NETGEAR FVS318G User Manual

Loading...

ProSafe Gigabit 8 Port

VPN Firewall FVS318G

Reference Manual

NETGEAR, Inc.

350 East Plumeria Drive

San Jose, CA 95134

202-10521-02

v1.1

August 2010

© 2009–2010 by NETGEAR, Inc. All rights reserved.

Technical Support

Please refer to the support information card that shipped with your product. By registering your product at http://www.netgear.com/register, we can provide you with faster expert technical support and timely notices of product and software upgrades.

NETGEAR, INC. Support Information

Phone: 1-888-NETGEAR, for US & Canada only. For other countries, see your Support information card. Email: support@netgear.com

North American NETGEAR website: http://www.netgear.com

Trademarks

NETGEAR and the NETGEAR logo are registered trademarks and ProSafe is a trademark of NETGEAR, Inc. Microsoft, Windows, and Windows NT are registered trademarks of Microsoft Corporation. Other brand and product names are registered trademarks or trademarks of their respective holders.

Statement of Conditions

In the interest of improving internal design, operational function, and/or reliability, NETGEAR reserves the right to make changes to the products described in this document without notice.

NETGEAR does not assume any liability that may occur due to the use or application of the product(s) or circuit layout(s) described herein.

Federal Communications Commission (FCC) Compliance Notice: Radio Frequency Notice

This equipment has been tested and found to comply with the limits for a Class B digital device, pursuant to

part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a residential installation. This equipment generates, uses, and can radiate radio frequency energy and, if not installed and used in accordance with the instructions, may cause harmful interference to radio communications. However, there is no guarantee that interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures:

Reorient or relocate the receiving antenna.

Increase the separation between the equipment and receiver.

Connect the equipment into an outlet on a circuit different from that to which the receiver is connected.

Consult the dealer or an experienced radio/TV technician for help.

EU Regulatory Compliance Statement

The ProSafe Gigabit 8 Port VPN Firewall FVS318G is compliant with the following EU Council Directives: 89/336/ EEC and LVD 73/23/EEC. Compliance is verified by testing to the following standards: EN55022 Class B, EN55024 and EN60950-1.

Visit the NETGEAR EU Declarations of Conformity website at: http://kb.netgear.com/app/answers/detail/a_id/11621/sno/0

ii

v1.1, August 2010

Bestätigung des Herstellers/Importeurs

Es wird hiermit bestätigt, daß das ProSafe Gigabit 8 Port VPN Firewall FVS318G gemäß der im BMPT-AmtsblVfg 243/ 1991 und Vfg 46/1992 aufgeführten Bestimmungen entstört ist. Das vorschriftsmäßige Betreiben einiger Geräte (z.B. Testsender) kann jedoch gewissen Beschränkungen unterliegen. Lesen Sie dazu bitte die Anmerkungen in der Betriebsanleitung.

Das Bundesamt für Zulassungen in der Telekommunikation wurde davon unterrichtet, daß dieses Gerät auf den Markt gebracht wurde und es ist berechtigt, die Serie auf die Erfüllung der Vorschriften hin zu überprüfen.

Certificate of the Manufacturer/Importer

It is hereby certified that the ProSafe Gigabit 8 Port VPN Firewall FVS318G has been suppressed in accordance with the conditions set out in the BMPT-AmtsblVfg 243/1991 and Vfg 46/1992. The operation of some equipment (for example, test transmitters) in accordance with the regulations may, however, be subject to certain restrictions. Please refer to the notes in the operating instructions.

Federal Office for Telecommunications Approvals has been notified of the placing of this equipment on the market and has been granted the right to test the series for compliance with the regulations.

Voluntary Control Council for Interference (VCCI) Statement

This equipment is in the second category (information equipment to be used in a residential area or an adjacent area thereto) and conforms to the standards set by the Voluntary Control Council for Interference by Data Processing Equipment and Electronic Office Machines aimed at preventing radio interference in such residential areas.

When used near a radio or TV receiver, it may become the cause of radio interference. Read instructions for correct handling.

Additional Copyrights

AES

Copyright (c) 2001, Dr. Brian Gladman, brg@gladman.uk.net, Worcester, UK.

 

All rights reserved.

 

TERMS

 

Redistribution and use in source and binary forms, with or without modification, are permitted

 

subject to the following conditions:

 

1.

Redistributions of source code must retain the above copyright notice, this list of

 

 

conditions, and the following disclaimer.

 

2.

Redistributions in binary form must reproduce the above copyright notice, this list of

 

 

conditions, and the following disclaimer in the documentation and/or other materials

 

 

provided with the distribution.

 

3.

The copyright holder’s name must not be used to endorse or promote any products

 

 

derived from this software without his specific prior written permission.

 

This software is provided “as is” with no express or implied warranties of correctness or fitness

 

for purpose.

 

 

 

iii

v1.1, August 2010

Open SSL Copyright (c) 1998–2000 The OpenSSL Project. All rights reserved.

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

1.Redistributions of source code must retain the above copyright notice, this list of conditions, and the following disclaimer.

2.Redistributions in binary form must reproduce the above copyright notice, this list of conditions, and the following disclaimer in the documentation and/or other materials provided with the distribution.

3.All advertising materials mentioning features or use of this software must display the

following acknowledgment: “This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit (http://www.openssl.org/).”

4.The names “OpenSSL Toolkit” and “OpenSSL Project” must not be used to endorse or promote products derived from this software without prior written permission. For written permission, contact openssl-core@openssl.org.

5.Products derived from this software may not be called “OpenSSL” nor may “OpenSSL” appear in their names without prior written permission of the OpenSSL Project.

6.Redistributions of any form whatsoever must retain the following acknowledgment: “This

product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit (http://www.openssl.org/).”

THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT “AS IS,” AND ANY EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

This product includes cryptographic software written by Eric Young (eay@cryptsoft.com). This product includes software written by Tim Hudson (tjh@cryptsoft.com).

MD5

Copyright (C) 1990, RSA Data Security, Inc. All rights reserved.

 

License to copy and use this software is granted provided that it is identified as the “RSA Data

 

Security, Inc. MD5 Message-Digest Algorithm” in all material mentioning or referencing this

 

software or this function. License is also granted to make and use derivative works provided

 

that such works are identified as “derived from the RSA Data Security, Inc. MD5 Message-

 

Digest Algorithm” in all material mentioning or referencing the derived work.

 

RSA Data Security, Inc. makes no representations concerning either the merchantability of

 

this software or the suitability of this software for any particular purpose. It is provided “as is”

 

without express or implied warranty of any kind.

 

These notices must be retained in any copies of any part of this documentation and/or

 

software.

iv

v1.1, August 2010

PPPCopyright (c) 1989 Carnegie Mellon University. All rights reserved.

Redistribution and use in source and binary forms are permitted provided that the above copyright notice and this paragraph are duplicated in all such forms and that any documentation, advertising materials, and other materials related to such distribution and use acknowledge that the software was developed by Carnegie Mellon University. The name of the University may not be used to endorse or promote products derived from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED “AS IS” AND WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.

Zlib

zlib.h. Interface of the zlib general purpose compression library version 1.1.4, March 11th,

 

2002. Copyright (C) 1995–2002 Jean-loup Gailly and Mark Adler.

 

This software is provided “as is,” without any express or implied warranty. In no event will the

 

authors be held liable for any damages arising from the use of this software. Permission is

 

granted to anyone to use this software for any purpose, including commercial applications,

 

and to alter it and redistribute it freely, subject to the following restrictions:

 

1. The origin of this software must not be misrepresented; you must not claim that you wrote

 

the original software. If you use this software in a product, an acknowledgment in the

 

product documentation would be appreciated but is not required.

 

2. Altered source versions must be plainly marked as such, and must not be misrepresented

 

as being the original software.

 

3. This notice may not be removed or altered from any source distribution.

 

Jean-loup Gailly: jloup@gzip.org; Mark Adler: madler@alumni.caltech.edu.

 

The data format used by the zlib library is described by RFCs (Request for Comments) 1950

 

to 1952 in the files ftp://ds.internic.net/rfc/rfc1950.txt (zlib format), rfc1951.txt (deflate

 

format), and rfc1952.txt (gzip format).

Product and Publication Details

Model Number:

FVS318G

Publication Date:

August 2010

Product Family:

VPN Firewall

Product Name:

ProSafe Gigabit 8 Port VPN Firewall FVS318G

Home or Business Product:

Business

Language:

English

Publication Part Number:

202-10521-02

Publication Version Number

1.1

v

v1.1, August 2010

vi

v1.1, August 2010

Contents

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual

About This Manual

 

Conventions, Formats and Scope ...................................................................................

xiii

How to Print This Manual ...............................................................................................

xiv

Chapter 1

 

Introduction

 

Key Features ..................................................................................................................

1-1

Advanced VPN Support for IPsec ............................................................................

1-2

A Powerful, True Firewall with Content Filtering ......................................................

1-2

Security Features .....................................................................................................

1-3

Autosensing Ethernet Connections with Auto Uplink ...............................................

1-3

Extensive Protocol Support ......................................................................................

1-4

Easy Installation and Management ..........................................................................

1-4

Maintenance and Support ........................................................................................

1-5

Package Contents ..........................................................................................................

1-5

VPN Firewall Front and Rear Panels ..............................................................................

1-6

Default IP Address, Login Name, and Password ...........................................................

1-8

Qualified Web Browsers .................................................................................................

1-8

Chapter 2

 

Connecting the VPN Firewall to the Internet

 

Understanding the Connection Steps .............................................................................

2-1

Logging into the VPN Firewall ........................................................................................

2-2

Navigating the Menus .....................................................................................................

2-3

Configuring the Internet Connection to Your ISP ...........................................................

2-4

Manually Configuring Your Internet Connection ......................................................

2-6

Configuring the WAN Mode ............................................................................................

2-9

Configuring Dynamic DNS ............................................................................................

2-11

Configuring the Advanced Broadband Options ............................................................

2-13

Additional WAN Related Configuration ..................................................................

2-14

vii

v1.1, August 2010

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual

Chapter 3

LAN Configuration

Choosing the VPN Firewall DHCP Options ....................................................................

3-1

Configuring the LAN Setup Options ...............................................................................

3-2

Managing Groups and Hosts (LAN Groups) ...................................................................

3-5

Creating the Network Database ...............................................................................

3-6

Viewing the Network Database ................................................................................

3-7

Adding Devices to the Network Database ................................................................

3-8

Changing Group Names in the LAN Groups Database ...........................................

3-9

Setting Up DHCP Address Reservation ...................................................................

3-9

Configuring Multi Home LAN IP Addresses ..................................................................

3-10

Configuring and Enabling the DMZ Port .......................................................................

3-11

Configuring Static Routes .............................................................................................

3-14

Static Route Example .............................................................................................

3-16

Configuring Routing Information Protocol (RIP) ...........................................................

3-17

Chapter 4

 

Firewall Protection and Content Filtering

 

About Firewall Protection and Content Filtering .............................................................

4-1

Using Rules to Block or Allow Specific Kinds of Traffic ..................................................

4-2

Services-Based Rules ..............................................................................................

4-3

Viewing Rules and Order of Precedence for Rules ..................................................

4-8

Configuring LAN WAN Rules ...................................................................................

4-9

Configuring DMZ WAN Rules ................................................................................

4-12

Configuring LAN DMZ Rules ..................................................................................

4-13

Inbound Rules Examples .......................................................................................

4-15

Outbound Rules Example ......................................................................................

4-19

Configuring Other Firewall Features .............................................................................

4-19

Attack Checks ........................................................................................................

4-20

Setting Session Limits ............................................................................................

4-22

Managing the Application Level Gateway for SIP Sessions ..................................

4-23

Creating Services, QoS Profiles, and Bandwidth Profiles ............................................

4-24

Adding Customized Services .................................................................................

4-24

Specifying Quality of Service (QoS) Priorities ........................................................

4-26

Creating Bandwidth Profiles ...................................................................................

4-27

Setting a Schedule to Block or Allow Specific Traffic ...................................................

4-29

 

 

viii

Contents

v1.1, August 2010

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual

Blocking Internet Sites (Content Filtering) ....................................................................

4-30

Configuring Source MAC Filtering ................................................................................

4-33

Configuring IP/MAC Address Binding ...........................................................................

4-35

Configuring Port Triggering ..........................................................................................

4-37

Configuring UPnP (Universal Plug and Play) ...............................................................

4-40

Email Notifications of Event Logs and Alerts ................................................................

4-41

Administrator Tips .........................................................................................................

4-42

Chapter 5

 

Virtual Private Networking

 

Using the VPN Wizard for Client and Gateway Configurations ......................................

5-1

Creating Gateway to Gateway VPN Tunnels with the Wizard .................................

5-2

Creating a Client to Gateway VPN Tunnel ...............................................................

5-5

Testing the Connections and Viewing Status Information ............................................

5-11

NETGEAR VPN Client Status and Log Information ...............................................

5-11

VPN Firewall VPN Connection Status and Logs ....................................................

5-14

Managing VPN Policies ................................................................................................

5-15

Configuring IKE Policies .........................................................................................

5-15

Configuring VPN Policies .......................................................................................

5-23

Managing Certificates ...................................................................................................

5-30

Understanding the Certificates Screen ..................................................................

5-32

Viewing and Loading CA Certificates .....................................................................

5-32

Understanding and Viewing Active Self Certificates ..............................................

5-33

Obtaining a Self Certificate from a Certificate Authority .........................................

5-35

Managing your Certificate Revocation List (CRL) ..................................................

5-38

Configuring Extended Authentication (XAUTH) ............................................................

5-39

Configuring XAUTH for VPN Clients ......................................................................

5-39

Configuring the User Database for XAUTH ...........................................................

5-41

Configuring RADIUS Clients for XAUTH ................................................................

5-42

Assigning IP Addresses to Remote Users (ModeConfig) .............................................

5-44

Mode Config Operation ..........................................................................................

5-44

Configuring Mode Config Operation on the VPN Firewall ......................................

5-45

Configuring the ProSafe VPN Client for ModeConfig .............................................

5-50

Configuring Keepalives and Dead Peer Detection .......................................................

5-53

Configuring Keepalives ..........................................................................................

5-53

Configuring Dead Peer Detection ..........................................................................

5-54

 

 

Contents

ix

v1.1, August 2010

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual

Configuring NetBIOS Bridging with VPN ......................................................................

5-55

Chapter 6

 

VPN Firewall and Network Management

 

Performance Management .............................................................................................

6-1

Bandwidth Capacity .................................................................................................

6-1

VPN Firewall Features That Reduce Traffic .............................................................

6-2

VPN Firewall Features That Increase Traffic ...........................................................

6-4

Using QoS to Shift the Traffic Mix ............................................................................

6-7

Tools for Traffic Management ..................................................................................

6-8

Configuring Users, Administrative Settings, and Remote Management .........................

6-8

Changing Passwords and Settings ..........................................................................

6-8

Adding External Users ...........................................................................................

6-10

Configuring an External Server for Authentication .................................................

6-11

Enabling Remote Management Access .................................................................

6-14

Using an SNMP Manager ......................................................................................

6-16

Managing the Configuration File ............................................................................

6-18

Configuring Date and Time Service .......................................................................

6-21

Monitoring System Performance ..................................................................................

6-23

Activating Notification of Events and Alerts ............................................................

6-23

Viewing the Logs ....................................................................................................

6-26

Enabling the Traffic Meter ......................................................................................

6-27

Viewing the VPN Firewall Configuration and System Status .................................

6-30

Monitoring VPN Firewall Statistics .........................................................................

6-31

Monitoring Broadband Port Status .........................................................................

6-32

Monitoring Attached Devices .................................................................................

6-33

Monitoring VPN Tunnel Connection Status ............................................................

6-34

Viewing the VPN Logs ...........................................................................................

6-35

Viewing the DHCP Log ..........................................................................................

6-36

Viewing Port Triggering Status ...............................................................................

6-36

Chapter 7

 

Troubleshooting

 

Basic Functions ..............................................................................................................

7-1

Power LED Not On ...................................................................................................

7-2

LEDs Never Turn Off ................................................................................................

7-2

LAN or Internet Port LEDs Not On ...........................................................................

7-2

 

 

x

Contents

v1.1, August 2010

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual

Troubleshooting the Web Configuration Interface ..........................................................

7-3

Troubleshooting the ISP Connection ..............................................................................

7-4

Troubleshooting a TCP/IP Network Using a Ping Utility .................................................

7-5

Testing the LAN Path to Your VPN Firewall .............................................................

7-5

Testing the Path from Your PC to a Remote Device ................................................

7-6

Restoring the Default Configuration and Password ........................................................

7-7

Problems with Date and Time ........................................................................................

7-7

Using the Diagnostics Utilities ........................................................................................

7-8

Appendix A

 

Default Settings and Technical Specifications

 

Appendix B

 

Two Factor Authentication

 

Why do I need Two-Factor Authentication? ..................................................................

B-1

What are the benefits of Two-Factor Authentication? .............................................

B-1

What is Two-Factor Authentication .........................................................................

B-2

NETGEAR Two-Factor Authentication Solutions ..........................................................

B-2

Appendix C

 

Related Documents

 

Index

Contents

xi

v1.1, August 2010

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual

xii

Contents

v1.1, August 2010

About This Manual

The NETGEAR® ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual describes how to install, configure and troubleshoot the ProSafe Gigabit 8 Port VPN Firewall FVS318G. The information in this manual is intended for readers with intermediate computer and Internet skills.

Conventions, Formats and Scope

The conventions, formats, and scope of this manual are described in the following paragraphs.

Typographical Conventions. This manual uses the following typographical conventions:

Italics

Emphasis, books, CDs, file and server names, extensions

 

 

Bold

User input, IP addresses, GUI screen text

 

 

Fixed

Command prompt, CLI text, code

italics

URL links

 

 

Formats. This manual uses the following formats to highlight special messages:

Note: This format is used to highlight information of importance or special interest.

Tip: This format is used to highlight a procedure that will save time or resources.

Warning: Ignoring this type of note may result in a malfunction or damage to the equipment.

Danger: This is a safety warning. Failure to take heed of this notice may result in personal injury or death.

xiii

v1.1, August 2010

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual

Scope. This manual is written for the VPN firewall according to these specifications.

Product Version

ProSafe Gigabit 8 Port VPN Firewall FVS318G

 

 

Manual Publication Date

August 2010

 

 

For more information about network, Internet, firewall, and VPN technologies, see the links to the NETGEAR website in Appendix C, “Related Documents.”

Note: Product updates are available on the NETGEAR, Inc. website at

http://kb.netgear.com/app/home.

How to Print This Manual

To print this manual, your computer must have the free Adobe Acrobat reader installed in order to view and print PDF files. The Acrobat reader is available on the Adobe website at http://www.adobe.com.

Tip: If your printer supports printing two pages on a single sheet of paper, you can save paper and printer ink by selecting this feature.

Revision History

Part Number

Version

Date

Description

Number

 

 

 

 

202-10521-01

1.0

July 2009

Product update: New firmware and new user Interface

 

 

 

 

202-10521-01

1.1

November

Update to LAN and firewall configuration

 

 

2009

 

 

 

 

 

xiv

About This Manual

v1.1, August 2010

 

 

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual

 

 

 

 

 

 

 

202-10521-02

1.0

April 2010

Added the following new features for the April 2010 firmware

 

 

 

maintenance release:

 

 

 

• Connection reset and delay options on the Broadband ISP

 

 

 

Settings screen (see “Manually Configuring Your Internet

 

 

 

Connection”).

 

 

 

• Support for an address range for inbound LAN rules on the Add

 

 

 

LAN WAN Inbound Service screen (see “Inbound Rules (Port

 

 

 

Forwarding)” and “Inbound Rules Examples”).

 

 

 

• Support for new log options such as Resolved DNS Names and

 

 

 

VPN on the Firewall Logs & E-mail screen (see “Activating

 

 

 

Notification of Events and Alerts”).

 

 

 

In addition, made the following substantial changes to the book:

 

 

 

• Provided new screen captures for better viewing.

 

 

 

• Made minor corrections throughout the manual.

 

 

 

• Removed the “Managing Users, Authentication, and Certificates”

 

 

 

chapter and included the material in other chapters.

 

 

 

• Made the following change to Chapter 2, “Connecting the VPN

 

 

 

Firewall to the Internet”:

 

 

 

* Updated the Broadband ISP Settings screen (Figure 2-2) and

 

 

 

the ISP Type options in the ”“Manually Configuring Your Internet

 

 

 

Connection” section.

 

 

 

• Made the following changes and addition to Chapter 3, “LAN

 

 

 

Configuration”:

 

 

 

* Updated the LAN Setup screen (Figure 3-1), added LDAP

 

 

 

information and the Enable ARP Broadcast paragraph to the

 

 

 

“Configuring the LAN Setup Options” section, and revised this

 

 

 

section for more clarity.

 

 

 

* Updated the LAN Multi-homing screen (Figure 3-4) and revised

 

 

 

the “Configuring Multi Home LAN IP Addresses” section for more

 

 

 

clarity.

 

 

 

* Added the “Configuring and Enabling the DMZ Port” section.

 

 

 

• Reorganized Chapter 4, “Firewall Protection and Content

 

 

 

Filtering” and added the following sections to this chapter:

 

 

 

* “Configuring DMZ WAN Rules

 

 

 

* “Configuring LAN DMZ Rules

 

 

 

* “Managing the Application Level Gateway for SIP Sessions

 

 

 

* “Configuring UPnP (Universal Plug and Play)

 

 

 

• Made the following changes to Chapter 5, “Virtual Private

 

 

 

Networking”:

 

 

 

* Revised the “Managing VPN Policies” section

 

 

 

* Revised the “Managing Certificates” section

 

 

 

• Added the following section to Chapter 6, “VPN Firewall and

 

 

 

Network Management”:

 

 

 

* “Monitoring System Performance

 

 

 

 

202-10521-02

1.1

Aug 2010

Added Multicast pass through to Attack Check screen.

 

 

 

 

 

 

 

 

About This Manual

 

xv

v1.1, August 2010

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual

xvi

About This Manual

v1.1, August 2010

Chapter 1

Introduction

The ProSafe Gigabit 8 Port VPN Firewall FVS318G with eight 10/100/1000 Mbps Gigabit Ethernet LAN ports and one 10/100/1000 Mbps Gigabit Ethernet WAN port connects your local area network (LAN) to the Internet through an external access device such as a cable modem or DSL modem.

The FVS318G is a complete security solution that protects your network from attacks and intrusions. For example, the FVX538 provides support for Stateful Packet Inspection, Denial of Service (DoS) attack protection and multi-NAT support. The VPN firewall supports multiple Web content filtering options, plus browsing activity reporting and instant alerts—both via email. Network administrators can establish restricted access policies based on time-of-day, website addresses and address keywords.

The FVS318G is a plug-and-play device that can be installed and configured within minutes. This chapter contains the following sections:

“Key Features” on this page

“Package Contents” on page 1-5

“VPN Firewall Front and Rear Panels” on page 1-6

“Default IP Address, Login Name, and Password” on page 1-8

“Qualified Web Browsers” on page 1-8

Key Features

The FVS318G provides the following features:

One 10/100/1000 Mbps Ethernet WAN port for connection to a WAN device, such as a cable modem or DSL modem.

Built-in eight-port 10/100/1000 Mbps Gigabit Ethernet LAN switch for extremely fast data transfer between local network resources.

Support for up to 253 internal LAN users.

Advanced VPN support for IPsec.

1-1

v1.1, August 2010

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual

SNMP Manageable, optimized for the NETGEAR ProSafe Network Management Software (NMS100).

Easy, Web-based setup for installation and management.

Advanced SPI Firewall and Multi-NAT support.

Extensive Protocol Support.

Login capability.

One console port for local management.

Front panel LEDs for easy monitoring of status and activity.

Flash memory for firmware upgrade.

Advanced VPN Support for IPsec

The VPN firewall supports IPsec virtual private network (VPN) connections.

IPsec VPN delivers full network access between a central office and branch offices, or between a central office and telecommuters. Remote access by telecommuters requires the installation of VPN client software on the remote computer.

IPsec VPN with broad protocol support for secure connection to other IPsec gateways and clients.

Bundled with a single-user license of the NETGEAR ProSafe VPN Client software (VPN01L)

Supports 5 concurrent IPsec VPN tunnels.

A Powerful, True Firewall with Content Filtering

Unlike simple Internet sharing NAT routers, the FVS318G is a true firewall, using stateful packet inspection to defend against hacker attacks. Its firewall features include:

DoS protection. Automatically detects and thwarts DoS attacks such as Ping of Death, SYN Flood, LAND Attack, and IP Spoofing.

Secure Firewall. Blocks unwanted traffic from the Internet to your LAN.

Block Sites. Blocks access from your LAN to Internet locations or services that you specify as off-limits.

Logs security incidents. The FVS318G will log security events such as blocked incoming traffic, port scans, attacks, and administrator logins. You can configure the VPN firewall to email the log to you at specified intervals. You can also configure the VPN firewall to send immediate alert messages to your email address or email pager whenever a significant event occurs.

1-2

Introduction

v1.1, August 2010

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual

Keyword Filtering. With its URL keyword filtering feature, the FVS318G prevents objectionable content from reaching your PCs. The VPN firewall allows you to control access to Internet content by screening for keywords within Web addresses. You can configure the VPN firewall to log and report attempts to access objectionable Internet sites.

Security Features

The FVS318G is equipped with several features designed to maintain security, as described in this section.

PCs Hidden by NAT. NAT opens a temporary path to the Internet for requests originating from the local network. Requests originating from outside the LAN are discarded, preventing users outside the LAN from finding and directly accessing the PCs on the LAN.

Port Forwarding with NAT. Although NAT prevents Internet locations from directly accessing the PCs on the LAN, the VPN firewall allows you to direct incoming traffic to specific PCs based on the service port number of the incoming request. You can specify forwarding of single ports or ranges of ports.

DMZ port. Incoming traffic from the Internet is normally discarded by the VPN firewall unless the traffic is a response to one of your local computers or a service for which you have configured an inbound rule. Instead of discarding this traffic, you can have it forwarded to one computer on your network.

Autosensing Ethernet Connections with Auto Uplink

With its internal 8-port 10/100/1000 Mbps switch and 10/100/1000 WAN port, the FVS318G can connect to either a 10 Mbps standard Ethernet network, a 100 Mbps Fast Ethernet network, or a 1000 Mbps Gigabit Ethernet network. The LAN and WAN interfaces are autosensing and capable of full-duplex or half-duplex operation.

The VPN firewall incorporates Auto UplinkTM technology. Each Ethernet port will automatically sense whether the Ethernet cable plugged into the port should have a ‘normal’ connection such as to a PC or an “uplink” connection such as to a switch or hub. That port will then configure itself to the correct configuration. This feature also eliminates the need to worry about crossover cables, as Auto Uplink will accommodate either type of cable to make the right connection.

Introduction

1-3

v1.1, August 2010

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual

Extensive Protocol Support

The FVS318G supports the Transmission Control Protocol/Internet Protocol (TCP/IP) and Routing Information Protocol (RIP). For further information about TCP/IP, see the “TCP/IP Networking Basics” document that you can access from the link in “Related Documents” in Appendix C.

IP Address Sharing by NAT. The VPN firewall allows several networked PCs to share an Internet account using only a single IP address, which may be statically or dynamically assigned by your Internet service provider (ISP). This technique, known as NAT, allows the use of an inexpensive single-user ISP account.

Automatic Configuration of Attached PCs by DHCP. The VPN firewall dynamically assigns network configuration information, including IP, gateway, and domain name server (DNS) addresses, to attached PCs on the LAN using the Dynamic Host Configuration Protocol (DHCP). This feature greatly simplifies configuration of PCs on your local network.

DNS Proxy. When DHCP is enabled and no DNS addresses are specified, the VPN firewall provides its own address as a DNS server to the attached PCs. The VPN firewall obtains actual DNS addresses from the ISP during connection setup and forwards DNS requests from the LAN.

PPP over Ethernet (PPPoE). PPPoE is a protocol for connecting remote hosts to the Internet over a DSL connection by simulating a dial-up connection. This feature eliminates the need to run a login program such as EnterNet or WinPOET on your PC.

Quality of Service (QoS). QoS support for traffic prioritization.

Easy Installation and Management

You can install, configure, and operate the FVS318G within minutes after connecting it to the network. The following features simplify installation and management tasks:

Browser-Based Management. Browser-based configuration allows you to easily configure your VPN firewall from almost any type of personal computer, such as Windows, Macintosh, or Linux. A user-friendly Setup Wizard is provided and online help documentation is built into the browser-based Web Management Interface.

Auto Detect. The VPN firewall automatically senses the type of Internet connection, asking you only for the information required for your type of ISP account.

VPN Wizard. The VPN firewall includes the NETGEAR VPN Wizard to easily configure VPN tunnels according to the recommendations of the Virtual Private Network Consortium (VPNC) to ensure the VPN tunnels are interoperable with other VPNC-compliant VPN routers and clients.

1-4

Introduction

v1.1, August 2010

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual

SNMP. The VPN firewall supports the Simple Network Management Protocol (SNMP) to let you monitor and manage log resources from an SNMP-compliant system manager. The SNMP system configuration lets you change the system variables for MIB2.

Diagnostic Functions. The VPN firewall incorporates built-in diagnostic functions such as Ping, Trace Route, DNS lookup, and remote reboot.

Remote Management. The VPN firewall allows you to login to the Web Management Interface from a remote location on the Internet. For security, you can limit remote management access to a specified remote IP address or range of addresses.

Visual monitoring. The VPN firewall’s front panel LEDs provide an easy way to monitor its status and activity.

Maintenance and Support

NETGEAR offers the following features to help you maximize your use of the FVS318G:

Flash memory for firmware upgrade

Technical support seven days a week, 24 hours a day, according to the terms identified in the Warranty and Support information card provided with your product.

Package Contents

The product package should contain the following items:

FVS318G ProSafe Gigabit 8 Port VPN Firewall FVS318G

AC power cable

Rubber feet

Category 5 (Cat5) Ethernet cable

ProSafe Gigabit 8 Port VPN Firewall FVS318G Installation Guide

Resource CD, including:

Application Notes and other helpful information.

ProSafe VPN Client software (one user license)

Warranty and Support Information Card

If any of the parts are incorrect, missing, or damaged, contact your NETGEAR dealer. Keep the carton, including the original packing materials, in case you need to return the VPN firewall for repair.

Introduction

1-5

v1.1, August 2010

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual

VPN Firewall Front and Rear Panels

The FVS318G front panel includes eight LAN ports, one WAN port, and four groups of status indicator light-emitting diodes (LEDs), including Power and Test, LAN, and WAN LEDs.

4

1

 

 

 

 

 

 

 

 

6

7

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

1

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

2

 

 

 

 

 

 

 

5

3

Figure 1-1

Table 1-1 describes each item on the front panel and its operation.

Table 1-1. LED Descriptions

Object

Activity

Description

 

 

 

1. Power

On (Green)

Power is supplied to the VPN firewall.

Off

Power is not supplied to the VPN firewall.

 

 

 

 

2. Test

On (Amber)

Test mode: The system is initializing or the initialization has failed.

Off

The system has booted successfully.

 

 

 

 

Eight LAN Ports

 

 

 

 

 

3. Link and Activity

On (Green)

The port has detected a link with a connected Ethernet device.

Blinking (Green)

Data is being transmitted or received by the port.

(left side of port)

Off

The port has no link.

 

 

 

 

4. Speed

On (Green)

The LAN port is operating at 1,000 Mbps.

On (Amber)

The LAN port is operating at 100 Mbps.

(right side of port)

Off

The LAN port is operating at 10 Mbps.

 

 

 

 

5. DMZ

On (Green)

LAN port 8 is enabled as a DMZ port.

Off

LAN port 8 is not enabled as a DMZ port.

 

 

 

 

1-6 Introduction

v1.1, August 2010

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual

Table 1-1. LED Descriptions (continued)

Object

Activity

Description

 

 

 

One WAN Port

 

 

 

 

 

6. Active

On (Green)

The WAN port is connected.

Off)

The Internet connection is down The WAN port is either not

(left side of port)

 

enabled or has no link.

 

 

 

 

 

7. Speed

On (Green)

The port is operating at 1,000 Mbps.

On (Amber)

The port is operating at 100 Mbps.

(right side of port)

Off

The port is operating at 10 Mbps.

 

 

 

 

The rear panel of the FVS318G includes a cable lock receptacle, a Factory Defaults button, and a DC power connection.

1

2

3

Figure 1-2

Viewed from left to right, the rear panel contains the following elements:

1.Cable security lock receptacle.

2.Factory Defaults button: Using a sharp object, press and hold this button for about ten seconds until the front panel TEST light flashes to reset the VPN firewall to factory default settings. All configuration settings will be lost and the default password will be restored.

3.DC power receptacle: 12V @ 1.5A.

Introduction

1-7

v1.1, August 2010

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual

Default IP Address, Login Name, and Password

Check the label on the bottom of the FVS318G’s enclosure if you forget the following factory default information:

IP Address: http://192.168.1.1

User name: admin

Password: password

LAN IP Address

User Name

Password

Figure 1-3

When FVS318G is connected, log in by going to go to http://192.168.1.1. When the login screen displays (see Figure 2-1 on page 2-2), enter admin for the user name and the password for password.

Qualified Web Browsers

To configure the FVS318G, you must use a Web browser such as Internet Explorer 5.1 or higher, Apple Safari 1.2 or higher, or Mozilla Firefox l.x Web browser with JavaScript, and cookies enabled.

1-8

Introduction

v1.1, August 2010

Chapter 2 Connecting the VPN Firewall to the Internet

This section provides instructions for connecting the ProSafe Gigabit 8 Port VPN Firewall FVS318G, including these topics:

“Understanding the Connection Steps” on this page

“Logging into the VPN Firewall” on page 2-2

“Navigating the Menus” on page 2-3

“Configuring the Internet Connection to Your ISP” on page 2-4

“Configuring the WAN Mode” on page 2-9

“Configuring Dynamic DNS” on page 2-11

“Configuring the Advanced Broadband Options” on page 2-13

Setting up VPN tunnels is covered in Chapter 5, “Virtual Private Networking.”

Understanding the Connection Steps

Typically, six steps are required to complete the basic Internet connection of your VPN firewall.

1.Connect the VPN firewall physically to your network. Connect the cables and restart your network according to the instructions in the installation guide. See the ProSafe Gigabit 8 Port VPN Firewall FVS318G Installation Guide for complete steps. A PDF of the Installation Guide is on the NETGEAR website at: http://kbserver.netgear.com.

2.Log in to the VPN Firewall. After logging in, you are ready to set up and configure your VPN firewall. You can also change your password and enable remote management at this time. See “Logging into the VPN Firewall” on page 2-2.

3.Configure the Internet connection to your ISP. During this phase, you will connect to your ISP. See “Configuring the Internet Connection to Your ISP” on page 2-4.

4.Configure the WAN mode. Select either NAT or classical routing. See “Configuring the WAN Mode” on page 2-9.

5.Configure dynamic DNS on the WAN port (optional). As an option, configure your fully qualified domain names during this phase. See “Configuring Dynamic DNS” on page 2-11.

2-1

v1.1, August 2010

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual

6.Configure the WAN options (optional). As an option, change the VPN firewall’s Media Access Control (MAC) address, the factory default MTU size, and the port speed. However, these are advanced features and changing them is not usually required. See “Configuring the Advanced Broadband Options” on page 2-13.

Each of these tasks is detailed separately in this chapter. The configuration of firewall and VPN features is described in later chapters.

Note: In this manual, “WAN port” and “broadband port” both indicate the same port through which the VPN firewall connects to the Internet.

Logging into the VPN Firewall

To connect to the VPN firewall, your computer needs to be configured to obtain an IP address automatically via DHCP. If you need instructions on how to configure you computer for DHCP, refer to the “Preparing Your Network” document that you can access from the link in Appendix C, “Related Documents.”

To log in to the VPN firewall:

1. Connect to the VPN firewall by typing http://192.168.1.1 in the address field of your browser.

Figure 2-1

2.When prompted, enter admin for the VPN firewall user name and password for the VPN firewall password, both in lower case letters. (The VPN firewall user name and password are not the same as any user name or password you may use to log in to your Internet connection.)

2-2

Connecting the VPN Firewall to the Internet

v1.1, August 2010

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual

3.Click Login. The Router Status screen displays. For more information about this screen, see “Viewing the VPN Firewall Configuration and System Status” on page 6-30.

Note: You might want to enable remote management at this time so that you can log in remotely in the future to manage the VPN firewall (see “Configuring an External Server for Authentication” on page 6-11). If you enable remote management, NETGEAR strongly advises you to change your password (see “Changing Passwords and Settings” on page 6-8).

Navigating the Menus

The Web Configuration Manager menus are organized in a layered structure of main categories and submenus:

Main menu. The horizontal orange bar near the top of the page is the main menu, containing the primary configuration categories. Clicking on a primary category changes the contents of the submenu bar.

Submenu. The horizontal grey bar immediately below the main menu is the submenu, containing subcategories of the currently selected primary category.

Tab. Immediately below the submenu bar, at the top of the menu active window, are one or more tabs, further subdividing the currently selected subcategory if necessary.

Option arrow. To the right of the tabs on some menus are one or more blue dots with an arrow in the center. Clicking an option arrow brings up either a popup window or an advanced option menu.

Tip: In the instructions in this manual, we may refer to a menu using the notation primary | subcategory, such as Network Configuration | WAN Settings. In this example, Network is the selected primary category (in the main menu) and WAN Settings is the selected subcategory (in the submenu).

You can now proceed to the first configuration task, configuring the VPN firewall’s Internet connection.

Connecting the VPN Firewall to the Internet

2-3

v1.1, August 2010

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual

Configuring the Internet Connection to Your ISP

To automatically configure the broadband port and connect to the Internet:

1.Select Network Configuration from the main menu and Broadband ISP Settings from the submenu. The Broadband ISP Settings screen displays.

Figure 2-2

2.Click Auto Detect at the bottom of the screen to automatically detect the type of Internet connection provided by your ISP. Auto Detect will probe for different connection methods and suggest one that your ISP will most likely support.

2-4

Connecting the VPN Firewall to the Internet

v1.1, August 2010

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual

When Auto Detect successfully detects an active Internet service, it reports which connection type it discovered. The options are described in Table 2-1.

Note: When you click Auto Detect while the WAN port already has a connection, you might lose the connection because the VPN firewall will enter its detection mode.

Table 2-1. Internet connection methods

Connection

Data Required

Method

 

 

 

PPPoE

Login (Username, Password); Account Name, Domain Name

 

 

PPTP

Login (Username, Password), Account Name, Local IP address, and PPTP

 

Server IP address;

 

 

DHCP (Dynamic IP)

No data is required.

 

 

Fixed (Static) IP

Static IP address, Subnet, and Gateway IP; and related data supplied by your

 

ISP.

 

 

If Auto Detect does not find a connection, you will be prompted to check the physical connection between your VPN firewall and the cable or DSL line or to check your VPN firewall’s MAC address (see “Manually Configuring Your Internet Connection” on page 2-6).

3.Click the Broadband Status option arrow at the top right of the screen to verify the WAN port connection status. Click Connect if there is no connection.

Figure 2-3

Connecting the VPN Firewall to the Internet

2-5

v1.1, August 2010

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual

The Connection Status window should show a valid IP address and gateway. If the configuration was not successful, skip ahead to “Manually Configuring Your Internet Connection following this section, or see “Troubleshooting the ISP Connection” on page 7-4.

Note: If the configuration process was successful, you are connected to the Internet through the WAN port.

If your WAN ISP configuration was successful, you can skip ahead to “Manually Configuring Your Internet Connection” on page 2-6.

Manually Configuring Your Internet Connection

If you know your ISP connection type, you can bypass the Auto Detect feature and connect your VPN firewall manually. Ensure that you have all of the relevant connection information such as IP addresses, account information, type of ISP connection, and so on, before you begin. Unless your ISP automatically assigns your configuration automatically via DHCP, you will need these configuration settings from your ISP.

To manually configure your broadband ISP settings:

1.Select Network Configuration from the main menu and Broadband ISP Settings from the submenu. The Broadband ISP Settings screen displays (see Figure 2-2 on page 2-4 for the entire screen).

2.In the ISP Login section, choose one of these options:

If your ISP requires an initial login to establish an Internet connection, click Yes (this is the default).

If a login is not required, click No and ignore the Login and Password fields.

Figure 2-4

3.If you clicked Yes, enter the ISP-provided Login and Password information.

2-6

Connecting the VPN Firewall to the Internet

v1.1, August 2010

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual

4.In the ISP Type section, select the type of ISP connection you use from the two listed options. (By default, “Other (PPPoE)” is selected.)

Figure 2-5

Other (PPPoE). If you have installed login software such as WinPoET or Ethernet, then your connection type is PPPoE. Configure the following fields:

Account Name. Valid account name for the PPPoE connection.

Domain Name. Name of your ISP’s domain or your domain name if your ISP has assigned one. In most cases, you may leave this field blank.

Idle Timeout. Select Keep Connected, to keep the connection always on. To logout after the connection is idle for a period of time, click Idle Time and in the timeout field enter the number of minutes to wait before disconnecting.

Connection Reset. Select this checkbox to to specify a time when the PPPoE WAN connection is reset, that is, the connection is disconnected momentarily and then reestablished. Enter the hour and minutes in the Disconnect Time fields to specify when the connection should be disconnected. Enter the seconds in the Delay field to specify the period after which the connection should be re-established.

PPTP. Select this option if your ISP is Austria Telecom or any other ISP that uses PPTP as a login protocol. Configure the following fields:

Account Name. (Also known as Host Name or System Name.) Enter the valid account name for the PPTP connection (usually your email name as assigned by your ISP). Some ISPs require entering your full email address here.

Domain Name. Your domain name or workgroup name assigned by your ISP, or your ISPs domain name. You may leave this field blank.

Connecting the VPN Firewall to the Internet

2-7

v1.1, August 2010

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual

Idle Timeout. Check the Keep Connected radio box to keep the connection always on. To logout after the connection is idle for a period of time, click Idle Time and enter the number of minutes to wait before disconnecting in the timeout field. This is useful if your ISP charges you based on the amount of time you have logged in.

My IP Address. IP address assigned by the ISP to make the connection with the ISP server.

Server IP Address. IP address of the PPTP server.

5.Review the Internet (IP) Address options.

Figure 2-6

Get Dynamically from ISP. If your ISP has not assigned a static IP address, select this radio button. The ISP will automatically assign an IP address to the VPN firewall using DHCP network protocol. The IP address and subnet mask fields will be inactivated. As an option, you can select the following checkboxes:

Client Identifier. Select this checkbox if your ISP requires the Client Identifier information to assign an IP address using DHCP.

Vendor Class Identifier. Select this checkbox if your ISP requires the Vendor Class Identifier information to assign an IP address using DHCP.

Use Static IP Address. If your ISP has assigned a fixed (static) IP address, select this radio button, and configure the following fields:

IP Address. Enter the Static IP address assigned to you, that identifies the VPN firewall to your ISP.

Subnet Mask. Enter the mask provided by the ISP or your network administrator.

Gateway IP Address. Enter the IP address of the ISP’s gateway, provided by the ISP or your network administrator.

2-8

Connecting the VPN Firewall to the Internet

v1.1, August 2010

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual

6. Review the Domain Name Server (DNS) server options.

Figure 2-7

If your ISP has not assigned any Domain Name Servers (DNS) addresses, click Get Dynamically from ISP.

If your ISP (or your IT department) has assigned DNS addresses, click Use These DNS Servers and enter the DNS server IP addresses provided to you in the fields.

7.Click Apply to save any changes to the broadband settings. (Or click Reset to discard any changes and revert to the previous settings.)

8.Click Test to evaluate your entries. The VPN firewall will attempt to connect to the NETGEAR website. If a successful connection is made, NETGEAR’s website appears.

Configuring the WAN Mode

To access the WAN Mode screen, select Network Configuration from the main menu and WAN Settings from the submenu. The WAN Mode screen displays.

Figure 2-8

Connecting the VPN Firewall to the Internet

2-9

v1.1, August 2010

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual

The WAN Mode screen allows you to configure how the VPN firewalll uses the external Internet connection. This screen gives you two choices for accessing the external Internet connection.

Network Address Translation (NAT). This technique allows several computers on a LAN to share the same Internet connection (IP address) while using private IP address on the LAN, which are hidden from the Internet.

Classical Routing. This method allows the VPN firewall to perform the routing, but requires separate valid static Internet IP address for each PC on your LAN.

Network Address Translation

Network Address Translation (NAT) allows all PCs on your LAN to share a single public Internet IP address. From the Internet, there is only a single device (the VPN firewall) and a single IP address. PCs on your LAN can use any private IP address range, and these IP addresses are not visible from the Internet.

The VPN firewall uses NAT to select the correct PC (on your LAN) to receive any incoming data.

If you only have a single public Internet IP address, you MUST use NAT. (the default setting).

If your ISP has provided you with multiple public IP addresses, you can use one address as the primary shared address for Internet access by your PCs, and you can map incoming traffic on the other public IP addresses to specific PCs on your LAN. This one-to-one inbound mapping is configured using an inbound firewall rule.

Classical Routing

In classical routing mode, the VPN firewall performs routing, but without NAT. To gain Internet access, each PC on your LAN must have a valid static Internet IP address.

If your ISP has allocated a number of static IP addresses to you, and you have assigned one of these addresses to each PC, you can choose classical routing. Or, you can use classical routing for routing private IP addresses within a campus environment.

To learn the status of the WAN port, you can view the Router Status screen (see “Viewing the VPN Firewall Configuration and System Status” on page 6-30) or look at the LEDs on the front panel (see “VPN Firewall Front and Rear Panels” on page 1-6).

2-10

Connecting the VPN Firewall to the Internet

v1.1, August 2010

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual

Configuring Dynamic DNS

Dynamic DNS (DDNS) is an Internet service that allows routers with varying public IP addresses to be located using Internet domain names. To use DDNS, you must setup an account with a DDNS provider such as DynDNS.org, TZO.com, Oray.net, or 3322.org. Links to DynDNS, TZO, Oray, and 3322 are provided for your convenience on the Dynamic DNS Configuration screen. The VPN firewall firmware includes software that notifies dynamic DNS servers of changes in the WAN IP address, so that the services running on this network can be accessed by others on the Internet.

If your network has a permanently assigned IP address, you can register a domain name and have that name linked with your IP address by public Domain Name Servers (DNS). However, if your Internet account uses a dynamically assigned IP address, you will not know in advance what your IP address will be, and the address can change frequently—hence, the need for a commercial DDNS service, which allows you to register an extension to its domain, and restores DNS requests for the resulting FQDN to your frequently-changing IP address.

After you have configured your account information on the VPN firewall, whenever your ISP-assigned IP address changes, your VPN firewall will automatically contact your DDNS service provider, log in to your account, and register your new IP address.

Note: If your ISP assigns a private WAN IP address such as 192.168.x.x or 10.x.x.x, the dynamic DNS service will not work because private addresses will not be routed on the Internet.

To configure Dynamic DNS:

1.Select Network Configuration from the main menu and Dynamic DNS from the submenu. The Dynamic DNS screen displays (see Figure 2-9 on page 2-12).

Connecting the VPN Firewall to the Internet

2-11

v1.1, August 2010

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual

Figure 2-9

2.Click the tab of the DNS service you want to enable. Each DNS service provider requires registration. After registration you can configure the required settings on the corresponding screen for the DNS service.

3.Access the website of one of the DNS service providers and set up an account. A link to each DNS service provider is located to the right of the tabs (see the option arrow). After setting up your account, return to the screen for the DNS service.

4.On the screen for the DNS service, select the Yes radio button, and complete the required fields for the DNS service that you selected:

a.In the Host and Domain Name field, enter the entire FQDN name that your DNS service provider gave you (for example: <yourname>.dyndns.org).

b.Enter the account information for the service you have chosen (for example, user name, password, key, or domain).

c.If your DNS service provider allows the use of wild cards in resolving your URL, you may check the Use wildcards checkbox to activate this feature.

For example, the wildcard feature will cause *.yourhost.dyndns.org to be aliased to the same IP address as yourhost.dyndns.org

d.If your WAN IP address does not change often, you may need to force a periodic update to the DDNS service to prevent your account from expiring. If it appears, you can select the Update every 30 days checkbox to enable a periodic update.

5.Click Apply to save your configuration or click Reset to return to the previous settings.

2-12

Connecting the VPN Firewall to the Internet

v1.1, August 2010

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual

Configuring the Advanced Broadband Options

To configure the advanced broadband options:

1.Select Network Configuration from the main menu and Broadband ISP Settings from the submenu. The Broadband ISP Settings screen displays.

2.Click the Advanced option arrow at the right of the tabs to display the Broadband Advanced Options screen.

Figure 2-10

3.Edit the default information you want to change.

MTU Size. The normal MTU (Maximum Transmit Unit) value for most Ethernet networks is 1500 Bytes, or 1492 Bytes for PPPoE connections. For some ISPs you may have to reduce the MTU. But this is rarely required, and should not be done unless you are sure it is necessary for your ISP connection.

Port Speed. In most cases, your VPN firewall can automatically determine the connection speed of the Internet (WAN) port. If you cannot establish an Internet connection and the Internet LED blinks continuously, you may have to manually select the port speed.

AutoSense is the default.

If you know that the Ethernet port on your broadband modem supports 100BaseT, select

100BaseT Half_Duplex; otherwise, select 10BaseT Half_Duplex. Use the half-duplex settings unless you are sure you need full duplex.

Connecting the VPN Firewall to the Internet

2-13

v1.1, August 2010

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual

Router's MAC Address. Each computer or router on your network has a unique 32-bit local Ethernet address. This is also referred to as the computer's MAC (Media Access Control) address. The default is Use Default Address. However, if your ISP requires MAC authentication, then select either

Use this Computer’s MAC address to enable the VPN firewall to use the MAC address of the computer you are now using, or

Use This MAC Address to manually type in the MAC address that your ISP expects.

The format for the MAC address is XX:XX:XX:XX:XX:XX (numbers 0-9 and either uppercase or lowercase letters A-F). If you select Use This MAC Address and then type in a MAC address, your entry will be overwritten.

Additional WAN Related Configuration

If you want the ability to manage the VPN firewalll remotely, enable remote management at this time (see “Enabling Remote Management Access” on page 6-14). If you enable remote management, NETGEAR strongly recommends that you change your password (see “Changing Passwords and Settings” on page 6-8).

At this point, you can set up the traffic meter for each WAN, if desired. See “Enabling the Traffic Meter” on page 6-27.

2-14

Connecting the VPN Firewall to the Internet

v1.1, August 2010

Chapter 3

LAN Configuration

This chapter describes how to configure the advanced LAN features of your ProSafe Gigabit 8 Port VPN Firewall FVS318G, including the following sections:

“Choosing the VPN Firewall DHCP Options” on this page

“Configuring the LAN Setup Options” on page 3-2

“Managing Groups and Hosts (LAN Groups)” on page 3-5

“Configuring Multi Home LAN IP Addresses” on page 3-10

“Configuring and Enabling the DMZ Port” on page 3-11

“Configuring Static Routes” on page 3-14

“Configuring Routing Information Protocol (RIP)” on page 3-17

Choosing the VPN Firewall DHCP Options

By default, the VPN firewall will function as a DHCP (Dynamic Host Configuration Protocol) server, allowing it to assign IP, DNS server, WINS Server, and default gateway addresses to all computers connected to the VPN firewall LAN. The assigned default gateway address is the LAN address of the VPN firewall. IP addresses will be assigned to the attached PCs from a pool of addresses that you must specify. Each pool address is tested before it is assigned to avoid duplicate addresses on the LAN. The DHCP options are available for both the LAN and DMZ settings.

For most applications, the default DHCP and TCP/IP settings of the VPN firewall are satisfactory. See the link to “TCP/IP Networking Basics” in Appendix C, “Related Documents for an explanation of DHCP and information about how to assign IP addresses for your network.

If another device on your network will be the DHCP server, or if you will manually configure the network settings of all of your computers, clear the Enable DHCP server radio box by selecting the Disable DHCP Server radio box. Otherwise, leave it checked.

Specify the pool of IP addresses to be assigned by setting the starting IP address and ending IP address. These addresses should be part of the same IP address subnet as the VPN firewall’s LAN IP address. Using the default addressing scheme, you should define a range between 192.168.1.2 and 192.168.1.100, although you may wish to save part of the range for devices with fixed addresses.

3-1

v1.1, August 2010

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual

The VPN firewall will deliver the following settings to any LAN device that requests DHCP:

An IP address from the range that you have defined.

Subnet mask.

Gateway IP address (the VPN firewall’s LAN IP address).

Primary DNS server (the VPN firewall’s LAN IP address).

WINS server (if you entered a WINS server address in the DHCP section of the LAN Setup screen).

Lease time (date obtained and duration of lease).

DHCP Relay options allow you to make the VPN firewall a DHCP relay agent. The DHCP Relay Agent makes it possible for DHCP broadcast messages to be sent over routers that do not support forwarding of these types of messages. The DHCP Relay Agent is therefore the routing protocol that enables DHCP clients to obtain IP addresses from a DHCP server on a remote subnet, or which is not located on the local subnet. If you have no configured DHCP Relay Agent, your clients would only be able to obtain IP addresses from the DHCP server which is on the same subnet. To enable clients to obtain IP addresses from a DHCP server on a remote subnet, you have to configure the DHCP Relay Agent on the subnet that contains the remote clients, so that it can relay DHCP broadcast messages to your DHCP server.

When the DNS Proxy option is enabled, the VPN firewall will act as a proxy for all DNS requests and communicates with the ISP’s DNS servers (as configured on the Broadband ISP Settings screen). All DHCP clients will receive the primary and/or secondary DNS IP address along with the IP address where the DNS proxy is running, that is, the VPN firewall’s LAN IP address. When disabled, all DHCP clients will receive the DNS IP addresses of the ISP excluding the DNS proxy IP address.

Configuring the LAN Setup Options

The LAN Setup screen allows configuration of LAN IP services such as DHCP and allows you to configure a secondary or “multi-home” LAN IP setup in the LAN. The default values are suitable for most users and situations.

Note: If you enable the DNS Relay feature, you will not use the VPN firewall as a DHCP server but rather as a DHCP relay agent for a DHCP server somewhere else on your network.

3-2

LAN Configuration

v1.1, August 2010

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual

To configure the LAN Setup options:

1.Select Network Configuration from the main menu and LAN Settings from the submenu. The LAN Setup screen displays.

Figure 3-1

2.In the LAN TCP/IP Setup section, configure the following settings:

IP Address. The LAN address of your VPN firewall (factory default: 192.168.1.1).

Note: If you change the LAN IP address of the VPN firewall while connected through the browser, you will be disconnected. You must then open a new connection to the new IP address and log in again. For example, if you change the default IP address 192.168.1.1 to 10.0.0.1, you must now enter https://10.0.0.1 in your browser to reconnect to the Web Configuration Manager.

LAN Configuration

3-3

v1.1, August 2010

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual

IP Subnet Mask. The subnet mask specifies the network number portion of an IP address. Your VPN firewall will automatically calculate the subnet mask based on the IP address that you assign. Unless you are implementing subnetting, use 255.255.255.0 as the subnet mask. (Always make sure that the LAN port IP address and DMZ port IP address are in different subnets.)

3.In the DHCP section, select Disable DHCP Server, Enable DHCP Server, or DHCP Relay. By default, the VPN firewall will function as a DHCP server, providing TCP/IP configuration settings for all computers connected to the VPN firewall’s LAN. If another device on your network will be the DHCP server, or if you will manually configure all devices, click Disable DHCP Server. If the VPN firewall will function as a DHCP relay agent, select DHCP Relay and enter the IP address of the DHCP relay gateway in the Relay Gateway field.

If the DHCP server is enabled, enter the following settings:

Domain Name. (Optional) The DHCP will assign the entered domain to DHCP clients.

Starting IP Address. Specifies the first of the contiguous addresses in the IP address pool. Any new DHCP client joining the LAN will be assigned an IP address between this address and the Ending IP Address. The IP address 192.168.1.2 is the default start address.

Ending IP Address. Specifies the last of the contiguous addresses in the IP address pool. The IP address 192.168.1.100 is the default ending address.

Note: The starting and ending DHCP addresses should be in the same subnet as the LAN IP address of the VPN firewall (the IP address that is configured in the LAN TCP/IP Setup section of the LAN Setup screen).

Primary DNS Server. (Optional) If an IP address is specified, the VPN firewall will provide this address as the primary DNS server IP address. If no address is specified, the VPN firewall will provide its own LAN IP address as the primary DNS server IP address.

Secondary DNS Server. (Optional) If an IP address is specified, the VPN firewall will provide this address as the secondary DNS server IP address.

WINS Server. (Optional) Specifies the IP address of a local Windows NetBIOS Server if one is present in your network.

Lease Time. This specifies the duration for which IP addresses will be leased to clients.

3-4

LAN Configuration

v1.1, August 2010

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual

If you will use a Lightweight Directory Access Protocol (LDAP) authentication server for network-validated domain-based authentication, select Enable LDAP Information to enable the DHCP server to provide LDAP server information. Enter the following settings:

LDAP Server. Specifies the name or the IP address of the device that hosts the LDAP server.

Search Base. Specifies the distinguished name (dn) at which to start the search, specified as a sequence of relative distinguished names (rdn), connected with commas and without any blank spaces. For most users, the search base is a variation of the domain name. For example, if your domain is yourcompany.com, your search base dn might be as follows: dc=yourcompany,dc=com.

port. Specifies the port number that the LDAP server is using. Leave this field blank for the default port.

4.In the Advanced Settings section, configure the following settings:

Enable DNS Proxy. If the DNS proxy is enabled (which is the default setting), the DHCP server will provide the VPN firewall’s LAN IP address as the DNS server for address name resolution. If this box is unchecked, the DHCP server will provide the ISP’s DNS server IP addresses. The VPN firewall will still service DNS requests sent to its LAN IP address unless you disable DNS Proxy in the VPN firewall settings (see “Attack Checks” on page 4-20).

Enable ARP Broadcast. If ARP broadcast is enabled (which is the default setting), the Address Resolution Protocol (ARP) is broadcasted on the LAN so that IP addresses can be mapped to physical addresses (that is, MAC addresses).

5.Click Apply to save your settings or click Reset to discard any changes and revert to the previous configuration.

Note: Once you have completed the LAN IP setup, all outbound traffic is allowed and all inbound traffic is discarded. To change these traffic rules, refer to Chapter 4, “Firewall Protection and Content Filtering.”

Managing Groups and Hosts (LAN Groups)

The Known PCs and Devices table on the Groups and Hosts screen contains a list of all known PCs and network devices, as well as hosts, that are assigned dynamic IP addresses by this VPN firewall. Collectively, these entries make up the Network Database.

LAN Configuration

3-5

v1.1, August 2010

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual

The Network Database is updated by these methods:

DHCP Client Requests. By default, the DHCP server in this VPN firewall is enabled, and will accept and respond to DHCP client requests from PCs and other network devices. These requests also generate an entry in the Network Database. Because of this, leaving the DHCP Server feature (on the LAN screen) enabled is strongly recommended.

Scanning the Network. The local network is scanned using standard methods such as ARP. This will detect active devices which are not DHCP clients. However, sometimes the name of the PC or device cannot be accurately determined, and will be shown as Unknown.

Manual Entry. You can manually enter information about a network device.

Creating the Network Database

Some advantages of the Network Database are:

Generally, you do not need to enter either IP address or MAC addresses. Instead, you can just select the desired PC or device.

No need to reserve an IP address for a PC in the DHCP Server. All IP address assignments made by the DHCP Server will be maintained until the PC or device is removed from the database, either by expiry (inactive for a long time) or by you.

No need to use a fixed IP address on PCs. Because the address allocated by the DHCP Server will never change, you do not need to assign a fixed IP address to a PC to ensure it always has the same IP address.

MAC level control over PCs. The Network Database uses the MAC address to identify each PC or device. So changing a PC’s IP address does not affect any restrictions on that PC.

Group and individual control over PCs.

You can assign PCs to groups and apply restrictions to each group using the Firewall Rules screen (see “Using Rules to Block or Allow Specific Kinds of Traffic” on page 4-2).

You can also select the groups to be covered by the Block Sites feature (see “Blocking Internet Sites (Content Filtering)” on page 4-30).

If necessary, you can also create firewall rules to apply to a single PC (see “Configuring Source MAC Filtering” on page 4-33). Because the MAC address is used to identify each PC, users cannot avoid these restrictions by changing their IP address.

A computer is identified by its MAC address—not its IP address. Hence, changing a computer’s IP address does not affect any restrictions applied to that PC.

3-6

LAN Configuration

v1.1, August 2010

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual

Viewing the Network Database

To view the Network Database, follow these steps:

1.Select Network Configuration from the main menu and LAN Settings from the submenu. The LAN Setup screen displays.

2.Click the LAN Groups tab. The LAN Groups screen displays.

Figure 3-2

The Known PCs and Devices table lists the entries in the Network Database. For each computer or device, the following fields are displayed:

Name. The name of the computer or device. Computers that do not support the NetBIOS protocol will be listed as Unknown. In this case, the name can be edited manually for easier management. If the computer was assigned an IP address by the DHCP server, then an asterisk is be appended to the name.

IP Address. The current IP address of the computer. For DHCP clients of the VPN firewall, this IP address will not change. If a computer is assigned a static IP address, you must to update this entry manually when the IP address of the computer changes.

MAC Address. The MAC address of the computer’s network interface.

Group. Each PC or device can be assigned to a single group. By default, a computer is assigned to the first group (Group 1). To change the group assignment by selecting the Edit button in the Action column.

Action/Edit. Allows modification of the selected entry.

LAN Configuration

3-7

v1.1, August 2010

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual

Adding Devices to the Network Database

To add devices manually to the network database:

1.To add computers to the network database manually, make the following selections:

Name: The name of the PC or device.

IP Address Type. From the pull-down menu, choose how this device receives its IP address:

Select Fixed (Set on PC) if the IP address is statically assigned on the computer.

Select Reserved (DHCP Client) to direct the VPN firewall to reserve the IP address for allocation by the DHCP server (see “Setting Up DHCP Address Reservation” on page 3-9).

Note: When assigning a reserved IP address to a client, the IP address selected must be outside the range of addresses allocated to the DHCP server pool.

IP Address. Enter the IP address that this computer or device is assigned. If the IP Address Type is Reserved (DHCP Client), the VPN firewall will reserve the IP address for the associated MAC address.

MAC Address. Enter the MAC address of the computer’s network interface. The MAC address format is six colon-separated pairs of hexadecimal characters (0-9 and A-F), such as 01:23:45:67:89:AB.

Group. From the pull-down menu, select the group to which the computer has to be assigned. (Group 1 is the default group.)

2.Click Add to add the new entry to the network database.

3.As an optional step: To enable DHCP address reservation for the entry that you just added to the Known PCs and Devices table, select the checkbox for the table entry, and click Save Binding to bind the IP address to the MAC address for DHCP assignment.

3-8

LAN Configuration

v1.1, August 2010

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual

Changing Group Names in the LAN Groups Database

By default, the LAN Groups are named Group1 through Group8. You can rename these group names to be more descriptive, such as Engineering or Marketing.

To edit the names of any of the eight available groups:

1.From the LAN Groups screen, click the Edit Group Names option arrow to the right of the tabs. The Network Database Group Names screen appears.

Figure 3-3

2.Select the radio button next to any group name to make that name active for editing.

3.Type a new name in the field.

4.Select and edit other group names if desired.

5.Click Apply to save your settings.

Setting Up DHCP Address Reservation

When you specify a reserved IP address for a device on the LAN (based on the MAC address of the device), that computer or device will always receive the same IP address each time it accesses the VPN firewall’s DHCP server. Reserved IP addresses should be assigned to servers or access points that require permanent IP settings. The Reserved IP address that you select must be outside of the DHCP Server pool.

To reserve an IP address, manually enter the device on the LAN Groups screen, specifying Reserved (DHCP Client), as described in “Adding Devices to the Network Database” on page 3- 8.

LAN Configuration

3-9

v1.1, August 2010

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual

Note: The reserved address will not be assigned until the next time the PC contacts the VPN firewall's DHCP server. Reboot the PC or access its IP configuration and force a DHCP release and renew.

Configuring Multi Home LAN IP Addresses

If you have computers on your LAN using different IP address ranges (for example, 172.16.2.0 or 10.0.0.0), you can add “aliases” to the LAN port, giving computers on those networks access to the Internet through the VPN firewall. This allows the VPN firewall to act as a gateway to additional logical subnets on your LAN. You can assign the VPN firewall an IP address on each additional logical subnet.

To add a secondary LAN IP address:

1.Select Network Configuration from the main menu and LAN Settings from the submenu. The LAN Setup screen displays.

2.Click the LAN Multi-homing tab. The LAN Multi-homing screen displays.

Figure 3-4

The Available Secondary LAN IPs table lists the secondary LAN IP addresses added to the VPN firewall.

IP Address. The IP address alias added to the LAN port of the VPN firewall. This is the gateway for computers that need to access the Internet.

Subnet Mask. IPv4 Subnet Mask.

Action. The Edit button allows you to make changes to the selected entry.

3-10

LAN Configuration

v1.1, August 2010

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual

3.In the Add Secondary LAN IP Address section, enter the additional IP address and subnet mask to be assigned to the LAN port of the VPN firewall.

4.Click Add. The secondary LAN IP address will be added to the Available Secondary LAN IPs table.

To make changes to the Available Secondary LAN IPs table, use the following buttons:

Select All. Selects all the entries in the Available Secondary LAN IPs table.

Delete. Deletes selected entries from the Available Secondary LAN IPs table.

Note: Additional IP addresses cannot be configured in the DHCP server. The hosts on the secondary subnets must be manually configured with the IP addresses, gateway IP and DNS server IPs.

Warning: Make sure that the secondary IP addresses are different from the LAN, WAN, DMZ, and any other subnet addresses that are attached to the VPN firewall. Example of correct addresses:

WAN IP address: 10.0.0.1 with subnet 255.0.0.0

DMZ IP address: 192.168.10.1 with subnet 255.255.255.0 LAN IP address: 192.168.1.1 with subnet 255.255.255.0

Secondary LAN IP address: 192.168.20.1 with subnet 255.255.255.0

Configuring and Enabling the DMZ Port

The De-Militarized Zone (DMZ) is a network which, when compared to the LAN, has fewer firewall restrictions, by default. This zone can be used to host servers (such as a Web server, FTP server, or email server, for example) and give public access to them. The eighth LAN ports on the VPN firewall can be dedicated as a hardware DMZ port for safely providing services to the Internet, without compromising security on your LAN.

The DMZ port feature is also helpful when using some online games and videoconferencing applications that are incompatible with NAT. The VPN firewall is programmed to recognize some of these applications and to work properly with them, but there are other applications that may not function well. In some cases, local PCs can run the application properly if those PCs are used on the DMZ port.

A separate firewall security profile is provided for the DMZ port that is hardware independent of the standard firewall security used for the LAN.

LAN Configuration

3-11

v1.1, August 2010

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual

The DMZ Setup screen allows you to set up the DMZ port. It permits you to enable or disable the hardware DMZ port (LAN port 8, see “VPN Firewall Front and Rear Panels” on page 1-6) and configure an IP address and Mask for the DMZ port.

To enable and configure the DMZ port:

1.From the main menu, select Network Configuration and then select DMZ Setup from the submenu. The DMZ Setup screen displays.

2.In the DMZ Port Setup section, under Do you want to enable DMZ Port?, select the Yes radio box.

3.Enter an IP address and the subnet mask for the DMZ port. Make sure that the DMZ port IP address and LAN Port IP address are in different subnets (for example, an address outside the LAN Address pool, such as 192.168.1.101).

Figure 3-5

3-12

LAN Configuration

v1.1, August 2010

+ 172 hidden pages