Lancom 1721+ VPN User manual

110739/0409

LANCOM Systems GmbH

Adenauerstr. 20/B2

52146 Würselen

Germany

E-Mail: [email protected]

Internet www.lancom.eu

LANCOM 821+

LANCOM 1711+ VPN

LANCOM 1721+ VPN

LANCOM 821+ LANCOM 1711+ VPN LANCOM 1721 VPN

쮿

Handbuch

쮿

Manual

...connecting your business

110739_LC-821plus-1711plus-1721p1 1110739_LC-821plus-1711plus-1721p1 1 20.04.2009 10:32:3020.04.2009 10:32:30

LANCOM 821+

LANCOM 1711+ VPN

LANCOM 1721+ VPN

While the information in this manual has been compiled with great care, it may not be deemed an assurance of product

characteristics. LANCOM Systems shall be liable only to the degree specified in the terms of sale and delivery.

The reproduction and distribution of the documentation and software supplied with this product and the use of its contents

is subject to written authorization from LANCOM Systems. We reserve the right to make any alterations that arise as the

result of technical development.

Windows®, Windows Vista™, Windows NT® and Microsoft® are registered trademarks of Microsoft, Corp.

The LANCOM Systems logo, LCOS and the name LANCOM are registered trademarks of LANCOM Systems GmbH. All other

names or descriptions used may be trademarks or registered trademarks of their owners.

Subject to change without notice. No liability for technical errors or omissions.

Products from LANCOM Systems include software developed by the OpenSSL Project for use in the OpenSSL Toolkit (http:/

/www.openssl.org/).

Products from LANCOM Systems include cryptographic software written by Eric Young (eay@cryptsoft.com

).

Products from LANCOM Systems include software developed by the NetBSD Foundation, Inc. and its contributors.

Products from LANCOM Systems contain the LZMA SDK developed by Igor Pavlov.

LANCOM Systems GmbH

Adenauerstr. 20/B2

52146 Wuerselen

Germany

www.lancom.eu

Wuerselen, April 2009

11

0

7

39

/

0

4

09

LANCOM 821+ – LANCOM 1711+ VPN – LANCOM 1721+ VPN

 Preface

3

EN

Preface

Thank you for placing your trust in this

LANCOM Systems

product.

With the LANCOM Router you have chosen a powerful router that possesses

integrated DSL respectively ADSL and ISDN interfaces by default as well as an

integrated 4-port switch. With this router you can simply and comfortably

connect individual PCs or whole local networks to the high-speed Internet.

Model variants

This user manual applies to the following models of the LANCOM Router

series:

 LANCOM 821+

 LANCOM 1721+ VPN

 LANCOM 1711+ VPN

Model

restriction

The sections of the documentation that refer only to a range of models are

marked either in the corresponding text itself or with appropriate comments

placed beside the text.

In the other parts of the documentation, all described models have been clas-

sified under the general term LANCOM Router.

Security settings

To maximize the security available from your product, we recommend that you

undertake all of the security settings (e.g. firewall, encryption, access protec-

tion) that were not already activated when you purchased the product. The

LANconfig Wizard 'Security Settings' will help you with this task. Further infor-

mation is also available in the chapter 'Security settings'.

We would additionally like to ask you to refer to our Internet site

www.lancom.eu

for the latest information about your product and technical

developments, and also to download our latest software versions.

LANCOM 821+ – LANCOM 1711+ VPN – LANCOM 1721+ VPN

 Preface

4

EN

Components of the documentation

The documentation of your device consists of the following parts:

 Installation Guide

 User manual

 PBX Functions manual

 Reference manual

 Menu Reference Guide

You are now reading the user manual.

It contains all information you need to put your device into operation. It also

contains all of the important technical specifications.

The Reference Manual is to be found as an Acrobat document (PDF file) at

www.lancom.eu/download

or on the CD supplied. It is designed as a supple-

ment to the user manual and goes into detail on topics that apply to a variety

of models. These include, for example:

 The system design of the operating system LCOS

 Configuration

 Management

 Diagnosis

 Security

 Routing and WAN functions

 Firewall

 Quality of Service (QoS)

 Virtual Private Networks (VPN)

 Virtual Local Networks (VLAN)

 Wireless networks (WLAN)

 Backup solutions

 LANCAPI

 Further server services (DHCP, DNS, charge management)

The Menu Reference Guide (also available at www.lancom.eu/download

or on

the CD supplied) describes all of the parameters in LCOS, the operating system

used by LANCOM products. This guide is an aid to users during the configu-

ration of devices by means of WEBconfig or the telnet console.

LANCOM 821+ – LANCOM 1711+ VPN – LANCOM 1721+ VPN

 Preface

5

EN

This documentation was created by …

... several members of our staff from a variety of departments in order to

ensure you the best possible support when using your

LANCOM

product.

Should you find any errors, or if you would like to suggest improvements,

please do not hesitate to send an e-mail directly to:

[email protected]



Our online services www.lancom.eu are available to you around the

clock if you have any questions on the content in this manual, or if you

require any further support. The area 'Support' will help you with

many answers to frequently asked questions (FAQs). Furthermore, the

knowledgebase offers you a large reserve of information. The latest

drivers, firmware, utilities and documentation are constantly available

for download.

In addition, LANCOM Support is available. For telephone numbers

and contact addresses for LANCOM Support, please refer to the

enclosed leaflet or the LANCOM Systems Web site.

Information symbols



Very important instructions. Failure to observe these may result in damage.



Important instruction that should be observed.



Additional information that may be helpful but is not essential.

LANCOM 821+ – LANCOM 1711+ VPN – LANCOM 1721+ VPN

 Contents

6

EN

Contents

1 Introduction 9

1.1 How do ADSL and ADSL 2+ work? 9

1.2 What does VPN offer? 10

2 Installation 14

2.1 Package contents 14

2.2 System requirements 14

2.3 Status displays and interfaces 15

2.3.1 Device connectors 19

2.4 Hardware installation 22

2.5 Software installation 23

2.5.1 Starting the software setup 24

2.5.2 Which software should I install? 24

3 Basic configuration 25

3.1 What details are necessary? 25

3.1.1 TCP/IP settings 25

3.1.2 Configuration protection 27

3.1.3 Settings for the wireless LAN 28

3.1.4 Settings for the DSL connection 29

3.1.5 Settings for the ISDN Connection 29

3.1.6 Charge protection 29

3.2 Instructions for LANconfig 30

3.3 Instructions for WEBconfig 31

3.4 TCP/IP settings for PC workstations 35

4 Setting up Internet access 37

4.1 The Internet Connection Wizard 39

4.1.1 Instructions for LANconfig 39

4.1.2 Instructions for WEBconfig 40

LANCOM 821+ – LANCOM 1711+ VPN – LANCOM 1721+ VPN

 Contents

7

EN

5 Connecting two networks 41

5.1 Which details are necessary? 42

5.1.1 General information 42

5.1.2 Settings for the TCP/IP router 44

5.1.3 Settings for the IPX router 45

5.1.4 Settings for NetBIOS routing 46

5.2 Instructions for LANconfig 47

5.3 1-Click-VPN for networks (site-to-site) 48

5.4 Instructions for WEBconfig 49

6 Providing dial-in access 51

6.1 Which details are necessary? 51

6.1.1 General information 52

6.1.2 Settings for TCP/IP 53

6.1.3 Settings for IPX 54

6.1.4 Settings for NetBIOS routing 54

6.2 Settings on the dial-in computer 55

6.2.1 Dialing-in via VPN 55

6.2.2 Dialing-in via ISDN 55

6.3 Instructions for LANconfig 56

6.4 1-Click-VPN for LANCOM Advanced VPN Client 56

6.5 Instructions for WEBconfig 57

7 Fax transmission with LANCAPI 58

7.1 Installing the LANCOM CAPI Faxmodem 59

7.2 Installing the MS Windows Fax Service 60

7.3 Sending a fax 61

7.3.1 Sending faxes from an office application 61

7.3.2 Sending faxes with the Windows Fax Service 61

8 Security settings 63

8.1 Security settings Wizard 63

8.1.1 LANconfig Wizard 63

8.1.2 WEBconfig Wizard 64

8.2 The security checklist 64

LANCOM 821+ – LANCOM 1711+ VPN – LANCOM 1721+ VPN

 Contents

8

EN

9 Advice & assistance 68

9.1 No WAN connection can be established 68

9.2 DSL data transfer is slow 68

9.3 Unwanted connections under Windows XP 69

9.4 Cable testing 69

10 Appendix 71

10.1 Performance data and specifications 71

10.2 Connector wiring 72

10.2.1 WAN interface 72

10.2.2 ADSL interface 72

10.2.3 ISDN-S

0

interface 73

10.2.4 Ethernet interface 10/100Base-T 73

10.2.5 Configuration interface (outband) 74

10.3 Declaration of conformity 74

11 Index 75

LANCOM 821+ – LANCOM 1711+ VPN – LANCOM 1721+ VPN

 Chapter 1: Introduction

9

EN

1Introduction

The models LANCOM 821+, LANCOM 1721+ VPN and LANCOM 1711+ VPN

are fully-featured routers that therefore also can be used in combination with

the integrated firewall for providing secure Internet access to a complete local

network (LAN).

The VPN option, which is either integrated already or can be activated subs-

quently, enables the LANCOM 1721+ VPN and LANCOM 1711+ VPN to act as

powerful Dynamic VPN gateways for external offices or mobile users.

The LANCOM Router models offer each a DSL or ADSL connector and also an

ISDN connector. The ISDN line can be used as back- up for the DSL connection,

for remote management of the router, as basis for the office communication

via LANCAPI or for establishing VPN connections to remote sites with dynamic

IP addresses.

By using the Voice over IP function, these devices can transfer voice data over

broadband Internet connections as well.

1.1 How do ADSL and ADSL 2+ work?

ADSL (Asymmetric Digital Subscriber Line) is currently the most common tech-

nology for broadband Internet connections. Standard and almost ubiquitous

telephone lines (analog or DSL) are the basis for DSL data transfer to the near-

est telephone exchange. From here, the data is passed directly on to the Inter-

net over high-speed connections.

The asymmetric DSL variant ADSL was developed for applications where users

receive large amounts of data but transmit only small amounts, such as when

surfing in the WWW. ADSL subscribers can receive data at up to 8 Mbps

("downstream") and transmit at up to 800 kbps ("upstream"). ADSL providers

are able to reduce these maximum rates as they please.

To satisfy the strongly increasing demand for higher bandwidths, the stand-

ards ADSL 2 and ADSL 2+ provider higher data rates as a basis for applica-

tions such as video streaming or high-definition TV (HDTV) over the Internet.

Depending on the Internet provider, ADSL 2 devices support downstream data

rates of up to 12 Mbps, and ADSL 2+ devices support up to 24 Mbps. Hand-

shake routines during connection establishment ensure that the standards

ADSL, ADSL 2 and ADSL 2+ are intercompatible.

Parallel to data transfer, ADSL also provides full and unlimited support for the

classic applications in telephony (telephone, fax, answering machine, PBX).

LANCOM 821+ – LANCOM 1711+ VPN – LANCOM 1721+ VPN

 Chapter 1: Introduction

10

EN

This is facilitated by splitters which separate the voice frequencies from the

data frequencies.

1.2 What does VPN offer?

For LANCOM

1711+ VPN and

LANCOM 1721+

VPN only

A VPN (Virtual Private Network) can be used to set up secure data communi-

cations over the Internet.



The models LANCOM 1721+ VPN and LANCOM 1711+ VPN are fac-

tory equipped to support VPN with 5 active tunnels. With the addi-

tional LANCOM VPN Option, VPN support can be extended to 25

active tunnels (incl. activated hardware accelerator).

The following structure results when using the Internet instead of direct con-

nections:

All participants have fixed or dial-up connections to the Internet. Expensive

dedicated lines are no longer needed.

 All that is required is the Internet connection of the LAN in the headquar-

ters. Special switching devices or routers for dedicated lines to individual

participants are superfluous.

 The subsidiary also has its own connection to the Internet.

HEADQUARTER

VPN GATEWAY

LAN

SERVER

LAPTOP

INTERNET

VPN ROUTER ROUTER

BRANCH

LAN

LANCOM 821+ – LANCOM 1711+ VPN – LANCOM 1721+ VPN

 Chapter 1: Introduction

11

EN

 The RAS PCs connect to the headquarters LAN via the Internet.

The Internet is available virtually everywhere and typically has low access

costs. Significant savings can thus be achieved in relation to switched or ded-

icated connections, especially over long distances.

The physical connection no longer exists directly between two participants;

instead, the participants rely on their connection to the Internet. The access

technology used is not relevant in this case: Broadband technology such as

DSL (Digital Subscriber Line) is ideal. A conventional ISDN line can be used,

too.

The technologies of the individual participants do not have to be compatible

to one another, as would be the case for conventional direct connections. A

single Internet access can be used to establish multiple simultaneous logical

connections to a variety of remote sites.

The resulting savings and high flexibility makes the Internet (or any other IP

network) an outstanding backbone for a corporate network.

What can your LANCOM Router do?The following table contains a direct

comparison of the properties and functions of your devices with other models:

LANCOM

821+

LANCOM

1711+ VPN

LANCOM

1721+ VPN

Applications

Internet access

✔✔✔

LAN to LAN coupling via VPN

✔✔

LAN to LAN coupling via ISDN

✔✔✔

RAS server (via VPN)

✔✔

RAS server (via ISDN)

✔✔✔

IP router

✔✔✔

IPX router (via ISDN), e.g. for coupling of Novell networks or dialling into

Novell networks

✔

NetBIOS proxy for coupling of Microsoft peer-to-peer networks via ISDN

✔✔✔

DHCP and DNS server (for LAN and WAN)

✔✔✔

N:N mapping for coupling networks using the same IP address ranges

✔✔✔

Bridge function for coupling networks via ISDN connection

✔✔✔

LANCOM 821+ – LANCOM 1711+ VPN – LANCOM 1721+ VPN

 Chapter 1: Introduction

12

EN

Port-Mapping to set up LAN ports as additional WAN ports

✔✔

Policy-based routing for policy-based selection of target routes

✔✔✔

Load-balancing for bundling of multiple DSL channels 2 channels 4 channels 4 channels

Backup solutions and load balancing with VRRP

✔✔✔

NAT Traversal (NAT-T)

✔✔✔

DMZ with configurable IDS checks

✔✔✔

PPPoE-Server

✔✔✔

WAN-RIP

✔✔✔

Spanning Tree Protocol

✔✔✔

Layer-2-QoS-Tagging

✔✔✔

ISDN leased lines

✔✔✔

LANCAPI server for the operating with office applications as fax or

answering machine via ISDN interface

✔✔✔

WAN connection

Connection for DSL or cable modem

✔✔✔

Integrated ADSL modem (ADSL2+ ready)

✔✔

ISDN S

0

bus in multi device-mode or in point-to-point mode with auto-

matic D-channel protocol identification. Supports static and dynamic

channel bundling per MLPPP and BACP as well as Stac data compression

(Hi/fn)

✔✔✔

Port for external modem, analogue or GSM (requires LANCOM modem

adapter kit; from LCOS 5.0)

✔✔✔

LAN connection

4 individual Fast Ethernet LAN ports, switchable separately, e.g. as LAN

switch or separate DMZ ports, auto crossover.

✔✔✔

USB connector

USB 2.0 host port (full speed: 12 Mbps) for connecting a USB printer and

for future extensions

✔✔

Security functions

IPSec encryption in external software (VPN client)

✔✔

5 integrated VPN tunnels for protection of network connections

✔✔

IPSec encryption in hardware (optional; activated with the VPN-25

option)

✔✔

IP masquerading (NAT, PAT) to conceal individual LAN workstations

behind a single public IP address.

✔✔✔

LANCOM

821+

LANCOM

1711+ VPN

LANCOM

1721+ VPN

LANCOM 821+ – LANCOM 1711+ VPN – LANCOM 1721+ VPN

 Chapter 1: Introduction

13

EN

Stateful Inspection Firewall

✔✔✔

Firewall filter for blocking individual IP addresses, protocols and ports

✔✔✔

MAC address filter regulates, for example, LAN-workstation access to the

IP routing function

✔✔✔

Protection of the configuration from brute-force attacks.

✔✔✔

Configuration

Configuration with LANconfig or with web browser, additionally terminal

mode for Telnet or other terminal programs, SNMP interface and TFTP

server function.

✔✔✔

Remote configuration via ISDN (with ISDN-PPP connections e.g. via Win-

dows network and dial-up connections)

✔✔✔

Serial configuration interface

✔✔✔

Callback function with PPP authentication mechanisms for restriction to

fixed ISDN telephone numbers

✔✔✔

FirmSafe with firmware versions for absolutely secure software upgrades

✔✔✔

Optional software extensions

LANCOM VPN Option with 25 active tunnels for protection of network

couplings

✔✔

Optional hardware extensions

LANCOM Modem Adapter Kit for connection of analog or GSM modems

to the serial interface

✔✔✔

LANCOM

821+

LANCOM

1711+ VPN

LANCOM

1721+ VPN

LANCOM 821+ – LANCOM 1711+ VPN – LANCOM 1721+ VPN

 Chapter 2: Installation

14

EN

2 Installation

This chapter will assist you to quickly install hardware and software. First,

check the package contents and system requirements. The device can be

installed and configured quickly and easily if all prerequisites are fulfilled.

2.1 Package contents

Please check the package contents for completeness before starting the

installation. In addition to the device itself, the package should contain the

following accessories:

If anything is missing, please contact your retailer or the address stated on the

delivery slip of the unit.

2.2 System requirements

Computers that connect to a LANCOM must meet the following minimum

requirements:

LANCOM 821+

LANCOM 1721+ VPN

LANCOM 1711+ VPN

Power adapter

✔✔✔

LAN connector cable (green plugs)

✔✔✔

WAN connector cable (dark blue plugs)

✔

ADSL connector cable (transparent plugs)

✔✔

ISDN connector cable (light blue plugs)

✔✔✔

Connector cable for the configuration interface

✔✔✔

LANCOM CD

✔✔✔

Printed documentation

✔✔✔

LANCOM 821+ – LANCOM 1711+ VPN – LANCOM 1721+ VPN

 Chapter 2: Installation

15

EN

 Operating system that supports TCP/IP, e.g. Windows Vista™,

Windows XP, Windows Millennium Edition (Me), Windows 2000, Win-

dows 98, Linux, BSD Unix, Apple Mac OS, OS/2.

 Access to the LAN via the TCP/IP protocol.



The LANtools also require a Windows operating system. A web

browser under any operating system provides access to WEBconfig.

2.3 Status displays and interfaces

Meanings of the LEDs

In the following sections we will use different terms to describe the behaviour

of the LEDs:

 Blinking means, that the LED is switched on or off at regular intervals in

the respective indicated colour.

 Flashing means, that the LED lights up very briefly in the respective col-

our and stay then clearly longer (approximately 10x longer) switched off.

 Inverse flashing means the opposite. The LED lights permanently in the

respective colour and is only briefly interrupted.

 Flickering means, that the LED is switched on and off in irregular inter-

vals.

Front side

The various LANCOM Router models have different numbers of indicators on

the front panel depending on their functionality.

LANCOM 821+ and

LANCOM 1721+ VPN

LANCOM 1711+ VPN

LANCOM

1721

VPN

Power

ADSL Status

Online

ADSL Data

ETH 3

ETH 4

ISDN Status

ISDN Data

ETH 1

ETH 2

VPN



not available on LANCOM 821+







1711+ VPN

Power

WAN Status

Online

WAN Data

ETH 3

ETH 4

ISDN Status

ISDN Data

ETH 1

ETH 2

VPN













LANCOM 821+ – LANCOM 1711+ VPN – LANCOM 1721+ VPN

 Chapter 2: Installation

16

EN

Top

The two top-mounted LEDs enable the main function status to be assessed

even if the device is positioned vertically.



Power

This LED indicates that the device is operational. After the device has been

switched on, it will flash green for the duration of the self-test. After the self-

test, either an error is output by a flashing red light code or the device starts

and the LED remains lit green.



The power LED flashes red/green in alternation until a configuration

password has been specified. Without a configuration password, the

configuration data of the LANCOM is insecure. Under normal circum-

stances, you would assign a configuration password during the basic

configuration (see instructions in the following chapter). For informa-

tion about a later assignment of the configuration password see the

section “Security settings”.

Power

Online

off Device off

green blinking Self-test when powering up

green constantly on Device ready for use

red/

green

blinking alternately Device insecure: configuration password not assigned

red blinking Time or connect-charge reached

LANCOM 821+ – LANCOM 1711+ VPN – LANCOM 1721+ VPN

 Chapter 2: Installation

17

EN

 Online

The online LED displays the general status of all WAN interfaces:



ADSL status

( LANCOM

821+ and

LANCOM

1721+ VPN

only)

Information on connection status at the ADSL connector:

Flashing Power LED but no connection?

There's no need to worry if the Power LED blinks red and you can no

longer connect to the WAN. This simply indicates that a preset time or

connect-charge limit has been reached. There are three methods

available for unlocking:

 Reset connect charge protection.

 Increase the limit that has been reached.

 Completely deactivate the lock that has been triggered (set limit

to '0').

If a time or connect charge limit has been reached, you will be notified in LANmonitor. To

reset the connect charge protection, select Reset Charge and Time Limits in the context

menu (right mouse click). You can configure the connect charge settings in LANconfig under

Management  Costs (you will only be able to access this configuration if 'Complete con-

figuration display' is selected under View  Options…).

You will find the connect charge protection reset in WEBconfig and all parameters under

Expert Configuration  Setup  Charges-module.

Signal for reached time

or connect-charge

limit

P

ower

P

ower

Off No active connection

Green Flashing Opening the first connection

Green Inverse flashing Opening an additional connection

Green On (perma-

nently)

At least one connection is established

Red On (perma-

nently)

Error establishing the last connection

Off Interface deactivated

Green Blinking/flashing Handshake/training

Green Permanently Synchronization successful

Red Flickering Error (CRC error, framing error, etc.)

Red On (permanently) No synchronization, searching for remote station

Red/

orange

Blinking Hardware error

LANCOM 821+ – LANCOM 1711+ VPN – LANCOM 1721+ VPN

 Chapter 2: Installation

18

EN

 ADSL data

( LANCOM

821+ and

LANCOM

1721+ VPN

only)

Information on data traffic at the ADSL connector:



WAN Status

(only LANCOM

1711+ VPN)

Connection status of the WAN connection:



WAN Data

(only LANCOM

1711+ VPN)

Data traffic via the WAN connection:



ISDN status

Information on connection status at the ISDN S

0

connector:



If the ISDN status LED goes off automatically, this does not indicate

an error at the S

0

bus. It is in fact because several ISDN connections

and PBXs switch the S

0

bus into power-saving mode after a certain

Off No logical connection

Green Blinking Opening the first connection

Green Inverse flashing Opening an additional connection

Green Permanently At least one logical connection is established

Green Inverse flickering Data traffic (send or receive)

off not connected

green blinking Establishing first connection

green invers flashing Establishing further connection

green constantly on At least one connection established

red constantly on Error while establishing connection

off No network device connected

green constantly on Connection to network device operational, no data traffic

green flickering Data traffic (send or receive)

Off Not connected or no S

0

voltage (no error message)

Green Blinking D-channel initialization (establishing contact to provider)

Green On (perma-

nently)

D-channel operational

Red Flickering D-channel error

Red On (perma-

nently)

D-channel activation failed

LANCOM 821+ – LANCOM 1711+ VPN – LANCOM 1721+ VPN

 Chapter 2: Installation

19

EN

period of inactivity. When needed, the S

0

bus automatically reacti-

vates and the ISDN status LED illuminates in green.



ISDN Data

Status display for both ISDN B channels:



ETH

LAN connector status in the integrated switch:



VPN

Status of a VPN connection.

2.3.1 Device connectors

The connections and switches of the router are located on the back panel:

off No connection established

green Blinking Dialling

green Flashing Establishing first connection

green Inverse flashing Establishing further connection

green Constantly on Connection established via B channel

green Flickering Data traffic (send or receive)

Off No networking device attached

Green On (perma-

nently)

Connection to network device operational, not data traffic

Green Flickering Data traffic

Red Flickering Data packet collision

Off No VPN tunnel established

Green Blinking Connection establishment

Green Flashing First connection

Green Inverse flashing Other connections

Green On (perma-

nently)

VPN tunnels are established

Page is loading ...

Lancom 1721+ VPN User manual

This manual is also suitable for

Lancom 1721+ VPN User manual

Related papers

Other documents