Good morning
Have a client with 14 Vigor2710n v 3.6.5_232201 and 11 Vigor2830n v2 v 3.7.8.1, Please note the 2710n use the EU firmware to allow dial in VPN. All routers use Dial in VPN as connecting to Eprom based cash registers.

The main problem we are having is the PCI complience are objecting to is allowing login via HTTPS and DrayTec routers using a "Self-signed certificate" rather than one from a "trusted third party Certificate Authority”. If we turn off allow HTTPS can no longer connect to router for remote support, only when hard wired. Is their a away round this. Do you have a certificate from a trusted third party Certificate Authority fro these routeers?

Can supply the cfg we use for both if rquired.

Sorry all. Got that a bit wrong The certificate bit is correct however I should have said if we turn off all remote access other than HTTPS cannot log on for remote support only hard wired. Suggestions for remote access protocols acceptable for PCI compliance. Cannot read my own notes so sorry again for the confusion.

SSL certs need to be generated specific to each router unfortunately!

I am not a PCI QSA but I think your options are:
- Run your own Certiificate Authority (CA) either on one of your Draytek devices or using something like OpenSSL on a PC, then sign all your routers certificates. You need to install the public key from that CA into all devices that connect to the SSL service (not too clear if it's other draytek routers ot the Eprom cash registers themselves, in which case this may not be an option? Plus your management PC). It's still self signed so will fail the PCI test but if the auditor understands technology then they should accept this approach. Best to check with them first, if they don't then you could either find another one who will or pay for certs. Guide on the Draytek side here to using a Draytek router as the CA: http://just.draytek.com/index.php?option=com_k2&view=item&id=5774&Itemid=293&lang=en

- Obtain certificates signed by a public trusted CA, there are free ones available from letsencrypt but they only last 90 days and are best on servers with auto-update scripts which the Drayteks unfortunately don't have. You could buy one for each router at about £50 each and can last at most 3 years, there may be cheaper ones if you shop around. Guide here: http://www.draytek.co.uk/support/guides/kb-local-certificate-management

- Use something other than HTTPS for remote management, like IPSEC VPN (but not PPTP as I doubt PCI would accept that), If your management PC is behind a draytek router and all your sites have static IPs then this might be a good way to do it, but technically complex. I've not had any luck running IPSEC from a PC to a draytek, but others might have fared better.

You could get a wildcard certificate and install that on each router, those appear to have become cheaper now (around £75 per year?). Then give each router a sub-domain to manage it.

IPSec is a good option for making a remote VPN to manage the routers, though L2TP with IPsec is easier to use for remote dial-in type VPNs.
If IPsec isn't working for you, try using the SmartVPN client and make sure the Windows Firewall is enabled, because ipsec requires the firewall to operate.

It might fail PCI anyway as v2710 is an old model and may not support TLS 1.2

Where did you buy them from ?