Gebruiksaanwijzing /service van het product TL-ER6120 SafeStream van de fabrikant TP-Link
Ga naar pagina of 167
TL-ER6120 Gigabit Dual-WAN VPN Router Rev: 1.0.1 1910010558.
-I- COPYRIGHT & TRADEMARKS Specifications are subjec t to change without notice. is a registered trademark of TP-LINK TECHNOLOGIES CO., L TD. Other brands and product names are trademarks of their respective holders.
-II- CONTENTS Package Contents .................................................................................................................. 1 Chapter 1 About this Guide ............................................................................
-III- 3.3.3 Session Li mit ........................................................................................................... 57 3.3.4 Load Balanc e .............................................................................................
-IV- 4.2 Network T opol ogy............................................................................................................... 126 4.3 Configur ations ........................................................................................
-1- Package Content s The following items should be found in your box: ¾ One TL-ER6120 Router ¾ One power cord ¾ One console cable ¾ One ground cable ¾ Two mounting brackets and other fittings ¾.
-2- Chapter 1 About this Guide This User Guide contains information for se tup and management of TL-E R6120 Router . Please read this guide carefully before operation. 1.1 Intended Readers This Guide is intended for Network Engineer and Network Administrator.
-3- Appendix A Hardwar e S pecifications Lists the hardware specific ations of this Router . Appendix B F AQ Provides the possible solutions to the problems that may occur during the installation and operation of the router . Appendix C Glossary Lists the glossary used in this guide.
-4- Chapter 2 Introduction Thanks for choosing the SafeS tream TM Gigabit Dual-W AN VPN Router TL-ER6120. 2.1 Overview of the Router The SafeS tream TM Gigabit Dual-W AN VPN Router TL-ER 6120 from TP-.
-5- z Dual-W AN Ports + Providing two 10/100/1000M WAN ports for use r s to connect two Internet lines for bandwidth expansion. + Supporting multiple Load Balance modes, including Bandwidth Based Balance Routing, Application Optimized Routing, and Polic y Routing to optimize bandwidth usage.
-6- ¾ Supports Diagnostic (Ping/T r acert) and Online Detection VPN ¾ Supports IPsec VPN and provides up to 100 IPsec VPN tunnels ¾ Supports IPSec VPN in LAN-to-LAN or Client-to-LAN ¾ Provides DES.
-7- z LEDs LED Status Indication On The Router is powered on PWR Off The Router is powered off or power supply is abnormal Flashing The Router works properly SYS On/Off The Router works improperly On .
-8- 2.3.2 Rear Panel The rear panel of TL-ER6120 is shown as the following figure. z Power Socket Connect the female connector of the power cord to this power socket, and the male connector to the AC power outlet. Please make sure the voltage of the pow er supply meets the requirement of the input voltage (100-240V~ 50/60Hz).
-9- Chapter 3 Configuration 3.1 Network 3.1.1 S t atus The S tatus page shows the system information, the port connection st atus and other information related to this Router . Choose the menu Network → Stat us to load the following page. Figure 3-1 S t atus 3.
-10- Figure 3-2 Network T opology - NA T Mode If your Router is connecting the two networks of di fferent areas in a large network environment with a network topology as the Figure 3-3 shown, and forwards the packets between these two networks by the Routing rules, you can set it to Non-NA T mode.
-1 1- Figure 3-4 Network T opology – Classic Mode Choose the menu Network → System Mode to load the following page. Figure 3-5 System Mode Y ou can select a System Mode for your R outer according to your network need.
-12- z Non-NA T Mode In this mode, the Router functi ons as the traditional Gateway and fo rwards the packets via routing protocol. The Hosts in dif ferent subnets can co mm unicate with one another via the routing rules whereas no NA T is employed.
-13- Figure 3-6 W AN – S tatic IP The following items are displayed on this screen: ¾ St atic IP Connection T ype: Select S tatic IP if your ISP has assigned a static IP address for your computer . IP Address: Enter the IP address assigned by your ISP .
-14- Secondary DNS: Optional. If a Secondary DNS Server address is available, enter it. Up stream Bandwidth: S pecify the bandwidth for transmitting p ackets o n the port. Downstream Bandwidth: S pecify the b andwidth for receiving p ackets on the port.
-15- ¾ Dyn am ic I P Connection T ype: Select Dynamic IP if your ISP assigns the IP address automatically . Click <Obt ain> to get the IP address from your ISP’s serv er . Cli ck <Release> to release the current IP address of W AN port.
-16- ¾ Dynamic IP S t atus Statu s: Displays the status of obt aining an IP address fr om your ISP . z “Disabled” indicates that the Dynamic IP connection type is not applied. z “Connecting” indicates that the Router is obtaining the IP parameters from your ISP .
-17- Figure 3-8 W AN - PPPoE.
-18- The following items are displayed on this screen: ¾ PPPoE Settings Connection T ype: Select PPPoE if your ISP provides xDSL Virtual Dial-up connection. Click <Connect> to dial-up to the Internet and obtain the IP a ddress. Click <Disconnect> to disconnect the Internet connection and release the current IP address.
-19- be set in the range of 576-1492. The default MTU is 1480. It is recommended to keep the default value if no other MTU value is provided by your ISP . ISP Address: Optional. Enter the ISP address provided by your ISP . It's null by default. Service Name: Optional.
-20- ¾ PPPoE St atus Statu s: Displays the status of PPPoE connection. z “Disabled” indicates that the PPPoE connection type is not applied. z “Connecting” indicates that the Router is obtaining the IP parameters from your ISP . z “Connected” indicates that the Router has successfully obtained the IP parameters from your ISP .
-21- Figure 3-9 W AN - L2TP The following items are displayed on this screen: ¾ L2TP Settings Connection T ype: Select L2TP if your ISP provides a L2TP connection. Click <Connect> to dial-up to the Internet and obtain the IP address. Click <Disco nnect> to disconnect the Internet connection and release the current IP address.
-22- Account Name: Enter the Account Name provided by your ISP . If you are not clear , please consult your ISP . Password: Enter the Password provided by your IS P . Server IP: Enter the Server IP provided by your ISP . MTU: MTU (Maximum T ransmission Unit) is the maximum data unit transmitted by the physical network.
-23- Default Gateway: If S tatic IP i s selected, c onfigure the default gateway . If Dynamic IP is selected, the obt ained default gateway is displayed. Primary DNS/Secondary DNS: If S tatic IP is selected, c onfigure the DNS. If Dynamic IP is selected, the obtained DNS is displayed.
-24- 5) PPTP If your ISP (Internet Service Provider) has provi ded the account informati on for the PPTP connection, please choose the PPTP connection type. Figure 3-10 W AN - PPTP The following items are displayed on this screen: ¾ PPTP Settings Connection T ype: Select PPTP if your ISP provides a PPTP connection.
-25- IP address. Click <Disco nnect> to disconnect the Internet connection and release the current IP address. Account Name: Enter the Account Name provided by your ISP . If you are not clear , please consult your ISP . Password: Enter the Password provided by your IS P .
-26- Default Gateway: If S tatic IP i s selected, c onfigure the default gateway . If Dynamic IP is selected, the obt ained default gateway is displayed. Primary DNS/Secondary DNS: If S tatic IP is selected, c onfigure the DNS. If Dynamic IP is selected, the obtained DNS is displayed.
-27- connection, please choose t he BigPond connection type. Figure 3-1 1 W AN - PPTP The following items are displayed on this screen: ¾ BigPond Settings Connection T ype: Select BigPond if your ISP provides a Big Pond connection. Click <Connect> to dial-up to the Internet and obtain the IP address.
-28- Auth Server: Enter the address of authentication server . It can be IP address or server name. Auth Domain: Enter the domain name of authentication server . It's only required when the address of Auth Server is a server name. Auth Mode: Y ou can select the proper Active mode according to your need.
-29- no response from your ISP . Please ensure that your settings are correct and y our network is connected well. Consult your ISP if this problem remains. IP Address: Displays the IP address a ssigned by your ISP . Subnet Mask: Displays the Subnet Mask assigned by your ISP .
-30- Note: If the LAN IP address is changed, you must use t he new IP address to log into the Router . T o guarantee a normal communication, be sure to set t he Gateway address and the Subn et Mask of the Hosts on the LAN to the new LAN IP a ddress and the Subnet Mask of the Router .
-31- Lease Time: S pecify the length of ti me the DHCP server will reserve the IP address for each computer . After the IP address expired, the client will be automatically assigned a new one. Default Gateway: Optional. Enter the Gateway address to be assigned.
-32- Figure 3-15 DHCP Reservation The following items are displayed on this screen: ¾ DHCP Reservation MAC Address: Enter the MAC address of the computer for which you want to reserve the IP address. IP Address: Enter the reserved IP address. Description: Optional.
-33- 3.1.5 DMZ DMZ (Demilitarized Zone) is a netwo rk which has fewer default firewa ll restrictions than th e LAN does. TL-ER6120 provides a DMZ port to allow all the loca l hosts connected to this port to be exposed to the Internet for some special-purpose services, such as such as Inter net gaming and video-conferencing.
-34- Choose the menu Network → DMZ → DMZ to load the following page. Figure 3-18 DMZ The following items are displayed on this screen: ¾ DMZ Statu s: Activate or inactivate this entry . The DMZ port functions as a normal LAN port when it’s disabled.
-35- Set the MAC Address for LAN port: In a complex network topology with all the ARP bound devices, if you want to use TL-ER6120 instead of the current router in a network node, you c an just set the.
-36- to apply . Note: T o avoid a conflict of MAC address on the local area network, it’s not allowed to set the MAC address of the Router ’s LAN port to the MAC address of the current management PC.
-37- Unicast: Displays the number of normal unicast packet s received or transmitted on the port. Broadcast: Displays the number of normal broadcast packe ts received or transmitted on the port. Pause: Displays the number of flow control frames received or transmitted on the port.
-38- Figure 3-21 Port Mirror The following items are displayed on this screen: ¾ General Enable Port Mirror: Check the box to enable t he Port Mirror function.
-39- The entry in Figure 3-21 indicates: The outgoing packets sent by port 1, port 2, port 3 and port 5 (mirrored ports) will be copied to port 4 (mirroring port). Tips: If both the mirrored port and the mirroring port are the LAN ports, these two L AN ports should be in the same Port VLAN.
-40- Figure 3-22 Rate Control The following items are displayed on this screen: ¾ Rate Control Port: Displays the port number . Ingress Limit: S pecify whether to enable t he Ingress Limit feature. Ingress Mode: Select the Ingress Mode for each port.
-41- Figure 3-23 Port Config The following items are displayed on this screen: ¾ Port Config Statu s: S pecify whether to enable the port. The packet s can be transported via this port after being enabled. Flow Control: Allows you to enable/disable the Flow Control function.
-42- 3.1.7.6 Port VLAN A VLAN (Virtual Local Area Network) is a network topology configured accord ing to a logical scheme rather than the physical layout, which allows you to divide the physical LAN into multiple logical LANs so as to control the communication among the ports .
-43- 3.2.1 Group On this page you can define the group for management. Choose the menu User Group → Group to load the following page. Figure 3-26 Group Configuration The following items are displayed on this screen: ¾ Group Config Group Name: S pecify a unique name for the group.
-44- ¾ User Config User Name: S pecify a unique name for the user . IP Address: Enter the IP Address of the user . It cannot be the network address or broadcast address of the port. Description: Give a description to the user fo r identification. It's o ptional.
-45- Group Structure: Click this button to view the tree struct ure of this group. All the members of this group will be displayed, includi ng Users and sub-Groups. The Group Names are displayed in bold. A vailable Member: Displays the Users and the Groups which can be added into this group.
-46- ¾ NA T -DMZ NA T -DMZ: Enable or disable NA T -DMZ. NA T DM Z is a special service of NA T application, which can be considered as a default forwardin g rule.
-47- The first entry in Figure 3-30 indicates: The IP address of host1 in local network is 192.168.0.128 and the W AN IP address after NA T mapping is spec ified to be 222.135.48.128. The data packets are transmitted from W AN1 port. DMZ Forwarding and this entry are both activated.
-48- The first entry in Figure 3-31 indicates that: This is a Multi-Ne ts NA T entry named tplink1. The subnet under the LAN port of the Router is 192.168.2.0/24 and this ent ry is activated. After the co rresponding S tatic Route entry is set, the hos ts within this subnet can access the Internet through the Router via NA T .
-49- Configuration procedure 1. Establish the Multi-Nets NA T entries with Subnet/Mask of VLAN2 and VLAN3. The configured entries are as follows: 2. Then set the corresponding S tatic Route entry , en ter the IP address of t he interface connecting the Router and the three layer swit ch into the Next Hop field.
-50- 3.3.1.4 V irtual Server Virtual server set s up public services in your private network, such as DN S, Email and FTP , and defines a service port. All the serv ice requests to this port will be transmitted to the LAN server appointed by the Router via IP address.
-51- Statu s: Activate or inactivate the entry . Note: ● The External port and Internal Port should be set in the range of 1-65535. ● The extern al ports of dif ferent entries should be different, whereas the internal ports can be the same.
-52- ¾ Port T riggering Name: Enter a name for Port Triggering entri es. Up to 28 characters can be entered. T rigger Port: Enter the trigger port number or the rang e of port.
-53- Choose the menu Advanced → NA T → ALG to load the following p age. Figure 3-34 ALG The following items are displayed on this screen: ¾ ALG FTP ALG: Enable or disable FTP ALG . The default setting is enabled. It is recommended to keep the def ault setting if no special requirement.
-54- Figure 3-35 Configuration The following items are displayed on this screen: ¾ General Disable Bandwidth Control: Select this option to disable Bandwidth Control. Enable Bandwidth Control all the time: Select this option to enable Bandwidth Control all the time.
-55- Interface: Displays the current enabled W AN port(s). The T otal bandwid th is equal to the sum of bandwidth of the enabled W AN port s. Up stream Bandwidth: Displays the bandwidth of each W A N port for transmitting dat a. The Upstream Bandwid th of W AN port can be configured on W AN page.
-56- ¾ Bandwidth Control Rule Direction: Select the data stream dir ection for the entry . The direction of arr owhead indicates the data stream direction The DMZ port displays in the drop-down list only when the DMZ port is enabled. WAN-ALL means all W AN ports through which the data fl ow might pass.
-57- Note: ● The premise for single r ule taking ef fect is that the bandwidth of the interface for this rule is sufficient and not used up. ● It is impossible to satisfy all the guaranteed bandw .
-58- ¾ Session Limit Group: Select a group to define the controlled users. Max. Sessions: Enter the max. Sessions for the users. Description: Give a description for the entry . Statu s: Activate or inactivate the entry . ¾ List of Session Limit Y ou can view the informati on of the entries and edit t hem by the Action buttons.
-59- Figure 3-39 Configuration With the box before Enable Application Optimized Routing checked, the Router will consider the source IP address and destination IP address of the packet s as a whole and record the W AN port they pass through.
-60- The following items are displayed on this screen: ¾ General Protocol: Select the protocol for the entry in the drop-down list. If the protocol you want to set is not in the lis t, you can add it to the list on 3.3.4.4 Protocol page. Source IP: Enter the source IP range for the entry .
-61- On this page, you can configur e the Link Backup function based on actual need to reduce the traffic burden of W AN port and improve the network efficie ncy . Choose the menu Advanced → Load Balance → Li nk Backup to load the following p age.
-62- W AN at the ending of the ef fective time. Failover: S pecify the premise for Failover Mode. The backup W AN port will be enabled only when the premise is met. Backup Effective Time: S pecify the backup ef fective time if T iming Mode has been selected.
-63- Figure 3-42 Protocol The following items are displayed on this screen: ¾ Protocol Name: Enter a name to indicate a protocol. The name will display in the drop-down list of Protocol on Access Rule page. Number: Enter the Number of the prot ocol in the range of 0-255.
-64- Choose the menu Advanced → Routi ng → S t atic Route to load the following page. Figure 3-43 Static Route The following items are displayed on this screen: ¾ St atic Route Destination: Enter the destination hos t the route leads to. Subnet Mask: Enter the Subnet Mask of the destination network.
-65- The first entry in Figure 3-43 indicates: If there are packets being sent to a device with IP address of 21 1.162.1.0 and subnet mask of 255.255.255.
-66- 3.3.5.2 RIP RIP (Routing Information Protocol) is a dynamic route protocol using di stance vector algorithm to select the optimal path. With features of easy configurat ion, management and implementat ion, it is widely used in small and medium-sized networks such as the campus network.
-67- Statu s: Enable or disable RIP protocol. RIP V ersion: Select RIPv1 or RIPv2. RIPv2 s upports multicast and broadcast. Password Authentication: If RIPv2 is enabled, set the Password Au thentication accordi ng to the actual network situation, and the password s hould not be more than 15 characters.
-68- Destination: The Destination of route entry . Gateway: The Gateway of route entry . Flags: The Flags of route entry . The Flags describe certain characteristics of the route. Logical Interface: The logical interface of route entry . Physical Interface: The physical interface of route entry .
-69- Figure 3-46 IP-MAC Binding The following items are displayed on this screen: ¾ General It is recommended to check all the options. Y ou s hould import the IP and MAC address of the host to IP-MAC Binding List and enable the corresponding entr y before enabling “Permit the packet s matching the IP-MAC Binding entries only”.
-70- ¾ List of Rules Y ou can view the informati on of the entries and edit t hem by the Action buttons. The first entry in Figure 3-46 indicates: The IP address of 192.168.1.101 and MAC address of 00-19-66-83-53-CF have been bound and this entry is activated.
-71- Indicates that this entry is imported to the list on IP-MAC Binding p age, but not effective yet. Indicates that the IP and MAC addres s of this entry are already bound.
-72- Figure 3-49 Attack Defense The following items are displayed on this screen: ¾ General Flood Defense: Flood attack is a commonly used DoS (Denial of Service) att ack, including TCP SYN, UDP , ICMP and so on. It is recommended to select all the Flood Defens e options and specify the corresponding thresholds.
-73- Packet Anomaly Defense: Packet Anomaly refers to the abnormal p ackets. It is recommended to select all the Packet Anomaly Defense options. Enable Att ack Defense Logs: With this box checked, the Rout er will record the defense logs.
-74- ¾ List of Rules Y ou can view the informati on of the entries and edit t hem by the Action buttons. 3.4.4 Access Control 3.4.4.1 URL Filtering URL (Uniform Resource Locator) specifies wher e an identified resource is available and the mechanism for retrieving it.
z Group: URL Filtering will t ake effect to all the users in group. Mode: Select the mode for URL Filtering. “Keyword’’ indicates that all the URL addresses including the specif ied keywords will be filtered. “URL Path” indicates that the URL address will be filtered only when it exactly matches the specified URL.
-76- 3.4.4.2 Web Filtering On this page, you can filter the desired web components. Choose the menu Firewall → Access Control → Web Filtering to load the following p age. Figure 3-52 Web Filtering Check the box before Enable Web Filt ering and select the web components to be filtered.
-77- rule will not be permitted to pass through the Router . y Allow: When this option is selected, the packet s obeyed the rule will be allowed to pass through the Router . Service: Select the service for the entry . Only the service belonging to the specified service type is limited by the entry .
-78- ¾ List of Rules Y ou can view the information of the entries and edit them by the Action butt ons. The smaller the valu e is, the higher the priority is. The first entry in Figure 3-53 indicates: The TELNET p acket s transmitted from the hosts within the network of 192.
-79- The following items are displayed on this screen: ¾ Service Name: Enter a name for the service. T he name should not be more than 28 characters. The name will display in the drop-down list of Protocol on Access Rule page. Protocol: Select the protocol for the servic e.
-80- Figure 3-55 Application Rules The following items are displayed on this screen: ¾ General Check the box before Enable Application Control to make the Applicat ion Control function take ef fect. The specified applic ation used by the specified loca l users will be not allowed to access the Internet if the App lication Control entry is enabled.
-81- Effective Time: S pecify the t ime for the entry to take e ffect . Description: Give a description for the entry . Statu s: Activate or inactivate the entry . ¾ List of Rules Y ou can view the informati on of the entries and edit t hem by the Action buttons.
-82- technology is developed and used to establish the private network through the public network, which can guarantee a secured data exchange. VPN adopts the tunneling technology to establish a private connection between tw o endpoints. It is a connection secured by encrypting the data and using point -to-point authenticat ion.
-83- Figure 3-58 IKE Policy The following items are displayed on this screen: ¾ IKE Policy Policy Name: S pecify a unique name to the IKE policy for ident ification and management purposes. The IKE policy can be applied to IPsec policy . Exchange Mode: Select the IKE Exchange Mode in phase 1, and ensure the remote VPN peer uses the same mode.
-84- scenarios with lower requirem ent for identity protection. Local ID T ype: Select the local ID type for I KE negotiation. IP Address: uses an IP address as the ID in IKE negotiation. FQDN: uses a name as the ID. Local ID: The local W AN IP will be inputted automatically if IP Address type is selected.
-85- Figure 3-59 IKE Proposal The following items are displayed on this screen: ¾ IKE Proposal Proposal Name: S pecify a unique name to the IK E proposal for identification and management purposes. The IKE proposal can be applied to IPsec proposal. Authentication: Select the authentication algor ithm for IKE negotiation.
-86- z AES192: Uses the AES algorit hm and 192-bit key for encryption. z AES256: Uses the AES algorit hm and 256-bit key for encryption. DH Group: Select the DH (Dif fie-Hellman) group to be used in key negotiation phase 1. The DH Grou p sets the strength of the algorithm in bits.
-87- Figure 3-60 IPsec Policy The following items are displayed on this screen: ¾ General Y ou can enable/disable IPsec func tion for the Router here. ¾ IPsec Policy Policy Name: S pecify a u nique name to the IPsec policy . Up to 28 characters can be entered.
-88- Mode: Select the network mode for IP sec policy . Options include: z LAN-to-LAN: Select this option when the client is a network. z Cl ie nt -to -L AN : Select th is option when the client is a host. Local Subnet: S pecify IP address range on your local LAN to identify which PCs on your LAN are covered by this policy .
-89- PFS: Select the PFS (Perfect Forward Security) for IKE mode to enhance security . This setting should match the remote peer . With PFS feature, IKE negotiates to create a new key in Phase2. As it is i ndepend ent of the key created in Phase1, this key can be secure even when the key in Phase1 is de-encrypted.
-90- Key-In: protocol is used in the co rresponding IPsec Proposal. The inbound key here must match the outbound ESP encryption key at the other end of the tunnel, and vice versa. Outgoing SPI: S pecify the Outgoing SPI (S ecurity Parameter Index) manually .
-91- 3.5.2.2 IPsec Proposal On this page, you can define and edit the IPsec proposal. Choose the menu VPN → IPsec → IPsec Proposal to load the following page.
less than the 64th power of 2 in bits and generates a 160-bit message digest. ESP Authentication: Select the algorithm used to ve rify the integrity of the data for ESP authentication. Options include: z MD5: MD5 (Message Digest Algorithm) t akes a message of arbitrary length and generates a 128-bit message digest.
-93- Figure 3-62 IPsec SA Figure 3-62 displays the connection status of the NO.1 entry in t he List of IPsec policy in Figure 3-60 . As shown in the figure, the Rout er is using W AN2 for tunnel con nection, and the IP address of W AN2 and the default gateway of remote peer are 172.
-94- Figure 3-63 L2TP/PPTP T unnel The following items are displayed on this screen: ¾ General Enable VPN-to-Internet: S pecify whether to enable VPN -to-Internet function. If enabled, the VPN client is permitted to access the LAN of the server and Internet.
-95- Mode: S pecify the working mode for this Router . Options include: z Client: In this mode, the device send s a request to the remote L2TP/PPTP server init iatively for establishing a tunnel. z Server: In this mode, t he Router responds the request from the remote client for establishing a tunnel.
-96- Client: Enter the IP address of the c lient which is allowed to connect to this L2TP/PPTP server . The default IP "0.0.0.0" means any IP address is accept able. IP Pool: Select the IP Pool Name to specify the address range for the server's IP assignment.
-97- Pool Name: S pecify a unique name to the IP Address Pool for identification and mana gement purpos es. IP Address Range: S pecify the st art and the end IP address for IP Pool. The start IP address should not exceed the end address and the IP ranges must not o verlap.
-98- The PPPoE configuration can be implemented on General , IP Address Pool , Account , Exceptional IP and List of Account pages. 3.6.1.1 General On this page, you can conf igure PPPoE function globally . Choose the menu Services → PPPoE Server → General to load the following page.
-99- Max Echo-Request s: S pecify the maximum number of Echo-R equests sent by the server to wait for response. The default is 10. The link will be dropped when the number of the unacknowledged LCP echo requests reaches your specified Max Echo-Requests.
-100- Figure 3-67 IP Address Pool The following items are displayed on this screen: ¾ IP Address Pool Pool Name: S pecify a unique name to the IP A ddress Pool for identification and management purposes. IP Address Range: S pecify the start and the end IP address for IP Pool.
-101- Figure 3-68 Account The following items are displayed on this screen: ¾ Account Account Name: Enter the account name. This name should not be the same with the one in L2TP/PPTP connection settings. Password: Enter the password. IP Address Assigned Mode: Select the IP Address Assigned Mode for IP assignment.
-102- Description: Enter the description for management and search purposes. Up to 28 characters can be entered. Statu s: Activate or inactivate the entry . MAC Binding: Select a MAC Binding type from t he pull-down list. Options include: z Disable: Select this option to disable the MAC Binding function.
-103- The following items are displayed on this screen: ¾ Exceptional IP IP Address Range: S pecify the st art and the end IP address to make an exceptional IP address range. This range should be in the sa me IP range with LAN port or DMZ port of the Router .
-104- Figure 3-71 E-Bulletin The following items are displayed on this screen: ¾ General Enable E-Bulletin: S pecify whether to enable el ectronic bulletin function . Interval: S pecify the interval to release the bulletin. Enable Logs: S pecify whether to log the E-Bulletin.
-105- Content: Enter the content of the bulletin. Object: Select the object of this bulletin. Options include: z ANY: The bulletin will be released to all the users and the PCs on the LAN. z Group: The bulletin will be released to the users in the selected group.
-106- latest IP add ress, the server will update the mappings between the domai n name and IP address in DNS database. Therefore, the users can use the same domain name to ac cess the DDNS client even if the IP address of the DDNS cli ent has changed.
-107- DDNS St atus: Displays the current statu s of DDNS service z Offline: DDNS service is disabled. z Connecting: client is connecting to the server . z Online: DDNS works normally . z Authorization fails: The Account Name or Password is incorrect. Please check and enter it again.
-108- DDNS St atus: Displays the current statu s of DDNS service z Offline: DDNS service is disabled. z Connecting: client is connecting to the server . z Online: DDNS works normally . z Authorization fails: The Account Name or Password is incorrect. Please check and enter it again.
-109- DDNS St atus: Displays the current status of DDNS service z Offline: DDNS service is disabled. z Connecting: client is connecting to the server . z Online: DDNS works normally . z Authorization fails: The Account Name or Passwo rd is incorrect. Please check and enter it again.
-1 10- Domain Name 1: Enter the Domain Name that you registered with your DDNS service provider . Domain Name 2: Optional. Enter the Domain Name that you registered with your DDNS service provider . Domain Name 3: Optional. Enter the Domain Name that you registered with your DDNS service provider .
- 111 - Figure 3-76 UPnP The following items are displayed on this screen: ¾ General UPnP Funct ion: Enable or disable the UPnP function globally . ¾ List of UPnP Mappin g After UPnP is enabled, all UPnP connection rules will be displayed in the list of UPnP Mapping.
-1 12- Figure 3-77 Password The following items are displayed on this screen: ¾ Administrator Current User Name: Enter the current user name of the Router . Current Password: Enter the current password of the Router . New User Name: Enter a new user name for the Router .
-1 13- ¾ General Web Management Port: Enter the Web Management Port for the Router . T elnet Management Port: Enter the T elnet Management Port for the Router . Web Idle T imeout: Enter a timeout period that the Router will log you out of the Web-based Utility af ter a specified period ( Web Idle Timeout ) of inactiv ity .
-1 14- 3.7.1.3 Remote Management On this page you can configure the Remote Managem ent function. This featur e allows managing your Router from a remote location via the Internet. Choose the menu Maintenance → Setup → Remote Management to load the following page.
-1 15- 3.7.2.2 Export and Import Choose the menu Maintenance → Management → Export and Import to load the following page. Figure 3-81 Export and Import The following items are displayed on this screen: ¾ Configuration V ersion Displays the current Configur ation version of the Router .
-1 16- Figure 3-82 Reboot Click the <Reboot> button to reboot the Router . The configuration will not be lost after rebooting. The Internet connection will be temporarily interrupted while rebooting. Note: T o avoid damage, please don't turn off the device while rebooting.
-1 17- Figure 3-84 License 3.7.4 S t atistics 3.7.4.1 Interface T raffic St atistics Interface T raf fic S tatistics screen displays the det ailed traf fic information of each port and extra information of W AN ports. Choose the menu Maintenance → St atistics → Interface T raffic Statistics to load the following p age.
-1 18- Rate Rx ： Displays the rate for receiving data frames. Rate Tx: Displays the rate for transmitting data frames. Packets Rx: Displays the number of packet s received on the interface. Packets Tx: Displays the number of packet s transmitted on the interface.
-1 19- ¾ T raffic St atistics Direction: Select the direction in the drop-down list to get the Flow S tatistics o f the specified direction. ¾ IP T raffic St atistics This table displays the det ailed traf fic information of corresponding PCs. Sorted by: Select the rule for displayi ng the traffic information.
-120- Figure 3-87 Diagnostics The following items are displayed on this screen: ¾ Ping Destination IP/Domain: Enter destination IP address or Domain name here. Then select a port for testing, if you select “A uto”, the Router will select the interface of destination automatically .
-121- ¾ T racer t Destination IP/Domain: Enter destination IP address or Domain name here. Then select a port for testing, if Auto is selected, the Router will select the interface of destination automatically .
-122- ¾ List of W AN status Port: Displays the detected W AN port. Detection: Displays whether the Online Detection is enabled. W AN St atus: Display the detecting results.
-123- ¾ Config Get GMT : When this option is selected, you can configure the time zone and the IP Address for the NTP Server . T he Router will get GMT automatically if it has connected to a NTP Server . z T ime Zone: Select your local time. z Primary/Secondary NTP Server: Enter the IP Address for the NTP Server .
-124- Severity: Displays the severity level of the log information. Y ou can select a severity level to display the log information with the same level. Send System Logs: Select Send System Logs and specif y the server IP , then the new added logs will be sent to the specified server .
-125- Chapter 4 Application 4.1 Network Requirement s The company has established the server farms in the headquarters to provide the Web, Mail and FTP services for all the staf f in the headquarters an d the branch offices, and to transmit the commercial confidential data to it s p artners.
-126- 4.2 Network T opology 4.3 Configurations Y ou can configure the Router via th e PC connected to the LAN port of this Router . T o log in to the Router , the IP address of your PC should be in the same subnet of the LAN por t of this Router . (The default subnet of LAN port is 192.
-127- 4.3.1.1 System Mode Set the system mode of the Router to the NA T mode. Choose the menu Netw ork → System Mode to load the following p age. Select the NA T mode and the <Save> button to apply . Figure 4-1 System Mode 4.3.1.2 Internet Connection Configure the St atic IP connection type for the W A N1 and W AN2 ports of the Router .
-128- Figure 4-3 Link Backup 4.3.2 VPN Setting T o enable the hosts in the remote branch of fice (W AN: 1 16.31.85.133, LAN: 172.31.10.1) to access the servers in the headquarters, you can create the VPN tunnel via the TP-LINK VPN routers between t he headquarters and the remote branch office to guar antee a secured communication.
-129- Authentication: MD5 Encryption: 3DES DH Group: DH2 Click the <Add> button to apply . Figure 4-4 IKE Proposal z IKE Policy Choose the menu VPN → IKE → IKE Policy to load the configuration p age.
-130- Figure 4-5 IKE Policy Tips: For the VPN Router in the remote branch office, t he IKE settings should be the same as the Router in the headquarters. 2) IPsec Setting T o configure the IPsec function, you sh ould create an IPsec Proposal firstly .
-131- ESP Encryption: 3DES Click the <Save> button to apply . Figure 4-6 IPsec Proposal z IPsec Policy Choose the menu VPN → IPsec → IPsec Policy to load the configuration p age. Settings: IPsec: Enable Policy Name: IPsec_1 S tatus: Activate Mode LAN-to-LAN Local Subnet: 192.
-132- Figure 4-7 IPsec Policy Tips: For the VPN Router in the remote branch office, the IPsec settings should be consistent with the Router in the headquarters. The Remote Gateway of the remote Router should be set to the IP address of the Router in the headquarters.
-133- 4.3.2.2 PPTP VPN Setting z IP Address Pool Choose the menu VPN → L2TP/PPTP → IP Address Pool to load the following page. Enter the Pool Name and the IP Address Range as the following figure shown. Click the <Add> button to apply . z L2TP/PPTP T unnel Choose the menu VPN → L2TP/PPTP → L2TP/PPTP T unnel to load the following page.
-134- Settings: L2TP/PPTP: Enable Protocol: PPTP Mode: Server Username: PPTP Password: abcdefg T unnel: Client-to-LAN IP Pool: PPTP_Dialup_User (you just created) Click the <Save> button to apply . 4.3.3 Network Management T o manage the enterprise network effectively and forbid the Hosts within the IP range of 192.
-135- 4.3.3.1 User Group Create a User Group with all the Hosts in the IP range of 192.168.0.30-1 92.168.0.50 as its group members. z Group Choose the menu User Group → Group to load the following page. Enter the Group Name and the Description to create a Group as the following figure shows.
-136- Figure 4-10 User Config - Batch z View Choose the menu User Group → Vie w to load the configuration p age. Add all the Users you just created into the Group 1 and click the <Save> button to apply . 4.3.3.2 App Control Choose the menu Firewall → App Control → Control Rules to load the configuration page.
-137- Figure 4-1 1 App Rules 4.3.3.3 Bandwid th Control T o enable Bandwidth Control, you s hould configure the total bandwid th of interfaces and the detailed bandwidth control rule first. 1) Enable Bandwidth Control Choose the menu Advanced → T raffic Control → Setup to load the configuration page.
-138- 2) Interface Bandw id th Choose the menu Network → WA N → WA N 1 to load the configurat ion page. Configure the Upstream Bandwidth and Do wnstream Bandw id th of the interface as Figur e 4-13 shows. The entered bandwidth value should be c onsistent with the ac tual bandwidth value.
-139- Max. Sessions: 250 S tatus: Activate Click the <Add> button to apply . Figure 4-15 Session Limit 4.3.4 Network Security Y ou can enable the IP-MAC Binding f unction to defend the ARP attack fr om local or public network and enable Sending GARP packet s function to defend ARP attack.
-140- Figure 4-17 Scanning Result Choose the menu Firewall → Anti ARP S poofing → IP-MAC Binding to load the configuration p age. Select the ARP entries needed to be bound or c lick the <Select All> button, and then click the <Import>button.
-141- Figure 4-19 IP-MAC Binding 4.3.4.2 W AN ARP Defense T o prevent the WAN ARP attack, you can bind the default gateway and IP address of W AN port. Obtain the MAC address of W AN port by ARP Scanning first. Choose the menu Firewall → Anti ARP S poofing → ARP Scanning to load the configuration p age.
-142- Figure 4-20 Att ack Defense 4.3.4.4 T raffic Monitoring 1) Port Mirror Choose the menu Network → Sw itch → Port Mirror to load the configuration page. Check the bo x before Enable Port Mirror and select the Ingress&Egress mode. Select the Port 5 for the Mirroring Port and the Port 3 and the Port 4 for the Mirrored ports.
-143- Figure 4-21 Port Mirror 2) St atistics Choose the menu Maintenance → St atistics to load the page. Load the Interface T raffic S t atistics p age to view the traffic st atistics of each physical interface of the Router as Figure 4-22 shows.
-144- Figure 4-23 IP T raf fic S tatistics After all the above step s, the enterpris e network will be operated based on planning..
-145- Chapter 5 CLI TL-ER6120 provides a Console po rt for CLI (Comm and Line Interface) confi guration, which enables you to configure the Router by accessing the CLI from c onsole (such as Hyper T ermi nal) or T elnet. The following part will introduce the step s to a ccess CLI via Hyper T erminal and some common CLI commands.
-146- Figure 5-2 Connection Description 4. Select the port (The default port is COM1) to connect in Figure 5-3 , and click OK . Figure 5-3 Select the port to connect 5.
-147- Figure 5-4 Port Settings 6. Choose File → Properties → Settings on the Hyper T erminal window as Figure 5-5 shows, then choose VT100 or Auto detect for Emulation and click OK .
-148- 7. The DOS prompting “TP-LINK>” will appea r after pressing the Enter button in the Hyper T erminal window as Figure 5-6 shows. Figure 5-6 Log in the Router 5.2 Interface Mode The CLI of TL-ER6120 offers two command mode s: User EXEC Mode and Privileged EXEC Mode.
-149- Mode Accessing Path Prompt Logout or Access the next mode User EXEC Mode Primary mode once it is connected with the Router . TP-LINK > Use the exit command to disconnect the Router (except t hat the Router is connected through the Console port).
-150- enable - Enter the privileged mode exit - Exit the CLI (only for telnet) history - Show command history ip - Display or Set the IP configuration ip-mac - Display or Set the IP mac bind configuration sys - System manager user - User configuration 2) T ype a command and a question mark separated by space.
-151- 5.4 Command Introduction TL-ER6120 provides a number of CLI commands for users to manage the Router and user information. For better understanding, each command is followed by note which is the meaning of the command. 5.4.1 ip The ip command is used to view or configure the IP address and subnet mask of the interfaces.
-152- 5.4.3 sys The sys command is used for system management, incl uding Backup and Restore, Factory Default, Reboot, Firmware Upgrade and so on. TP-LINK # sys reboot This command will r eboot system, Continue?[Y/N] Reboot the system. Y me ans YES, N means NO.
-153- ● Pay special attention t hat the specified a ccount must be with approp riate permissions since the functions such as export, import and firmwa re upgrade require read-wri te operation on FTP server . TP-LINK # sys import config Server address: [192.
-154- TP-LINK > user get Username: admin Password: admin Query the user name and password of the current Guest. TP-LINK > user set password Enter old password: Enter new password: Confirm new password: Modify the password of the Guest. TP-LINK # user get Username: admin Password: admin Query the user name and password of the Administrator .
-155- TP-LINK > history 1. history 2. sys show 3. history View the history command. TP-LINK > history clear 1. history 2. sys show 3. history 4. history clear Clear the history command. 5.4.6 exit The exit command is used to exit the syst em when logging in by T elnet.
-156- Appendix A Hardware S pecifications St andards IEEE 802.3, IEEE 802.3u, IEEE 802.3ab, IEEE 802.3x, TCP/ IP , DHCP , ICMP , NA T 、 PPPoE, SNTP , HTTP , DNS, L2TP , PPTP , IPsec T wo 10/100/1000.
-157- Appendix B F AQ Q1. What can I do if I cannot access the web-based configuration page? 1. For the first login, pl ease try the following steps: 1) Make sure the cable is well connected to t he LAN port of the Router . The corresponding LED should flash or be solid light.
-158- Q3: What can I do if the Router with the re mote management function enabled cannot be accessed by the remote computer? 1. Make sure that the IP address of the remote com puter is in the subnet allowed to remotely access the router .
-159- Appendix C Glossary Glossary Description DSL (Digital Subscriber Line) A technology that allows data to be sent or received over existing traditional phone lines.
-160- Glossary Description H.323 H.323 allows dissimilar communica tion devices to communicate with each other by using a standardized communication protocol. H.323 defines a comm on set of CODECs, call setup and negotiating procedures, and basic data transport methods.
-161- Glossary Description structures. MAC addresses are 6 bytes long and are controlled by the IEEE. MTU （ Maximum T ransmission Unit ） The size in bytes of the larges t packet that can be transmitted. NA T （ Network Address T ranslator ） Mechanism for reducing the need for globally unique IP addresses.
-162- Glossary Description Protocol ） processing and retransmission be handled by other protocols. UPnP （ Universal Plug and Play ） UPnP is a set of networking prot ocols for primarily residential networks without enterprise cl ass devices that permits networked devices.
Een belangrijk punt na aankoop van elk apparaat TP-Link TL-ER6120 SafeStream (of zelfs voordat je het koopt) is om de handleiding te lezen. Dit moeten wij doen vanwege een paar simpele redenen:
Als u nog geen TP-Link TL-ER6120 SafeStream heb gekocht dan nu is een goed moment om kennis te maken met de basisgegevens van het product. Eerst kijk dan naar de eerste pagina\'s van de handleiding, die je hierboven vindt. Je moet daar de belangrijkste technische gegevens TP-Link TL-ER6120 SafeStream vinden. Op dit manier kan je controleren of het apparaat aan jouw behoeften voldoet. Op de volgende pagina's van de handleiding TP-Link TL-ER6120 SafeStream leer je over alle kenmerken van het product en krijg je informatie over de werking. De informatie die je over TP-Link TL-ER6120 SafeStream krijgt, zal je zeker helpen om een besluit over de aankoop te nemen.
In een situatie waarin je al een beziter van TP-Link TL-ER6120 SafeStream bent, maar toch heb je de instructies niet gelezen, moet je het doen voor de hierboven beschreven redenen. Je zult dan weten of je goed de alle beschikbare functies heb gebruikt, en of je fouten heb gemaakt die het leven van de TP-Link TL-ER6120 SafeStream kunnen verkorten.
Maar de belangrijkste taak van de handleiding is om de gebruiker bij het oplossen van problemen te helpen met TP-Link TL-ER6120 SafeStream . Bijna altijd, zal je daar het vinden Troubleshooting met de meest voorkomende storingen en defecten #MANUAl# samen met de instructies over hun opplosinge. Zelfs als je zelf niet kan om het probleem op te lossen, zal de instructie je de weg wijzen naar verdere andere procedure, bijv. door contact met de klantenservice of het dichtstbijzijnde servicecentrum.
