DrayTek VPN Solution

Outline What is VPN What does VPN Do Supported VPN Protocol How Many Tunnels does Vigor Support VPN Application Special VPN Application CVM (Central VPN Management) Trouble Shooting

What is VPN A virtual private network (VPN) extends a private network across a public network, such as the Internet. It enables a computer to send and receive data across shared or public networks as if it were directly connected to the private network, while benefiting from the functionality, security and management policies of the private network.

What is VPN

What does VPN Do Host to LAN allow employees to securely access their company's intranet while traveling outside the office. Similarly, VPNs securely and cost-effectively connect geographically disparate offices of an organization, creating one cohesive virtual network. We call it as LAN to LAN.

Supported VPN Protocol PPTP (TCP 1723) L2TP (UDP 1701) IPsec (UDP 500) L2TP over IPsec SSL VPN (TCP 443) mOTP

How Many VPN Tunnel does Vigor Support Vigor Model IPsec/PPTP/L2TPSSL Vigor21102N/A Vigor21302N/A Vigor291216N/A Vigor292032N/A Vigor Vigor Vigor Vigor Vigor3200 Series6410 Vigor3300 Series200NA Vigor (PPTP/L2TP 200)20

How Many VPN Tunnel does Vigor Support Vigor ModelIPsec/PPTP/L2TPSSL Vigor27102N/A Vigor27602N/A Vigor Vigor Vigor

VPN Application LAN to LAN Host to LAN – PPTP/L2TP/IPsec/L2TP over IPsec – SSL VPN – mOTP VPN Trunk

LAN to LAN / /24

Host to LAN Client site OS could be – Windows (may use Smart VPN client) – Mac OS/iOS – Android – Ubuntu

SSL VPN SSL Tunnel – TCP port 443 SSL Application SSL Proxy vpn&Itemid=293&lang=en

SSL VPN

mOTP: Mobile One Time Password

VPN Trunk-Load Balance

VPN Trunk-Backup

Special VPN Application Change default route to this VPN tunnel Apply VPN Tunnel as Interface for L/B Policy VPN backup when specified WAN drops Packets trigger to establish the VPN tunnel Add more network into Phase 2 SA

Change Default Route to VPN tunnel Enable VPN default route Go via VPN tunnel for local service

Apply VPN Tunnel as Interface for L/B Policy How to Use Load-Balance/Route Policy

VPN Backup when Specified WAN Down

Add More Network into Phase2 SA

CVM

How to Use Central VPN Management

Trouble Shooting VPN is up but Traffic cannot pass to remote network?

What to Do? Check Routing Table Use ping to diagnose Use trace route to diagnose Check Firewall Rule

Check Routing Table Check Dial-Out Vigor's Routing table Check Dial-In Vigor's Routing table – If the route to remote VPN network doesn't exist, check TCP/IP Network Setting in VPN LAN to LAN profile. – If the route to remote VPN network exists, check if the host can respond ping.

PPTP Dial Out

PPTP Dial In

IPsec Dial Out

IPsec Dial In

Use Ping to Diagnose Ping to host from its Local Router – If Local Router cannot get ping response from the host, check the firewall setting on the host. Find a host that can respond ping from its Local Router, and then ping the host from Remote Router.

Ping Diagnostic

Check ARP Table

Use Trace Route to Diagnose Use command “tracert -d destination IP” to check if the packet is sending through the right gateway.

Check Firewall Rule Check Firewall Rule and see if the packet to remote VPN network is blocked by firewall rule.

Case Study

Router A has two networks connected, which are /24 and /24. Router B has one network connected, which is /24. Computer with IP can ping IP , but cannot ping IP What could we do?

Use Trace Route on Computer with IP to destination IP Result: The packet is routed to the Internet?! Step1:

Check Router B's Routing Table. Result: There is no Route to /24 on Router B. Next Step:

Add Route /24 via More option in VPN LAN to LAN Profile. Then disconnect and reconnect VPN. Result: Router B has route to network /24 now. Next Step:

Use Trace Route on Computer with IP to destination IP again. Result: The packet is stopped at IP Next Step:

Next Step Check Routing Table on Router A with IP Result: Route A has Static Route – to destination /24 via

Try to ping IP from Router A. Result: No ping response from IP Next Step:

Check Router A's ARP Table. Result: There is no ARP for IP It seems the host isn't connected to Router A! Next Step:

Check the Router setting that is connected between Router A and network /24. Result: The correct IP is ! Next Step:

Correct the Static Route setting from Router A then use Trace Route on Computer with IP to destination IP again. Result: It succeeds! Next Step:

Application Note When VPN tunnel is established, why can't I access any host in the remote subnet ? -