Handleiding Draytek Vigor 2620 LTE series (pagina 602 van 610) (Engels)

Vigor2620 Series User’s Guide

ii

Vigor2620 LTE Series

LTE Router

User’s Guide

Version: 1.01

Firmware Version: V3.8.11

(For future update, please visit DrayTek web site)

Date: April 26, 2019

Vigor2620 Series User’s Guide

iii

Copyrights

reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language without

written permission from the copyright holders.

Trademarks

The following trademarks are used in this document:

 Microsoft is a registered trademark of Microsoft Corp.

 Windows, Windows 95, 98, Me, NT, 2000, XP, Vista, 7 and Explorer are trademarks of Microsoft Corp.

 Apple and Mac OS are registered trademarks of Apple Inc.

 Other products may be trademarks or registered trademarks of their respective manufacturers.

Safety Instructions



Read the installation guide thoroughly before you set up the router.

 The router is a complicated electronic unit that may be repaired only be authorized and qualified personnel.

Do not try to open or repair the router yourself.

 Do not place the router in a damp or humid place, e.g. a bathroom.

 The router should be used in a sheltered area, within a temperature range of +5 to +40 Celsius.

 Do not expose the router to direct sunlight or other heat sources. The housing and electronic components

may be damaged by direct sunlight or heat sources.

 Do not deploy the cable for LAN connection outdoor to prevent electronic shock hazards.

 Keep the package out of reach of children.

 When you want to dispose of the router, please follow local regulations on conservation of the environment.

Warranty

 We warrant to the original end user (purchaser) that the router will be free from any defects in workmanship

or materials for a period of two (2) years from the date of purchase from the dealer. Please keep your

purchase receipt in a safe place as it serves as proof of date of purchase. During the warranty period, and upon

proof of purchase, should the product have indications of failure due to faulty workmanship and/or materials,

we will, at our discretion, repair or replace the defective products or components, without charge for either

parts or labor, to whatever extent we deem necessary tore-store the product to proper operating condition.

Any replacement will consist of a new or re-manufactured functionally equivalent product of equal value, and

will be offered solely at our discretion. This warranty will not apply if the product is modified, misused,

tampered with, damaged by an act of God, or subjected to abnormal working conditions. The warranty does

not cover the bundled or licensed software of other vendors. Defects which do not significantly affect the

usability of the product will not be covered by the warranty. We reserve the right to revise the manual and

online documentation and to make changes from time to time in the contents hereof without obligation to

notify any person of such revision or changes.

Be a Registered Owner

 Web registration is preferred. You can register your Vigor router via http://www.DrayTek.com.

Firmware & Tools Updates

 Due to the continuous evolution of DrayTek technology, all routers will be regularly upgraded. Please consult

the DrayTek web site for more information on newest firmware, tools and documents.

More update, please visit www.draytek.com.

Vigor2620 Series User’s Guide

i

v

T

a

b

l

e

o

f

C

o

n

t

e

n

t

s

Part I Installation.................................................................................................................i

I-1 Introduction ................................................................................................................................... 1

I-1-1 Indicators and Connectors .................................................................................................. 2

I-2 Hardware Installation .................................................................................................................... 6

I-2-1 Network Connection via LTE............................................................................................... 6

I-2-2 Network Connection via DSL .............................................................................................. 7

I-2-3 Wall-Mounted Installation .................................................................................................... 8

I-3 Accessing Web Page.................................................................................................................... 9

I-4 Changing Password.....................................................................................................................11

I-5 Dashboard................................................................................................................................... 12

I-5-1 Virtual Panel ...................................................................................................................... 13

I-5-2 Name with a Link............................................................................................................... 13

I-5-3 Quick Access for Common Used Menu ............................................................................ 14

I-5-4 GUI Map ............................................................................................................................ 15

I-5-5 Web Console..................................................................................................................... 16

I-5-6 Config Backup ................................................................................................................... 16

I-5-7 Logout................................................................................................................................ 17

I-5-8 Online Status..................................................................................................................... 17

I-5-8-1 Physical Connection ......................................................................17

I-5-8-2 Virtual WAN ...............................................................................19

I-6 Quick Start Wizard ...................................................................................................................... 20

I-6-1 LTE.................................................................................................................................... 21

I-6-2 WAN1 (ADSL/VDSL2)....................................................................................................... 23

I-6-3 WAN2 (Ethernet) ............................................................................................................... 29

I-7 Service Activation Wizard ........................................................................................................... 38

I-8 Registering Vigor Router............................................................................................................. 40

Part II Connectivity ..........................................................................................................43

II-1 LTE............................................................................................................................................. 44

Web User Interface.................................................................................................................... 45

II-1-1 General Settings............................................................................................................... 45

II-1-1-1 SMS Quota.................................................................................45

II-1-1-2 SMS Inbox..................................................................................46

II-1-2 SMS Inbox........................................................................................................................ 47

II-1-3 Send SMS ........................................................................................................................ 50

II-1-4 Router Commands ........................................................................................................... 51

II-1-5 Status ............................................................................................................................... 53

II-2 WAN........................................................................................................................................... 55

Web User Interface.................................................................................................................... 56

II-2-1 General Setup .................................................................................................................. 56

Vigor2620 Series User’s Guide

v

II-2-1-1 WAN1.......................................................................................56

II-2-1-2 LTE .........................................................................................58

II-2-2 Internet Access................................................................................................................. 59

II-2-2-1 Details Page for PPPoE/PPPoA in WAN1 (Physical Mode: ADSL)..................60

II-2-2-2 Details Page for MPoA/Static or Dynamic IP in WAN1 (Physical Mode: ADSL) .64

II-2-2-3 Details Page for PPPoE in WAN1 (Physical Mode: VDSL2) .........................68

II-2-2-4 Details Page for MPoA/Static or Dynamic IP in WAN1 (Physical Mode: VDSL2) 71

II-2-2-5 Details Page for PPPoE in WAN2 (Physical Mode: Ethernet) ......................74

II-2-2-6 Details Page for Static or Dynamic IP in WAN2 (Physical Mode: Ethernet).....76

II-2-2-7 Details Page for PPTP ...................................................................80

II-2-2-8 Details Page for IPv6 – Offline.........................................................82

II-2-2-9 Details Page for IPv6 – PPP .............................................................82

II-2-2-10 Details Page for IPv6 – TSPC ..........................................................83

II-2-2-11 Details Page for IPv6 – AICCU.........................................................85

II-2-2-12 Details Page for IPv6 – DHCPv6 Client...............................................86

II-2-2-13 Details Page for IPv6 – Static IPv6 ...................................................87

II-2-2-14 Details Page for IPv6 – 6in4 Static Tunnel..........................................88

II-2-2-15 Details Page for IPv6 – 6rd ............................................................90

II-2-3 Multi-PVC/VLAN............................................................................................................... 92

Application Notes....................................................................................................................... 97

A-1 How to configure IPv6 on WAN interface? ................................................97

II-3 LAN .......................................................................................................................................... 102

Web User Interface.................................................................................................................. 104

II-3-1 General Setup ................................................................................................................ 104

II-3-1-1 Details Page for LAN1 – Ethernet TCP/IP and DHCP Setup...................... 106

II-3-1-2 Details Page for LAN2 ................................................................. 108

II-3-1-3 Details Page for IP Routed Subnet .................................................. 110

II-3-1-4 Details Page for LAN IPv6 Setup..................................................... 112

II-3-1-5 Advanced DHCP Options .............................................................. 115

II-3-2 VLAN .............................................................................................................................. 117

II-3-3 Bind IP to MAC............................................................................................................... 120

II-4 NAT .......................................................................................................................................... 124

Web User Interface.................................................................................................................. 125

II-4-1 Port Redirection.............................................................................................................. 125

II-4-2 DMZ Host ....................................................................................................................... 129

II-4-3 Open Ports ..................................................................................................................... 132

II-4-4 ALG................................................................................................................................. 134

II-5 Applications.............................................................................................................................. 136

Web User Interface.................................................................................................................. 137

II-5-1 Dynamic DNS................................................................................................................. 137

II-5-2 Schedule......................................................................................................................... 140

II-5-3 RADIUS.......................................................................................................................... 143

II-5-4 UPnP .............................................................................................................................. 144

II-5-5 IGMP............................................................................................................................... 145

II-5-5-1 General Setting ........................................................................ 145

II-5-5-2 Working Group ......................................................................... 146

II-5-6 SMS Alert Service .......................................................................................................... 147

Application Notes..................................................................................................................... 148

Vigor2620 Series User’s Guide

vi

A-1 How to use DrayDDNS? ..................................................................... 148

A-2 How to Configure Customized DDNS?.................................................... 153

II-6 Routing..................................................................................................................................... 157

Web User Interface.................................................................................................................. 158

II-6-1 Static Route.................................................................................................................... 158

Part III Wireless LAN......................................................................................................163

III-1 Wireless LAN .......................................................................................................................... 164

Web User Interface.................................................................................................................. 168

III-1-1 Wireless Wizard............................................................................................................. 168

III-1-2 General Setup ............................................................................................................... 171

III-1-3 Security.......................................................................................................................... 173

III-1-4 Access Control .............................................................................................................. 175

III-1-5 WPS............................................................................................................................... 176

III-1-6 WDS .............................................................................................................................. 178

III-1-7 Advanced Setting .......................................................................................................... 181

III-1-8 AP Discovery................................................................................................................. 184

III-1-9 Station List..................................................................................................................... 185

Part IV VPN.....................................................................................................................187

IV-1 VPN and Remote Access ....................................................................................................... 188

Web User Interface.................................................................................................................. 189

IV-1-1 VPN Client Wizard ........................................................................................................ 189

IV-1-2 VPN Server Wizard....................................................................................................... 195

IV-1-3 Remote Access Control ................................................................................................ 199

IV-1-4 PPP General Setup....................................................................................................... 200

IV-1-5 IPsec General Setup..................................................................................................... 202

IV-1-6 IPsec Peer Identity........................................................................................................ 204

IV-1-7 Remote Dial-in User...................................................................................................... 206

IV-1-8 LAN to LAN ................................................................................................................... 209

IV-1-9 Connection Management.............................................................................................. 219

IV-2 SSL VPN................................................................................................................................. 220

Web User Interface.................................................................................................................. 221

IV-2-1 General Setup............................................................................................................... 221

IV-2-2 User Account................................................................................................................. 222

IV-2-3 SSL Portal Online User................................................................................................. 226

IV-3 Certificate Management.......................................................................................................... 227

Web User Interface.................................................................................................................. 228

IV-3-1 Local Certificate ............................................................................................................ 228

IV-3-2 Trusted CA Certificate................................................................................................... 232

IV-3-3 Certificate Backup......................................................................................................... 234

Part V Security ...............................................................................................................235

Vigor2620 Series User’s Guide

vii

V-1 Firewall..................................................................................................................................... 236

Web User Interface.................................................................................................................. 238

V-1-1 General Setup................................................................................................................ 238

V-1-2 Filter Setup..................................................................................................................... 243

V-1-3 DoS Defense.................................................................................................................. 252

V-1-3-1 DoS Defense............................................................................. 252

V-1-3-2 Spoofing Defense....................................................................... 255

Application Notes..................................................................................................................... 256

A-1 How to Configure Certain Computers Accessing to Internet ........................ 256

V-2 Central Security Management (CSM)...................................................................................... 260

Web User Interface.................................................................................................................. 261

V-2-1 APP Enforcement Profile ............................................................................................... 261

V-2-2 URL Content Filter Profile .............................................................................................. 263

V-2-3 Web Content Filter Profile.............................................................................................. 267

Application Notes..................................................................................................................... 271

A-1 How to Create an Account for MyVigor ................................................. 271

A-2 How to Block Facebook Service Accessed by the Users via Web Content Filter / URL

Content Filter.................................................................................... 276

Part VI Management ......................................................................................................283

VI-1 System Maintenance.............................................................................................................. 284

Web User Interface.................................................................................................................. 285

VI-1-1 System Status............................................................................................................... 285

VI-1-2 TR-069 .......................................................................................................................... 287

VI-1-3 Administrator Password................................................................................................ 289

VI-1-4 User Password.............................................................................................................. 290

VI-1-5 Configuration Backup.................................................................................................... 292

VI-1-6 Syslog/Mail Alert ........................................................................................................... 294

VI-1-7 Time and Date............................................................................................................... 296

VI-1-8 SNMP............................................................................................................................ 297

VI-1-9 Management ................................................................................................................. 299

VI-1-10 Panel Control .............................................................................................................. 302

VI-1-11 Self-Signed Certificate ................................................................................................ 303

VI-1-12 Reboot System............................................................................................................ 305

VI-1-13 Firmware Upgrade ...................................................................................................... 306

VI-1-14 Activation..................................................................................................................... 307

VI-2 Bandwidth Management......................................................................................................... 309

Web User Interface.................................................................................................................. 311

VI-2-1 Sessions Limit............................................................................................................... 311

VI-2-2 Bandwidth Limit............................................................................................................. 313

VI-2-3 Quality of Service.......................................................................................................... 315

Application Notes..................................................................................................................... 322

A-1 How to Optimize the Bandwidth through QoS Technology .......................... 322

Vigor2620 Series User’s Guide

viii

VI-3 Central Management (AP)...................................................................................................... 326

Web User Interface.................................................................................................................. 327

VI-3-1 Dashboard..................................................................................................................... 327

VI-3-2 Status............................................................................................................................ 328

VI-3-3 WLAN Profile................................................................................................................. 329

VI-3-4 AP Maintenance............................................................................................................ 334

VI-3-5 Traffic Graph ................................................................................................................. 335

VI-3-6 Temperature Sensor..................................................................................................... 336

VI-3-7 Event Log...................................................................................................................... 336

VI-3-8 Total Traffic ................................................................................................................... 337

VI-3-9 Station Number ............................................................................................................. 337

VI-3-10 Load Balance .............................................................................................................. 338

Part VII Others................................................................................................................341

VII-1 Objects Settings..................................................................................................................... 342

Web User Interface.................................................................................................................. 343

VII-1-1 IP Object ...................................................................................................................... 343

VII-1-2 IP Group....................................................................................................................... 347

VII-1-3 IPv6 Object................................................................................................................... 348

VII-1-4 IPv6 Group................................................................................................................... 350

VII-1-5 Service Type Object..................................................................................................... 351

VII-1-6 Service Type Group ..................................................................................................... 353

VII-1-7 Keyword Object............................................................................................................ 355

VII-1-8 Keyword Group ............................................................................................................ 357

VII-1-9 File Extension Object................................................................................................... 358

VII-1-10 SMS Service Object................................................................................................... 360

VII-1-11 Notification Object...................................................................................................... 363

VII-1-12 String Object .............................................................................................................. 365

Application Notes..................................................................................................................... 366

A-1 How to Send a Notification to Specified Phone Number via SMS Service in WAN

Disconnection .................................................................................... 366

Part VIII Troubleshooting ..............................................................................................371

VIII-1 Diagnostics ........................................................................................................................... 372

Web User Interface.................................................................................................................. 373

VIII-1-1 Dial-out Triggering....................................................................................................... 373

VIII-1-2 Routing Table.............................................................................................................. 374

VIII-1-3 ARP Cache Table ....................................................................................................... 375

VIII-1-4 IPv6 Neighbour Table ................................................................................................. 376

VIII-1-5 DHCP Table................................................................................................................ 377

VIII-1-6 NAT Sessions Table ................................................................................................... 378

VIII-1-7 DNS Cache Table ....................................................................................................... 379

Vigor2620 Series User’s Guide

ix

VIII-1-8 Ping Diagnosis ............................................................................................................ 380

VIII-1-9 Data Flow Monitor....................................................................................................... 381

VIII-1-10 Traffic Graph ............................................................................................................. 384

VIII-1-11 Trace Route .............................................................................................................. 385

VIII-1-12 IPv6 TSPC Status ..................................................................................................... 386

VIII-1-13 DSL Status................................................................................................................ 386

VIII-1-14 DoS Flood Table....................................................................................................... 387

VIII-2 Checking If the Hardware Status Is OK or Not..................................................................... 389

VIII-3 Checking If the Network Connection Settings on Your Computer Is OK or Not................... 390

VIII-4 Pinging the Router from Your Computer .............................................................................. 393

VIII-5 Checking If the ISP Settings are OK or Not ......................................................................... 395

VIII-6 Backing to Factory Default Setting If Necessary.................................................................. 396

VIII-7 Contacting DrayTek .............................................................................................................. 397

Part IX Telnet Commands..............................................................................................399

Accessing Telnet of Vigor2620....................................................................................................... 400

Index ...............................................................................................................................593

P

a

r

t

I

n

s

t

a

l

a

t

i

o

n

This part will introduce Vigor router and guide to

install the device in hardware and software.

Vigor2620 Series User’s Guide

1

I

-

1

I

n

t

r

o

d

u

c

t

i

o

n

T

h

i

s

i

s

a

g

e

n

e

r

i

c

I

n

t

e

r

n

a

t

i

o

n

a

l

v

e

r

s

i

o

n

o

f

t

h

e

u

s

e

r

g

u

i

d

e

.

S

p

e

c

i

f

i

c

a

t

i

o

n

,

c

o

m

p

a

t

i

b

i

l

i

t

y

a

n

d

f

e

a

t

u

r

e

s

v

a

r

y

b

y

r

e

g

i

o

n

.

F

o

r

s

p

e

c

i

f

i

c

u

s

e

r

g

u

i

d

e

s

u

i

t

a

b

l

e

f

o

r

y

o

u

r

e

g

i

o

n

o

r

p

r

o

d

u

c

t

,

p

l

e

a

s

e

c

o

n

t

a

c

t

l

o

c

a

l

d

i

s

t

r

i

b

u

t

o

r

.

Vigor2620 LTE series is a router equipped with an LTE module which allows you to access the

Internet via a SIM card.

It integrates IP layer QoS, NAT session/bandwidth management to help users control works

well with large bandwidth. By adopting hardware-based VPN platform and hardware

encryption of AES/DES/3DES, the router increases the performance of VPN greatly, and offers

several protocols (such as IPSec/PPTP/L2TP) with VPN tunnels.

The object-based design used in SPI (Stateful Packet Inspection) firewall allows users to set

firewall policy with ease. CSM (Content Security Management) provides users control and

management in IM (Instant Messenger) and P2P (Peer to Peer) more efficiency than before. By

the way, DoS/DDoS prevention and URL/Web content filter strengthen the security outside

and control inside. Object-based firewall is flexible and allows your network be safe.

On the Wireless-equipped models each of the wireless SSIDs can also be grouped within one of

the VLANs.

Vigor2620 series provides two-level management to simplify the configuration of network

connection. The user mode allows user accessing into WEB interface via simple configuration.

However, if users want to have advanced configurations, they can access into WEB interface

through admin mode.

Vigor2620 Series User’s Guide

2

I

-

1

-

1

I

n

d

i

c

a

t

o

r

s

a

n

d

C

o

n

e

c

t

o

r

s

Before you use the Vigor router, please get acquainted with the LED indicators and

connectors first.

V

i

g

o

r

2

6

2

0

L

/

V

i

g

o

r

2

6

2

0

L

e

LED Status Explanation

Off The router is powered off.

Blinking The router is powered on and running normally.

On The router is ready to access Internet.

Off The router is not ready to access Internet.

Blinking Slowly: The DSL connection is ready.

Quickly: The DSL connection is establishing.

On Physical line has been connected.

Blinking The connection is training.

On The LAN port is connected.

(for Vigor2620L)

Blinking The data is transmitting through the LAN port.

On The LAN port is connected.

(for

Vigor2620Le)

Blinking The data is transmitting through the LAN port.

On LTE device is connected and ready for use.

Off LTE device is not detected, or has serious problem

(e.g., no SIM card, SIM pin error, SIM deactivated, and

etc.).

Blinking Vigor device performs initial access procedure.

On SIM card is inserted into the slot and detected by Vigor

device.

(for Vigor2620L)

Blinking No SIM card in detected.

Vigor2620 Series User’s Guide

3

Vigor2620L,

Vigor2620Le,

Interface Description

Factory Reset

Restore the default settings. Usage: Turn on the router (ACT LED is

blinking). Press the hole and keep for more than 5 seconds. When you

see the ACT LED begins to blink rapidly than usual, release the button.

Then the router will restart with the factory default configuration.

DSL

Connecter for accessing the Internet.

SIM2/SIM1

SIM card slot(s).

P2-P1

(Vigor2620L)

Connecters for local network devices.

P4-P1

(Vigor2620Le)

Connecters for local network devices.

ON/OFF Power Switch.

PWR Connecter for a power adapter.

Vigor2620 Series User’s Guide

4

V

i

g

o

r

2

6

2

0

L

n

/

V

i

g

o

r

2

6

2

0

L

n

e

LED Status Explanation

Off The router is powered off.

Blinking The router is powered on and running normally.

On The router is ready to access Internet.

Off The router is not ready to access Internet.

Blinking Slowly: The DSL connection is ready.

Quickly: The DSL connection is establishing.

On Physical line has been connected.

Blinking The connection is training.

On The LAN port is connected.

(for

Vigor2620Ln)

Blinking The data is transmitting through the LAN port.

On The LAN port is connected.

(for

Vigor2620Lne)

Blinking The data is transmitting through the LAN port.

On LTE device is connected and ready for use.

Off LTE device is not detected, or has serious problem

(e.g., no SIM card, SIM pin error, SIM deactivated, and

etc.).

Blinking Vigor device performs initial access procedure.

On SIM card is inserted into the slot and detected by Vigor

device.

(for

Vigor2620Ln)

Blinking No SIM card in detected.

On Vigor device is ready for sending wireless signal.

Off No wireless signal is sent out.

Blinking The data is transmitting via wireless connection.

Vigor2620 Series User’s Guide

5

Vigor2620Ln,

Vigor2620Lne,

Interface Description

Wireless LAN

ON/OFF/WPS

 Press the button and release it within 2 seconds. When the wireless

function is ready, the green LED will be on.

 Press the button and release it within 2 seconds to turn off the

WLAN function. When the wireless function is not ready, the LED

will be off.

 When WPS function is enabled by web user interface, press this

button for more than 2 seconds to wait for client’s device making

network connection through WPS.

Factory Reset

Restore the default settings. Usage: Turn on the router (ACT LED is

blinking). Press the hole and keep for more than 5 seconds. When you

see the ACT LED begins to blink rapidly than usual, release the button.

Then the router will restart with the factory default configuration.

DSL

Connecter for accessing the Internet.

SIM2/SIM1

(Vigor2620Ln)

SIM card slot(s).

SIM1

(Vigor2620Lne)

SIM card slot(s).

P2-P1

Connecters for local network devices.

ON/OFF Power Switch.

PWR Connecter for a power adapter.

Vigor2620 Series User’s Guide

6

I

-

2

H

a

r

d

w

a

r

e

I

n

s

t

a

l

a

t

i

o

n

I

-

2

-

1

N

e

t

w

o

r

k

C

o

n

e

c

t

i

o

n

v

i

a

L

T

E

Before starting to configure the router, you have to connect your devices correctly. In this

section, Vigor2620n is taken as an example.

1. Install the SIM card into the card slot. The back plate of the SIM card slot must be

removed first and the direction of card notch must be on the left side.

After installing the SIM card, fasten the back plate again.

2. Connect to your computer with a RJ-45 cable.

3. Connect one end of the power cord to the power port of this device. Connect the other

end to the wall outlet of electricity.

4. Power on the router.

5. Check the power, LTE and LAN LEDs to assure network connections.

(For the hardware connection, we take “n” model as an example.)

Vigor2620 Series User’s Guide

7

I

-

2

-

2

N

e

t

w

o

r

k

C

o

n

e

c

t

i

o

n

v

i

a

D

S

L

1. Connect the DSL interface to the external ADSL splitter with an ADSL line cable.

2. Connect to your computer with a RJ-45 cable.

3. Connect one end of the power cord to the power port of this device. Connect the other

end to the wall outlet of electricity.

4. Power on the router.

5. Check the power and DSL, LAN LEDs to assure network connections.

Vigor2620 Series User’s Guide

8

I

-

2

-

3

W

a

l

-

M

o

u

n

t

e

d

I

n

s

t

a

l

a

t

i

o

n

Vigor2620 has keyhole type mounting slots on the underside.

1. A template is provided on the Vigor2620 packaging box to enable you to space the screws

correctly on the wall.

2. Place the template on the wall and drill the holes according to the recommended

instruction.

3. Fit screws into the wall using the appropriate type of wall plug.

Note

The recommended drill diameter shall be 6.5mm (1/4”).

4. When you finished about procedure, the router has been mounted on the wall firmly.

Vigor2620 Series User’s Guide

9

I

-

3

A

c

e

s

i

n

g

W

e

b

P

a

g

e

1. Make sure your PC connects to the router correctly.

You may either simply set up your computer to get IP dynamically from the router or set

up the IP address of the computer to be the same subnet as the default IP address of

Vigor router 192.168.1.1. For the detailed information, please refer to the later

section - Trouble Shooting of the guide.

2. Open a web browser on your PC and type http://192.168.1.1. The following window

will be open to ask for username and password.

3. Please type “admin/admin” as the Username/Password and click Login.

Info

If you fail to access to the web configuration, please go to “Trouble

Shooting” for detecting and solving your problem.

Vigor2620 Series User’s Guide

10

4. Now, the Main Screen will appear. Take Vigor2620Ln as as example.

Info

The home page will be different slightly in accordance with the type of the

router you have.

5. The web page can be logged out according to the chosen condition. The default setting

is Auto Logout, which means the web configuration system will logout after 5 minutes

without any operation. Change the setting for your necessity.

Vigor2620 Series User’s Guide

11

I

-

4

C

h

a

n

g

i

n

g

P

a

s

w

o

r

d

Please change the password for the original security of the router.

1. Open a web browser on your PC and type http://192.168.1.1. A pop-up window will

open to ask for username and password.

2. Please type “admin/admin” as Username/Password for accessing into the web user

interface with admin mode.

3. Go to System Maintenance page and choose Administrator Password.

4. Enter the login password (the default is “admin”) on the field of Old Password. Type

New Password and Confirm Password. Then click OK to continue.

Info

The maximum length of the password you can set is 23 characters.

5. Now, the password has been changed. Next time, use the new password to access the

Web user interface for this router.

Info

Even the password is changed, the Username for logging onto the web user

interface is still “admin”.

Vigor2620 Series User’s Guide

12

I

-

5

D

a

s

h

b

o

a

r

d

Dashboard shows the connection status including System Information, IPv4 Internet Access,

IPv6 Internet Access, Interface (physical connection), Security and Quick Access.

Click Dashboard from the main menu on the left side of the main page.

A web page with default selections will be displayed on the screen. Refer to the following

figure:

Vigor2620 Series User’s Guide

13

I

-

5

-

1

V

i

r

t

u

a

l

P

a

n

e

l

On the top of the Dashboard, a virtual panel (simulating the physical panel of the router)

displays the physical interface connection. It will be refreshed every five seconds. When you

move and click the mouse cursor on LEDs (except ACT), USB ports, or LAN1 – LAN4, related

web setting page will be open for you to configure if required.

Port Color Description

Black It means the router or the function is not working. LED

Green It means the router or the function is working.

For detailed information about the LED display, refer to I-1-1 LED Indicators and

Connectors.

I

-

5

-

2

N

a

m

e

w

i

t

h

a

L

i

n

k

A name with a link (e.g., Router Name, Current Time, LTE and etc.) below means you can

click it to open the configuration page for modification.

Vigor2620 Series User’s Guide

1

4

I

-

5

-

3

Q

u

i

c

k

A

c

e

s

f

o

r

C

o

m

o

n

U

s

e

d

M

e

n

u

All the menu items can be accessed and arranged orderly on the left side of the main page for

your request. However, some important and common used menu items which can be

accessed in a quick way just for convenience.

Look at the right side of the Dashboard. You will find a group of common used functions

grouped under Quick Access.

The function links of System Status, Dynamic DDNS, TR-069, IM/P2P Block, Schedule,

Syslog/Mail Alert, RADIUS, Firewall Object Setting and Data Flow Monitor are displayed here.

Move your mouse cursor on any one of the links and click on it. The corresponding setting

page will be open immediately.

In addition, quick access for VPN security settings such as Remote Dial-in User and LAN to

LAN are located on the bottom of this page. Scroll down the page to find them and use them

if required.

Note that there is a plus (

) icon located on the left side of LAN/WLAN/VPN/MyVigor. Click

it to review the LAN/WLAN/VPN/MyVigor connection(s) used presently.

Vigor2620 Series User’s Guide

15

Host connected physically to the router via LAN port(s) will be displayed with green circles in

the field of Connected.

All of the hosts (including wireless clients) displayed with Host ID, IP Address and MAC address

indicates that the traffic would be transmitted through LAN port(s) and then the WAN port.

The purpose is to perform the traffic monitor of the host(s).

I

-

5

-

4

G

U

I

M

a

p

All the functions the router supports are listed with table clearly in this page. Users can click

the function link to access into the setting page of the function for detailed configuration.

Click the icon on the top of the main screen to display all the functions.

Vigor2620 Series User’s Guide

16

I

-

5

-

5

W

e

b

C

o

n

s

o

l

e

It is not necessary to use the telnet command via DOS prompt. The changes made by using

web console have the same effects as modified through web user interface. The

functions/settings modified under Web Console also can be reviewed on the web user

interface.

Click the Web Console icon on the top of the main screen to open the following screen.

I

-

5

-

6

C

o

n

f

i

g

B

a

c

k

u

p

There is one way to store current used settings quickly by clicking the Config Backup icon. It

allows you to backup current settings as a file. Such configuration file can be restored by

using System Maintenance>>Configuration Backup.

Simply click the icon on the top of the main screen and a pop up dialog will appear.

Click Save to store the setting.

Vigor2620 Series User’s Guide

1

7

I

-

5

-

7

L

o

g

o

u

t

Click this icon to exit the web user interface.

I

-

5

-

8

O

n

l

i

n

e

S

t

a

t

u

s

I

-

5

-

8

-

1

P

h

y

s

i

c

a

l

C

o

n

e

c

t

i

o

n

Such page displays the physical connection status such as LAN connection status, WAN

connection status, ADSL information, and so on.

P

h

y

s

i

c

a

l

C

o

n

e

c

t

i

o

n

f

o

r

I

P

v

4

P

r

o

t

o

c

o

l

Vigor2620 Series User’s Guide

18

P

h

y

s

i

c

a

l

C

o

n

e

c

t

i

o

n

f

o

r

I

P

v

6

P

r

o

t

o

c

o

l

Detailed explanation (for IPv4) is shown below:

Item Description

LAN Status Primary DNS-Displays the primary DNS server address for

WAN interface.

Secondary DNS -Displays the secondary DNS server address

for WAN interface.

IP Address-Displays the IP address of the LAN interface.

TX Packets-Displays the total transmitted packets at the LAN

interface.

RX Packets-Displays the total received packets at the LAN

interface.

WAN1/WAN2/WAN3

/WAN4 Status

Enable – Yes in red means such interface is available but not

enabled. Yes in green means such interface is enabled.

Line – Displays the physical connection (VDSL, ADSL,

Ethernet, or USB) of this interface.

Name – Display the name of the router.

Mode - Displays the type of WAN connection (e.g., PPPoE).

Up Time - Displays the total uptime of the interface.

IP - Displays the IP address of the WAN interface.

GW IP - Displays the IP address of the default gateway.

TX Packets - Displays the total transmitted packets at the

WAN interface.

TX Rate - Displays the speed of transmitted octets at the

WAN interface.

RX Packets - Displays the total number of received packets

at the WAN interface.

RX Rate - Displays the speed of received octets at the WAN

interface.

Vigor2620 Series User’s Guide

19

Detailed explanation (for IPv6) is shown below:

Item Description

LAN Status IP Address- Displays the IPv6 address of the LAN interface..

TX Packets-Displays the total transmitted packets at the LAN

interface.

RX Packets-Displays the total received packets at the LAN

interface.

TX Bytes - Displays the speed of transmitted octets at the

LAN interface.

RX Bytes - Displays the speed of received octets at the LAN

interface.

WAN IPv6 Status Enable – No in red means such interface is available but not

enabled. Yes in green means such interface is enabled. No in

red means such interface is not available.

Mode - Displays the type of WAN connection (e.g., TSPC).

Up Time - Displays the total uptime of the interface.

IP - Displays the IP address of the WAN interface.

Gateway IP - Displays the IP address of the default gateway.

Info

The words in green mean that the WAN connection of that interface is ready for

accessing Internet; the words in red mean that the WAN connection of that interface

is not ready for accessing Internet.

I

-

5

-

8

-

2

V

i

r

t

u

a

l

W

A

N

Such page displays the virtual WAN connection information.

Virtual WAN are used by TR-069 management, and so on.

The field of Application will list the purpose of such WAN connection.

Vigor2620 Series User’s Guide

20

I

-

6

Q

u

i

c

k

S

t

a

r

t

W

i

z

a

r

d

Quick Start Wizard can help you to deploy and use the router easily and quickly. Go to

Wizards>>Quick Start Wizard. The first screen of Quick Start Wizard is entering login

password. After typing the password, please click Next.

On the next page, please select the WAN interface that you use. If DSL interface is used,

please choose WAN1; if USB interface is used, please choose LTE. Then click Next for next

step. WAN1 and LTE will bring up different configuration page. Here, we take LTE as an

example.

Vigor2620 Series User’s Guide

21

I

-

6

-

1

L

T

E

1. Choose LTE. Enter a string as Display Name (optional). Click Next.

2. After clicking Next, you will get the following web page.

Available settings are explained as follows:

Item Description

Internet Access Specify a connection mode from the drop down menu.

SIM PIN code Enter PIN code of the SIM card that will be used to access

Internet.

Network Mode Force Vigor router to connect Internet with the mode

specified here. If you choose 4G/3G/2G as network mode,

the router will choose a suitable one according to the actual

wireless signal automatically.

APN Name APN means Access Point Name which is provided and

Vigor2620 Series User’s Guide

22

Item Description

required by some ISPs.

Back Click it to return to previous setting page.

Next Click it to get into the next setting page.

Cancel Click it to give up the quick start wizard.

3. Please manually enter the Username/Password provided by your ISP. Click Next for

viewing summary of such connection.

4. Click Finish. A page of Quick Start Wizard Setup OK!!! will appear.

5. Now, you can enjoy surfing on the Internet.

Vigor2620 Series User’s Guide

23

I

-

6

-

2

W

A

N

1

(

A

D

S

L

/

V

D

S

L

2

)

WAN1 is specified for ADSL or VDSL2 connection.

Available settings are explained as follows:

Item Description

Display Name Enter a name to identify such WAN.

Physical Mode Display the physical mode of this WAN interface.

DSL Mode Specify a DSL mode from the drop down menu.

P

o

E

/

P

o

A

1. Choose WAN1 as WAN Interface and click the Next button; you will get the following

page.

Available settings are explained as follows:

Vigor2620 Series User’s Guide

2

4

Item Description

Protocol There are two modes offered for you to choose for WAN1

interface.

Choose PPPoE/PPPoA as the protocol.

For ADSL Only Such field is provided for ADSL only. You have to choose

encapsulation and Enter the values for VPI and VCI. Or, click

Auto detect to find out the best values.

Fixed IP Click Yes to enable Fixed IP feature.

IP Address Enter the IP address if Fixed IP is enabled.

Subnet Mask Enter the subnet mask.

Default Gateway Enter the IP address as the default gateway.

Primary DNS Enter the primary IP address for the router.

Secondary DNS Enter secondary IP address for necessity in the future.

VLAN Tag insertion

(VDSL2)/(ADSL)

Enable – Enable the function of VLAN with tag.

The router will add specific VLAN number to all packets on

the WAN while sending them out.

Please Enter the tag value and specify the priority for the

packets sending by WAN1.

Disable – Disable the function of VLAN with tag.

Tag value – Enter the value as the VLAN ID number. The

range is from 0 to 4095.

Priority – Enter the packet priority number for such VLAN.

The range is from 0 to 7.

Back Click it to return to previous setting page.

Next Click it to get into the next setting page.

Cancel Click it to give up the quick start wizard.

2. After finished the above settings, simply click Next. Manually enter the

Username/Password provided by your ISP

Vigor2620 Series User’s Guide

25

Available settings are explained as follows:

Item Description

Service Name

(Optional)

Enter the description of the specific network service.

Username Assign a specific valid user name provided by the ISP.

Note: The maximum length of the user name you can set is

63 characters.

Password Assign a valid password provided by the ISP.

Note: The maximum length of the password you can set is 62

characters.

Confirm Password ReEnter the password.

Back Click it to return to previous setting page.

Next Click it to get into the next setting page.

Cancel Click it to give up the quick start wizard.

3. After finished the above settings, click Next for viewing summary of such connection.

Vigor2620 Series User’s Guide

26

4. Click Finish. A page of Quick Start Wizard Setup OK!!! will appear.

5. Now, you can enjoy surfing on the Internet.

Vigor2620 Series User’s Guide

2

7

M

P

o

A

/

S

t

a

t

i

c

o

r

D

y

n

a

m

i

c

I

P

1. Choose WAN1 as WAN Interface and click the Next button; you will get the following

page.

Available settings are explained as follows:

Item Description

Protocol There are two modes offered for you to choose for WAN1

interface.

Choose MPoA / Static or Dynamic IP as the protocol.

For ADSL Only Such field is provided for ADSL only. You have to choose

encapsulation and Enter the values for VPI and VCI. Or, click

Auto detect to find out the best values.

Fixed IP Click Yes to enable Fixed IP feature.

IP Address Enter the IP address if Fixed IP is enabled.

Subnet Mask Enter the subnet mask.

Default Gateway Enter the IP address as the default gateway.

Vigor2620 Series User’s Guide

28

Primary DNS Enter the primary IP address for the router.

Secondary DNS Enter secondary IP address for necessity in the future.

VLAN Tag insertion

(VDSL2)/(ADSL)

Enable – Enable the function of VLAN with tag.

The router will add specific VLAN number to all packets on

the WAN while sending them out.

Please Enter the tag value and specify the priority for the

packets sending by WAN1.

Disable – Disable the function of VLAN with tag.

Tag value – Enter the value as the VLAN ID number. The

range is from 0 to 4095.

Priority – Enter the packet priority number for such VLAN.

The range is from 0 to 7.

Back Click it to return to previous setting page.

Next Click it to get into the next setting page.

Cancel Click it to give up the quick start wizard.

2. Please Enter the IP address/mask/gateway information originally provided by your ISP.

Then click Next for viewing summary of such connection.

3. Click Finish. A page of Quick Start Wizard Setup OK!!! will appear.

4. Now, you can enjoy surfing on the Internet.

Vigor2620 Series User’s Guide

29

I

-

6

-

3

W

A

N

2

(

E

t

h

e

r

n

e

t

)

WAN2 can be configured for physical mode of Ethernet. If you choose Ethernet WAN2, please

specify a physical type. Then, click Next.

Available settings are explained as follows:

Item Description

Display Name Type a name for the router.

Physical Mode Display the physical mode of this WAN interface.

Physical Type This setting is available when Ethernet is selected as

Physical Mode. In general, Auto negotiation is suggested.

P

o

E

1. Choose WAN2 as the WAN Interface and choose Ethernet as the Physical Mode. Click

the Next button. The following page will be open for you to specify Internet Access

Type.

Vigor2620 Series User’s Guide

30

2. Click PPPoE as the Internet Access Type. Then click Next to get the following page.

Available settings are explained as follows:

Item Description

Service Name

(Optional)

Enter the description of the specific network service.

Username Assign a specific valid user name provided by the ISP.

Note: The maximum length of the user name you can set is

63 characters.

Password Assign a valid password provided by the ISP.

Note: The maximum length of the password you can set is 62

characters.

Confirm Password ReEnter the password.

Back Click it to return to previous setting page.

Next Click it to get into the next setting page.

Cancel Click it to give up the quick start wizard.

Vigor2620 Series User’s Guide

31

3. Please manually enter the Username/Password provided by your ISP. Click Next for

viewing summary of such connection.

4. Click Finish. A page of Quick Start Wizard Setup OK!!! will appear.

5. Now, you can enjoy surfing on the Internet.

Vigor2620 Series User’s Guide

32

P

T

P

1. Choose PPTP as the WAN Interface and click the Next button.

2. The following page will be open for you to Enter all the information originally provided

by your ISP.

Available settings are explained as follows:

Item Description

Username Assign a specific valid user name provided by the ISP.

Note: The maximum length of the user name you can set is

63 characters.

Password Assign a valid password provided by the ISP.

Note: The maximum length of the password you can set is 62

characters.

Confirm Password ReEnter the password.

WAN IP Configuration

Obtain an IP address automatically – the router will get an

Vigor2620 Series User’s Guide

33

IP address automatically from DHCP server.

Specify an IP address – you have to type relational settings

manually.

IP Address - Enter the IP address.

Subnet Mask –Enter the subnet mask.

Gateway – Enter the IP address of the gateway.

Primary DNS - Enter the primary IP address for the router.

Secondary DNS - Enter the secondary IP address for

necessity in the future.

PPTP Server Enter the IP address of the server.

Back Click it to return to previous setting page.

Next Click it to get into the next setting page.

Cancel Click it to give up the quick start wizard.

3. Please Enter the IP address/mask/gateway information originally provided by your ISP.

Then click Next for viewing summary of such connection.

4. Click Finish. A page of Quick Start Wizard Setup OK!!! will appear. Then, the system

status of this protocol will be shown.

5. Now, you can enjoy surfing on the Internet.

Vigor2620 Series User’s Guide

3

4

S

t

a

t

i

c

I

P

1. Click Static IP as the Internet Access type and click the Next button.

2. The following page will be open for you to Enter the IP address information originally

provided by your ISP.

Available settings are explained as follows:

Item Description

WAN IP Enter the IP address.

Subnet Mask Enter the subnet mask.

Gateway Enter the IP address of gateway.

Primary DNS Enter the primary IP address for the router.

Secondary DNS Enter secondary IP address for necessity in the future.

Back Click it to return to previous setting page.

Next Click it to get into the next setting page.

Cancel Click it to give up the quick start wizard.

Vigor2620 Series User’s Guide

35

3. Click Next for next step.

4. Click Finish. A page of Quick Start Wizard Setup OK!!! will appear.

5. Now, you can enjoy surfing on the Internet.

Vigor2620 Series User’s Guide

36

D

H

C

P

1. Click DHCP as the Internet Access type and click the Next button.

2. The following page will be open for you to Enter the IP address information originally

provided by your ISP.

Available settings are explained as follows:

Item Description

Host Name Enter the name of the host.

Note: The maximum length of the host name you can set is

39 characters.

MAC Some Cable service providers specify a specific MAC address

for access authentication. In such cases you need to enter

the MAC address.

Back Click it to return to previous setting page.

Next Click it to get into the next setting page.

Cancel Click it to give up the quick start wizard.

Vigor2620 Series User’s Guide

3

7

3. After finished the settings above, click Next for viewing summary of such connection.

4. Click Finish. A page of Quick Start Wizard Setup OK!!! will appear. Then, the system

status of this protocol will be shown.

5. Now, you can enjoy surfing on the Internet.

Vigor2620 Series User’s Guide

38

I

-

7

S

e

r

v

i

c

e

A

c

t

i

v

a

t

i

o

n

W

i

z

a

r

d

Service Activation Wizard can guide you to activate WCF service (Web Content Filter) with a

quick and easy way. For the Service Activation Wizard is only available for admin

operation, please type “admin/admin” on Username/Password while Logging into the web

user interface.

Service Activation Wizard is a tool which allows you to activate services without accessing

into the server (MyVigor) located on http://myvigor.draytek.com.

Info

Such function is available only for Admin Mode.

1. Open Wizards>>Service Activation Wizard.

2. In the following page, you can activate the Web content filter services and DNS service

at the same time or individually. When you finish the selection, please click Next.

Vigor2620 Series User’s Guide

39

Info

BPjM is web content filter (WCF) for German Speaking users. It is ideal for your

family to provide more Internet security for youngsters.

Cryan 30-day trial is WCF which offers 30-day trial period. After trial, you can

purchase DrayTek's prepared Cryan GlobalView WCF package from retailing

outlets.

DT-DDNS, developed by DrayTek, offers one year free charge service of

dynamic DNS service for internal use.

3. Setting confirmation page will be displayed as follows, please click Activate.

Info

The service will be activated and applied as the default rule configured in

Firewall>>General Setup.

4. Now, the web page will display the service that you have activated according to your

selection(s). The valid time for the free trial of these services is one month.

Vigor2620 Series User’s Guide

40

I

-

8

R

e

g

i

s

t

e

r

i

n

g

V

i

g

o

r

R

o

u

t

e

r

You have finished the configuration of Quick Start Wizard and you can surf the Internet at any

time. Now it is the time to register your Vigor router to MyVigor website for getting more

service. Please follow the steps below to finish the router registration.

1 Please login the web configuration interface of Vigor router by typing “admin/admin” as

User Name / Password.

2 Click Support Area>>Production Registration from the home page.

3 A Login page will be shown on the screen. Please Enter the account and password that

you created previously. And click Login.

Vigor2620 Series User’s Guide

41

Info

If you haven’t an accessing account, please refer to section Creating an

Account for MyVigor to create your own one. Please read the articles on the

Agreement regarding user rights carefully while creating a user account.

4 The following page will be displayed after you logging in MyVigor. Type a nickname for

the router, then click Add.

5 When the following page appears, your router information has been added to the

database.

6 After clicking OK, you will see the following page. Your router has been registered to

myvigor website successfully.

Vigor2620 Series User’s Guide

42

This page is left blank.

Vigor2620 Series User’s Guide

43

P

a

r

t

I

C

o

n

e

c

t

i

v

i

t

y

It means wide area network. Public IP will be used in

WAN.

It means local area network. Private IP will be used in

LAN. Local Area Network (LAN) is a group of subnets

regulated and ruled by router. The design of network

structure is related to what type of public IP addresses

coming from your ISP.

When the data flow passing through, the Network

Address Translation (NAT) function of the router will

dedicate to translate public/private addresses, and

the packets will be delivered to the correct host PC in

the local area network.

DNS, LAN DNS, IGMP, UPnP, WOL, RADIUS, SMS.

Static Route

Vigor2620 Series User’s Guide

4

I

-

1

L

T

E

LTE WAN with SIM card can provide convinent Internet access for Vigor router. However, we

can't stop thinking about what can Vigor router utilize this SIM card to provide more useful

functions for user? Now, we have developed some useful functions for user, such as sending

SMS from a router to report router status, rebooting router remotely via SMS with taking

security into consideration, and so on.

This section can guide you to use the SIM card in LTE WAN to perform SMS related operations.

Vigor2620 Series User’s Guide

45

W

e

b

U

s

e

r

I

n

t

e

r

f

a

c

e

I

-

1

-

1

G

e

n

e

r

a

l

S

e

t

i

n

g

s

This page allows you to configure general settings for LTE. When SMS Quota Limit is enabled,

you can specify the number of SMS quota, actions to perform when quota exceeded, and the

period of resetting SMS quota used.

I

-

1

-

1

-

1

S

M

S

Q

u

o

t

a

Available settings are explained as follows:

Item Description

Enable SMS Quota Limit Check the box to enable such feature.

Quota Limit Specify the maximum number of sending SMS for LTE.

When quota exceeded There are two actions to be performed when the quota limit

is expired.

Stop sending SMS – If it is checked, no SMS for LTE will be

sent after the quota limit is expired.

Send Mail Alert to Administrator – If it is checkd, a mail

alert will be sent to the administrator when the quota limit is

expired.

Monthly This setting is to offer a mechanism of resetting the number

of SMS sent record every month.

SMS quota resets on day XX at XX … –You can determine the

starting day in one month. The number of SMS sent will be

Vigor2620 Series User’s Guide

46

reset.

Custom This setting allows the user to define the billing cycle

according to his request.

The number of SMS sent will be reset with an interval of

cycle duration.

Custom – Monthly is default setting. If long period or a short

period is required, use Custom. The period of reset is

between 1 day and 60 days. You can determine the cycle

duration by specifying the days and the hours.

 Cycle duration: Specify the days to reset the number of

SMS sent. For example, 7 means the whole cycle is 7

days; 20 means the whole cycle is 20 days. When the time

is up, the router will reset the number of SMS sent

automatically.

 Today is day XX in the cycle –Specify the day in the cycle

duration as the starting point which Vigor router will

reset the number of SMS sent. For example, 3 means the

third day of the duration cycle.

I

-

1

-

1

-

2

S

M

S

I

n

b

o

x

Such page allows you to determine which policy shall be used for SMS inbox/outbox.

Vigor2620 Series User’s Guide

4

7

I

-

1

-

2

S

M

S

I

n

b

o

x

This page will list the received SMS messages in the LTE SIM card. The SMS Inbox table shows

the received date, the phone number or sender ID where this message was from, and the

beginning of the message content.

Since the data size of one SMS is limited, a long message will be sent by multiple SMS. For the

convenience of users, we provide two modes. Simple Mode

lists SMS messages in order for

received time. Advanced Mode

lists SMS in order for real index in the SIM card. Different SIM

cards have different capacities. In general, it's around 30 to 40 SMS. Please note that the SIM

card can not receive new SMS when all SMS indexes are occupied.

Click the Simple Mode link or the Advanced Mode link below to switch between these two

modes.

I

-

1

-

2

-

1

S

i

m

p

l

e

M

o

d

e

Available settings are explained as follows:

Item Description

Mark as Read Those messages in "unread" state are showed in bold text. If

you want to change messages into "read" state, select them

and click the OK button. Checking the checkbox in title will

select all "unread" messages in this page.

Delete If you want to delete messages, select them and click the OK

button. Checking the checkbox in title will select all

messages in this page.

Details If you want to read the full content of the message, click the

View

link of that message to open the following page. It will

change the message into "read" state.

Vigor2620 Series User’s Guide

48

 Message Content - Display the full content of the

message.

 OK - Return to previous page.

 Delete - Click it to delete this message and return to

previous page.

 Next - Click it to see the content of next message.

I

-

1

-

2

-

1

A

d

v

a

n

c

e

d

M

o

d

e

Available settings are explained as follows:

Item Description

Mark as Read Those SMS in "unread" state are shown in bold text. If you

want to change SMS into "read" state, select them and click

the OK button. Checking the checkbox in title will select all

"unread" SMS in this page.

Delete If you want to delete SMS, select them and click the OK

button. Checking the checkbox in title will select all SMS in

this page.

Index If you want to read the full content of the message of the

SMS, click the index link of that SMS to open the following

page. It will change all SMS of the message into "read" state.

Vigor2620 Series User’s Guide

49

Message Content - Display the full content of the message.

OK - Return to previous page.

Delete - Click it to delete all SMS of this message and return

to previous page.

Next - Click it to see the content of next SMS index.

Vigor2620 Series User’s Guide

50

I

-

1

-

3

S

e

n

d

S

M

S

This page is used to send SMS messages by the LTE SIM card. It also displays the number of SMS

required to send the message.

Available settings are explained as follows:

Item Description

Recipient Number Type the phone number of the recipient.

The format can be an international phone number

( +8869123455678) or a general phone number(0912345678).

Data Coding Scheme The router will automatically select a suitable Data Coding

Scheme according to the current content in Message. GSM

7-bit and UCS-2 are supported.

Message Type in the message content to send.

The total number of characters that you can type in this field

is 1024.

Send Message Click it to send this SMS message to the recipient

immediately.

View SMS Outbox Cache Display the record of SMS messages sent from the Router.

Vigor2620 Series User’s Guide

51

I

-

1

-

4

R

o

u

t

e

r

C

o

m

a

n

d

s

This page allows the user to set function to reboot Vigor router remotely and get the router

status via SMS.

Go to LTE>>Router Commands to get the following page.

Available settings are explained as follows:

Item Description

Reboot on SMS Message

Enable with Password /

To reboot Vigor router remotely via SMS, please check such

box and type the password/PIN number (treated as

Vigor2620 Series User’s Guide

52

authentication for any mobile phone).

The password shall be composed by letters, numbers and

baseline.

Access Control List Check the box to type or modify (up to 3) phone numbers.

The phone number specified here is capable of sending SMS

to reboot such Vigor router remotely.

Note: If such option is enabled, only mobile phones specified

here are allowed to send SMS to reboot Vigor router if

correct password is given. That is, if it is disabled

(unchecked), any mobile phone can send SMS to reboot such

Vigor router if correct password is given.

Reply with Router Status Message

Enable with Password /

Users can get the WAN data usage and basic information

about Vigor router (e.g., IP address, MAC address) through

the mobile phone by entering the password/PIN specified in

this field.

The password shall be composed by letters, numbers and

baseline.

Access Control List Check the box to type or modify (up to 3) phone numbers.

The phone number specified here is capable of getting

related information about Vigor router remotely.

Note: If such option is enabled, only mobile phones specified

here are allowed to obtaine related information about Vigor

router if correct password is given. That is, if it is disabled

(unchecked), any mobile phone can get the data of Vigor

router if correct password is given.

Message Contents There are several types of message contents for you to

select. Choose and check the required item, then Vigor

router will offer the status response about that item via SMS.

SMS messages per status

response

Display the total number of the type for status response.

Display the total number of SMS required to send the status

message which contains the current selected Message

Contents.

Vigor2620 Series User’s Guide

53

I

-

1

-

5

S

t

a

t

u

s

Vigor router with LTE function is capable of accessing into Internet and able to send SMS to

specified mobile phone.

This page will display basic information about the embedded LTE module and the current LTE

connection.

Each item is explained as follows:

Item Description

Status LTE WAN status.

IMEI International Mobile Equipment Identity of the embedded

LTE module.

IMSI International Mobile Subscripber Identity of the LTE SIM card.

Access Tech Type of LTE connection

(CDMA/GSM/WCDMA/LTE/TD-SCDMA).

Band Band of LTE connection.

Operator ISP name of LTE connection.

Mobile Country Code /

Mobile Network Code /

Location Area Code / Cell

ID :

Base station information.

RSSI Signal Signal strength of LTE connection.

Active Channel Frequency of LTE connection.

Max Channel TX Rate / Maximum TX/RX link rate of LTE connection.

Vigor2620 Series User’s Guide

5

4

Max Channel RX Rate

SMS Centre Number The phone number for SMS service of the LTE SIM card.

SMS Service status Whether the SMS service of the LTE SIM card is ready.

SMS Loading Whether the received SMS messages in the LTE SIM card have

been loaded to the Router.

New SMS The number of unread SMS in SMS Inbox.

Vigor2620 Series User’s Guide

55

I

-

2

W

A

N

It allows users to access Internet.

B

a

s

i

c

s

o

f

I

n

t

e

r

n

e

t

P

r

o

t

o

c

o

l

(

I

P

)

N

e

t

w

o

r

k

IP means Internet Protocol. Every device in an IP-based Network including routers, print

server, and host PCs, needs an IP address to identify its location on the network. To avoid

address conflicts, IP addresses are publicly registered with the Network Information Centre

(NIC). Having a unique IP address is mandatory for those devices participated in the public

network but not in the private TCP/IP local area networks (LANs), such as host PCs under the

management of a router since they do not need to be accessed by the public. Hence, the NIC

has reserved certain addresses that will never be registered publicly. These are known as

private IP addresses, and are listed in the following ranges:

From 10.0.0.0 to 10.255.255.255

From 172.16.0.0 to 172.31.255.255

From 192.168.0.0 to 192.168.255.255

W

h

a

t

a

r

e

P

u

b

l

i

c

I

P

A

d

r

e

s

a

n

d

P

r

i

v

a

t

e

I

P

A

d

r

e

s

As the router plays a role to manage and further protect its LAN, it interconnects groups of

host PCs. Each of them has a private IP address assigned by the built-in DHCP server of the

Vigor router. The router itself will also use the default private IP address: 192.168.1.1 to

communicate with the local hosts. Meanwhile, Vigor router will communicate with other

network devices through a public IP address. When the data flow passing through, the

Network Address Translation (NAT) function of the router will dedicate to translate

public/private addresses, and the packets will be delivered to the correct host PC in the local

area network. Thus, all the host PCs can share a common Internet connection.

G

e

t

Y

o

u

r

P

u

b

l

i

c

I

P

A

d

r

e

s

f

r

o

m

I

S

P

In ADSL deployment, the PPP (Point to Point)-style authentication and authorization is

required for bridging customer premises equipment (CPE). Point to Point Protocol over

Ethernet (PPPoE) connects a network of hosts via an access device to a remote access

concentrator or aggregation concentrator. This implementation provides users with

significant ease of use. Meanwhile it provides access control, billing, and type of service

according to user requirement.

When a router begins to connect to your ISP, a serial of discovery process will occur to ask for

a connection. Then a session will be created. Your user ID and password is authenticated via

PAP or CHAP with RADIUS authentication system. And your IP address, DNS server, and other

related information will usually be assigned by your ISP.

Vigor2620 Series User’s Guide

56

W

e

b

U

s

e

r

I

n

t

e

r

f

a

c

e

I

-

2

-

1

G

e

n

e

r

a

l

S

e

t

u

p

This section will introduce some general settings of Internet and explain the connection

modes for WAN in details.

I

-

2

-

1

-

1

W

A

N

1

This webpage allows you to set general setup for WAN1and WAN3 respectively.

Available settings are explained as follows:

Item Description

Index Click the WAN /LTE interface link under Index to access into

the WAN configuration page.

Enable V means such WAN interface is enabled and ready to be used.

Physical Mode / Type Display the physical mode and physical type of such WAN

interface.

Active Mode Display whether such WAN interface is Active device or

backup device.

Info

In default, each WAN port is enabled.

Click WAN1/WAN2 link to get the following page:

Vigor2620 Series User’s Guide

57

Available settings are explained as follows:

Item Description

Enable Choose Yes to invoke the settings for this WAN interface.

Choose No to disable the settings for this WAN interface.

Display Name Enter the description for such WAN interface.

Physical Mode Display the physical mode of this WAN interface.

DSL Mode Specify the physical mode (Auto, VDSL2 or ADSL) for such

router manually.

DSL Modem Code Choose the correct DSL modem code for ensuring the

network connection.

If you have no idea about the selection, simply choose

Default or contact the dealer for assistance.

VLAN Tag insertion Enable – Enable the function of VLAN with tag.

The router will add specific VLAN number to all packets on

the WAN while sending them out.

Please Enter the tag value and specify the priority for the

packets sending by WAN interface.

Disable – Disable the function of VLAN with tag.

Tag value – Enter the value as the VLAN ID number. The

range is from 0 to 4095.

Priority – Enter the packet priority number for such VLAN.

The range is from 0 to 7.

After finished the above settings, click OK to save the settings.

Vigor2620 Series User’s Guide

58

I

-

2

-

1

-

2

L

T

E

To use 3G/4G network connection through 3G/4G USB Modem, please configure WAN3

interface.

Available settings are explained as follows:

Item Description

Enable Choose Yes to invoke the settings for this WAN interface.

Choose No to disable the settings for this WAN interface.

Display Name Enter the description for such WAN interface.

Physical Mode Display the physical mode of this WAN interface.

Active Mode Choose Always On to make the WAN1 connection being

activated always.

Failover – Choose it to make the WAN connection as a

backup connection.

After finished the above settings, click OK to save the settings.

Vigor2620 Series User’s Guide

59

I

-

2

-

2

I

n

t

e

r

n

e

t

A

c

e

s

This page allows you to set WAN configuration with different modes.

Available settings are explained as follows:

Item Description

Index Display the WAN interface.

Display Name It shows the name of the WAN1/WAN2/LTE that entered in

general setup.

Physical Mode It shows the physical connection for WAN (Ethernet or fiber)

according to the real network connection.

Access Mode Use the drop down list to choose a proper access mode. The

details page of that mode will be popped up. If not, click

Details Page for accessing the page to configure the settings.

Details Page This button will open different web page (based on IPv4)

according to the access mode that you choose in WAN

interface.

IPv6 This button will open different web page (based on Physical

Mode) to setup IPv6 Internet Access Mode for WAN interface.

If IPv6 service is active on this WAN interface, the color of

“IPv6” will become green.

DHCP Client Option This button allows you to configure DHCP client options.

DHCP packets can be processed by adding option number and

data information when such function is enabled and

configured.

Vigor2620 Series User’s Guide

60

Enable – Check the box to enable the function of DHCP

Option. Each DHCP option is composed by an option number

with data. For example,

Option number:100

Data: abcd

When such function is enabled, the specified values for DHCP

option will be seen in DHCP reply packets.

Interface – Specify the WAN interface(s) that will be

overwritten by such function. WAN5 ~ WAN6 can be located

under WAN>>Multi-PVC/VLAN.

Option Number – Type a number for such function.

Note: If you choose to configure option 61 here, the

detailed settings in WAN>>Interface Access will be

overwritten.

DataType – Choose the type (ASCII or Hex) for the data to be

stored.

Data – Enter the content of the data to be processed by the

function of DHCP option.

I

-

2

-

2

-

1

D

e

t

a

i

l

s

P

a

g

e

f

o

r

P

o

E

/

P

o

A

i

n

W

A

N

1

(

P

h

y

s

i

c

a

l

M

o

d

e

:

A

D

S

L

)

To use PPPoE/PPPoA as the accessing protocol of the internet, please click the PPPoE/PPPoA

tab. The following web page will be shown.

Vigor2620 Series User’s Guide

61

Available settings are explained as follows:

Item Description

Enable/Disable Click Enable for activating this function. If you click Disable,

this function will be closed and all the settings that you

adjusted in this page will be invalid.

ADSL Modem Settings Set up the DSL parameters required by your ISP. These

settings configured here are specified for ADSL only.

Multi-PVC channel - The selections displayed here are

determined by the page of Internet Access >> Multi PVCs.

Select M-PVCs Channel means no selection will be chosen.

VPI - Type in the value provided by ISP.

VCI - Type in the value provided by ISP.

Encapsulating Type - Drop down the list to choose the type

provided by ISP.

Protocol - Drop down the list to choose the one (PPPoE or

PPPoA) provided by ISP.

If you have already used Quick Start Wizard to set the

protocol, then it is not necessary for you to change any

settings in this group.

Modulation –Default setting is Multimode. Choose the one

that fits the requirement of your router.

ISP Access Setup Enter your allocated username, password and authentication

parameters according to the information provided by your

ISP.

Vigor2620 Series User’s Guide

62

Username – Type in the username provided by ISP in this

field.

Password – Type in the password provided by ISP in this field.

More Options –It shows optional settings for configuration.

 Service Name - Enter the description of the specific

network service.

Separate Account for ADSL – In default, WAN1 supports

VDSL2/ADSL and uses the same PPPoE account and password

for connection. If required, you can configure another

account and password for ADSL connection by checking this

box. If it is checked, the system will ask you to type another

group of account and password additionally.

WAN Connection

Detection

Such function allows you to verify whether network

connection is alive or not through PPP Detect or Ping Detect.

Mode – Choose PPP Detect or Ping Detect for the system to

execute for WAN detection. If you choose Ping Detect as the

detection mode, you have to type required settings for the

following items.

 Primary/Secondary Ping IP – If you choose Ping Detect as

detection mode, you have to type Primary or Secondary IP

address in this field for pinging.

 Ping Gateway IP – If you choose Ping Detect as detection

mode, you also can enable this setting to use current WAN

gateway IP address for pinging.

With the IP address(es) pinging, Vigor router can check if

the WAN connection is on or off.

 TTL (Time to Live) – Set TTL value of PING operation.

 Ping Interval – Enter the interval for the system to

execute the PING operation.

 Ping Retry – Enter the number of times that the system is

allowed to execute the PING operation before WAN

disconnection is judged.

MTU It means Max Transmit Unit for packet.

Path MTU Discovery – It is used to detect the maximum MTU

size of a packet not to be segmented in specific transmit

path.

Click Detect to open the following dialog.

 Path MTU to – Enter the IP address as the specific

transmit path.

 MTU size start from - Determine the starting point

value of the packet.

 MTU reduce size by – It determines the decreasing size

of MTU value. For example, the number specified in

this field is “8”. The maximum MTU size is “1500”.

After clicking the “detect” button, the system will

calculate and get the suitable MTU value such as 1500,

1492, 1484 and etc., automatically.

Vigor2620 Series User’s Guide

63

 Detect – Click it to detect a suitable MTU value

 Accept – After clicking it, the detected value will be

displayed in the field of MTU.

PPP/MP Setup PPP Authentication – Select PAP only or PAP or CHAP for

PPP.

IP Assignment (IPCP) - Usually ISP dynamically assigns IP

address to you each time you connect to it and request. In

some case, your ISP provides service to always assign you the

same IP address whenever you request. In this case, you can

fill in this IP address in the Fixed IP field. Please contact your

ISP before you want to use this function.

Fixed IP Address– Type in a fixed IP address in the box.

WAN IP Alias - If you have multiple public IP addresses and

would like to utilize them on the WAN interface, please use

WAN IP Alias. You can set up to 8 public IP addresses other

than the current one you are using.

Dial-Out Schedule You can type in four sets of time schedule for your request.

All the schedules can be set previously in Applications >>

Schedule web page and you can use the number that you

have set in that web page.

PPPoE Pass-through The router offers PPPoE dial-up connection. Besides, you

also can establish the PPPoE connection directly from local

clients to your ISP via the Vigor router. When PPPoA protocol

is selected, the PPPoE package transmitted by PC will be

transformed into PPPoA package and sent to WAN server.

Thus, the PC can access Internet through such direction.

For Wired LAN – If you check this box, PCs on the same

network can use another set of PPPoE session (different with

the Host PC) to access into Internet.

For Wireless LAN – It is available for n model. If you check

this box, PCs on the same wireless network can use another

set of PPPoE session (different with the Host PC) to access

into Internet.

Vigor2620 Series User’s Guide

64

Note: To have PPPoA Pass-through, please choose PPPoA

protocol and check the box(es) here. The router will behave

like a modem which only serves the PPPoE client on the LAN.

That’s, the router will offer PPPoA dial-up connection.

MAC Address Default MAC Address – You can use Default MAC Address or

specify another MAC address by typing on the boxes of MAC

Address for the router.

Specify a MAC Address – Enter the MAC address for the

router manually.

After finishing all the settings here, please click OK to activate them.

I

-

2

-

2

-

2

D

e

t

a

i

l

s

P

a

g

e

f

o

r

M

P

o

A

/

S

t

a

t

i

c

o

r

D

y

n

a

m

i

c

I

P

i

n

W

A

N

1

(

P

h

y

s

i

c

a

l

M

o

d

e

:

A

D

S

L

)

MPoA is a specification that enables ATM services to be integrated with existing LANs, which

use either Ethernet, token-ring or TCP/IP protocols. The goal of MPoA is to allow different

LANs to send packets to each other via an ATM backbone.

To use MPoA/Static or Dynamic IP as the accessing protocol of the Internet, select MPoA

/Static or Dynamic IP from the WAN>>Internet Access >>WAN1 page. The following web

page will appear.

Available settings are explained as follows:

Vigor2620 Series User’s Guide

65

Item Description

Enable/Disable Click Enable for activating this function. If you click Disable,

this function will be closed and all the settings that you

adjusted in this page will be invalid.

ADSL Modem Settings Set up the DSL parameters required by your ISP. These

settings configured here are specified for ADSL only.

Multi-PVC channel - The selections displayed here are

determined by the page of Internet Access >>Multi PVCs.

Select M-PVCs Channel means no selection will be chosen.

Encapsulation - Drop down the list to choose the type

provided by ISP.

VPI - Type in the value provided by ISP.

VCI - Type in the value provided by ISP.

Modulation –Default setting is Multimode. Choose the one

that fits the requirement of your router.

IP Network Settings This group allows you to obtain an IP address automatically

and allows you type in IP address manually.

Obtain an IP address automatically – Click this button to

obtain the IP address automatically.

More Options - Click it to display router name and domain

name items.

 Router Name – Type in the router name provided by

ISP.

 Domain Name – Type in the domain name that you have

assigned.

 DHCP Client Identifier - Check the box to specify

username and password as the DHCP client identifier

for some ISP.

 Username: Type a name as username. The

maximum length of the user name you can set is

63 characters.

 Password: Type a password. The maximum length

of the password you can set is 62 characters.

Specify an IP address – Click this radio button to specify

some data.

 IP Address – Type in the private IP address.

 Subnet Mask – Type in the subnet mask.

 Gateway IP Address – Type in gateway IP address.

 WAN IP Alias - If you have multiple public IP addresses

and would like to utilize them on the WAN interface,

please use WAN IP Alias. You can set up to 8 public IP

addresses other than the current one you are using.

Notice that this setting is available for WAN1 only. Type

the additional WAN IP address and check the Enable

box. Then click OK to exit the dialog.

Vigor2620 Series User’s Guide

66

DNS Server IP Address Type in the primary IP address for the router. If necessary,

type in secondary IP address for necessity in the future.

WAN Connection

Detection

Such function allows you to verify whether network

connection is alive or not through ARP Detect or Ping Detect.

Mode – Choose Always on, ARP Detect or Ping Detect for the

system to execute for WAN detection. If you choose Ping

Detect as the detection mode, you have to type required

settings for the following items.

 Primary/Secondary Ping IP – If you choose Ping Detect as

detection mode, you have to type Primary or Secondary IP

address in this field for pinging.

 Ping Gateway IP – If you choose Ping Detect as detection

mode, you also can enable this setting to use current WAN

gateway IP address for pinging. With the IP address(es)

pinging, Vigor router can check if the WAN connection is

on or off.

 TTL (Time to Live) – Set TTL value of PING operation.

 Ping Interval – Type the interval for the system to

execute the PING operation.

 Ping Retry – Type the number of times that the system is

allowed to execute the PING operation before WAN

disconnection is judged.

MTU It means Max Transmit Unit for packet.

Path MTU Discovery – It is used to detect the maximum MTU

size of a packet not to be segmented in specific transmit

path.

Click Detect to open the following dialog.

Vigor2620 Series User’s Guide

67

 Path MTU to – Type the IP address as the specific

transmit path.

 MTU size start from – Determine the starting point

value of the packet. Default setting is 1500.

 MTU reduce size by– It determines the decreasing size

of MTU value. For example, the number specified in

this field is “8”. The maximum MTU size is “1500”.

After clicking the “detect” button, the system will

calculate and get the suitable MTU value such as 1500,

1492, 1484 and etc., automatically.

 Detect – Click it to detect a suitable MTU value

 Accept – After clicking it, the detected value will be

displayed in the field of MTU.

RIP Protocol

Routing Information Protocol is abbreviated as RIP（RFC1058）

specifying how routers exchange routing tables information.

Click Enable RIP for activating this function.

Bridge Mode Enable Bridge Mode - If the function is enabled, the router

will work as a bridge modem. Yet, the incoming packets with

VLAN tags will be discarded.

Enable Firewall – It is available when Bridge Mode is

enabled. When both Bridge Mode and Firewall check boxes

are enabled, the settings configured (user profiles) under

User Management will be ignored. And all of the filter rules

defined and enabled in Firewall menu will be activated.

 Bridge Subnet – Make a bridge between the selected

LAN subnet and such WAN interface.

MAC Address Default MAC Address – Type in MAC address for the router.

You can use Default MAC Address or specify another MAC

address for your necessity.

Specify a MAC Address – Type in the MAC address for the

router manually.

After finishing all the settings here, please click OK to activate them.

Vigor2620 Series User’s Guide

68

I

-

2

-

2

-

3

D

e

t

a

i

l

s

P

a

g

e

f

o

r

P

o

E

i

n

W

A

N

1

(

P

h

y

s

i

c

a

l

M

o

d

e

:

V

D

S

L

2

)

To choose PPPoE as the accessing protocol of the Internet, please select PPPoE from the

WAN>>Internet Access >>WAN1 page. The following web page will be shown.

Available settings are explained as follows:

Item Description

Enable/Disable Click Enable for activating this function. If you click Disable,

this function will be closed and all the settings that you

adjusted in this page will be invalid.

ADSL Modem Setting It is not necessary to configure settings in these fields for

modem settings are prepared for ADSL only.

ISP Access Setup Enter your allocated username, password and authentication

parameters according to the information provided by your

ISP.

Username – Type in the username provided by ISP in this

field.

Password – Type in the password provided by ISP in this field.

Service Name – Type a name representing serive used.

Separate Account for ADSL – In default, WAN1 supports

VDSL2/ADSL and uses the same PPPoE account and password

for connection. If required, you can configure another

account and password for ADSL connection by checking this

box. If it is checked, the system will ask you to type another

Vigor2620 Series User’s Guide

69

group of account and password additionally.

WAN Connection

Detection

Such function allows you to verify whether network

connection is alive or not through ARP Detect or Ping Detect.

Mode – Choose ARP Detect or Ping Detect for the system to

execute for WAN detection. If you choose Ping Detect as the

detection mode, you have to type required settings for the

following items.

 Primary/Secondary Ping IP – If you choose Ping Detect as

detection mode, you have to type Primary or Secondary IP

address in this field for pinging.

 Ping Gateway IP – If you choose Ping Detect as detection

mode, you also can enable this setting to use current WAN

gateway IP address for pinging.

With the IP address(es) pinging, Vigor router can check if

the WAN connection is on or off.

 TTL (Time to Live) – Set TTL value of PING operation.

 Ping Interval – Type the interval for the system to

execute the PING operation.

 Ping Retry – Type the number of times that the system is

allowed to execute the PING operation before WAN

disconnection is judged.

MTU It means Max Transmit Unit for packet.

Path MTU Discovery – It is used to detect the maximum MTU

size of a packet not to be segmented in specific transmit

path.

Click Path MTU Discovery to open the following dialog.

 Path MTU to – Type the IP address as the specific

transmit path.

 MTU size start from – Determine the starting point

value of the packet.

 MTU reduce size by– It determines the decreasing size

of MTU value. For example, the number specified in

this field is “8”. The maximum MTU size is “1500”.

After clicking the “detect” button, the system will

calculate and get the suitable MTU value such as 1500,

1492, 1484 and etc., automatically.

 Detect – Click it to detect a suitable MTU value

 Accept– After clicking it, the detected value will be

displayed in the field of MTU.

PPP/MP Setup PPP Authentication – Select PAP only or PAP or CHAP for

PPP.

IP Assignment(IPCP) - Usually ISP dynamically assigns IP

address to you each time you connect to it and request. In

some case, your ISP provides service to always assign you the

same IP address whenever you request. In this case, you can

fill in this IP address in the Fixed IP field. Please contact your

ISP before you want to use this function.

Vigor2620 Series User’s Guide

70

Fixed IP Address – Type in a fixed IP address.

WAN IP Alias - If you have multiple public IP addresses and

would like to utilize them on the WAN interface, please use

WAN IP Alias. You can set up to 8 public IP addresses other

than the current one you are using.

Dial-Out Schedule Index (1-15) in Schedule Setup - You can type in four sets of

time schedule for your request. All the schedules can be set

previously in Applications >> Schedule web page and you

can use the number that you have set in that web page.

PPPoE Pass-through The router offers PPPoE dial-up connection. Besides, you

also can establish the PPPoE connection directly from local

clients to your ISP via the Vigor router. When PPPoA protocol

is selected, the PPPoE package transmitted by PC will be

transformed into PPPoA package and sent to WAN server.

Thus, the PC can access Internet through such direction.

For Wired LAN – If you check this box, PCs on the same

network can use another set of PPPoE session (different with

the Host PC) to access into Internet.

For Wireless LAN – It is available for n model. If you check

this box, PCs on the same wireless network can use another

set of PPPoE session (different with the Host PC) to access

into Internet.

Note: To have PPPoA Pass-through, please choose PPPoA

protocol and check the box(es) here. The router will behave

like a modem which only serves the PPPoE client on the LAN.

That’s, the router will offer PPPoA dial-up connection.

MAC Address Default MAC Address – You can use Default MAC Address or

specify another MAC address by typing on the boxes of MAC

Address for the router.

Specify a MAC Address – Type the MAC address for the router

manually.

After finished the above settings, click OK to save the settings.

Vigor2620 Series User’s Guide

71

I

-

2

-

2

-

4

D

e

t

a

i

l

s

P

a

g

e

f

o

r

M

P

o

A

/

S

t

a

t

i

c

o

r

D

y

n

a

m

i

c

I

P

i

n

W

A

N

1

(

P

h

y

s

i

c

a

l

M

o

d

e

:

V

D

S

L

2

)

MPoA is a specification that enables ATM services to be integrated with existing LANs, which

use either Ethernet, token-ring or TCP/IP protocols. The goal of MPoA is to allow different

LANs to send packets to each other via an ATM backbone.

To use MPoA/Static or Dynamic IP as the accessing protocol of the Internet, select

MPoA/Static or Dynamic IP from the WAN>>Internet Access >>WAN1 page. The following

web page will appear.

Available settings are explained as follows:

Item Description

Enable/Disable Click Enable for activating this function. If you click Disable,

this function will be closed and all the settings that you

adjusted in this page will be invalid.

ADSL Modem Settings It is not necessary to configure settings in these fields for

modem settings are prepared for ADSL only.

IP Network Settings Obtain an IP address automatically – Click this button to

obtain the IP address automatically.

More Options – Click it to display router name and domain

name items.

 Router Name – Type in the router name provided by

Vigor2620 Series User’s Guide

72

ISP.

 Domain Name – Type in the domain name that you have

assigned.

 DHCP Client Identifier* - Check the box to specify

username and password as the DHCP client identifier

for some ISP.

 Username: Type a name as username. The

maximum length of the user name you can set is 63

characters.

 Password: Type a password. The maximum length of

the password you can set is 62 characters.

Specify an IP address – Click this radio button to specify

some data.

 IP Address – Type in the private IP address.

 Subnet Mask – Type in the subnet mask.

 Gateway IP Address – Type in gateway IP address.

WAN IP Alias - If you have multiple public IP addresses and

would like to utilize them on the WAN interface, please use

WAN IP Alias. You can set up to 8 public IP addresses other

than the current one you are using. Notice that this setting is

available for WAN1 only. Type the additional WAN IP address

and check the Enable box. Then click OK to exit the dialog.

DNS Server IP Address Type in the primary IP address for the router. If necessary,

type in secondary IP address for necessity in the future.

WAN Connection

Detection

Such function allows you to verify whether network

connection is alive or not through ARP Detect or Ping Detect.

Mode – Choose ARP Detect, Ping Detect or Always On for

the system to execute for WAN detection. If you choose Ping

Detect as the detection mode, you have to type required

settings for the following items.

 Primary/Secondary Ping IP – If you choose Ping Detect as

Vigor2620 Series User’s Guide

73

detection mode, you have to type Primary or Secondary IP

address in this field for pinging.

 Ping Gateway IP – If you choose Ping Detect as detection

mode, you also can enable this setting to use current WAN

gateway IP address for pinging.

With the IP address(es) pinging, Vigor router can check if

the WAN connection is on or off.

 TTL (Time to Live) – Set TTL value of PING operation.

 Ping Interval – Type the interval for the system to

execute the PING operation.

 Ping Retry – Type the number of times that the system is

allowed to execute the PING operation before WAN

disconnection is judged.

MTU It means Max Transmit Unit for packet.

Path MTU Discovery – It is used to detect the maximum MTU

size of a packet not to be segmented in specific transmit

path.

Click Detect to open the following dialog.

 Path MTU to – Type the IP address as the specific

transmit path.

 MTU size start from – Determine the starting point

value of the packet. Default setting is 1500.

 MTU reduce size by– It determines the decreasing size

of MTU value. For example, the number specified in

this field is “8”. The maximum MTU size is “1500”.

After clicking the “detect” button, the system will

calculate and get the suitable MTU value such as 1500,

1492, 1484 and etc., automatically.

 Detect – Click it to detect a suitable MTU value

 Accept– After clicking it, the detected value will be

displayed in the field of MTU.

RIP Protocol

Routing Information Protocol is abbreviated as RIP（RFC1058）

specifying how routers exchange routing tables information.

Click Enable RIP for activating this function.

Bridge Mode Enable Bridge Mode - If the function is enabled, the router

will work as a bridge modem.

Enable Firewall – It is available when Bridge Mode is

enabled. When both Bridge Mode and Firewall check boxes

are enabled, the settings configured (user profiles) under

User Management will be ignored. And all of the filter rules

defined and enabled in Firewall menu will be activated.

Bridge Subnet – Make a bridge between the selected LAN

subnet and such WAN interface.

MAC Address Default MAC Address – Type in MAC address for the router.

You can use Default MAC Address or specify another MAC

address for your necessity.

Specify a MAC Address – Type in the MAC address for the

router manually.

After finishing all the settings here, please click OK to activate them.

Vigor2620 Series User’s Guide

74

I

-

2

-

2

-

5

D

e

t

a

i

l

s

P

a

g

e

f

o

r

P

o

E

i

n

W

A

N

2

(

P

h

y

s

i

c

a

l

M

o

d

e

:

E

t

h

e

r

n

e

t

)

To choose PPPoE as the accessing protocol of the Internet, please select PPPoE from the

WAN>>Internet Access >>WAN2 page. The following web page will be shown.

Available settings are explained as follows:

Item Description

Enable/Disable Click Enable for activating this function. If you click Disable,

this function will be closed and all the settings that you

adjusted in this page will be invalid.

ISP Access Setup Enter your allocated username, password and authentication

parameters according to the information provided by your

ISP.

Service Name - Enter the description of the specific network

service.

Username – Type in the username provided by ISP in this

field.

The maximum length of the user name you can set is 63

characters.

Password – Type in the password provided by ISP in this field.

The maximum length of the password you can set is 62

characters.

Index (1-15) - You can type in four sets of time schedule for

your request. All the schedules can be set previously in

Applications >> Schedule web page and you can use the

number that you have set in that web page.

WAN Connection

Such function allows you to verify whether network

Vigor2620 Series User’s Guide

75

Detection connection is alive or not through PPP Detect or Ping Detect.

Mode – Choose PPP Detect or Ping Detect for the system to

execute for WAN detection. If you choose Ping Detect as the

detection mode, you have to type required settings for the

following items.

 Primary/Secondary Ping IP – If you choose Ping Detect as

detection mode, you have to type Primary or Secondary IP

address in this field for pinging.

 Ping Gateway IP – If you choose Ping Detect as detection

mode, you also can enable this setting to use current WAN

gateway IP address for pinging.

With the IP address(es) pinging, Vigor router can check if

the WAN connection is on or off.

 TTL (Time to Live) – Set TTL value of PING operation.

 Ping Interval – Type the interval for the system to

execute the PING operation.

 Ping Retry – Type the number of times that the system is

allowed to execute the PING operation before WAN

disconnection is judged.

MTU It means Max Transmit Unit for packet.

Path MTU Discovery – It is used to detect the maximum MTU

size of a packet not to be segmented in specific transmit

path.

Click Detect to open the following dialog.

 Path MTU to – Type the IP address as the specific

transmit path.

 MTU size start from – Determine the starting point

value of the packet. Default setting is 1500.

 MTU reduce size by – It determines the decreasing size

of MTU value. For example, the number specified in

this field is “8”. The maximum MTU size is “1500”.

After clicking the “detect” button, the system will

calculate and get the suitable MTU value such as 1500,

1492, 1484 and etc., automatically.

 Detect – Click it to detect a suitable MTU value

 Accept – After clicking it, the detected value will be

displayed in the field of MTU.

TTL Change the TTL value – Enable or disable the TTL (Time to

Live) for a packet transmitted through Vigor router.

 Enable - TTL value will be reduced (-1) when it passess

through Vigor router. It will cause the client, accessing

Internet through Vigor router, be blocked by certain ISP

when TTL value becomes “0”.

 Disable – TTL value will not be reduced. Then, when a

packet passes through Vigor router, it will not be

cancelled. That is, the client who sends out the packet

will not be blocked by ISP.

Vigor2620 Series User’s Guide

76

PPP/MP Setup PPP Authentication – Select PAP only or PAP or CHAP for

PPP.

Idle Timeout – Set the timeout for breaking down the

Internet after passing through the time without any action.

IP Assignment (IPCP)- Usually ISP dynamically assigns IP

address to you each time you connect to it and request. In

some case, your ISP provides service to always assign you the

same IP address whenever you request. In this case, you can

fill in this IP address in the Fixed IP field. Please contact your

ISP before you want to use this function.

WAN IP Alias - If you have multiple public IP addresses and

would like to utilize them on the WAN interface, please use

WAN IP Alias. You can set up to 8 public IP addresses other

than the current one you are using. Notice that this setting is

available for WAN1 only. Type the additional WAN IP address

and check the Enable box. Then click OK to exit the dialog.

Fixed IP Address – Type in a fixed IP address.

Default MAC Address – You can use Default MAC Address or

specify another MAC address by typing on the boxes of MAC

Address for the router.

Specify a MAC Address – Type the MAC address for the router

manually.

After finishing all the settings here, please click OK to activate them.

I

-

2

-

2

-

6

D

e

t

a

i

l

s

P

a

g

e

f

o

r

S

t

a

t

i

c

o

r

D

y

n

a

m

i

c

I

P

i

n

W

A

N

2

(

P

h

y

s

i

c

a

l

M

o

d

e

:

E

t

h

e

r

n

e

t

)

For static IP mode, you usually receive a fixed public IP address or a public subnet, namely

multiple public IP addresses from your DSL or Cable ISP service providers. In most cases, a

Cable service provider will offer a fixed public IP, while a DSL service provider will offer a

public subnet. If you have a public subnet, you could assign an IP address or many IP address

to the WAN interface.

Vigor2620 Series User’s Guide

77

To use Static or Dynamic IP as the accessing protocol of the internet, please click the Static

or Dynamic IP tab. The following web page will be shown.

Available settings are explained as follows:

Item Description

Enable / Disable Click Enable for activating this function. If you click Disable,

this function will be closed and all the settings that you

adjusted in this page will be invalid.

Keep WAN Connection Normally, this function is designed for Dynamic IP

environments because some ISPs will drop connections if

there is no traffic within certain periods of time. Check

Enable PING to keep alive box to activate this function.

PING to the IP - If you enable the PING function, please

specify the IP address for the system to PING it for keeping

alive.

PING Interval - Enter the interval for the system to execute

the PING operation.

WAN Connection

Detection

Such function allows you to verify whether network

connection is alive or not through ARP Detect or Ping Detect.

Mode – Choose ARP Detect, Ping Detect or Always On for

the system to execute for WAN detection. If you choose Ping

Detect as the detection mode, you have to type required

settings for the following items.

 Primary/Secondary Ping IP – If you choose Ping Detect as

detection mode, you have to type Primary or Secondary IP

address in this field for pinging.

 Ping Gateway IP – If you choose Ping Detect as detection

Vigor2620 Series User’s Guide

78

mode, you also can enable this setting to use current WAN

gateway IP address for pinging.

With the IP address(es) pinging, Vigor router can check if

the WAN connection is on or off.

 TTL (Time to Live) – Set TTL value of PING operation.

 Ping Interval – Enter the interval for the system to

execute the PING operation.

 Ping Retry – Enter the number of times that the system is

allowed to execute the PING operation before WAN

disconnection is judged.

MTU It means Max Transmit Unit for packet.

Path MTU Discovery – It is used to detect the maximum MTU

size of a packet not to be segmented in specific transmit

path.

Click Detect to open the following dialog.

 Path MTU to – Choose the destination as the specific

transmit path and Enter the IP address.

 MTU size start from - Determine the starting point

value of the packet.

 MTU reduce size by – It determines the decreasing size

of MTU value. For example, the number specified in

this field is “8”. The maximum MTU size is “1500”.

After clicking the “detect” button, the system will

calculate and get the suitable MTU value such as 1500,

1492, 1484 and etc., automatically.

 Detect – Click it to detect a suitable MTU value

 Accept – After clicking it, the detected value will be

displayed in the field of MTU.

RIP Protocol

Routing Information Protocol is abbreviated as RIP（RFC1058）

specifying how routers exchange routing tables information.

Click Enable RIP for activating this function.

TTL Change the TTL value – Enable or disable the TTL (Time to

Live) for a packet transmitted through Vigor router.

Enable - TTL value will be reduced (-1) when it passess

through Vigor router. It will cause the client, accessing

Internet through Vigor router, be blocked by certain ISP

when TTL value becomes “0”.

Disable – TTL value will not be reduced. Then, when a packet

passes through Vigor router, it will not be cancelled. That is,

the client who sends out the packet will not be blocked by

ISP.

WAN IP Network Settings This group allows you to obtain an IP address automatically

and allows you Enter IP address manually.

WAN IP Alias - If you have multiple public IP addresses and

would like to utilize them on the WAN interface, please use

WAN IP Alias. You can set up to 8 public IP addresses other

Vigor2620 Series User’s Guide

79

than the current one you are using.

Obtain an IP address automatically – Click this button to

obtain the IP address automatically if you want to use

Dynamic IP mode.

 Router Name: Enter the router name provided by ISP.

 Domain Name: Enter the domain name that you have

assigned.

Specify an IP address – Click this radio button to specify

some data if you want to use Static IP mode.

 IP Address: Enter the IP address.

 Subnet Mask: Enter the subnet mask.

 Gateway IP Address: Enter the gateway IP address.

Default MAC Address: Click this radio button to use default

MAC address for the router.

Specify a MAC Address: Some Cable service providers

specify a specific MAC address for access authentication. In

such cases you need to click the Specify a MAC Address and

enter the MAC address in the MAC Address field.

DNS Server IP Address Enter the primary IP address for the router if you want to use

Static IP mode. If necessary, Enter secondary IP address for

necessity in the future.

After finishing all the settings here, please click OK to activate them.

Vigor2620 Series User’s Guide

80

I

-

2

-

2

-

7

D

e

t

a

i

l

s

P

a

g

e

f

o

r

P

T

P

To use PPTP as the accessing protocol of the internet, please click the PPTP tab. The

following web page will be shown.

Available settings are explained as follows:

Item Description

PPTP Enable - Click this radio button to enable a PPTP client to

establish a tunnel to a DSL modem on the WAN interface.

Disable – Click this radio button to close the connection

through PPTP.

Server Address - Specify the IP address of the PPTP server if

you enable PPTP client mode.

Specify Gateway IP Address – Specify the gateway IP address

for DHCP server.

ISP Access Setup Username -Enter the username provided by ISP in this field.

The maximum length of the user name you can set is 63

characters.

Password -Enter the password provided by ISP in this field.

The maximum length of the password you can set is 62

characters.

Index (1-15) in Schedule Setup - You can Enter four sets of

time schedule for your request. All the schedules can be set

previously in Application >> Schedule web page and you can

use the number that you have set in that web page.

MTU It means Max Transmit Unit for packet.

Path MTU Discovery – It is used to detect the maximum MTU

size of a packet not to be segmented in specific transmit

path.

Click Detect to open the following dialog.

Vigor2620 Series User’s Guide

81

 Path MTU to – Choose the destination as the specific

transmit path and Enter the IP address.

 MTU size start from - Determine the starting point

value of the packet.

 MTU reduce size by – It determines the decreasing size

of MTU value. For example, the number specified in

this field is “8”. The maximum MTU size is “1500”.

After clicking the “detect” button, the system will

calculate and get the suitable MTU value such as 1500,

1492, 1484 and etc., automatically.

 Detect – Click it to detect a suitable MTU value

 Accept – After clicking it, the detected value will be

displayed in the field of MTU.

PPP Setup PPP Authentication - Select PAP only or PAP or CHAP for

PPP.

Idle Timeout - Set the timeout for breaking down the

Internet after passing through the time without any action.

IP Address Assignment

Method(IPCP)

WAN IP Alias - If you have multiple public IP addresses and

would like to utilize them on the WAN interface, please use

WAN IP Alias. You can set up to 8 public IP addresses other

than the current one you are using.

Fixed IP - Usually ISP dynamically assigns IP address to you

each time you connect to it and request. In some case, your

ISP provides service to always assign you the same IP address

whenever you request. In this case, you can fill in this IP

address in the Fixed IP field. Please contact your ISP before

you want to use this function. Click Yes to use this function

and Enter a fixed IP address in the box.

Fixed IP Address -Type a fixed IP address.

WAN IP Network Settings Obtain an IP address automatically – Click this button to

obtain the IP address automatically.

Specify an IP address – Click this radio button to specify

some data.

 IP Address – Enter the IP address.

 Subnet Mask – Enter the subnet mask.

After finishing all the settings here, please click OK to activate them.

Vigor2620 Series User’s Guide

82

I

-

2

-

2

-

8

D

e

t

a

i

l

s

P

a

g

e

f

o

r

I

P

v

6

–

O

f

l

i

n

e

When Offline is selected, the IPv6 connection will be disabled.

I

-

2

-

2

-

9

D

e

t

a

i

l

s

P

a

g

e

f

o

r

I

P

v

6

–

P

During the procedure of IPv4 PPPoE connection, we can get the IPv6 Link Local Address

between the gateway and Vigor router through IPv6CP. Later, use DHCPv6 or accept RA to

acquire the IPv6 prefix address (such as: 2001:B010:7300:200::/64) offered by the ISP. In

addition, PCs under LAN also can have the public IPv6 address for Internet access by means of

the generated prefix.

No need to type any other information for PPP mode.

Available settings are explained as follows:

Item Description

WAN Connection

Detection

Such function allows you to verify whether network

connection is alive or not through Ping Detect.

Mode – Choose NS Detect, Always On or Ping Detect for the

system to execute for WAN detection. Always On means no

detection will be executed. The network connection will be

on always.

 Ping IP/Hostname – If you choose Ping Detect as

detection mode, you have to type IP address in this field

for pinging.

 TTL (Time to Live) –If you choose Ping Detect as

detection mode, you have to type TTL value.

Vigor2620 Series User’s Guide

83

RIPng Protocol RIPng (RIP next generation) offers the same functions and

benefits as IPv4 RIP v2.

Below shows an example for successful IPv6 connection based on PPP mode.

Info

At present, the IPv6 prefix can be acquired via the PPPoE mode connection which is

available for the areas such as Taiwan (hinet), the Netherlands, Australia and UK.

I

-

2

-

2

-

1

0

D

e

t

a

i

l

s

P

a

g

e

f

o

r

I

P

v

6

–

T

S

P

C

Tunnel setup protocol client (TSPC) is an application which could help you to connect to IPv6

network easily.

Please make sure your IPv4 WAN connection is OK and apply one free account from hexago

(http://gogonet.gogo6.com/page/freenet6-account ) before you try to use TSPC for network

connection. TSPC would connect to tunnel broker and requests a tunnel according to the

specifications inside the configuration file. It gets a public IPv6 IP address and an IPv6 prefix

from the tunnel broker and then monitors the state of the tunnel in background.

After getting the IPv6 prefix and starting router advertisement daemon (RADVD), the PC

behind this router can directly connect to IPv6 the Internet.

Vigor2620 Series User’s Guide

84

Available settings are explained as follows:

Item Description

Username Enter the name obtained from the broker. It is suggested for

you to apply another username and password for

http://gogonet.gogo6.com/page/freenet6-account.

The maximum length of the name you can set is 63

characters.

Password Enter the password assigned with the user name.

The maximum length of the name you can set is 19

characters.

Tunnel Broker Enter the address for the tunnel broker IP, FQDN or an

optional port number.

WAN Connection

Detection

Such function allows you to verify whether network

connection is alive or not through Ping Detect.

Mode – Choose NS Detect, Always On or Ping Detect for the

system to execute for WAN detection. Always On means no

detection will be executed. The network connection will be

on always.

 Ping IP/Hostname – If you choose Ping Detect as

detection mode, you have to type IP address in this field

for pinging.

 TTL (Time to Live) –If you choose Ping Detect as

detection mode, you have to type TTL value.

After finished the above settings, click OK to save the settings.

Vigor2620 Series User’s Guide

85

I

-

2

-

2

-

1

D

e

t

a

i

l

s

P

a

g

e

f

o

r

I

P

v

6

–

A

I

C

U

Available settings are explained as follows:

Item Description

Always On Check this box to keep the network connection always.

Username Enter the name obtained from the broker. Please apply new

account at http://www.sixxs.net/. It is suggested for you to

apply another username and password.

The maximum length of the name you can set is 19

characters.

Password Enter the password assigned with the user name.

The maximum length of the password you can set is 19

characters.

Tunnel Broker It means a server of AICCU. The server can provide IPv6

tunnels to sites or end users over IPv4.

Enter the address for the tunnel broker IP, FQDN or an

optional port number.

Tunnel ID One user account may have several tunnels. And, each

tunnel shall have one specified tunnel ID (e.g., T115394).

Enter the ID offered by Tunnel Broker.

Subnet Prefix Enter the subnet prefix address obtained from service

provider.

The maximum length of the prefix you can set is 128

characters.

WAN Connection

Detection

Such function allows you to verify whether network

connection is alive or not through Ping Detect.

Mode – Choose NS Detect, Always On or Ping Detect for the

system to execute for WAN detection.

 Ping IP/Hostname – If you choose Ping Detect as

Vigor2620 Series User’s Guide

86

detection mode, you have to type IP address in this field

for pinging.

 TTL (Time to Live) –If you choose Ping Detect as

detection mode, you have to type TTL value.

After finished the above settings, click OK to save the settings.

I

-

2

-

2

-

1

2

D

e

t

a

i

l

s

P

a

g

e

f

o

r

I

P

v

6

–

D

H

C

P

v

6

C

l

i

e

n

t

DHCPv6 client mode would use DHCPv6 protocol to obtain IPv6 address from server.

Available settings are explained as follows:

Item Description

DHCPv6 Client

Configuration

IAID - Type a number as IAID.

WAN Connection

Detection

Such function allows you to verify whether network

connection is alive or not through NS Detect or Ping Detect.

Mode – Choose Always On, Ping Detect or NS Detect for

the system to execute for WAN detection. With NS Detect

mode, the system will check if network connection is

established or not, like IPv4 ARP Detect. Always On means

no detection will be executed. The network connection will

be on always.

 Ping IP/Hostname – If you choose Ping Detect as

detection mode, you have to type IP address in this field

for pinging.

 TTL (Time to Live) –If you choose Ping Detect as

detection mode, you have to type TTL value.

RIPng Protocol RIPng (RIP next generation) offers the same functions and

benefits as IPv4 RIP v2.

After finished the above settings, click OK to save the settings.

Vigor2620 Series User’s Guide

8

7

I

-

2

-

2

-

1

3

D

e

t

a

i

l

s

P

a

g

e

f

o

r

I

P

v

6

–

S

t

a

t

i

c

I

P

v

6

This type allows you to setup static IPv6 address for WAN interface.

Available settings are explained as follows:

Item Description

Static IPv6 Address

configuration

IPv6 Address – Enter the IPv6 Static IP Address.

Prefix Length – Enter the fixed value for prefix length.

Add – Click it to add a new entry.

Update – Click it to modify an existed entry.

Delete – Click it to remove an existed entry.

Current IPv6 Address

Table

Display current interface IPv6 address.

Static IPv6 Gateway

Configuration

IPv6 Gateway Address - Type your IPv6 gateway address

here.

WAN Connection

Detection

Such function allows you to verify whether network

connection is alive or not through Ping Detect.

Mode – Choose NS Detect, Always On or Ping Detect for the

system to execute for WAN detection. Always On means no

detection will be executed. The network connection will be

on always.

Vigor2620 Series User’s Guide

88

 Ping IP/Hostname – If you choose Ping Detect as

detection mode, you have to type IP address in this field

for pinging.

 TTL (Time to Live) –If you choose Ping Detect as

detection mode, you have to type TTL value.

RIPng Protocol RIPng (RIP next generation) offers the same functions and

benefits as IPv4 RIP v2.

After finished the above settings, click OK to save the settings.

I

-

2

-

2

-

1

4

D

e

t

a

i

l

s

P

a

g

e

f

o

r

I

P

v

6

–

6

i

n

4

S

t

a

t

i

c

T

u

n

e

l

This type allows you to setup 6in4 Static Tunnel for WAN interface.

Such mode allows the router to access IPv6 network through IPv4 network.

However, 6in4 offers a prefix outside of 2002::0/16. So, you can use a fixed endpoint rather

than anycast endpoint. The mode has more reliability.

Available settings are explained as follows:

Item Description

Remote Endpoint IPv4

Address

Enter the static IPv4 address for the remote server.

6in4 IPv6 Address Enter the static IPv6 address for IPv4 tunnel with the value

for prefix length.

LAN Routed Prefix Enter the static IPv6 address for LAN routing with the value

for prefix length.

Tunnel TTL Enter the number for the data lifetime in tunnel.

WAN Connection

Detection

Such function allows you to verify whether network

connection is alive or not through Ping Detect.

Mode – Choose NS Detect, Always On or Ping Detect for

the system to execute for WAN detection. Always On

means no detection will be executed. The network

connection will be on always.

 Ping IP/Hostname – If you choose Ping Detect as

detection mode, you have to type IP address in this field

Vigor2620 Series User’s Guide

89

for pinging.

 TTL (Time to Live) –If you choose Ping Detect as

detection mode, you have to type TTL value.

After finished the above settings, click OK to save the settings.

Below shows an example for successful IPv6 connection based on 6in4 Static Tunnel mode.

Vigor2620 Series User’s Guide

90

I

-

2

-

2

-

1

5

D

e

t

a

i

l

s

P

a

g

e

f

o

r

I

P

v

6

–

6

r

d

This type allows you to setup 6rd for WAN interface.

Available settings are explained as follows:

Item Description

6rd Mode Auto 6rd – Retrieve 6rd prefix automatically from 6rd service

provider. The IPv4 WAN must be set as "DHCP".

Static 6rd - Set 6rd options manually.

IPv4 Border Relay Enter the IPv4 addresses of the 6rd Border Relay for a given

6rd domain.

IPv4 Mask Length Type a number of high-order bits that are identical across all

CE IPv4 addresses within a given 6rd domain.

It may be any value between 0 and 32.

6rd Prefix Enter the 6rd IPv6 address.

6rd Prefix Length Enter the IPv6 prefix length for the 6rd IPv6 prefix in number

of bits.

WAN Connection

Detection

Such function allows you to verify whether network

connection is alive or not through Ping Detect.

Mode – Choose NS Detect, Always On or Ping Detect for the

system to execute for WAN detection. Always On means no

detection will be executed. The network connection will be

on always.

 Ping IP/Hostname – If you choose Ping Detect as

detection mode, you have to type IP address in this field

for pinging.

 TTL (Time to Live) –If you choose Ping Detect as

detection mode, you have to type TTL value.

After finished the above settings, click OK to save the settings.

Below shows an example for successful IPv6 connection based on 6rd mode.

Vigor2620 Series User’s Guide

91

Vigor2620 Series User’s Guide

92

I

-

2

-

3

M

u

l

t

i

-

P

V

C

/

V

L

A

N

Multi-VLAN allows users to create profiles for specific WAN interface and bridge connections

for user applications that require very high network throughput. Simply go to WAN and select

Multi-VLAN.

Channel 1 to 2 have the following fixed assignments and cannot be altered.

 Channel 1: ADSL on WAN1.

 Channel 2: Ethernet on WAN2 (based on the model)

 Channel 3: LTE on WAN3.

Channels 5 through 7 can be configured as virtual WANs (WAN5 through WAN7).

G

e

n

e

r

a

l

This page shows the basic configurations used by every channel.

Available settings are explained as follows:

Item Description

Channel Display the number of each channel.

Channels 1 and 2 are used by the Internet Access web user

interface and can not be configured here.

Channels 5 ~ 7 are configurable.

Enable Display whether the settings in this channel are enabled

(Yes) or not (No).

WAN Type Displays the physical medium that the channel will use.

VLAN Tag Displays the VLAN tag value that will be used for the packets

traveling on this channel.

Port-based Bridge The network traffic flowing on each channel will be

identified by the system via their VLAN Tags. Channels using

the same WAN type may not configure the same VLAN tag

value.

Enable - Check this box to enable the port-based bridge

function on this channel.

P1 ~ P2 – Check the box(es) to build bridge connection on

LAN.

Vigor2620 Series User’s Guide

93

To configure a PVC channel, click its channel number.

WAN links for Channel 5, 6 and 7 are provided for router-borne application such as TR-069.

The settings must be applied and obtained from your ISP. For your special request, please

contact with your ISP and then click WAN link of Channel 5, 6 and 7 to configure your router.

Available settings are explained as follows:

Item Description

Enable Channel 4/5/6 Enable – Select to enable this channel.

Disable – Select to disable this channel.

General Settings VLAN Tag – Enter the value as the VLAN ID number. Valid

settings are in the range from 1 to 4095. The network traffic

flowing on each channel will be identified by the system via

their VLAN Tags. Channels using the same WAN type may not

configure the same VLAN tag value.

Priority – Choose the number to determine the packet

priority for such VLAN. The range is from 0 to 7.

Open Port-based Bridge The settings here will create a bridge between the LAN ports

Vigor2620 Series User’s Guide

9

4

Connection for this

Channel

selected and the WAN. The WAN interface of the bridge

connection will be built upon the WAN type selected using

the VLAN tag configured.

Physical Members – Group the physical ports by checking the

corresponding check box(es) for applying the port-based

bridge connection.

Note: LAN port P1 is reserved for NAT use and cannot be

selected for bridging.

Open WAN Interface for

this Channel

Check the box to enable relating function.

WAN Application

 Management can be specified for general management

(Web configuration/telnet/TR069). If you choose

Management, the configuration for this VLAN will be

effective for Web configuration/telnet/TR069.

 IPTV - The IPTV configuration will allow the WAN

interface to send IGMP packets to IPTV servers.

WAN Connection Detection – Such function allows you to

verify whether network connection is alive or not through

ARP Detect or Ping Detect.

Mode – Choose ARP Detect or Ping Detect for the system to

execute for WAN detection. If you choose Ping Detect as the

detection mode, you have to type required settings for the

following items.

 Primary/Secondary Ping IP – If you choose Ping Detect as

detection mode, you have to type Primary or Secondary IP

address in this field for pinging.

 Ping Gateway IP – If you choose Ping Detect as detection

mode, you also can enable this setting to use current WAN

gateway IP address for pinging.

With the IP address(es) pinging, Vigor router can check if

the WAN connection is on or off.

 TTL (Time to Live) – Set TTL value of PING operation.

 Ping Interval – Type the interval for the system to

execute the PING operation.

 Ping Retry – Type the number of times that the system is

allowed to execute the PING operation before WAN

disconnection is judged.

PPPoE/PPPoA Client Enter your allocated username, password and authentication

parameters according to the information provided by your

ISP.

ISP Name – PPP Service Name. Enter if your ISP requires this

setting; otherwise leave blank.

Username – Name provided by the ISP for PPPoE/PPPoA

authentication. Maximum length is 62 characters.

Password – Password provided by the ISP for PPPoE/PPPoA

authentication. Maximum length is 62 characters.

PPP Authentication –The protocol used for PPP

authentication.

 PAP only- Only PAP (Password Authentication Protocol)

is used.

 PAP or CHAP- Both PAP and CHAP

(Challenge-Handshake Authentication Protocol) can be

used for PPP authentication. Router negotiates with the

PPTP or L2TP server to determine which protocol to

Vigor2620 Series User’s Guide

95

use.

Always On – If selected, the router will maintain the

PPPoE/PPPoA connection.

Idle Timeout – Maximum length of time, in seconds, of idling

allowed (no traffic) before the connection is dropped.

IP Address From ISP - Specifies how the WAN IP address of

the channel configured.

 Fixed IP

Yes - IP address entered in the Fixed IP Address field

will be used as the IP address of the virtual WAN.

No - Virtual WAN IP address will be assigned by the ISP’s

PPPoE/PPPoA server.

MPoA Obtain an IP address automatically – Select this option if the

router is to receive IP configuration information from a DHCP

server.

 Router Name – Sets the value of DHCP Option 12, which

is used by some ISPs.

 Domain Name – Sets the value of DHCP Option 15,

which is used by some ISPs.

Specify an IP address – Select this option to manually enter

the IP address.

 IP Address – Type in the IP address.

 Subnet Mask – Type in the subnet mask.

 Gateway IP Address – Type in gateway IP address.

DNS Server IP Address - Type in the primary IP address for

the router if you want to use Static IP mode. If necessary,

type in secondary IP address for necessity in the future.

After finished the above settings, click OK to save the settings and return to previous page.

A

d

v

a

n

c

e

d

Such configuration is applied to upstream packets. Such information will be provided by ISP.

Please contact with your ISP for detailed information.

Vigor2620 Series User’s Guide

96

Available settings are explained as follows:

Item Description

QoS Type Select a proper QoS type for the channel according to the

information that your ISP provides.

PCR It represents Peak Cell Rate. The default setting is “0”.

SCR It represents Sustainable Cell Rate. The value of SCR must be

smaller than PCR.

MBS It represents Maximum Burst Size. The range of the value is

10 to 50.

PVC to PVC Binding It allows the enabled PVC channel to use the same ADSL

connection settings of another PVC channel. Please choose

the PVC channel via the drop down list.

After finished the above settings, click OK to save the settings.

Vigor2620 Series User’s Guide

9

7

A

p

l

i

c

a

t

i

o

n

N

o

t

e

s

A

-

1

H

o

w

t

o

c

o

n

f

i

g

u

r

e

I

P

v

6

o

n

W

A

N

i

n

t

e

r

f

a

c

e

?

This document is going to demonstrate how to implement an IPv6 address on Vigor Router's

WAN.

1. Before configuring IPv6 on WAN, please make sure the router is connected to the IPv4

Internet.

2. Go to WAN >> Internet Access, click on IPv6 of the WAN interface that you would like to

configure an IPv6 address.

3. Select a Connection Type from the drop-down list, enter the required parameters. Then

click OK and reboot the router to apply the settings.

Vigor2620 Series User’s Guide

98

4. After accomplishing the configurations, Network Administrator may check the status from

the IPv6 tab on Online Status >> Physical Connection page.

5. Furthermore, Network Administrator may test the connectivity of IPv6 from the router by

going to Diagnostics >> Ping Diagnosis and selecting "IPv6".

Below we will provide some examples of configuring IPv6 with different connection types.

Vigor2620 Series User’s Guide

99

P

(

P

o

i

n

t

-

t

o

-

P

o

i

n

t

P

r

o

t

o

c

o

l

)

This applies if the IPv4 access mode is PPPoE, and the IPv4 ISP also provides an IPv6 address.

To use IPv6 PPP, you just need to choose the Connection Type to "PPP", no other setting is

required.

T

S

P

C

(

T

u

n

e

l

S

e

t

u

p

P

r

o

t

o

c

o

l

C

l

i

e

n

t

)

In this mode, the IPv6 connectivity is provided by a tunnel broker on the IPv4 Internet through

a tunnel set up by Tunnel Setup Protocol (TSP). To use TSPC, you'll need to sign up for a

tunnel broker service and get a username and password first, then, configure the router as

follows:

1. Set Connection Type to TSPC.

2. Enter the Username and Password registered at the TSP server.

3. Enter the IP or Domain Name of the TSPC server for Tunnel Broker.

Vigor2620 Series User’s Guide

100

S

t

a

t

i

c

I

P

v

6

If your ISP provides a static IPv6 address for you, you may configure that IPv6 address for WAN

by doing the following steps:

1. Set Connection Type to Static IPv6.

2. Enter the IPv6 address and Prefix Length which provided by the ISP, and click Add.

3. You should see the IPv6 address in Current IPv6 Address Table. Then, specify the IP

address of IPv6 Gateway.

Vigor2620 Series User’s Guide

101

6

i

n

4

S

t

a

t

i

c

T

u

n

e

l

In this mode, the IPv6 connectivity is provided by a tunnel broker on the IPv4 Internet through

a tunnel configured manually. To use 6in4 Static Tunnel, you need sign up for a tunnel broker

service and get an IPv6 address and routed IPv6 prefixes first. Then, configure the router as

follows:

1. Set Connection Type to 6in4 Static Tunnel.

2. Enter the tunnel server's IPv4 address in Remote Endpoint IPv4 Address.

3. Enter the router's IPv6 address in 6in4 IPv6 Address.

4. Enter the routed IPv6 prefix in LAN Routed Prefix.

Vigor2620 Series User’s Guide

102

I

-

3

L

A

N

Local Area Network (LAN) is a group of subnets regulated and ruled by router. The design of

network structure is related to what type of public IP addresses coming from your ISP.

The most generic function of Vigor router is NAT. It creates a private subnet of your own. As

mentioned previously, the router will talk to other public hosts on the Internet by using public

IP address and talking to local hosts by using its private IP address. What NAT does is to

translate the packets from public IP address to private IP address to forward the right packets

to the right host and vice versa. Besides, Vigor router has a built-in DHCP server that assigns

private IP address to each local host. See the following diagram for a briefly understanding.

In some special case, you may have a public IP subnet from your ISP such as 220.135.240.0/24.

This means that you can set up a public subnet or call second subnet that each host is

equipped with a public IP address. As a part of the public subnet, the Vigor router will serve

for IP routing to help hosts in the public subnet to communicate with other public hosts or

servers outside. Therefore, the router should be set as the gateway for public hosts.

Vigor2620 Series User’s Guide

103

W

h

a

t

i

s

R

o

u

t

i

n

g

I

n

f

o

r

m

a

t

i

o

n

P

r

o

t

o

c

o

l

(

R

I

P

)

Vigor router will exchange routing information with neighboring routers using the RIP to

accomplish IP routing. This allows users to change the information of the router such as IP

address and the routers will automatically inform for each other.

W

h

a

t

i

s

S

t

a

t

i

c

R

o

u

t

e

When you have several subnets in your LAN, sometimes a more effective and quicker way for

connection is the Static routes function rather than other method. You may simply set rules

to forward data from one specified subnet to another specified subnet without the presence

of RIP.

W

h

a

t

a

r

e

V

i

r

t

u

a

l

L

A

N

s

a

n

d

R

a

t

e

C

o

n

t

r

o

l

You can group local hosts by physical ports and create up to 8 virtual LANs. To manage the

communication between different groups, please set up rules in Virtual LAN (VLAN) function

and the rate of each.

Vigor2620 Series User’s Guide

104

W

e

b

U

s

e

r

I

n

t

e

r

f

a

c

e

A LAN comprises a collection of LAN clients, which are networked devices on your premises. A

LAN client can be a computer, a printer, a Voice-over-IP (VoIP) phone, a mobile phone, a

gaming console, an Internet Protocol Television (IPTV), etc, and can have either a wired

(using Ethernet cabling) or wireless (using Wi-Fi) network connection.

LAN clients within the same LAN are normally able to communicate with one another directly,

as they are peers to one another, unless measures, such as firewalls or VLANs, have been put

in place to restrict such access. Nowadays the most common LAN firewalls are implemented

on the LAN client itself. For example, Microsoft Windows since Windows XP and Apple OS X

have built-in firewalls that can be configured to restrict traffic coming in and going out of the

computer. VLANs, on the other hand, are usually set up using network switches or routers.

To communicate with the hosts outside of the LAN, LAN clients have to go through a network

gateway, which in most cases is a router that sits between the LAN and the ISP network,

which is the WAN. The router acts as a director to ensure traffic between the LAN and the

WAN reach their intended destinations.

I

-

3

-

1

G

e

n

e

r

a

l

S

e

t

u

p

This page provides you the general settings for LAN. Click LAN to open the LAN settings page

and choose General Setup.

There are four subnets provided by the router which allow users to divide groups into

different subnets (LAN1 – LAN2). In addition, different subnets can link for each other by

configuring Inter-LAN Routing. At present, LAN1 setting is fixed with NAT mode only. LAN2 –

LAN4 can be operated under NAT or Route mode. IP Routed Subnet can be operated under

Route mode.

Vigor2620 Series User’s Guide

105

Available settings are explained as follows:

Item Description

General Setup Allow to configure settings for each subnet respectively.

Index - Display all of the LAN items.

Enable- Basically, LAN1 status is enabled in default. LAN2

and IP Routed Subnet can be observed by checking the

Enable box.

DHCPv6- LAN1 is configured with DHCP in default. If

required, please check the DHCP box for each LAN.

IP Address - Display the IP address for each LAN item. Such

information is set in default and you can not modify it.

Details Page - Click it to access into the setting page. Each

LAN will have different LAN configuration page. Each LAN

must be configured in different subnet.

IPv6 – Click it to access into the settings page of IPv6.

DHCP Server Option DHCP packets can be processed by adding option number and

data information when such function is enabled.

For detailed information, refer to later section.

Force router to use “DNS

server IP address” …..

Force Vigor router to use DNS servers configured in

LAN1/LAN2 instead of DNS servers given by the Internet

Access server (PPPoE, PPTP or DHCP server).

Inter-LAN Routing Check the box to link two or more different subnets (LAN and

LAN).

Inter-LAN Routing allows different LAN subnets to be

interconnected or isolated.

It is only available when the VLAN functionality is enabled.

Refer to section II-2-2 VLAN on how to set up VLANs.

In the Inter-LAN Routing matrix, a selected checkbox means

that the 2 intersecting LANs can communicate with each

other.

When you finish the configuration, please click OK to save and exit this page.

Vigor2620 Series User’s Guide

106

Info

To configure a subnet, select its Detials Page button to bring up the LAN

Details Page.

I

-

3

-

1

-

1

D

e

t

a

i

l

s

P

a

g

e

f

o

r

L

A

N

1

–

E

t

h

e

r

n

e

t

T

C

P

/

I

P

a

n

d

D

H

C

P

S

e

t

u

p

There are two configuration pages for LAN1, Ethernet TCP/IP and DHCP Setup (based on IPv4)

and IPv6 Setup. Click the tab for each type and refer to the following explanations for

detailed information.

Available settings are explained as follows:

Item Description

Network Configuration For NAT Usage,

IP Address - This is the IP address of the router. (Default:

192.168.1.1).

Subnet Mask - The subnet mask, together with the IP Address

field, indicates the maximum number of clients allowed on

the subnet. (Default: 255.255.255.0/ 24).

RIP Protocol Control,

Enable – When Enabled, the router will attempt to exchange

routing information with neighbouring routers using the

Routing Information Protocol.

DHCP Server

Configuration

DHCP stands for Dynamic Host Configuration Protocol. The

router by factory default acts a DHCP server for your network

so it automatically dispatches related IP settings to any local

user configured as a DHCP client. It is highly recommended

that you leave the router enabled as a DHCP server if you do

not have a DHCP server for your network.

If you want to use another DHCP server in the network other

than the Vigor Router’s, you can let Relay Agent help you to

redirect the DHCP request to the specified location.

Disable – Let you manually assign IP address to every host in

the LAN.

Enable Server - Let the router assign IP address to every host

in the LAN.

 Start IP Address - The beginning LAN IP address that is

Vigor2620 Series User’s Guide

107

given out to LAN DHCP clients.

 IP Pool Counts - The maximum number of IP addresses

to be handed out by DHCP. The default value is 200.

Valid range is between 1 and 253. The actual number of

IP addresses available for assignment is the IP Pool

Counts, or 253 minus the last octet of the Start IP

Address, whichever is smaller.

 Gateway IP Address - The IP address of the gateway,

which is the host on the LAN that relays all traffic

coming into and going out of the LAN. The gateway is

normally the router, and therefore the Gateway IP

Address should be identical to the IP Address in the

Network Configuration section above.

 Lease Time - The maximum duration DHCP-issued IP

addresses can be used before they have to be renewed.

 Clear DHCP lease for inactive clients periodically - If

selected, the router sends ARP requests recycles IP

addresses previously assigned to inactive DHCP clients

to prevent exhaustion of the IP address pool.

Note: When Clear DHCP lease for inactive clients

periodically is enabled, router will do the following:

 Check activities of DHCP clients by ARP requests

every minute when the available DHCP IP

addresses are less than 30

 Clear DHCP lease when the client is not

responding ARP replies.

Enable Relay Agent – When selected, all DHCP requests are

forwarded to a DHCP server outside of the LAN subnet, and

whose address is specified in the DHCP Server IP Address

field.

 DHCP Server IP Address – It is available when Enable

Relay Agent is checked. Set the IP address of the DHCP

server you are going to use so the Relay Agent can help

to forward the DHCP request to the DHCP server.

DNS Server IP Address DNS stands for Domain Name System. Every Internet host

must have a unique IP address, also they may have a

human-friendly, easy to remember name such as

www.yahoo.com. The DNS server converts the user-friendly

name into its equivalent IP address.

Primary IP Address -You must specify a DNS server IP address

here because your ISP should provide you with usually more

than one DNS Server.

Secondary IP Address - You can specify secondary DNS server

IP address here because your ISP often provides you more

than one DNS Server.

The default DNS Server IP address can be found via Online

Status:

If both the Primary IP and Secondary IP Address fields are left

empty, the router will assign its own IP address to local users

as a DNS proxy server and maintain a DNS cache.

Vigor2620 Series User’s Guide

108

If the IP address of a domain name is already in the DNS

cache, the router will resolve the domain name immediately.

Otherwise, the router forwards the DNS query packet to the

external DNS server by establishing a WAN (e.g. DSL/Cable)

connection.

When you finish the configuration, please click OK to save and exit this page.

Private IP addresses can be assigned automatically to LAN clients using Dynamic Host

Configuration Protocol (DHCP), or manually assigned. The DHCP server can either be the

router (the most common case), or a separate server, that hands out IP addresses to DHCP

clients.

Alternatively, static IP addresses can be manually configured on LAN clients as part of their

network settings. No matter how IP addresses are configured, it is important that no two

devices get the same IP address. If both DHCP and static assignment are used on a network, it

is important to exclude the static IP addresses from the DHCP IP pool. For example, if your

LAN uses the 192.168.1.x subnet and you have 20 DHCP clients and 20 static IP clients, you

could configure 192.168.1.10 as the Start IP Address, 50 as the IP Pool Counts (enough for the

current number of DHCP clients, plus room for future expansion), and use addresses greater

than 192.168.1.100 for static assignment.

I

-

3

-

1

-

2

D

e

t

a

i

l

s

P

a

g

e

f

o

r

L

A

N

2

Available settings are explained as follows:

Item Description

Network Configuration Enable/Disable - Click Enable to enable such configuration;

click Disable to disable such configuration.

For NAT Usage - Click this radio button to invoke NAT

function.

For Routing Usage - Click this radio button to invoke this

function.

IP Address - This is the IP address of the router. (Default:

192.168.1.1).

Subnet Mask - The subnet mask, together with the IP Address

field, indicates the maximum number of clients allowed on

the subnet. (Default: 255.255.255.0/ 24).

DHCP Server DHCP stands for Dynamic Host Configuration Protocol. The

Vigor2620 Series User’s Guide

109

Configuration router by factory default acts a DHCP server for your network

so it automatically dispatch related IP settings to any local

user configured as a DHCP client. It is highly recommended

that you leave the router enabled as a DHCP server if you do

not have a DHCP server for your network.

Disable Server – Let you manually assign IP address to every

host in the LAN.

Enable Server - Let the router assign IP address to every host

in the LAN.

 Start IP Address - The beginning LAN IP address that is

given out to LAN DHCP clients.

 IP Pool Counts - The maximum number of IP addresses

to be handed out by DHCP. The default value is 100.

Valid range is between 1 and 253. The actual number of

IP addresses available for assignment is the IP Pool

Counts, or 253 minus the last octet of the Start IP

Address, whichever is smaller.

 Gateway IP Address - The IP address of the gateway,

which is the host on the LAN that relays all traffic

coming into and going out of the LAN. The gateway is

normally the router, and therefore the Gateway IP

Address should be identical to the IP Address in the

Network Configuration section above.

 Lease Time - The maximum duration DHCP-issued IP

addresses can be used before they have to be renewed.

 Clear DHCP lease for inactive clients periodically - If

selected, the router sends ARP requests recycles IP

addresses previously assigned to inactive DHCP clients

to prevent exhaustion of the IP address pool.

Note: When Clear DHCP lease for inactive clients

periodically is enabled, router will do the following:

 Check activities of DHCP clients by ARP requests

every minute when the available DHCP IP

addresses are less than 30

 Clear DHCP lease when the client is not

responding ARP replies.

Enable Relay Agent – When selected, all DHCP requests are

forwarded to a DHCP server outside of the LAN subnet, and

whose address is specified in the DHCP Server IP Address

field.

 DHCP Server IP Address – It is available when Enable

Relay Agent is checked. Set the IP address of the DHCP

server you are going to use so the Relay Agent can help

to forward the DHCP request to the DHCP server.

DNS Server IP Address DNS stands for Domain Name System. Every Internet host

must have a unique IP address, also they may have a

human-friendly, easy to remember name such as

www.yahoo.com. The DNS server converts the user-friendly

name into its equivalent IP address.

Primary IP Address -You must specify a DNS server IP address

here because your ISP should provide you with usually more

than one DNS Server.

Secondary IP Address - You can specify secondary DNS server

IP address here because your ISP often provides you more

than one DNS Server.

The default DNS Server IP address can be found via Online

Vigor2620 Series User’s Guide

110

Status:

If both the Primary IP and Secondary IP Address fields are left

empty, the router will assign its own IP address to local users

as a DNS proxy server and maintain a DNS cache.

If the IP address of a domain name is already in the DNS

cache, the router will resolve the domain name immediately.

Otherwise, the router forwards the DNS query packet to the

external DNS server by establishing a WAN (e.g. DSL/Cable)

connection.

When you finish the configuration, please click OK to save and exit this page.

I

-

3

-

1

-

3

D

e

t

a

i

l

s

P

a

g

e

f

o

r

I

P

R

o

u

t

e

d

S

u

b

n

e

t

Available settings are explained as follows:

Item Description

Network Configuration Enable/Disable - Click Enable to enable such configuration;

click Disable to disable such configuration.

For Routing Usage,

IP Address - This is the IP address of the router. (Default:

192.168.1.1).

Subnet Mask - The subnet mask, together with the IP Address

field, indicates the maximum number of clients allowed on

the subnet. (Default: 255.255.255.0/ 24).

RIP Protocol Control,

Enable – When Enabled, the router will attempt to exchange

routing information with neighbouring routers using the

Vigor2620 Series User’s Guide

111

Routing Information Protocol.

DHCP Server

Configuration

DHCP stands for Dynamic Host Configuration Protocol. The

router by factory default acts a DHCP server for your network

so it automatically dispatch related IP settings to any local

user configured as a DHCP client. It is highly recommended

that you leave the router enabled as a DHCP server if you do

not have a DHCP server for your network.

If you want to use another DHCP server in the network other

than the Vigor Router’s, you can let Relay Agent help you to

redirect the DHCP request to the specified location.

Start IP Address - The beginning LAN IP address that is given

out to LAN DHCP clients.

IP Pool Counts - The maximum number of IP addresses to be

handed out by DHCP. The default value is 100. Valid range is

between 1 and 253. The actual number of IP addresses

available for assignment is the IP Pool Counts, or 253 minus

the last octet of the Start IP Address, whichever is smaller.

Lease Time - The maximum duration DHCP-issued IP

addresses can be used before they have to be renewed.

Use LAN Port – Specify an IP for IP Route Subnet. If it is

enabled, DHCP server will assign IP address automatically for

the clients coming from P1 and/or P2. Please check the box

of P1 and P2.

Use MAC Address - Check such box to specify MAC address.

 MAC Address: Enter the MAC Address of the host one by

one and click Add to create a list of hosts which can be

assigned, deleted or edited from above pool. Set a list

of MAC Address for 2

nd

DHCP server will help router to

assign the correct IP address of the correct subnet to

the correct host. So those hosts in 2

nd

subnet won’t get

an IP address belonging to 1

st

subnet.

Add – Enter the MAC address in the boxes and click this

button to add.

Delete – Click it to delete the selected MAC address.

Edit – Click it to edit the selected MAC address.

Cancel – Click it to cancel the job of adding, deleting and

editing.

When you finish the configuration, please click OK to save and exit this page.

Vigor2620 Series User’s Guide

112

I

-

3

-

1

-

4

D

e

t

a

i

l

s

P

a

g

e

f

o

r

L

A

N

I

P

v

6

S

e

t

u

p

There are two configuration pages for each LAN. Click the tab for each type and refer to the

following explanations for detailed information. Below shows the settings page for IPv6.

It provides 2 daemons for LAN side IPv6 address configuration. One is SLAAC(stateless) and

the other is DHCPv6 (Stateful) server.

Available settings are explained as follows:

Item Description

Enable IPv6 Check the box to enable the configuration of LAN 1 IPv6

Setup.

WAN Primary Interface Use the drop down list to specify a WAN interface for IPv6.

Static IPv6 Address IPv6 Address –Type static IPv6 address for LAN.

Vigor2620 Series User’s Guide

113

Prefix Length – Enter the fixed value for prefix length.

Add – Click it to add a new entry.

Delete – Click it to remove an existed entry.

Unique Local Address

(ULA) configuration

Unique Local Addresses (ULAs) are private IPv6 addresses

assigned to LAN clients.

Off - ULA is disabled.

Manually ULA Prefix - LAN clients will be assigned ULAs

generated based on the prefix manually entered.

Auto ULA Prefix - LAN clients will be assigned ULAs using an

automatically-determined prefix.

Current IPv6 Address

Table

Display current used IPv6 addresses.

DNS Server IPv6 Address Deploy when WAN is up – The RA (router advertisement)

packets will be sent to LAN PC with DNS server information

only when network connection by any one of WAN interfaces

is up.

Enable – The RA (router advertisement) packets will be sent

to LAN PC with DNS server information no matter WAN

connection is up or not.

 Primary DNS Sever – Enter the IPv6 address for Primary

DNS server.

 Secondary DNS Server –Type another IPv6 address for

DNS server if required.

Disable – DNS server will not be used.

Management Configures the Managed Address Configuration flag (M-bit) in

Route Advertisements.

 Off - No configuration information is sent using Route

Advertisements.

 SLAAC(stateless) - M-bit is unset.

 DHCPv6(stateful) - M-bit is set, which indicates to LAN

clients that they should acquire all IPv6 configuration

information from a DHCPv6 server. The DHCPv6 server

can either be the one built into the Vigor2860, or a

separate DHCPv6 server.

Other Option(O-bit) When selected, the Other Configuration flag is set, which

indicates to LAN clients that IPv6 configuration information

besides LAN IPv6 addresses is available from a DHCPv6

server.

Setting the M-bit (see Management above) has the same

effect as implicitly setting the O-bit, as DHCPv6 supplies all

IPv6 configuration information, including what is indicated as

available when the O-bit is set.

DHCPv6 Server Enable Server –Click it to enable DHCPv6 server. DHCPv6

Vigor2620 Series User’s Guide

114

Server could assign IPv6 address to PC according to the

Start/End IPv6 address configuration.

Disable Server –Click it to disable DHCPv6 server.

IPv6 Address Random Allocation -

Auto IPv6 range – After check the box, Vigor router will

assign the IPv6 range automatically.

Start IPv6 Address / End IPv6 Address –Enter the start and

end address for IPv6 server.

Advance setting – Click the Edit button to configure

advanced IPv6 settings for DHCPv6 server.

Advance setting The Advanced Settings page has additional settings for

Router Advertisement and enabling multiple WANs for IPv6

traffic.

Router Advertisement Configuration – Click Enable to

enable router advertisement server. The router

advertisement daemon sends Router Advertisement

messages, specified by RFC 2461, to a local Ethernet LAN

periodically and when requested by a node sending a Router

Solicitation message. These messages are required for IPv6

stateless auto-configuration.

Disable – Click it to disable router advertisement server.

Hop Limt – The value is required for the device behind the

router when IPv6 is in use.

Vigor2620 Series User’s Guide

115

Min/Max Interval Time (sec) – It defines the interval

(between minimum time and maximum time) for sending RA

(Router Advertisement) packets.

Default Lifetime (sec) –Within such period of time,

Vigor2620 can be treated as the default gateway.

Default Preference – It determines the priority of the host

behind the router when RA (Router Advertisement) packets

are transmitted.

MTU – It means Max Transmit Unit for packet. If Auto is

selected, the router will determine the MTU value for LAN.

RIPng Protocol –RIPng (RIP next generation) offers the same

functions and benefits as IPv4 RIP v2.

Extension WAN – In addition to the default WAN used for

IPv6 traffic specified in the WAN Primary Interface in the LAN

IPv6 Setup page, additional WANs can be selected to carry

IPv6 traffic by enabling them in the Extension WAN section.

Available WAN – Additional WANs available but not currently

selected to carry IPv6 traffic.

Selected WAN – Additional WANs selected to carry IPv6

traffic.

After making changes on the Advance setting page, click the OK button to retain the changes

and return to the LAN IPv6 Setup page. Be sure to click OK on the LAN IPv6 Setup page or else

changes made on the Advance setting page will not be saved.

I

-

3

-

1

-

5

A

d

v

a

n

c

e

d

D

H

C

P

O

p

t

i

o

n

s

DHCP Options can be configured by clicking the Advanced button on the LAN General Setup

screen.

Vigor2620 Series User’s Guide

116

Available settings are explained as follows:

Item Description

Customized List Shows all the DHCP options that have been configured in the

system.

Enable If selected, DHCP option entry is enabled.

If unselected, DHCP option entry is disabled.

Interface LAN interface(s) to which this entry is applicable.

Next Server IP

Address/SIAddr

Overrides the DHCP Next Server IP address (DHCP Option 66)

supplied by the DHCP server.

Option Number DHCP option number (e.g., 100).

DataType Type of data in the Data field:

ASCII Character - A text string. Example: /path.

Hexadecimal Digit - A hexadecimal string. Valid characters

are from 0 to 9 and from a to f. Example: 2f70617468.

Address List - One or more IPv4 addresses, delimited by

commas.

Data Data of this DHCP option.

To add a DHCP option entry from scratch, clear the data entry fields (Enable, Interface,

Option Number, DataType and Data) by clicking Reset. After filling in the values, click Add

to create the new entry.

To add a DHCP option entry modeled after an existing entry, click the model entry in

Customized List. The data entry fields will be populated with values from the model entry.

After making all necessary changes for the new entry, click Add to create it.

To modify an existing DHCP option entry, click on it in Customized List. The data entry fields

will be populated with the current values from the entry. After making all necessary changes,

click Update to save the changes.

To delete a DHCP option entry, click on it in Customized List, and then click Delete.

Vigor2620 Series User’s Guide

11

7

I

-

3

-

2

V

L

A

N

Virtual Local Area Networks (VLANs) allow you to subdivide your LAN to facilitate

management or to improve network security.

Select LAN>>VLAN from the menu bar of the Web UI to bring up the VLAN Configuration page.

T

a

g

e

d

V

L

A

N

The tagged VLANs (802.1q) can mark data with a VLAN identifier. This identifier can be

carried through an onward Ethernet switch to specific ports. The specific VLAN clients can

also pick up this identifier as it is just passed to the LAN. You can set the priorities for

LAN-side QoS. You can assign each of VLANs to each of the different IP subnets that the router

may also be operating, to provide even more isolation. The said functionality is tag-based

multi-subnet.

P

o

r

t

-

B

a

s

e

d

V

L

A

N

Relative to tag-based VLAN which groups clients with an identifier, port-based VLAN uses

physical ports (P1 ~ P2) to separate the clients into different VLAN group.

Virtual LAN function provides you a very convenient way to manage hosts by grouping them

based on the physical port. The multi-subnet can let a small businesses have much better

isolation for multi-occupancy applications. Go to LAN page and select VLAN. The following

page will appear. Click Enable to invoke VLAN function.

Below is an example page in Vigor2620Ln:

Vigor2620 Series User’s Guide

118

Info

Settings in this page only applied to LAN port but not WAN port.

Available settings are explained as follows:

Item Description

Enable Click it to enable VLAN configuration.

LAN P1 – P2– Check the LAN port(s) to group them under the

selected VLAN.

Wireless LAN SSID1 – SSID4 – Check the SSID boxes to group them under the

selected VLAN.

Subnet Choose one of them to make the selected VLAN mapping to

the specified subnet only. For example, LAN1 is specified for

VLAN0. It means that PCs grouped under VLAN0 can get the

IP address(es) that specified by the subnet.

VLAN Tag

Enable – Check the box to enable the function of VLAN with

tag.

The router will add specific VLAN number to all packets on

the LAN while sending them out.

Please Enter the tag value and specify the priority for the

packets sending by LAN.

VID – Enter the value as the VLAN ID number. The range is

form 0 to 4095. VIDs must be unique.

Priority – Valid values are from 0 to 7, where 1 has the

lowest priority, followed by 0, and finally from 2 to 7 in

increasing order of priority.

Info

Leave one VLAN untagged at least to prevent from not connecting to Vigor

router due to unexpected error.

The Vigor router supports up to 8 VLANs. Each VLAN can be set up to use one or more of the

Ethernet ports and wireless LAN Service Set Identifiers (SSIDs). Within the grid of VLANs

(horizontal rows) and LAN interfaces (vertical columns),

 all hosts within the same VLAN (horizontal row) are visible to one another

 all hosts connected to the same LAN or WLAN interface (vertical column) are visible to

one another if

- they belong to the same VLAN, or

- they belong to different VLANs, and inter-LAN routing (LAN>>General Setup) between

them is enabled (see below).

Vigor2620 Series User’s Guide

119

Inter-LAN Routing allows different LAN subnets to be interconnected or isolated. It is

only available when the VLAN functionality is enabled. In the Inter-LAN Routing matrix,

a selected checkbox means that the 2 intersecting LANs can communicate with each

other.

Vigor2620 series features a hugely flexible VLAN system. In its simplest form, each of the

Gigabit LAN ports can be isolated from each other, for example to feed different companies

or departments but keeping their local traffic completely separated.

C

o

n

f

i

g

u

r

i

n

g

p

o

r

t

-

b

a

s

e

d

V

L

A

N

f

o

r

w

i

r

e

l

e

s

a

n

d

n

o

n

-

w

i

r

e

l

e

s

c

l

i

e

n

t

s

1. All the wire network clients are categorized to group VLAN0 in subnet 192.168.1.0/24

(LAN1).

2. All the wireless network clients are categorized to group VLAN1 in subnet

192.168.2.0/24 (LAN2).

3. Open LAN>>VLAN. Check the boxes according to the statement in step 1 and Step 2.

4. Click OK.

5. Open LAN>>General Setup. If you want to let the clients in both groups communicate

with each other, simply activate Inter-LAN Routing by checking the box between LAN1

and LAN2.

Vigor2620 Series User’s Guide

120

Vigor router supports up to six private IP subnets on LAN. Each can be independent

(isolated) or common (able to communicate with each other). This is ideal for

departmental or multi-occupancy applications.

Info

As for the VLAN applications, refer to “Appendix I: VLAN Application on

Vigor Router” for more detailed information.

I

-

3

-

3

B

i

n

d

I

P

t

o

M

A

C

This function is used to bind the IP and MAC address in LAN to have a strengthening control in

network. With the Bind IP to MAC feature you can reserve LAN IP addresses for LAN clients.

Each reserved IP address is associated with a Media Access Control (MAC) address.

Click LAN and click Bind IP to MAC to open the setup page.

Vigor2620 Series User’s Guide

121

Available settings are explained as follows:

Item Description

Enable Click this radio button to invoke this function. However,

IP/MAC which is not listed in IP Bind List also can connect to

Internet.

Disable Click this radio button to disable this function. All the

settings on this page will be invalid.

Vigor2620 Series User’s Guide

122

Strict Bind Check the box to block the connection of the IP/MAC which is

not listed in IP Bind List.

LAN clients will be assigned IP addresses according to the

MAC-to-IP address associations on this page. LAN client

whose MAC address has not been bound to an IP address will

be denied network access.

Note: Before selecting Strict Bind, make sure at least one

valid MAC address has been bound to an IP address.

Otherwise no LAN clients will have network access, and it

will not be possible to connect to the router to make changes

to its configuration.

Apply Strict Bind to Subnet – Choose the subnet(s) for

applying the rules of Bind IP to MAC.

ARP Table This table is the LAN ARP table of this router. The

information for IP and MAC will be displayed in this field.

Each pair of IP and MAC address listed in ARP table can be

selected and added to IP Bind List by clicking Add below.

Select All Select all entries in the ARP Table for manipulation.

Sort Reorder the entry based on the IP address.

Refresh Refresh the ARP table listed below to obtain the newest ARP

table information.

Add / Update to IP Bind

List

IP Address – Enter the IP address to be associated with a

MAC address.

Mac Address – Enter the MAC address of the LAN client’s

network interface.

Comment – Type a brief description for the entry.

Add - It allows you to add the one you choose from the ARP

table or the IP/MAC address typed in Add and Edit to the

table of IP Bind List.

Update - It allows you to edit and modify the selected IP

address and MAC address that you create before.

Delete - You can remove any item listed in IP Bind List.

Simply click and select the one, and click Delete. The

selected item will be removed from the IP Bind List.

IP Bind List It displays a list for the IP bind to MAC information.

Backup IP Bind List Click Backup and enter a filename to back up IP Bind List to a

file.

Upload From File

Click Browse… to select an IP Bind List backup file. Click

Restore to restore the backup and overwrite the existing

list.

Vigor2620 Series User’s Guide

123

Info

Before you select Strict Bind, you have to bind one set of IP/MAC address for

one PC. If not, no one of the PCs can access into Internet. And the web user

interface of the router might not be accessed.

When you finish the configuration, click OK to save the settings.

Vigor2620 Series User’s Guide

124

I

-

4

N

A

T

Usually, the router serves as an NAT (Network Address Translation) router. NAT is a

mechanism that one or more private IP addresses can be mapped into a single public one.

Public IP address is usually assigned by your ISP, for which you may get charged. Private IP

addresses are recognized only among internal hosts.

When the outgoing packets destined to some public server on the Internet reach the NAT

router, the router will change its source address into the public IP address of the router,

select the available public port, and then forward it. At the same time, the router shall list an

entry in a table to memorize this address/port-mapping relationship. When the public server

response, the incoming traffic, of course, is destined to the router’s public IP address and the

router will do the inversion based on its table. Therefore, the internal host can communicate

with external host smoothly.

The benefit of the NAT includes:

 Save cost on applying public IP address and apply efficient usage of IP address. NAT

allows the internal IP addresses of local hosts to be translated into one public IP address,

thus you can have only one IP address on behalf of the entire internal hosts.

 Enhance security of the internal network by obscuring the IP address. There are

many attacks aiming victims based on the IP address. Since the attacker cannot be

aware of any private IP addresses, the NAT function can protect the internal network.

Info

On NAT page, you will see the private IP address defined in RFC-1918.

Usually we use the 192.168.1.0/24 subnet for the router. As stated before,

the NAT facility can map one or more IP addresses and/or service ports into

different specified services. In other words, the NAT function can be

achieved by using port mapping methods.

Vigor2620 Series User’s Guide

125

W

e

b

U

s

e

r

I

n

t

e

r

f

a

c

e

I

-

4

-

1

P

o

r

t

R

e

d

i

r

e

c

t

i

o

n

Port Redirection is usually set up for server related service inside the local network (LAN),

such as web servers, FTP servers, E-mail servers etc. Most of the case, you need a public IP

address for each server and this public IP address/domain name are recognized by all users.

Since the server is actually located inside the LAN, the network well protected by NAT of the

router, and identified by its private IP address/port, the goal of Port Redirection function is

to forward all access request with public IP address from external users to the mapping

private IP address/port of the server.

The port redirection can only apply to incoming traffic.

To use this function, please go to NAT page and choose Port Redirection web page. The Port

Redirection Table provides 40 port-mapping entries for the internal hosts.

Vigor2620 Series User’s Guide

126

Each item is explained as follows:

Item Description

Index Display the number of the profile.

Enable Check the box to enable the profile.

Service Name Display the description of the specific network service.

WAN Interface Display the WAN IP address used by the profile.

Protocol Display the transport layer protocol (TCP or UDP).

Public Port Display the port number which will be redirected to the

specified Private IP and Port of the internal host.

Source IP Display the source IP address or object.

Private IP Display the IP address of the internal host providing the

service.

Press any number under Index to access into next page for configuring port redirection.

Vigor2620 Series User’s Guide

12

7

Available settings are explained as follows:

Item Description

Enable Check this box to enable such port redirection setting.

Mode Two options (Single and Range) are provided here for you to

choose. To set a range for the specific service, select Range.

In Range mode, if the public port (start port and end port)

and the starting IP of private IP had been entered, the

system will calculate and display the ending IP of private IP

automatically.

Service Name Enter the description of the specific network service.

Protocol Select the transport layer protocol (TCP or UDP).

WAN Interface Select the WAN IP used for port redirection. There are eight

WAN IP alias that can be selected and used for port

redirection.

The default setting is All which means all the incoming data

from any port will be redirected to all intefaces.

Public Port Specify which port can be redirected to the specified Private

IP and Port of the internal host. If you choose Range as the

port redirection mode, you will see two boxes on this field.

Enter the required number on the first box (as the starting

port) and the second box (as the ending port).

Source IP Use the drop down list to specify an IP object. Or click IP

Object link to create a new one for applying.

Private IP Specify the private IP address of the internal host providing

the service. If you choose Range as the port redirection

mode, you will see two boxes on this field. Type a complete

IP address in the first box (as the starting point). The second

one will be assigned automatically later.

Private Port Specify the private port number of the service offered by the

internal host.

After finishing all the settings here, please click OK to save the configuration.

Vigor2620 Series User’s Guide

128

Note that the router has its own built-in services (servers) such as Telnet, HTTP and FTP etc.

Since the common port numbers of these services (servers) are all the same, you may need to

reset the router in order to avoid confliction.

For example, the built-in web user interface in the router is with default port 80, which may

conflict with the web server in the local network, http://192.168.1.13:80. Therefore, you

need to change the router’s http port to any one other than the default port 80 to avoid

conflict, such as 8080. This can be set in the System Maintenance >>Management Setup. You

then will access the admin screen of by suffixing the IP address with 8080, e.g.,

http://192.168.1.1:8080 instead of port 80.

Vigor2620 Series User’s Guide

129

I

-

4

-

2

D

M

Z

H

o

s

t

As mentioned above, Port Redirection can redirect incoming TCP/UDP or other traffic on

particular ports to the specific private IP address/port of host in the LAN. However, other IP

protocols, for example Protocols 50 (ESP) and 51 (AH), do not travel on a fixed port. Vigor

router provides a facility DMZ Host that maps ALL unsolicited data on any protocol to a single

host in the LAN. Regular web surfing and other such Internet activities from other clients will

continue to work without inappropriate interruption. DMZ Host allows a defined internal user

to be totally exposed to the Internet, which usually helps some special applications such as

Netmeeting or Internet Games etc.

The security properties of NAT are somewhat bypassed if you set up DMZ host. We suggest

you to add additional filter rules or a secondary firewall.

Click DMZ Host to open the following page. You can set different DMZ host for each WAN

interface. Click the WAN tab to switch into the configuration page for that WAN.

Vigor2620 Series User’s Guide

130

Available settings are explained as follows:

Item Description

Choose Private IP or None first.

Private IP Enter the private IP address of the DMZ host, or click Choose

IP to select one.

Choose IP Click this button and then a window will automatically pop

up, as depicted below. The window consists of a list of private

IP addresses of all hosts in your LAN network. Select one

private IP address in the list to be the DMZ host.

When you have selected one private IP from the above dialog,

the IP address will be shown on the following screen. Click OK

to save the setting.

If you previously have set up WAN Alias for PPPoE or Static or Dynamic IP mode in WAN

interface, you will find them in Aux. WAN IP for your selection.

Available settings are explained as follows:

Item Description

Enable Check to enable the DMZ Host function.

Private IP Enter the private IP address of the DMZ host, or click Choose

IP to select one.

Vigor2620 Series User’s Guide

131

Choose IP Click this button and then a window will automatically pop

up, as depicted below. The window consists of a list of

private IP addresses of all hosts in your LAN network. Select

one private IP address in the list to be the DMZ host.

When you have selected one private IP from the above

dialog, the IP address will be shown on the screen. Click OK

to save the setting.

After finishing all the settings here, please click OK to save the configuration.

Vigor2620 Series User’s Guide

132

I

-

4

-

3

O

p

e

n

P

o

r

t

s

Open Ports allows you to open a range of ports for the traffic of special applications.

Common application of Open Ports includes P2P application (e.g., BT, KaZaA, Gnutella,

WinMX, eMule and others), Internet Camera etc. Ensure that you keep the application

involved up-to-date to avoid falling victim to any security exploits.

Click Open Ports to open the following page:

Available settings are explained as follows:

Item Description

Index Indicate the relative number for the particular entry that you

want to offer service in a local host. You should click the

appropriate index number to edit or clear the corresponding

entry.

Comment Specify the name for the defined network service.

WAN Interface Display the WAN interface used by such index.

Aux. WAN IP Display the IP alias setting used by such index. If no IP alias

setting exists, such field will not appear.

Source IP Display the name of source IP object.

Local IP Address Display the private IP address of the local host offering the

service.

Status Display the state for the corresponding entry. X or V is to

represent the Inactive or Active state.

To add or edit port settings, click one index number on the page. The index entry setup page

will pop up. In each index entry, you can specify 10 port ranges for diverse services.

Vigor2620 Series User’s Guide

133

Available settings are explained as follows:

Item Description

Enable Open Ports Check to enable this entry.

Comment Make a name for the defined network application/service.

Source IP Use the drop down list to specify an IP object. Or click IP

Object link to create a new one for applying.

Private IP Enter the private IP address of the local host or click Choose

IP to select one.

Choose IP - Click this button and, subsequently, a window

having a list of private IP addresses of local hosts will

automatically pop up. Select the appropriate IP address of

the local host in the list.

Protocol Specify the transport layer protocol. It could be TCP, UDP,

or ----- (none) for selection.

Start Port Specify the starting port number of the service offered by

the local host.

End Port Specify the ending port number of the service offered by the

local host.

Vigor2620 Series User’s Guide

134

After finishing all the settings here, please click OK to save the configuration.

I

-

4

-

4

A

L

G

ALG means Application Layer Gateway. There are two methods provided by Vigor router,

RTSP (Real Time Streaming Protocol) ALG and SIP (Session Initiation Protocol) ALG, for

processing the packets of voice and video.

RTSP ALG makes RTSP message, RTCP message, and RTP packets of voice and video be

transmitted and received correctly via NAT by Vigor router.

However, SIP ALG makes SIP message and RTP packets of voice be transmitted and received

correctly via NAT by Vigor router.

Available settings are explained as follows:

Item Description

Enable ALG Check to enable such function.

Listen Port Type a port number for SIP or RTSP protocol.

Vigor2620 Series User’s Guide

135

TCP Check the box to make correspond protocol message packet

from TCP transmit and receive via NAT.

UDP Check the box to make correspond protocol message packet

from UDP transmit and receive via NAT.

Vigor2620 Series User’s Guide

136

I

-

5

A

p

l

i

c

a

t

i

o

n

s

D

y

n

a

m

i

c

D

N

S

The ISP often provides you with a dynamic IP address when you connect to the Internet via

your ISP. It means that the public IP address assigned to your router changes each time you

access the Internet. The Dynamic DNS feature lets you assign a domain name to a dynamic

WAN IP address. It allows the router to update its online WAN IP address mappings on the

specified Dynamic DNS server. Once the router is online, you will be able to use the registered

domain name to access the router or internal virtual servers from the Internet. It is

particularly helpful if you host a web server, FTP server, or other server behind the router.

Before you use the Dynamic DNS feature, you have to apply for free DDNS service to the DDNS

service providers. The router provides up to three accounts from three different DDNS service

providers. Basically, Vigor routers are compatible with the DDNS services supplied by most

popular DDNS service providers such as www.dyndns.org, www.no-ip.com, www.dtdns.com,

www.changeip.com, www.dynamic- nameserver.com. You should visit their websites to

register your own domain name for the router.

S

c

h

e

d

u

l

e

The Vigor router has a built-in clock which can update itself manually or automatically by

means of Network Time Protocols (NTP). As a result, you can not only schedule the router to

dialup to the Internet at a specified time, but also restrict Internet access to certain hours so

that users can connect to the Internet only during certain hours, say, business hours. The

schedule is also applicable to other functions.

R

A

D

I

U

S

Remote Authentication Dial-In User Service (RADIUS) is a security authentication

client/server protocol that supports authentication, authorization and accounting, which is

widely used by Internet service providers. It is the most common method of authenticating

and authorizing dial-up and tunneled network users.

The built-in RADIUS client feature enables the router to assist the remote dial-in user or a

wireless station and the RADIUS server in performing mutual authentication. It enables

centralized remote access authentication for network management.

U

P

n

P

The UPnP (Universal Plug and Play) protocol is supported to bring to network connected

devices the ease of installation and configuration which is already available for directly

connected PC peripherals with the existing Windows 'Plug and Play' system. For NAT routers,

the major feature of UPnP on the router is “NAT Traversal”. This enables applications inside

the firewall to automatically open the ports that they need to pass through a router.

Vigor2620 Series User’s Guide

13

7

W

e

b

U

s

e

r

I

n

t

e

r

f

a

c

e

I

-

5

-

1

D

y

n

a

m

i

c

D

N

S

E

n

a

b

l

e

t

h

e

F

u

n

c

t

i

o

n

a

n

d

A

d

a

D

y

n

a

m

i

c

D

N

S

A

c

o

u

n

t

1. Assume you have a registered domain name from the DDNS provider, say

hostname.dyndns.org, and an account with username: test and password: test.

2. Open Applications>>Dynamic DNS.

3. In the DDNS setup menu, check Enable Dynamic DNS Setup.

Available settings are explained as follows:

Item Description

Enable Dynamic DNS

Setup

Check this box to enable DDNS function.

Set to Factory

Default

Clear all profiles and recover to factory settings.

View Log Display DDNS log status.

Force Update Force the router updates its information to DDNS server.

Auto-Update

interval

Set the time for the router to perform auto update for DDNS

service.

Index Click the number below Index to access into the setting page

of DDNS setup to set account(s).

Vigor2620 Series User’s Guide

138

Enable Check the box to enable this account.

Domain Name Display the domain name that you set on the setting page of

DDNS setup.

4. Select Index number 1 to add an account for the router. Check Enable Dynamic DNS

Account, and choose correct Service Provider: dyndns.org, Enter the registered

hostname: hostname and domain name suffix: dyndns.org in the Domain Name block.

The following two blocks should be typed your account Login Name: test and Password:

test.

If User-Defined is specified as the service provider, the web page will be changed

slightly as follows:

Available settings are explained as follows:

Item Description

Vigor2620 Series User’s Guide

139

Enable Dynamic DNS

Account

Check this box to enable the current account. If you did

check the box, you will see a check mark appeared on the

Active column of the previous web page in step 2).

Service Provider Select the service provider for the DDNS account.

Provider Host Enter the IP address or the domain name of the host which

provides related service.

Note that such option is available when Customized is

selected as Service Provider.

Service API Enter the API information obtained from DDNS server.

Note that such option is available when Customized is

selected as Service Provider.

(e.g:

/dynamic/dns/update.asp?u=jo***&p=jo********&hostname=j*

***.changeip.org&ip=###IP### &cmd=update&offline=0)

Auth Type Two types can be used for authentication.

Basic – Username and password defined later can be shown

from the packets captured.

URL - Username and password defined later can be shown in

URL.

(e.g., http://ns1.vigorddns.com/ddns.php?username=xxxx&

password=xxxx&domain=xxxx.vigorddns.com)

Note that such option is available when Customized is

selected as Service Provider.

Connection Type There are two connection types (HTTP and HTTPs) to be

specified. Note that such option is available when

Customized is selected as Service Provider.

Server Response Type any text that you want to receive from the DDNS

server.

Note that such option is available when Customized is

selected as Service Provider.

Login Name Enter the login name that you set for applying domain.

Password Enter the password that you set for applying domain.

Wildcard The Wildcard feature is not supported for all Dynamic DNS

providers. You could get more detailed information from

their websites.

Mail Extender If the mail server is defined with another name, please Enter

the name in this area. Such mail server will be used as

backup mail exchange.

Determine WAN IP If a Vigor router is installed behind any NAT router, you can

enable such function to locate the real WAN IP.

When the WAN IP used by Vigor router is private IP, this

function can detect the public IP used by the NAT router and

use the detected IP address for DDNS update.

There are two methods offered for you to choose:

 WAN IP - If it is selected and the WAN IP of Vigor router

is private, DDNS update will take place right away.

 Internet IP – If it is selected and the WAN IP of Vigor

router is private, it will be converted to public IP

before DDNS update takes place.

5. Click OK button to activate the settings. You will see your setting has been saved.

Vigor2620 Series User’s Guide

140

D

i

s

a

b

l

e

t

h

e

F

u

n

c

t

i

o

n

a

n

d

C

l

e

a

r

a

l

D

y

n

a

m

i

c

D

N

S

A

c

o

u

n

t

s

Uncheck Enable Dynamic DNS Setup, and click Clear All button to disable the function and

clear all accounts from the router.

I

-

5

-

2

S

c

h

e

d

u

l

e

The Vigor router has a built-in clock which can update itself manually or automatically by

means of Network Time Protocols (NTP). As a result, you can not only schedule the router to

dialup to the Internet at a specified time, but also restrict Internet access to certain hours so

that users can connect to the Internet only during certain hours, say, business hours. The

schedule is also applicable to other functions.

You have to set your time before set schedule. In System Maintenance>> Time and Date

menu, press Inquire Time button to set the Vigor router’s clock to current time of your PC.

The clock will reset once if you power down or reset the router. There is another way to set

up time. You can inquiry an NTP server (a time server) on the Internet to synchronize the

router’s clock. This method can only be applied when the WAN connection has been built up.

Available settings are explained as follows:

Item Description

Set to Factory Default Clear all profiles and recover to factory settings.

Index Click the index number link to access into the setting page of

schedule.

Enable Click the box to enable such schedule profile.

Comment Display the name of the time schedule.

You can set up to 15 schedules. Then you can apply them to your Internet Access or VPN and

Remote Access >> LAN to LAN settings.

To add a schedule:

1. Click any index, say Index No. 1.

2. The detailed settings of the schedule with index 1 will be shown below.

Vigor2620 Series User’s Guide

141

Available settings are explained as follows:

Item Description

Enable Schedule

Setup

Check to enable the schedule.

Comment Type a short description for such schedule.

Start Date

(yyyy-mm-dd)

Specify the starting date of the schedule.

Start Time (hh:mm) Specify the starting time of the schedule.

Duration Time

(hh:mm)

Specify the duration (or period) for the schedule.

Action Specify which action Call Schedule should apply during the

period of the schedule.

Force On -Force the connection to be always on.

Force Down -Force the connection to be always down.

Enable Dial-On-Demand -Specify the connection to be

dial-on-demand and the value of idle timeout should be

specified in Idle Timeout field.

Disable Dial-On-Demand -Specify the connection to be up

when it has traffic on the line. Once there is no traffic over

idle timeout, the connection will be down and never up again

during the schedule.

Idle Timeout Specify the duration (or period) for the schedule.

Vigor2620 Series User’s Guide

142

How Often Specify how often the schedule will be applied.

 Once -The schedule will be applied just once

 Weekdays -Specify which days in one week should

perform the schedule.

 Monthly, on date – The router will only execute the

action applied such schedule on the date (1 to 28) of a

month.

 Cycle duration – Type a number as cycle duration.

Then, any action applied such schedule will be

executed per several days. For example, “3” is selected

as cycle duration. That means, the action applied such

schedule will be executed every three days since the

date defined on the Start Date.

3. Click OK button to save the settings.

Example

Suppose you want to control the PPPoE Internet access connection to be always on (Force On)

from 9:00 to 18:00 for whole week. Other time the Internet access connection should be

disconnected (Force Down).

Office

Hour:

(Force On)

Mon - Sun 9:00 am to 6:00 pm

1. Make sure the PPPoE connection and Time Setup is working properly.

2. Configure the PPPoE always on from 9:00 to 18:00 for whole week.

3. Configure the Force Down from 18:00 to next day 9:00 for whole week.

4. Assign these two profiles to the PPPoE Internet access profile. Now, the PPPoE Internet

connection will follow the schedule order to perform Force On or Force Down action

according to the time plan that has been pre-defined in the schedule profiles.

Vigor2620 Series User’s Guide

143

I

-

5

-

3

R

A

D

I

U

S

Remote Authentication Dial-In User Service (RADIUS) is a security authentication

client/server protocol that supports authentication, authorization and accounting, which is

widely used by Internet service providers. It is the most common method of authenticating

and authorizing dial-up and tunneled network users.

The built-in RADIUS client feature enables the router to assist the remote dial-in user or a

wireless station and the RADIUS server in performing mutual authentication. It enables

centralized remote access authentication for network management.

Vigor router can be operated as a RADIUS client. Therefore, this page is used to configure

settings for external RADIUS server. Then LAN user of Vigor router will be authenticated by

such server for network application.

Available settings are explained as follows:

Item Description

Enable Check to enable RADIUS client feature.

Server IP Address /

Hostname

Enter the IP address / hostname of RADIUS server

Destination Port The UDP port number that the RADIUS server is using. The

default value is 1812, based on RFC 2138.

Shared Secret The RADIUS server and client share a secret that is used to

authenticate the messages sent between them. Both sides

must be configured to use the same shared secret. The

maximum length of the shared secret you can set is 36

characters.

Confirm Shared Secret Re-Enter the Shared Secret for confirmation.

After finished the above settings, click OK button to save the settings.

Vigor2620 Series User’s Guide

144

I

-

5

-

4

U

P

n

P

The UPnP (Universal Plug and Play) protocol is supported to bring to network connected

devices the ease of installation and configuration which is already available for directly

connected PC peripherals with the existing Windows 'Plug and Play' system. For NAT routers,

the major feature of UPnP on the router is “NAT Traversal”. This enables applications inside

the firewall to automatically open the ports that they need to pass through a router.

Info

UPnP is required for some applications such as PPS, Skype, eMule...and etc.

If you are not familiar with UPnP, it is suggested to turn off this function for

security.

Available settings are explained as follows:

Item Description

Enable UPNP Service Accordingly, you can enable either the Connection Control

Service or Connection Status Service.

The reminder as regards concern about Firewall and UPnP:

Can't work with Firewall Software

Enabling firewall applications on your PC may cause the UPnP function not working properly.

This is because these applications will block the accessing ability of some network ports.

Security Considerations

Activating the UPnP function on your network may incur some security threats. You should

consider carefully these risks before activating the UPnP function.

 Some Microsoft operating systems have found out the UPnP weaknesses and hence you

need to ensure that you have applied the latest service packs and patches.

 Non-privileged users can control some router functions, including removing and adding

port mappings.

The UPnP function dynamically adds port mappings on behalf of some UPnP-aware

applications. When the applications terminate abnormally, these mappings may not be

removed.

Vigor2620 Series User’s Guide

145

I

-

5

-

5

I

G

M

P

IGMP is the abbreviation of Internet Group Management Protocol. It is a communication

protocol which is mainly used for managing the membership of Internet Protocol multicast

groups.

I

-

5

-

5

-

1

G

e

n

e

r

a

l

S

e

t

i

n

g

Available settings are explained as follows:

Item Description

IGMP Proxy Check this box to enable this function. The application of

multicast will be executed through WAN /PVC/VLAN port.

In addition, such function is available in NAT mode.

Interface – Specify an interface for packets passing

through.

IGMP version – At present, two versions (v2 and v3) are

supported by Vigor router. Choose the correct version

based on the IPTV service you subscribe.

General Query Interval – Vigor router will periodically

check which IP obtaining IPTV service by sending query. It

might cause inconvenience for client. Therefore, set a

suitable time (unit: second) as the query interval to limit

the frequency of query sent by Vigor router.

Add PPP header – Check this box if the interface type for

IGMP is PPPoE. It depends on the specifications regulated

by each ISP. If you have no idea to enable or disable, simply

contact your ISP providers.

IGMP Snooping Check this box to enable this function. Multicast traffic will

be forwarded to ports that have members of that group.

Disabling IGMP snooping will make multicast traffic treated

in the same manner as broadcast traffic.

IGMP Fast Leave Check this box to make the router stop forwarding

multicast traffic to a LAN port as soon as it receives a leave

message from that port. Each LAN port should have one

IGMP host connected.

Vigor2620 Series User’s Guide

146

After finishing all the settings here, please click OK to save the configuration.

I

-

5

-

5

-

2

W

o

r

k

i

n

g

G

r

o

u

p

Available settings are explained as follows:

Item Description

Refresh Click this link to renew the working multicast group status.

Group ID This field displays the ID port for the multicast group. The

available range for IGMP starts from 224.0.0.0 to

239.255.255.254.

P1 to P2 It indicates the LAN port used for the multicast group.

Vigor2620 Series User’s Guide

14

7

I

-

5

-

6

S

M

S

A

l

e

r

t

S

e

r

v

i

c

e

The function of SMS (Short Message Service) Alert is that Vigor router sends a message to

user’s mobile or e-mail box through specified service provider to assist the user knowing the

real-time abnormal situations.

Vigor router allows you to set up to 10 SMS profiles which will be sent out according to

different conditions.

This page allows you to specify SMS provider, who will get the SMS, what the content is and

when the SMS will be sent.

Available settings are explained as follows:

Item Description

Enable Check the box to enable such profile.

SMS Provider Use the drop down list to choose SMS service provider.

You can click SMS Provider link to define the SMS server.

Recipient Number Enter the phone number of the one who will receive the

SMS.

Notify Profile Use the drop down list to choose a message profile. The

recipient will get the content stated in the message profile.

You can click the Notify Profile link to define the content

of the SMS.

Schedule (1-15) Enter the schedule number that the SMS will be sent out.

You can click the Schedule(1-15) link to define the

schedule.

After finishing all the settings here, please click OK to save the configuration.

Vigor2620 Series User’s Guide

148

A

p

l

i

c

a

t

i

o

n

N

o

t

e

s

A

-

1

H

o

w

t

o

u

s

e

D

r

a

y

D

N

S

?

Vigor router supports various DDNS service providers, user can set up user-defined profile to

update the DDNS even the service provider is not on the list. Now, DrayTek starts to support

our own DDNS service - DrayDDNS. We will provide a domain name for each Vigor Router, this

single domain name can record IP addresses of all WAN.

A

c

t

i

v

a

t

e

D

r

a

y

D

N

S

L

i

c

e

n

s

e

1. Go to Wizards >> Service Activation Wizard, wait for the router to connect to MyVigor

server, then tick DT-DDNS and I have read and accept the above Agreement, click

Next.

2. Confirm the information, then click Activate.

Vigor2620 Series User’s Guide

149

3. MyVigor server will reply with the service activation information.

C

o

n

f

i

g

u

r

e

D

N

S

P

r

o

f

i

l

e

1. Go to Applications >> Dynamic DNS Setup,

a. Tick Enable Dynamic DNS Setup

b. Click an available profile index

c. Tick Enable Dynamic DNS Account

d. Select DrayTek Global (www.drayddns.com) as Service Provider

e. Select the WAN you would like to upload the IP to DDNS server

f. Click Get domain

g. Click OK on the pop up notification window

Vigor2620 Series User’s Guide

150

2. Wait few seconds for router to get the domain name, then, we can click the profile to

check the information of license and domain name.

M

o

d

i

f

y

D

o

m

a

i

n

N

a

m

e

Currently, only the domain name is allowed to be modified MyVigor website. We will need to

register the router to MyVigor server, and log in to MyVigor website to modify it.

1. Please visit https://myvigor.draytek.com/ or go to Applications >> Dynamic DNS Setup

>> DrayDDNS profile and click Edit domain.

2. Log in to MyVigor Website, choose the profile, then click Edit DDNS settings.

Vigor2620 Series User’s Guide

151

3. Input the desired Domain name (e.g., XXXX25) and click Update.

4. Vigor router will get the modified domain name when the it performs next DDNS

updating. We can click Sync domain to accelerate this process.

After few seconds, the router will get the new domain name and print it on the profiles

list.

Vigor2620 Series User’s Guide

152

Vigor2620 Series User’s Guide

153

A

-

2

H

o

w

t

o

C

o

n

f

i

g

u

r

e

C

u

s

t

o

m

i

z

e

d

D

N

S

?

This article describes how to configure customized DDNS on Vigor routers to update your IP to

the DDNS server. We will take “Changeip.org” and “3322.net” as example. Before setting,

please make sure that the WAN connection is up.

P

a

r

t

A

:

C

h

a

n

g

e

i

p

.

o

r

g

Note that,

Username: jo***

Password: jo********

Host name: j*****.changeip.org

WAN IP address: 1.169.185.242

Following is the screenshot of editing the HTML script on the browser to update your IP to the

DDNS server.

Vigor2620 Series User’s Guide

154

Now we have to configure the router so it can do the same job for us automatically.

1. Please go to Applications >> Dynamic DNS to create a profile for user-defined DDNS

client.

2. Set the Service Provider as User-Defined.

3. Set the Service API as:

/dynamic/dns/update.asp?u=jo***&p=jo********&hostname=j****.changeip.org&ip=###IP

### &cmd=update&offline=0

In which, ###IP### is a value which will be replaced with the current interface IP

address automatically when DDNS service is running. In this case the IP will be

1.169.185.242.

4. After setting, the Customized DDNS service will be up, and our IP will be updated to the

DDNS server.

P

a

r

t

B

:

3

2

.

n

e

t

Username: bi*******

Password: 88********

Host name: bi*******.3322.org

WAN IP address: 111.243.178.53

Vigor2620 Series User’s Guide

155

To update the IP to the DDNS server via editing the HTML script, we can Enter the following

script on the browser:

“good 111.243.178.53” means our IP has been updated to the server successfully.

Now we have to configure the router so it can do the same job for us automatically.

1. Please go to Applications >> Dynamic DNS to create a profile for User-Defined DDNS

client.

2. Set the Service Provider as User-Defined.

3. Set the Provider Host as member.3322.net.

4. Set the Service API as:

/dyndns/update?hostname=yourhost.3322.org&myip=###IP###&wildcard=OFF&mx=mail

.exchanger.ext&backmx=NO&offline=NO

5. Enter your account and password.

6. After the setting, the Customized DDNS service will be up, and our IP will be updated to

the DDNS server automatically.

Vigor2620 Series User’s Guide

156

P

a

r

t

C

:

E

x

t

e

n

d

N

o

t

e

The customized Service Provider is also eligible with the ClouDNS.net.

Vigor2620 Series User’s Guide

15

7

I

-

6

R

o

u

t

i

n

g

Route Policy (also well known as PBR, policy-based routing) is a feature where you may need

to get a strategy for routing. The packets will be directed to the specified interface if they

match one of the policies. You can setup route policies in various reasons such as load balance,

security, routing decision, and etc.

Through protocol, IP address, port number and interface configuration, Route Policy can be

used to configure any routing rules to fit actual request. In general, Route Policy can easily

reach the following purposes:

Specify Interface

Through dedicated interface (WAN/LAN/VPN), the data can be sent from the source IP to the

destination IP.

Address Mapping

Allows you specify the outgoing WAN IP address (es) for an internal private IP address or a

range of internal private IP addresses.

Priority

The router will determine which policy will be adopted for transmitting the packet according

to the priority of Static Route and Route Policy.

Failover to/Failback

Packets will be sent through another Interface or follow another Policy when the original

interface goes down (Failover to). Once the original interface resumes service (Failback),

the packets will be returned to it immediately.

Other routing

Specify routing policy to determine the direction of the data transmission.

Info

For more detailed information about using policy route, refer to Support

>>FAQ/Application Notes on www.draytek.com.

Vigor2620 Series User’s Guide

158

W

e

b

U

s

e

r

I

n

t

e

r

f

a

c

e

I

-

6

-

1

S

t

a

t

i

c

R

o

u

t

e

Static routing is an alternative to dynamic routing. It is a process that the system network

administrator can configure network routers with all the required information for packet

forwarding.

Go to Routing >> Static Route. The router offers IPv4 and IPv6 for you to configure the static

route. Both protocols bring different web pages.

S

t

a

t

i

c

R

o

u

t

e

f

o

r

I

P

v

4

Available settings are explained as follows:

Item Description

Set to Factory Default Clear all of the settings and return to factory default

settings.

Viewing Routing Table Displays the routing table for your reference.

Index The number (1 to 30) under Index allows you to open next

page to set up static route.

Enable Check the box to enable such route.

Destination Address Displays the destination address of the static route.

Vigor2620 Series User’s Guide

159

A

d

S

t

a

t

i

c

R

o

u

t

e

s

t

o

P

r

i

v

a

t

e

a

n

d

P

u

b

l

i

c

N

e

t

w

o

r

k

s

Here is an example (based on IPv4) of setting Static Route in Main Router so that user A and B

locating in different subnet can talk to each other via the router. Assuming the Internet

access has been configured and the router works properly:

 use the Main Router to surf the Internet.

 create a private subnet 192.168.10.0 using an internal Router A (192.168.1.2)

 create a public subnet 211.100.88.0 via an internal Router B (192.168.1.3).

 have set Main Router 192.168.1.1 as the default gateway for the Router A 192.168.1.2.

Before setting Static Route, user A cannot talk to user B for Router A can only forward

recognized packets to its default gateway Main Router.

1. Go to LAN page and click General Setup, select 1st Subnet as the RIP Protocol Control.

Then click the OK button.

Info

There are two reasons that we have to apply RIP Protocol Control on

1st Subnet. The first is that the LAN interface can exchange RIP

packets with the neighboring routers via the 1st subnet

(192.168.1.0/24). The second is that those hosts on the internal

private subnets (ex. 192.168.10.0/24) can access the Internet via the

router, and continuously exchange of IP routing information with

different subnets.

Vigor2620 Series User’s Guide

160

2. Click the LAN >> Static Route and click on the Index Number 1. Check the Enable box.

Please add a static route as shown below, which regulates all packets destined to

192.168.10.0 will be forwarded to 192.168.1.2. Click OK.

Available settings are explained as follows:

Item Description

Enable Click it to enable this profile.

Destination IP

Address

Type an IP address as the destination of such static route.

Subnet Mask Enter the subnet mask for such static route.

Gateway IP Address Enter the IP address of the gateway.

Network Interface Use the drop down list to specify an interface for such

static route.

3. Return to Static Route Setup page. Click on another Index Number to add another

static route as show below, which regulates all packets destined to 211.100.88.0 will be

forwarded to 192.168.1.3. Click OK.

Vigor2620 Series User’s Guide

161

4. Go to Diagnostics and choose Routing Table to verify current routing table.

S

t

a

t

i

c

R

o

u

t

e

f

o

r

I

P

v

6

You can set up to 40 profiles for IPv6 static route. Click the IPv6 tab to open the following

page:

Available settings are explained as follows:

Item Description

Set to Factory Default Clear all of the settings and return to factory default

settings.

Viewing IPv6 Routing

Table

Displays the routing table for your reference.

Index The number (1 to 40) under Index allows you to open next

page to set up static route.

Enable Check the box to enable such static route.

Destination Address Displays the destination address of the static route.

Click any underline of index number to get the following page.

Vigor2620 Series User’s Guide

162

Available settings are explained as follows:

Item Description

Enable Click it to enable this profile.

Destination IPv6 Address /

Prefix Len

Enter the IP address with the prefix length for this entry.

Gateway IPv6 Address Enter the gateway address for this entry.

Network Interface Use the drop down list to specify an interface for this static

route.

When you finish the configuration, please click OK to save and exit this page.

Vigor2620 Series User’s Guide

163

P

a

r

t

I

W

i

r

e

l

e

s

L

A

N

Wireless LAN enables high mobility so WLAN users

can simultaneously access all LAN facilities just

like on a wired LAN as well as Internet access.

Vigor2620 Series User’s Guide

164

I

-

1

W

i

r

e

l

e

s

L

A

N

This function is used for “n” model only.

Over recent years, the market for wireless communications has enjoyed tremendous growth.

Wireless technology now reaches or is capable of reaching virtually every location on the

surface of the earth. Hundreds of millions of people exchange information every day via

wireless communication products. The Vigor2620 wireless series router (with “n”, or “ac” in

model name) is designed for maximum flexibility and efficiency of a small office/home. Any

authorized staff can bring a built-in WLAN client PDA or notebook into a meeting room for

conference without laying a clot of LAN cable or drilling holes everywhere. Wireless LAN

enables high mobility so WLAN users can simultaneously access all LAN facilities just like on a

wired LAN as well as Internet access.

The Vigor wireless routers are equipped with a wireless LAN interface compliant with the

standard IEEE 802.11n draft 2 protocol. To boost its performance further, the Vigor Router is

also loaded with advanced wireless technology to lift up data rate up to 300 Mbps*. Hence,

you can finally smoothly enjoy stream music and video.

Vigor2620 wireless router is a highly integrated wireless local area network (WLAN) for 5 GHz

802.11ac or 2.4/5 GHz 802.11n WLAN applications. It supports channel operations of 20/40

MHz at 2.4 GHz and 20/40/80 MHz at 5 GHz. Vigor2620 “ac” series router can support data

rates up to 1.3 Gbps in 802.11ac 80 MHz channels. Vigor2620 “n” series router supports

802.11n up to 300 Mbps for 40 MHz channel operations.

Info

The actual data throughput will vary according to the network conditions

and environmental factors, including volume of network traffic, network

overhead and building materials.

In an Infrastructure Mode of wireless network, Vigor wireless router plays a role as an Access

Point (AP) connecting to lots of wireless clients or Stations (STA). All the STAs will share the

same Internet connection via Vigor wireless router. The General Settings will set up the

information of this wireless network, including its SSID as identification, located channel etc.

M

u

l

t

i

p

l

e

S

I

D

s

Vigor2620 Series User’s Guide

165

Vigor router supports four SSID settings for wireless connections. Each SSID can be defined

with different name and download/upload rate for selecting by stations connected to the

router wirelessly.

R

e

a

l

-

t

i

m

e

H

a

r

d

w

a

r

e

E

n

c

r

y

p

t

i

o

n

Vigor Router is equipped with a hardware AES encryption engine so it can apply the highest

protection to your data without influencing user experience.

C

o

m

p

l

e

t

e

S

e

c

u

r

i

t

y

S

t

a

n

d

a

r

d

S

e

l

e

c

t

i

o

n

To ensure the security and privacy of your wireless communication, we provide several

prevailing standards on market.

WEP (Wired Equivalent Privacy) is a legacy method to encrypt each frame transmitted via

radio using either a 64-bit or 128-bit key. Usually access point will preset a set of four keys

and it will communicate with each station using only one out of the four keys.

WPA (Wi-Fi Protected Access), the most dominating security mechanism in industry, is

separated into two categories: WPA-personal or called WPA Pre-Share Key (WPA/PSK), and

WPA-Enterprise or called WPA/802.1x.

In WPA-Personal, a pre-defined key is used for encryption during data transmission. WPA

applies Temporal Key Integrity Protocol (TKIP) for data encryption while WPA2 applies AES.

The WPA-Enterprise combines not only encryption but also authentication.

Since WEP has been proved vulnerable, you may consider using WPA for the most secure

connection. You should select the appropriate security mechanism according to your needs.

No matter which security suite you select, they all will enhance the over-the-air data

protection and /or privacy on your wireless network. The Vigor wireless router is very flexible

and can support multiple secure connections with both WEP and WPA at the same time.

Info

The password (PSK) of default security mode is provided and stated on the

label pasted on the bottom of the router. For the wireless client who wants

to access into Internet through such router, please input the default PSK

value for connection.

S

e

p

a

r

a

t

e

t

h

e

W

i

r

e

l

e

s

a

n

d

t

h

e

W

i

r

e

d

L

A

N

-

W

L

A

N

I

s

o

l

a

t

i

o

n

It enables you to isolate your wireless LAN from wired LAN for either quarantine or limit

access reasons. To isolate means neither of the parties can access each other. To elaborate

an example for business use, you may set up a wireless LAN for visitors only so they can

connect to Internet without hassle of the confidential information leakage. For a more

flexible deployment, you may add filters of MAC addresses to isolate users’ access from wired

LAN.

Vigor2620 Series User’s Guide

166

M

a

n

a

g

e

W

i

r

e

l

e

s

S

t

a

t

i

o

n

s

-

S

t

a

t

i

o

n

L

i

s

t

It will display all the stations in your wireless network and the status of their connection.

W

P

S

WPS (Wi-Fi Protected Setup) provides easy procedure to make network connection between

wireless station and wireless access point (vigor router) with the encryption of WPA and

WPA2.

Info

WPS is available for the wireless station with WPS supported.

It is the simplest way to build connection between wireless network clients and vigor router.

Users do not need to select any encryption mode and type any long encryption passphrase to

setup a wireless client every time. He/she only needs to press a button on wireless client, and

WPS will connect for client and router automatically.

There are two methods to do network connection through WPS between AP and Stations:

pressing the Start PBC button or using PIN Code.

Vigor2620 Series User’s Guide

167

 On the side of Vigor2620 series which served as an AP, press WPS button once on the

front panel of the router or click Start PBC on web configuration interface. On the side

of a station with network card installed, press Start PBC button of network card.

 If you want to use PIN code, you have to know the PIN code specified in wireless client.

Then provide the PIN code of the wireless client you wish to connect to the vigor router.

For WPS is supported in WPA-PSK or WPA2-PSK mode, if you do not choose such mode in

Wireless LAN>>Security, you will see the following message box.

Please click OK and go back Wireless LAN>>Security to choose WPA-PSK or WPA2-PSK mode

and access WPS again.

Vigor2620 Series User’s Guide

168

W

e

b

U

s

e

r

I

n

t

e

r

f

a

c

e

I

-

1

-

1

W

i

r

e

l

e

s

W

i

z

a

r

d

The wireless wizard allows you to configure settings specified for a host AP (for home use or

internal use for a company) and specified for a guest AP (for any wireless clients accessing

into Internet).

Follow the steps listed below:

1. Open Wizards>>Wireless Wizard.

2. The screen of wireless wizard will be shown as follows. This page will be used for internal

users in a company or your home. Besides, the settings will change based on different

model of Vigor2620 series. In this case, Vigor2620Ln is used as an example.

Available settings are explained as follows:

Item Description

Name Enter the SSID name of this router for wireless connection.

The default name is defined with DrayTek. Change the name

if required.

Mode At present, the router can connect to 11b Only, 11g Only,

11n Only, Mixed (11b+11g), Mixed (11g+11n) and Mixed

(11b+11g+11n) stations simultaneously. Simply choose Mixed

(11b+11g+11n) mode.

Vigor2620 Series User’s Guide

169

Channel Means the channel of frequency of the wireless LAN. The

default channel is 6. You may switch channel if the selected

channel is under serious interference. If you have no idea of

choosing the frequency, please select Auto to let system

determine for you.

Security Key The wireless mode offered by this wizard is WPA2/PSK.

The WPA encrypts each frame transmitted from the radio

using the key, which either PSK (Pre-Shared Key) entered

manually in this field below or automatically negotiated via

802.1x authentication.

Either 8~63 ASCII characters, such as 012345678(or 64

Hexadecimal digits leading by 0x, such as

“0x321253abcde…”).

Next Click it to get into the next setting page.

Cancel Exit the wireless wizard without saving any changes.

3. After typing the required information, click Next. The settings in the page limit the

wireless station (guest) accessing into Internet but not being allowed to share the LAN

network and VPN connection.

Available settings are explained as follows:

Item Description

Enable/Disable Click it to enable or disable settings in this page.

SSID Enter the SSID name of this router. (SSID1)

Security Key The wireless mode offered by this wizard is WPA2/PSK.

The WPA encrypts each frame transmitted from the radio

using the key, which either PSK (Pre-Shared Key) entered

Vigor2620 Series User’s Guide

170

manually in this field below or automatically negotiated via

802.1x authentication.

Either 8~63 ASCII characters, such as 012345678(or 64

Hexadecimal digits leading by 0x, such as

"0x321253abcde...").

Rate Control Check the box to enable the rate control function.

Upload / Download - Enter the values as the limits for data

upload and data download.

Next Click it to get into the next setting page.

Cancel Exit the wireless wizard without saving any changes.

4. After typing the required information, click Next.

5. The following page will display the configuration summary for wireless setting.

6. Click Finish to complete the wireless settings configuration.

Vigor2620 Series User’s Guide

171

I

-

1

-

2

G

e

n

e

r

a

l

S

e

t

u

p

By clicking the Wireless LAN>>General Setup, a new web page will appear so that you could

configure the SSID and the wireless channel. Please refer to the following figure for more

information.

Available settings are explained as follows:

Item Description

Enable Wireless LAN Check the box to enable wireless function.

Mode For 2.4GHz: At present, the router can connect to 11b Only,

11g Only, 11n Only(2.4 GHz), Mixed (11b+11g), Mixed

(11g+11n), and Mixed (11b+11g+11n) stations

simultaneously. Simply choose Mixed (11b+11g+11n) mode.

Channel Means the channel of frequency of the wireless LAN. The

default channel is 6. You may switch channel if the selected

channel is under serious interference. If you have no idea of

choosing the frequency, please select Auto to let system

determine for you.

Vigor2620 Series User’s Guide

172

Hide SSID Check it to prevent from wireless sniffing and make it harder

for unauthorized clients or STAs to join your wireless LAN.

Depending on the wireless utility, the user may only see the

information except SSID or just cannot see any thing about

Vigor wireless router while site surveying. The system allows

you to set four sets of SSID for different usage. In default,

the first set of SSID will be enabled. You can hide it for your

necessity.

SSID Means the identification of the wireless LAN. SSID can be any

text numbers or various special characters.

Isolate Member –Check this box to make the wireless clients

(stations) with the same SSID not accessing for each other.

VPN – Check this box to make the wireless clients (stations)

with different VPN not accessing for each other.

Rate Control Enable – Check the box to set the rate limit for data

transmission in upload and download.

It controls the data transmission rate through wireless

connection.

Upload – Check Enable and enter the transmitting rate for

data upload. Default value is 30,000 kbps.

Download – Enter the transmitting rate for data download.

Default value is 30,000 kbps.

Schedule Profiles Set the wireless LAN to work at certain time interval only.

You may choose up to 4 schedules out of the 15 schedules

pre-defined in Applications >> Schedule setup. The default

setting of this field is blank and the function will always

work.

After finishing all the settings here, please click OK to save the configuration.

Vigor2620 Series User’s Guide

173

I

-

1

-

3

S

e

c

u

r

i

t

y

This page allows you to set security with different modes for SSID 1, 2, 3 and 4 respectively.

After configuring the correct settings, please click OK to save and invoke it.

The password (PSK) of default security mode is provided and stated on the label pasted on the

bottom of the router. For the wireless client who wants to access into Internet through such

router, please input the default PSK value for connection.

By clicking the Wireless LAN>>Security Settings, a new web page will appear so that you

could configure the settings of WPA and WEP.

Available settings are explained as follows:

Item Description

Vigor2620 Series User’s Guide

174

Mode

There are several modes provided for you to choose.

Info

You should also set RADIUS Server

simultaneously if 802.1x mode is selected.

Disable - Turn off the encryption mechanism.

WEP - Accepts only WEP clients and the encryption key

should be entered in WEP Key.

WEP/802.1x Only - Accepts only WEP clients and the

encryption key is obtained dynamically from RADIUS server

with 802.1X protocol.

WPA/802.1x Only - Accepts only WPA clients and the

encryption key is obtained dynamically from RADIUS server

with 802.1X protocol.

WPA2/802.1x Only - Accepts only WPA2 clients and the

encryption key is obtained dynamically from RADIUS server

with 802.1X protocol.

Mixed (WPA+WPA2/802.1x only) - Accepts WPA and WPA2

clients simultaneously and the encryption key is obtained

dynamically from RADIUS server with 802.1X protocol.

WPA/PSK - Accepts only WPA clients and the encryption key

should be entered in PSK.

WPA2/PSK - Accepts only WPA2 clients and the encryption

key should be entered in PSK.

Mixed (WPA+ WPA2)/PSK - Accepts WPA and WPA2 clients

simultaneously and the encryption key should be entered in

PSK.

WPA

The WPA encrypts each frame transmitted from the radio

using the key, which either PSK (Pre-Shared Key) entered

manually in this field below or automatically negotiated via

802.1x authentication. Either 8~63 ASCII characters, such as

012345678(or 64 Hexadecimal digits leading by 0x, such as

"0x321253abcde...").

Pre-Shared Key (PSK) - Either 8~63 ASCII characters, such as

012345678..(or 64 Hexadecimal digits leading by 0x, such as

"0x321253abcde...").

Password Strength – The system will display the password

strength (represented with the word of weak, medium or

strong) of the PSK specified above.

WEP

64-Bit - For 64 bits WEP key, either 5 ASCII characters, such

as 12345 (or 10 hexadecimal digitals leading by 0x, such as

0x4142434445.)

Vigor2620 Series User’s Guide

175

128-Bit - For 128 bits WEP key, either 13 ASCII characters,

such as ABCDEFGHIJKLM (or 26 hexadecimal digits leading by

0x, such as 0x4142434445464748494A4B4C4D).

All wireless devices must support the same WEP encryption

bit size and have the same key. Four keys can be entered

here, but only one key can be selected at a time. The keys

can be entered in ASCII or Hexadecimal. Check the key you

wish to use.

After finishing all the settings here, please click OK to save the configuration.

I

-

1

-

4

A

c

e

s

C

o

n

t

r

o

l

In the Access Control, the router may restrict wireless access to certain wireless clients only

by locking their MAC address into a black or white list. The user may block wireless clients by

inserting their MAC addresses into a black list, or only let them be able to connect by inserting

their MAC addresses into a white list.

In the Access Control web page, users may configure the white/black list modes used by each

SSID and the MAC addresses applied to their lists.

Available settings are explained as follows:

Item Description

Enable Mac Address Filter

Select to enable the MAC Address filter for wireless LAN

identified with SSID 1 to 4 respectively. All the clients

Vigor2620 Series User’s Guide

176

(expressed by MAC addresses) listed in the box can be

grouped under different wireless LAN. For example, they can

be grouped under SSID 1 and SSID 2 at the same time if you

check SSID 1 and SSID 2.

MAC Address Filter Display all MAC addresses that are edited before.

Client’s MAC Address Manually enter the MAC address of wireless client.

Apply SSID After entering the client’s MAC address, check the box of the

SSIDs desired to insert this MAC address into their access

control list.

Attribute s: Isolate the station from LAN - select to isolate the

wireless connection of the wireless client of the MAC address

from LAN.

Comment Enter a brief description for the specified client’s MAC

address.

Add Add a new MAC address into the list.

Delete Delete the selected MAC address in the list.

Edit Edit the selected MAC address in the list.

Cancel Give up the access control set up.

OK Click it to save the access control list.

Clear All Clean all entries in the MAC address list.

Backup Access Control Settings on this web page can be saved as a file which can be

restored in the future by this device or other device.

Upload From File Restore wireless access control settings and applied onto this

device.

After finishing all the settings here, please click OK to save the configuration.

I

-

1

-

5

W

P

S

Below shows Wireless LAN>>WPS web page:

Available settings are explained as follows:

Vigor2620 Series User’s Guide

177

Item Description

Enable WPS Check this box to enable WPS setting.

WPS Status Display related system information for WPS. If the wireless

security (encryption) function of the router is properly

configured, you can see ‘Configured’ message here.

SSID Display the SSID1 of the router. WPS is supported by SSID1

only.

Authentication Mode Display current authentication mode of the router. Only

WPA2/PSK and WPA/PSK support WPS.

Configure via Push Button

Click Start PBC to invoke Push-Button style WPS setup

procedure. The router will wait for WPS requests from

wireless clients about two minutes. The WPS LED on the

router will blink fast when WPS is in progress. It will return to

normal condition after two minutes. (You need to setup WPS

within two minutes)

Configure via Client

PinCode

Please input the PIN code specified in wireless client you

wish to connect, and click Start PIN button. The WPS LED on

the router will blink fast when WPS is in progress. It will

return to normal condition after two minutes. (You need to

setup WPS within two minutes)

Vigor2620 Series User’s Guide

178

I

-

1

-

6

W

D

S

WDS means Wireless Distribution System. It is a protocol for connecting two access points (AP)

wirelessly. Usually, it can be used for the following application:

 Provide bridge traffic between two LANs through the air.

 Extend the coverage range of a WLAN.

Refer to the following table:

WDS Mode Wireless

Signal

Comparisons

Bridge

Limited

 Wireless stations (clients) within the effective range of

wireless signal can access into Internet through the router

/AP.

 Wireless stations (clients) out of the effective range of

wireless signal cannot access into Internet through the

router /AP with Bridge mode configured.

 The packets received from a WDS link will only be forwarded

to local wired or wireless hosts.

Repeater

Extended

 Wireless stations (clients) within the effective range of

wireless signal can access into Internet through the router

/AP.

 Wireless stations (clients) out of the effective range of

wireless signal can access into Internet through the router

/AP with Repeater mode configured.

 The packets received from one Vigor router can be repeated

to another AP (remotely) through WDS links.

 Only Repeater mode can do WDS-to-WDS packet forwarding.

The WDS - Repeater mode is implemented in Vigor router. The application for the

WDS-Repeater mode is depicted as below:

Click WDS from Wireless LAN menu. The following page will be shown.

Vigor2620 Series User’s Guide

179

Available settings are explained as follows:

Item Description

Mode Choose the mode for WDS setting. Disable mode will not

invoke any WDS setting. Repeater mode is for the second

one.

Security There are three types for security, Disable, WEP and

Pre-shared key. The setting you choose here will make the

following WEP or Pre-shared key field valid or not. Choose

one of the types for the router.

Pre-shared Key When Pre-Shared Key is selected as Security above,

configure the following settings if required.

Type – There are some types for you to choose. WPA and

WPA2 are used for WDS devices (e.g.2925n wireless router,

you can set the encryption mode as WPA or WPA2 to establish

your WDS system between AP and the router.

Key – Set the encryption key in this field. Type 8 ~ 63 ASCII

characters or 64 hexadecimal digits leading by “0x”.

Bridge

If you choose Bridge as the connecting mode, please Enter

the peer MAC address in these fields. Four peer MAC

addresses are allowed to be entered in this page at one time.

Yet please disable the unused link to get better

Vigor2620 Series User’s Guide

180

performance. If you want to invoke the peer MAC address,

remember to check Enable box in the front of the MAC

address after typing.

Repeater If you choose Repeater as the connecting mode, please Enter

the peer MAC address (of VigorAP/Vigor router required to

make connection with such Vigor router and used to extend

the wireless signal) in these fields.

Four peer MAC addresses are allowed to be entered in this

page at one time. Similarly, if you want to invoke the peer

MAC address, remember to check Enable box in the front of

the MAC address after typing.

Access Point Function Click Enable to make this router serve as an access point.

When Repeater is set as WDS Mode, click Enable to use such

function.

Click Disable if Bridge is set as WDS Mode.

Status It allows user to send “hello” message to peers. Yet, it is

valid only when the peer also supports this function.

After finishing all the settings here, please click OK to save the configuration.

Vigor2620 Series User’s Guide

181

I

-

1

-

7

A

d

v

a

n

c

e

d

S

e

t

i

n

g

This page allows users to set advanced settings such as operation mode, channel bandwidth,

guard interval, and aggregation MSDU for wireless data transmission.

Available settings are explained as follows:

Item Description

Operation Mode Mixed Mode – the router can transmit data with the ways

supported in both 802.11a/b/g and 802.11n standards.

However, the entire wireless transmission will be slowed

down if 802.11g or 802.11b wireless client is connected.

Green Field – to get the highest throughput, please choose

such mode. Such mode can make the data transmission

happen between 11n systems only. In addition, it does not

have protection mechanism to avoid the conflict with

neighboring devices of 802.11a/b/g.

Channel Bandwidth Vigor router will use 20MHz/40MHz/80MHz for data

transmission and receiving between the AP and the stations.

20/40- Vigor Router will scan for nearby wireless AP, and

then use 20MHz if the number of AP is more than 10, or use

40MHz if it's not.

Guard Interval It is to assure the safety of propagation delays and

reflections for the sensitive digital data. If you choose auto

as guard interval, the AP router will choose short guard

interval (increasing the wireless performance) or long guard

interval for data transmit based on the station capability.

Aggregation MSDU

Aggregation MSDU can combine frames with different sizes

.

It is used for improving MAC layer’s performance for some

brand’s clients. The default setting is Enable.

Long Preamble This option is to define the length of the sync field in an

802.11 packet. Most modern wireless network uses short

preamble with 56 bit sync field instead of long preamble with

128 bit sync field. However, some original 11b wireless

network devices only support long preamble. Click Enable to

Vigor2620 Series User’s Guide

182

use Long Preamble if needed to communicate with this kind

of devices.

Packet-OVERDRIVE TX

Burst

This feature can enhance the performance in data

transmission about 40%* more (by checking Tx Burst). It is

active only when both sides of Access Point and Station (in

wireless client) invoke this function at the same time. That

is, the wireless client must support this feature and invoke

the function, too.

Note: Vigor N61 wireless adapter supports this function.

Therefore, you can use and install it into your PC for

matching with Packet-OVERDRIVE (refer to the following

picture of Vigor N61 wireless utility window, choose Enable

for TxBURST on the tab of Option).

TX Power Set the power percentage for transmission signal of access

point. The greater the value is, the higher intensity of the

signal will be.

WMM Capable WMM is an abbreviation of Wi-Fi Multimedia. It defines the

priority levels for four access categories derived from 802.1d

(prioritization tabs). The categories are designed with

specific types of traffic, voice, video, best effort and low

priority data. There are four accessing categories - AC_BE ,

AC_BK, AC_VI and AC_VO for WMM.

To apply WMM parameters for wireless data transmission,

please click the Enable radio button.

APSD Capable APSD (automatic power-save delivery) is an enhancement

over the power-save mechanisms supported by Wi-Fi

networks. It allows devices to take more time in sleeping

state and consume less power to improve the performance

by minimizing transmission latency.

The default setting is Disable.

Rate Adaptation Algorithm

Wireless transmission rate is adapted dynamically. Usually,

performance of “new” algorithm is better than “old”.

Fragment Length

(256 – 2346)

Set the Fragment threshold. Do not modify

default value if

you don’t know what it is, default value is

2346.

RTS Threshold (1 – 2347) Minimize the collision (unit is bytes) between hidden stations

to improve wireless performance.

Set the RTS threshold. Do not modify default

value if you

don’t know what it is, default value is 2347.

Vigor2620 Series User’s Guide

183

Country Code Vigor router broadcasts country codes by following the

802.11d standard. However, some wireless stations will

detect / scan the country code to prevent conflict occurred.

If conflict is detected, wireless station will be warned and is

unable to make network connection. Therefore, changing

the country code to ensure successful network connection

will be necessary for some clients.

After finishing all the settings here, please click OK to save the configuration.

Vigor2620 Series User’s Guide

184

I

-

1

-

8

A

P

D

i

s

c

o

v

e

r

y

Vigor router can scan all regulatory channels and find working APs in the neighborhood. Based

on the scanning result, users will know which channel is clean for usage. Also, it can be used

to facilitate finding an AP for a WDS link. Notice that during the scanning process (about 5

seconds), no client is allowed to connect to Vigor.

This page is used to scan the existence of the APs on the wireless LAN. Yet, only the AP which

is in the same channel of this router can be found. Please click Scan to discover all the

connected APs.

Available settings are explained as follows:

Item Description

Scan It is used to discover all the connected AP. The results will be

shown on the box above this button.

Statistics It displays the statistics for the channels used by APs.

Add to If you want the found AP applying the WDS settings, please

Enter the AP’s MAC address on the bottom of the page and

click Repeater. Next, click Add to. Later, the MAC address of

the AP will be added to Bridge or Repeater field of WDS

settings page.

Vigor2620 Series User’s Guide

185

I

-

1

-

9

S

t

a

t

i

o

n

L

i

s

t

Station List provides the knowledge of connecting wireless clients now along with its status

code. There is a code summary below for explanation. For convenient Access Control, you

can select a WLAN station and click Add to Access Control below.

Available settings are explained as follows:

Item Description

Refresh Click this button to refresh the status of station list.

Add Click this button to add current typed MAC address into

Access Control.

Vigor2620 Series User’s Guide

186

This page is left blank.

Vigor2620 Series User’s Guide

18

7

P

a

r

t

I

V

P

N

A Virtual Private Network (VPN) is the extension of a

private network that encompasses links across shared

or public networks like the Internet. In short, by VPN

technology, you can send data between two

computers across a shared or public network in a

manner that emulates the properties of a

point-to-point private link.

It is a form of VPN that can be used with a standard

Web browser.

A digital certificate works as an electronic ID, which

is issued by a certification authority (CA). It contains

information such as your name, a serial number,

expiration dates etc., and the digital signature of the

certificate-issuing authority so that a recipient can

verify that the certificate is real. Here Vigor router

support digital certificates conforming to standard

X.509.

Vigor2620 Series User’s Guide

188

I

V

-

1

V

P

N

a

n

d

R

e

m

o

t

e

A

c

e

s

A Virtual Private Network (VPN) is the extension of a private network that encompasses links

across shared or public networks like the Internet. In short, by VPN technology, you can send

data between two computers across a shared or public network in a manner that emulates the

properties of a point-to-point private link.

The VPN built is suitable for:

 Communication between home office and customer

 Secure connection between Teleworker, staff on business trip and main office

 Exchange data between remote office and main office

 POS between chain store and headquarters

S

i

t

e

-

t

o

-

S

i

t

e

(

L

A

N

-

t

o

-

L

A

N

)

 A connection between two router's LAN networks.

 Allows employees in branch offices and head office to share the same network resources.

R

e

m

o

t

e

A

c

e

s

(

R

e

m

o

t

e

D

i

a

l

-

i

n

)

 A connection between the remote host and router's LAN network. The host will use an IP

address in the local subnet.

 Allows employees to access the company's internal resources when they are traveling.

Vigor2620 Series User’s Guide

189

W

e

b

U

s

e

r

I

n

t

e

r

f

a

c

e

I

V

-

1

-

1

V

P

N

C

l

i

e

n

t

W

i

z

a

r

d

Such wizard is used to configure VPN settings for VPN client. Such wizard will guide to set the

LAN-to-LAN profile for VPN dial out connection (from server to client) step by step.

1. Open Wizards>>VPN Client Wizard. The following page will appear.

Available settings are explained as follows:

Item Description

LAN-to-LAN Client

Mode Selection

Choose the client mode.

Route Mode/NAT Mode – If the remote network only allows

you to dial in with single IP, please choose NAT mode,

otherwise please choose Route Mode.

Please choose a

LAN-to-LAN Profile

There are 32 VPN profiles for users to set.

Vigor2620 Series User’s Guide

190

2. When you finish the mode and profile selection, please click Next to open the following

page.

In this page, you have to select suitable VPN type for the VPN client profile. There are six

types provided here. Different type will lead to different configuration page. After

making the choices for the client profile, please click Next. You will see different

configurations based on the selection(s) you made.

Info

The following descriptions for VPN Type are based on the Route Mode

specified in LAN-to-LAN Client Mode Selection.

When you choose PPTP (None Encryption) or PPTP (Encryption), you will see the

following graphic:

Vigor2620 Series User’s Guide

191

When you choose IPsec, you will see the following graphic:

When you choose SSL, you will see the following graphic:

Vigor2620 Series User’s Guide

192

When you choose L2TP over IPsec (Nice to Have) or L2TP over IPsec (Must), you will see

the following graphic:

Available settings are explained as follows:

Item Description

Profile Name Type a name for such profile. The length of the file is limited

Vigor2620 Series User’s Guide

193

to 10 characters.

Always On Check to enable router always keep VPN connection.

Server IP/Host Name

for VPN

Enter the IP address of the server or Enter the host name for

such VPN profile.

IKE Authentication

Method

IKE Authentication Method usually applies to those are

remote dial-in user or node (LAN to LAN) which uses dynamic

IP address and IPsec-related VPN connections such as L2TP

over IPsec and IPsec tunnel.

Pre-Shared Key- Specify a key for IKE authentication.

Confirm Pre-Shared Key-Confirm the pre-shared key.

Digital Signature

(X.509)

Click Digital Signature to invoke this function.

Peer ID – Choose the peer ID selection from the drop down

list.

Local ID – Choose Alternative Subject Name First or Subject

Name First.

Local Certificate – Use the drop down list to choose one of

the certificates for using. You have to configure one

certificate at least previously in Certificate Management >>

Local Certificate. Otherwise, the setting you choose here

will not be effective.

IPsec Security Method

Medium - Authentication Header (AH) means data will be

authenticated, but not be encrypted. By default, this option

is active.

High - Encapsulating Security Payload (ESP) means payload

(data) will be encrypted and authenticated. You may select

encryption algorithm from Data Encryption Standard (DES),

Triple DES (3DES), and AES.

User Name This field is used to authenticate for connection when you

select PPTP or L2TP with or without IPsec policy above.

The length of the user name is limited to 11 characters.

Password This field is used to authenticate for connection when you

select PPTP or L2TP with or without IPsec policy above.

The length of the password is limited to 11 characters.

Remote Network IP Please type one LAN IP address (according to the real

location of the remote host) for building VPN connection.

Remote Network

Mask

Please Enter the network mask (according to the real

location of the remote host) for building VPN connection.

Local Network IP Enter the local network IP for TCP / IP configuration.

Local Network Mask Enter the local network mask for TCP / IP configuration.

3. After finishing the configuration, please click Next. The confirmation page will be

shown as follows. If there is no problem, you can click one of the radio buttons listed on

the page and click Finish to execute the next action.

Vigor2620 Series User’s Guide

194

Available settings are explained as follows:

Item Description

Go to the VPN

Connection

Management

Click this radio button to access VPN and Remote

Access>>Connection Management for viewing VPN

Connection status.

Do another VPN

Server Wizard Setup

Click this radio button to set another profile of VPN Server

through VPN Server Wizard.

View more detailed

configuration

Click this radio button to access VPN and Remote

Access>>LAN to LAN for viewing detailed configuration.

Vigor2620 Series User’s Guide

195

I

V

-

1

-

2

V

P

N

S

e

r

v

e

r

W

i

z

a

r

d

Such wizard is used to configure VPN settings for VPN server. Such wizard will guide to set the

LAN-to-LAN profile for VPN dial in connection (from client to server) step by step.

1. Open Wizards>>VPN Server Wizard. The following page will appear.

Available settings are explained as follows:

Item Description

VPN Server Mode

Selection

Choose the direction for the VPN server.

Site to Site VPN – To set a LAN-to-LAN profile automatically,

please choose Site to Site VPN.

Remote Dial-in User –You can manage remote access by

maintaining a table of remote user profile, so that users can

be authenticated to dial-in via VPN connection.

Please choose a

LAN-to-LAN Profile

This item is available when you choose Site to Site VPN

(LAN-to-LAN) as VPN server mode. There are 32 VPN profiles

for users to set.

Please choose a

Dial-in User Accounts

This item is available when you choose Remote Dial-in User

(Teleworker) as VPN server mode. There are 32 VPN tunnels

for users to set.

Allowed Dial-in Type This item is available after you choose any one of dial-in user

account profiles. Next, you have to select suitable dial-in

type for the VPN server profile. There are several types

provided here (similar to VPN Client Wizard).

Vigor2620 Series User’s Guide

196

Different Dial-in Type will lead to different configuration

page. In addition, adjustable items for each dial-in type will

be changed according to the VPN Server Mode (Site to Site

VPN and Remote Dial-in User) selected.

2. After making the choices for the server profile, please click Next. You will see different

configurations based on the selection you made. Here we take the examples of choosing

Site-to-Site VPN as the VPN Server Mode.

When you check PPTP/SSL, you will see the following graphic:

When you check PPTP & IPsec & L2TP (three types) or PPTP & IPsec (two types) or L2TP

with Policy (Nice to Have/Must), you will see the following graphic:

Vigor2620 Series User’s Guide

19

7

When you check IPsec, you will see the following graphic:

Available settings are explained as follows:

Item Description

Profile Name Type a name for such profile. The length of the file is limited

to 10 characters.

User Name This field is used to authenticate for connection when you

select PPTP or L2TP with or without IPsec policy above.

The length of the name is limited to 11 characters.

Vigor2620 Series User’s Guide

198

Password This field is used to authenticate for connection when you

select PPTP or L2TP with or without IPsec policy above.

The length of the name is limited to 11 characters.

Pre-Shared Key For IPsec/L2TP IPsec authentication, you have to type a

pre-shared key.

The length of the name is limited to 64 characters.

Confirm Pre-Shared

Key

Enter the pre-shared key again for confirmation.

Digital Signature

(X.509)

Check the box of Digital Signature to invoke this function.

Peer ID – Choose the peer ID selection from the drop down

list.

Local ID – Choose Alternative Subject Name First or Subject

Name First.

Peer IP/VPN Client IP Enter the WAN IP address or VPN client IP address for the

remote client.

Peer ID Enter the ID name for the remote client.

The length of the name is limited to 47 characters.

Remote Network IP Please type one LAN IP address (according to the real

location of the remote host) for building VPN connection.

Remote Network

Mask

Please Enter the network mask (according to the real

location of the remote host) for building VPN connection.

Local Network IP Enter the local network IP for TCP / IP configuration.

Local Network Mask Enter the local network mask for TCP / IP configuration.

3. After finishing the configuration, please click Next. The confirmation page will be

shown as follows. If there is no problem, you can click one of the radio buttons listed on

the page and click Finish to execute the next action.

Available settings are explained as follows:

Vigor2620 Series User’s Guide

199

Item Description

Go to the VPN

Connection

Management

Click this radio button to access VPN and Remote

Access>>Connection Management for viewing VPN

Connection status.

Do another VPN

Server Wizard Setup

Click this radio button to set another profile of VPN Server

through VPN Server Wizard.

View more detailed

configuration

Click this radio button to access VPN and Remote

Access>>LAN to LAN for viewing detailed configuration.

I

V

-

1

-

3

R

e

m

o

t

e

A

c

e

s

C

o

n

t

r

o

l

Enable the necessary VPN service as you need. If you intend to run a VPN server inside your

LAN, you should disable the VPN service of Vigor Router to allow VPN tunnel pass through, as

well as the appropriate NAT settings, such as DMZ or open port.

Open VPN and Remote Access>>Remote Access Control.

After finishing all the settings here, please click OK to save the configuration.

Vigor2620 Series User’s Guide

200

I

V

-

1

-

4

P

G

e

n

e

r

a

l

S

e

t

u

p

This submenu only applies to PPP-related VPN connections, such as PPTP, L2TP, L2TP over

IPsec.

Available settings are explained as follows:

Item Description

Dial-In PPP Authentication

PAP Only - elect this option to force the router to

authenticate dial-in users with the PAP protocol.

PAP/CHAP/MS-CHAP/MS-CHAPv2 - Selecting this option

means the router will attempt to authenticate dial-in users

with the CHAP protocol first. If the dial-in user does not

support this protocol, it will fall back to use the PAP protocol

for authentication.

Dial-In PPP Encryption

(MPPE)

Optional MPPE - This option represents that the MPPE

encryption method will be optionally employed in the router

for the remote dial-in user. If the remote dial-in user does

not support the MPPE encryption algorithm, the router will

transmit “no MPPE encrypted packets”. Otherwise, the MPPE

encryption scheme will be used to encrypt the data.

 Require MPPE (40/128bits) - Selecting this option will

force the router to encrypt packets by using the MPPE

encryption algorithm. In addition, the remote dial-in

user will use 40-bit to perform encryption prior to using

128-bit for encryption. In other words, if 128-bit MPPE

encryption method is not available, then 40-bit

encryption scheme will be applied to encrypt the data.

 Maximum MPPE - This option indicates that the router

will use the MPPE encryption scheme with maximum

bits (128-bit) to encrypt the data.

Mutual Authentication

(PAP)

The Mutual Authentication function is mainly used to

communicate with other routers or clients who need

bi-directional authentication in order to provide stronger

security, for example, Cisco routers. So you should enable

this function when your peer router requires mutual

Vigor2620 Series User’s Guide

201

authentication. You should further specify the User Name

and Password of the mutual authentication peer.

The length of the name/password is limited to 23/19

characters.

IP Address Assignment for

Dial-In Users

Enter a start IP address for the dial-in PPP connection. You

should choose an IP address from the local private network.

For example, if the local private network is

192.168.1.0/255.255.255.0, you could choose 192.168.1.200

as the Start IP Address.

You can configure up to four start IP addresses for LAN1 ~

LAN4.

PPP Authentication

Methods

Select the method(s) to be used for authentication in PPP

connection.

While using Radius

Authentication

If PPP connection will be authenticated via RADIUS server, it

is necessary to specify the LAN profile for the dial-in user to

get IP from.

Vigor2620 Series User’s Guide

202

I

V

-

1

-

5

I

P

s

e

c

G

e

n

e

r

a

l

S

e

t

u

p

In IPsec General Setup, there are two major parts of configuration.

There are two phases of IPsec.

 Phase 1: negotiation of IKE parameters including encryption, hash, Diffie-Hellman

parameter values, and lifetime to protect the following IKE exchange, authentication of

both peers using either a Pre-Shared Key or Digital Signature (x.509). The peer that

starts the negotiation proposes all its policies to the remote peer and then remote peer

tries to find a highest-priority match with its policies. Eventually to set up a secure

tunnel for IKE Phase 2.

 Phase 2: negotiation IPsec security methods including Authentication Header (AH) or

Encapsulating Security Payload (ESP) for the following IKE exchange and mutual

examination of the secure tunnel establishment.

There are two encapsulation methods used in IPsec, Transport and Tunnel. The Transport

mode will add the AH/ESP payload and use original IP header to encapsulate the data payload

only. It can just apply to local packet, e.g., L2TP over IPsec. The Tunnel mode will not only

add the AH/ESP payload but also use a new IP header (Tunneled IP header) to encapsulate the

whole original IP packet.

Authentication Header (AH) provides data authentication and integrity for IP packets passed

between VPN peers. This is achieved by a keyed one-way hash function to the packet to

create a message digest. This digest will be put in the AH and transmitted along with packets.

On the receiving side, the peer will perform the same one-way hash on the packet and

compare the value with the one in the AH it receives.

Encapsulating Security Payload (ESP) is a security protocol that provides data confidentiality

and protection with optional authentication and replay detection service.

Available settings are explained as follows:

Item Description

IKE Authentication

Method

This usually applies to those are remote dial-in user or node

(LAN-to-LAN) which uses dynamic IP address and

IPsec-related VPN connections such as L2TP over IPsec and

Vigor2620 Series User’s Guide

203

IPsec tunnel. There are two methods offered by Vigor router

for you to authenticate the incoming data coming from

remote dial-in user, Certificate (X.509) and Pre-Shared

Key.

Certificate for Dial-in –Choose one of the local certificates

from the drop down list.

General Pre-Shared Key - Define the PSK key for general

authentication.

 Pre-Shared Key- Specify a key for IKE authentication.

 Confirm Pre-Shared Key- Retype the characters to

confirm the pre-shared key.

Pre-Shared Key for XAuth User - Define the PSK key for

IPsec XAuth authentication.

 Pre-Shared Key- Specify a key for IKE authentication.

 Confirm Pre-Shared Key- Retype the characters to

confirm the pre-shared key.

Note: Any packets from the remote dial-in user which does

not match the rule defined in VPN and Remote

Access>>Remote Dial-In User will be applied with the

method specified here.

IPsec Security Method Medium - Authentication Header (AH) means data will be

authenticated, but not be encrypted. By default, this option

is active.

High (ESP) - Encapsulating Security Payload (ESP) means

payload (data) will be encrypted and authenticated. You

may select encryption algorithm from Data Encryption

Standard (DES), Triple DES (3DES), and AES.

After finishing all the settings here, please click OK to save the configuration.

Vigor2620 Series User’s Guide

204

I

V

-

1

-

6

I

P

s

e

c

P

e

r

I

d

e

n

t

i

t

y

To use digital certificate for peer authentication in either LAN-to-LAN connection or Remote

User Dial-In connection, here you may edit a table of peer certificate for selection. As shown

below, the router provides 32 entries of digital certificates for peer dial-in users.

Available settings are explained as follows:

Item Description

Set to Factory Default Click it to clear all indexes.

Index Click the number below Index to access into the setting page

of IPsec Peer Identity.

Name Display the profile name of that index.

Click each index to edit one peer digital certificate. There are three security levels of digital

signature authentication: Fill each necessary field to authenticate the remote peer. The

following explanation will guide you to fill all the necessary fields.

Vigor2620 Series User’s Guide

205

Available settings are explained as follows:

Item Description

Profile Name Enter the name of the profile. The maximum length of the

name you can set is 32 characters.

Enable this account Check it to enable such account profile.

Accept Any Peer ID Click to accept any peer regardless of its identity.

Accept Subject

Alternative Name

Click to check one specific field of digital signature to accept

the peer with matching value. The field can be IP Address,

Domain, or E-mail. The box under the Type will appear

according to the type you select and ask you to fill in

corresponding setting.

Accept Subject Name Click to check the specific fields of digital signature to

accept the peer with matching value. The field includes

Country (C), State (ST), Location (L), Organization (O),

Organization Unit (OU), Common Name (CN), and Email

(E).

After finishing all the settings here, please click OK to save the configuration.

Vigor2620 Series User’s Guide

206

I

V

-

1

-

7

R

e

m

o

t

e

D

i

a

l

-

i

n

U

s

e

r

You can manage remote access by maintaining a table of remote user profile, so that users

can be authenticated to dial-in via VPN connection. You may set parameters including

specified connection peer ID, connection type (VPN connection - including PPTP, IPsec Tunnel,

and L2TP by itself or over IPsec) and corresponding security methods, etc.

The router provides multiple access accounts for dial-in users. Besides, you can extend the

user accounts to the RADIUS server through the built-in RADIUS client function. The following

figure shows the summary table.

Available settings are explained as follows:

Item Description

Set to Factory Default Click to clear all indexes.

Index Click the number below Index to access into the setting page

of Remote Dial-in User.

Enable Check the box to enable the profile.

User Display the username for the specific dial-in user of the

LAN-to-LAN profile. The symbol ??? represents that the

Vigor2620 Series User’s Guide

20

7

profile is empty.

Status Display the access state of the specific dial-in user. The

symbol V and X represent the specific dial-in user to be

active and inactive, respectively.

Click each index to edit one remote user profile. Each Dial-In Type requires you to fill the

different corresponding fields on the right. If the fields gray out, it means you may leave it

untouched. The following explanation will guide you to fill all the necessary fields.

Available settings are explained as follows:

Item Description

User account and

Authentication

Enable this account - Check the box to enable this function.

Idle Timeout- If the dial-in user is idle over the limitation of

the timer, the router will drop this connection. By default,

the Idle Timeout is set to 300 seconds.

Allowed Dial-In Type PPTP - Allow the remote dial-in user to make a PPTP VPN

connection through the Internet. You should set the User

Name and Password of remote dial-in user below.

IPsec Tunnel - Allow the remote dial-in user to make an

IPsec VPN connection through Internet.

L2TP with IPsec Policy - Allow the remote dial-in user to

make a L2TP VPN connection through the Internet. You can

select to use L2TP alone or with IPsec. Select from below:

Vigor2620 Series User’s Guide

208

 None - Do not apply the IPsec policy. Accordingly, the

VPN connection employed the L2TP without IPsec

policy can be viewed as one pure L2TP connection.

 Nice to Have - Apply the IPsec policy first, if it is

applicable during negotiation. Otherwise, the dial-in

VPN connection becomes one pure L2TP connection.

 Must -Specify the IPsec policy to be definitely applied

on the L2TP connection.

SSL Tunnel – Allow the remote dial-in user to make an SSL

VPN connection through Internet.

IPsec XAuth – Allow the remote dial-in user to make an IPsec

VPN connection through XAuth server in Internet.

Specify Remote Node -You can specify the IP address of the

remote dial-in user, ISDN number or peer ID (used in IKE

aggressive mode).

Uncheck the checkbox means the connection type you select

above will apply the authentication methods and security

methods in the general settings.

Netbios Naming Packet -

 Pass – Click it to have an inquiry for data transmission

between the hosts located on both sides of VPN Tunnel

while connecting.

 Block – When there is conflict occurred between the

hosts on both sides of VPN Tunnel in connecting, such

function can block data transmission of Netbios Naming

Packet inside the tunnel.

Multicast via VPN - Some programs might send multicast

packets via VPN connection.

 Pass – Click this button to let multicast packets pass

through the router.

 Block – This is default setting. Click this button to let

multicast packets be blocked by the router.

User Name - This field is applicable when you select PPTP or

L2TP with or without IPsec policy above. The length of the

name is limited to 23 characters.

Password - This field is applicable when you select PPTP or

L2TP with or without IPsec policy above. The length of the

password is limited to 19 characters.

Enable Mobile One-Time Passwords (mOTP) - Check this

box to make the authentication with mOTP function.

PIN Code – Enter the code for authentication (e.g, 1234).

Secret – Use the 32 digit-secret number generated by mOTP

in the mobile phone (e.g., e759bb6f0e94c7ab4fe6).

Subnet Chose one of the subnet selections for such VPN profile.

Assign Static IP Address – Please type a static IP address for

the subnet you specified.

IKE Authentication

Method

This group of fields is applicable for IPsec Tunnels and L2TP

with IPsec Policy when you specify the IP address of the

remote node. The only exception is Digital Signature (X.509)

can be set when you select IPsec tunnel either with or

without specifying the IP address of the remote node.

Pre-Shared Key - Check the box of Pre-Shared Key to invoke

this function and Enter the required characters (1-63) as the

Vigor2620 Series User’s Guide

209

pre-shared key.

Digital Signature (X.509) – Check the box of Digital Signature

to invoke this function and Select one predefined Profiles set

in the VPN and Remote Access >>IPsec Peer Identity.

IPsec Security Method This group of fields is a must for IPsec Tunnels and L2TP with

IPsec Policy when you specify the remote node. Check the

Medium, DES, 3DES or AES box as the security method.

Medium-Authentication Header (AH) means data will be

authenticated, but not be encrypted. By default, this option

is invoked. You can uncheck it to disable it.

High-Encapsulating Security Payload (ESP) means payload

(data) will be encrypted and authenticated. You may select

encryption algorithm from Data Encryption Standard (DES),

Triple DES (3DES), and AES.

Local ID (Optional)- Specify a local ID to be used for Dial-in

setting in the LAN-to-LAN Profile setup. This item is optional

and can be used only in IKE aggressive mode.

After finishing all the settings here, please click OK to save the configuration.

I

V

-

1

-

8

L

A

N

t

o

L

A

N

Here you can manage LAN-to-LAN connections by maintaining a table of connection profiles.

You may set parameters including specified connection direction (dial-in or dial-out),

connection peer ID, connection type (VPN connection - including PPTP, IPsec Tunnel, and

L2TP by itself or over IPsec) and corresponding security methods, etc.

Available settings are explained as follows:

Item Description

Set to Factory Default Click to clear all indexes.

Vigor2620 Series User’s Guide

210

Name Indicate the name of the LAN-to-LAN profile. The symbol ???

represents that the profile is empty.

Active V – means the profile has been enabled.

X – means the profile has not been enabled.

Status Online – means such LAN to LAN profile is in use.

Offline – means such LAN to LAN profile isn’t in use even if

the profile has been enabled.

To edit each profile:

1. Click each index to edit each profile and you will get the following page. Each

LAN-to-LAN profile includes 4 subgroups. If the fields gray out, it means you may leave it

untouched. The following explanations will guide you to fill all the necessary fields.

Available settings are explained as follows:

Item Description

Common Settings Profile Name – Specify a name for the profile of the

LAN-to-LAN connection.

Enable this profile - Check here to activate this profile.

VPN Dial-Out Through - Use the drop down menu to choose a

proper WAN interface for this profile. This setting is useful

for dial-out only.

 WAN1 First/ WAN2 First/ LTE First - While connecting,

the router will use WAN1/WAN2/WAN3 or LTE/WAN4 as

the first channel for VPN connection. If

WAN1/WAN2/WAN3 or LTE/WAN4 fails, the router will

use another WAN interface instead.

Vigor2620 Series User’s Guide

211

 WAN1 Only /WAN2 Only/ LTE Only - While connecting,

the router will use WAN1/WAN2/WAN3 or LTE/WAN4 as

the only channel for VPN connection.

 WAN1 Only: Only establish VPN if WAN2 down - If

WAN2 failed, the router will use WAN1 for VPN

connection.

 WAN2 Only: Only establish VPN if WAN1 down - If

WAN1 failed, the router will use WAN2 for VPN

connection.

Netbios Naming Packet

 Pass – click it to have an inquiry for data transmission

between the hosts located on both sides of VPN Tunnel

while connecting.

 Block – When there is conflict occurred between the

hosts on both sides of VPN Tunnel in connecting, such

function can block data transmission of Netbios Naming

Packet inside the tunnel.

Multicast via VPN - Some programs might send multicast

packets via VPN connection.

 Pass – Click this button to let multicast packets pass

through the router.

 Block – This is default setting. Click this button to let

multicast packets be blocked by the router.

Call Direction - Specify the allowed call direction of this

LAN-to-LAN profile.

 Both:-initiator/responder

 Dial-Out- initiator only

 Dial-In- responder only.

Always On-Check to enable router always keep VPN

connection.

Idle Timeout: The default value is 300 seconds. If the

connection has been idled over the value, the router will

drop the connection.

Enable PING to keep IPsec tunnel alive - This function is to

help the router to determine the status of IPsec VPN

connection, especially useful in the case of abnormal VPN

IPsec tunnel disruption. For details, please refer to the note

below. Check to enable the transmission of PING packets to a

specified IP address.

This function is used to handle abnormal IPsec VPN

connection disruption. It will help to provide the state of a

VPN connection for router’s judgment of redial. Normally, if

any one of VPN peers wants to disconnect the connection, it

should follow a serial of packet exchange procedure to

inform each other. However, if the remote peer disconnects

without notice, Vigor router will by no where to know this

situation. To resolve this dilemma, by continuously sending

PING packets to the remote host, the Vigor router can know

the true existence of this VPN connection and react

accordingly. This is independent of DPD (dead peer

detection).

PING to the IP - Enter the IP address of the remote host that

located at the other-end of the VPN tunnel.

Dial-Out Settings Type of Server I am calling - PPTP - Build a PPTP VPN

connection to the server through the Internet. You should set

the identity like User Name and Password below for the

Vigor2620 Series User’s Guide

212

authentication of remote server.

IPsec Tunnel - Build an IPsec VPN connection to the server

through Internet.

L2TP with IPsec Policy - Build a L2TP VPN connection

through the Internet. You can select to use L2TP alone or

with IPsec. Select from below:

 None: Do not apply the IPsec policy. Accordingly, the

VPN connection employed the L2TP without IPsec

policy can be viewed as one pure L2TP connection.

 Nice to Have: Apply the IPsec policy first, if it is

applicable during negotiation. Otherwise, the dial-out

VPN connection becomes one pure L2TP connection.

 Must: Specify the IPsec policy to be definitely applied

on the L2TP connection.

SSL Tunnel - Build an SSL VPN connection to the server

through Internet.

User Name - This field is applicable when you select, PPTP or

L2TP with or without IPsec policy above. The length of the

name is limited to 49 characters.

Password - This field is applicable when you select PPTP or

L2TP with or without IPsec policy above. The length of the

password is limited to 15 characters.

PPP Authentication - This field is applicable when you

select, PPTP or L2TP with or without IPSec policy above.

PAP/CHAP/MS-CHAP/MS-CHAPv2 is the most common

selection due to compatibility.

VJ compression - This field is applicable when you select

PPTP or L2TP with or without IPsec policy above. VJ

Compression is used for TCP/IP protocol header compression.

Normally set to On to improve bandwidth utilization.

IKE Authentication Method - This group of fields is

applicable for IPsec Tunnels and L2TP with IPsec Policy.

 Pre-Shared Key - Input 1-63 characters as pre-shared

key.

 Digital Signature (X.509) - Select one predefined

Profiles set in the VPN and Remote Access >>IPsec

Peer Identity.

Peer ID - Select one of the predefined Profiles set in

VPN and Remote Access >>IPsec Peer Identity.

Local ID – Specify a local ID (Alternative Subject Name

First or Subject Name First) to be used for Dial-in

setting in the LAN-to-LAN Profile setup. This item is

optional and can be used only in IKE aggressive mode.

 Local Certificate – Select one of the profiles set in

Certificate Management>>Local Certificate.

IPsec Security Method - This group of fields is a must for

IPsec Tunnels and L2TP with IPsec Policy.

 Medium AH (Authentication Header) means data will

be authenticated, but not be encrypted. By default,

this option is active.

 High (ESP-Encapsulating Security Payl

oad)- means

payload (data) will be encrypted and authenticated.

Select from below:

 DES without Authentication -Use DES encryption

algorithm and not apply any authentication

Vigor2620 Series User’s Guide

213

scheme.

 DES with Authentication-Use DES encryption

algorithm and apply MD5 or SHA-1 authentication

algorithm.

 3DES without Authentication-Use triple DES

encryption algorithm and not apply any

authentication scheme.

 3DES with Authentication-Use triple DES

encryption algorithm and apply MD5 or SHA-1

authentication algorithm.

 AES without Authentication-Use AES encryption

algorithm and not apply any authentication

scheme.

 AES with Authentication-Use AES encryption

algorithm and apply MD5 or SHA-1 authentication

algorithm.

Advanced - Specify mode, proposal and key life of each IKE

phase, Gateway, etc.

The window of advance setup is shown as below:

IKE phase 1 mode -Select from Main mode and Aggressive

mode. The ultimate outcome is to exchange security

proposals to create a protected secure channel. Main mode

is more secure than Aggressive mode since more exchanges

are done in a secure channel to set up the IPsec session.

However, the Aggressive mode is faster. The default value in

Vigor router is Main mode.

 IKE phase 1 proposal-To propose the local available

authentication schemes and encryption algorithms to

the VPN peers, and get its feedback to find a match.

Two combinations are available for Aggressive mode

and nine for Main mode. We suggest you select the

combination that covers the most schemes.

 IKE phase 2 proposal-To propose the local available

algorithms to the VPN peers, and get its feedback to

find a match. Three combinations are available for both

modes. We suggest you select the combination that

covers the most algorithms.

 IKE phase 1 key lifetime-For security reason, the

lifetime of key should be defined. The default value is

28800 seconds. You may specify a value in between 900

and 86400 seconds.

 IKE phase 2 key lifetime-For security reason, the

lifetime of key should be defined. The default value is

3600 seconds. You may specify a value in between 600

and 86400 seconds.

 Perfect Forward Secret (PFS)-The IKE Phase 1 key will

be reused to avoid the computation complexity in

phase 2. The default value is inactive this function.

Vigor2620 Series User’s Guide

214

Local ID-In Aggressive mode, Local ID is on behalf of

the IP address while identity authenticating with

remote VPN server. The length of the ID is limited to 47

characters.

Schedule Profile - Set the wireless LAN to work at certain

time interval only. You may choose up to 4 schedules out of

the 15 schedules pre-defined in Applications >> Schedule

setup. The default setting of this field is blank and the

function will always work.

Available settings are explained as follows:

Item Description

Dial-In Settings Allowed Dial-In Type - Determine the dial-in connection

with different types.

 PPTP - Allow the remote dial-in user to make a PPTP

VPN connection through the Internet. You should set

the User Name and Password of remote dial-in user

below.

 IPsec Tunnel- Allow the remote dial-in user to trigger

an IPsec VPN connection through Internet.

 L2TP with IPsec Policy - Allow the remote dial-in user

to make a L2TP VPN connection through the Internet.

You can select to use L2TP alone or with IPsec. Select

from below:

 None - Do not apply the IPsec policy. Accordingly,

the VPN connection employed the L2TP without

IPsec policy can be viewed as one pure L2TP

connection.

Vigor2620 Series User’s Guide

215

 Nice to Have - Apply the IPsec policy first, if it is

applicable during negotiation. Otherwise, the

dial-in VPN connection becomes one pure L2TP

connection.

 Must - Specify the IPsec policy to be definitely

applied on the L2TP connection.

 SSL Tunnel- Allow the remote dial-in user to trigger an

SSL VPN connection through Internet.

Specify Remote VPN Gateway - You can specify the IP

address of the remote dial-in user or peer ID (should be the

same with the ID setting in dial-in type) by checking the box.

Also, you should further specify the corresponding security

methods on the right side.

If you uncheck the checkbox, the connection type you select

above will apply the authentication methods and security

methods in the general settings.

Username - This field is applicable when you select PPTP or

L2TP with or without IPsec policy above. The length of the

name is limited to 11 characters.

Password - This field is applicable when you select PPTP or

L2TP with or without IPsec policy above. The length of the

password is limited to 11 characters.

VJ Compression - VJ Compression is used for TCP/IP

protocol header compression. This field is applicable when

you select PPTP or L2TP with or without IPsec policy above.

IKE Authentication Method - This group of fields is

applicable for IPsec Tunnels and L2TP with IPsec Policy when

you specify the IP address of the remote node. The only

exception is Digital Signature (X.509) can be set when you

select IPsec tunnel either with or without specify the IP

address of the remote node.

 Pre-Shared Key - Check the box of Pre-Shared Key to

invoke this function and Enter the required characters

(1-63) as the pre-shared key.

 Digital Signature (X.509) –Check the box of Digital

Signature to invoke this function and select one

predefined Profiles set in the VPN and Remote Access

>>IPsec Peer Identity.

 Local ID – Specify which one will be inspected

first.

 Alternative Subject Name First – The alternative

subject name (configured in Certificate

Management>>Local Certificate) will be

inspected first.

 Subject Name First – The subject name

(configured in Certificate Management>>Local

Certificate) will be inspected first.

IPsec Security Method - This group of fields is a must for

IPsec Tunnels and L2TP with IPsec Policy when you specify

the remote node.

 Medium- Authentication Header (AH) means data will

be authenticated, but not be encrypted. By default,

this option is active.

 High- Encapsulating Security Payload (ESP) means

payload (data) will be encrypted and authenticated.

You may select encryption algorithm from Data

Vigor2620 Series User’s Guide

216

Encryption Standard (DES), Triple DES (3DES), and AES.

TCP/IP Network

Settings

My WAN IP –This field is only applicable when you select

PPTP or L2TP with or without IPsec policy above. The default

value is 0.0.0.0, which means the Vigor router will get a PPP

IP address from the remote router during the IPCP

negotiation phase. If the PPP IP address is fixed by remote

side, specify the fixed IP address here. Do not change the

default value if you do not select PPTP or L2TP.

Remote Gateway IP - This field is only applicable when you

select PPTP or L2TP with or without IPsec policy above. The

default value is 0.0.0.0, which means the Vigor router will

get a remote Gateway PPP IP address from the remote router

during the IPCP negotiation phase. If the PPP IP address is

fixed by remote side, specify the fixed IP address here. Do

not change the default value if you do not select PPTP or

L2TP.

Remote Network IP/ Remote Network Mask - Add a static

route to direct all traffic destined to this Remote Network IP

Address/Remote Network Mask through the VPN connection.

For IPsec, this is the destination clients IDs of phase 2 quick

mode.

Local Network IP / Local Network Mask - Display the local

network IP and mask for TCP / IP configuration. You can

modify the settings if required.

More - Add a static route to direct all traffic destined to

more Remote Network IP Addresses/ Remote Network Masks

through the VPN connection. This is usually used when you

find there are several subnets behind the remote VPN router.

RIP Direction - The option specifies the direction of RIP

(Routing Information Protocol) packets. You can

enable/disable one of direction here. Herein, we provide

four options: TX/RX Both, TX Only, RX Only, and Disable.

From first subnet to remote network, you have to do - If

the remote network only allows you to dial in with single IP,

please choose NAT, otherwise choose Route.

Change default route to this VPN tunnel - Check this box to

change the default route with this VPN tunnel.

IPSec VPN with the

Same subnet

For both ends (e.g., different sections in a company) are

within the same subnet, there is a function which allows you

to build Virtual IP mapping between two ends. Thus, when

VPN connection established, the router will change the IP

address according to the settings configured here and block

Vigor2620 Series User’s Guide

21

7

sessions which are not coming from the IP address defined in

the Virtual IP Mapping list.

After checking the box of IPSec VPN with the Same subnet,

the options under TCP/IP Network Settings will be changed

as shown below:

Remote Network IP/ Remote Network Mask - Add a static

route to direct all traffic destined to this Remote Network IP

Address/Remote Network Mask through the VPN connection.

For IPSec, this is the destination clients IDs of phase 2 quick

mode.

Translated Local Network – This function is enabled in

default. Use the drop down list to specify a LAN port as the

transferred direction. Then specify an IP address. Click

Advanced to configure detailed settings if required.

Advanced – Add a static route to direct all traffic destined to

more Remote Network IP Addresses/ Remote Network Mask

through the VPN connection. This is usually used when you

find there are several subnets behind the remote VPN router.

Translated Type – There are two types for you to choose.

 Whole Subnet

 Specific IP Address

Virtual IP Mapping – A pop up dialog will appear for you to

specify the local IP address and the mapping virtual IP

address.

Vigor2620 Series User’s Guide

218

2. After finishing all the settings here, please click OK to save the configuration.

Vigor2620 Series User’s Guide

219

I

V

-

1

-

9

C

o

n

e

c

t

i

o

n

M

a

n

a

g

e

m

e

n

t

You can find the summary table of all VPN connections. You may disconnect any VPN

connection by clicking Drop button. You may also aggressively Dial-out by using Dial-out Tool

and clicking Dial button.

Available settings are explained as follows:

Item Description

Dial-out Tool This filed displays the profile configured in LAN-to-LAN (with

Index number and VPN Server IP address). The VPN

connection built by General Mode does not support VPN

backup function.

Dial - Click this button to execute dial out function.

Vigor2620 Series User’s Guide

220

I

V

-

2

S

L

V

P

N

An SSL VPN (Secure Sockets Layer virtual private network) is a form of VPN that can be used

with a standard Web browser.

There are two benefits that SSL VPN provides:

 It is not necessary for users to preinstall VPN client software for executing SSL VPN

connection.

 There are less restrictions for the data encrypted through SSL VPN in comparing with

traditional VPN.

Vigor2620 Series User’s Guide

221

W

e

b

U

s

e

r

I

n

t

e

r

f

a

c

e

I

V

-

2

-

1

G

e

n

e

r

a

l

S

e

t

u

p

This page determines the general configuration for SSL VPN Server and SSL Tunnel.

Available settings are explained as follows:

Item Description

Bind to WAN Choose and check WAN interface(s) for SSL VPN tunnel

establishment.

Port Such port is set for SSL VPN server. It will not affect the HTTPS

Port configuration set in System Maintenance>>Management.

In general, the default setting is 443.

Server Certificate When the client does not set any certificate, default

certificate will be used for HTTPS and SSL VPN server. Choose

any one of the user-defined certificates from the drop down

list if users set several certificates previously. Otherwise,

choose Self-signed to use the router’s built-in default

certificate. The default certificate can be used in SSL VPN

server and HTTPS Web Proxy.

After finishing all the settings here, please click OK to save the configuration.

Vigor2620 Series User’s Guide

222

I

V

-

2

-

2

U

s

e

r

A

c

o

u

n

t

With SSL VPN, Vigor2620 series let teleworkers have convenient and simple remote access to

central site VPN. The teleworkers do not need to install any VPN software manually. From

regular web browser, you can establish VPN connection back to your main office even in a

guest network or web cafe. The SSL technology is the same as the encryption that you use for

secure web sites such as your online bank. The SSL VPN can be operated in either full tunnel

mode or proxy mode. Now, Vigor2620 series allows up to 16 simultaneous incoming users.

For SSL VPN, identity authentication and power management are implemented through

deploying user accounts. Therefore, the user account for SSL VPN must be set together with

remote dial-in user web page. Such menu item will guide to access into VPN and Remote

Access>>Remote Dial-in user.

Vigor2620 Series User’s Guide

223

Click each index to edit one remote user profile.

Available settings are explained as follows:

Item Description

User account and

Authentication

Enable this account - Check the box to enable this function.

Idle Timeout- If the dial-in user is idle over the limitation of

the timer, the router will drop this connection. By default, the

Idle Timeout is set to 300 seconds.

Username - This field is applicable when you select PPTP or

L2TP with or without IPsec policy above. The length of the

name/password is limited to 23 characters.

Password - This field is applicable when you select PPTP or

L2TP with or without IPsec policy above. The length of the

name/password is limited to 19 characters.

Enable Mobile One-Time Passwords (mOTP) - Check this box

to make the authentication with mOTP function.

PIN Code – Enter the code for authentication (e.g, 1234).

Secret – Use the 32 digit-secret number generated by mOTP in

the mobile phone (e.g., e759bb6f0e94c7ab4fe6).

Allowed Dial-In Type PPTP - Allow the remote dial-in user to make a PPTP VPN

connection through the Internet. You should set the User

Name and Password of remote dial-in user below.

IPSec Tunnel - Allow the remote dial-in user to make an IPSec

VPN connection through Internet.

Vigor2620 Series User’s Guide

224

Item Description

L2TP with IPSec Policy - Allow the remote dial-in user to

make a L2TP VPN connection through the Internet. You can

select to use L2TP alone or with IPSec. Select from below:

 None - Do not apply the IPSec policy. Accordingly, the

VPN connection employed the L2TP without IPSec policy

can be viewed as one pure L2TP connection.

 Nice to Have - Apply the IPSec policy first, if it is

applicable during negotiation. Otherwise, the dial-in VPN

connection becomes one pure L2TP connection.

 Must -Specify the IPSec policy to be definitely applied on

the L2TP connection.

SSL Tunnel - It allows the remote dial-in user to make an SSL

VPN Tunnel connection through Internet, suitable for the

application through network accessing (e.g., PPTP / L2TP /

IPSec).

If you check this box, the function of SSL Tunnel for this

account will be activated immediately.

IPsec XAuth – Allow the remote dial-in user to make an IPsec

VPN connection through XAuth server in Internet.

Specify Remote Node - Check the checkbox to specify the IP

address of the remote dial-in user, ISDN number or peer ID

(used in IKE aggressive mode). If you uncheck the checkbox,

the connection type you select above will apply the

authentication methods and security methods in the general

settings.

Netbios Naming Packet

 Pass – Click it to have an inquiry for data transmission

between the hosts located on both sides of VPN Tunnel

while connecting.

 Block – When there is conflict occurred between the

hosts on both sides of VPN Tunnel in connecting, such

function can block data transmission of Netbios Naming

Packet inside the tunnel.

Multicast via VPN - Some programs might send multicast

packets via VPN connection.

 Pass – Click this button to let multicast packets pass

through the router.

 Block – This is default setting. Click this button to let

multicast packets be blocked by the router.

Subnet Chose one of the subnet selections for such VPN profile.

Assign Static IP Address – Please type a static IP address for

the subnet you specified.

IKE Authentication

Method

This group of fields is applicable for IPSec Tunnels and L2TP

with IPSec Policy when you specify the IP address of the

remote node. The only exception is Digital Signature (X.509)

can be set when you select IPSec tunnel either with or without

specify the IP address of the remote node.

Pre-Shared Key - Check the box of Pre-Shared Key to invoke

this function and Enter the required characters (1-63) as the

pre-shared key.

Digital Signature (X.509) – Check the box of Digital Signature

to invoke this function and Select one predefined Profiles set

in the VPN and Remote Access >>IPSec Peer Identity.

Vigor2620 Series User’s Guide

225

Item Description

IPSec Security Method This group of fields is a must for IPSec Tunnels and L2TP with

IPSec Policy when you specify the remote node. Check the

Medium, DES, 3DES or AES box as the security method.

Medium-Authentication Header (AH) means data will be

authenticated, but not be encrypted. By default, this option is

invoked. You can uncheck it to disable it.

High(ESP-Encapsulating Security Payload) means payload

(data) will be encrypted and authenticated. You may select

encryption algorithm from Data Encryption Standard (DES),

Triple DES (3DES), and AES.

Local ID - Specify a local ID to be used for Dial-in setting in the

LAN-to-LAN Profile setup. This item is optional and can be

used only in IKE aggressive mode.

After finishing all the settings here, please click OK to save the configuration.

Vigor2620 Series User’s Guide

226

I

V

-

2

-

3

S

L

P

o

r

t

a

l

O

n

l

i

n

e

U

s

e

r

If you have finished the configuration of SSL Web Proxy (server), users can find out

corresponding settings when they access into DrayTek SSL VPN portal interface.

Next, users can open SSL VPN>> Online Status to view logging status of SSL VPN.

Available settings are explained as follows:

Item Description

Active User Display current user who visits SSL VPN server.

Host IP Display the IP address for the host.

Time out Display the time remaining for logging out.

Action You can click Drop to drop certain login user from the router's

SSL Portal UI.

Vigor2620 Series User’s Guide

22

7

I

V

-

3

C

e

r

t

i

f

i

c

a

t

e

M

a

n

a

g

e

m

e

n

t

A digital certificate works as an electronic ID, which is issued by a certification authority (CA).

It contains information such as your name, a serial number, expiration dates etc., and the

digital signature of the certificate-issuing authority so that a recipient can verify that the

certificate is real. Here Vigor router support digital certificates conforming to standard

X.509.

Any entity wants to utilize digital certificates should first request a certificate issued by a CA

server. It should also retrieve certificates of other trusted CA servers so it can authenticate

the peer with certificates issued by those trusted CA servers.

Here you can manage generate and manage the local digital certificates, and set trusted CA

certificates. Remember to adjust the time of Vigor router before using the certificate so that

you can get the correct valid period of certificate.

Below shows the menu items for Certificate Management.

Vigor2620 Series User’s Guide

228

W

e

b

U

s

e

r

I

n

t

e

r

f

a

c

e

I

V

-

3

-

1

L

o

c

a

l

C

e

r

t

i

f

i

c

a

t

e

Available settings are explained as follows:

Item Description

Generate Click this button to open Generate Certificate Request

window.

Enter all the information that the window requests. Then click

Generate again.

Import Click this button to import a saved file as the certification

information.

Refresh Click this button to refresh the information listed below.

View Click this button to view the detailed settings for certificate

request.

Delete Click this button to delete selected name with certification

information.

G

E

N

E

R

A

T

E

Click this button to open Generate Certificate Signing Request window. Enter all the

information that the window request such as certifcate name (used for identifying different

certificate), subject alternative name type and relational settings for subject name. Then

click GENERATE again.

Vigor2620 Series User’s Guide

229

Info

Please be noted that “Common Name” must be configured with router’s

WAN IP or domain name.

After clicking GENERATE, the generated information will be displayed on the window below:

I

M

P

O

R

T

Vigor router allows you to generate a certificate request and submit it the CA server, then

import it as “Local Certificate”. If you have already gotten a certificate from a third party,

you may import it directly. The supported types are PKCS12 Certificate and Certificate with a

private key.

Click this button to import a saved file as the certification information. There are three types

of local certificate supported by Vigor router.

Vigor2620 Series User’s Guide

230

Available settings are explained as follows:

Item Description

Upload Local Certificate It allows users to import the certificate which is generated by

Vigor router and signed by CA server.

If you have done well in certificate generation, the Status of

the certificate will be shown as “OK”.

Upload PKCS12

Certificate

It allows users to import the certificate whose extensions are

usually .pfx or .p12. And these certificates usually

need passwords.

Note that PKCS12 is a standard for storing private keys and

certificates securely. It is used in (among other things)

Netscape and Microsoft Internet Explorer with their import

and export options.

Upload Certificate and

Private Key

It is useful when users have separated certificates and private

keys. And the password is needed if the private key is

encrypted.

Vigor2620 Series User’s Guide

231

R

E

F

R

E

S

H

Click this button to refresh the information listed below.

V

i

e

w

Click this button to view the detailed settings for certificate request.

Info

You have to copy the certificate request information from above window.

Next, access your CA server and enter the page of certificate request, copy

the information into it and submit a request. A new certificate will be

issued to you by the CA server. You can save it.

D

e

l

e

t

e

Click this button to remove the selected certificate.

Vigor2620 Series User’s Guide

232

I

V

-

3

-

2

T

r

u

s

t

e

d

C

A

C

e

r

t

i

f

i

c

a

t

e

Trusted CA certificate lists three sets of trusted CA certificate. In addition, you can build a

RootCA certificate if required.

When the local client and remote client are required to make certificate authentication (e.g.,

IPsec X.509) for data passing through SSL tunnel and avoiding the attack of MITM, a trusted

root certificate authority (Root CA) will be used to authenticate the digital certificates

offered by both ends.

However, the procedure of applying digital certificate from a trusted root certificate

authority is complicated and time-consuming. Therefore, Vigor router offers a mechanism

which allows you to generate root CA to save time and provide convenience for general user.

Later, such root CA generated by DrayTek server can perform the issuing of local certificate.

Info

Root CA can be deleted but not edited. If you want to modify the settings

for a Root CA, please delete the one and create another one by clicking

Create Root CA.

C

r

e

a

t

i

n

g

a

R

o

t

C

A

Click Create to open the following page. Enter all the information that the window request

such as certifcate name (used for identifying different certificate), subject alternative name

type and relational settings for subject name. Then click Generate again.

Vigor2620 Series User’s Guide

233

I

m

p

o

r

t

i

n

g

a

T

r

u

s

t

e

d

C

A

To import a pre-saved trusted CA certificate, please click IMPORT to open the following

window. Use Browse… to find out the saved text file. Then click Import. The one you

imported will be listed on the Trusted CA Certificate window.

For viewing each trusted CA certificate, click View to open the certificate detail information

window. If you want to delete a CA certificate, choose the one and click Delete to remove all

the certificate information.

Vigor2620 Series User’s Guide

234

I

V

-

3

-

3

C

e

r

t

i

f

i

c

a

t

e

B

a

c

k

u

p

Local certificate and Trusted CA certificate for this router can be saved within one file.

Please click Backup on the following screen to save them. If you want to set encryption

password for these certificates, please type characters in both fields of Encrypt password

and Confirm password.

Also, you can use Restore to retrieve these two settings to the router whenever you want.

Vigor2620 Series User’s Guide

235

P

a

r

t

V

S

e

c

u

r

i

t

y

While the broadband users demand more bandwidth

for multimedia, interactive applications, or distance

learning, security has been always the most

concerned. The firewall of the Vigor router helps to

protect your local network against attack from

unauthorized outsiders. It also restricts users in the

local network from accessing the Internet.

CSM is an abbreviation of Central Security Management

which is used to control IM/P2P usage, filter the web

content and URL content to reach a goal of security

management.

Vigor2620 Series User’s Guide

236

V

-

1

F

i

r

e

w

a

l

While the broadband users demand more bandwidth for multimedia, interactive applications,

or distance learning, security has been always the most concerned. The firewall of the Vigor

router helps to protect your local network against attack from unauthorized outsiders. It also

restricts users in the local network from accessing the Internet. Furthermore, it can filter out

specific packets that trigger the router to build an unwanted outgoing connection.

F

i

r

e

w

a

l

F

a

c

i

l

i

t

i

e

s

The users on the LAN are provided with secured protection by the following firewall facilities:

 User-configurable IP filter (Call Filter/ Data Filter).

 Stateful Packet Inspection (SPI): tracks packets and denies unsolicited incoming data

 Selectable Denial of Service (DoS) /Distributed DoS (DDoS) attacks protection

I

P

F

i

l

t

e

r

s

Depending on whether there is an existing Internet connection, or in other words “the WAN

link status is up or down”, the IP filter architecture categorizes traffic into two: Call Filter

and Data Filter.

 Call Filter - When there is no existing Internet connection, Call Filter is applied to all

traffic, all of which should be outgoing. It will check packets according to the filter rules.

If legal, the packet will pass. Then the router shall “initiate a call” to build the Internet

connection and send the packet to Internet.

 Data Filter - When there is an existing Internet connection, Data Filter is applied to

incoming and outgoing traffic. It will check packets according to the filter rules. If legal,

the packet will pass the router.

The following illustrations are flow charts explaining how router will treat incoming traffic

and outgoing traffic respectively.

Vigor2620 Series User’s Guide

23

7

S

t

a

t

e

f

u

l

P

a

c

k

e

t

I

n

s

p

e

c

t

i

o

n

(

S

P

I

)

Stateful inspection is a firewall architecture that works at the network layer. Unlike legacy

static packet filtering, which examines a packet based on the information in its header,

stateful inspection builds up a state machine to track each connection traversing all

interfaces of the firewall and makes sure they are valid. The stateful firewall of Vigor router

not only examines the header information also monitors the state of the connection.

D

e

n

i

a

l

o

f

S

e

r

v

i

c

e

(

D

o

S

)

D

e

f

e

n

s

e

The DoS Defense functionality helps you to detect and mitigate the DoS attack. The attacks

are usually categorized into two types, the flooding-type attacks and the vulnerability attacks.

The flooding-type attacks will attempt to exhaust all your system's resource while the

vulnerability attacks will try to paralyze the system by offending the vulnerabilities of the

protocol or operation system.

The DoS Defense function enables the Vigor router to inspect every incoming packet based on

the attack signature database. Any malicious packet that might duplicate itself to paralyze

the host in the secure LAN will be strictly blocked and a Syslog message will be sent as warning,

if you set up Syslog server.

Also the Vigor router monitors the traffic. Any abnormal traffic flow violating the pre-defined

parameter, such as the number of thresholds, is identified as an attack and the Vigor router

will activate its defense mechanism to mitigate in a real-time manner.

The below shows the attack types that DoS/DDoS defense function can detect:

1. SYN flood attack

2. UDP flood attack

3. ICMP flood attack

4. Port Scan attack

5. IP options

6. Land attack

7. Smurf attack

8. Trace route

9. SYN fragment

10. Fraggle attack

11. TCP flag scan

12. Tear drop attack

13. Ping of Death attack

14. ICMP fragment

15. Unassigned Numbers

Vigor2620 Series User’s Guide

238

W

e

b

U

s

e

r

I

n

t

e

r

f

a

c

e

Below shows the menu items for Firewall.

V

-

1

-

1

G

e

n

e

r

a

l

S

e

t

u

p

General Setup allows you to adjust settings of IP Filter and common options. Here you can

enable or disable the Call Filter or Data Filter. Under some circumstance, your filter set can

be linked to work in a serial manner. So here you assign the Start Filter Set only. Also you can

configure the Log Flag settings, Apply IP filter to VPN incoming packets, and Accept

incoming fragmented UDP packets.

Click Firewall and click General Setup to open the general setup page.

G

e

n

e

r

a

l

S

e

t

u

p

P

a

g

e

Such page allows you to enable / disable Call Filter and Data Filter, determine general rule

for filtering the incoming and outgoing data.

Available settings are explained as follows:

Item Description

Call Filter Check Enable to activate the Call Filter function. Assign a

start filter set for the Call Filter.

Vigor2620 Series User’s Guide

239

Data Filter Check Enable to activate the Data Filter function. Assign a

start filter set for the Data Filter.

Always pass inbound

fragmented large

packets…

Some on-line games (for example: Half Life) will use lots of

fragmented UDP packets to transfer game data. Instinctively

as a secure firewall, Vigor router will reject these

fragmented packets to prevent attack unless you enable

“Always pass inbound fragmented large packets…”. By

checking this box, you can play these kinds of on-line games.

If security concern is in higher priority, you cannot enable

“Always pass inbound fragmented large packets…”.

Enable Strict Security

Firewall

For the sake of security, the router will execute strict

security checking for data transmission.

Such feature is enabled in default. All the packets, while

transmitting through Vigor router, will be filtered by

firewall. If the firewall system (e.g., content filter server)

does not make any response (pass or block) for these

packets, then the router’s firewall will block the packets

directly.

Block routing connections

initiated from WAN

Usually, IPv6 network sessions/traffic from WAN to LAN will

be accepted by IPv6 firewall in default.

IPv6 - To prevent remote client accessing into the PCs on

LAN, check the box to make the packets (routed from WAN to

LAN) via IPv6 being blocked by such router. It is effective

only for the packets routed but not for packets translated by

NAT.

IPv4 - To prevent remote client accessing into the PCs on

LAN, check the box to make the incoming packets via IPv4

being blocked by such router. It is effective only for the

packets routed but not for packets translated by NAT.

Backup Firewall Click Backup to save the firewall configuration.

Restore Firewall Click Select to choose a firewall configuration file. Then

click Restore to apply the file.

Vigor2620 Series User’s Guide

240

D

e

f

a

u

l

t

R

u

l

e

P

a

g

e

Such page allows you to choose filtering profiles including QoS, Load-Balance policy, WCF,

APP Enforcement, URL Content Filter, for data transmission via Vigor router.

Available settings are explained as follows:

Item Description

Filter Select Pass or Block for the packets that do not match with

the filter rules.

Sessions Control The number typed here is the total sessions of the packets

that do not match the filter rule configured in this page. The

default setting is 60000.

Quality of Service Choose one of the QoS rules to be applied as firewall rule.

For detailed information of setting QoS, please refer to the

related section later.

APP Enforcement Select an APP Enforcement profile for global IM/P2P

application blocking. If there is no profile for you to select,

please choose [Create New] from the drop down list in this

page to create a new profile. All the hosts in LAN must follow

the standard configured in the APP Enforcement profile

selected here. For detailed information, refer to the section

of APP Enforcement profile setup. For troubleshooting

needs, you can specify to record information for IM/P2P by

checking the Log box. It will be sent to Syslog server. Please

refer to section Syslog/Mail Alert for more detailed

information.

Vigor2620 Series User’s Guide

241

URL Content Filter Select one of the URL Content Filter profile settings

(created in CSM>> URL Content Filter) for applying with this

router. Please set at least one profile for choosing in CSM>>

URL Content Filter web page first. Or choose [Create New]

from the drop down list in this page to create a new profile.

For troubleshooting needs, you can specify to record

information for URL Content Filter by checking the Log box.

It will be sent to Syslog server. Please refer to section

Syslog/Mail Alert for more detailed information.

Web Content Filter Select one of the Web Content Filter profile settings

(created in CSM>> Web Content Filter) for applying with

this router. Please set at least one profile for anti-virus in

CSM>> Web Content Filter web page first. Or choose

[Create New] from the drop down list in this page to create

a new profile. For troubleshooting needs, you can specify to

record information for Web Content Filter by checking the

Log box. It will be sent to Syslog server. Please refer to

section Syslog/Mail Alert for more detailed information.

Advance Setting Click Edit to open the following window. However, it is

strongly recommended to use the default settings here.

Codepage - This function is used to compare the characters

among different languages. Choose correct codepage can

help the system obtain correct ASCII after decoding data

from URL and enhance the correctness of URL Content Filter.

The default value for this setting is ANSI 1252 Latin I. If you

do not choose any codepage, no decoding job of URL will be

processed. Please use the drop-down list to choose a

codepage.

If you do not have any idea of choosing suitable codepage,

please open Syslog. From Codepage Information of Setup

dialog, you will see the recommended codepage listed on the

dialog box.

Window size – It determines the size of TCP protocol

(0~65535). The more the value is, the better the

Vigor2620 Series User’s Guide

242

performance will be. However, if the network is not stable,

small value will be proper.

Session timeout – Setting timeout for sessions can make the

best utilization of network resources.

Backup Firewall Click Backup to save the firewall configuration.

Restore Firewall Click Select to choose a firewall configuration file. Then

click Restore to apply the file.

After finishing all the settings here, please click OK to save the configuration.

Vigor2620 Series User’s Guide

243

V

-

1

-

2

F

i

l

t

e

r

S

e

t

u

p

Click Firewall and click Filter Setup to open the setup page.

To edit or add a filter, click on the set number to edit the individual set. The following page

will be shown. Each filter set contains up to 7 rules. Click on the rule number button to edit

each rule. Check Active to enable the rule.

Available settings are explained as follows:

Item Description

Rule Click a button numbered (1 ~ 7) to edit the filter rule. Click

the button will open Edit Filter Rule web page. For the

detailed information, refer to the following page.

Enable Check the box to enable the filter rule.

Comments Enter filter set comments/description. Maximum length is

23–character long.

Direction Display the direction of packet.

Src IP / Dst IP Display the IP address of source /destination.

Service Type Display the type and port number of the packet.

Vigor2620 Series User’s Guide

244

Action Display the packets to be passed /blocked.

CSM Display the content security managed

Move Up/Down Use Up or Down link to move the order of the filter rules.

Next Filter Set Set the link to the next filter set to be executed after the

current filter run. Do not make a loop with many filter sets.

Wizard Mode Allow to configure frequently used settings for filter rule via

several setting pages.

Advance Mode Allow to configure detailed settings of filter rule.

To use Wizard Mode, simple do the following steps:

1. Click the Wizard Mode radio button.

2. Click Index 1. The setting page will appear as follows:

Available settings are explained as follows:

Item Description

Comments Enter filter set comments/description. Maximum length is

14- character long.

Direction Set the direction of packet flow. It is for Data Filter only.

For the Call Filter, this setting is not available since Call

Filter is only applied to outgoing traffic.

Note: RT means routing domain for 2nd subnet or other

LAN.

Vigor2620 Series User’s Guide

245

Source/Destination IP

Click Edit to access into the following dialog to choose the

source/destination IP or IP ranges.

Protocol Specify the protocol(s) which this filter rule will apply to.

Source Port /

Destination Port

(=) – when the first and last value are the same, it indicates

one port; when the first and last values are different, it

indicates a range for the port and available for this service

type.

(!=) – when the first and last value are the same, it

indicates all the ports except the port defined here; when

the first and last values are different, it indicates that all

the ports except the range defined here are available for

this service type.

(>) – the port number greater than this value is available.

(<) – the port number less than this value is available for

this profile.

3. Click Next to get the following page.

Available settings are explained as follows:

Item Description

Pass Immediately Packets matching the rule will be passed immediately.

APP Enforcement - Select an APP Enforcement profile for

global IM/P2P application blocking. If there is no profile for

you to select, please choose [Create New] from the drop

Vigor2620 Series User’s Guide

246

down list in this page to create a new profile. All the hosts

in LAN must follow the standard configured in the APP

Enforcement profile selected here. For detailed

information, refer to the section of APP Enforcement

profile setup. For troubleshooting needs, you can specify to

record information for IM/P2P by checking the Log box. It

will be sent to Syslog server. Please refer to section

Syslog/Mail Alert for more detailed information.

URL Content Filter - Select one of the URL Content Filter

profile settings (created in CSM>> URL Content Filter) for

applying with this router. Please set at least one profile for

choosing in CSM>> URL Content Filter web page first. Or

choose [Create New] from the drop down list in this page

to create a new profile. For troubleshooting needs, you can

specify to record information for URL Content Filter by

checking the Log box. It will be sent to Syslog server. Please

refer to section Syslog/Mail Alert for more detailed

information.

Web Content Filter - Select one of the Web Content Filter

profile settings (created in CSM>> Web Content Filter) for

applying with this router. Please set at least one profile for

anti-virus in CSM>> Web Content Filter web page first. Or

choose [Create New] from the drop down list in this page

to create a new profile. For troubleshooting needs, you can

specify to record information for Web Content Filter by

checking the Log box. It will be sent to Syslog server. Please

refer to section Syslog/Mail Alert for more detailed

information.

Block Immediately Packets matching the rule will be dropped immediately.

4. After choosing the mechanism, click Next to get the summary page for reference.

5. If there is no error, click Finish to complete wizard setting.

Vigor2620 Series User’s Guide

247

To use Advance Mode, do the following steps:

1. Click the Advance Mode radio button.

2. Click Index 1 to access into the following page.

Available settings are explained as follows:

Item Description

Enable Check this box to enable the filter rule.

Comments Enter filter set comments/description. Maximum length is

14- character long.

Schedule Profile Set PCs on LAN to work at certain time interval only. You

may choose up to 4 schedules out of the 15 schedules

pre-defined in Applications >> Schedule setup. The

default setting of this field is blank and the function will

always work.

Clear sessions when

schedule ON

Check this box to clear the sessions when the above

schedule profiles are applied.

Direction Set the direction of packet flow. It is for Data Filter only.

For the Call Filter, this setting is not available since Call

Filter is only applied to outgoing traffic.

Note: RT means routing domain for 2nd subnet or other

LAN.

Source/Destination IP

Click Edit to access into the following dialog to choose the

Vigor2620 Series User’s Guide

248

source/destination IP or IP ranges.

To set the IP address manually, please choose Any

Address/Single Address/Range Address/Subnet Address as

the Address Type and type them in this dialog. In addition,

if you want to use the IP range from defined groups or

objects, please choose Group and Objects as the Address

Type.

From the IP Group drop down list, choose the one that you

want to apply. Or use the IP Object drop down list to

choose the object that you want.

Service Type Click Edit to access into the following dialog to choose a

suitable service type.

To set the service type manually, please choose User

defined as the Service Type and type them in this dialog. In

addition, if you want to use the service type from defined

groups or objects, please choose Group and Objects as the

Service Type.

Vigor2620 Series User’s Guide

249

Protocol - Specify the protocol(s) which this filter rule will

apply to.

Source/Destination Port –

(=) – when the first and last value are the same, it indicates

one port; when the first and last values are different, it

indicates a range for the port and available for this service

type.

(!=) – when the first and last value are the same, it

indicates all the ports except the port defined here; when

the first and last values are different, it indicates that all

the ports except the range defined here are available for

this service type.

(>) – the port number greater than this value is available.

(<) – the port number less than this value is available for

this profile.

Service Group/Object - Use the drop down list to choose

the one that you want.

Fragments Specify the action for fragmented packets. And it is used

for Data Filter only.

Don’t care -No action will be taken towards fragmented

packets.

Unfragmented -Apply the rule to unfragmented packets.

Fragmented - Apply the rule to fragmented packets.

Too Short - Apply the rule only to packets that are too short

to contain a complete header.

Filter Specifies the action to be taken when packets match the

rule.

Block Immediately - Packets matching the rule will be

dropped immediately.

Pass Immediately - Packets matching the rule will be

passed immediately.

Block If No Further Match - A packet matching the rule,

and that does not match further rules, will be dropped.

Pass If No Further Match - A packet matching the rule, and

that does not match further rules, will be passed through.

Branch to other Filter

Set

If the packet matches the filter rule, the next filter rule

will branch to the specified filter set. Select next filter rule

to branch from the drop-down menu. Be aware that the

router will apply the specified filter rule for ever and will

not return to previous filter rule any more.

Sessions Control The number typed here is the total sessions of the packets

that do not match the filter rule configured in this page.

The default setting is 60000.

MAC Bind IP

Strict –Make the MAC address and IP address settings

configured in IP Object for Source IP and Destination IP

are bound for applying such filter rule.

No-Strict - no limitation.

Quality of Service Choose one of the QoS rules to be applied as firewall rule.

For detailed information of setting QoS, please refer to the

Vigor2620 Series User’s Guide

250

related section later.

APP Enforcement Select an APP Enforcement profile for global IM/P2P

application blocking. If there is no profile for you to select,

please choose [Create New] from the drop down list in this

page to create a new profile. All the hosts in LAN must

follow the standard configured in the APP Enforcement

profile selected here. For detailed information, refer to

the section of APP Enforcement profile setup. For

troubleshooting needs, you can specify to record

information for IM/P2P by checking the Log box. It will be

sent to Syslog server. Please refer to section Syslog/Mail

Alert for more detailed information.

URL Content Filter Select one of the URL Content Filter profile settings

(created in CSM>> URL Content Filter) for applying with

this router. Please set at least one profile for choosing in

CSM>> URL Content Filter web page first. Or choose

[Create New] from the drop down list in this page to create

a new profile. For troubleshooting needs, you can specify to

record information for URL Content Filter by checking the

Log box. It will be sent to Syslog server. Please refer to

section Syslog/Mail Alert for more detailed information.

Web Content Filter Select one of the Web Content Filter profile settings

(created in CSM>> Web Content Filter) for applying with

this router. Please set at least one profile for anti-virus in

CSM>> Web Content Filter web page first. Or choose

[Create New] from the drop down list in this page to create

a new profile. For troubleshooting needs, you can specify to

record information for Web Content Filter by checking the

Log box. It will be sent to Syslog server. Please refer to

section Syslog/Mail Alert for more detailed information.

Advance Setting Click Edit to open the following window. However, it is

strongly recommended to use the default settings here.

Codepage - This function is used to compare the characters

among different languages. Choose correct codepage can

help the system obtaining correct ASCII after decoding data

from URL and enhance the correctness of URL Content

Filter. The default value for this setting is ANSI 1252 Latin I.

Vigor2620 Series User’s Guide

251

If you do not choose any codepage, no decoding job of URL

will be processed. Please use the drop-down list to choose

a codepage.

If you do not have any idea of choosing suitable codepage,

please open Syslog. From Codepage Information of Setup

dialog, you will see the recommended codepage listed on

the dialog box.

Window size – It determines the size of TCP protocol

(0~65535). The more the value is, the better the

performance will be. However, if the network is not stable,

small value will be proper.

Session timeout–Setting timeout for sessions can make the

best utilization of network resources. However, Queue

timeout is configured for TCP protocol only; session

timeout is configured for the data flow which matched with

the firewall rule.

DrayTek Banner – Please uncheck this box and the

following screen will not be shown for the unreachable web

page. The default setting is Enabled.

Strict Security Checking - All the packets, while

transmitting through Vigor router, will be filtered by

firewall settings configured by Vigor router. When the

resource is inadequate, the packets will be blocked if Strict

Security Checking is enabled. If Strict Security Checking is

not enabled, then the packets will pass through the router.

3. When you finish the configuration, please click OK to save and exit this page.

Vigor2620 Series User’s Guide

252

V

-

1

-

3

D

o

S

D

e

f

e

n

s

e

As a sub-functionality of IP Filter/Firewall, there are 15 types of detect/ defense function in

the DoS Defense setup. The DoS Defense functionality is disabled for default.

V

-

1

-

3

-

1

D

o

S

D

e

f

e

n

s

e

Click Firewall and click DoS Defense to open the setup page.

Available settings are explained as follows:

Item Description

Enable Dos Defense Check the box to activate the DoS Defense Functionality.

Select All - Click this button to select all the items listed

below.

White/Black List Option – Set white/black list of IPv4/IPv6

address.

Enable SYN flood defense Check the box to activate the SYN flood defense function.

Once detecting the Threshold of the TCP SYN packets from

the Internet has exceeded the defined value, the Vigor

router will start to randomly discard the subsequent TCP

SYN packets for a period defined in Timeout. The goal for

this is prevent the TCP SYN packets’ attempt to exhaust the

limited-resource of Vigor router.

By default, the threshold and timeout values are set to

2000 packets per second and 10 seconds, respectively. That

means, when 2000 packets per second received, they will

be regarded as “attack event” and the session will be

paused for 10 seconds.

Vigor2620 Series User’s Guide

253

Enable UDP flood defense

Check the box to activate the UDP flood defense function.

Once detecting the Threshold of the UDP packets from the

Internet has exceeded the defined value, the Vigor router

will start to randomly discard the subsequent UDP packets

for a period defined in Timeout.

The default setting for threshold and timeout are 2000

packets per second and 10 seconds, respectively. That

means, when 2000 packets per second received, they will

be regarded as “attack event” and the session will be

paused for 10 seconds.

Enable ICMP flood defense

Check the box to activate the ICMP flood defense function.

Similar to the UDP flood defense function, once if the

Threshold of ICMP packets from Internet has exceeded the

defined value, the router will discard the ICMP echo

requests coming from the Internet.

The default setting for threshold and timeout are 250

packets per second and 10 seconds, respectively. That

means, when 250 packets per second received, they will be

regarded as “attack event” and the session will be paused

for 10 seconds.

Enable Port Scan

detection

Port Scan attacks the Vigor router by sending lots of packets

to many ports in an attempt to find ignorant services would

respond. Check the box to activate the Port Scan

detection. Whenever detecting this malicious exploration

behavior by monitoring the port-scanning Threshold rate,

the Vigor router will send out a warning.

By default, the Vigor router sets the threshold as 2000

packets per second. That means, when 2000 packets per

second received, they will be regarded as “attack event”.

Block IP options Check the box to activate the Block IP options function.

The Vigor router will ignore any IP packets with IP option

field in the datagram header. The reason for limitation is IP

option appears to be a vulnerability of the security for the

LAN because it will carry significant information, such as

security, TCC (closed user group) parameters, a series of

Internet addresses, routing messages...etc. An

eavesdropper outside might learn the details of your

private networks.

Block Land Check the box to enforce the Vigor router to defense the

Land attacks. The Land attack combines the SYN attack

technology with IP spoofing. A Land attack occurs when an

attacker sends spoofed SYN packets with the identical

source and destination addresses, as well as the port

number to victims.

Block Smurf Check the box to activate the Block Smurf function. The

Vigor router will ignore any broadcasting ICMP echo

request.

Block trace route Check the box to enforce the Vigor router not to forward

any trace route packets.

Block SYN fragment Check the box to activate the Block SYN fragment function.

The Vigor router will drop any packets having SYN flag and

more fragment bit set.

Block Fraggle Attack Check the box to activate the Block fraggle Attack function.

Any broadcast UDP packets received from the Internet is

blocked.

Vigor2620 Series User’s Guide

254

Activating the DoS/DDoS defense functionality might block

some legal packets. For example, when you activate the

fraggle attack defense, all broadcast UDP packets coming

from the Internet are blocked. Therefore, the RIP packets

from the Internet might be dropped.

Block TCP flag scan Check the box to activate the Block TCP flag scan function.

Any TCP packet with anomaly flag setting is dropped. Those

scanning activities include no flag scan, FIN without ACK

scan, SYN FINscan, Xmas scan and full Xmas scan.

Block Tear Drop Check the box to activate the Block Tear Drop function.

Many machines may crash when receiving ICMP datagrams

(packets) that exceed the maximum length. To avoid this

type of attack, the Vigor router is designed to be capable of

discarding any fragmented ICMP packets with a length

greater than 1024 octets.

Block Ping of Death Check the box to activate the Block Ping of Death function.

This attack involves the perpetrator sending overlapping

packets to the target hosts so that those target hosts will

hang once they re-construct the packets. The Vigor routers

will block any packets realizing this attacking activity.

Block ICMP Fragment Check the box to activate the Block ICMP fragment

function. Any ICMP packets with more fragment bit set are

dropped.

Block Unassigned Numbers

Check the box to activate the Block Unknown Protocol

function. Individual IP packet has a protocol field in the

datagram header to indicate the protocol type running over

the upper layer. However, the protocol types greater than

100 are reserved and undefined at this time. Therefore, the

router should have ability to detect and reject this kind of

packets.

Warning Messages We provide Syslog function for user to retrieve message

from Vigor router. The user, as a Syslog Server, shall receive

the report sending from Vigor router which is a Syslog

Client.

All the warning messages related to DoS Defense will be

sent to user and user can review it through Syslog daemon.

Look for the keyword DoS in the message, followed by a

name to indicate what kind of attacks is detected.

Vigor2620 Series User’s Guide

255

After finishing all the settings here, please click OK to save the configuration.

V

-

1

-

3

-

2

S

p

o

f

i

n

g

D

e

f

e

n

s

e

Click the Spoofing Defense tab to open the setup page.

Vigor2620 Series User’s Guide

256

A

p

l

i

c

a

t

i

o

n

N

o

t

e

s

A

-

1

H

o

w

t

o

C

o

n

f

i

g

u

r

e

C

e

r

t

a

i

n

C

o

m

p

u

t

e

r

s

A

c

e

s

i

n

g

t

o

I

n

t

e

r

n

e

t

We can specify certain computers (e.g., 192.168.1.10 ~ 192.168.1.20) accessing to Internet

through Vigor router. Others (e.g., 192.168.1.31 and 192.168.1.32) outside the range can get

the source from LAN only.

The way we can use is to set two rules under Firewall. For Rule 1 of Set 2 under

Firewall>>Filter Setup is used as the default setting, we have to create a new rule starting

from Filter Rule 2 of Set 2.

1. Access into the web user interface of Vigor router.

2. Open Firewall>>Filter Setup. Click the Set 2 link, choose Advance Mode and choose the

Filter Rule 2 button.

Vigor2620 Series User’s Guide

257

3. Check the box of Check to enable the Filter Rule. Enter the comments (e.g., block_all).

Choose Block If No Further Match for the Filter setting. Then, click OK.

Info

In default, the router will check the packets starting with Set 2, Filter

Rule 2 to Filter Rule 7. If Block If No Further Match for is selected for

Filter, the firewall of the router would check the packets with the rules

starting from Rule 3 to Rule 7. The packets not matching with the rules

will be processed according to Rule 2.

4. Next, set another rule. Just open Firewall>>Filter Setup. Click the Set 2 link and

choose the Filter Rule 3 button.

5. Check the box of Check to enable the Filter Rule. Enter the comments (e.g., open_ip).

Click the Edit button for Source IP.

Vigor2620 Series User’s Guide

258

6. A dialog box will be popped up. Choose Range Address as Address Type by using the

drop down list. Type 192.168.1.10 in the field of Start IP, and type 192.168.1.20 in the

field of End IP. Then, click OK to save the settings. The computers within the range can

access into the Internet.

7. Now, check the content of Source IP is correct or not. The action for Filter shall be set

with Pass Immediately. Then, click OK to save the settings.

Vigor2620 Series User’s Guide

259

8. Both filter rules have been created. Click OK.

Now, all the settings are configured well. Only the computers with the IP addresses within

192.168.1.10 ~ 192.168.1.20 can access to Internet.

Vigor2620 Series User’s Guide

260

V

-

2

C

e

n

t

r

a

l

S

e

c

u

r

i

t

y

M

a

n

a

g

e

m

e

n

t

(

C

S

M

)

CSM is an abbreviation of Central Security Management which is used to control IM/P2P

usage, filter the web content and URL content to reach a goal of security management.

A

P

E

n

f

o

r

c

e

m

e

n

t

F

i

l

t

e

r

As the popularity of all kinds of instant messenger application arises, communication cannot

become much easier. Nevertheless, while some industry may leverage this as a great tool to

connect with their customers, some industry may take reserved attitude in order to reduce

employee misusage during office hour or prevent unknown security leak. It is similar situation

for corporation towards peer-to-peer applications since file-sharing can be convenient but

insecure at the same time. To address these needs, we provide CSM functionality.

U

R

L

C

o

n

t

e

n

t

F

i

l

t

e

r

To provide an appropriate cyberspace to users, Vigor router equips with URL Content Filter

not only to limit illegal traffic from/to the inappropriate web sites but also prohibit other web

feature where malicious code may conceal.

Once a user Enter or click on an URL with objectionable keywords, URL keyword blocking

facility will decline the HTTP request to that web page thus can limit user’s access to the

website. You may imagine URL Content Filter as a well-trained convenience-store clerk who

won’t sell adult magazines to teenagers. At office, URL Content Filter can also provide a

job-related only environment hence to increase the employee work efficiency. How can URL

Content Filter work better than traditional firewall in the field of filtering? Because it checks

the URL strings or some of HTTP data hiding in the payload of TCP packets while legacy

firewall inspects packets based on the fields of TCP/IP headers only.

On the other hand, Vigor router can prevent user from accidentally downloading malicious

codes from web pages. It’s very common that malicious codes conceal in the executable

objects, such as ActiveX, Java Applet, compressed files, and other executable files. Once

downloading these types of files from websites, you may risk bringing threat to your system.

For example, an ActiveX control object is usually used for providing interactive web feature. If

malicious code hides inside, it may occupy user’s system.

W

e

b

C

o

n

t

e

n

t

F

i

l

t

e

r

We all know that the content on the Internet just like other types of media may be

inappropriate sometimes. As a responsible parent or employer, you should protect those in

your trust against the hazards. With Web filtering service of the Vigor router, you can protect

your business from common primary threats, such as productivity, legal liability, network and

security threats. For parents, you can protect your children from viewing adult websites or

chat rooms.

Once you have activated your Web Filtering service in Vigor router and chosen the categories

of website you wish to restrict, each URL address requested (e.g.www.bbc.co.uk) will be

checked against our server database. This database is updated as frequent as daily by a global

team of Internet researchers. The server will look up the URL and return a category to your

router. Your Vigor router will then decide whether to allow access to this site according to the

categories you have selected. Please note that this action will not introduce any delay in your

Web surfing because each of multiple load balanced database servers can handle millions of

requests for categorization.

Info

The priority of URL Content Filter is higher than Web Content Filter.

Vigor2620 Series User’s Guide

261

W

e

b

U

s

e

r

I

n

t

e

r

f

a

c

e

V

-

2

-

1

A

P

E

n

f

o

r

c

e

m

e

n

t

P

r

o

f

i

l

e

You can define policy profiles for IM (Instant Messenger)/P2P (Peer to Peer)/Protocol/Misc

application. This page allows you to set 32 profiles for different requirements. The APP

Enforcement Profile will be applied in Default Rule of Firewall>>General Setup for filtering.

Available settings are explained as follows:

Item Description

Set to Factory Default Clear all profiles.

Profile Display the number of the profile which allows you to click to

set different policy.

Name Display the name of the APP Enforcement Profile.

Click the number under Index column for settings in detail.

Vigor2620 Series User’s Guide

262

Available settings are explained as follows:

Item Description

Profile Name Type a name for the CSM profile. The maximum length of the

name you can set is 15 characters.

Select All Click it to choose all of the items in this page.

Clear All Uncheck all the selected boxes.

Enable Check the box to select the APP to be blocked by Vigor

router.

The profiles configured here can be applied in the Firewall>>General Setup and

Firewall>>Filter Setup pages as the standard for the host(s) to follow.

Vigor2620 Series User’s Guide

263