Page 2 Vigor2960 Dual-WAN Security Firewall User’s Guide Version: 1.3 Firmware Version: V1.0.9 (For future update, please visit DrayTek web site for further information) Date: October 29, 2014 Vigor2960 Series User’s Guide...
Page 3 Web registration is preferred. You can register your Vigor router via Owner http://www.draytek.com. Firmware & Tools Due to the continuous evolution of DrayTek technology, all routers will be regularly Updates upgraded. Please consult the DrayTek web site for more information on newest firmware, tools and documents.
Page 4 No. 26, Fu Shing Road, HuKou Township, HsinChu Industrial Park, Hsin-Chu County, Taiwan Product: Vigor2960 DrayTek Corp. declares that Vigor2960 of routers are in compliance with the following essential requirements and other relevant provisions of EC, Directive 2004/108/EC. The product conforms to the requirements of Electro-Magnetic Compatibility (EMC) Directive 2004/108/EC by complying with the requirements set forth in EN55022/Class A and EN55024/Class A.
Page 5: Table Of Contents
4.2.2 PPPoE Server........................103 4.2.3 Switch ..........................108 4.2.4 Bind IP to MAC ........................114 4.2.5 LAN DNS 117 4.3 Routing ............................. 120 4.3.1 Load Balance Pool.......................120 4.3.2 Static Route .........................124 4.3.3 Policy Route.........................130 4.3.4 Default Route........................145 4.3.5 RIP Configuration ........................146 Vigor2960 Series User’s Guide...
Page 6 4.9.2 VPN Server Wizard......................298 4.9.3 Remote Access Control .......................303 4.9.4 PPP General Setup ......................304 4.9.5 IPsec General Setup......................307 4.9.6 VPN Profiles ........................308 4.9.7 VPN Trunk Management .....................318 4.9.8 Connection Management ....................323 4.10 Certificate Management ......................325 Vigor2960 Series User’s Guide...
Page 7 5.2 Checking If the Network Connection Settings on Your Computer Is OK or Not ...... 410 5.3 Pinging the Router from Your Computer .................. 413 5.4 Checking If the ISP Settings are OK or Not ................414 5.5 Backing to Factory Default Setting If Necessary..............415 Vigor2960 Series User’s Guide...
Page 8 5.6 Contacting DrayTek ........................416 Vigor2960 Series User’s Guide viii...
Page 9: Chapter 1: Introduction
The Vigor2960 Series integrates a rich suite of functions, including NAT, firewall, VPN, load balance, and bandwidth management capability. These products are very suitable for providing multi-integrated solutions to SME markets. A Virtual Private Network (VPN) is an extension of a private network that encompasses links across shared or public networks like an Intranet.
Page 10: Led Indicators And Connectors
The port is connected with 10/100Mbps. Left LED The port is connected. GigaLAN (Green) The port is disconnected. 1/2/3/4 Blinking The data is transmitting. Right LED The port is connected with 1000Mbps. (Green) The port is connected with 10/100Mbps. Vigor2960 Series User’s Guide...
Page 11 Vigor2960 Series User’s Guide...
Page 12 Then the router will restart with the factory default configuration. GigaWAN 1/2 Connecters for remote networked devices. GigaLAN 1/2/3/4 Connecters for local networked devices. USB1/2 Connecter for Mobile HDD, 3G Modem or printer. Connecter for a power cord. ON/OFF - Power switch. Vigor2960 Series User’s Guide...
Page 13: Hardware Installation
Power on the device by pressing down the power switch on the rear panel. The PWR LED should be ON. The system starts to initiate. After completing the system test, the ACT LED will light up and start blinking. Below shows an outline of the hardware installation for your reference. Vigor2960 Series User’s Guide...
Page 14: Wall-Mounted Installation
The Vigor2960 Series can be mounted on the wall by using standard brackets shown below. Choose a flat surface (on the wall) which is suitable for placing the router. Make the screw holes on the short side of the bracket aim at the screw holes on the router. Next, fasten both the bracket and the router with two screws;...
Page 15: Chapter 2: Initial Configuration
Open a web browser on your PC and type http://192.168.1.1. A pop-up window will open to ask for username and password. Please type default values on the window for the first time accessing. The default value for user name is admin and the password is admin. Next, click Login. Vigor2960 Series User’s Guide...
Page 16 New Password and retype it on the field of Confirm Password. Then click Apply to continue. Now, the password has been changed. Next time, use the new password to access the Web Configurator for this router. Vigor2960 Series User’s Guide...
Page 17: Quick Start Wizard
Available parameters are listed as follows: Item Description Use the drop down list to choose one of the WAN profiles Profile for modifying. IPv4 Protocol Use the drop down list to choose the type for the IPv4 protocol for such profile. Vigor2960 Series User’s Guide...
Page 18: Step 2 - Configuring The Selected Protocol
Type a public gateway address for such WAN profile. Add – Click this button to display the IP address field for DNS Server IP adding a new IP address. Type the IP address on the tiny boxes Address one by one. Vigor2960 Series User’s Guide...
Page 19 Previous Click it to return to previous setting page. Finish Click it to finish the configuration. Cancel Click it to discard the settings configured in this page. When you finished the above settings, please click Finish. Vigor2960 Series User’s Guide...
Page 20 If your ISP provides you the PPPoE (Point-to-Point Protocol over Ethernet) connection, please select PPPoE for this router to get the following page. Enter the username and password provided by your ISP on the web page. Vigor2960 Series User’s Guide...
Page 21 Previous Click it to return to previous setting page. Finish Click it to finish the configuration. Cancel Click it to discard the settings configured in this page. When you finished the above settings, please click Finish. Vigor2960 Series User’s Guide...
Page 22 In this case, you can fill in this IP address in the Fixed IP field. Please contact your ISP before you want to use this function. Static – specify the IP address. DHCP - obtain the IP address automatically. Vigor2960 Series User’s Guide...
Page 23 Finish Click it to finish the configuration. Cancel Click it to discard the settings configured in this page. When you finished the above settings, please click Finish. Later, you can surf the Internet at any time. Vigor2960 Series User’s Guide...
Page 24 When the following screen appears, it means you have finished the Quick Start Wizard configuration. Vigor2960 Series User’s Guide...
Page 25: Register Vigor Router
A Login page will be shown on the screen. Please type the account and password that you created previously. And click Login. Notice: If you haven’t an accessing account, please create a new one first. Please read the articles on the Agreement regarding user rights carefully while creating a user account. Vigor2960 Series User’s Guide...
Page 26 When the following page appears, please type in Nick Name (for the router) and choose the right registration date from the popup calendar (it appears when you click on the box of Registration Date). After adding the basic information for the router, please click Submit. Vigor2960 Series User’s Guide...
Page 27 Now, your router information has been added to the database. Click OK to leave this web page and return to My Information web page. Take a look at the page of My Information, the new added Vigor2960 is listed under Your Device List. Vigor2960 Series User’s Guide...
Page 28 This page is left blank. Vigor2960 Series User’s Guide...
Page 29: Chapter 3: Application And Tutorial
RDP Server via any browser. Open the web configurator of Vigor2960. Enable the HTTPS service from System Maintenance >> Access Control by clicking Enable for HTTPS Allow and type 443 as the value of HTTPS Port. Vigor2960 Series User’s Guide...
Page 30 Open User Management >> User Profile to create a new profile named “7788”. Set the Password as 7788 and choose the profile of Win7 as SSL Application (RDP). Click Apply. Logout Vigor2960. Login Vigor2960 HTTPS Server with 7788 for both Username and Password. Vigor2960 Series User’s Guide...
Page 31 A screen like the following figure will appear. Simply click the SSL Application link. In the following screen, click Connect for connecting to Win7, the RDP server. Vigor2960 Series User’s Guide...
Page 32 After that, you can access into Windows 7 via a browser. Note the message below the window. In which, TLS means Transport Layer Security. Vigor2960 Series User’s Guide...
Page 33: Troubleshooting
If you have installed Java Runtime Environment edition 6 but still cannot establish the connection, please make sure you have disabled “Use TLS 1.0” in the Java Control Panel as figure shown below. Then, try to connect again. Vigor2960 Series User’s Guide...
Page 34: How To Configure Ospf
Each router has its own view of the topology and calculates its own SPF tree, even though all the routers build a shortest-path tree using the same link-state database. Vigor2960 Series User’s Guide...
Page 35 2. Next, continue to create a LAN (192.168.3.1/24) profile named lan2 with the settings shown below. 3. Open LAN >> Static Route Setup and click the Inter-LAN Route tab to enable this profile. Vigor2960 Series User’s Guide...
Page 36 Profiles lan2 area setting as 11 and lan1 area as 11. (As shown in the topology diagram.) 1. Open LAN >> General Setup to create a LAN (192.168.2.1/24) profile named lan1 with the settings shown below. 2. Next, continue to create a LAN (192.168.3.2/24) profile named lan2 with the settings shown below. Vigor2960 Series User’s Guide...
Page 37 Profiles lan2 area setting as 11 and lan1 area as 11. (As shown in the topology diagram.) 1. Open LAN >> General Setup to create a LAN (192.168.4.1/24) profile named lan1 with the settings shown below. Vigor2960 Series User’s Guide...
Page 38 2. Next, continue to create a LAN (192.168.3.3/24) profile named lan2 with the settings shown below. 3. Open LAN >> General Setup and click the Inter-LAN Route tab to enable this profile. Vigor2960 Series User’s Guide...
Page 39 4. Open Routing >> OSPF Configuration to enable this profile. Click Add to make the LAN Profiles lan2 area setting as 11 and lan1 area as 11. (As shown in the topology diagram.) 5. After setting, check the routing information (marked with red line) which is created by OSPF. Vigor2960 Series User’s Guide...
Page 40 Vigor2960 Series User’s Guide...
Page 41: How To Configure Lan To Lan Ipsec Tunnel Between Vigor2960 And Other Router
Type the Pre-shared key and choose a WAN Profile. Specify Local IP/Subnet Mask with 192.168.29.0/24. The Remote Host should be Vigor 2710's WAN IP address; And the Remote IP/Subnet Mask should be192.168.2.0/24. Click Apply to save the settings and return to previous page. Vigor2960 Series User’s Guide...
Page 42 Choose Dial-Out as Call Direction and check the box of Always on. For Dial-Out Settings, please choose IPsec Tunnel and type WAN IP address of Vigor2960 in the field of Server IP/Host Name for VPN (e.g., 1.169.162.1). Type the same IKE Pre-Shared Key configured in Vigor2960. Vigor2960 Series User’s Guide...
Page 43 Please check if the VPN connection is built successfully in both devices respectively. For Vigor2960, open VPN and Remote Access>>IPsec>>Status for viewing the result. As to Vigor2710, please open VPN and Remote Access>>Connection Management to confirm the result. Vigor2960 Series User’s Guide...
Page 44: Cvm Application - How To Manage The Cpe (Router) Through Vigor2960
Web Port. Then click Apply to save the settings. Open Central VPN Management>>CPE Management. On the page of CPE Maintenance, there is no CPE managed by Vigor2960. Open Central VPN Management>>General Setup. Vigor2960 Series User’s Guide...
Page 45 “http://{IP address of Vigor296}:{CVM port}/ACSServer/services/ACSServlet” and type the same Username and Password defined on the page of Central VPN Management>>General Setup in Vigor2960. Then, click Enable for CPE Client and then click OK to save the settings. Vigor2960 Series User’s Guide...
Page 46 Login the web user interface of the CPE. Open System Maintenance>>Management Setup. Check Allow management from the Internet to set management access control. Vigor2960 Series User’s Guide...
Page 47 IP address for your CPE. Then click OK. Note: Reboot the CPE device and re-log into Vigor2960. CPE which has registered to Vigor2960 will be captured and displayed on the page of Central VPN Management>>CPE Management. Vigor2960 Series User’s Guide...
Page 48 Return to the web user interface of Vigor2960. Open Central VPN Management>>CPE Management. Now there is one CPE managed (Vigor2830) by Vigor2960 on the page of CPE Maintenance. Vigor2960 Series User’s Guide...
Page 49: Cvm Application - How To Build The Vpn Between Remote Devices And Vigor2960
When a remote device is managed by Vigor2960 series, it is easy to build VPN between these two devices. Access into the web user interface of Vigor2960 series. Open Central VPN Management>>CPE Management. The icons displayed on the screen means the remote devices are ready for building VPN with Vigor2960.
Page 50 Or click Advanced to open the following page for specified the CPE you want. Click Connect after finished the settings. A confirmation dialog will appear. Click OK and wait for a moment. If VPN is built successfully, related information will be displayed on Connected Devices. Vigor2960 Series User’s Guide...
Page 51 VPN and Remote Access>>LAN to LAN of the remote device for viewing the detailed information. Note: The profile name is created automatically by the system. Do not modify any value in such page to avoid VPN error. Vigor2960 Series User’s Guide...
Page 52: Cvm Application - How To Upgrade Cpe Firmware Through Vigor2960
Open System Maintenance>>Access Control. Check Enable for Web Allow and type the value for Web Port. Then click Apply to save the settings. Open Central VPN Management>>CPE Management. Click CPE Maintenance. In the Maintenance area, click File Explorer. In the File Explorer dialog, click Upload. Vigor2960 Series User’s Guide...
Page 53 In the Upload dialog, click the Browse.. button to find out the firmware (e.g., 2830_0508 in this case) you want to upload from PC to Vigor2960. Then, click Upload. Vigor2960 Series User’s Guide...
Page 54 When the file is uploaded successfully, later you will find the one in the File Explorer dialog. Vigor2960 Series User’s Guide...
Page 55 Firmware Upgrade as the Action, choose Now as the Schedule (it means the firmware upgrade will be performed after clicking Apply); and type the string of the firmware filename or click to choose a correct one. Vigor2960 Series User’s Guide...
Page 56 – now). Note that a red icon, will appear during the period of firmware upgrading. And, in the web user interface of client’s CPE, the system will show you that firmware upgrade is on going. Vigor2960 Series User’s Guide...
Page 57 If [Finished] is displayed, it means the firmware upgrade of specified CPE has completed. Open Central VPN Management>>CPE Management. In the Managed Devices Status area, choose the router (representing Vigor2830) and click Detail. Check the software version field. Vigor2960 Series User’s Guide...
Page 58: How To Use High Availability For Vigor Routers
Note: Make sure the WAN interfaces for both Router A and Router B are well connected. Both routers can be used to access into Internet. Note: For advanced applications, please refer to FAQ/Application Notes on www.draytek.com. Vigor2960 Series User’s Guide...
Page 59 2. Open Applications >>High Availability. 3. In the tab of High Availability Global Setup, choose Hot-Standby as Redundant Method; choose Primary as Config Synchronization Rule; type draytek as Authentication Key; choose Immediate as Advance Preemption Mode. Click Apply to save the settings.
Page 60 3. In the tab of High Availability Global Setup, choose Hot-Standby as Redundant Method; choose Secondary as Config Synchronization Rule; type the lan1 IP address configured in router A; type draytek as Authentication Key; choose Automatic as Advance Preemption Mode. Click Apply to save the settings.
Page 61 Type the lan1 IP address configured in Router A 4. Click the High Availability Profile Setup tab to create HA profile(s). Click Add. 5. Create an HA profile. Refer to the following figures. Vigor2960 Series User’s Guide...
Page 62 Under such construction, when Router A (defined as Master device) is powered off, Router B (defined as Slave device) will be up and take over all the jobs that Router A performs. Later, when Router A is powered on again, all the jobs will return to Router Vigor2960 Series User’s Guide...
Page 63: How To Configure Dns Inbound Load Balance On Vigor 2960
WAN interface according to the DNS query time. Follow the steps listed below to Configure DNS Inbound Load Balance. Open NAT >> Port Redirection to set up Port Redirection rules for the Web server. Click Apply to save the settings. Vigor2960 Series User’s Guide...
Page 64 It means the total DNS query time will be three, one will pass through WAN1; two will pass through WAN2. Click the Detail tab and locate Additional A Record. Type “www” as the name of the Host, and type “192.168.1.10” as the IP Address. Vigor2960 Series User’s Guide...
Page 65 > www.yourdomain.com Server: [google-public-dns-a.google.com] Address: 8.8.8.8 Name: www.yourdomain.com Address: 2.2.2.2 Third DNS query > www.yourdomain.com Server: [google-public-dns-a.google.com] Address: 8.8.8.8 Name: www.yourdomain.com Address: 2.2.2.2 Note: It is recommended to clear cache before executing “nslookup” for DNS query. Vigor2960 Series User’s Guide...
Page 66 This page is left blank. Vigor2960 Series User’s Guide...
Page 67: Chapter 4: Advanced Configuration
When a router begins to connect to your ISP, a serial of discovery process will occur to ask for a connection. Then a session will be created. Your user ID and password is authenticated Vigor2960 Series User’s Guide...
Page 68: General Setup
ISP connections, all the traffic will be guided and switched to the normal communication port for proper operation. Note: Some menu items (e.g., Bridge VLAN) are available only under Advance Mode. Web Page in Basic Mode Web Page in Advance Mode Vigor2960 Series User’s Guide...
Page 69 If the data transmitted with tag, Enable will be displayed in this field. Otherwise, Disable will be shown instead. VLAN ID Display the VLAN ID of the profile. Priority Display the level of the priority for such profile. Vigor2960 Series User’s Guide...
Page 70 Open WAN>>General Setup. Click the Add button to open the following dialog. Different protocol type selected will bring up different configuration web page. Available parameters for global configuration are listed as follows: Item Description Profile (max Type a name (less than 7 characters) for such profile. Vigor2960 Series User’s Guide...
Page 71 VLAN Tag Enable – Click it to enable the function of VLAN Tag. Data transmitted through the router will be tagged with specified number for identification. Disable – Click it to disable the function of VLAN Tag. Vigor2960 Series User’s Guide...
Page 72 Global configuration allows you to enable the profile, give a brief explanation for such profile, specify the VLAN ID, specify MAC address, choose IPv4 and IPv6 protocol, and specify the mode of the data transmission (NAT or Routing). Vigor2960 Series User’s Guide...
Page 73 IP address. Type the IP address on the tiny Address boxes one by one. Save – After finished the IP address configuration, click Save to save the setting onto the router. Type other IP addresses to be bound to this interface. This IP Alias Vigor2960 Series User’s Guide...
Page 74 Add – click this button to have a field for adding a new IP address. Save – click this button to save the setting. Connection Assign an interval period of time for each detecting. Detection Interval Vigor2960 Series User’s Guide...
Page 75 Next, click Save. The new one will be added and displayed on the field under the box. Save – Click this button to save the setting. Vigor2960 Series User’s Guide...
Page 76 Add – click this button to have a field for adding a new IP address. Save – click this button to save the setting. Apply Click it to save the configuration and exit the dialog. Cancel Click it to exit the dialog without saving the configuration. Vigor2960 Series User’s Guide...
Page 77 Fixed IP Address – Type an IP address here if you choose Enable for Fixed IP. Connection Select a detecting mode for this WAN interface. There are Detection Mode two ways PING and HTTP supported in Vigor router for you to choose to send the request out. Vigor2960 Series User’s Guide...
Page 78 Save – After finished the IP address configuration, click Save to save the setting onto the router. Specify DNS Enable – Click it to enable the function of DNS specified. It is used for local service (e.g., NTP, ping diagnostic) or Vigor2960 Series User’s Guide...
Page 79 Type the value of MTU/MRU. The default value is 1452. Debug Click Enable to display the PPTP debug message in syslog. The default setting is Disable. Always On Enable – Click it to enable the function of Always On. The Vigor2960 Series User’s Guide...
Page 80 MAC Address.  If you choose PPP as IPv6 protocol type Simply refer to the section of “If you choose PPPoE as IPv4 protocol type, click the PPPoE Tab to open the following page” for detailed information. Vigor2960 Series User’s Guide...
Page 81 Add – Click this button to have a field for adding a new IP address. Save – Click this button to save the setting. Apply Click it to save the configuration and exit the dialog. Cancel Click it to exit the dialog without saving the configuration. Vigor2960 Series User’s Guide...
Page 82 Click it to exit the dialog without saving the configuration.  If you choose DHCP IA PD as IPv6 protocol type It is not necessary for you to configure any web page. After finished the settings configuration, click Apply to save and apply the settings. Vigor2960 Series User’s Guide...
Page 83 Display the status of the profile. False means disabled; True Enable means enabled. Description Display a brief explanation for such profile. Port Display the physical WAN interface for such profile. Protocol Display the protocol selected by the profile. Vigor2960 Series User’s Guide...
Page 84 Click it to save and exit the dialog. Cancel Click it to exit the dialog without saving anything. After finished the settings above, click the 3G/4G PPP or 4G DHCP tab (based on the Protocol specified) to display the following page: Vigor2960 Series User’s Guide...
Page 85 Please use the default value. If you have any question, please contact to your ISP. Modem Initial String 2-The initial string 1 is shared with APN. In some cases, user may need another initial AT Vigor2960 Series User’s Guide...
Page 86 ISPs. Default Click it to restore the default settings. Apply Click it to save and exit the dialog. Cancel Click it to exit the dialog without saving anything. Enter all of the settings and click Apply. Vigor2960 Series User’s Guide...
Page 87 Profile Number Limit Display the total number of the profiles to be created. Profile Display the profile name. WAN Profile Display the WAN profile selected. LAN VLAN/Member Display VLAN ID number of the LAN port selected. Vigor2960 Series User’s Guide...
Page 88 Apply Click it to save and exit the dialog. Cancel Click it to exit the dialog without saving anything. Enter all of the settings and click Apply. The new profile will be shown as below. Vigor2960 Series User’s Guide...
Page 89: Inbound Load Balance
To edit a profile, simply select the one you want to modify and click the Edit button. The edit window will appear for you to modify the corresponding settings for the selected rule. Delete Remove the selected WAN profile. Vigor2960 Series User’s Guide...
Page 90 Simply click the Add button to open the following dialog. Available parameters are listed as follows: Item Description Status Check this box to enable such profile. Domain Name Type an available domain name to serve the inbound load balance. Vigor2960 Series User’s Guide...
Page 91 Alias – Use the drop down list to choose an alias IP setting (for Alias From WAN Interface) or type an IP address manually (for Alias From Manual Input). Weight –Use the drop down list to choose the one you want. Vigor2960 Series User’s Guide...
Page 92 IP Address – This is optional. If required, simply type the IP address of the NS record server. MX Record This is used to specify the mail server with IP address. Add –Click it to add a new server with specified name and IP Vigor2960 Series User’s Guide...
Page 93 A sub-domain setting page will appear for you to add new profile. Note that the configuration is similar to the way stated on the above steps. Vigor2960 Series User’s Guide...
Page 94: Switch
This page allows you to configure Mirroring Port, Mirrored Port, enable/disable WAN interface, and configure 802.1Q VLAN ID for different WAN interfaces, and so on. Vigor2960 Series User’s Guide...
Page 95 Display number of the WAN interface for the packets Member tagged with such VLAN ID number to pass through. Display number of the WAN interface for the VLAN ID Untag will be untagged for packets passing through the WAN interface selected. Vigor2960 Series User’s Guide...
Page 96 Mirrored Port Select a port to make the packets passing through it monitored by the administrator. Apply Click it to save the configuration. Cancel Click it to discard the settings configured in this page. Vigor2960 Series User’s Guide...
Page 97 Enable – Check it to enable such interface. Speed – Use the drop down list to specify the transmission rate (Auto, 10M, 100M or 1000M) for such interface. Apply – Click it to save and exit the dialog. Vigor2960 Series User’s Guide...
Page 98: Lan
This page allows you to set LAN profiles for PCs in LAN. Settings of DHCP, DHCP Relay, RADVD and DHCPv6 settings are generated automatically by the system when the LAN profile is created. You can edit these settings by switching into each tab individually. Vigor2960 Series User’s Guide...
Page 99 Display the status of the profile. False means disabled; True means enabled. Description Display the brief explanation for the LAN profile. VLAN ID Display the VLAN ID configured for the LAN profile. IPv4 Protocol Display the IPv4 protocol type for the LAN profile. Vigor2960 Series User’s Guide...
Page 100 Type the packet priority number for such profile. The range is from 0 to 7. Default MAC Enable – Click it to enable the default MAC address for such Address profile. Disable – Click it to type the MAC address manually for such profile. Vigor2960 Series User’s Guide...
Page 101 Each DHCP option is composed by an option number with data. For example, Option number:100 Data: abcd When such function is enabled, the specified values for DHCP option will be seen in DHCP reply packets. Vigor2960 Series User’s Guide...
Page 102 DNS Server. It must work with LAN DNS function. It defines the IPv6 connection types for LAN interface. IPv6 Protocol Possible types contain Link-Local, Static and DHCP-SLA. Except Link-Local, each type requires different parameter settings. Vigor2960 Series User’s Guide...
Page 103 Apply Click it to save and exit the dialog. Cancel Click it to exit the dialog without saving anything. When you finish the above settings, please click Apply to save the configuration and exit the dialog. Vigor2960 Series User’s Guide...
Page 104 DHCP Server Location Display the LAN or WAN profile for the DHCP server. DHCP Server IP Display the IP address of DHCP server. DHCP Relay Agent IP Display the IP address of DHCP relay agent server. Vigor2960 Series User’s Guide...
Page 105 Click it to save and exit the dialog. Cancel Click it to exit the dialog without saving anything. When you finish the above settings, please click Apply to save the configuration and exit the dialog. The LAN profile has been edited. Vigor2960 Series User’s Guide...
Page 106 To make the users in different LAN communicating with each other, please check the box to enable Inter-LAN route function. Vigor2960 Series User’s Guide...
Page 107 10 ~ 150. It is used to control the lifetime of the prefix. A lifetime of 0 indicates that the router is not a default router and should not appear on the default router list. Vigor2960 Series User’s Guide...
Page 108 Click it to save and exit the dialog. Cancel Click it to exit the dialog without saving anything. When you finish the above settings, please click Apply to save the configuration and exit the dialog. The LAN profile has been edited. Vigor2960 Series User’s Guide...
Page 109 Display the private IP address for DNS server. Open LAN>>General Setup and click the DHCPv6 tab. Choose one of the LAN profiles by clicking on it and click the Edit button to open the following dialog. Vigor2960 Series User’s Guide...
Page 110 2000:0000:0000:0000:0000:0000:0000:10 or 2000::10. It is available when Manual Setting is selected as Mode. Set the private IP address for DNS server. If this field is blank, users on LAN will treat Vigor2960 as the DNS server. Vigor2960 Series User’s Guide...
Page 111: Pppoe Server
There are several advantages of using PPPoE connections on the LAN. Firstly, the PPPoE server can secure the LAN PC connections with username/password authentication. Secondly, it can prevent ARP attack by nature. Thirdly, the system administrator can configure quota (time/traffic based) for each user as ISP does. Vigor2960 Series User’s Guide...
Page 112 Display the IP address of the client’s host. IP Address Up Time Display the time that the PPPoE connection built. RX Bytes Display the total amount of received packets. TX Bytes Display the total amount of transmitted packets. Vigor2960 Series User’s Guide...
Page 113 Name tagged in the PADO ( PPPoE Active Discovery Offer ) frame. Primary DNS Type an IP address as primary DNS. Type another IP address as secondary DNS. Secondary DNS PPPoE Server Choose the authentication type for PPPoE server. Authentication Type Vigor2960 Series User’s Guide...
Page 114 DHCP Relay can help to forward the DHCP request to the DHCP server. Apply Click it to save and exit the dialog. Cancel Click it to discard current page modification. Vigor2960 Series User’s Guide...
Page 115 Display the connection time. If the action is “Down”, such field will display the total connection time. If the action is “up”, such field will display the time point that the user account access into the PPPoE server. Vigor2960 Series User’s Guide...
Page 116: Switch
Modify the selected VLAN ID setting. Edit To edit VALN ID setting, simply select the one you want to modify and click the Edit button. The edit window will appear for you to modify the corresponding settings for the selected rule. Vigor2960 Series User’s Guide...
Page 117 VLAN profile, than return this page and make the selection again. Determine if the packets transmitted to Internet through such Untag LAN profile with the VLAN ID number is tagged or not. Vigor2960 Series User’s Guide...
Page 118 Available parameters are listed as follows: Item Description Enable Check the box to enable the Mirror function for the switch. Mirroring Port Select a port to view traffic sent from mirrored ports. Vigor2960 Series User’s Guide...
Page 119 A pop up window will appear for you to change the settings. Renew current web page. Refresh Display the profile name of the interface. Interface Display the status of the profile. False means disabled; True Enable means enabled. Vigor2960 Series User’s Guide...
Page 120 Display addition information for such interface. Apply Click it to save and exit the dialog. Cancel Click it to exit the dialog without saving anything. Enter all of the settings and click Apply. The profile has been edited. Vigor2960 Series User’s Guide...
Page 121 It always takes a lot of time. To reduce the sending number of times, wasted bandwidth and transmission time, use Jumbo Frame to enlarge the size of the data and speed up the transmission rate for packets coming from LAN. Vigor2960 Series User’s Guide...
Page 122: Bind Ip To Mac
Refresh - It is used to refresh the ARP table. When there is one new PC added to the LAN, you can click this link to obtain the newly ARP table information. IP Address - Display the IP address of one device. Vigor2960 Series User’s Guide...
Page 123 Enable – Specified IP addresses on the Bind Table will be reserved for the device with bind MAC address. Other devices which are not listed on the Bind Table shall still get the IP address from DHCP server. Vigor2960 Series User’s Guide...
Page 124 IP address. Type a brief description for such profile. Comment Apply Click it to save and exit the dialog. Cancel Click it to exit the dialog without saving anything. Enter all of the settings and click Apply. Vigor2960 Series User’s Guide...
Page 125: Lan Dns
LAN DNS is a simple version of DNS server. It is not necessary for the user to build another DNS server in LAN. With such feature, the user can configure some services (such as ftp, www or database) with domain name which is easy to be accessed. Vigor2960 Series User’s Guide...
Page 126 Display the domain name configured for such profile. Display the alias domain name for such profile. CNAME(Alias Domain Name) IP Address Display the IP address of the domain name. IPv6 Address Display the IPv6 address of the domain name. Vigor2960 Series User’s Guide...
Page 127 Type several domain names in this field. LAN DNS will Domain Name) redirect both Domain name and CNAME to an assigned IP. For example, Domain Name is set with “www.draytek.com”, and the CNAME is set as “www.dray.com”. If the IP address is set with “192.168.1.123”, then both “www.draytek.com”...
Page 128: Routing
The profiles configured here will be selected in the field of Routing >>Default Route page. Each item will be explained as follows: Item Description Add a new pool profile. Edit Modify the selected pool profile. Vigor2960 Series User’s Guide...
Page 129 If you choose Load Balance, the tab of Load Balance will be shown which allows you to configure for different WAN interfaces. If you choose Failover, the tab of Failover will be displayed which allows you to specify the primary profile and backup profile for such Pool setting. Vigor2960 Series User’s Guide...
Page 130 Use the drop down list of Interface to choose the WAN profiles that will be in the Load Balance Pool. Type the value for Weight. Click Apply. A new profile will be added on the page. Vigor2960 Series User’s Guide...
Page 131 Use the drop down list to choose the one you need. Backup Profile Use the drop down list to choose the one you need. Click Apply. A new profile will be added on the page. Vigor2960 Series User’s Guide...
Page 132: Static Route
Enable Display the status of the profile. False means disabled; True means enabled. Destination IP Address Display the IP address for such static route profile. Display the subnet mask for such static route profile. Subnet Mask Vigor2960 Series User’s Guide...
Page 133 Apply Click it to save and exit the dialog. Cancel Click it to exit the dialog without saving anything. Enter all of the settings and click Apply. The new profile will be added on the screen. Vigor2960 Series User’s Guide...
Page 134 Display the status of the profile. False means disabled; True means enabled. Display the IP address for such static route profile. Destination IP Address Prefix Length Display the prefix length of the profile. Nexthop Display the nexthop address for such static route profile. Vigor2960 Series User’s Guide...
Page 135 IP routing function to complete the work. Usually, the local device might be assigned with a public IP address or an IP address with the same subnet as certain WAN. When the local device tries to transmit the data packets out, Vigor2960 Series User’s Guide...
Page 136 Display the WAN profile used for such ARP profile. LAN Profile Display the LAN profile used for such ARP profile. Display the IP address used by such ARP profile. Mask Display the mask address used by such ARP profile. Vigor2960 Series User’s Guide...
Page 137 Click it to save and exit the dialog. Apply Cancel Click it to exit the dialog without saving anything. Enter all of the settings and click Apply. The new profile will be added on the screen. Vigor2960 Series User’s Guide...
Page 138: Policy Route
>>FAQ/Application Notes on www.draytek.com. Each item will be explained as follows: Item Description Add a new rule profile. Edit Modify the selected rule profile. To edit a profile, simply select the one you want to modify Vigor2960 Series User’s Guide...
Page 139 Display the route mode (NAT or Routing) used by such Mode policy route. Failover to Next Rule Display the status (enabled or disabled) of the function. Failback (Quick Display the status (enabled or disabled) of the function. Recover) Vigor2960 Series User’s Guide...
Page 140 Protocol Choose a protocol (ALL, TCP, UDP, TCP/UDP and ICMP) for such rule applied to load balance. All is the default setting. Source Source Type - Choose the address type (Subnet or Object) for such rule. Vigor2960 Series User’s Guide...
Page 141 65535) for such rule.  Destination Port End - Specify a number as the ending value in the destination port range (from 1 to 65535) for such rule. When Object is selected as Destination Type Vigor2960 Series User’s Guide...
Page 142 Click Enable to enable such function. Or, click Disable to disable such function.  Failback (Quick Recover) - When the specified Vigor2960 Series User’s Guide...
Page 143 Or, click Disable to disable such function.  Failback (Quick Recover) - When the specified interface re-connects, the traffic via other interface will be interrupted immediately. The router will use the specified interface for data transmission Vigor2960 Series User’s Guide...
Page 144 Disable to disable such function. Click it to save the configuration. Apply Cancel Click it to return to the factory setting. Enter all of the settings and click Apply. The new rule profile will be added on the screen. Vigor2960 Series User’s Guide...
Page 145 NAT Address Mapping function lets you specify the outgoing IP address(es) for one internal IP address or a block of internal IP addresses. We will take an example to introduce how to make use of this feature. Log into the web user interface of Vigor2960. Vigor2960 Series User’s Guide...
Page 146 From the following page, set main WAN IP address as 202.211.100.10. Click Add on IP Alias to configure the other IP address which is 202.211.100.11. After finished configuration for WAN1, continue to configure WAN2. At this time, the IP switch shall be set as “203.98.200.10”. Vigor2960 Series User’s Guide...
Page 147 Open Objects Setting>>Object and click Add to create a new IP object profile. Type the required information as shown below. Click Apply to save the settings. Open Routing>> Policy Route and click Add to create a new profile. Vigor2960 Series User’s Guide...
Page 148 IP range object profile from the drop down list of IP Object. Click Apply to save the settings. And, Upon completing the above configuration, you have specified the outgoing IP address(es) for some specific computers. Now, you bind some specific computers to some WAN IP alias for outgoing traffic. Vigor2960 Series User’s Guide...
Page 149 Internet. The PC in LAN1 can send the data to the remote PC through the specified WAN1. Access into web user interface of Vigor2960. Open Routing>> Policy Route and click Add to create a new profile. Vigor2960 Series User’s Guide...
Page 150 Out-going Rule; choose WAN1 as the Load Balance Rule; click Disable for Failover to Next Rule. After finished the above settings, click Apply to save the configuration. Now, any packets from LAN1 sent to the remote PC (IP address: 203.65.1.35) will be forcefully to pass through WAN1. Vigor2960 Series User’s Guide...
Page 151 A LAN to LAN VPN tunnel is built between DrayTek VPN router (e.g., Vigor2960) and the remote router. Enterprise firewall router (in Headquarter) can control the all of the traffic coming from the remote PC (in Branch) which wants to access into Internet.
Page 152 Source Type and type the source IP address with 172.16.3.25; choose User Defined as Out-going Rule; choose lan1 as the Out-going Interface; type 192.168.1.2 as the Out-going (Gateway); and click Disable for Failover to Next Rule. After finished the above settings, click Apply to save the configuration. Vigor2960 Series User’s Guide...
Page 153: Default Route
Enable – Check it to let the network connection being WANs established through any active WAN interface. Disable – Check it to disable the function. Click it to save the configuration. Apply Cancel Discard current page modification. Vigor2960 Series User’s Guide...
Page 154: Rip Configuration
B will tell A "if you want to send packets to C, please send it to me first", then A will create a routing rule to forward packet that destination is C to B. In another direction, C will do the same thing. Vigor2960 Series User’s Guide...
Page 155 Check the box to enable the Mirror function for the switch. Profile Choose the LAN/WAN profile(s). Click it to save the settings. Apply Cancel Click it to exit the dialog without saving anything. After finished the settings, click Apply to save them. Vigor2960 Series User’s Guide...
Page 156: Ospf Configuration
Area – An AS will be divided into several areas. Each area must be assigned with a dedicated number. Note: For the detailed information of OSPF application, refer to section “3.2 How to Configure OSPF?”. Apply Click it to save the settings. Vigor2960 Series User’s Guide...
Page 157 Use the drop down list of LAN Profile to choose the one you need. And specify the value of Area (either 0.0.0.0 ~ 255.255.255.255 or 0 ~ 4294967295) for that profile. Click Apply to save the settings. A new profile is created and displayed on the screen. Vigor2960 Series User’s Guide...
Page 158: Bgp Configuration
AS numbers indicate the full paths that the route information will be taken. It can be operated by one or several ISPs and follows the routing policies made by ISP. Such page displays current neighbors status in BGP routing environment. Vigor2960 Series User’s Guide...
Page 159 Display the autonomous system number of the neighbor configured successfully in the Neighbor tab in Routing >>BGP configuration. State Display the status of neighbor profile. If it is established successfully, “Established (time)” will be shown in this field. Vigor2960 Series User’s Guide...
Page 160 Profile Number Limit - Display the total number of the profiles to be created. IP – Type the IP address. Subnet Mask – Display subnet mask for the IP address automatically. After finished the settings, click Apply to save the configuration. Vigor2960 Series User’s Guide...
Page 161 Delete button. Rename Allow to modify the selected profile name. Before using such function, there is one profile existed at least. Refresh Renew current web page. Profile Display the name of the profile. Vigor2960 Series User’s Guide...
Page 162 Apply Click it to save and exit the dialog. Cancel Click it to exit the dialog without saving anything. Enter all of the settings and click Apply. A new profile has been added onto Neighbor table. Vigor2960 Series User’s Guide...
Page 163: Nat
Series is NAT-enabled by default and gets one globally routable IP addresses from the ISP by Static, PPPoE, or DHCP mechanism. The Vigor2960 Series assigns private network IP addresses according to RFC-1918 protocol and translates the private network addresses to a globally routable IP address so that local hosts can communicate with the router and access the Internet.
Page 164 Display the starting number of the public port. Public Port End Display the ending number of the public port. Display the private IP used for this entry. Private IP Private Port Display the number of the private port. Vigor2960 Series User’s Guide...
Page 165 Profile Type the name of the profile. Check the box to enable this profile. Enable Port Redirection Specify the direction for the port to be redirected. Mode Specify the WAN interface for such profile. WAN Profile Vigor2960 Series User’s Guide...
Page 166 Click it to save and exit the dialog. Cancel Click it to exit the dialog without saving anything. Enter all of the settings and click Apply. A new profile has been added onto Port Redirection table. Vigor2960 Series User’s Guide...
Page 167: Dmz Host
Delete Remove the selected profile. To delete a profile, simply select the one you want to delete and click the Delete button. Rename Allow to modify the selected profile name. Vigor2960 Series User’s Guide...
Page 168 Display the IP address of the DMZ host. Allow DMZ Host to Display if such function is enabled or disabled. Access Network Open NAT>> DMZ Host. Simply click the Add button. The following dialog will appear. Available parameters are listed as follows: Vigor2960 Series User’s Guide...
Page 169 Click it to save and exit the dialog. Cancel Click it to exit the dialog without saving anything. Enter all of the settings and click Apply. A new profile has been added onto DMZ Host table. Vigor2960 Series User’s Guide...
Page 170: Alg
Available parameters are listed as follows: Item Description Enable SIP ALG Check the box to enable the function for the switch. Apply Click it to save the settings. Cancel Click it to discard the settings configured in this page. Vigor2960 Series User’s Guide...
Page 171 The H.323 ALG allows incoming and outgoing VoIP calls passing through NAT. If required, check the box and click Apply to save the settings. Vigor2960 Series User’s Guide...
Page 172: Firewall
The firewall controls the allowance and denial of packets through the router. Firewall Setup in the Vigor2960 Series mainly consists of packet filtering, Denial of Service (DoS) and URL (Universal Resource Locator) content filtering facilities. These firewall filters help to protect your local network against attack from outsiders. A firewall...
Page 173 The following dialog will appear. Available parameters are listed as follows: Item Description Group Type the name of the IP filter group. Enable Check the box to enable this profile. Give a brief description for the profile. Comment Vigor2960 Series User’s Guide...
Page 174 IP filter group profile. A setting page will appear for you to add new IP filter rule profile. Move your mouse to click Add. The following page for configuration will appear. Vigor2960 Series User’s Guide...
Page 175 When you choose Block If No Further Match or Accept If No Further Match as Action, you have to specify next IP filter group for further matching. Syslog Click Enable to make the history of firewall actions appearing on the System Maintenance >> Syslog/Mail Vigor2960 Series User’s Guide...
Page 176 Choose one or more IP object profiles from the drop down list. The selected profile will be treated as source target. You can click to create another new IP object profile. Source IP Group - Click the triangle icon to display the Vigor2960 Series User’s Guide...
Page 177 Destination LDAP Group –Click the triangle icon display the profile selection box. Choose one or more LDAP group profiles from the drop down list. The selected profile will be treated as destination target. You can click create another new LDAP group profile. Vigor2960 Series User’s Guide...
Page 178 Enter all of the settings and click Apply. 10. A new IP filter rule has been added under the IP Filter Group (named IPF_Market in this case). Note: You can create multiple IP filter rules under a certain IP Filter group. Vigor2960 Series User’s Guide...
Page 179 Display the total number of the profiles to be created. Profile Number Limit Group Display the name of the IP filter group profile. Enable Display the status of the profile. False means disabled; True means enabled. Comment Display the description for such profile. Vigor2960 Series User’s Guide...
Page 180 Give a brief description for the profile. Apply Click it to save and exit the dialog. Click it to exit the dialog without saving anything. Cancel Enter all of the settings and click Apply. A new filter group has been added. Vigor2960 Series User’s Guide...
Page 181 You can create filter rule by clicking on the left side of the selected IP filter group profile. A setting page will appear for you to add new IP filter rule profile. Move your mouse to click Add. Vigor2960 Series User’s Guide...
Page 182 When you choose Block If No Further Match or Accept If No Further Match as Block Action, you have to specify next IP filter group for further matching. Syslog Click Enable to make the history of firewall actions Vigor2960 Series User’s Guide...
Page 183 Click it to exit the dialog without saving anything. Enter all of the settings and click Apply. 10. A new IPv6 filter rule has been added under the IPv6 Filter Group (named For_IPv61 in this case). Vigor2960 Series User’s Guide...
Page 184 Note: You can create multiple IPv6 filter rules under a certain IP Filter group. Vigor2960 Series User’s Guide...
Page 185 Display the status of the profile. False means disabled; True means enabled. Time Object If no time schedule is set, None will be shown in this field. Time Group Display the Time group profile selected for such application profile. Vigor2960 Series User’s Guide...
Page 186 Type the name of the application filter profile. Enable Check the box to enable this profile. Click Enable to make the history of firewall actions Syslog appearing on the System Maintenance >> Syslog/Mail Alert >> Syslog File. Vigor2960 Series User’s Guide...
Page 187 Source LDAP Group - Click the triangle icon to display the profile selection box. Choose one or more user LDAP profiles from the drop down list. The selected profile will be treated as source target. You can click to create another Vigor2960 Series User’s Guide...
Page 188 Apply Click it to save and exit the dialog. Cancel Click it to exit the dialog without saving anything. Enter all of the settings and click Apply. A new application filter profile has been added. Vigor2960 Series User’s Guide...
Page 189 To delete a rule, simply select the one you want to delete and click the Delete button. Move Up Change the order of selected profile by moving it up. Move Down Change the order of selected profile by moving it down. Vigor2960 Series User’s Guide...
Page 190 Disable – Type the message manually to display on the page that the user tries to access into the blocked web page through HTTPs. Default HTTPS WebSite The message will display on the user's browser when he/she Vigor2960 Series User’s Guide...
Page 191 Disable – When only keyword and web category are selected for such rule, choose Disable. Syslog Click Enable to make the history of firewall actions appearing on the System Maintenance >> Syslog/Mail Alert >> Syslog File. Vigor2960 Series User’s Guide...
Page 192 Source LDAP Group - Click the triangle icon to display the profile selection box. Choose one or more user LDAP profiles from the drop down list. The selected profile will be Vigor2960 Series User’s Guide...
Page 193 Apply Click it to save and exit the dialog. Cancel Click it to exit the dialog without saving anything. Enter all of the settings and click Apply. A new URL filter profile has been added. Vigor2960 Series User’s Guide...
Page 194 If no time schedule is set, None will be shown in this field. Source IP Display the IP object profile selected for each rule. QQ Account Pass Display the account name which is allowed to pass if the Vigor2960 Series User’s Guide...
Page 195 The select account will not be blocked by Vigor router. You can click to create another new QQ account. Use the drop down list to specify a QQ account profile for QQ Account Block Vigor2960 Series User’s Guide...
Page 196 Port Redirection/DMZ passing through Vigor router’s firewall.  Enable Syslog – Check the box to make related information for the blocked packets being recorded in Syslog. The above three policies also can be configured in Vigor2960 Series User’s Guide...
Page 197 Item Description Firewall>>Filter Setup>>IP Filter/Application Filter. Apply Click it to save the configuration. Cancel Click it to discard the settings configured in this page. After finished the above settings, click Apply to save the configuration. Vigor2960 Series User’s Guide...
Page 198: Dos Defense
Any packet that may paralyze the host in the security zone is blocked. The DoS Defense Engine also monitors traffic behavior. Any anomalous situation violating the DoS configuration is reported and the attack is mitigated. Vigor2960 Series User’s Guide...
Page 199 Click Enable to activate the Port Scan detection function. Block Port Scan Port scan sends packets with different port numbers to find available services, which respond. The router will identify it and report a warning message if the port scanning rate in Vigor2960 Series User’s Guide...
Page 200 The router will block any packets with unknown protocol types. Apply Click it to save the configuration. Cancel Click it to discard the settings configured in this page. After finished the above settings, click Apply to save the configuration. Vigor2960 Series User’s Guide...
Page 201: Mac Block
Display the total number of the object profiles to be created. Profile Display the name of the profile. Enable Display the status of the profile. False means disabled; True means enabled. MAC Address Display the MAC address for such profile. Vigor2960 Series User’s Guide...
Page 202 Apply Click it to save and exit the dialog. Cancel Click it to exit the dialog without saving anything. Enter all of the settings and click Apply. A new MAC Block profile has been created. Vigor2960 Series User’s Guide...
Page 203: Objects Setting
Vigor2960 allows users to set different filter profiles based on IP, service type, keyword, file extension, instant message application, P2P application, protocol application, web category, QQ application, time setting, SMS service, mail service and notification. These objects setting profiles can be applied in Firewall. Vigor2960 Series User’s Guide...
Page 204: Ip Object
Display the address type (single, range or subnet) for such profile. Start IP Address Display the IP address of the starting point for such profile. End IP Address Display the IP address of the ending point for such profile. Vigor2960 Series User’s Guide...
Page 205 Subnet as Address Type. Apply Click it to save and exit the dialog. Cancel Click it to exit the dialog without saving anything. Enter all of the settings and click Apply. A new IP object profile has been created. Vigor2960 Series User’s Guide...
Page 206: Ip Group
Display the total number (32) of the object profiles to be created. Group Name Display the name of the object group. Description Display the description for such profile. Objects Display the object profiles grouped under such group. Vigor2960 Series User’s Guide...
Page 207 Apply Click it to save the configuration. Cancel Click it to exit the dialog without saving anything. Enter all of the settings and click Apply. A new IP Group profile has been created. Vigor2960 Series User’s Guide...
Page 208: Ipv6 Object
Display the name of the object. Address Type Display the address type of the object. Address Pool Display the IP address/ IP range /subnet of the object. Open Objects Setting>>IPv6 Object. Simply click the Add button. The following dialog will appear. Vigor2960 Series User’s Guide...
Page 209 Apply Click it to save the configuration. Cancel Click it to exit the dialog without saving anything. Enter all of the settings and click Apply. A new IPv6 Object profile has been created. Vigor2960 Series User’s Guide...
Page 210: Country Object
To delete a rule, simply select the one you want to delete and click the Delete button. Refresh Renew current web page. Open Objects Setting>>Country Object. Simply click the Add button. The following dialog will appear. Vigor2960 Series User’s Guide...
Page 211 Check the box(es) for the country/countries to be blocked by Firewall. Apply Click it to save the configuration. Cancel Click it to exit the dialog without saving anything. Enter all of the settings and click Apply. A new Country Object profile has been created. Vigor2960 Series User’s Guide...
Page 212: Service Type Object
Display the starting source port for such profile. Source Port End Display the ending source port for such profile. Display the starting destination port for such profile. Destination Port Start Destination Port End Display the ending destination port for such profile. Vigor2960 Series User’s Guide...
Page 213 ICMP. Type a port number (0 – 65535) as the ending destination port. Apply Click it to save the configuration. Cancel Click it to exit the dialog without saving anything. Enter all of the settings and click Apply. Vigor2960 Series User’s Guide...
Page 214: Service Type Group
Display the name of the service type group. Description Display the description for such profile. Objects Display the service type object profiles grouped under such group. Open Objects Setting>> Service Type Group. Simply click the Add button. Vigor2960 Series User’s Guide...
Page 215 Apply Click it to save the configuration. Click it to exit the dialog without saving the configuration. Cancel Enter all of the settings and click Apply. A new Service Type Group profile has been created. Vigor2960 Series User’s Guide...
Page 216: Keyword /Dns Object
Renew current web page. Profile Number Limit Display the total number (100) of the object profiles to be created. Profile Display the name of the keyword object profile. Member Display the words specified in such profile. Vigor2960 Series User’s Guide...
Page 217 Click it to exit the dialog without saving the configuration. Enter all of the settings and click Apply. A new Keyword Object profile has been created. DNS can be set as a filter rule to be applied in Firewall. Vigor2960 Series User’s Guide...
Page 218 Display the total number (100) of the object profiles to be created. Profile Display the name of the DNS object profile. Member Table Display the words specified in such profile. Open Objects Setting>> DNS Object. Simply click the Add button. The following dialog will appear. Vigor2960 Series User’s Guide...
Page 219: File Extension Object
This page allows you to set file extension profiles which will be applied in Firewall. All the files with the extension names specified in these profiles will be processed according to the chosen action. Each item will be explained as follows: Item Description Vigor2960 Series User’s Guide...
Page 220 Display the selected file extension of activeX. Compression Display the selected file extension of compression. Display the selected file extension of execution. Execution Open Objects Setting>>File Extension Object. Simply click the Add button. The following dialog will appear. Vigor2960 Series User’s Guide...
Page 221 Use the drop down list to check the box (es) to select the file extension you need. Apply Click it to save the configuration. Cancel Click it to exit the dialog without saving the configuration. Enter all of the settings and click Apply. Vigor2960 Series User’s Guide...
Page 222: App Object
Display the name of the IM object profile. Display the IM application specified in such profile. Display the P2P specified in such profile. Protocol Display the protocol specified in such profile. Others Display other types specified in such profile. Vigor2960 Series User’s Guide...
Page 223 Click it to exit the dialog without saving the configuration. Click P2P to get the following page. Vigor2960 can block P2P application for users, especially for the ones who always upload or download improper files to Internet. Vigor2960 Series User’s Guide...
Page 224 POP3, for LAN users can be blocked by Vigor2960. Common services will be listed in this function and can be selected to be blocked by the router. Item Description Protocol Several protocols offered for you to choose. Check the one (s) you want to add for such profile. Vigor2960 Series User’s Guide...
Page 225 Several protocols offered for you to choose. Check the one g/Remote (s) you want to add for such profile. Control/Web HD Enter all of the settings and click Apply. A new APP Object profile has been created. Vigor2960 Series User’s Guide...
Page 226: Web Category Object
If you want to purchase a formal edition, simply contact with your DrayTek dealer. Note 1: Web Content Filter (WCF) is not a built-in service of Vigor router but a service powered by Commtouch.
Page 227 Other Display the items under certain category that you choose to block. Open Objects Setting>> Web Category Object and click the Web Category Object tab. Simply click the Add button. The following dialog will appear. Vigor2960 Series User’s Guide...
Page 228 Enter all of the settings and click Apply. A new Web Category Object profile has been created. Move your mouse to the link of Activate URL and click it. The system will guide you to access into MyVigor website. Vigor2960 Series User’s Guide...
Page 229 After finishing the activation for the trial version of WCF, remember to purchase “Silver Card” for WCF service from your DrayTek dealer or distributor. Note: This page is designed for Chinese IM "Tencent QQ" users (especially for China) only. For people who do not use QQ, skip this section.
Page 230: Qq Object
Type a brief explanation for the QQ object profile. Apply Click it to save the configuration. Cancel Click it to exit the dialog without saving the configuration. Enter all of the settings and click Apply. A new QQ Object profile has been created. Vigor2960 Series User’s Guide...
Page 231: Qq Group
Display the name of the group. Group Name Description Display the brief explanation for such group. Display the objects selected by such group. Objects Open Objects Setting>> QQ Group. Simply click the Add button. The following dialog will appear. Vigor2960 Series User’s Guide...
Page 232 Apply Click it to save the configuration. Cancel Click it to exit the dialog without saving the configuration. Enter all of the settings and click Apply. A new QQ group profile has been created. Vigor2960 Series User’s Guide...
Page 233: Time Object
Display the starting time of the time object profile. End Date Display the ending date of the time object profile. End Time Display the ending time of the time object profile. Weekdays Display the frequency of such time object profile. Vigor2960 Series User’s Guide...
Page 234 Specify the starting time of the time object profile. Specify the ending date of the time object profile. End Date End Time Specify the ending time of the time object profile. Weekdays Specify which days in one week should perform the schedule. Vigor2960 Series User’s Guide...
Page 235: Time Group
Display the total number (8) of the object profiles to be created. Display the name of the group. Group Name Description Display the brief explanation for such group. Display the time objects selected by such group. Objects Vigor2960 Series User’s Guide...
Page 236 Objects Setting>>Time Object will be seen here. Apply Click it to save the configuration. Cancel Click it to exit the dialog without saving the configuration. Enter all of the settings and click Apply. A new time group profile has been created. Vigor2960 Series User’s Guide...
Page 237: Sms Service Object
Display the user name that the sender can use to register to selected SMS provider. Quota Display the number of the credit that you purchase from the service provider Interval(s) Display the time interval for sending the SMS. Vigor2960 Series User’s Guide...
Page 238 Note that one credit equals to one SMS text message on the standard route. To avoid quota being exhausted soon, type time interval for Interval(s) sending the SMS. Apply Click it to save the configuration. Vigor2960 Series User’s Guide...
Page 239: Mail Service Object
Display the name of the profile. Enable Display the status of the profile. False means disabled; True means enabled. Mail From Display the mail address of the sender. SMTP Port Display the port number used for the SMTP service. Vigor2960 Series User’s Guide...
Page 240 Mail From Type the e-mail address of the sender. SMTP Port Type the port number for SMTP server. SMTP Server Type the IP address of the mail server. Click the Enable button to enable service. SSL/TLS Vigor2960 Series User’s Guide...
Page 241 Apply Click it to save the configuration. Cancel Click it to exit the dialog without saving the configuration. Enter all of the settings and click Apply. A new mail service object profile has been created. Vigor2960 Series User’s Guide...
Page 242 Display if such function is enabled or disabled. Temperature Display if such function is enabled or disabled. Router Reboot Display if such function is enabled or disabled. Syslog Display if such function is enabled or disabled. Vigor2960 Series User’s Guide...
Page 243: Notification Object
Enable – Such notification will be recorded in Syslog. Apply Click it to save the configuration. Cancel Click it to exit the dialog without saving the configuration. Enter all of the settings and click Apply. A new notification object profile has been created. Vigor2960 Series User’s Guide...
Page 244: User Management
The Online User Status is a monitoring tool which only works after you choose HTTP or HTTPS as the Mode setting on General Setup page of User Management>>Web Portal. Refer to section 4.6.1.2 General Setup to get more detailed information of setting web portal. Vigor2960 Series User’s Guide...
Page 245 Display the authentication type (local, RADIUS, LDAP, Login Disable, Guest) used by such user. LDAP Group Display the LDAP group used by such user. Logout/Clear It is a button which is used to disconnect the connection manually. Vigor2960 Series User’s Guide...
Page 246 Check the box to force the online user logging out the web user interface of Vigor router everyday. Time to Logout It is available when Daily Auto Logout is enabled. Type that time setting (HH:MM) for the router to force online user leaving Vigor router. Vigor2960 Series User’s Guide...
Page 247 URL Redirection After Login. White List Select the source IP objects/groups that are ignored by web portal function. Apply Click it to save the configuration. Cancel Click it to discard the settings configured in this page. Vigor2960 Series User’s Guide...
Page 248 Upload Login Image – Choose a file to upload to Vigor2960. It is useful for advertisement. Customized Background Specify an image file which will be display on the login page Image as a background. It is useful for advertisement. Vigor2960 Series User’s Guide...
Page 249: User Profile
Edit button. The edit window will appear for you to modify the corresponding settings for the selected rule. Delete Remove the selected profile. To delete a rule, simply select the one you want to delete and Vigor2960 Series User’s Guide...
Page 250 Display the current PPPoE traffic quota usage portion for Quota(MB) such user. Allow FTP Server Login Display if FTP Server Login is activated (enable or disable) or not. Open User Management>>User Profile. Simply click the Add button. Vigor2960 Series User’s Guide...
Page 251 The user has to type the password specified here to pass the authentication. When the user passes the authentication, he/she can access Internet via this router with the limitation configured in this user profile. Vigor2960 Series User’s Guide...
Page 252 Remote clients using this profile to do PPTP/L2TP dial-in will be assigned IP addresses according to this DHCP pool. Static IP Address Type an IP address for such user profile which accesses Internet with PPTP/L2TP connection. Vigor2960 Series User’s Guide...
Page 253 It is used to set the maximum traffic (MB) for such user profile. Current Traffic Display the cumulative amount of data traffic that the user Used (MB) used. Reset - Click it to reset the setting to default value (0). Vigor2960 Series User’s Guide...
Page 254 Click it to save the configuration. Apply Cancel Click it to exit the dialog without saving the configuration. Enter all of the settings and click Apply. A new User Profile has been created. Below shows an example of user profile. Vigor2960 Series User’s Guide...
Page 255 By default, the Idle Timeout is set to 300 seconds. Modify PPTP Status Check the box to configure detailed setting. /Modify L2TP Status Enable – Click it to enable the PPTP/L2TP/SSL tunnel network connection all user profiles. /Modify SSL Tunnel Status Vigor2960 Series User’s Guide...
Page 256 Modify PPPoE Server Check the box to configure detailed setting. Login Enable – Click it to enable the PPPoE authentication function all user profiles. After finished the above settings, click Apply to save the configuration. Vigor2960 Series User’s Guide...
Page 257 Bind IP Open User Management >> User Profile, and click Add. Set up user profile as shown below. Type Username; check Enable and type Password. Then, type Max User Login. Click Apply to save the settings. Vigor2960 Series User’s Guide...
Page 258 Type the Group Name (in this case, Room); Guest Name Prefix, and Number of Generate (in this case, 100); click Enable for Validity Period to type the Start Time and End time, and click Apply to save the settings. Vigor2960 Series User’s Guide...
Page 259 Open User Management >> Guest Profile and click Guest Group to check the Mass User account Group. By clicking each account (e.g., choose 1001 and click Edit), we can check the information for this account, and we may also modify the account name and password manually. Vigor2960 Series User’s Guide...
Page 260 Note that Administrator is able to Export the information for the whole group to a .csv file, which is useful to redistribute the account and password combinations to guests. Vigor2960 Series User’s Guide...
Page 261 Boss to put it into the white list, and this will allow this IP address to access to the Internet without authentication. After finishing configuration, Vigor2960 will redirect users to the authentication page when they try accessing to the Internet. Vigor2960 Series User’s Guide...
Page 262: User Group
For Room guest to access into Internet: The User Group can consist of several user profiles, which help the administrator to manage a large number of users conveniently. Each item will be explained as follows: Item Description Vigor2960 Series User’s Guide...
Page 263 Check this box to enable such profile. Member Use the drop down list to check the user profile(s) under such group. To clear the selected one, click to remove current object selections. Apply Click it to save the configuration. Vigor2960 Series User’s Guide...
Page 264: Guest Profile
Display the total number (30) of the profiles to be created. Group Display the name of the guest group. Enable Display the status of the profile. False means disabled; True means enabled. Comment Display the description for the profile. Vigor2960 Series User’s Guide...
Page 265 Start Time/End Time – Specify the valid period by typing the time with the format of YYYY-MM-DD-HH-MM. When it is set with “--“, that means such time setting is no limit. Apply Click it to save the configuration. Vigor2960 Series User’s Guide...
Page 266 You can create several guest names by clicking on the left side of the selected guest group profile. A setting page will appear for you to add new guest list. Move your mouse to click Add. The following page for configuration will appear. Vigor2960 Series User’s Guide...
Page 267 The guest profile can be unlocked to be used by other users. Enter all of the settings and click Apply. 10. A new guest has been added under the Guest Group (named Carrie in this case). Vigor2960 Series User’s Guide...
Page 268 (ending) Random Password Length – Type a number to determine the length of the Settings random passwords which will be assigned to the mass guest profiles by the system. The range of Password Length is 6~12. Vigor2960 Series User’s Guide...
Page 269 This function is used to export the guest profile names and random passwords. Available parameters are listed as follows: Item Description Guest Group Choose a group that you want to export the settings, including guest profile names and random passwords as a file for reference. Vigor2960 Series User’s Guide...
Page 270: Radius
It means the maximum usage duration for RADIUS authentication. Apply Click it to save the configuration. Cancel Click it to discard the settings configured in this page. After finished the above settings, click Apply to save the configuration. Vigor2960 Series User’s Guide...
Page 271: Ldap/Active Directory
Display the total number (32) of the profiles to be created. Profile Display the name of the profile. Enable Display the status of the profile. False means disabled; True means enabled. Bind Type Display the type setting selected for such profile. Vigor2960 Series User’s Guide...
Page 272 Open User Management>>LDAP/Active Directory. Simply click the Add button. The following dialog will appear. Available parameters are listed as follows: Item Description Profile Type a name for such profile. Enable This Profile Check this box to enable such profile. Vigor2960 Series User’s Guide...
Page 273 It means the maximum usage duration for LDAP authentication. Apply Click it to save the configuration. Click it to exit the dialog without saving the configuration. Cancel Enter all of the settings and click Apply. A new LADP/Active Directory Profile has been created. Vigor2960 Series User’s Guide...
Page 274: Application
Basically, Vigor routers are compatible with the DDNS services supplied by most popular DDNS service providers such as www.dyndns.org, www.no-ip.com, www.dtdns.com, www.changeip.com, www.dynamic- nameserver.com. You should visit their websites to register your own domain name for the router. Vigor2960 Series User’s Guide...
Page 275 The information will update immediately when the Refresh button is clicked. Refresh Renew current web page. Profile Display the name of the DDNS. Status Display the connection status of the DDNS server. Domain Name Display the domain name for the DDNS server. Vigor2960 Series User’s Guide...
Page 276 Display the domain name of such profile. Display the interface (My WAN IP or My Internet IP) IP Source selected by such DDNS profile. Force update interval Display the interval setting to refresh the data for such profile. Vigor2960 Series User’s Guide...
Page 277 WAN interface first, then applied to other interface. selected wan only – The DDNS profile will be applied to the traffic via WAN interface only. No other interface will be used. Service Provider Select the service provider for the DDNS account. Vigor2960 Series User’s Guide...
Page 278 Click it to force update the profile. Apply Click it to save the configuration. Cancel Click it to exit the dialog without saving the configuration. Enter all of the settings and click Apply. The DDNS Profile has been modified. Vigor2960 Series User’s Guide...
Page 279 This page displays the information related to all DDNS. Vigor2960 Series User’s Guide...
Page 280: Gvrp
Join Time Define the time for the system to send GVRP packet to other device. The unit is second. Apply Click it to save the configuration. Click it to discard the settings configured in this page. Cancel Vigor2960 Series User’s Guide...
Page 281: Igmp Proxy
Use the drop down list to specify the LAN profile as the destination of data coming from WAN interface (defined in IGMP Proxy Channel). Apply Click it to save the configuration. Cancel Click it to discard the settings configured in this page. Vigor2960 Series User’s Guide...
Page 282: Upnp
The NAT Traversal of UPnP enables the multimedia features of your applications to operate. This has to manually set up port mappings or use other similar methods. The screenshots below show examples of this facility. Vigor2960 Series User’s Guide...
Page 283 Some Microsoft operating systems have found out the UPnP weaknesses and hence you need to ensure that you have applied the latest service packs and patches.  Non-privileged users can control some router functions, including removing and adding port mappings. Vigor2960 Series User’s Guide...
Page 284: High Availability
(Active) device, the lower Vigor2960 is regarded as Slave (standby) device. When Master Vigor2960 Series is broken down, the Slave device could replace the Master role to take over all jobs as soon as possible. However, once the original Master is working again, the Slave would be changed to original role to stand by.
Page 285 Config Synchronization Role(Hot-Standby) – Specify the Hot-Standby role for such Vigor router. Primary – It means such Vigor router is treated as the primary device (master device). Authentication Key – Type a string as the authentication key. Vigor2960 Series User’s Guide...
Page 286 Authentication Key – Type a string as the authentication key. It is used for encrypting the HA session communication to prevent malicious attack. Advance Preemption Mode – Specify a mode for changing the Config Synchronization Role. Vigor2960 Series User’s Guide...
Page 287 WAN connection status. It is similar to "LAN Port Detection Mode" but will detect connection status of all enabled WAN profiles. If connection status of all enabled WAN profiles are down, the master router hands off its Vigor2960 Series User’s Guide...
Page 288 (router). When the primary device fails, one of the rest ones will be elected as the new master device. When the Master device fails, one of the slave devices will be chosen as the Master device to offer the network service for the connected PCs. Vigor2960 Series User’s Guide...
Page 289 Gateway VHID Display the virtual host ID number of the profile. HA Status Display the online status (Master, Backup, LAN_failed and WAN_Failed) of such HA profile. Open Applications>>High Availability and click the Hot-Standby Profile Setup tab. Vigor2960 Series User’s Guide...
Page 290 VHID is used for Backup router to identify which Master will be backed up. Apply Click it to save the configuration. Cancel Click it to discard the settings configured in this page. Enter all of the settings and click Apply. Vigor2960 Series User’s Guide...
Page 291 All the WAN interfaces can be active which provide more flexible utilization of network service. When LAN1 in Router A fails, one of the available line connections (e.g., LAN1 in Router C) will be selected to offer the network service for all the connected PCs. Vigor2960 Series User’s Guide...
Page 292 Display the virtual host ID number of the profile. Role Display the role of this profile in the corresponding HA group. HA Status Display the online status (Master, Backup, LAN_failed and WAN_Failed) of such HA profile. Vigor2960 Series User’s Guide...
Page 293 Each HA LAN profile (configured under the same router) must be specified a role as Master or Backup. Apply Click it to save the configuration. Cancel Click it to discard the settings configured in this page. Vigor2960 Series User’s Guide...
Page 294 Enter all of the settings and click Apply. Vigor2960 Series User’s Guide...
Page 295: Wake On Lan
LAN Profile – Use the drop down list to choose one of the LAN profiles. Wake Up Click this button to wake up the selected IP. See the following figure. The result will be shown on the box. Delete Click this button to remove the result. Vigor2960 Series User’s Guide...
Page 296: Sms / Mail Alert Service
Display the status of the profile. False means disabled; True means enabled. Display the name of the SMS provider. SMS Provider Recipient Display the one who will receive the SMS. Notify Profile Display the name of the notify profile. Vigor2960 Series User’s Guide...
Page 297 Click it to save the configuration and exit the page. Cancel Click it to exit the dialog without saving the configuration. Enter all of the settings and click Apply. The SMS alert service profile has been modified. Vigor2960 Series User’s Guide...
Page 298 Notify Profile Display the name of the notify profile. Open Applications>> SMS/Mail Alert Service and click the Mail Alert Service tab. Choose one of the index numbers and click the Edit button. The following dialog will appear. Vigor2960 Series User’s Guide...
Page 299 Click it to save the configuration and exit the page. Cancel Click it to exit the dialog without saving the configuration. Enter all of the settings and click Apply. The mail alert service profile has been modified. Vigor2960 Series User’s Guide...
Page 300: Vpn And Remote Access
Below shows the menu items for VPN and Remote Access. Such wizard is used to configure VPN settings for VPN client. Such wizard will guide to set the LAN-to-LAN profile for VPN dial out connection (from server to client) step by step. Vigor2960 Series User’s Guide...
Page 301 Create New VPN Profile – It allows you to create a new VPN LAN to LAN profile. Simply type the name in the field of Profile Name. The field of Profile Name is available only when you click this setting. Vigor2960 Series User’s Guide...
Page 302 Specify the type. Click Create New VPN Profile and type the name of the profile. Then, click Next. If you choose PPTP as the Type, you will get the following screen: Available parameters are listed as follows: Item Description Vigor2960 Series User’s Guide...
Page 303 VPN Tunnel Packet while connecting. Disable –When there is conflict occurred between the hosts on both sides of VPN Tunnel in connecting, such function can block data transmission of Netbios Naming Packet inside the tunnel. Vigor2960 Series User’s Guide...
Page 304 Choose ESP to specify the IPsec protocol for the Encapsulating Security Payload protocol. The data will be encrypted and authenticated. Choose AH to specify the IPsec protocol for the Authentication Header protocol. The data will be authenticated but not be encrypted. Vigor2960 Series User’s Guide...
Page 305 Use the value 0 to disable this function. The recommended value is 120 seconds if enabled. Fill in the required information on this page and click Finish. Later, a new profile has been created. Vigor2960 Series User’s Guide...
Page 306: Vpn Server Wizard
Such wizard is used to configure VPN settings for VPN server. Such wizard will guide to set the LAN-to-LAN profile for VPN dial in connection (from client to server) step by step. Open VPN and Remote Access >> VPN Server Wizard. The following dialog will appear. Vigor2960 Series User’s Guide...
Page 307 Display the name of the profile. Enable Check this box to enable such profile. PPTP User Name Choose a user for authentication in PPTP connection. Such profile shall be created in User Management>>User Profile previously. Otherwise, there are no selections Vigor2960 Series User’s Guide...
Page 308 Specify the gateway for WAN interface. Usually, use the default setting (leave it in blank). Remote Host Type the WAN IP address for the remote host. Remote IP / Subnet Type the LAN IP address and LAN subnet mask for the Vigor2960 Series User’s Guide...
Page 309 Use the value 0 to disable this function. The recommended value is 120 seconds if enabled. F Fill in the required information on this page and click Finish. A pop-up window will appear. Vigor2960 Series User’s Guide...
Page 310 Click OK. Then, return to VPN and Remote Access>>VPN Server Wizard. The new added VPN server profile will be displayed on the screen. Vigor2960 Series User’s Guide...
Page 311: Remote Access Control
Enable SSL Tunnel Service IPsec Remote Dial-In Choose one of the services by clicking on the radio button. Service Apply Click it to save the configuration. Cancel Click it to discard the settings configured in this page. Vigor2960 Series User’s Guide...
Page 312: Ppp General Setup
Choose a LAN profile for L2TP Server if RADIUS is selected as user authentication type. Enable - Let the router assign IP address to every host in the DHCP Relay LAN. Disable - Let you manually assign IP address to every host Vigor2960 Series User’s Guide...
Page 313 PAP - It means the router will attempt to authenticate dial-in users with the PAP protocol. CHAP - It means the router will attempt to authenticate dial-in users with the CHAP protocol. User Authentication Set user authentication to Local server or RADIUS server. Vigor2960 Series User’s Guide...
Page 314 If it is checked, the router will use L2TP with IPsec policy policy for VPN connection. Apply Click it to save the configuration. Cancel Click it to discard the settings configured in this page. Enter all of the settings and click Apply. Vigor2960 Series User’s Guide...
Page 315: Ipsec General Setup
Type the port number for GRE over IPsec MSS. GRE over IPsec MSS Apply Click it to save the configuration. Cancel Click it to discard the settings configured in this page. Enter all of the settings and click Apply. Vigor2960 Series User’s Guide...
Page 316: Vpn Profiles
Profile Number Limit created. Profile Display the name of LAN to LAN profile. Enable Display the status of the profile. False means disabled; True means enabled. Dial-Out Through Display the WAN interface selected for the profile. Vigor2960 Series User’s Guide...
Page 317 There are three types offered here for you to choose. Please choose IPsec for this case. Basic Auto Dial-Out – Click Enable to make Vigor router performing VPN connection based on the condition selected (e.g., Always Dial-Out, if.wan1/wan2/usb1/usb2 down). Vigor2960 Series User’s Guide...
Page 318 IPsec protocol for the Authentication Header protocol. The data will be authenticated but not be encrypted. Apply Click it to save the configuration. Cancel Click it to exit the page without saving the configuration. Vigor2960 Series User’s Guide...
Page 319 Ping to Keep Alive Enable – Click it to enable such function. Ping to the IP - If you enable the PING function, please specify the IP address for the system to PING it for keeping Vigor2960 Series User’s Guide...
Page 320 Click it to exit the page without saving the configuration. After filling the required information for Advanced, click the GRE tab to open the following page. Available parameters are listed as follows: Item Description Enable GRE Click Enable to enable such function. Function Vigor2960 Series User’s Guide...
Page 321 VPN peers, and get its feedback to find a match. IKE Phase1 Propose the local available algorithms to the VPN peers, and Authentication get its feedback to find a match. (Dial-Out) IKE Phase2 Propose the local available authentication schemes and Vigor2960 Series User’s Guide...
Page 322 Below will guide you to create a PPTP dial-out profile for VPN connection: Open VPN and Remote Access >> VPN Profiles. Simply click the Add button. The following dialog will appear. Available parameters are listed as follows: Vigor2960 Series User’s Guide...
Page 323 Naming Packet inside the tunnel. Apply Click it to save the configuration. Click it to exit the page without saving the configuration. Cancel Enter all of the settings and click Apply. A new PPTP Dial-Out VPN profile has been created. Vigor2960 Series User’s Guide...
Page 324 Enable – Click it to have an inquiry for data transmission Packet between the hosts located on both sides of VPN Tunnel while connecting. Disable –When there is conflict occurred between the hosts on both sides of VPN Tunnel in connecting, such function Vigor2960 Series User’s Guide...
Page 325 Apply Click it to save the configuration. Cancel Click it to exit the page without saving the configuration. Enter all of the settings and click Apply. A new PPTP Dial-In LAN-to-LAN profile has been created. Vigor2960 Series User’s Guide...
Page 326: Vpn Trunk Management
VPN Tunnels disconnected. Users do not need to reconnect with setting TCP/UDP Service Port again. The VPN Load Balance function can keep the transmission for internal data on tunnel stably. Vigor2960 Series User’s Guide...
Page 327 Display which mode (load_balance or failover) is selected. Interface Display the name of the Load Balance profile grouped under such pool profile. Primary Interface Display the primary interface for failover. Backup Interface Display the backup interface for failover. Vigor2960 Series User’s Guide...
Page 328 Important!!! If there is no selection for Interface option, please go to VPN and Remote Access>>VPN Profiles to create a new IPsec LAN to LAN profile with enabled GRE setting. Then, return to this page to specify the Interface option. Enter all of the settings and click Apply. Vigor2960 Series User’s Guide...
Page 329 Protocol Display the protocol configured by such profile. Source IP Address Display the source IP address specified for this profile. Source Mask Display the subnet mask address specified for the source IP of this entry. Vigor2960 Series User’s Guide...
Page 330 Source IP Address Type the source IP address specified for this profile. Source Mask Type the subnet mask address specified for the source IP. Destination IP Type the destination IP address specified for this entry. Address Vigor2960 Series User’s Guide...
Page 331: Connection Management
Click it to perform PPTP VPN connection. Profile This filed displays the profile configured in LAN-to-LAN (with Index number and VPN Server IP address). The VPN connection built by General Mode does not support VPN backup function. Vigor2960 Series User’s Guide...
Page 332 Display the connection type used of such VPN. Remote IP Display the IP address of the remote end. Action Display the connection status (UP or DOWN) of VPN profile. Time Display the time the VPN profile connects/disconnects. Vigor2960 Series User’s Guide...
Page 333: Certificate Management
Remember to adjust the time of Vigor router before using the certificate so that you can get the correct valid period of certificate. Below shows the menu items for Certificate Management. Local certificate is created by the end user and must be signed by a trusted CA center. Vigor2960 Series User’s Guide...
Page 334: Local Certificate
Click this button to open the following dialog to upload selected certificate onto the router. After choosing the certificate file type, type the required information and choose the required file (e.g., Key Passphrase, Key File, PKCS12 Password and PKCS12 File). Vigor2960 Series User’s Guide...
Page 335 Available parameters are listed as follows: Item Description Certificate Name Type the name of the local certificate. ID Type The ID type for such certificate. There are four types: Domain Name: Certificated by domain name. IP: Certificated by IP address. Vigor2960 Series User’s Guide...
Page 336 Click it to create a new local certificate based on the Apply configuration here. Cancel Click it to exit the web page without saving the configuration. Enter all of the settings and click Apply. A new generated Local Certificate has been created. Vigor2960 Series User’s Guide...
Page 337 Open Certificate Management>> Local Certificate. Specify a certificate and click the Download button. Click Save. The file will be stored under the folder you specified above. Open Certificate Management>> Local Certificate. Click Upload to open the following dialog. Vigor2960 Series User’s Guide...
Page 338 From the above dialog, choose the certificate you want and click Open. The dialog box with the selected certificate file name will be shown as follows. Click Upload. The system will start to upload the selected file. Vigor2960 Series User’s Guide...
Page 339: Trusted Ca Certificate
(CA) to be used as a CA for signing the local certicate. Just create a new Trust CA Certificate first. Each item will be explained as follows: Item Description Upload Click this button to open the following dialog to upload selected certificate onto the router. Vigor2960 Series User’s Guide...
Page 340 Display the issuer of trusted certificate built. Status Display the status of trusted certificate built. Valid From Display the starting point of the valid time of trusted certificate. Display the end point of the valid time of trusted certificate. Valid To Vigor2960 Series User’s Guide...
Page 341: Remote Certificate
After choosing the PKCS12 Certificate mode, type the required information and choose the required file (e.g., PKCS12 Password and PKCS12 File). Later, click Upload on the dialog to upload the file onto Vigor router. Vigor2960 Series User’s Guide...
Page 342 Select File Use the Browse.. button to specify a file to be used as a certificate. Name Display the name of certificate built. Subject Display the subject of certificate built. Status Display the status of certificate built. Vigor2960 Series User’s Guide...
Page 343: Ssl Vpn
Edit button. The edit window will appear for you to modify the corresponding settings for the selected profile. Delete Remove the selected profile. To delete a profile, simply select the one you want to delete Vigor2960 Series User’s Guide...
Page 344 URL setting. Apply Click it to save the configuration. Click it to exit the page without saving the configuration. Cancel Enter all of the settings and click Apply. A new SSL Web Proxy profile has been created. Vigor2960 Series User’s Guide...
Page 345: Ssl Application
Display the name of the profile that you create. IP Address Display the IP address for this protocol. Port Display the port used for this protocol. Display the percentage for such application. Scaling Open SSL VPN>> SSL Application and click the VNC tab. Vigor2960 Series User’s Guide...
Page 346 Chose the percentage (100%, 80%, 60%) for such application. Apply Click it to save the configuration. Cancel Click it to exit the page without saving the configuration. Enter all of the settings and click Apply. A new SSL Application profile has been created. Vigor2960 Series User’s Guide...
Page 347 Display the port used for this protocol. Screen Size Display the screen size for such application. Open SSL VPN>> SSL Application and click the RDP tab. Simply click the Add button. The following dialog will appear. Vigor2960 Series User’s Guide...
Page 348 Chose the screen size for such application. Apply Click it to save the configuration. Cancel Click it to exit the page without saving the configuration. Enter all of the settings and click Apply. A new SSL Application profile has been created. Vigor2960 Series User’s Guide...
Page 349: Online User Status
If you have finished the configuration of SSL Web Proxy (server), users can find out corresponding settings when they access into DrayTek SSL VPN portal interface. Each item will be explained as follows: Item Description Refresh Renew current web page.
Page 350: Central Vpn Management
(called CVM server) which can manage TR-069 CPE for periodical firmware upgrade, configuration backup and restoring configuration. Below shows the menu items under CVM: Note: 1. Such menu can manage the CPE connected through WAN only. 2. Up to 12 devices can be managed. Vigor2960 Series User’s Guide...
Page 351: General Setup
Disable – Click it to disable the polling function. Polling Interval Type the time value (unit is second). The range is from 60 ~ 86400. Apply Click it to save the configuration. Cancel Click it to discard the settings configured in this page. Vigor2960 Series User’s Guide...
Page 352 IKE Phase1 Mode Choose Aggressive or Main as the IKE Phase1 Mode. Apply Click it to save the configuration. Cancel Click it to discard the settings configured in this page. Vigor2960 Series User’s Guide...
Page 353: Cpe Management
Edit – To modify the name and location of specific CPE, click the one you want and click the Edit button. A pop up window will appear. Simply change the name (for identification) and/or location manually. Vigor2960 Series User’s Guide...
Page 354 Managed Devices Status area again. Maintenance This area displays all the profiles which are created for applying to the managed device. Add – To add a new profile, simply click it to open a pop up window. Vigor2960 Series User’s Guide...
Page 355 Action – Display the action specified for such profile. Schedule – Display the frequency of for such profile which will be performed by Vigor router. Weekdays – Display the day(s) chosen for such profile. Vigor2960 Series User’s Guide...
Page 356 Vigor2960. Choose the one which will be applied with such new created profile. Usually, the name of the device will be assigned by Vigor2960 automatically. If you want to give a name easy for easy recognition, refer to 4.11.2.1 CPE Maintenance to Vigor2960 Series User’s Guide...
Page 357 It is available only when Weekdays is selected as Schedule. Weekdays Simply check the day you want. Filename Type the name string of the file which will be used for firmware upgrade, configuration backup or configuration Vigor2960 Series User’s Guide...
Page 358 If not, refer to sections “3.4 How to manage the CPE (router) through Vigor2960?” for more detailed information. If the VPN isn’t established successfully, a red line will appear instead. Vigor2960 Series User’s Guide...
Page 359 Add – Click it to open the following dialog. Type the name of the profile and choose the CPE from the Device drop down list. Then, click Apply to save the settings. Such profile will be applied to the device connecting to Vigor2960 with VPN. Vigor2960 Series User’s Guide...
Page 360 Virtual Network – Display the IP address of Vigor2960. Up Time –Display the connection time of such VPN. RX(Packets) /TX(Packets) –Display the number of the packets exchanged in such VPN. Disconnect – Click it to disconnect the VPN. Vigor2960 Series User’s Guide...
Page 361 To display the location of the selected CPE with a bird’s eye view, open Central VPN Management>>CPE Management and click the tab of Map. Vigor2960 Series User’s Guide...
Page 362: Log/Alert
The Log page offers brief information to identify the CPE connected to Vigor2960. The Alert page offers brief information to identify the CPE connected to Vigor2960. Vigor2960 Series User’s Guide...
Page 363: Bandwidth Management
The QoS function handles incoming and outgoing classes independently. Users can configure incoming or outgoing separately without any impact on the other. This page displays current QoS Status. Vigor2960 Series User’s Guide...
Page 364 Display bandwidth for the incoming data is enabled or disabled. Follow the steps below to create a new maintenance profile. Click one of the QoS WAN profiles to select the one you want to edit. Click Edit. Vigor2960 Series User’s Guide...
Page 365 Type the weight of queues in bytes, range from 0 to 1000000. Apply Click it to save and exit the dialog. Cancel Click it to exit the dialog without saving anything. Enter all of the settings and click Apply. Vigor2960 Series User’s Guide...
Page 366 Type the weight of queues in bytes, range from 0 to 1000000. Apply Click it to save and exit the dialog. Cancel Click it to exit the dialog without saving anything. Enter all of the settings and click Apply. Vigor2960 Series User’s Guide...
Page 367: Qos Rule
Display the destination IP address for the filter. Remote IP Object Service Type Display the service type (e.g., IKE, HTTP, AUTH and etc) for the filter. Match Type Display the match type (e.g., TOS or DSCP) for the filter. Vigor2960 Series User’s Guide...
Page 368 Type the name of the filter profile. Enable Check this box to enable such profile. Match Type Use the drop down list to specify a suitable match type. It is available when DSCP is selected as the Match type. DSCP Vigor2960 Series User’s Guide...
Page 369 IP objects for such rule profile. Local IP Group – Use the drop down list to choose one of the IP group for such rule profile. If you want to create a new IP object, simply click open the following dialog. Vigor2960 Series User’s Guide...
Page 370 Start IP Address - Type the IP address of the starting point for such profile.  End IP Address - Type the IP address of the ending point for such profile if you choose Range as Address Vigor2960 Series User’s Guide...
Page 371 Click it to save the configuration and exit the page. Cancel Click it to exit the page without saving the configuration. Enter all of the settings and click Apply. A QoS rule profiler has been created. Vigor2960 Series User’s Guide...
Page 372 Enable - Click it to enable VoIP QoS function. SIP UDP Port Set a port number used for SIP. Apply Click it to save and exit the dialog. Cancel Click it to discard the settings configured in this page. Vigor2960 Series User’s Guide...
Page 373 Apply Click it to save and exit the dialog. Cancel Click it to discard the settings configured in this page. Vigor2960 Series User’s Guide...
Page 374: Sessions Limit
Allow to modify the selected profile name. Refresh Renew current web page. Profile Display the name of the profile. Enable Display the status of the profile. False means disabled; True means enabled. Limit Display the maximum session number allowed for the Vigor2960 Series User’s Guide...
Page 375 Apply Click it to save and exit the dialog. Cancel Click it to discard the settings configured in this page. Open Bandwidth Management>> Sessions Limit. Simply click the Add button. The following dialog will appear. Vigor2960 Series User’s Guide...
Page 376 Source IP Object - Click the triangle icon to display the profile selection box. Choose one or more IP object profiles from the drop down list. The selected profile will be treated Vigor2960 Series User’s Guide...
Page 377: Bandwidth Limit
Edit button. The edit window will appear for you to modify the corresponding settings for the selected profile. Delete Remove the selected profile. To delete a profile, simply select the one you want to delete Vigor2960 Series User’s Guide...
Page 378 Default RX Limit –Define the limitation for the speed of the downstream. Apply Click it to save and exit the dialog. Cancel Click it to discard the settings configured in this page. Open Bandwidth Management>>Bandwidth Limit. Simply click the Add button. The following dialog will appear. Vigor2960 Series User’s Guide...
Page 379 Time Object - Click the triangle icon to display the profile selection box. Choose a schedule object profile to be applied on such rule. You can click to create another new time object profile. Vigor2960 Series User’s Guide...
Page 380 Click it to save the configuration and exit the dialog. Cancel Click it to exit the dialog without saving the configuration. Enter all of the settings and click Apply. A bandwidth limit profile has been created. Vigor2960 Series User’s Guide...
Page 381: Usb Application
Description Refresh Click it to refresh current USB connection status. The result will be shown on the screen immediately. Restart Devices Click it to restart the USB device. Display the manufacturer of the USB device. Manufacturer Vigor2960 Series User’s Guide...
Page 382: Ftp User Management
It displays the username that user uses to login to the FTP server. If there is nothing displayed here, it means there is no FTP user profile created. Just open User Management>>User Profile, create a new user profile with Allow FTP Server Login enabled. Vigor2960 Series User’s Guide...
Page 383: Temperature Sensor
IP and the FTP server. The default setting is “10”. A USB Thermometer is now available that complements your installed DrayTek router installations that will help you monitor the server or data communications room environment and notify you if the server room or data communications room is overheating.
Page 384 Upper limit Calibration Type a value used for correcting the temperature error. Apply Click it to save the configuration and exit the dialog. Click it to exit the dialog without saving the configuration. Cancel Vigor2960 Series User’s Guide...
Page 385: Modem Support List
Enter all of the settings and click Apply. Such page provides the information about the brand name and model name of the USB modems which are supported by Vigor router. Vigor2960 Series User’s Guide...
Page 386: System Maintenance
TR-069 device (Vigor router, AP and etc.) through VigorACS SI ( Server Each item will be explained as follows: Item Description Enable Check this box to enable such profile. ACS server on Choose one of the WANlLAN profiles which will be Vigor2960 Series User’s Guide...
Page 387 A value of “-1” indicates that no maximum period is specified. Apply Click it to save the configuration. Cancel Click it to discard the settings configured in this page. Enter all of the settings and click Apply. Vigor2960 Series User’s Guide...
Page 388: Administrator Password
Type the old password. New Password Type the new password. Re-type the new password for confirmation. Confirm Password Apply Click this button to save the configuration and exit the web page. Enter all of the settings and click Apply. Vigor2960 Series User’s Guide...
Page 389: Configuration Backup
Backup to Remote TFTP Server – The configuration file will be stored in the remote TFTP server specified. Backup Selected Config – The configuration file will be stored with an existing file in local host. You must select Vigor2960 Series User’s Guide...
Page 390 Use the Browse.. button to locate the file for uploading to the router. Restore Click it to upload the selected file to the router. After finishing the restoration, the system will ask you to reboot the router. Vigor2960 Series User’s Guide...
Page 391: Syslog / Mail Alert
Save or open the Syslog file. Clear Syslog Remove all of the records. Auto Refresh Specify the interval of refresh time to obtain the latest status. The information will update immediately when the Refresh button is clicked. Vigor2960 Series User’s Guide...
Page 392 Type the name of the router. The default name is Vigor. Click Enable to make the firewall log recorded in the Firewall Log Syslog. VPN Log Click Enable to make the VPN log recorded in the Syslog. Vigor2960 Series User’s Guide...
Page 393 Click Enable to make any user logging into the mail server. If you click Enable, you have to type user name and user password on the below fields. Type the user name for authentication. User Name Vigor2960 Series User’s Guide...
Page 394: Time And Date
Select the time zone where the router is located. Daylight Saving Click Enable to enable the daylight saving. Such feature is available for certain area. Apply Click this button to save the configuration and exit the web Vigor2960 Series User’s Guide...
Page 395: Access Control
HTTPS server and management the web page of the router. HTTPS Port Type the port number for the management through HTTPS server. FTP Allow Click Enable to allow system administrator to login from the FTP server and management the web page of the router. Vigor2960 Series User’s Guide...
Page 396 Click Enable to disable the function of Auto-Logout of Auto-Logout Vigor router. Apply Click this button to save the configuration and exit the web page. Cancel Click it to discard the settings configured in this page. Enter all of the settings and click Apply. Vigor2960 Series User’s Guide...
Page 397: Snmp Setup
Type a password for authentication. The maximum length of Auth Password the text is limited to 23 characters. Privacy Algorithm Choose one of the methods listed below as the privacy algorithm. Privacy Password Type a password for privacy. The maximum length of the Vigor2960 Series User’s Guide...
Page 398: Reboot System
Click it to reboot the router using the current configuration Reboot with Customized Configurations (only the configuration settings listed and selected below). If you choose this option, Select Config File will be available for you to select. Vigor2960 Series User’s Guide...
Page 399 If you do not create any time object previously, you can also create a required one in this page directly. The bottom of this page offers tools for you to create time object. The way of configuration is the same as settings in Objects Setting>>Time Object. Vigor2960 Series User’s Guide...
Page 400: Firmware Upgrade
The following web page will guide you to upgrade firmware by using such page. Download the newest firmware from DrayTek's web site or FTP site. The DrayTek web site is www.DrayTek.com (or local DrayTek's web site) and FTP site is ftp.DrayTek.com.
Page 401: Diagnostics
Refresh Renew the web page. Search Move the mouse cursor onto the box of Search. Click the mouse button and type the keyword inside the box. The system will display the records relating to the keyword. Vigor2960 Series User’s Guide...
Page 402 Metric Display the distance to the target (usually counted in hops). It may be needed by routing daemons. Iface Display the direction of such route represented with LAN/WAN profile (starting from LAN/WAN profile to LAN/WAN profile). Vigor2960 Series User’s Guide...
Page 403 Metric Display the distance to the target (usually counted in hops). It may be needed by routing daemons. Iface Display the direction of such route represented with LAN/WAN profile (starting from LAN/WAN profile to LAN/WAN profile). Vigor2960 Series User’s Guide...
Page 404: Arp Cache Table
Display the IP address for different ARP cache. HW type Display the hardware type of the address from RFC 826. MAC Address Display the MAC address for different ARP cache. C means complete entry. Flags M means permanent entries. Vigor2960 Series User’s Guide...
Page 405 IP Address Display the IPv6 address of the neighbor. Profile Display the interface to which this neighbor is attached. MAC Address Display the MAC address of the neighbor. Vigor2960 Series User’s Guide...
Page 406 PROBE - The neighbor is no longer to be reachable, and unicast Neighbor Solicitation probes are being sent to verify reachability. Vigor2960 Series User’s Guide...
Page 407: Dhcp Table
Display the starting time that DHCP server is activated. End Date Display the end date that DHCP server is closed. Display the end time that DHCP server is closed. End Time Mac Address Display the MAC address of the static DHCP server. Vigor2960 Series User’s Guide...
Page 408 Display the IPv6 address of the static DHCP server. Start Time Display the starting time that DHCP server is activated. End Time Display the end time that DHCP server is closed. DUID Display the detailed information for DUID. Vigor2960 Series User’s Guide...
Page 409: Session Table
Display the destination IP address and port of remote host. Display the WAN interface used. Protocol Display the protocol of such session used. State Display the actual state of the TCP connection. Display how long the conntrack entry has to live. Vigor2960 Series User’s Guide...
Page 410: Traffic Graph
Recent 24 Hours – Display the information of memory operation about recent 24 hours. Recent 7 Days – Display the information of memory operation about recent 7 days. Recent 4 Weeks – Display the information of memory Vigor2960 Series User’s Guide...
Page 411 24 hours. Recent 7 Days – Display the information of WAN operation about recent 7 days. Recent 4 Weeks – Display the information of WAN operation about recent 4 weeks. Below show a graphic for CPU: Vigor2960 Series User’s Guide...
Page 412: Web Console
Choose one of the LAN or WAN profile to be applied by such function. Start Click it to start the action of Ping or Trace Route. Stop Click it to terminate the action of Ping or Trace Route. Vigor2960 Series User’s Guide...
Page 413: Data Flow Monitor
Display the records with 1 hour/24 hours/7 days recently. Recent 1 Hour/ Recent 24 Hours / Recent 7 Days Auto Refresh Specify the interval of refresh time to obtain the latest status. The information will update immediately when the Refresh button is clicked. Vigor2960 Series User’s Guide...
Page 414: External Devices
External Devices to make detailed configuration. Each item will be explained as follows: Item Description External Devices Auto Check the box to detect the external device connected to Discovery Vigor2960. Refresh Click it to renew the web page. Vigor2960 Series User’s Guide...
Page 415: Product Registration
Note: Only DrayTek products can be detected by this function. Please refer to section 2.3 Register Vigor Router for more detailed information. Vigor2960 Series User’s Guide...
Page 416 This page is left blank. Vigor2960 Series User’s Guide...
Page 417: Chapter 5: Trouble Shooting
Turn on the router. Make sure the ACT LED blink once per second and the correspondent LAN LED is bright. If not, it means that there is something wrong with the hardware status. Simply back to “1.3 Hardware Installation” to execute the hardware installation again. And then, try again. Vigor2960 Series User’s Guide...
Page 418 Open All Programs>>Getting Started>>Control Panel. Click Network and Sharing Center. In the following window, click Change adapter settings. Icons of network connection will be shown on the window. Right-click on Local Area Connection and click on Properties. Vigor2960 Series User’s Guide...
Page 419 Select Internet Protocol Version 4 (TCP/IP) and then click Properties. Select Obtain an IP address automatically and Obtain DNS server address automatically. Finally, click OK. Double click on the current used Mac OS on the desktop. Open the Application folder and get into Network. Vigor2960 Series User’s Guide...
Page 420 On the Network screen, select Using DHCP from the drop down list of Configure IPv4. Vigor2960 Series User’s Guide...
Page 421: Pinging The Router From Your Computer
Open the Application folder and get into Utilities. Double click Terminal. The Terminal window will appear. Type ping 192.168.1.1 and press [Enter]. If the link is OK, the line of “64 bytes from 192.168.1.1: icmp_seq=0 ttl=255 time=xxxx ms” will appear. Vigor2960 Series User’s Guide...
Page 422: Checking If The Isp Settings Are Ok Or Not
Open Online Status to check current network status. Be careful to check if the settings coming from your ISP have been typed correctly or not. Vigor2960 Series User’s Guide...
Page 423: Backing To Factory Default Setting If Necessary
Go to System Maintenance>> Reboot System on the web page. The following screen will appear. Choose the selection you need and click Reboot After few seconds, the router will return all the settings to the factory settings. Vigor2960 Series User’s Guide...
Page 424 If the router settings are correct at all, and the router still does not connect to internet, please contact Draytek to help you for configuration. Also, if the router still cannot work correctly, please contact DrayTek for help. For any further questions, please send e-mail to support@draytek.com.

This manual is also suitable for:

Vigor 2960 series

Draytek Vigor2960 Series User Manual

Chapter 1: Introduction

Chapter 2: Initial Configuration

Chapter 3: Application and Tutorial

Chapter 4: Advanced Configuration

Chapter 5: Trouble Shooting

Quick Links

Troubleshooting

Related Manuals for Draytek Vigor2960 Series

Summary of Contents for Draytek Vigor2960 Series

This manual is also suitable for:

Table of Contents