Manuel d'utilisation / d'entretien du produit TL-ER604W SafeStream du fabricant TP-Link
Aller à la page of 159
TL-ER604W Wireless N Gigabit Broadband VPN Router Rev1.0.1 1910010844.
-I- COPYRIGHT & TRADEMARKS Specifications are subjec t to change without notice. is a registered trademark of TP-LINK TECHNOLOGIES CO., L TD. Other brands and product names are trademarks of their respective holders.
-II- CONTENTS Package Contents .................................................................................................................. 1 Chapter 1 About this Guide ............................................................................
-III- 3.4 Advanc ed ....................................................................................................................... ......55 3.4.1 NA T ...........................................................................................
-IV- 3.8.7 Logs ....................................................................................................................... 128 Chapter 4 Application .........................................................................................
-1- Package Content s The following items should be found in your package: One TL-ER604W Router One Power Adapter One RJ45 Ethernet Cable Quick Installation Guide Resource CD Note: Make sure that the package contains the above items.
-2- Chapter 1 About this Guide This User Guide contains information for set up and managem ent of TL-ER604W Router . Please read this guide carefully before operation. 1.1 Intended Readers This Guide is intended for Network Engineer and Network Administrator.
-3- Chapter 2 Introduction Thanks for choosing the SafeS tream Wireless N Gigabit Broadband VPN Router TL-ER604W. 2.1 Overview of the Router The SafeS tream Wireless N Gigabit Broadband VPN Router TL-ER604W from TP-LINK supports Wireless N speed and Gigabit wired speeds on all ports .
-4- + Possessing MAC Filtering function to block the access of illegal hosts. Flexible T raffic Control + Featured Bandwidth Control with flexible band width management to automatically control the bandwidth of the host in bi-direction to avoid ban dwidth over occup ation, as well as optimize bandwidth usage.
-5- Supports Virtual Server , Port T rigger ing, ALG , S tatic Route and RIP v1/v2 Built-in Switch supporting Port Mirror , Port VLAN, Rate Control and so on Supports to change the MAC add.
-6- 2.3 Appearance 2.3.1 Front Panel The front panel of TL-ER604W is shown as the following figure. Figure 2-1 Front Panel LEDs LED Status Indication On The Router is powered on PWR Off The Router.
-7- Reset button Use the button to restore the Router to the factory defaults. With the Router powered on, use a pin to press and hold the Reset button (about 4~5 seconds).
-8- Chapter 3 Configuration 3.1 Network 3.1.1 S t atus The S tatus page shows the system information, the port connection st atus and other information related to this Router . Choose the menu Network → Stat us to load the following page. Figure 3-1 S t atus 3.
-9- Figure 3-2 Network T opology - NA T Mode If your Router is connecting the two networks of di fferent areas in a large network environment with a network topology as the Figure 3-3 shown, and forwards the packets betwe en these two networks by the Routing rules, you can set it to Non-NA T mode.
-10- Figure 3-5 System Mode Y ou can select a System Mode for your R outer according to your network need. NA T Mode NA T (Network Address T r anslation) mode allows the Router to translate private IP addresses within internal networks to public IP addresses for traf fi c transport over external networks, such as the Internet.
-1 1- Figure 3-6 W AN Mode W AN Mode W AN Ports: Select the total number of W AN port s you prefer to use. The Router support one W AN and dual W AN. The Router will adjust the physical ports accordingly , which can be illustr ated on the following port sketch.
-12- Figure 3-7 W AN – S tatic IP The following items are displayed on this screen: St atic IP Connection T ype: Select S tatic IP if your ISP has assigned a static IP address for your computer . IP Address: Enter the IP address assigned by your ISP .
-13- Downstream Bandwid th: S pecify the b andwidth for receiving p ackets on the port. 2) Dynamic IP If your ISP (Internet Service Provider) assigns the IP address automatic ally , please choose the Dynamic IP connection type to obt ain the parameters for W AN port automatically .
-14- the default value if no other MTU va lue is provided by your ISP . Get IP Address b y Unicast: The broadcast requirement may not be supported by a few ISPs. Select this option if you can not get the IP address from your ISP even if with a normal network c onnection.
-15- Gateway Address: Displays the Gateway Address assigned by your ISP . Primary DNS: Displays the IP address of your ISP’ s Primary DNS. Secondary DNS: Displays the IP address of your ISP’ s Secondary DNS.
-16- The following items are displayed on this screen: PPPoE Settings Connection T ype: Select PPPoE if your ISP provides xDSL Vir tual Dial-up connection. Click <Connect> to dial-up to the Internet and obtain the IP address. Click <Disconnect> to disconnec t the Internet connection and release the current IP address.
-17- ISP Address: Optional. Enter the ISP address provided by your ISP . It's null by default. Service Name: Optional. Enter the Service Name prov ided by your ISP . It's null by default. Primary DNS: Enter the IP address of y our ISP’s Primary DNS.
-18- “Connected” indicates that the Router has successfully obtained the IP parameters from your ISP . “Disconnected” indicates t hat the connection has been manually terminated or the request of the Router has no response from your ISP .
-19- Figure 3-10 W AN - L2TP The following items are displayed on this screen: L2TP Settings Connection T ype: Select L2TP if your ISP provides a L2TP connection. Click <Connect> to dial-up to the Internet and obtain the IP address. Click <Disconnect> to disconnect the In ternet connection and release the current IP address.
-20- MTU: MTU (Maximum T ransmission Unit) is the maximum data unit transmitted by the physical network . It can be set in the range of 576-1460. The default MTU is 1460. It is recommended to keep the default value if no other MTU va lue is provided by your ISP .
-21- L2TP S t atus Statu s: Displays the status of PPPoE connection. “Disabled” indicates that the L2TP connection type is not applied. “Connecting” indicates that t he Router is obtaining the IP parameters from your ISP . “Connected” indicates that the Router has successfully obtained the IP p arameters from your ISP .
-22- Figure 3-1 1 W AN - PPTP The following items are displayed on this screen: PPTP Settings Connection T ype: Select PPTP if your ISP pr ovides a PPTP connection. Click <Connect> to dial-up to the Internet and obtain the IP address. Click <Disconnect> to disconnec t the Internet connection and release the current IP address.
-23- MTU: MTU (Maximum T ransmission Unit) is the maximum dat a unit transmitted by the physical network. It can be set in the range of 576-1460. The default MTU is 1460. It is recommended to keep the default value if no other MTU va lue is provided by your ISP .
-24- PP TP Stat us Statu s: Displays the status of PPTP connection. “Disabled” indicates that t he PPTP connection type is no t applied. “Connecting” indicates that t he Router is obtaining the IP parameters from your ISP . “Connected” indicates that the Router has successfully obtained the IP p arameters from your ISP .
-25- Figure 3-12 W AN – Bigpond The following items are displayed on this screen: BigPond Settings Connection T ype: Select BigPond if your ISP prov ides a BigPond connection. Click <Connect> to dial-up to the Internet and obtain the IP address.
-26- Auth Mode: Y ou can select the proper Active mode according to your need. Manual: Select this option to manually activate or terminate the Internet connection by the <Connec t> or <Disconn ect> button. It is optimum for the dial-u p connection charged on time.
-27- Note: T o ensure the BigPond connection re-established norma lly , please restart the connection at least 5 seconds after the connection is of f. 3.1.4 LAN 3.1.4.1 LAN On this page, you can configure the p a rameters for LAN port of this router .
-28- Figure 3-14 DHCP Settings The following items are displayed on this screen: DHCP Settings DHCP Server: Enable or disable the DHCP server on your Router . T o enable the Router to assign the TCP/IP paramete rs to the computers in the LAN automatically , please select Enable.
-29- 3.1 Secondary DNS: Optional. If a Secondary DNS Server address is available, enter it. .4.3 DHCP Client On this page, you can view the information about all the DHCP clients c onnected to the Router . Choose the menu Network → LAN → DHCP Client to load the following page.
-30- Statu s: Activate or Inactivate the corresponding entry . List of Reserved Address In this table, you can view the information of the entries and edit them by the Action buttons. The first entry in Figure 3-16 indicates: The IP address 192.168.
-31- MAC Address Port: Displays the port type of the Router . Current MAC Address: Displays the current MAC address of the port. MAC Clone: It’s only available for W AN port.
-32- The following items are displayed on this screen: St atistics Unicast: Displays the number of normal unica st packet s received or transmitted on the port. Broadcast: Displays the number of normal broadcast packet s received or transmitted on the port.
-33- Choose the menu Network → Sw itc h → Port Mirror to load the following page. Figure 3-19 Port Mirror The following items are displayed on this screen: General Enable Port Mirror: Check the box to enable the Port Mirr or function. If unchecked, it will be disabled.
-34- Application Example: T o monitor all the traffic and analyze the network abnormity for an ent erprise’s network, please set the Port Mirror function as below: 1) Check the box before Enable Port Mirror to enable the Port Mirro r function and select the Ingress & Egress mode.
-35- 3.1 Port: Displays the port number . Ingress Limit: S pecify whether to enable t he Ingress Limit feature. Ingress Rate: S pecify the limit rate for the ingress packet s. Egress Limit: S pecify whether to enable Egress Limit feature. Egress Rate: S pecify the limit rate for the egress packe ts.
-36- 3.1.6.5 Port St atus On this page, you can view t he current status of each port. Choose the menu Network → Sw itc h → Port St atus to load the following page.
-37- VLAN: Select the desired VLAN for the port. Tips: The Port VLAN can only be created among the LAN ports. 3.2 Wireless 3.2.1 Wireless Setting 3.2.1.1 Wireless Setting On this page you can configure the basi c parameters of the wireless network. Choose the menu Wi rele ss → Wireless Setting → W ireless Setting to load the following page.
-38- Region: Select your region from the drop-dow n lis t. This field specifies the region where the wireless function of the Ro uter can be used. It may be illegal to use the wireless function of the Router in a region other than one of those specified in this field.
-39- SSID: Enter a name for the wireless network. The same name of SSID(Service Set Identification) must be assigned to all wireless device in your network. Considering your wireless network secu rity , the default SSID is set to be TP-LINK _ XXXXXX (XXXXXX indicates the last unique six numbers of each Router ’s MAC address).
-40- Auth T ype: Choose the Auth type of the WPA-PSK/WPA2-PSK security on the drop-down list. The default setting is Automatic , which can select WP A-PSK (Pre-shared key of WPA) or WP A2-PSK (Pre-shared key of WPA) automatically based on the wire less station's capability and request.
-41- Encryption: Select the Encryption type. which including Automatic , TKIP , AES . The default setting is Automatic , which can select TKIP (T emporal Key Integrity Protocol) or AES （ Advanced Encryption S tandard ） automatically based on the wireless station's capability and request.
-42- Key Format: Hexadecimal and ASCII formats are provided . Hexade cimal format stands for any combination of hexadecimal digits (0-9, a-f, A-F) in the specified length. ASCII format stands for any combination of keyboard characters in t he specified length.
-43- Figure 3- 25 Multi-SSID The following items are displayed on this screen: General Multi-SSID: Enable or disable the Multi-SSID. Y ou can est ablish multiple wireless networks if Multi-SSID is enabled. SSID Insulation: Enable or disable the SSID Insulation.
-44- Security: Specify the security optio n of the wireless network. If you do not want to use wireless security, select “Disable Security”, otherwise select one Security option from the drop-down list. It’ s strongly recommended to choose one of the security options to enable security.
-45- Encryption: Select the Encryption type, which including Automatic , TKIP , AES . The default setting is Automatic , which can select TKIP (T emporal Key Integrity Protocol) or AES （ Advanced Encryption S tandard ） automatically based on the wireless station's capability and request.
-46- Encryption: Select the Encryption type. which including Automatic , TKIP , AES . The default setting is Automatic , which can select TKIP (T emporal Key Integrity Protocol) or AES （ Advanced Encryption S tandard ） automatically based on the wireless station's capability and request.
-47- Key Selected: You can select the key based on need. WEP Key : Select which of the four keys w ill be used and enter the matching WEP key that you create. Make sure these values are identical on all wireless stations in your network. Key T ype: You can select the WEP key length (64-bit, or 128-bit, or 152-bit.
-48- Choose the menu Wi rele ss → Wireless Setting → WDS to load the following page. Figure 3-26 WDS Configuration General WDS: Enable or disable the WDS function. With this f unction, the Router can bridge two or more WLANs. Scan: Click this button; you can search the AP which runs in the current channel.
-49- Key ： If the AP your Router is going to connect needs p assword, you need to fill the key in this blank. Tips: The Multi-SSID function will be disabled if WDS is enabled. 3.2.1.4 Wireless Advanced On this page, you can configure the wireless advanced parameters.
-50- Beacon Interval: Enter a value between 40-1000 millis econds for Beacon Interval here. The beacons are the packets sent by the router to synchronize a wireless network. Beacon Interval val ue determines the time interval of the beacons. The default value is 100.
-51- Figure 3-28 MAC Filtering General Each SSID can be configured the MAC Address Filt ering rules. Y ou can select a SSID in the SSID drop-down list.
-52- Figure 3-29 Host S t atus General Select a SSID, the status of t he host in this wireless network will display on the following table. Host St atus MAC Address: Displays the MAC address of the host wh ich access the Router by wireless connection.
-53- Figure 3-30 Group Configuration The following items are displayed on this screen: Group Config Group Name: S pecify a unique name for the group. Description: Give a description for the group. It's optional. List of Group In this table, you can view the information of the Groups and edit them by the Action buttons.
-54- Description: Give a description to the user fo r identification. It's optional. List of User In this table, you can view the information of the Users and edit them by the Action buttons. 3.3.3 Vi ew On this page, you can configur e the User View or Group V iew .
-55- 3.4 Group Structure: Click this button to view the tree struct ure of this group. All the members of this group will be displayed, includi ng Users and sub-Groups. The Group Names are displayed in bold. A vailable Member: Displays the Users and the Groups which can be added into this group.
-56- 3.4 NA T -DMZ: Enable or disable NA T -DMZ. NA T DM Z is a special service of NA T application, which can be considered as a default forwardin g rule. When NA T DMZ ( Pseudo DMZ) is enabled, all the data initiated by external network falling short of the current connections or forwarding rules will be forwarded to the preset NA T DMZ host.
-57- Statu s: Activate or inactivate the entry . List of Rules In this table, you can view the information of the entries and edit them by the Action buttons. The first entry in Figure 3-34 indicates: The IP address of host1 in local network is 192.
-58- The first entry in Figure 3-35 indicates that: This is a Multi-Ne ts NA T entry named tplink1. The subnet under the LAN port of the Router is 192.168.2.0/24 and this ent ry is activated. After the co rresponding S tatic Route entry is set, the hos ts within this subnet can access the Internet through the Router via NA T .
-59- The configured entries are as follows: 2. Then set the corresponding S tatic Route entry , en ter the IP address of t he interface connecting the Router and the three layer swit ch into the Next Hop field. Choose the menu Advanced → Routi ng → S t atic Route to load the following page.
-60- Figure 3-36 Virtual Server The following items are displayed on this screen: Virtual Server Name: Enter a name for Virtual Server ent ries. Up to 28 characters can be entered. Interface: Select an interface for forwarding data packe ts. External Port: Enter the service port or port range the Router provided for accessing external network.
-61- 3.4 List of Rules In this table, you can view the information of the entries and edit them by the Action buttons. The first entry in Figure 3-36 indicates: This is a V irtual Serv er entry na.
-62- T rigger Protocol: Select the protocol used for trigger port. Incoming Port: Enter the incoming port number or range of port numbers. The incoming port will open for follow-up connection after the trigger port initiates connection. Incoming Protocol: Select the protocol used for incoming port.
-63- 3.4.2.1 Setup ALG FTP ALG: Enable or disable FTP ALG . The default setting is enabled. It is recommended to keep the def ault setting if no special requirement. H.323 ALG: Enable or disable H.323 ALG . The default setting is enabl ed. H.323 is used for various applicat ions such as NetMeeting and V oIP .
-64- The following items are displayed on this screen: General Disable Bandwidth Control: Select this option to disable Bandwidth Control. Enable Bandwidth Control all the time: Select this option to enable Bandwidth Control all the time.
-65- 3.4.2.2 Bandwid th Control On this page, you can configure the Bandwid th Control function. Choose the menu Advanced → T raffic Control → Band width Control to loa d the following page.
-66- Limited Bandwid th (Down): S pecify the L imited Downstream Bandwidth for this entry . Effective Time: S pecify the t ime for the entry to take e ffect .
-67- Figure 3-41 Session Limit The following items are displayed on this screen: General Enable Session Limit: Check here to enable Session Limit, otherwise all the Session Limit entries will be disabled. Session Limit Group: Select a group to define the controlled users.
-68- Figure 3-42 Session List In this table, you can view the session limit inform ation of users configured with Session Limit. Click the <Refresh> button to get the latest information. 3.4.4 Load Balance In this part, you can configure the traf fic sharing mode of the W A N ports to optimize the resource utilization.
-69- Figure 3-44 Policy Routing The following items are displayed on this screen: General Protocol: Select the protocol for the entry in the drop-down list. If the protocol you want to set is not in the lis t, you can add it to the list on 3.4.4.4 Protocol p age.
-70- 3.4 List of Rules Y ou can view the informati on of the entries and edit t hem by the Action buttons. The first entry in Figure 3-44 indicates: All the packe ts with Source IP between 192.168.0.100 and 192.168.0.199 and Destinat ion IP between 1 16.
-71- W AN Config: The W AN port in the secondary W AN list will share the traffic for the W AN in the primary W AN list under the specified condition. Mode: Y ou can select T iming or Failover Mod e. Timing: Link Backup will be enabled if the spec ified effective time is reached.
-72- Figure 3-46 Protocol The following items are displayed on this screen: Protocol Name: Enter a name to indicate a protocol. The name will display in the drop-down list of Protocol on Access Rule page. Number: Enter the Number of the prot ocol in the range of 0-255.
-73- Figure 3-47 Static Route The following items are displayed on this screen: St atic Route Destination: Enter the destination hos t the route leads to. Subnet Mask: Enter the Subnet Mask of the destination network. Next Hop: Enter the gateway IP address to which the p acket should be sent next.
-74- Application Example There is a network topology as the following figure shown: If the LAN port of TL-ER604W （ with Non-NAT or Classic system mode ） is connected to LAN1 with subnet of 192.168.0.0/24, while the LAN por t of another Router R1 is c onnected to LAN2 with network of 192.
-75- TL-ER604W supports both RIPv1 vers ion and RIPv2 version, thus you can configure the RIP version based on the actual need to improve the network performance.
-76- data via this port. The IP address of next hop is 116.10.1.254 and the hop count is 1. The effective time of this entry is 1 second. Note: ● RIP function cannot be set if t he Router is in NA T Mode. T o set RIP function, please change the System Mode to Routing or Full Mode.
-77- 3.5 3.5 Firewall 3.5.1 Anti ARP S poofing ARP (Address Resolution Protocol) is used for analyzing and mapping IP addresses to the corresponding MAC addresses so that packet s can be delivered to their destinations correctly .
-78- It is recommended to check all the options. Y ou s hould import the IP and MAC address of the host to IP-MAC Binding List and enable the corresponding entr y before enabling “Permit the packet s matching the IP-MAC Binding entries only”.
-79- Figure 3-51 ARP Scanning Enter the start and the end IP addresses into the Scanning IP Range field. Then click the <Scan> button, the Router will scan all the active host s with in the scanning range and di splay the result in the list.
-80- Figure 3-52 ARP List The configurations for t he entries is the same as the confi guration of List of Scanning Re sult on 3.5.1.2 ARP Scanning p age. The unbound IP-MAC inform ation will be replaced by new IP-MAC information or be automatically removed from the list if it has not been communica ted with others for a long time.
-81- Figure 3-53 Attack Defense The following items are displayed on this screen: General Flood Defense: Flood attack is a commonly used DoS (Denial of Service) att ack, including TCP SYN, UDP , ICMP and so on. It is recommended to select all the Flood Defens e options and specify the corresponding thresholds.
-82- 3.5.3 MAC Filtering On this page, you can control the Internet access of local hosts by spec ifying their MAC addresses. Choose the menu Firewall → MAC Filtering → MAC Filtering to load the following page.
-83- Figure 3-55 URL Filtering The following items are displayed on this screen: General T o control the access to Internet for host s in your private network, you are recommended to check the box before Enable URL Filtering and select a filtering rule based on the actual situation.
-84- Application Example: Network Requirements: Prevent the local hosts fr om accessing Internet website www .aabbcc.com and downloading the files with suffix of “exe”. Configuration Procedure: Select Keywords mode and type ”exe“ in the field, select URL mode and type “www .
-85- Figure 3-57 Access Rule The following items are displayed on this screen: Access Rules Policy: Select a policy for the entry: Block: When this option is selected, the p ackets obeyed the rule will not be permitted to pass through the Router .
-86- means any IP). Group: Sele ct a predefined group of users. Y ou can set the group on 3.3.1 Group . ANY : means for any users. Destination: Select the Destination IP R ange for the entries, including the following two ways: IP/MASK: Enter an IP address or subnet mask.
-87- services if needed. Choose the menu Firewall → Access Control → Service to loa d the following p age. Figure 3-58 Service The following items are displayed on this screen: Service Name: Enter a name for the service. T he name should not be more than 28 characters.
-88- 3.5 3.5.5 App Control .5.1 Control Rules On this page, you can enable t he Application Rules function. Choose the menu Firewall → App Control → Control Rules to load the following page.
-89- and Proxy . The default setting is to limit all the applications in the application list except for Basic and Proxy . Effective Time: S pecify the t ime for the entry to take e ffect . Description: Give a description for the entry . Statu s: Activate or inactivate the entry .
-90- cause the private data to be exposed to all the user s on the Internet. The VPN (Virtual Private Network) technology is developed and used to establish the private network through the public network, which can guarantee a secured data exchange. VPN adopts the tunneling technology to establish a private connection between tw o endpoints.
-91- Figure 3-62 IKE Policy The following items are displayed on this screen: IKE Policy Policy Name: S pecify a unique name to the I KE policy for identification and management purposes. The IKE policy can be applied to IPsec policy . Exchange Mode: Select the IKE Exchange Mode in phase 1, and en sure the remote VPN peer uses the same mode.
-92- 3.6 Local ID: The local W AN IP will be inputted aut omatically if IP Address type is selected. If Name type is selected, e nter a name for the local device as the ID in IKE negotiation Remote ID T ype: Select the remote ID type for IKE n egotiation.
-93- Figure 3-63 IKE Proposal The following items are displayed on this screen: IKE Proposal Proposal Name: S pecify a unique name to the IKE proposal for identification and management purposes. The IKE proposal can be applied to IPsec proposal. Authentication: Select the authentication algorithm for IKE negotia tion.
-94- 3.6 DH1: 768 bits DH2: 1024 bits DH3: 1536 bits List of IKE Proposal In this table, you can view the information of IKE Proposals and edit them by the action buttons.
-95- Figure 3-64 IPsec Policy The following items are displayed on this screen: General Y ou can enable/disable IPsec func tion for the Router here. IPsec Policy Policy Name: S pecify a unique name to the IPsec policy . Up to 28 characters can be entered.
-96- Remote Subnet: S pecify IP address range on your remote network to identify which PCs on the remote network are covered by this policy . It's formed by IP address and subnet mask. WA N : S pecify the local W AN port for this Policy . The "Remote Gateway" of the remote peer should be set to the IP address of this W AN port.
-97- Statu s: Activate or inactivate the entry . Manual Mode IPsec Proposal: Select the IPsec Proposal. Only one proposal can be selected on Manual mode. Y ou need to first create the IPsec Proposal. Incoming SPI: S pecify the Incoming SPI (Security Parameter Index) manually .
-98- ESP Encry ption Key-Out: S pecify the outbound ESP Encryption Key manually if ESP protocol is used in the co rresponding IPsec Proposal. The outbound key here must match the inbound ESP encryption key at the other end of the tunnel, and vice versa.
-99- Security Protocol: Select the security protocol to be used. Options include: AH: AH (Authentication Header) provides data origin authentication, data integrity and anti-replay services. ESP: ESP (Encapsula ting Security Payload) provides data encryption in addition to origin aut hentication, data integrity , and anti-replay services.
-100- 3.6.2.3 IPsec SA This page displays the information of the IPsec SA (Security Association). Choose the menu VPN → IPsec → IPsec SA to load the following page. Figure 3-66 IPsec SA Figure 3-66 displays the connection status of the NO.1 entry in t he List of IPsec policy in Figure 3-64 .
-101- 3.6.3.1 L2TP/PPTP T unnel On this page, you can conf igure the L2TP/PPTP VPN. Choose the menu VPN → L2TP/PPTP → L2TP/PPTP T unnel to load the following page. Figure 3-67 L2TP/PPTP T unnel The following items are displayed on this screen: General Enable VPN-to-Internet: S pecify whether to enable VPN-to-In ternet function.
-102- Account Name: Enter the account nam e of L2TP/PPTP tunnel. It should be configured identically on server and client. Password: Enter the password of L2TP/PPT P tunnel. It should be configured identically on server and client. T unnel: Select the network mode for the tunnel.
-103- 3.6 Statu s Activate or inactivate the entry . List of Configurations In this table, you can view your configurations of the tunnels and edit them by the action buttons. The No.1 entry in Figure 3-67 indicates: this tunnel is encapsula ted by using L2TP .
-104- Figure 3-69 List of L2TP/PPTP T unnel Figure 3-69 displays the connection st atus of the NO.1 entry in the list of tunnel in Figure 3-68 . This tunnel has been successfully established. Each tunnel has a T unnel ID and a Session ID. The ID value in client corresponds to that in se rver .
-105- Figure 3-70 General The following items are displayed on this screen: General PPPoE Server: S pecify whether to enable t he PPPoE Server function. Dial-up Access Only: S pecify whether to enable the Dial-up Access Only func tion. If enabled, only the Dial-in Users and the user with Excepti onal IP can access the Internet.
-106- 3.7 Authentication: Select the Authentication type. It can be Local authentication and Remote authentication. Select Loc al authentication for authentication in PPPoE server and select Remo te authentication for authentication in the remote server .
-107- 3.7.1.3 Account IP Address Range: S pecify the start and the end IP address for IP Pool. The start IP address should not exceed the end address and the IP address ranges must not overlap. List of IP Po ol In this table, you can view the information of IP Address Pools and edit them by the Action buttons.
-108- 3.7 IP Address Pool: It's available on Dynamic mode. Select an IP Address Pool to make a range to assign dynamic IPs. Max Sessions: S pecify the maximum number of se ssions for the client. The default value is 1. Expiration Date: S pecify the Expiration Date of t he acco unt.
-109- Figure 3-73 Exceptional IP The following items are displayed on this screen: Exceptional IP IP Address Range: S pecify the st art and the end IP address to make an exceptional IP address range. This range should be in the same IP range with LAN port of the Router .
-1 10- Choose the menu Services → E-Bulletin to load the following page. Figure 3-75 E-Bulletin The following items are displayed on this screen: General Enable E-Bulletin: S pecify whether to enable el ectronic bulletin function . Interval: S pecify the interval to release the bulletin.
- 111 - Object: Select the object of this bulletin. Options include: ANY: The bulletin will be released to all the users and the PCs on the LAN. Group: The bulletin will be released to the users in the selected group.
-1 12- 3.7.3.1 DynDNS if the IP address of the DDNS cli ent has changed. DDNS is usually us ed for the Internet users to access the private website and FTP server , both of which are established based on W eb server . The Router , as a DDNS client, cannot provide DDN S service.
-1 13- 3.7.3.2 No-IP W AN Port: Displays the W AN port for which Dyndns DDNS is selected. DDNS St atus: Displays the current status of DDNS service Offline: DDNS service is disabled. Connecting: client is connecting to the server. Online: DDNS works normally.
-1 14- 3.7 DDNS Service: Activate or inactivate DDNS service here. W AN Port: Displays the W AN port for which No-IP DDNS is selected. DDNS St atus: Displays the current status of DDNS service Offline: DDNS service is disabled. Connecting: client is connecting to the server.
-1 15- 3.7.3.4 Comexe Password: Enter the password of your DDNS account. DDNS Service: Activate or inactivate DDNS service here. W AN Port: Displays the W AN port for whic h PeanutHull DDNS is selected. Service T ype: Displays the DDNS service type, including Professional service and S tandard service.
-1 16- Comexe DDNS Account Name: Enter the Account Name of y our DDNS account. If you have not registered, click <Go to register> to go to the website of Comexe for register . Password: Enter the password of your DDNS account. DDNS Service: Activate or inactivate DDNS service here.
-1 17- Figure 3-80 UPnP The following items are displayed on this screen: General UPnP Funct ion: Enable or disable the UPnP function globally . List of UPnP Mappin g After UPnP is enabled, all UPnP connection rules will be displayed in the list of UPnP Mapping.
-1 18- Figure 3-81 Administrator The following items are displayed on this screen: Administrator Current User Name: Enter the current user name of the Router . Current Password: Enter the current password of the Router . New User Name: Enter a new user name for the Router .
-1 19- The following items are displayed on this screen: General Web Management Port: Enter the Web Management Port for the Router . T elnet Management Port: Enter the T elnet Management Port for the Router .
-120- Subnet/Mask: S pecify a single IP address or network address for the hosts desired to access the Router from external network. Statu s: Activate or inactivate the entry . List of Subnet In this list, you can view the Remote Management entries and edit them by the Action buttons.
-121- 3.8.2.2 Click the <Restore to Factory Defaults> button to rese t all configuration settings to their default values. The default IP address is 192.168. 0.1; the default login user nam e and p assword are both admin. Export and Import Choose the menu Maintenance → Management → Export and Import to load the following page.
-122- Figure 3-86 Reboot Click the <Reboot> button to reboot the Router . The configuration will not be lost after rebooting. The Internet connection will be temporarily interrupted while rebooting. Note: T o avoid damage, please don't turn off the device while rebooting.
-123- Figure 3-88 License 3.8.4 S t atistics 3.8.4.1 Interface T raffic St atistics Interface T raf fic S tatistics screen displays the det ailed traf fic information of each port and extra information of W AN ports. Choose the menu Maintenance → St atistics → Interface T raffic Statistics to load the following p age.
-124- 3.8 Packets Rx: Displays the number of packet s received on the interface. Packets Tx: Displays the number of packet s transmitted on the interface. Bytes Rx: Displays the bytes of packet s received on the interface. Bytes Tx: Displays the bytes of packet s transmitted on the interface.
-125- T raffic St atistics Direction: Select the direction in the drop-dow n list to get the Flow S tatistics o f the specified direction. IP T raffic St atistics This table displays the det ailed traf fic information of corresponding PCs. Sorted by: Select the rule for displayi ng the traf fic information.
-126- 3.8 Ping Destination IP/Domain: Enter destination IP address or Domain name here. Then select a port for testing, if you select “Auto”, the Router will select the interface of destination automatically .
-127- dial-up status. Mode: Detect automatically or Manually . In Auto mode, gateway will be selected as destination for PING detection, DNS server of W AN port will be selected as destinati on for DNS Lookup. In Manual Mode, you can conf igure the destinati on for PING and DNS Lookup manually .
-128- Current Time Syst em T ime : Displays the current date and time of the Router . Time Zone: Displays the current time zone of the Router . Statu s: Displays the status of time capturing Config Get GMT : When this option is selected, you can configure the time zone and the IP Address for the NTP Server .
-129- Figure 3-94 Logs List of Logs List of Logs displays the system l og information in log buf fer . An entry of log contains the following four part s: Config Enable Auto-refresh: With this option selected, the page will refresh automatically every 5 seconds.
-130- Chapter 4 Application 4.1 Network Requirement s The company has established the server farms in the headquarters to provide the Web, Mail and FTP services for all the staf f in the headquarters an d the branch offices, and to transmit the commercial confidential data to it s p artners.
-131- 4.2 Network T opology 4.3 Configurations Y ou can configure the Router via th e PC connected to the LAN port of this Router . T o log in to the Router , the IP address of your PC should be in the same subnet of the LAN por t of this Router . (The default subnet of LAN port is 192.
-132- Figure 4-1 System Mode 4.3.1.2 Internet Connection Configure the St atic IP connection type for the W A N1 and W AN2 ports of the Router . Choose the menu Netw ork → WA N → WA N 1 to load the following page. Select the St atic IP connection type and enter the IP address , Subnet Mask and Default Gateway provided by your ISP .
-133- Figure 4-3 Link Backup 4.3.2 VPN Setting T o enable the hosts in the remote branch of fice (W AN: 1 16.31.85.133, LAN: 172.31.10.1) to access the servers in the headquarters, you can create the VPN tunnel via the TP-LINK VPN routers between t he headquarters and the remote branch office to guar antee a secured communication.
-134- Click the <Add> button to apply . Figure 4-4 IKE Proposal IKE Policy Choose the menu VPN → IKE → IKE Policy to load the configuration p age.
-135- Figure 4-5 IKE Policy Tips: For the VPN Router in the remote branch office, t he IKE settings should be the same as the Router in the headquarters. 2) IPsec Setting T o configure the IPsec function, you sh ould create an IPsec Proposal firstly .
-136- Figure 4-6 IPsec Proposal IPsec Policy Choose the menu VPN → IPsec → IPsec Policy to load the configuration p age. Settings: IPsec: Enable Policy Name: IPsec_1 S tatus: Activate Mode LAN-to-LAN Local Subnet: 192.168.0.0/24 Remote Subnet: 172.
-137- Figure 4-7 IPsec Policy Tips: For the VPN Router in the remote branch office, the IPsec settings should be consistent with the Router in the headquarters. The Remote Gateway of the remote Router should be set to the IP address of the Router in the headquarters.
-138- L2TP/PPTP T unnel Choose the menu VPN → L2TP/PPTP → L2TP/PPTP T unnel to load the following page. Check the box of Enable VPN-to-Internet to allow the PPTP clients to access the local enterprise network and the Internet. Then continue with the following settings for the PPTP T unnel.
-139- 4.3.3 Network Management T o manage the enterprise network effectively and forbid the Hosts within the IP range of 192.168.0.30-192.168.0.50 to use IM/P2P application, you can set up a User Group and specify the network bandwidth limit and session limit for this group.
-140- Action: Add S tart IP Address: 192.168.0.30 End IP Address: 192.168.0.50 Prefix Username: User S tart No.: 1 S tep: 1 Click the OK button to add the Users in bulk. Figure 4-10 User Config - Batch View Choose the menu User Group → Vie w to load the configuration p age.
-141- Figure 4-1 1 App Rules 4.3.3.3 Bandwid th Control T o enable Bandwidth Control, you s hould configure the total bandwid th of interfaces and the detailed bandwidth control rule first. 1) Enable Bandwidth Control Choose the menu Advanced → T raffic Control → Setup to load the configuration page.
-142- 3) Bandwidth Control Rule Choose the menu Advanced → T raffic Control → Bandw id th C ontrol to load the configuration p age. Then continue with the following settings: Settings: Direction: .
-143- Figure 4-15 Session Limit 4.3.4 Network Security Y ou can enable the IP-MAC Binding f unction to defend the ARP attack fr om local or public network and enable Sending GARP packet s function to defend ARP attack. Moreover , you can enable DoS Defense function to implement fl ood defense and Packet Anomaly Def ense.
-144- Choose the menu Firewall → Anti ARP S poofing → IP-MAC Binding to load the configuration p age. Select the ARP entries needed to be bound or c lick the <Select All> button, and then click the <Import>button. The ARP List will di splay as the following figure shows.
-145- Choose the menu Firewall → Anti ARP S poofing → ARP Scanning to load the configuration p age. Enter the default gateway of the W AN port such as 58.51.128.254 in t he Scanning Range field and click the <Scan> button, the MAC address of the W A N port will display in the Scanning Result table.
-146- 4.3.4.4 T raffic Monitoring 1) Port Mirror Choose the menu Network → Sw itch → Port Mirror to load the configuration page. Check the bo x before Enable Port Mirror and select the Ingress&Egress mode. Select the Port 5 for the Mirroring Port and the Port 3 and the Port 4 for the Mirrored ports.
-147- Figure 4-23 IP T raf fic S tatistics After all the above step s, the enterpris e network will be operated based on planning..
-148- Appendix A Hardware S pecifications General S tandards IEEE 802.3, IEEE 802.3u, IEEE 802. 3ab, IEEE 802.3x, IEEE 802.1 1b, IEEE 802.1 1g and IEEE 802.
-149- Appendix B F AQ Q1. What can I do if I cannot access the web-based configuration page? 1. For the first login, pl ease try the following steps: 1) Make sure the cable is well connected to t he LAN port of the Router . The corresponding LED should flash or be solid light.
-150- Q3: What can I do if the Router with the re mote management function enabled cannot be accessed by the remote computer? 1. Make sure that the IP address of the remote com puter is in the subnet allowed to remotely access the router .
-151- Appendix C Glossary Glossary Description ALG （ Application Layer Gateway ） Application Level Gateway (A LG) is application specifi c translation agent that allows an application on a host in one address realm to connect to its counterpart running on a host in different realm transparently .
-152- Glossary Description H.323 H.323 allows dissimilar communica tion devices to communicate with each other by using a standardized communication protocol. H.323 defines a comm on set of CODECs, call setup and negotiating procedures, and basic data transport methods.
-153- Glossary Description MAC address （ Media Access Control address ） S tandardized data link layer address that is required for every port or device that connects to a LAN. Other devices in th e network use these addresses to lo cate specific ports in the network and to create and update routing tables and data structures.
-154- Glossary Description Network protocol ） log in to remote systems and us e resources as if they we re connected to a local system. UDP （ User Datagram Protocol ） UDP is a simple protocol th.
Un point important après l'achat de l'appareil (ou même avant l'achat) est de lire le manuel d'utilisation. Nous devons le faire pour quelques raisons simples:
Si vous n'avez pas encore acheté TP-Link TL-ER604W SafeStream c'est un bon moment pour vous familiariser avec les données de base sur le produit. Consulter d'abord les pages initiales du manuel d'utilisation, que vous trouverez ci-dessus. Vous devriez y trouver les données techniques les plus importants du TP-Link TL-ER604W SafeStream - de cette manière, vous pouvez vérifier si l'équipement répond à vos besoins. Explorant les pages suivantes du manuel d'utilisation TP-Link TL-ER604W SafeStream, vous apprendrez toutes les caractéristiques du produit et des informations sur son fonctionnement. Les informations sur le TP-Link TL-ER604W SafeStream va certainement vous aider à prendre une décision concernant l'achat.
Dans une situation où vous avez déjà le TP-Link TL-ER604W SafeStream, mais vous avez pas encore lu le manuel d'utilisation, vous devez le faire pour les raisons décrites ci-dessus,. Vous saurez alors si vous avez correctement utilisé les fonctions disponibles, et si vous avez commis des erreurs qui peuvent réduire la durée de vie du TP-Link TL-ER604W SafeStream.
Cependant, l'un des rôles les plus importants pour l'utilisateur joués par les manuels d'utilisateur est d'aider à résoudre les problèmes concernant le TP-Link TL-ER604W SafeStream. Presque toujours, vous y trouverez Troubleshooting, soit les pannes et les défaillances les plus fréquentes de l'apparei TP-Link TL-ER604W SafeStream ainsi que les instructions sur la façon de les résoudre. Même si vous ne parvenez pas à résoudre le problème, le manuel d‘utilisation va vous montrer le chemin d'une nouvelle procédure – le contact avec le centre de service à la clientèle ou le service le plus proche.
