Manuals / TRENDnet / Computer Equipment / Network Router

TRENDnet BRV204 manual IPSec SA Parameters

Models: BRV204

1 146

Page 88

TW100-BRV204 User Guide

IKE Authentication	Pre-shared Key	Pre-shared Key	Certificates are not widely
method			used.
Pre-shared Key	Xxxxxxxxxx	Xxxxxxxxxx	Must match
IKE Authentication	MD5	MD5	Must match
algorithm
IKE Encryption	DES	DES	Must match
IKE Exchange	Main Mode	Main Mode	Must match
mode
DH Group	Group 1 (768 bit)	Group 1 (768 bit)	Must match
IKE SA Life time	28800	28800	Does not have to match.
			Shorter period will be
			used.
IKE PFS	Disable	Disable	Must match
IPSec SA Parameters
IPSec SA Life time	28800	28800	Does not have to match.
			Shorter period will be
			used.
IPSec PFS	Disabled	Disabled	Must match
AH authentication	Disabled	Disabled	AH is rarely used
ESP authentication	Enable/MD5	Enable/MD5	Must match
ESP encryption	Enable/DES	Enable/DES	Must match

Page 88

Image 88

TRENDnet BRV204 manual IPSec SA Parameters

Contents

Page Page Table of Contents TW100-BRV204 FeaturesPackage Contents CHAPTER 2 INSTALLATIONVPN Configuration Server SetupWindows Client Setup CHAPTER 10 OTHER FEATURES & SETTINGSTW100-BRV204 Features Internet Access FeaturesIntroduction ChapterConfiguration & Management LAN FeaturesAdvanced Internet Functions Package Contents Security FeaturesIPSec VPN Gateway Features Microsoft VPN Gateway SupportPhysical Details Front-mounted LEDsPower Figure 2 Front PanelUsing the DMZ Port Rear PanelReset Button To Clear All Data and restore the factory default valuesAdvantages of the DMZ Port Installation ProcedureRequirements This Chapter covers the physical installation of the TW100-BRV2043. Connect WAN Cable 4. Power Up5. Check the LEDs Setup OverviewThis Chapter provides Setup details of the TW100-BRV204 ChapterConfiguration Program PreparationFigure 5 Password Dialog Using your Web BrowserIf you cant connect TW100-BRV204 User’s Guide Setup Wizard Common Connection TypesType DetailsOther Modems e.g. Broadband Wireless Big Pond Cable AustraliaSingTel RAS TypeNavigation & Data Input Home ScreenFigure 6 Home Screen LAN Screen Save CancelFigure 7 LAN Screen TCP/IPDHCP Using the TW100-BRV204 s DHCP ServerUsing another DHCP Server To Configure your PCs to use DHCPPC Configuration TCP/IP Settings - OverviewWindows Clients ChapterChecking TCP/IP Settings - Windows 9x/ME Using DHCPUsing Specify an IP Address Figure 8 Network ConfigurationFigure 11 DNS Tab Win 95/98 Figure 10 Gateway Tab Win 95/98TW100-BRV204 User Guide Checking TCP/IP Settings - Windows NT4.0 PC ConfigurationFigure 12 Windows NT4.0 - TCP/IP Figure 13 Windows NT4.0 - IP AddressSpecify an IP Address Obtain an IP address from a DHCP ServerFigure 14 - Windows NT4.0 - Add Gateway PC Configuration Figure 15 Windows NT4.0 - DNSChecking TCP/IP Settings - Windows Figure 16 Network Configuration Win1. Select Control Panel - Network and Dial-up Connection Figure 17 TCP/IP Properties WinUsing DHCP Using a fixed IP Address Use the following IP AddressFigure 18 Network Configuration Windows XP Checking TCP/IP Settings - Windows XP1. Select Control Panel - Network Connection Using a fixed IP Address Use the following IP Address Using DHCPFigure 19 TCP/IP Properties Windows XP Internet Access Accessing AOL1. Select Start Menu - Settings - Control Panel - Internet Options 2. Select Set up or change your Internet ConnectionMacintosh Clients Linux ClientsOther Unix Systems Ensure you are logged in as root before attempting any changesOperation and Status OperationStatus Screen ChapterInternet Connection MethodBroadband Modem Internet ConnectionConnection Status - PPPoE Figure 21 PPPoE Status ScreenConnection Physical AddressButtons ConnectDisconnect Clear LogConnection Status - PPTP Figure 22 PPTP Status ScreenConnection Physical AddressConnection Status - Telstra Big Pond Clear LogRefresh Figure 23 Telstra Big Pond Status ScreenConnection Details - SingTel RAS Default GatewayConnection Log Connection LogButtons DNS IP Address DHCP ClientRelease/Renew Button will display EITHER Release OR Renew Refresh Connection Details - Fixed/Dynamic IP Address Physical Address IP Address Network Mask Default GatewayFigure 25 Connection Details - Fixed/Dynamic IP Address InternetRefresh Update the data shown on screenOperation and Status Internet Features The following advanced features are provided WAN Port ConfigurationChapter OverviewWAN Port Configuration Figure 26 WAN Port Configuration ScreenIdentification HostnameEnable NAT Disable NATDisabling NAT will disable Internet access, unless all PCs have LoginAdvanced Internet Communication ApplicationsFigure 27 Internet Screen Communication ApplicationsSpecial Applications Use this to Enable or Disable this Special Application as requiredFigure 28 Special Applications Screen CheckboxMulti-DMZ Using a Special ApplicationIncoming Ports Outgoing PortsURL Filter URL Filter ScreenFigure 29 URL Filter Screen Filter StringsDynamic DNS Domain Name Server Dynamic DNS ScreenThe Service works as follows DDNS ServiceDDNS Service User Name Password/Key Domain Name DDNS Status DDNS DataIP Address seen by Internet Users Virtual ServersFigure 31 Virtual Servers Connecting to the Virtual Servers Virtual Servers ScreenDefining your own Virtual Servers EnableOptions Backup DNSFigure 33 Options Screen IP AddressSecurity Configuration Admin LoginFigure 34 Admin Login Screen ChapterFigure 35 Password Dialog Security ConfigurationAccess Control Access Control ScreenIf required, you can also define your own Services Figure 36 Access Control ScreenInternet Access ServicesCancel Members ButtonAccess Control Log Group Members ScreenPCs not assigned to any group will be in the Default group PCs deleted from any other Group will be added to the Default groupFirewall Rules Firewall Rules ScreenThis feature is for advanced administrators only Figure 38 Firewall Rules ScreenData Add Edit Move Delete View Log System Rules Define Firewall Rule Figure 39 Define Firewall RuleName TypeDest IP ServicesAction Logs Enable LogsData - Logs Screen Figure 40 Logs ScreenEnable Syslog System LogRouter operations start up, get time etc - This option will log Connections to the Web - based interface of this Router - ThisE-mail Figure 41 E-Mail ScreenE-Mail Alerts Send E-Mail alertdefault value is SubjectEnter the text string to be shown in the Subject field for the E mailSecurity Options Enable DoS Firewall ThresholdData - Security Options Screen Figure 42 Security Options ScreenOptions Respond to ICMP ping Allow VPN pass- throughDrop fragmented IP packets Block TCP Flood Block UDP Flood Block non- standard packetsScheduling Define Schedule ScreenEnter the start using a 24 hr clock Enter the finish time using a 24 hr clockServices Figure 44 Services ScreenAvailable Services Available ServicesVPN IPSec IPSecChapter OverviewVPN Configuration PoliciesVPN Endpoint addressCommon VPN Situations VPN Pass-throughClient PC to VPN Gateway Figure 45 VPN Pass-throughConnecting 2 LANs via VPN Figure 47 Connecting 2 VPN GatewaysVPN Configuration VPN Policies ScreenEnable Figure 48 VPN Policies ScreenAdding a New Policy Enable/DisableMove CopyGeneral Settings Policy Name Enable Policy Allow NetBIOS traffic Remote VPN EndpointFigure 50 VPN Wizard - General Screen KeysLocal IP addresses Figure 51 VPN Wizard - Traffic Selector ScreenType Remote IP addresses TypeFigure 52 VPN Wizard - Manual Key Exchange Screen Manually assigned KeysESP Authentication tion is enabledESP Encryption Encryption AlgorithmFigure 53 VPN Wizard - IKE Phase 1 Screen IKE PhaseIKE Phase 1 IKE SA Authentication AuthenticationAlgorithm EncryptionFigure 54 VPN Wizard - IKE Phase 2 Screen IKE Phase 2 IPsec SAAH Authentication ESP AuthenticationFor IKE, configuration is now complete Click Next to view the final screenFigure 55 VPN Wizard - Final Screen TW100-BRV204 User GuideExample 1 Connecting 2 TW100-BRV204 s VPN ExamplesFigure 56 Connecting 2 TW100-BRV204 s SettingIPSec SA Parameters Example 2 Windows 2000/XP Client to LAN SettingFigure 57 Windows 2000/XP Client to TW100-BRV204 ValueWindows Client Configuration Figure 58 Windows 2000/XP - Local Security SettingsDeselect Activate the default response rule. Click Next IPSec SA ParametersFigure 59 Windows 2000/XP - Policy Properties Figure 60 IP Filter List8. Enter the Source IP address and the Destination IP address Figure 61 Filter Properties AddressingFigure 62 New Rule Properties IP Filter List Figure 63 New Rule Properties Filter Action Figure 64 Require Security Properties12. Select Negotiate security this selects IKE, then click Add Microsoft VPNVPN Setting Windows SettingFigure 65 Modify Security Method Figure 66 Require Security PropertiesFigure 67 Tunnel Setting Figure 68 Authentication MethodFigure 69 Windows 2000/XP Client to TW100-BRV204 Figure 70 Windows 2000/XP Client to TW100-BRV204Figure 71 Filter Properties Addressing 22. Click OK to save your changes, then CloseFigure 72 Filter List Microsoft VPNFigure 73 Filter Action Figure 74 Security MethodsFigure 76 Tunnel Setting Figure 75 Modify Security MethodFigure 77 Authentication Method Figure 78 DUT to Win2K Properties31. Select the General tab TW100-BRV204 User GuideFigure 80 Key Exchange Settings Figure 79 Properties - General Tab32. Click the Advanced button to see the screen below 33. Click the Methods button to see the screen belowConfiguration is now complete Figure 81 Key Exchange Security MethodsFigure 82 IKE Security Algorithms Figure 83 Windows 2000/XP Client to TW100-BRV204Example 3 Windows 2000 Server to VPN Gateway SettingFigure 84 TW100-BRV204 to Windows 2000 Server Single ClientWindows 2000 Server Configuration Figure 85 Windows 2000 Server - AddressingCertificates Trusted CertificatesRequesting a Trusted Certificate Issuer NameSelf Certificates Issuer NameFigure 87 Add Trusted Certificate Figure 88 Self Certificates ScreenRequesting a Self Certificate Delete buttonSelf Certificate Requests Request ListName Subject NameHash Algorithm Signature AlgorithmTo add a New CRL CRLsFigure 91 Upload Self Certificate Status Figure 92 Certificate Revocation ListsFigure 93 Upload CRL Figure 94 VPN Status ScreenVPN Status Policy NameSA Type VPN EndpointServer Setup Microsoft VPNChapter OverviewClient Database EnableAuthentication PPTP ServerLogin Name Login PasswordVerify Password Update SelectedThis indicates whether or not the PPTP VPN Server is enabled Status ScreenFigure 97 Microsoft VPN Status Screen Server StatusWindows Client Setup Windows 98/ME1. Click Start - Settings - Dial-up Networking 2. Select Make New ConnectionTo establish a connection 2. Select Start - Settings - Dial-up NetworkingWindows ME VPN Dialing Properties Figure 100 Windows 2000 Network Connection WindowsFigure 101 Windows 2000 Public Network Figure 102 Windows 2000 VPN Host Click Next to continueFigure 103 Windows 2000 Connection Availability Microsoft VPNFigure 104 Windows 2000 Finish Wizard Figure 105 Windows XP Network Connection Type Windows XPFigure 106 Windows XP Network Connection Figure 107 Windows XP Connection Name 4. Enter a suitable name for this connection. Click Next to continueFigure 108 Windows XP Public Network Figure 109 Windows XP VPN ServerTo establish a connection Changing the connection settingsFigure 110 Windows XP Connection Availability Other Features & Settings Config FileDiagnostics Remote AdminData - Config File Screen Config FileFigure 111 Config File Screen Network Diagnostics Figure 112 Network Diagnostics ScreenPing IP AddressPC Database Screen PC DatabaseFigure 113 PC Database Administration Known PCsName IP AddressPC Database Admin Figure 114 PC Database AdminKnown PCs PC PropertiesUpdate Selected ButtonsAdd as New EntryRemote Administration Figure 115 Remote Administration ScreenSettings EnableAccess To connect from a remote PC via the InternetPort Number Allow RemoteRouting OverviewRouting Screen Open Routing and Remote AccessEnable RIP Data - Routing ScreenFigure 116 Routing Screen Static RoutingConfiguring Other Routers on your LAN Save Add Update Delete Clear Form Generate ReportProperties ButtonsStatic Routing - Example Other Routers on the Local LANFor the TW100-BRV204 s Routing Table Figure 117 Routing ExampleFor Router Bs Default Route For Router As Default RouteOther Features and Settings Upgrade Firmware Figure 118 Upgrade Firmware ScreenUpgrade Firmware PasswordUPnP Enable UPnP Services Allow Configu rationAllow Internet access to be disabled Figure 119 UPnP ScreenTroubleshooting General ProblemsInternet Access Appendix AIt is a security risk, since the firewall is disabled TW100-BRV204 Appendix B SpecificationsFCC Statement CE Marking Warning FCC Radiation Exposure StatementLimited Warranty TW100-BRV204 - 5 Years WarrantyTRENDware Technical Support Tel +1-310-891-1100 Fax +1-310-8911111 Technical SupportE-mail support@trendware.com TW100-BRV204 User Guide