User manual DRAYTEK VIGOR 2710N VERSION 2.1

[. . . ] i Vigor2710 Series User's Guide Vigor2710 Series User's Guide ii Vigor2710 Series ADSL2/2+ Firewall Router User's Guide Version: 2. 0 Date: 21/07/2009 iii Vigor2710 Series User's Guide Copyright Information Copyright Declarations Copyright 2009 All rights reserved. No part may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language without written permission from the copyright holders. The following trademarks are used in this document: Microsoft is a registered trademark of Microsoft Corp. Windows, Windows 95, 98, Me, NT, 2000, XP, Vista and Explorer are trademarks of Microsoft Corp. [. . . ] Stateful Packet Inspection (SPI): tracks packets and denies unsolicited incoming data Selectable Denial of Service (DoS) /Distributed DoS (DDoS) attacks protection IP Filters Depending on whether there is an existing Internet connection, or in other words "the WAN link status is up or down", the IP filter architecture categorizes traffic into two: Call Filter and Data Filter. Call Filter - When there is no existing Internet connection, Call Filter is applied to all traffic, all of which should be outgoing. Then the router shall "initiate a call" to build the Internet connection and send the packet to Internet. Data Filter - When there is an existing Internet connection, Data Filter is applied to incoming and outgoing traffic. The following illustrations are flow charts explaining how router will treat incoming traffic and outgoing traffic respectively. 121 Vigor2710 Series User's Guide Stateful Packet Inspection (SPI) Stateful inspection is a firewall architecture that works at the network layer. Unlike legacy static packet filtering, which examines a packet based on the information in its header, stateful inspection builds up a state machine to track each connection traversing all interfaces of the firewall and makes sure they are valid. The stateful firewall of Vigor router not just examine the header information also monitor the state of the connection. Denial of Service (DoS) Defense The DoS Defense functionality helps you to detect and mitigate the DoS attack. The attacks are usually categorized into two types, the flooding-type attacks and the vulnerability attacks. The flooding-type attacks will attempt to exhaust all your system's resource while the vulnerability attacks will try to paralyze the system by offending the vulnerabilities of the protocol or operation system. The DoS Defense function enables the Vigor router to inspect every incoming packet based on the attack signature database. Any malicious packet that might duplicate itself to paralyze the host in the secure LAN will be strictly blocked and a Syslog message will be sent as warning, if you set up Syslog server. Any abnormal traffic flow violating the pre-defined parameter, such as the number of thresholds, is identified as an attack and the Vigor router will activate its defense mechanism to mitigate in a real-time manner. The below shows the attack types that DoS/DDoS defense function can detect: 1. Unknown protocol Below shows the menu items for Firewall. Vigor2710 Series User's Guide 122 4. 4. 2 General Setup General Setup allows you to adjust settings of IP Filter and common options. Under some circumstance, your filter set can be linked to work in a serial manner. Also you can configure the Log Flag settings, Apply IP filter to VPN incoming packets, and Accept incoming fragmented UDP packets. Click Firewall and click General Setup to open the general setup page. Call Filter Data Filter Filter Check Enable to activate the Call Filter function. Select Pass or Block for the packets that do not match with the filter rules. IM/P2P Filter Select a CSM profile for global IM/P2P application blocking. All the hosts in LAN must follow the standard configured in the CSM profile selected here. For troubleshooting needs, you can specify to record information for IM/P2P by checking the Log box. Please refer to section 3. 14. 4 Syslog/Mail Alert for more detailed information. Select one of the URL Content Filter profile settings (created in CSM>> URL Content Filter) for applying with this router. [. . . ] Make sure the ACT LED blink once per second and the correspondent LAN LED is bright. 3. If not, it means that there is something wrong with the hardware status. Simply back to "1. 3 Hardware Installation" to execute the hardware installation again. And then, try again. 283 Vigor2710 Series User's Guide 6. 2 Checking If the Network Connection Settings on Your Computer Is OK or Not Sometimes the link failure occurs due to the wrong network connection settings. After trying the above section, if the link is stilled failed, please do the steps listed below to make sure the network connection settings is OK. For Windows The example is based on Windows XP. [. . . ]