Manuals / TRENDnet / Computer Equipment / Network Router

TRENDnet BRV204 manual Package Contents, Security Features, IPSec VPN Gateway Features

Models: BRV204

1 146

Download 146 pages 58.45 Kb

Page 7

Security Features

Introduction

Security Features

•Password - protected Configuration. Optional password protection is provided to prevent unauthorized users from modifying the configuration data and settings.

•NAT Protection. An intrinsic side effect of NAT (Network Address Translation) tech- nology is that by allowing all LAN users to share a single IP address, the location and even the existence of each PC is hidden. From the external viewpoint, there is no network, only a single device - the TW100-BRV204 .

•Stateful Inspection Firewall. All incoming data packets are monitored and all incom- ing server requests are filtered, thus protecting your network from malicious attacks from external sources.

•Protection against DoS attacks. DoS (Denial of Service) attacks can flood your Internet connection with invalid packets and connection requests, using so much band- width and so many resources that Internet access becomes unavailable. The TW100- BRV204 incorporates protection against DoS attacks.

•Rule-based Policy Firewall. To provide additional protection against malicious pack- ets, you can define your own firewall rules. This can also be used to control the Internet services available to LAN users.

IPSec VPN Gateway Features

•IPSec.. Support for IPSec standards, including IKE and certificates.

•10 Tunnels. Up to 10 VPN tunnels can be created.

•High performance. High performance encryption engine maintains high throughput even when using 3DES.

Microsoft VPN Gateway Support

•PPTP Server. The TW100-BRV204 emulates a Microsoft PPTP VPN Server, allowing clients to use the Microsoft VPN client provided in Windows.

•Windows Client Support. Remote users can use the Microsoft VPN client (VPN Adapter) provided in recent versions of Windows.

•Easy Setup. For both the Administrator and remote users, the Microsoft VPN is much easier to configure than IPSec VPN.

Package Contents

The following items should be included:

•The TW100-BRV204 Unit

•Power Adapter

•Quick Installation Guide

•CD-ROM containing the on-line manual.

If any of the above items are damaged or missing, please contact your dealer immediately.

3

Image 7

TRENDnet BRV204 manual Package Contents, Security Features, IPSec VPN Gateway Features, Microsoft VPN Gateway Support

Contents

Page Page CHAPTER 2 INSTALLATION Table of ContentsTW100-BRV204 Features Package ContentsCHAPTER 10 OTHER FEATURES & SETTINGS VPN ConfigurationServer Setup Windows Client SetupChapter TW100-BRV204 FeaturesInternet Access Features IntroductionConfiguration & Management LAN FeaturesAdvanced Internet Functions Microsoft VPN Gateway Support Package ContentsSecurity Features IPSec VPN Gateway FeaturesFigure 2 Front Panel Physical DetailsFront-mounted LEDs PowerTo Clear All Data and restore the factory default values Using the DMZ PortRear Panel Reset ButtonAdvantages of the DMZ Port This Chapter covers the physical installation of the TW100-BRV204 InstallationProcedure Requirements3. Connect WAN Cable 4. Power Up5. Check the LEDs Chapter SetupOverview This Chapter provides Setup details of the TW100-BRV204Preparation Configuration ProgramFigure 5 Password Dialog Using your Web BrowserIf you cant connect TW100-BRV204 User’s Guide Details Setup WizardCommon Connection Types TypeType Other Modems e.g. Broadband WirelessBig Pond Cable Australia SingTel RASNavigation & Data Input Home ScreenFigure 6 Home Screen TCP/IP LAN ScreenSave Cancel Figure 7 LAN ScreenTo Configure your PCs to use DHCP DHCPUsing the TW100-BRV204 s DHCP Server Using another DHCP ServerChapter PC ConfigurationTCP/IP Settings - Overview Windows ClientsFigure 8 Network Configuration Checking TCP/IP Settings - Windows 9x/MEUsing DHCP Using Specify an IP AddressFigure 11 DNS Tab Win 95/98 Figure 10 Gateway Tab Win 95/98TW100-BRV204 User Guide Figure 13 Windows NT4.0 - IP Address Checking TCP/IP Settings - Windows NT4.0PC Configuration Figure 12 Windows NT4.0 - TCP/IPSpecify an IP Address Obtain an IP address from a DHCP ServerFigure 14 - Windows NT4.0 - Add Gateway Figure 15 Windows NT4.0 - DNS PC ConfigurationFigure 17 TCP/IP Properties Win Checking TCP/IP Settings - WindowsFigure 16 Network Configuration Win 1. Select Control Panel - Network and Dial-up ConnectionUsing a fixed IP Address Use the following IP Address Using DHCPFigure 18 Network Configuration Windows XP Checking TCP/IP Settings - Windows XP1. Select Control Panel - Network Connection Using a fixed IP Address Use the following IP Address Using DHCPFigure 19 TCP/IP Properties Windows XP 2. Select Set up or change your Internet Connection Internet AccessAccessing AOL 1. Select Start Menu - Settings - Control Panel - Internet OptionsEnsure you are logged in as root before attempting any changes Macintosh ClientsLinux Clients Other Unix SystemsChapter Operation and StatusOperation Status ScreenInternet Connection InternetConnection Method Broadband ModemPhysical Address Connection Status - PPPoEFigure 21 PPPoE Status Screen ConnectionClear Log ButtonsConnect DisconnectPhysical Address Connection Status - PPTPFigure 22 PPTP Status Screen ConnectionFigure 23 Telstra Big Pond Status Screen Connection Status - Telstra Big PondClear Log RefreshConnection Log Connection Details - SingTel RASDefault Gateway Connection LogButtons DNS IP Address DHCP ClientRelease/Renew Button will display EITHER Release OR Renew Refresh Internet Connection Details - Fixed/Dynamic IP AddressPhysical Address IP Address Network Mask Default Gateway Figure 25 Connection Details - Fixed/Dynamic IP AddressRefresh Update the data shown on screenOperation and Status Overview Internet FeaturesThe following advanced features are provided WAN Port Configuration ChapterHostname WAN Port ConfigurationFigure 26 WAN Port Configuration Screen IdentificationLogin Enable NATDisable NAT Disabling NAT will disable Internet access, unless all PCs haveCommunication Applications Advanced InternetCommunication Applications Figure 27 Internet ScreenCheckbox Special ApplicationsUse this to Enable or Disable this Special Application as required Figure 28 Special Applications ScreenOutgoing Ports Multi-DMZUsing a Special Application Incoming PortsFilter Strings URL FilterURL Filter Screen Figure 29 URL Filter ScreenDDNS Service Dynamic DNS Domain Name ServerDynamic DNS Screen The Service works as followsDDNS Data DDNS Service User Name Password/Key Domain Name DDNS StatusIP Address seen by Internet Users Virtual ServersFigure 31 Virtual Servers Enable Connecting to the Virtual ServersVirtual Servers Screen Defining your own Virtual ServersIP Address OptionsBackup DNS Figure 33 Options ScreenChapter Security ConfigurationAdmin Login Figure 34 Admin Login ScreenSecurity Configuration Figure 35 Password DialogFigure 36 Access Control Screen Access ControlAccess Control Screen If required, you can also define your own ServicesMembers Button Internet AccessServices CancelPCs deleted from any other Group will be added to the Default group Access Control LogGroup Members Screen PCs not assigned to any group will be in the Default groupFigure 38 Firewall Rules Screen Firewall RulesFirewall Rules Screen This feature is for advanced administrators onlyData Add Edit Move Delete View Log System Rules Type Define Firewall RuleFigure 39 Define Firewall Rule NameDest IP ServicesAction Figure 40 Logs Screen LogsEnable Logs Data - Logs ScreenConnections to the Web - based interface of this Router - This Enable SyslogSystem Log Router operations start up, get time etc - This option will logSend E-Mail alert E-mailFigure 41 E-Mail Screen E-Mail Alertsmail default value isSubject Enter the text string to be shown in the Subject field for the EFigure 42 Security Options Screen Security OptionsEnable DoS Firewall Threshold Data - Security Options ScreenBlock non- standard packets OptionsRespond to ICMP ping Allow VPN pass- through Drop fragmented IP packets Block TCP Flood Block UDP FloodEnter the finish time using a 24 hr clock SchedulingDefine Schedule Screen Enter the start using a 24 hr clockAvailable Services ServicesFigure 44 Services Screen Available ServicesThe TW100-BRV204 always uses Tunnel Mode VPN IPSecIPSec The TW100-BRV204 does NOT support Transport Modeaddress VPN ConfigurationPolicies VPN EndpointFigure 45 VPN Pass-through Common VPN SituationsVPN Pass-through Client PC to VPN GatewayFigure 47 Connecting 2 VPN Gateways Connecting 2 LANs via VPNFigure 48 VPN Policies Screen VPN ConfigurationVPN Policies Screen EnableCopy Adding a New PolicyEnable/Disable MoveKeys General SettingsPolicy Name Enable Policy Allow NetBIOS traffic Remote VPN Endpoint Figure 50 VPN Wizard - General ScreenLocal IP addresses Figure 51 VPN Wizard - Traffic Selector ScreenType Manually assigned Keys Remote IP addressesType Figure 52 VPN Wizard - Manual Key Exchange ScreenEncryption Algorithm ESP Authenticationtion is enabled ESP EncryptionFigure 53 VPN Wizard - IKE Phase 1 Screen IKE PhaseIKE Phase 1 IKE SA Encryption AuthenticationAuthentication AlgorithmESP Authentication Figure 54 VPN Wizard - IKE Phase 2 ScreenIKE Phase 2 IPsec SA AH AuthenticationTW100-BRV204 User Guide For IKE, configuration is now completeClick Next to view the final screen Figure 55 VPN Wizard - Final ScreenSetting Example 1 Connecting 2 TW100-BRV204 sVPN Examples Figure 56 Connecting 2 TW100-BRV204 sIPSec SA Parameters Value Example 2 Windows 2000/XP Client to LANSetting Figure 57 Windows 2000/XP Client to TW100-BRV204IPSec SA Parameters Windows Client ConfigurationFigure 58 Windows 2000/XP - Local Security Settings Deselect Activate the default response rule. Click NextFigure 60 IP Filter List Figure 59 Windows 2000/XP - Policy Properties8. Enter the Source IP address and the Destination IP address Figure 61 Filter Properties AddressingFigure 62 New Rule Properties IP Filter List Microsoft VPN Figure 63 New Rule Properties Filter ActionFigure 64 Require Security Properties 12. Select Negotiate security this selects IKE, then click AddFigure 66 Require Security Properties VPN SettingWindows Setting Figure 65 Modify Security MethodFigure 68 Authentication Method Figure 67 Tunnel SettingFigure 70 Windows 2000/XP Client to TW100-BRV204 Figure 69 Windows 2000/XP Client to TW100-BRV204Microsoft VPN Figure 71 Filter Properties Addressing22. Click OK to save your changes, then Close Figure 72 Filter ListFigure 74 Security Methods Figure 73 Filter ActionFigure 75 Modify Security Method Figure 76 Tunnel SettingTW100-BRV204 User Guide Figure 77 Authentication MethodFigure 78 DUT to Win2K Properties 31. Select the General tab33. Click the Methods button to see the screen below Figure 80 Key Exchange SettingsFigure 79 Properties - General Tab 32. Click the Advanced button to see the screen belowFigure 83 Windows 2000/XP Client to TW100-BRV204 Configuration is now completeFigure 81 Key Exchange Security Methods Figure 82 IKE Security AlgorithmsSingle Client Example 3 Windows 2000 Server to VPN GatewaySetting Figure 84 TW100-BRV204 to Windows 2000 ServerFigure 85 Windows 2000 Server - Addressing Windows 2000 Server ConfigurationIssuer Name CertificatesTrusted Certificates Requesting a Trusted CertificateFigure 88 Self Certificates Screen Self CertificatesIssuer Name Figure 87 Add Trusted CertificateRequest List Requesting a Self CertificateDelete button Self Certificate RequestsSignature Algorithm NameSubject Name Hash AlgorithmTo add a New CRL CRLsFigure 91 Upload Self Certificate Figure 94 VPN Status Screen StatusFigure 92 Certificate Revocation Lists Figure 93 Upload CRLVPN Endpoint VPN StatusPolicy Name SA TypeOverview Server SetupMicrosoft VPN ChapterPPTP Server Client DatabaseEnable AuthenticationUpdate Selected Login NameLogin Password Verify PasswordServer Status This indicates whether or not the PPTP VPN Server is enabledStatus Screen Figure 97 Microsoft VPN Status Screen2. Select Make New Connection Windows Client SetupWindows 98/ME 1. Click Start - Settings - Dial-up NetworkingTo establish a connection 2. Select Start - Settings - Dial-up NetworkingWindows ME VPN Dialing Properties Figure 100 Windows 2000 Network Connection WindowsFigure 101 Windows 2000 Public Network Microsoft VPN Figure 102 Windows 2000 VPN HostClick Next to continue Figure 103 Windows 2000 Connection AvailabilityFigure 104 Windows 2000 Finish Wizard Figure 105 Windows XP Network Connection Type Windows XPFigure 106 Windows XP Network Connection Figure 109 Windows XP VPN Server Figure 107 Windows XP Connection Name4. Enter a suitable name for this connection. Click Next to continue Figure 108 Windows XP Public NetworkTo establish a connection Changing the connection settingsFigure 110 Windows XP Connection Availability Remote Admin Other Features & SettingsConfig File DiagnosticsData - Config File Screen Config FileFigure 111 Config File Screen IP Address Network DiagnosticsFigure 112 Network Diagnostics Screen PingPC Database Screen PC DatabaseFigure 113 PC Database IP Address AdministrationKnown PCs NamePC Properties PC Database AdminFigure 114 PC Database Admin Known PCsEntry Update SelectedButtons Add as NewEnable Remote AdministrationFigure 115 Remote Administration Screen SettingsAllow Remote AccessTo connect from a remote PC via the Internet Port NumberOpen Routing and Remote Access RoutingOverview Routing ScreenStatic Routing Enable RIPData - Routing Screen Figure 116 Routing ScreenButtons Configuring Other Routers on your LANSave Add Update Delete Clear Form Generate Report PropertiesFigure 117 Routing Example Static Routing - ExampleOther Routers on the Local LAN For the TW100-BRV204 s Routing TableFor Router Bs Default Route For Router As Default RouteOther Features and Settings Password Upgrade FirmwareFigure 118 Upgrade Firmware Screen Upgrade FirmwareFigure 119 UPnP Screen UPnPEnable UPnP Services Allow Configu ration Allow Internet access to be disabledAppendix A TroubleshootingGeneral Problems Internet AccessIt is a security risk, since the firewall is disabled TW100-BRV204 Appendix B SpecificationsFCC Statement FCC Radiation Exposure Statement CE Marking WarningTW100-BRV204 - 5 Years Warranty Limited WarrantyTRENDware Technical Support Tel +1-310-891-1100 Fax +1-310-8911111 Technical SupportE-mail support@trendware.com TW100-BRV204 User Guide