This tunnel has been successfully established. Each tunnel has a T unnel ID and a Session ID. The ID value in client corresponds to that in se rver . The connection information of this tunnel in the server[...]

  • Página 110

    -105- Figure 3-70 General The following items are displayed on this screen:  General PPPoE Server: S pecify whether to enable t he PPPoE Server function. Dial-up Access Only: S pecify whether to enabl e the Dial-up Access Only func tion. If enabled, only the Dial-in Users and the user with Excepti onal IP can access the Internet. PPPoE User Isol[...]

  • Página 111

    -106- 3.7 Authentication: Select the Authentication type. It can be Local authentication and Remote authentication. Select Loc al authentication for authentication in PPPoE server and select Remo te authentication for authentication in the remote server . Auth Protocol: Select at least one authent ication protocol for Loc al Authentication.  P A[...]

  • Página 112

    -107- 3.7.1.3 Account IP Address Range: S pecify the start and the end IP address for IP Pool. The start IP address should not exceed the end address and the IP address ranges must not overlap.  List of IP Po ol In this table, you can view the information of IP Address Pools and edit them by the Action buttons. On this page, you can c onfigure t[...]

  • Página 113

    -108- 3.7 IP Address Pool: It's available on Dynamic mode. Select an IP Address Pool to make a range to assign dynamic IPs. Max Sessions: S pecify the maximum number of se ssions for the client. The default value is 1. Expiration Date: S pecify the Expiration Date of t he acco unt. The default is 2099-1-1. Description: Enter the description fo[...]

  • Página 114

    -109- Figure 3-73 Exceptional IP The following items are displayed on this screen:  Exceptional IP IP Address Range: S pecify the start and the end IP address to make an exceptional IP address range. This range should be in the same IP range with LAN port of the Router . The start IP address should not exceed the end address and the IP address r[...]

  • Página 115

    -1 10- Choose the menu Services → E-Bulletin to load the following page. Figure 3-75 E-Bulletin The following items are displayed on this screen:  General Enable E-Bulletin: S pecify whether to enabl e el ectronic bulletin function. Interval: S pecify the interval to release the bulletin. Enable Logs: S pecify whether to log the E-Bulletin. ?[...]

  • Página 116

    - 111 - Object: Select the object of this bulletin. Options include:  ANY: The bulletin will be released to all the users and the PCs on the LAN.  Group: The bulletin will be released to the users in the selected group. You can click < > button to add a group to the selected group and click < > to remove a group from the selected [...]

  • Página 117

    -1 12- 3.7.3.1 DynDNS if the IP address of the DDNS cli ent has changed. DDNS is usually us ed for the Internet users to access the private website and FTP server , both of which are established based on W eb server . The Router , as a DDNS client, cannot provide DDN S service. Prior to using this function, be sure you have registered on the offici[...]

  • Página 118

    -1 13- 3.7.3.2 No-IP W AN Port: Displays the W AN port for which Dyndns DDNS is selected. DDNS St atus: Dis plays the current status of DDNS service  Offline: DDNS service is disabled.  Connecting: client is connecting to the server.  Online: DDNS works normally.  Authorization fails: The Account Name or Password is incorrect. Please ch[...]

  • Página 119

    -1 14- 3.7 DDNS Service: Activate or inactivate DDNS service here. W AN Port: Displays the W AN port for which No-IP DDNS is selected. DDNS St atus: Dis plays the current status of DDNS service  Offline: DDNS service is disabled.  Connecting: client is connecting to the server.  Online: DDNS works normally.  Authorization fails: The Acc[...]

  • Página 120

    -1 15- 3.7.3.4 Comexe Password: Enter the password of your DDNS account. DDNS Service: Activate or inactivate DDNS service here. W AN Port: Displays the W AN port for whic h PeanutHull DDNS is selected. Service T ype: Displays the DDNS service type, including Professional service and S tandard service. DDNS St atus: Dis plays the current status of [...]

  • Página 121

    -1 16-  Comexe DDNS Account Name: Enter the Account Name of y our DDNS account. If you have no t registered, click <Go to register> to go to the website of Comexe for register . Password: Enter the password of your DDNS account. DDNS Service: Activate or inactivate DDNS service here. W AN Port: Displays the W AN port for which Comexe DDNS [...]

  • Página 122

    -1 17- Figure 3-80 UPnP The following items are displayed on this screen:  General UPnP Funct ion: Enable or disable the UPnP function globally .  List of UPnP Mappin g After UPnP is enabled, all UPnP connection rules will be displayed in the list of UPnP Mapping. Up to 64 UPnP service connections are supported in TL-ER604W. The NO.1 entry in[...]

  • Página 123

    -1 18- Figure 3-81 Administrator The following items are displayed on this screen:  Administrator Current User Name: Enter the current user name of the Router . Current Password: Enter the current p assword of the Router . New User Name: Enter a new user name for the Router . New Password: Enter a new password for the Router . Confirm New Pass w[...]

  • Página 124

    -1 19- The following items are displayed on this screen:  General Web Management Port: Enter the Web Management Port for the Router . T elnet Management Port: Enter the T elnet Management Port for the Router . Web Idle T imeout: Enter a timeout period that the Router will log you out of the Web-based Utility af ter a specified period (W eb Idle [...]

  • Página 125

    -120- Subnet/Mask: S pecify a single IP address or network address for the hosts d esired to access the Router from external network. Statu s: Activate or inactiva te the entry .  List of Subnet In this list, you can view the Remote Management entries and edit them by the Action buttons. The first entry in Figure 3-83 indicates that: The hosts w[...]

  • Página 126

    -121- 3.8.2.2 Click the <Restore to Factory Defaults> button to rese t all configuration settings to their default values. The default IP address is 192.168. 0.1; the default login user nam e and p assword are both admin. Export and Import Choose the menu Maintenance → Management → Export and Import to load the following page. Figure 3-85[...]

  • Página 127

    -122- Figure 3-86 Reboot Click the <Reboot> button to reboot the Router . The configuration will not be lost after rebooting. The Internet connection will be temporarily interrupted while rebooting. Note: T o avoid damage, please don't turn off the device while rebooting. 3.8.2.4 Firmware Upgrade Choose the menu Maintenance → Managemen[...]

  • Página 128

    -123- Figure 3-88 License 3.8.4 S t atistics 3.8.4.1 Interface T raffic St atistics Interface T raf fic S tatistics screen displays the det ailed traf fic information of each port and extra information of W AN ports. Choose the menu Maintenance → St atistics → Interface T raffic Statistics to load the following p age. Figure 3-89 Interface T ra[...]

  • Página 129

    -124- 3.8 Packets Rx: Displays the number of p acket s received on the interface. Packets Tx: Displays the number of packets transmitted on the interface. Bytes Rx: Displays the bytes of packet s received on the interface. Bytes Tx: Displays the bytes of packet s transmitted on the interface.  Advanced W AN Information Interface: Displays the in[...]

  • Página 130

    -125-  T raffic St atistics Direction: Select the direction in the drop-dow n list to get the Flow S tatistics o f the specified direction.  IP T raffic St atistics This table displays the det ailed traf fic information of corresponding PCs. Sorted by: Select the rule for displayi ng the traf fic information. 3.8.5 Diagnostics 3.8.5.1 Diagnos[...]

  • Página 131

    -126- 3.8  Ping Destination IP/Domain: Enter destination IP address or Domain name here. Then select a port for testing, if you select “Auto”, the Router will select the interface of destination automatically . Af ter clicking <S tart> button, the Router will send Ping packet s to test the network connectivity and reachability of the h[...]

  • Página 132

    -127- dial-up status. Mode: Detect automatically or Manually . In Auto mode, gateway will be selected as destination for PING detection, DNS server of W AN port will be selected as destinati on for DNS Lookup. In Manual Mode, you can conf igure the destinati on for PING and DNS Lookup manually . Ping: Enter the destination IP for Pi ng in Manual mo[...]

  • Página 133

    -128-  Current Time Syst em T ime : Displays the current date and time of the Router . Time Zone: Displays the current time zone of the Router . Statu s: Displays the status of time capturing  Config Get GMT : When this option is selected, you can configure the time zone and the IP Address for the NTP Server . The Router will get GMT automati[...]

  • Página 134

    -129- Figure 3-94 Logs  List of Logs List of Logs displays the system l og information in log buf fer . An entry of log contains the following four part s:  Config Enable Auto-refresh: With this option selected, the page will refresh automatically every 5 seconds. Severity: Displays the severity level of the log information. Y ou can select a[...]

  • Página 135

    -130- Chapter 4 Application 4.1 Network Requirement s The company has established the server farms in the headquarters to provide the Web, Mail and FTP services for all the staf f in the headquarters an d the branch offices, and to transmit the commercial confidential data to it s p artners. The dedicated line access service wa s used by this comp [...]

  • Página 136

    -131- 4.2 Network T opology 4.3 Configurations Y ou can configure the Router via th e PC connected to the LAN port of this Router . T o log in to the Router , the IP address of your PC should be in the same subnet of the LAN por t of this Router . (The default subnet of LAN port is 192.168.0.0/24.). The IP ad dress of your PC can be obtained automa[...]

  • Página 137

    -132- Figure 4-1 System Mode 4.3.1.2 Internet Connection Configure the St atic IP connection type for the W A N1 and W AN2 ports of the Router . Choose the menu Netw ork → WA N → WA N 1 to load the following page. Select the St atic IP connection type and enter the IP address , Subnet Mask and Default Gateway provided by your ISP . Set both the[...]

  • Página 138

    -133- Figure 4-3 Link Backup 4.3.2 VPN Setting T o enable the hosts in the remote branch of fice (W AN: 1 16.31.85.133, LAN: 172.31.10.1) to access the servers in the headquarters, you can create the VPN tunnel via the TP-LINK VPN routers between t he headquarters and the remote branch office to guar antee a secured communication. The following tak[...]

  • Página 139

    -134- Click the <Add> button to apply . Figure 4-4 IKE Proposal  IKE Policy Choose the menu VPN → IKE → IKE Policy to load the configuration p age. Settings: Policy Name: IKE_1 Exchange Mode: Main IKE Proposal: proposal_I KE_1 (you just created) Pre-shared Key: aabbccddee SA Lifetime: 3600 DPD: Enable DPD Interval: 10 Click the <Add[...]

  • Página 140

    -135- Figure 4-5 IKE Policy Tips: For the VPN Router in the remote branch office, t he IKE settings should be the same as the Router in the headquarters. 2) IPsec Setting T o configure the IPsec function, you sh ould create an IPsec Proposal firstly .  IPsec Proposal Choose the menu VPN → IPsec → IPsec Proposal to load the following page. Se[...]

  • Página 141

    -136- Figure 4-6 IPsec Proposal  IPsec Policy Choose the menu VPN → IPsec → IPsec Policy to load the configuration p age. Settings: IPsec: Enable Policy Name: IPsec_1 S tatus: Activate Mode LAN-to-LAN Local Subnet: 192.168.0.0/24 Remote Subnet: 172.31.10.0/24 WA N : WA N1 Remote Gateway: 1 16.31.85.133 Exchange Mode IKE IKE Policy: IKE_1 IPs[...]

  • Página 142

    -137- Figure 4-7 IPsec Policy Tips: For the VPN Router in the remote branch office, the IPsec settings should be consistent with the Router in the headquarters. The Remote Gateway of the remote Router should be set to the IP address of the Router in the headquarters. After the IPsec VPN tunnel of the two peers is est ablished successfully , y ou ca[...]

  • Página 143

    -138-  L2TP/PPTP T unnel Choose the menu VPN → L2TP/PPTP → L2TP/PPTP T unnel to load the following page. Check the box of Enable VPN-to-Internet to allow the PPTP clients to access the local enterprise network and the Internet. Then continue with the following settings for the PPTP T unnel. Settings: L2TP/PPTP: Enable Protocol: PPTP Mode: Se[...]

  • Página 144

    -139- 4.3.3 Network Management T o manage the enterprise network effectively and forbid the Hosts within the IP range of 192.168.0.30-192.168.0.50 to use IM/P2P application, you can set up a User Group and specify the network bandwidth limit and session limit for this group. The det ailed configur ations are as follows. 4.3.3.1 User Group Create a [...]

  • Página 145

    -140- Action: Add S tart IP Address: 192.168.0.30 End IP Address: 192.168.0.50 Prefix Username: User S tart No.: 1 S tep: 1 Click the OK button to add the Users in bulk. Figure 4-10 User Config - Batch  View Choose the menu User Group → Vie w to load the configuration page. Add all the Users you just created into the Group 1 and click the <[...]

  • Página 146

    -141- Figure 4-1 1 App Rules 4.3.3.3 Bandwid th Control T o enable Bandwidth Control, you s hould configure the total bandwid th of interfaces and the detailed bandwidth control rule first. 1) Enable Bandwid th Control Choose the menu Advanced → T raffic Control → Setup to load the configuration page. Check the box before Enable Bandwidt h Cont[...]

  • Página 147

    -142- 3) Bandwidth Control Rule Choose the menu Advanced → T raffic Control → Bandwid th Control to load the configuration p age. Then continue with the following settings: Settings: Direction: LAN -> W AN1 Group: group1 Mode: Individual Guaranteed Bandwidth (Up/Down): 100 Limited Bandwidth (Up/Down): 800 Effective T ime: Keep the default va[...]

  • Página 148

    -143- Figure 4-15 Session Limit 4.3.4 Network Security Y ou can enable the IP-MAC Binding f unction to defend the ARP attack fr om local or public network and enable Sending GARP packet s function to defend ARP attack. Moreover , you can enable DoS Defense function to implement fl ood defense and Packet Anomaly Def ense. Moreover , you can ena ble [...]

  • Página 149

    -144- Choose the menu Firewall → Anti ARP S poofing → IP-MAC Binding to load the configuration p age. Select the ARP entries needed to be bound or c lick the <Select All> button, and then click the <Import>button. The ARP List will di splay as the following figure shows. Figure 4-18 ARP List 2) Set IP-MAC Binding Entry Manually Conf[...]

  • Página 150

    -145- Choose the menu Firewall → Anti ARP Spoofin g → ARP Scanning to lo ad the configuration page. Enter the default gateway of the W AN port such as 58.51.128.254 in t he Scanning Range field and click the <Scan> button, the MAC address of the W A N port will display in the Scanning Result table. After obt aining the MAC address of W AN[...]

  • Página 151

    -146- 4.3.4.4 T raffic Monitoring 1) Port Mirror Choose the menu Network → Sw itch → Port Mirror to load the configuration page. Check the bo x before Enable Port Mirror and select the Ingress&Egress mode. Select the Port 5 for the Mirroring Port and the Port 3 and the Port 4 for the Mirrored ports. Click the <Save> button to apply . [...]

  • Página 152

    -147- Figure 4-23 IP T raf fic S tatistics After all the above step s, the enterpris e network will be operated based on planning.[...]

  • Página 153

    -148- Appendix A Hardware Specifications General S tandards IEEE 802.3, IEEE 802.3u, IEEE 802. 3ab, IEEE 802.3x, IEEE 802.1 1b, IEEE 802.1 1g and IEEE 802.1 1n, TCP/ IP , DHCP , ICMP , NA T , PPPoE, SNTP , HTTP , DNS, L2TP , PPTP , IPsec One fixed 10/100/1000Mbps Auto -Negotiation W AN RJ45 port (Auto MDI/MDIX) One interchangeable 10/100/1000Mbp s [...]

  • Página 154

    -149- Appendix B F AQ Q1. What can I do if I cannot access the web-based configuration page? 1. For the first login, pl ease try the following steps: 1) Make sure the cable is well connected to t he LAN port of the Router . The corresponding LED should flash or be solid light. 2) Make sure the IP address of your PC is set in the same subnet address[...]

  • Página 155

    -150- Q3: What can I do if the Router with the re mote management function enabled cannot be accessed by the remote computer? 1. Make sure that the IP address of the remote com puter is in the subnet allowed to remotely access the router . 2. If the router ’s management por t has been modified, please log in to the Router with the new address, su[...]

  • Página 156

    -151- Appendix C Glossary Glossary Description ALG ( Application Layer Gateway ) Application Level Gateway (A LG) is application specifi c translation agent that allows an application on a host in one address realm to connect to its counterpart running on a host in different realm transparently . ARP ( Address Resolution Protocol ) Internet[...]

  • Página 157

    -152- Glossary Description H.323 H.323 allows dissimilar communica tion devices to communicate with each other by using a standardized communication protocol. H.323 defines a comm on set of CODECs, call setup and negotiating procedures, and basic data transport methods. H HTTP ( Hypertext Transfer Protocol ) The protocol used by Web browsers an[...]

  • Página 158

    -153- Glossary Description MAC address ( Media Access Control address ) S tandardized data link layer address that is required for every port or device that connects to a LAN. Other devices in th e network use these addresses to lo cate specific ports in the network and to create and update routing tables and data structures. MAC addresses are [...]

  • Página 159

    -154- Glossary Description Network protocol ) log in to remote systems and us e resources as if they were connected to a local system. UDP ( User Datagram Protocol ) UDP is a simple protocol that exchanges datagram without acknowledgments or guaranteed del ivery, requiri ng that error processing and retransmission be handled by other protocol[...]