Expired

V. VPN (Virtual Private Networking)

Expired

Teleworker VPN - IPsec with XAuth - Vigor 3900

Products:

Keywords:

Show all

The DrayTek routers that support Dial-In VPN connections can use any compatible VPN client to connect a remote dial-in user VPN to achieve secured access to the network connected to the router and its internet connection.

The DrayTek Vigor 2960 and Vigor 3900 routers with 1.3.0 firmware provide IPsec with XAuth authentication, which allows many standard IPsec VPN clients to authenticate with a username and password, creating a securely encrypted IPsec tunnel to the Vigor router with access to network resources and its Internet connection.

This article is broken down into three sections, with the tasks that are required for IPsec VPN dial-in user clients to connect using XAuth authentication:

IPsec XAuth VPN Server Setup	Configure the router's IPsec VPN server for XAuth authentication
VPN Profile Setup	Configuration of VPN user profiles on the router
iOS VPN Client Configuration	Setup of a VPN profile on an Apple iOS device (iPad, iPhone) with the built-in VPN client

IPsec XAuth VPN Server Setup

The DrayTek Vigor 2960 and Vigor 3900 routers are able to support IPsec using XAuth authentication from firmware version 1.3.0 onwards. It is necessary to update to this firmware version (or any later current firmware version) before proceeding.

To configure the Vigor router's IPsec server for dial-in users to connect with XAuth authentication, go to [VPN and Remote Access] > [Remote Access Control]:

Ensure that Enable IPsec Service is ticked
Set IPsec Remote Dial-In Service to DHCP over IPsec

Click Apply to apply the change to the router's VPN services.

Go to [VPN and Remote Access] > [IPsec General Setup] to configure the router's IPsec VPN server for dial-in users:

Set the IPsec User Preshared Key with a secure password, this Preshared key is shared between all users that will connect via XAuth authentication.

Click Apply to save and apply the change.

VPN Profile Setup

VPN / User Profile Setup

VPN profiles for the Vigor 2960 and 3900 routers are configured in the User Management section; each user profile can be configured to connect to a specified LAN / VLAN and allow dial-in VPN services on a per-user basis.

To set up the VPN profile on the router, go to [User Management] > [User Profile], click Add in the User Profile tab to create a new user profile.

Enable the profile
Enter a suitable Username, please note that this cannot be changed after creating the user account
Set a secure Password
Click on the IPsec User Setting bar to expand the VPN options for the profile
Enable XAuth

Click Apply to save the changes to that profile. The router is now ready to accept client IPsec VPN connections with those credentials.

iOS VPN Client Configuration

iOS Device VPN Client Configuration

Apple's iOS (used by iPad, iPhone and iPod Touch devices) has a built-in VPN client with support for IPsec encrypted VPN tunnels, this uses XAuth as the authentication method to allow dial-in users to connect with individual usernames and passwords.

On the Apple iPad / iPhone, open the Settings menu.

Go to the General menu and select VPN

Select Add VPN Configuration to create a new VPN profile

In the VPN profile, configure the following settings:

Type	IPSec
Description	Enter a name for the VPN profile
Server	Hostname or IP address of the VPN server router. In this example, the hostname is "london.company.vpn"
Account	Username of account configured in [User Management] > [User Profile]
Password	Password of account configured in [User Management] > [User Profile]
Use Certificate	Leave this option disabled
Group Name	Leave this field blank
Secret	Enter the IPsec User Pre-shared Key that is configured on the router under [VPN and Remote Access] > [IPsec General Setup]

Press Done to save the VPN profile.

To establish the VPN tunnel, select the profile from the list in the VPN menu and toggle the Status option to establish the VPN tunnel.

Note that the iOS device must be connected to a different network so that the router is accessed over the Internet, the router's VPN server does not accept VPN connections on the LAN side.

When the VPN tunnel is established, press the "i" button to view the connection status:

The status of the VPN tunnel can be viewed from the router's web interface under [VPN and Remote Access] > [Connection Management].

How do you rate this article?

1 1 1 1 1 1 1 1 1 1

: First Published: 06/04/2018; Last Updated: 06/04/2020

Share this link

Teleworker VPN - IPsec with XAuth - Vigor 3900

IPsec XAuth VPN Server Setup

IPsec XAuth VPN Server Setup