TP-LINK TL-ER604W Specifiche

TL-ER604W Wireless N Gigabit Broadband VPN Router Rev1.0.1 1910010844

-5-  Supports Virtual Server, Port Triggering, ALG, Static Route and RIP v1/v2  Built-in Switch supporting Port Mirror, Port VLAN, Rate Control a

-95- Figure 3-64 IPsec Policy The following items are displayed on this screen:  General You can enable/disable IPsec function for the Router here

-96- Remote Subnet: Specify IP address range on your remote network to identify which PCs on the remote network are covered by this policy. It's

-97- Status: Activate or inactivate the entry.  Manual Mode IPsec Proposal: Select the IPsec Proposal. Only one proposal can be selected on Manual

-98- ESP Encryption Key-Out: Specify the outbound ESP Encryption Key manually if ESP protocol is used in the corresponding IPsec Proposal. The outbou

-99- Security Protocol: Select the security protocol to be used. Options include:  AH: AH (Authentication Header) provides data origin authenticati

-100- 3.6.2.3 IPsec SA This page displays the information of the IPsec SA (Security Association). Choose the menu VPN→IPsec→IPsec SA to load the fol

-101- 3.6.3.1 L2TP/PPTP Tunnel On this page, you can configure the L2TP/PPTP VPN. Choose the menu VPN→L2TP/PPTP→L2TP/PPTP Tunnel to load the followi

-102- Account Name: Enter the account name of L2TP/PPTP tunnel. It should be configured identically on server and client. Password: Enter the passw

-103- 3.6Status Activate or inactivate the entry.  List of Configurations In this table, you can view your configurations of the tunnels and edit t

-104- Figure 3-69 List of L2TP/PPTP Tunnel Figure 3-69 displays the connection status of the NO.1 entry in the list of tunnel in Figure 3-68. This t

-6- 2.3 Appearance 2.3.1 Front Panel The front panel of TL-ER604W is shown as the following figure. Figure 2-1 Front Panel  LEDs LED Status Ind

-105- Figure 3-70 General The following items are displayed on this screen:  General PPPoE Server: Specify whether to enable the PPPoE Server func

-106- 3.7Authentication: Select the Authentication type. It can be Local authentication and Remote authentication. Select Local authentication for au

-107- 3.7.1.3 Account IP Address Range: Specify the start and the end IP address for IP Pool. The start IP address should not exceed the end address

-108- 3.7IP Address Pool: It's available on Dynamic mode. Select an IP Address Pool to make a range to assign dynamic IPs. Max Sessions: Specify

-109- Figure 3-73 Exceptional IP The following items are displayed on this screen:  Exceptional IP IP Address Range: Specify the start and the end

-110- Choose the menu Services→E-Bulletin to load the following page. Figure 3-75 E-Bulletin The following items are displayed on this screen:  Ge

-111- Object: Select the object of this bulletin. Options include:  ANY: The bulletin will be released to all the users and the PCs on the LAN. 

-112- 3.7.3.1 DynDNS if the IP address of the DDNS client has changed. DDNS is usually used for the Internet users to access the private website and

-113- 3.7.3.2 No-IP WAN Port: Displays the WAN port for which Dyndns DDNS is selected. DDNS Status: Displays the current status of DDNS service  Of

-114- 3.7DDNS Service: Activate or inactivate DDNS service here. WAN Port: Displays the WAN port for which No-IP DDNS is selected. DDNS Status: Displ

-7-  Reset button Use the button to restore the Router to the factory defaults. With the Router powered on, use a pin to press and hold the Reset bu

-115- 3.7.3.4 Comexe Password: Enter the password of your DDNS account. DDNS Service: Activate or inactivate DDNS service here. WAN Port: Displays th

-116-  Comexe DDNS Account Name: Enter the Account Name of your DDNS account. If you have not registered, click <Go to register> to go to the

-117- Figure 3-80 UPnP The following items are displayed on this screen:  General UPnP Function: Enable or disable the UPnP function globally. 

-118- Figure 3-81 Administrator The following items are displayed on this screen:  Administrator Current User Name: Enter the current user name of

-119- The following items are displayed on this screen:  General Web Management Port: Enter the Web Management Port for the Router. Telnet Manageme

-120- Subnet/Mask: Specify a single IP address or network address for the hosts desired to access the Router from external network. Status: Activ

-121- 3.8.2.2 Click the <Restore to Factory Defaults> button to reset all configuration settings to their default values. The default IP addr

-122- Figure 3-86 Reboot Click the <Reboot> button to reboot the Router. The configuration will not be lost after rebooting. The Internet co

-123- Figure 3-88 License 3.8.4 Statistics 3.8.4.1 Interface Traffic Statistics Interface Traffic Statistics screen displays the detailed traffic

-124- 3.8Packets Rx: Displays the number of packets received on the interface. Packets Tx: Displays the number of packets transmitted on the interf

-8- Chapter 3 Configuration 3.1 Network 3.1.1 Status The Status page shows the system information, the port connection status and other informatio

-125-  Traffic Statistics Direction: Select the direction in the drop-down list to get the Flow Statistics of the specified direction.  IP Traffi

-126- 3.8 Ping Destination IP/Domain: Enter destination IP address or Domain name here. Then select a port for testing, if you select “Auto”, the R

-127- dial-up status. Mode: Detect automatically or Manually. In Auto mode, gateway will be selected as destination for PING detection, DNS server

-128-  Current Time System Time: Displays the current date and time of the Router. Time Zone: Displays the current time zone of the Router. Status:

-129- Figure 3-94 Logs  List of Logs List of Logs displays the system log information in log buffer. An entry of log contains the following four p

-130- Chapter 4 Application 4.1 Network Requirements The company has established the server farms in the headquarters to provide the Web, Mail and

-131- 4.2 Network Topology 4.3 Configurations You can configure the Router via the PC connected to the LAN port of this Router. To log in to the R

-132- Figure 4-1 System Mode 4.3.1.2 Internet Connection Configure the Static IP connection type for the WAN1 and WAN2 ports of the Router. Choose t

-133- Figure 4-3 Link Backup 4.3.2 VPN Setting To enable the hosts in the remote branch office (WAN: 116.31.85.133, LAN: 172.31.10.1) to access the

-134- Click the <Add> button to apply. Figure 4-4 IKE Proposal  IKE Policy Choose the menu VPN→IKE→IKE Policy to load the configuration page

-9- Figure 3-2 Network Topology - NAT Mode If your Router is connecting the two networks of different areas in a large network environment with a ne

-135- Figure 4-5 IKE Policy Tips: For the VPN Router in the remote branch office, the IKE settings should be the same as the Router in the headquart

-136- Figure 4-6 IPsec Proposal  IPsec Policy Choose the menu VPN→IPsec→IPsec Policy to load the configuration page. Settings: IPsec: Enable Pol

-137- Figure 4-7 IPsec Policy Tips: For the VPN Router in the remote branch office, the IPsec settings should be consistent with the Router in the h

-138-  L2TP/PPTP Tunnel Choose the menu VPN→L2TP/PPTP→L2TP/PPTP Tunnel to load the following page. Check the box of Enable VPN-to-Internet to allo

-139- 4.3.3 Network Management To manage the enterprise network effectively and forbid the Hosts within the IP range of 192.168.0.30-192.168.0.50 t

-140- Action: Add Start IP Address: 192.168.0.30 End IP Address: 192.168.0.50 Prefix Username: User Start No.: 1 Step: 1 Click the OK button to a

-141- Figure 4-11 App Rules 4.3.3.3 Bandwidth Control To enable Bandwidth Control, you should configure the total bandwidth of interfaces and the d

-142- 3) Bandwidth Control Rule Choose the menu Advanced→Traffic Control→Bandwidth Control to load the configuration page. Then continue with the fo

-143- Figure 4-15 Session Limit 4.3.4 Network Security You can enable the IP-MAC Binding function to defend the ARP attack from local or public net

-144- Choose the menu Firewall→Anti ARP Spoofing→IP-MAC Binding to load the configuration page. Select the ARP entries needed to be bound or click th

-10- Figure 3-5 System Mode You can select a System Mode for your Router according to your network need.  NAT Mode NAT (Network Address Translatio

-145- Choose the menu Firewall→Anti ARP Spoofing→ARP Scanning to load the configuration page. Enter the default gateway of the WAN port such as 58.5

-146- 4.3.4.4 Traffic Monitoring 1) Port Mirror Choose the menu Network→Switch→Port Mirror to load the configuration page. Check the box before Enabl

-147- Figure 4-23 IP Traffic Statistics After all the above steps, the enterprise network will be operated based on planning.

-148- Appendix A Hardware Specifications General Standards IEEE 802.3, IEEE 802.3u, IEEE 802.3ab, IEEE 802.3x, IEEE 802.11b, IEEE 802.11g and IEEE 80

-149- Appendix B FAQ Q1. What can I do if I cannot access the web-based configuration page? 1. For the first login, please try the following steps:

-150- Q3: What can I do if the Router with the remote management function enabled cannot be accessed by the remote computer? 1. Make sure that t

-151- Appendix C Glossary Glossary Description ALG （ Application Layer Gateway） Application Level Gateway (ALG) is application specific translatio

-152- Glossary Description H.323 H.323 allows dissimilar communication devices to communicate with each other by using a standardized communicatio

-153- Glossary Description MAC address（Media Access Control address） Standardized data link layer address that is required for every port or devic

-154- Glossary Description Network protocol） log in to remote systems and use resources as if they were connected to a local system. UDP（User Data

-11- Figure 3-6 WAN Mode  WAN Mode WAN Ports: Select the total number of WAN ports you prefer to use. The Router support one WAN and dual WAN. The

-12- Figure 3-7 WAN – Static IP The following items are displayed on this screen:  Static IP Connection Type: Select Static IP if your ISP has a

-13- Downstream Bandwidth: Specify the bandwidth for receiving packets on the port. 2) Dynamic IP If your ISP (Internet Service Provider) assigns the

-14- the default value if no other MTU value is provided by your ISP. Get IP Address by Unicast: The broadcast requirement may not be supported by a

-I- COPYRIGHT & TRADEMARKS Specifications are subject to change without notice. is a registered trademark of TP-LINK TECHNOLOGIES CO., LTD. Oth

-15- Gateway Address: Displays the Gateway Address assigned by your ISP. Primary DNS: Displays the IP address of your ISP’s Primary DNS. Secondary DN

-16- The following items are displayed on this screen:  PPPoE Settings Connection Type: Select PPPoE if your ISP provides xDSL Virtual Dial-up co

-17- ISP Address: Optional. Enter the ISP address provided by your ISP. It's null by default. Service Name: Optional. Enter the Service Name pro

-18-  “Connected” indicates that the Router has successfully obtained the IP parameters from your ISP.  “Disconnected” indicates that the connect

-19- Figure 3-10 WAN - L2TP The following items are displayed on this screen:  L2TP Settings Connection Type: Select L2TP if your ISP provides a

-20- MTU: MTU (Maximum Transmission Unit) is the maximum data unit transmitted by the physical network. It can be set in the range of 576-1460. The d

-21-  L2TP Status Status: Displays the status of PPPoE connection.  “Disabled” indicates that the L2TP connection type is not applied. “Conne

-22- Figure 3-11 WAN - PPTP The following items are displayed on this screen:  PPTP Settings Connection Type: Select PPTP if your ISP provides a

-23- MTU: MTU (Maximum Transmission Unit) is the maximum data unit transmitted by the physical network. It can be set in the range of 576-1460. The d

-24-  PPTP Status Status: Displays the status of PPTP connection.  “Disabled” indicates that the PPTP connection type is not applied.  “Conne

-II- CONTENTS Package Contents...1 Cha

-25- Figure 3-12 WAN – Bigpond The following items are displayed on this screen:  BigPond Settings Connection Type: Select BigPond if your ISP p

-26- Auth Mode: You can select the proper Active mode according to your need.  Manual: Select this option to manually activate or terminate the Int

-27- Note: To ensure the BigPond connection re-established normally, please restart the connection at least 5 seconds after the connection is off. 3.

-28- Figure 3-14 DHCP Settings The following items are displayed on this screen:  DHCP Settings DHCP Server: Enable or disable the DHCP server

-29- 3.1Secondary DNS: Optional. If a Secondary DNS Server address is available, enter it. .4.3 DHCP Client On this page, you can view the informatio

-30- Status: Activate or Inactivate the corresponding entry.  List of Reserved Address In this table, you can view the information of the entries

-31-  MAC Address Port: Displays the port type of the Router. Current MAC Address: Displays the current MAC address of the port. MAC Clone: It’s

-32- The following items are displayed on this screen:  Statistics Unicast: Displays the number of normal unicast packets received or transmitted o

-33- Choose the menu Network→Switch→Port Mirror to load the following page. Figure 3-19 Port Mirror The following items are displayed on this screen

-34- Application Example: To monitor all the traffic and analyze the network abnormity for an enterprise’s network, please set the Port Mirror functi

-III- 3.4 Advanced ...55 3

-35- 3.1Port: Displays the port number. Ingress Limit: Specify whether to enable the Ingress Limit feature. Ingress Rate: Specify the limit rate fo

-36- 3.1.6.5 Port Status On this page, you can view the current status of each port. Choose the menu Network→Switch→Port Status to load the following

-37- VLAN: Select the desired VLAN for the port. Tips: The Port VLAN can only be created among the LAN ports. 3.2 Wireless 3.2.1 Wireless Setting 3

-38- Region: Select your region from the drop-down list. This field specifies the region where the wireless function of the Router can be used. It ma

-39- SSID: Enter a name for the wireless network. The same name of SSID(Service Set Identification) must be assigned to all wireless device in your n

-40- Auth Type: Choose the Auth type of the WPA-PSK/WPA2-PSK security on the drop-down list. The default setting is Automatic, which can selectWPA-PS

-41- Encryption: Select the Encryption type. which including Automatic, TKIP, AES. The default setting is Automatic, which can select TKIP (Tempora

-42- Key Format: Hexadecimal and ASCII formats are provided. Hexadecimal format stands for any combination of hexadecimal digits (0-9, a-f, A-F) in

-43- Figure 3-25 Multi-SSID The following items are displayed on this screen:  General Multi-SSID: Enable or disable the Multi-SSID. You can estab

-44- Security: Specify the security option of the wireless network. If you do not want to use wireless security, select “Disable Security”, otherwise

-IV- 3.8.7 Logs...128 Chapter 4

-45- Encryption: Select the Encryption type, which including Automatic, TKIP, AES. The default setting is Automatic, which can select TKIP (Tempora

-46- Encryption: Select the Encryption type. which including Automatic, TKIP, AES. The default setting is Automatic, which can select TKIP (Tempora

-47- Key Selected: You can select the key based on need. WEP Key: Select which of the four keys will be used and enter the matching WEP key that you

-48- Choose the menu Wireless→Wireless Setting→WDS to load the following page. Figure 3-26 WDS Configuration  General WDS: Enable or disable the W

-49- Key： If the AP your Router is going to connect needs password, you need to fill the key in this blank. Tips: The Multi-SSID function will be di

-50- Beacon Interval: Enter a value between 40-1000 milliseconds for Beacon Interval here. The beacons are the packets sent by the router to synchron

-51- Figure 3-28 MAC Filtering  General Each SSID can be configured the MAC Address Filtering rules. You can select a SSID in the SSID drop-down l

-52- Figure 3-29 Host Status  General Select a SSID, the status of the host in this wireless network will display on the following table.  Host

-53- Figure 3-30 Group Configuration The following items are displayed on this screen:  Group Config Group Name: Specify a unique name for the gr

-54- Description: Give a description to the user for identification. It's optional.  List of User In this table, you can view the information

-1- Package Contents The following items should be found in your package:  One TL-ER604W Router  One Power Adapter  One RJ45 Ethernet Cable  Q

-55- 3.4Group Structure: Click this button to view the tree structure of this group. All the members of this group will be displayed, including Users

-56- 3.4NAT-DMZ: Enable or disable NAT-DMZ. NAT DMZ is a special service of NAT application, which can be considered as a default forwarding rule. Wh

-57- Status: Activate or inactivate the entry.  List of Rules In this table, you can view the information of the entries and edit them by the Actio

-58- The first entry in Figure 3-35 indicates that: This is a Multi-Nets NAT entry named tplink1. The subnet under the LAN port of the Router is 192.

-59- The configured entries are as follows: 2. Then set the corresponding Static Route entry, enter the IP address of the interface connecting the

-60- Figure 3-36 Virtual Server The following items are displayed on this screen:  Virtual Server Name: Enter a name for Virtual Server entries.

-61- 3.4 List of Rules In this table, you can view the information of the entries and edit them by the Action buttons. The first entry in Figur

-62- Trigger Protocol: Select the protocol used for trigger port. Incoming Port: Enter the incoming port number or range of port numbers. The incomin

-63- 3.4.2.1 Setup  ALG FTP ALG: Enable or disable FTP ALG. The default setting is enabled. It is recommended to keep the default setting if no sp

-64- The following items are displayed on this screen:  General Disable Bandwidth Control: Select this option to disable Bandwidth Control. Enable

-2- Chapter 1 About this Guide This User Guide contains information for setup and management of TL-ER604W Router. Please read this guide carefully b

-65- 3.4.2.2 Bandwidth Control On this page, you can configure the Bandwidth Control function. Choose the menu Advanced→Traffic Control→Bandwidth Con

-66- Limited Bandwidth (Down): Specify the Limited Downstream Bandwidth for this entry. Effective Time: Specify the time for the entry to take effect

-67- Figure 3-41 Session Limit The following items are displayed on this screen:  General Enable Session Limit: Check here to enable Session Limit

-68- Figure 3-42 Session List In this table, you can view the session limit information of users configured with Session Limit. Click the <Refres

-69- Figure 3-44 Policy Routing The following items are displayed on this screen:  General Protocol: Select the protocol for the entry in the dro

-70- 3.4 List of Rules You can view the information of the entries and edit them by the Action buttons. The first entry in Figure 3-44 indicate

-71- WAN Config: The WAN port in the secondary WAN list will share the traffic for the WAN in the primary WAN list under the specified condition. M

-72- Figure 3-46 Protocol The following items are displayed on this screen:  Protocol Name: Enter a name to indicate a protocol. The name will di

-73- Figure 3-47 Static Route The following items are displayed on this screen:  Static Route Destination: Enter the destination host the route le

-74- Application Example There is a network topology as the following figure shown: If the LAN port of TL-ER604W（with Non-NAT or Classic system mo

-3- Chapter 2 Introduction Thanks for choosing the SafeStream Wireless N Gigabit Broadband VPN Router TL-ER604W. 2.1 Overview of the Router The Saf

-75- TL-ER604W supports both RIPv1 version and RIPv2 version, thus you can configure the RIP version based on the actual need to improve the network

-76- data via this port. The IP address of next hop is 116.10.1.254 and the hop count is 1. The effective time of this entry is 1 second. Note: ●

-77- 3.53.5 Firewall 3.5.1 Anti ARP Spoofing ARP (Address Resolution Protocol) is used for analyzing and mapping IP addresses to the corresponding

-78- It is recommended to check all the options. You should import the IP and MAC address of the host to IP-MAC Binding List and enable the correspon

-79- Figure 3-51 ARP Scanning Enter the start and the end IP addresses into the Scanning IP Range field. Then click the <Scan> button, the R

-80- Figure 3-52 ARP List The configurations for the entries is the same as the configuration of List of Scanning Result on 3.5.1.2 ARP Scanning pag

-81- Figure 3-53 Attack Defense The following items are displayed on this screen:  General Flood Defense: Flood attack is a commonly used DoS (De

-82- 3.5.3 MAC Filtering On this page, you can control the Internet access of local hosts by specifying their MAC addresses. Choose the menu Firewal

-83- Figure 3-55 URL Filtering The following items are displayed on this screen:  General To control the access to Internet for hosts in your priv

-84- Application Example: Network Requirements: Prevent the local hosts from accessing Internet website www.aabbcc.com and downloading the files with

-4- + Possessing MAC Filtering function to block the access of illegal hosts.  Flexible Traffic Control + Featured Bandwidth Control with flexible

-85- Figure 3-57 Access Rule The following items are displayed on this screen:  Access Rules Policy: Select a policy for the entry:  Block: W

-86- means any IP).  Group: Select a predefined group of users. You can set the group on3.3.1 Group.  ANY: means for any users. Destination: Selec

-87- services if needed. Choose the menu Firewall→Access Control→Service to load the following page. Figure 3-58 Service The following items are

-88- 3.53.5.5 App Control .5.1 Control Rules On this page, you can enable the Application Rules function. Choose the menu Firewall→App Control→Contr

-89- and Proxy. The default setting is to limit all the applications in the application list except for Basic and Proxy. Effective Time: Specify the

-90- cause the private data to be exposed to all the users on the Internet. The VPN (Virtual Private Network) technology is developed and used to est

-91- Figure 3-62 IKE Policy The following items are displayed on this screen:  IKE Policy Policy Name: Specify a unique name to the IKE policy for

-92- 3.6Local ID: The local WAN IP will be inputted automatically if IP Address type is selected. If Name type is selected, enter a name for the loca

-93- Figure 3-63 IKE Proposal The following items are displayed on this screen:  IKE Proposal Proposal Name: Specify a unique name to the IKE pr

-94- 3.6 DH1: 768 bits  DH2: 1024 bits  DH3: 1536 bits  List of IKE Proposal In this table, you can view the information of IKE Proposals and