Manuals / TRENDnet / Computer Equipment / Network Router

TRENDnet BRV204 manual Common VPN Situations, VPN Pass-through, Client PC to VPN Gateway

Models: BRV204

1 146

Download 146 pages 58.45 Kb

Page 75

Common VPN Situations

Microsoft VPN

Common VPN Situations

VPN Pass-through

Figure 45: VPN Pass-through

Here, a PC on the LAN behind the Router/Gateway is using VPN software, but the Router/Gateway is NOT acting as a VPN endpoint. It is only allowing the VPN connection.

•The PC software can use any VPN protocol supported by the remote VPN.

•The remote VPN Server must support client PCs which are behind a NAT router, and so have an IP address which is not valid on the Internet.

•The Router/Gateway requires no VPN configuration, since it is not acting as a VPN endpoint.

Client PC to VPN Gateway

Figure 46: Client PC to VPN Server

In this situation, the PC must run appropriate VPN client software in order to connect, via the Internet, to the TW100-BRV204 . Once connected, the client PC has the same access to LAN resources as PCs on the local LAN (unless restricted by the network administrator).

•IPsec is not the only protocol which can be used in this situation, but the TW100-BRV204 supports IPsec ONLY.

•Windows 2000 and Windows XP include a suitable IPsec VPN client program. Configura- tion of this client program for use with the TW100-BRV204 is covered later in this document.

71

Image 75

TRENDnet BRV204 manual Common VPN Situations, VPN Pass-through, Client PC to VPN Gateway, Client PC to VPN Server

Contents

Page Page CHAPTER 2 INSTALLATION Table of ContentsTW100-BRV204 Features Package ContentsCHAPTER 10 OTHER FEATURES & SETTINGS VPN ConfigurationServer Setup Windows Client SetupChapter TW100-BRV204 FeaturesInternet Access Features IntroductionLAN Features Configuration & ManagementAdvanced Internet Functions Microsoft VPN Gateway Support Package ContentsSecurity Features IPSec VPN Gateway FeaturesFigure 2 Front Panel Physical DetailsFront-mounted LEDs PowerTo Clear All Data and restore the factory default values Using the DMZ PortRear Panel Reset ButtonAdvantages of the DMZ Port This Chapter covers the physical installation of the TW100-BRV204 InstallationProcedure Requirements4. Power Up 3. Connect WAN Cable5. Check the LEDs Chapter SetupOverview This Chapter provides Setup details of the TW100-BRV204Preparation Configuration ProgramUsing your Web Browser Figure 5 Password DialogIf you cant connect TW100-BRV204 User’s Guide Details Setup WizardCommon Connection Types TypeType Other Modems e.g. Broadband WirelessBig Pond Cable Australia SingTel RASHome Screen Navigation & Data InputFigure 6 Home Screen TCP/IP LAN ScreenSave Cancel Figure 7 LAN ScreenTo Configure your PCs to use DHCP DHCPUsing the TW100-BRV204 s DHCP Server Using another DHCP ServerChapter PC ConfigurationTCP/IP Settings - Overview Windows ClientsFigure 8 Network Configuration Checking TCP/IP Settings - Windows 9x/MEUsing DHCP Using Specify an IP AddressFigure 10 Gateway Tab Win 95/98 Figure 11 DNS Tab Win 95/98TW100-BRV204 User Guide Figure 13 Windows NT4.0 - IP Address Checking TCP/IP Settings - Windows NT4.0PC Configuration Figure 12 Windows NT4.0 - TCP/IPObtain an IP address from a DHCP Server Specify an IP AddressFigure 14 - Windows NT4.0 - Add Gateway Figure 15 Windows NT4.0 - DNS PC ConfigurationFigure 17 TCP/IP Properties Win Checking TCP/IP Settings - WindowsFigure 16 Network Configuration Win 1. Select Control Panel - Network and Dial-up ConnectionUsing a fixed IP Address Use the following IP Address Using DHCPChecking TCP/IP Settings - Windows XP Figure 18 Network Configuration Windows XP1. Select Control Panel - Network Connection Using DHCP Using a fixed IP Address Use the following IP AddressFigure 19 TCP/IP Properties Windows XP 2. Select Set up or change your Internet Connection Internet AccessAccessing AOL 1. Select Start Menu - Settings - Control Panel - Internet OptionsEnsure you are logged in as root before attempting any changes Macintosh ClientsLinux Clients Other Unix SystemsChapter Operation and StatusOperation Status ScreenInternet Connection InternetConnection Method Broadband ModemPhysical Address Connection Status - PPPoEFigure 21 PPPoE Status Screen ConnectionClear Log ButtonsConnect DisconnectPhysical Address Connection Status - PPTPFigure 22 PPTP Status Screen ConnectionFigure 23 Telstra Big Pond Status Screen Connection Status - Telstra Big PondClear Log RefreshConnection Log Connection Details - SingTel RASDefault Gateway Connection LogDNS IP Address DHCP Client ButtonsRelease/Renew Button will display EITHER Release OR Renew Refresh Internet Connection Details - Fixed/Dynamic IP AddressPhysical Address IP Address Network Mask Default Gateway Figure 25 Connection Details - Fixed/Dynamic IP AddressUpdate the data shown on screen RefreshOperation and Status Overview Internet FeaturesThe following advanced features are provided WAN Port Configuration ChapterHostname WAN Port ConfigurationFigure 26 WAN Port Configuration Screen IdentificationLogin Enable NATDisable NAT Disabling NAT will disable Internet access, unless all PCs haveCommunication Applications Advanced InternetCommunication Applications Figure 27 Internet ScreenCheckbox Special ApplicationsUse this to Enable or Disable this Special Application as required Figure 28 Special Applications ScreenOutgoing Ports Multi-DMZUsing a Special Application Incoming PortsFilter Strings URL FilterURL Filter Screen Figure 29 URL Filter ScreenDDNS Service Dynamic DNS Domain Name ServerDynamic DNS Screen The Service works as followsDDNS Data DDNS Service User Name Password/Key Domain Name DDNS StatusVirtual Servers IP Address seen by Internet UsersFigure 31 Virtual Servers Enable Connecting to the Virtual ServersVirtual Servers Screen Defining your own Virtual ServersIP Address OptionsBackup DNS Figure 33 Options ScreenChapter Security ConfigurationAdmin Login Figure 34 Admin Login ScreenSecurity Configuration Figure 35 Password DialogFigure 36 Access Control Screen Access ControlAccess Control Screen If required, you can also define your own ServicesMembers Button Internet AccessServices CancelPCs deleted from any other Group will be added to the Default group Access Control LogGroup Members Screen PCs not assigned to any group will be in the Default groupFigure 38 Firewall Rules Screen Firewall RulesFirewall Rules Screen This feature is for advanced administrators onlyData Add Edit Move Delete View Log System Rules Type Define Firewall RuleFigure 39 Define Firewall Rule NameServices Dest IPAction Figure 40 Logs Screen LogsEnable Logs Data - Logs ScreenConnections to the Web - based interface of this Router - This Enable SyslogSystem Log Router operations start up, get time etc - This option will logSend E-Mail alert E-mailFigure 41 E-Mail Screen E-Mail Alertsmail default value isSubject Enter the text string to be shown in the Subject field for the EFigure 42 Security Options Screen Security OptionsEnable DoS Firewall Threshold Data - Security Options ScreenBlock non- standard packets OptionsRespond to ICMP ping Allow VPN pass- through Drop fragmented IP packets Block TCP Flood Block UDP FloodEnter the finish time using a 24 hr clock SchedulingDefine Schedule Screen Enter the start using a 24 hr clockAvailable Services ServicesFigure 44 Services Screen Available ServicesOverview VPN IPSecIPSec Chapteraddress VPN ConfigurationPolicies VPN EndpointFigure 45 VPN Pass-through Common VPN SituationsVPN Pass-through Client PC to VPN GatewayFigure 47 Connecting 2 VPN Gateways Connecting 2 LANs via VPNFigure 48 VPN Policies Screen VPN ConfigurationVPN Policies Screen EnableCopy Adding a New PolicyEnable/Disable MoveKeys General SettingsPolicy Name Enable Policy Allow NetBIOS traffic Remote VPN Endpoint Figure 50 VPN Wizard - General ScreenFigure 51 VPN Wizard - Traffic Selector Screen Local IP addressesType Manually assigned Keys Remote IP addressesType Figure 52 VPN Wizard - Manual Key Exchange ScreenEncryption Algorithm ESP Authenticationtion is enabled ESP EncryptionIKE Phase Figure 53 VPN Wizard - IKE Phase 1 ScreenIKE Phase 1 IKE SA Encryption AuthenticationAuthentication AlgorithmESP Authentication Figure 54 VPN Wizard - IKE Phase 2 ScreenIKE Phase 2 IPsec SA AH AuthenticationTW100-BRV204 User Guide For IKE, configuration is now completeClick Next to view the final screen Figure 55 VPN Wizard - Final ScreenSetting Example 1 Connecting 2 TW100-BRV204 sVPN Examples Figure 56 Connecting 2 TW100-BRV204 sIPSec SA Parameters Value Example 2 Windows 2000/XP Client to LANSetting Figure 57 Windows 2000/XP Client to TW100-BRV204IPSec SA Parameters Windows Client ConfigurationFigure 58 Windows 2000/XP - Local Security Settings Deselect Activate the default response rule. Click NextFigure 60 IP Filter List Figure 59 Windows 2000/XP - Policy PropertiesFigure 61 Filter Properties Addressing 8. Enter the Source IP address and the Destination IP addressFigure 62 New Rule Properties IP Filter List Microsoft VPN Figure 63 New Rule Properties Filter ActionFigure 64 Require Security Properties 12. Select Negotiate security this selects IKE, then click AddFigure 66 Require Security Properties VPN SettingWindows Setting Figure 65 Modify Security MethodFigure 68 Authentication Method Figure 67 Tunnel SettingFigure 70 Windows 2000/XP Client to TW100-BRV204 Figure 69 Windows 2000/XP Client to TW100-BRV204Microsoft VPN Figure 71 Filter Properties Addressing22. Click OK to save your changes, then Close Figure 72 Filter ListFigure 74 Security Methods Figure 73 Filter ActionFigure 75 Modify Security Method Figure 76 Tunnel SettingTW100-BRV204 User Guide Figure 77 Authentication MethodFigure 78 DUT to Win2K Properties 31. Select the General tab33. Click the Methods button to see the screen below Figure 80 Key Exchange SettingsFigure 79 Properties - General Tab 32. Click the Advanced button to see the screen belowFigure 83 Windows 2000/XP Client to TW100-BRV204 Configuration is now completeFigure 81 Key Exchange Security Methods Figure 82 IKE Security AlgorithmsSingle Client Example 3 Windows 2000 Server to VPN GatewaySetting Figure 84 TW100-BRV204 to Windows 2000 ServerFigure 85 Windows 2000 Server - Addressing Windows 2000 Server ConfigurationIssuer Name CertificatesTrusted Certificates Requesting a Trusted CertificateFigure 88 Self Certificates Screen Self CertificatesIssuer Name Figure 87 Add Trusted CertificateRequest List Requesting a Self CertificateDelete button Self Certificate RequestsSignature Algorithm NameSubject Name Hash AlgorithmCRLs To add a New CRLFigure 91 Upload Self Certificate Figure 94 VPN Status Screen StatusFigure 92 Certificate Revocation Lists Figure 93 Upload CRLVPN Endpoint VPN StatusPolicy Name SA TypeOverview Server SetupMicrosoft VPN ChapterPPTP Server Client DatabaseEnable AuthenticationUpdate Selected Login NameLogin Password Verify PasswordServer Status This indicates whether or not the PPTP VPN Server is enabledStatus Screen Figure 97 Microsoft VPN Status Screen2. Select Make New Connection Windows Client SetupWindows 98/ME 1. Click Start - Settings - Dial-up Networking2. Select Start - Settings - Dial-up Networking To establish a connectionWindows ME VPN Dialing Properties Windows Figure 100 Windows 2000 Network ConnectionFigure 101 Windows 2000 Public Network Microsoft VPN Figure 102 Windows 2000 VPN HostClick Next to continue Figure 103 Windows 2000 Connection AvailabilityFigure 104 Windows 2000 Finish Wizard Windows XP Figure 105 Windows XP Network Connection TypeFigure 106 Windows XP Network Connection Figure 109 Windows XP VPN Server Figure 107 Windows XP Connection Name4. Enter a suitable name for this connection. Click Next to continue Figure 108 Windows XP Public NetworkChanging the connection settings To establish a connectionFigure 110 Windows XP Connection Availability Remote Admin Other Features & SettingsConfig File DiagnosticsConfig File Data - Config File ScreenFigure 111 Config File Screen IP Address Network DiagnosticsFigure 112 Network Diagnostics Screen PingPC Database PC Database ScreenFigure 113 PC Database IP Address AdministrationKnown PCs NamePC Properties PC Database AdminFigure 114 PC Database Admin Known PCsEntry Update SelectedButtons Add as NewEnable Remote AdministrationFigure 115 Remote Administration Screen SettingsAllow Remote AccessTo connect from a remote PC via the Internet Port NumberOpen Routing and Remote Access RoutingOverview Routing ScreenStatic Routing Enable RIPData - Routing Screen Figure 116 Routing ScreenButtons Configuring Other Routers on your LANSave Add Update Delete Clear Form Generate Report PropertiesFigure 117 Routing Example Static Routing - ExampleOther Routers on the Local LAN For the TW100-BRV204 s Routing TableFor Router As Default Route For Router Bs Default RouteOther Features and Settings Password Upgrade FirmwareFigure 118 Upgrade Firmware Screen Upgrade FirmwareFigure 119 UPnP Screen UPnPEnable UPnP Services Allow Configu ration Allow Internet access to be disabledAppendix A TroubleshootingGeneral Problems Internet AccessIt is a security risk, since the firewall is disabled Appendix B Specifications TW100-BRV204FCC Statement FCC Radiation Exposure Statement CE Marking WarningTW100-BRV204 - 5 Years Warranty Limited WarrantyTechnical Support TRENDware Technical Support Tel +1-310-891-1100 Fax +1-310-8911111E-mail support@trendware.com TW100-BRV204 User Guide