Home

Netgear Modem FVS318G User's Manual

1. Figure 5 15 Note The information in the Connection Monitor screen in Figure 5 15 does not correspond to the configuration that is presented in the Use the NETGEAR VPN Client Security Policy Editor to Create a Secure Connection on page 5 7 The VPN client system tray icon provides a variety of status indications which are listed below Table 5 1 System Tray Icon Status SV H 12 22 PM The client policy is deactivated ES We 12 26 PM The client policy is deactivated but not connected The client policy is activated and connected A flashing vertical bar indicates traffic on the tunnel BS yO 12 32PM Virtual Private Networking 5 13 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual VPN Firewall VPN Connection Status and Logs To view VPN firewall VPN connection status select VPN from the main menu and Connection Status from the submenu The VPN Connection Status screen displays Policies VPN Wizard Certificates Mode Config VPN Client VPN Connection Status Operation succeeded help Policy Name Endpoint Tx KB Tx Packets State Action toSonic 10 1 32 54 0 00 0 IPsec SA Not Established a connect GW1 to Gw2 221 219 133 11 0 00 o IPsec SA Established bd drop 192 168 1 2 221 219 138 104 0 00 8 IPsec SA Established bd drop Client Policy Poll Interval 5___ Seconds set interval stop Figure 5 16 The information in the VPN
2. To configure the VPN firewall for remote management 1 Select Administration from the main menu and Remote Management from the submenu The Remote Management screen displays Administration SNMP Settings Backup amp Upgrade Time Zone Remote Management Everyone Be sure to change default password IP address range Allow Secure HTTP Management From 0 0 10 Yes To 0 0 O No Only this PC 0 0 Port Number 8080 IP Address to connect to this device https 64 139 54 227 8080 Be sure to type https not http Everyone Be sure to change default password Allow Telnet Management IP address range Yes From o No To 0 Only this PC 0 Figure 6 5 6 14 VPN Firewall and Network Management v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Check Allow Remote Management radio box Click the Yes radio button to enable secure HTTP management enabled by default and configure the external IP addresses that will be allowed to connect To allow access from any IP address on the Internet select Everyone To allow access from a range of IP addresses on the Internet select IP address range Enter a beginning and ending IP address to define the allowed range c To allow access from a single IP address on the Internet select Only this PC Enter the IP address that will be allowed access Configure the port number that will be used for secure
3. If your browser is not set up to save downloaded files automatically locate where you want to save the file specify file name and click Save If you have your browser set up to save downloaded files automatically the file will be saved to your browser s download location on the hard disk Warning Once you start restoring settings or erasing the VPN firewall do not A interrupt the process Do not try to go online turn off the VPN firewall shutdown the computer or do anything else to the VPN firewall until it finishes restarting VPN Firewall and Network Management 6 19 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Restoring Settings To restore settings from a backup file 1 On the Settings Backup and Firmware Upgrade screen next to Restore save settings from file click Browse 2 Locate and select the previously saved backup file by default netgear cfg When you have located the file click restore An Alert screen will appear indicating the status of the restore operation You must manually restart the VPN firewall for the restored settings to take effect Reverting to Factory Default Settings To reset the VPN firewall to the original factory default settings 1 On the Settings Backup and Firmware Upgrade screen click default 2 Manually restart the VPN firewall in order for the default settings to take effect After rebooting the VPN firewall s password will be
4. To edit a bandwidth profile 1 Click the Edit button adjacent to the profile you want to edit The Edit Bandwidth Profile screen is displayed This screen shows the same fields as the Add New Bandwidth Profile screen 2 Modify the settings that you wish to change 3 Click Apply Your modified profile displays in the List of Bandwidth Profiles table To remove an entry from the table select the profile and click delete To remove all the profiles click select All and then click delete Setting a Schedule to Block or Allow Specific Traffic Schedules define the timeframes under which firewall rules may be applied Three schedules Schedule 1 Schedule 2 and Schedule3 can be defined and any one of these can be selected when defining firewall rules To invoke rules based on a schedule follow these steps 1 Select Security from the main menu and Schedule from the submenu The Schedule 1 screen displays see Figure 4 20 on page 4 30 Firewall Protection and Content Filtering 4 29 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Block Sites Firewall Address Filter Port Triggering UPnP Bandwidth Profile UAMS Schedule 2 Schedule 3 O sunday C Monday O Tuesday C Wednesday O Thursday CO Friday O Saturday Do you want this schedule to be active on all days or specific days All Days Specific Days help Do you want this schedule to be active Start Time 12 Hour 00 Min
5. 1 Redistributions of source code must retain the above copyright notice this list of conditions and the following disclaimer 2 Redistributions in binary form must reproduce the above copyright notice this list of conditions and the following disclaimer in the documentation and or other materials provided with the distribution 3 All advertising materials mentioning features or use of this software must display the following acknowledgment This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit ittp Avww openssl org 4 The names OpenSSL Toolkit and OpenSSL Project must not be used to endorse or promote products derived from this software without prior written permission For written permission contact openssl core openssl org 5 Products derived from this software may not be called OpenSSL nor may OpenSSL appear in their names without prior written permission of the OpenSSL Project 6 Redistributions of any form whatsoever must retain the following acknowledgment This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit http vww openssl org THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT AS IS AND ANY EXPRESSED OR IMPLIED WARRANTIES INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED IN NO EVENT SHALL THE OpenSSL PROJECT OR ITS
6. Do you want to enable a Backup RADIUS Backup Server IP Address l a 1 Secret Phrase Backup Server NAS Identifier Fvs318g Server O Yes No i Connection Configuration Time out period Sec Maximum Retry Count k Figure 5 31 Enable the primary RADIUS server by checking the Yes radio box 4 Enter the primary RADIUS Server IP Address Enter a Secret Phrase Transactions between the client and the RADIUS server are authenticated using a shared secret phrase so the same Secret Phrase must be configured on both client and server 6 Enter the Primary Server NAS Identifier Network Access Server This identifier must be present in a RADIUS request Ensure that NAS identifier is configured as the same on both client and server The VPN firewall is acting as a NAS Network Access Server allowing network access to external users after verifying their authentication information In a RADIUS transaction the NAS must provide some NAS Identifier information to the RADIUS server Depending on the configuration of the RADIUS server the VPN firewall s IP address may be sufficient as an identifier or the Server may require a name which you would enter here This name would also be configured on the RADIUS server although in some cases it should be left blank on the RADIUS server 7 Enable a backup RADIUS server if required by following steps 3 through 6 Virtual Private Networking 5 43 v1 1 August 2010 Pr
7. Single address The rule applies to a single Internet IP address Address range The rule is applied to a range of Internet IP addresses Services You can specify the desired services or applications to be covered a rule If the desired service or application does not appear in the list you must define it using the Services screen see Adding Customized Services on page 4 24 Groups and Hosts You can apply these rules selectively to groups of PCs to reduce the outbound or inbound traffic The Network Database is an automatically maintained list of all known PCs and network devices PCs and devices become known by the following methods DHCP Client Request By default the DHCP server in the VPN firewall is enabled and will accept and respond to DHCP client requests from PCs and other network devices These requests also generate an entry in the Network Database Because of this leaving the DHCP Server feature on the LAN Setup screen enabled is strongly recommended Scanning the Network The local network is scanned using standard methods such as ARP This will detect active devices which are not DHCP clients However sometimes the name of the PC or device cannot be accurately determined and will be shown as Unknown Manual Entry You can manually enter information about a device See Managing Groups and Hosts LAN Groups on page 3 5 for the procedure on how to use this feature Schedule If you have s
8. policy Note To gain a more complete understanding of the encryption authentication and DH algorithm technologies see the link to Virtual Private Networking Basics on page C 1 Virtual Private Networking 5 17 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Manually Adding or Editing an IKE Policy To manually add an IKE policy 1 Select VPN from the main menu and Policies from the submenu The Policies submenu tabs appear with the IKE Policies screen in view see Figure 5 18 on page 5 16 2 Under the List of IKE Policies table click the add button The Add IKE Policy screen is displayed Add IKE Policy Add New VPN Policy EEE 0 Beet Do you want to use Mode Config Record Oves wo Policy Neme ______ IE Direction Type Dview selected Exchange Mode Select Mode Config Record eal Identifier Type Local Wan IP Identifier Type Identifier J Identifier J Encryption Algorithm Authentication Algorithm Authentication Method Pre shared key ORSA Signature Pre shared key J Key Length 8 49 Char Diffie Hellman DH Group SA Lifetime sec Enable Dead Peer Detection Q Yes No Detection Period Seconds Reconnect after failure count ii Extended Authentication XAUTH Configuration Authentication Type User Database iv None Username Password a Edge Device IPSec Host Figure 5 19 5
9. Note A schedule narrows down the period during which a firewall rule is applied For information about specifying schedules see Setting a Schedule to Block or Allow Specific Traffic on page 4 29 Adding Customized Services Services are functions performed by server computers at the request of client computers You can configure up to 125 custom services For example Web servers serve Web pages time servers serve time and date information and game hosts serve data about other players moves When a computer on the Internet sends a request for service to a server computer the requested service is identified by a service or port number This number appears as the destination port number in the transmitted IP packets For example a packet that is sent with destination port number 80 is an HTTP Web server request The service numbers for many common protocols are defined by the Internet Engineering Task Force IETF and published in RFC1700 Assigned Numbers Service numbers for other applications are typically chosen from the range 1024 to 65535 by the authors of the application Although the VPN firewall already holds a list of many service port numbers you are not limited to these choices Use the Services screen to add additional services and applications to the list for use in defining firewall rules The Services screen shows a list of services that you have defined as shown in Figure 4 16 on page 4 25 4 24 F
10. Policies VPN Wizard Certificates Mode Config VPN Client l VPN Connection Status Operation succeeded help Policy Name Endpoint Tx KB Tx Packets State Action toSonic 10 1 32 54 0 00 0 IPsec SA Not Established a connect GW1 to Gw2 221 219 133 11 0 00 o IPsec SA Established kA drop 192 168 1 2 221 219 138 104 0 00 0 IPsec SA Established bd drop Client Policy Poll Interval S Seconds set interval stop Figure 6 18 6 34 VPN Firewall and Network Management v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual The Active IPsec SA s table lists each active connection with the following information Table 6 5 IPsec Connection Status Fields Item Description Policy Name The name of the VPN policy associated with this SA Endpoint The IP address on the remote VPN endpoint Tx KB The amount of data transmitted over this SA Tx Packets The number of IP packets transmitted over this SA State The current status of the SA Phase 1 is Authentication phase and Phase 2 is Key Exchange phase Action Use this button to terminate or build the SA connection if required Viewing the VPN Logs The VPN Logs screen gives log details for recent VPN activity Select Monitoring from the main menu and VPN Logs from the submenu to view the VPN logs Monitoring Router Status Traffic Meter Diagnostics Firewall Logs amp E mail 2010 Mar 26 15 32 21 FVS318g
11. ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual NETGEAR NETGEAR Inc 350 East Plumeria Drive San Jose CA 95134 202 10521 02 v1 1 August 2010 2009 2010 by NETGEAR Inc All rights reserved Technical Support Please refer to the support information card that shipped with your product By registering your product at http www netgear com register we can provide you with faster expert technical support and timely notices of product and software upgrades NETGEAR INC Support Information Phone 1 888 NETGEAR for US amp Canada only For other countries see your Support information card Email support netgear com North American NETGEAR website http Avww netgear com Trademarks NETGEAR and the NETGEAR logo are registered trademarks and ProSafe is a trademark of NETGEAR Inc Microsoft Windows and Windows NT are registered trademarks of Microsoft Corporation Other brand and product names are registered trademarks or trademarks of their respective holders Statement of Conditions In the interest of improving internal design operational function and or reliability NETGEAR reserves the right to make changes to the products described in this document without notice NETGEAR does not assume any liability that may occur due to the use or application of the product s or circuit layout s described herein Federal Communications Commission FCC Compliance Notice Radio Frequency Notice This eq
12. When FVS318G is connected log in by going to go to http 192 168 1 1 When the login screen displays see Figure 2 1 on page 2 2 enter admin for the user name and the password for password Qualified Web Browsers To configure the FVS318G you must use a Web browser such as Internet Explorer 5 1 or higher Apple Safari 1 2 or higher or Mozilla Firefox 1 x Web browser with JavaScript and cookies enabled 1 8 Introduction v1 1 August 2010 Chapter 2 Connecting the VPN Firewall to the Internet This section provides instructions for connecting the ProSafe Gigabit 8 Port VPN Firewall FVS318G including these topics Understanding the Connection Steps on this page Logging into the VPN Firewall on page 2 2 Navigating the Menus on page 2 3 Configuring the Internet Connection to Your ISP on page 2 4 Configuring the WAN Mode on page 2 9 Configuring Dynamic DNS on page 2 11 Configuring the Advanced Broadband Options on page 2 13 Setting up VPN tunnels is covered in Chapter 5 Virtual Private Networking Understanding the Connection Steps Typically six steps are required to complete the basic Internet connection of your VPN firewall 1 Connect the VPN firewall physically to your network Connect the cables and restart your network according to the instructions in the installation guide See the ProSafe Gigabit 8 Port VPN Firewall FVS318G Installation Guide for complete s
13. i Manual Policy Parameters SPI Incoming s Hex 3 8 Chars SPI Outgoing Hex 3 8 Chars Encryption Algorithm Bos v Integrity Algorithm SHa key In key In nd key out Key Out DES 8 Char amp 3DES 24 Char MDS 16 Char amp SHA 1 20 Char SA Lifetime Encryption Algorithm Integrity Algorithm Mers Key Group Select IKE Policy P view selected Figure 5 21 4 Complete the fields select the radio buttons and checkboxes and make your selections from the pull down menus as explained Table 5 3 on page 5 27 5 26 Virtual Private Networking v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Table 5 3 Add VPN Policy Settings Item Description or Subfield and Description General Policy Name A descriptive name of the VPN policy for identification and management purposes Note The name is not supplied to the remote VPN endpoint Policy Type From the pull down menu select one of the following policy types Remote Endpoint Enable NetBIOS Enable Keepalive Note See also Configuring Keepalives and Dead Peer Detection on page 5 53 Auto Policy Some settings the ones in the Manual Policy Parameters section of the screen for the VPN tunnel are generated automatically e Manual Policy All settings must be specified including the ones in the Manual Policy Parameters section of the screen Select a radio button to specify how the r
14. multi home LAN IP setup in the LAN The default values are suitable for most users and situations Note If you enable the DNS Relay feature you will not use the VPN firewall as a DHCP server but rather as a DHCP relay agent for a DHCP server somewhere else on your network 3 2 LAN Configuration v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual To configure the LAN Setup options 1 Select Network Configuration from the main menu and LAN Settings from the submenu The LAN Setup screen displays Network Configuration ss J DHCP Log ii LAN TCP IP Setup 1P address 92 Jass J JE Sunet nose as sese Disable DHCP Server Enable DHCP Server C Enable LDAP information Domain Name LDAP Server Starting IP Address fis2 Jhesa Me Search Base Ea Ending IP Address port leave blank for default port Primary DNS Server CIC ICIC Secondary DNS Server CIC IC C WINS Server CICC E Lease Time Hours DHCP Relay Relay Gateway El Ee a if Advanced Settings Enable ONS Proxy Enable ARP Broadcast V Figure 3 1 2 Inthe LAN TCP IP Setup section configure the following settings e IP Address The LAN address of your VPN firewall factory default 192 168 1 1 Note If you change the LAN IP address of the VPN firewall while connected through the browser you will be disconnected You must then open a new connection to the new IP add
15. Firewall Protection and Content Filtering 4 35 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Source MAC Filter POJAT AUE UT 8 Set Poll Interval i Email IP MAC Violations help Do you want to enable E mail Logs for IP MAC Binding iolation Yes No For this option e mailing of logs must be enabled in Firewall Logs amp E mail page i IP MAC Bindings help Name MAC Addresses IP Addresses Log Dropped Packets Action select all delete Add IP MAC Binding Name MAC Address IP Address Log Dropped Packets Add hs Co CH H H Disable v O24 Figure 4 23 3 Select the Yes radio box and click Apply Make sure that you have enabled the e maling of logs see Activating Notification of Events and Alerts on page 6 23 4 Add an IP MAC Bind rule by entering a Name Specify an easily identifiable name for this rule b MAC Address Specify the MAC Address for this rule c IP Addresses Specify the IP Address for this rule d Log Dropped Packets Select the logging option for this rule from the pull down menu 5 Click Add The new IP MAC binding rule will be appear the IP MAC Bindings table The IP MAC Bindings table lists the currently defined IP MAC binding rules e Name Displays the user defined name for this rule e MAC Addresses Displays the MAC Addresses for this rule e IP Addresses Displays the IP Addresses for this rule e Log Droppe
16. IKE IKE started_ A 2010 Mar 26 15 32 21 FV5318g IKE Adding IKE configuration with identifer toWin7 _ 2010 Mar 26 15 32 21 FVS318q IKE Adding IPSec configuration with identifier toWin _ 2010 Mar 27 02 45 46 FV S318q IKE Invalid exchange type 243 from 98 232 20 132 501 2010 Mar 27 02 45 46 FV 318q IKE Could not find configuration for 98 232 20 132 500 Last output repeated twice 2010 Mar 27 02 45 48 FVS318g IKE Invalid exchange type 243 from 98 232 20 132 501 Last output repeated twice 2010 Mar 27 02 45 51 FVS318g IKE Could not find configuration for 98 232 20 132 500 2010 Mar 27 02 45 55 FVS318g IKE Invalid exchange type 243 from 98 232 20 132 501 2010 Mar 27 02 45 55 FVS318g IKE Could not find configuration for 98 232 20 132 500 2010 Mar 27 06 11 54 FVS318g IKE Could not find configuration for 72 187 52 76 500 _ Last output repeated 7 times 2010 Mar 27 08 16 43 FV 318q9 IKE Invalid exchange type 243 from 58 64 55 19 500 2010 Mar 27 08 16 45 FVS318q IKE Could not find configuration for 58 64 55 19 500 _ lt gt refresh tea clear log Figure 6 19 To view the most recent entries click refresh log To delete all the existing log entries click clear log VPN Firewall and Network Management 6 35 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Viewing the DHCP Log To display the DHCP log 1 Select Network C
17. Lease Time 24 Hours DHCP Relay Relay Gateway a Sl a a Enable LDAP information LDAP Server Search Base port leave blank for default port i DNS Proxy Enable DNS Proxy Figure 3 5 3 12 LAN Configuration v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual 4 Inthe DHCP for DMZ Connected Computers section select one of the following three radio buttons e Disable DHCP Server The DHCP server is disabled which is the default setting Select this radio button if another device on your DMZ network will be the DHCP server or if you will manually configure all devices e Enable DHCP Server The DHCP server provide a TCP IP configuration for all computers connected to the VPN firewall s DMZ network Enter the following settings Domain Name Optional The DHCP will assign the entered domain to DHCP clients Starting IP Address Specifies the first of the contiguous addresses in the IP address pool Any new DHCP client joining the LAN will be assigned an IP address between this address and the Ending IP Address The IP address 192 168 1 2 is the default start address Ending IP Address Specifies the last of the contiguous addresses in the IP address pool The IP address 192 168 1 100 is the default ending address Note The starting and ending DHCP addresses should be in the same subnet as the LAN IP address of the VPN firewall the IP address that is configured in
18. ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual certificates CRL 5 32 management of 5 35 trusted CA certificates 5 32 Classical Routing definition of 2 0 command line interface 6 16 configuration automatic by DHCP 1 4 Connecting the VPN firewall 2 Content Filtering 4 about 2 4 30 Block Sites 4 30 enabling 4 32 firewall protection about 4 CRL 5 32 managing 5 38 crossover cable 3 7 2 CSR 5 35 Customized Services adding 4 3 4 25 editing 4 26 D Data Encryption Standard See DES Date setting 6 21 troubleshooting 7 7 Daylight Savings Time adjusting for 6 22 DDNS about 2 configuration of 2 11 links to 2 72 providers of 2 11 providers links to 2 72 services examples 2 2 Dead Peer Detection 5 17 5 54 default configuration restoring 7 7 default IP Address 7 8 default password 7 8 2 2 default user name 8 2 2 denial of service attack 4 21 Denial of Service See DoS DES and 3DES 5 20 5 28 5 29 DH 5 21 5 30 DHCP 2 5 DNS server address 3 4 3 13 DHCP Address Pool 3 3 4 3 13 DHCP log monitoring 6 36 DHCP server about 3 address pool 3 4 3 13 enable 3 4 lease time 3 4 3 13 diagnostics DNS lookup 7 8 packet capture 7 8 ping 7 8 rebooting 7 8 routing table 7 8 Diagnostics screen 7 8 Diffie Hellman Group IKE Policy 5 17 Disable DHCP Server 3 Disable DNS Proxy 4 21 DMZ about 3 11 firewall security 3 11 DMZ port 3 increasing tra
19. and allows it to dynamically adjust its routing tables and adapt to changes in the network RIP is disabled by default To configure RIP 1 Network Configuration WAN Settings Dynamic DNS RIP Configuration RIP Direction First Key Parameters MDS Key Id MDS Auth Key MM OD YYYY Not Valid Before Authentication for RIP 2B 2M required LAN Settings DMZ Setup Routing Select Network Configuration from the main menu and Routing from the submenu The Routing screen displays see Figure 3 6 on page 3 15 Click RIP Configuration option arrow to the right of the Routing tab The RIP Configuration screen displays RIP Version Disabled Not Valid After O Yes No Second Key Parameters MDS Key Id MDS Auth Key MM OD YYYY Not Valid Before y Not Valid After yi y MM OD YYYY Ay MM OD YYYY y a Figure 3 8 LAN Configuration v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual 3 From the RIP Direction pull down menu select the direction in which the VPN firewall will send and receives RIP packets The choices are e None The VPN firewall neither broadcasts its routing table nor does it accept any RIP packets from other routers This effectively disables RIP e Both The VPN firewall broadcasts its routing table and also processes RIP information received from other routers e Out Only The VPN firewall broadcasts its routing ta
20. e Advanced VPN support for IPsec 1 1 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual e SNMP Manageable optimized for the NETGEAR ProSafe Network Management Software NMS100 e Easy Web based setup for installation and management e Advanced SPI Firewall and Multi NAT support e Extensive Protocol Support e Login capability e One console port for local management e Front panel LEDs for easy monitoring of status and activity e Flash memory for firmware upgrade Advanced VPN Support for IPsec The VPN firewall supports IPsec virtual private network VPN connections IPsec VPN delivers full network access between a central office and branch offices or between a central office and telecommuters Remote access by telecommuters requires the installation of VPN client software on the remote computer e IPsec VPN with broad protocol support for secure connection to other IPsec gateways and clients e Bundled with a single user license of the NETGEAR ProSafe VPN Client software VPNO1L e Supports 5 concurrent IPsec VPN tunnels A Powerful True Firewall with Content Filtering Unlike simple Internet sharing NAT routers the FVS318G is a true firewall using stateful packet inspection to defend against hacker attacks Its firewall features include e DoS protection Automatically detects and thwarts DoS attacks such as Ping of Death SYN Flood LAND Attack and IP Spoofing e Secur
21. e Manual All settings including the keys for the VPN tunnel are manually entered at each end both VPN Endpoints No third party server or organization is involved e Auto Some settings for the VPN tunnel are generated automatically by using the IKE Internet Key Exchange protocol to perform negotiations between the two VPN Endpoints the Local ID Endpoint and the Remote ID Endpoint In addition a CA Certificate Authority can also be used to perform authentication see Managing Certificates on page 5 30 To use a CA each VPN gateway must have a certificate from the CA For each certificate there is both a public key and a private key The public key is freely distributed and is used by any sender to encrypt data intended for the receiver the key owner The receiver then uses its private key to decrypt the data without the private key decryption is impossible The use of certificates for authentication reduces the amount of data entry required on each VPN endpoint The VPN Policies Screen The VPN Policies screen allows you to add additional policies either Auto or Manual and to manage the VPN policies already created You can edit policies enable or disable policies or delete them entirely The rules for VPN policy use are 1 Traffic covered by a policy will automatically be sent via a VPN tunnel 2 When traffic is covered by two or more policies the first matching policy will be used In this situation the or
22. the HTTP port the Internet Outbound communications going out to Enabled all the Internet Source MAC filtering Disabled Stealth Mode Enabled Technical specifications for the ProSafe Gigabit 8 Port VPN Firewall FVS318G are listed in the following table Table A 2 VPN firewall Technical Specifications Featu re Specifications Network Protocol and Standards Compatibility Data and Routing Protocols TCP IP RIP 1 RIP 2 DHCP PPP over Ethernet PPPoE Powe r Adapter North America 120V 60 Hz input United Kingdom Australia 240V 50 Hz input Europe 230V 50 Hz input Physi Japan 100V 50 60 Hz input All regions output 12 V DC 1 5 A output 18 W maximum cal Specifications Dimensions 32 x 189 x 123 mm 1 6 x 10 x 7 in Weight 590g 1 3 Ib A 2 Default Settings and Technical Specifications v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Table A 2 VPN firewall Technical Specifications continued Feature Specifications Environmental Specifications Operating temperature 0 to 40 C 32 to 104 F Operating humidity 90 maximum relative humidity noncondensing Electromagnetic Emissions Meets requirements of FCC Part 15 Class B VCCI Class B EN 55 022 CISPR 22 Class B Interface Specifications LAN Eight 10 100 1000BASE Tx Gb Ru 45 ports WAN One 10 100 1000BASE Tx G
23. 8 Firewall Protection and Content Filtering 4 15 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual LAN WAN Inbound Rule Allowing Videoconference from Restricted Addresses If you want to allow incoming videoconferencing to be initiated from a restricted range of outside IP addresses such as from a branch office you can create an inbound rule Add LAN WAN Inbound Service Operation succeeded Service Action BLOCK by schedule otherwise allow Select Schedule Send to LAN Server Start koz ms a fra i J Finish Translate to Port Number O WAN Destination IP Address Broadband y Start Finish LAN Users Any Start J Finish A Finish fi72 Mhe ss 254 Log Bandwidth Profile Figure 4 9 In the example CU SeeMe connections are allowed only from a specified range of external IP addresses LAN WAN or DMZ WAN Inbound Rule Setting Up One to One NAT Mapping If you arrange with your ISP to have more than one public IP address for your use you can use the additional public IP addresses to map to servers on your LAN or DMZ One of these public IP addresses will be used as the primary IP address of the VPN firewall This address will be used to provide Internet access to your LAN PCs through NAT The other addresses are available to map to your servers In the example shown in Figure 4 10 on page 4 17 we have configured multi NAT to sup
24. 8 schedule blocking traffic 4 29 Schedule 1 screen 4 29 Secure Hash Algorithm 1 See SHA 1 Security features of 1 3 Security Parameters Index See SPI self certificate request 5 35 Send To E mail Address 6 25 Service Based Rules 4 3 Service Blocking outbound rules 4 3 port filtering 4 3 reducing traffic 6 2 service numbers common protocols 4 24 Services screen 4 25 Session Initiation Protocol See SIP Session Limit screen 4 22 Setting Up One to One NAT Mapping example of 4 16 Settings Backup amp Upgrade screen 6 18 SHA 1 IKE policies 5 20 VPN policies 5 29 Simple Network Management Protocol See SNMP SIP 4 23 sniffer 7 3 SNMP about 6 16 configuring 6 17 global access 6 17 host only access 6 17 subnet access 6 17 SNMP screen 6 17 software upgrade 6 20 Source MAC Filter screen 4 33 Source MAC Filtering enabling 4 33 reducing traffic 6 4 Specifying an Exposed Host example of 4 17 SPI 5 28 spoof MAC address 7 5 Starting IP Address DHCP Address Pool 3 4 3 13 stateful packet inspection 7 2 firewall use with 4 2 static IP address configuring 2 8 connection method 2 5 static routes about 3 14 add or edit 3 15 configuring 3 14 example 3 16 stealth mode 4 21 6 5 submenu 2 3 SYN flood 4 21 6 5 SysLog Server IP Address 6 25 T tab menu 2 3 TCP flood special rule 6 5 Index 7 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual TCP IP network tro
25. Add New VPN Policy Mods Config Record Do you want to use Mode Config Record Ove Om Policy Name SalesPerson elect Mode Config Record F e P view selected A Select Local Gateway wani O wanz Identifier Type Identifier Type Identifier Identifier i IKE SA Parameters Encryption Algorithm Authentication Algorithm Authentication Method Pre shared key ORSA Signature Pre shared key 2345673 sd Key Length 8 49 Char Diffie Hellman DH Group SA Lifetime sec Enable Dead Peer Detection Q Yes No Detection Period Seconds Reconnect after failure count Extended Authentication XAUTH Configuration Authentication Type User Database None Username Edge Device O IPSec Host Figure 5 34 5 48 Virtual Private Networking v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual 9 Enter a Pre Shared Key that will also be configured in the VPN client 10 XAUTH is disabled by default To enable XAUTH in the Extended Authentication section select one of the following e Edge Device to use the VPN firewall as a VPN concentrator where one or more gateway tunnels terminate If selected you must specify the Authentication Type to be used in verifying credentials of the remote VPN gateways e IPsec Host if you want the VPN firewall to be authenticated by the remote gateway Enter a Username and Password to be associated with t
26. Add to manually add a device to the database VPN Firewall and Network Management 6 33 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual The Known PCs and Devices table lists all current entries in the LAN Groups database For each PC or device the following data is displayed Table 6 4 Known PCs and Devices options Item Description Name The name of the PC or device Sometimes this can not be determined and will be listed as Unknown In this case you can edit the entry to add a meaningful name IP Address The current IP address For DHCP clients where the IP address is allocated by the DHCP Server in this device this IP address will not change Where the IP address is set on the PC as a fixed IP address you may need to update this entry manu ally if the IP address on the PC is changed MAC Address The MAC address of the PC The MAC address is a low level network identifier which is fixed at manufacture Group Each PC or device must be in a single group The Group column indicates which group each entry is in By default all entries are in the Groupi 3 Note If the VPN firewall is rebooted the table data is lost until the VPN firewall rediscovers the devices Monitoring VPN Tunnel Connection Status You can view the status of the VPN tunnels by selecting VPN from the main menu and Connection Status from the submenu The IPSec Connection Status screen displays
27. B s bytes per second and the interface up time are shown To set the poll interval 1 Click the Stop button 2 From the Poll Interval pull down menu select a new interval the minimum is 5 seconds the maximum is 5 minutes 3 Click the Set Interval button Monitoring Broadband Port Status You can monitor the status of the broadband connection the dynamic DNS server connections and the DHCP server connections To monitor the status of the broadband port 1 Select Network Configuration from the main menu and WAN Settings from the submenu The Broadband ISP Settings screen displays 2 Click the Broadband Status option arrow in the upper right hand section of the screen The Connection Status popup window displays a status report on the WAN port Connection Status Connection Time 0 Days 00 17 39 Connection Type Static IP Connection State Connected IP Address 64 139 54 227 Subnet Mask 255 255 255 243 Gateway 64 139 54 225 DNS Server 66 80 130 23 HF dis connect Figure 6 16 6 32 VPN Firewall and Network Management v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Monitoring Attached Devices The LAN Groups screen contains a table of all IP devices that the VPN firewall has discovered on the local network To view the LAN Groups screen 1 Select Network Configuration from the main menu and LAN Settings from the submenu 2 Select the LAN Groups tab The LAN
28. CONTRIBUTORS BE LIABLE FOR ANY DIRECT INDIRECT INCIDENTAL SPECIAL EXEMPLARY OR CONSEQUENTIAL DAMAGES INCLUDING BUT NOT LIMITED TO PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES LOSS OF USE DATA OR PROFITS OR BUSINESS INTERRUPTION HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY WHETHER IN CONTRACT STRICT LIABILITY OR TORT INCLUDING NEGLIGENCE OR OTHERWISE ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE This product includes cryptographic software written by Eric Young eay cryptsoft com This product includes software written by Tim Hudson tjh cryptsoft com Copyright C 1990 RSA Data Security Inc All rights reserved License to copy and use this software is granted provided that it is identified as the RSA Data Security Inc MD5 Message Digest Algorithm in all material mentioning or referencing this software or this function License is also granted to make and use derivative works provided that such works are identified as derived from the RSA Data Security Inc MD5 Message Digest Algorithm in all material mentioning or referencing the derived work RSA Data Security Inc makes no representations concerning either the merchantability of this software or the suitability of this software for any particular purpose It is provided as is without express or implied warranty of any kind These notices must be retained in any copies of any part of this documenta
29. Groups screen displays Network Configuration WAN Settings Dynamic DNS LAN Setup EPOENLITIJ LAN Multi homing Edit Group Names help Name IP Address MAC Address Group Action o unknown 102 168 1 101 OO 1er23 e2 3f 24 Groupi Besi o unknown 102 168 1 16 00 1 23 e2 92 b4 Groupi Besi DHCP Assigned IP Address lt elect all seiste Grave binding Add Known PCs and Devices Name IP Address Type IP Address MAC Address Group Add _ Fixed set on PC koz kss a Jhs Groups m a44 Figure 6 17 The Known PCs and Devices table lists the entries in the Network Database which is an automatically maintained list of LAN attached devices PCs and other LAN devices become known by the following methods DHCP Client Requests By default the DHCP server in the VPN firewall is enabled and will accept and respond to DHCP client requests from PCs and other network devices These requests also generate an entry in the database Because of this leaving the DHCP Server feature enabled on the LAN Setup screen is strongly recommended e Scanning the Network The local network is scanned using standard methods such as ARP The scan will detect active devices that are not DHCP clients However sometimes the name of the PC or device cannot be accurately determined and will be shown as unknown e Manually Adding Devices You can enter information in the Add Known PCs and Devices section and click
30. ISAKMP OAK INFO HASH NOTIFY STATUS_INITISL_CONTACT 21 356 My Connections campfrog RECEIVED lt lt lt ISAKMP OAK QM HASH SA NON ID 2x 1 831 My Connections camptrog Filter entry 3 added SECURE 192 168 001 002 255 255 255 255 192 168 002 000 21 12 31 21 831 My Connections campfrog SENDING gt gt gt gt ISAKMP OAK GM HASH 21 12 31 21 832 My Connections campfrog Loading IPSec SA Message ID 1F44FC04 OUTBOUND SPI EESEE30 INBOUN 12 31 21 832 m r Figure 5 14 ____ Note The information in the Log Viewer screen in Figure 5 14 does not correspond to the configuration that is presented in the Use the NETGEAR VPN Client Security Policy Editor to Create a Secure Connection on page 5 7 5 12 Virtual Private Networking v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual e Right click the VPN Client icon in the system tray and select Connection Monitor N Connection Monitor NETGEAR ProSafe VPN Client Global Statistics Non Secured Packets 737 Secured Packets 0 Dropped Packets 49 Secured Data KBytes 0 I Show Idle Connections Close I Freeze Display Connection Name LocalAddess Local Subnet Remote Address Remote Modifier GW Address Protocol Local Port Rem Port Eg My Connections campfrog 192 168 001 002 amp 255 255 255 255 192 168 002 000 amp 255 255 255 255 021 208 246 891 ALL ALL ALL
31. N Network Security Policy My Connections My Identity modetfa_test My Identity EI Security Policy None Ei amp to_fdvg ID Type By Other Connections Select Certificate Pre Shared Key Domain Name J salesperson 1 remote_id com Virtual Adapter Preferred Intermal Network IP Address 0 0 0 0 Internet Interface Name fol Broadcom 440x 10 100 Integrated Controlle IP Addr 192 168 1 2 Figure 5 36 Enter the following information a Click Pre Shared Key and enter the key you configured in the VPN firewall s Add IKE Policy screen b From the Select Certificate pull down menu select None c From the ID Type pull down menu select Domain Name and create an identifier based on the name of the IKE policy you created for example remote_id com d Under Virtual Adapter pull down menu select Preferred The Internal Network IP Address should be 0 0 0 0 Note If no box is displayed for Internal Network IP Address go to Options Global Policy Settings and check the box for Allow to Specify Internal Network Address e Select your Internet Interface adapter from the Name pull down menu 3 On the left side of the menu select Security Policy Enter the following information a Under Security Policy Phase 1 Negotiation Mode check the Aggressive Mode radio button Virtual Private Networking 5 51 v1 1 August 2010 ProSafe Gi
32. O Block All Traffic Except E Mail faz o0 on the day of Month O send e mail alert O Send e mail report before restarting counter Internet Traffic Statistics Start Date Time Outgoing Traffic Volume MB Incoming Traffic Volume MB Total Traffic Volume MB Average per day MB of Standard Limit of this Month s Limit Figure 6 12 3 Inthe Traffic Counter section make your traffic counter selections e Restart Traffic Counter Now Select this option and click Apply to restart the traffic counter immediately 6 28 VPN Firewall and Network Management v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual e Restart Traffic Counter at a Specific Time Restart the traffic counter at a specific time and day of the month Fill in the time fields and choose AM or PM and the day of the month from the pull down menus Send e mail report before restarting counter An email report will be sent just before restarting the counter You must configure the email capability in order for this function to work see Activating Notification of Events and Alerts on page 6 23 4 Inthe When limit is reached section make the following choice e Block All Traffic All access to and from the Internet will be blocked Warning If the Block All Traffic radio button is selected the WAN port shuts down once its traffic limit is reached e Block all traffic except E mail On
33. Proxy Allows the VPN firewall to handle DNS queries from the LAN e Enable Stealth Mode Prevents the VPN firewall from responding to incoming requests for unsupported services As you define your firewall rules you can further refine their application according to the following criteria e LAN Users These settings determine which computers on your network are affected by this rule Select the desired IP Address in this field VPN Firewall and Network Management 6 5 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual WAN Users These settings determine which Internet locations are covered by the rule based on their IP address Any The rule applies to all Internet IP address Single address The rule applies to a single Internet IP address Address range The rule is applied to a range of Internet IP addresses Destination Address These settings determine the WAN destination IP address for this rule which will be applicable to incoming traffic This rule will be applied only when the destination IP address or IP address range of the incoming packet matches the IP address or IP address range of the selected WAN interface Services You can specify the desired services or applications to be covered a rule If the desired service or application does not appear in the list you must define it using the Services screen see Adding Customized Services on page 4 24 Schedule If you have
34. Reference Manual Table 4 1 Outbound Rules continued Item Select Schedule LAN Users Description Select the desired time schedule Schedule1 Schedule2 or Schedules that will be used by this rule e This pull down menu gets activated only when BLOCK by schedule otherwise Allow or ALLOW by schedule otherwise Block is selected as Action e Use schedule screen to configure the time schedules see Setting a Schedule to Block or Allow Specific Traffic on page 4 29 These settings determine which computers on your network are affected by this rule Select the desired options e Any All PCs and devices on your LAN e Single address Enter the required address and the rule will be applied to that particular PC Address range If this option is selected you must enter the start and finish fields e Groups Select the Group to which this rule will apply Use the LAN Groups screen under Network Configuration to assign PCs to Groups See Managing Groups and Hosts LAN Groups on page 3 5 WAN Users These settings determine which Internet locations are covered by the rule based on their IP address Select the desired option Any All Internet IP address are covered by this rule Single address Enter the required address in the start field e Address range If this option is selected you must enter the start and end fields DMZ Users QoS Priority Log These settings dete
35. Seconds KBytes SALite Seconds gt zeeaq Compression None x IV Encapsulation Protocol ESP Encypt lg Triple DES Hash Alg SHA 1 Encapsulation Tunnel v T Authentication Protocol AH 5 52 v1 1 August 2010 Virtual Private Networking ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Enter the values to match your configuration of the VPN firewall ModeConfig Record menu The SA Lifetime can be longer such as 8 hours 28800 seconds 6 Click the Save icon to save the Security Policy and close the VPN ProSafe VPN client Testing the Mode Config Connection To test the connection 1 Right click on the VPN client icon in the Windows toolbar and select Connect The connection policy you configured will appear in this case My Connections modecfg_test 2 Click on the connection Within 30 seconds the message Successfully connected to MyConnections modecfg_test displays and the VPN client icon in the toolbar will read On 3 From the client PC ping a computer on the VPN firewall LAN Configuring Keepalives and Dead Peer Detection In some cases it may not be desirable to have a VPN tunnel drop when traffic is idle for example when client server applications over the tunnel cannot tolerate the tunnel establishment time If you require your VPN tunnel to remain connected you can use the Keepalive and Dead Peer Detection features to prevent the tunnel fr
36. The Broadband ISP Settings screen displays see Figure 2 2 on page 2 4 for the entire screen 2 In the ISP Login section choose one of these options e Tf your ISP requires an initial login to establish an Internet connection click Yes this is the default e Ifa login is not required click No and ignore the Login and Password fields help Does Your Internet Connection Require a Login Login Yes No Password Figure 2 4 3 Ifyou clicked Yes enter the ISP provided Login and Password information 2 6 Connecting the VPN Firewall to the Internet v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual 4 Inthe ISP Type section select the type of ISP connection you use from the two listed options By default Other PPPoE is selected help Account Name Sa Domain Name Idle Timeout O Keep Connected Which type of ISP connection do you use Idle Time Minutes Austria PPTP Connection Reset Other PPPoE Disconnect Time 0__ 4 o__ mm Delay fo Sec My IP Address 0 p J fe Server IP Address Figure 2 5 e Other PPPoE If you have installed login software such as WinPoET or Ethernet then your connection type is PPPoE Configure the following fields Account Name Valid account name for the PPPoE connection Domain Name Name of your ISP s domain or your domain name if your ISP has assigned one In most cases you may leave this field blank Idl
37. The Internet connection is down The WAN port is either not left side of port enabled or has no link 7 Speed On Green The port is operating at 1 000 Mbps ped On Amber The port is operating at 100 Mbps right side of port Off The port is operating at 10 Mbps The rear panel of the FVS318G includes a cable lock receptacle a Factory Defaults button and a DC power connection 1 2 3 Figure 1 2 Viewed from left to right the rear panel contains the following elements 1 Cable security lock receptacle 2 Factory Defaults button Using a sharp object press and hold this button for about ten seconds until the front panel TEST light flashes to reset the VPN firewall to factory default settings All configuration settings will be lost and the default password will be restored 3 DC power receptacle 12V 1 5A Introduction 1 7 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Default IP Address Login Name and Password Check the label on the bottom of the FVS318G s enclosure if you forget the following factory default information e IP Address http 192 168 1 1 e User name admin e Password password NETGEAR ProSafe Gigabit 8 Port VPN Firewall FVS318G LAN IP Address CE http 192 168 1 1 user name admin password password User Name TES internet i Made in China 272 10769 01 Password Figure 1 3
38. The Policies submenu tabs appear with the IKE Policies screen in view see Figure 5 18 on page 5 16 Virtual Private Networking 5 55 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual 2 Click the VPN Policies tab The VPN Policies screen displays see Figure 5 20 on page 5 24 3 In the List of VPN Policies table click the edit button to the right of the VPN policy that you want to edit The Edit VPN Policy screen displays 4 Inthe General section of the Edit VPN Policy screen click the Enable NetBIOS checkbox Policy Name owi to Gw2 Policy Type Select Local Gateway want Owanz Remote Endpoint 1P Address 81 Oregon 71 202 246 81 Enable NetBIOS O Enable Rollover Enable Keepalive Yes QO No Ping IP Address Detection period 10 Seconds Reconnect after failure count B Figure 5 41 5 Click Apply at the bottom of the screen 5 56 Virtual Private Networking v1 1 August 2010 Chapter 6 VPN Firewall and Network Management This chapter describes how to use the network management features of your ProSafe Gigabit 8 Port VPN Firewall FVS318G This chapter includes the following sections e Performance Management on this page e Configuring Users Administrative Settings and Remote Management on page 6 8 e Monitoring System Performance on page 6 23 Performance Management Performance management consists of controlling the traffic t
39. Type from the pull down menu which will be used to verify user account information Select one of the following options e Edge Device Use the VPN firewall as a VPN concentrator where one or more gateway tunnels terminate When this option is chosen you will need to specify the authentication type to be used in verifying credentials of the remote VPN gateways 5 40 Virtual Private Networking v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual User Database to verify against the VPN firewall s user database Users must be added through the User Database screen see Configuring the User Database for XAUTH on page 5 41 RADIUS CHAP or RADIUS PAP depending on the authentication mode accepted by the RADIUS server to add a RADIUS server If RADIUS PAP is selected the VPN firewall will first check in the User Database to see if the user credentials are available If the user account is not present the VPN firewall will then connect to the RADIUS server see Configuring RADIUS Clients for XAUTH on page 5 42 e IPSec Host Enable authentication by the remote gateway In the adjacent Username and Password fields type in the information user name and password associated with the IKE policy for authenticating this gateway by the remote gateway 4 Click Apply to save your settings Configuring the User Database for XAUTH The User Database screen is used to configure and administer use
40. Virtual Adapter Disabled bi Intemet Interface Name 3 Broadcom NetLink TM Fast Ethemet v IP Addr 192 168 1 2 OK Cancel Figure 5 10 e From the Select Certificate pull down menu choose None e Click Pre Shared Key to enter the key you provided in the VPN Wizard in this example we are using r3m0 eC Lient e From the ID Type pull down menu choose Domain Name e Leave Virtual Adapter disabled e In Network Adapter select the adapter you will use the IP address of the selected adapter will display Verify the Security Policy settings no changes are needed Virtual Private Networking v1 1 August 2010 5 9 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Security Policy Editor NETGEAR ProSafe VPN Client File Edit Options Help E NETGEAR Network Security Policy J My Connections Poicy B gwi uly w G My Identity Select Phase 1 Negotiation Mode SJ secs Po Man Mode Qs Other Connections Aggressive Mode Use Manual Keys J Enable Perfect Forward Secrecy PFS Group DifieHelman Group 2 x PFS I Enable Replay Detection Security Policy Editor NETGEAR ProSafe VPN Client a axla NETGEAR N Network Security Policy B L My Connections r Authentication Method and Algorithms 2 amp owt G My Identity Authentication Method B a Security Policy PreShaedKey S
41. WAN Rules The default outbound policy is to allow all traffic to the Internet to pass through Firewall rules can then be applied to block specific types of traffic from going out from the LAN to the Internet outbound The default policy of Allow Always can be changed to block all outbound traffic which then allows you to enable only specific services to pass through the VPN firewall To change the default outbound policy 1 Select Security from the main menu and Firewall Rules from the submenu The LAN WAN Rules screen displays see Figure 4 1 on page 4 8 2 Change the Default Outbound Policy by selecting Block Always from the pull down menu 3 Click Apply Firewall Protection and Content Filtering 4 9 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual LAN WAN Outbound Services Rules You may define rules that will specify exceptions to the default rules By adding custom rules you can block or allow access based on the service or application source or destination IP addresses and time of day The outbound rule will block the selected application from any internal IP LAN address to any external WAN IP address according to the schedule created in the Schedule menu You can also tailor these rules to your specific needs see Administrator Tips on page 4 42 gt Note This feature is for advanced administrators only Incorrect configuration will cause serious problems To create a
42. a RADIUS server provides a method for storing the authentication information centrally in the local network XAUTH is enabled when adding or editing an IKE policy Two types of XAUTH are available e Edge Device If this is selected the VPN firewall is used as a VPN concentrator where one or more gateway tunnels terminate If this option is chosen you must specify the authentication type to be used in verifying credentials of the remote VPN gateways User Database RADIUS PAP or RADIUS CHAP e IPSec Host If you want authentication by the remote gateway enter a user name and password to be associated with this IKE policy If this option is chosen the remote gateway must specify the user name and password used for authenticating this gateway Note If a RADIUS PAP server is enabled for authentication XAUTH will first check the local User Database for the user credentials If the user account is not present the VPN firewall will then connect toa RADIUS server Configuring XAUTH for VPN Clients Once the XAUTH has been enabled you must establish user accounts on the local database to be authenticated against XAUTH or you must enable a RADIUS CHAP or RADIUS PAP server Note You cannot modify an existing IKE policy to add XAUTH while the IKE policy is in use by a VPN policy The VPN policy must be disabled before you can modify the IKE policy To enable and configure XAUTH 1 Select VPN from the main menu and Policies fr
43. by selecting this feature Revision History Part Number version Date Description Number 202 10521 01 1 0 July 2009 Product update New firmware and new user Interface 202 10521 01 1 1 November Update to LAN and firewall configuration 2009 xiv About This Manual v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual 202 10521 02 1 0 April 2010 Added the following new features for the April 2010 firmware maintenance release Connection reset and delay options on the Broadband ISP Settings screen see Manually Configuring Your Internet Connection Support for an address range for inbound LAN rules on the Add LAN WAN Inbound Service screen see Inbound Rules Port Forwarding and Inbound Rules Examples Support for new log options such as Resolved DNS Names and VPN on the Firewall Logs amp E mail screen see Activating Notification of Events and Alerts In addition made the following substantial changes to the book Provided new screen captures for better viewing Made minor corrections throughout the manual Removed the Managing Users Authentication and Certificates chapter and included the material in other chapters Made the following change to Chapter 2 Connecting the VPN Firewall to the Internet Updated the Broadband ISP Settings screen Figure 2 2 and the ISP Type options in the Manually Configuring
44. configured your VPN firewall two implicit static routes were created A default route was created with your ISP as the gateway and a second static route was created to your local network for all 192 168 1 x addresses With this configuration if you attempt to access a device on the 134 177 0 0 network your VPN firewall will forward your request to the ISP The ISP forwards your request to the company where you are employed and the request will likely be denied by the company s firewall In this case you must define a static route telling your VPN firewall that 134 177 0 0 should be accessed through the ISDN firewall at 192 168 1 100 In this example e The Destination IP Address and IP Subnet Mask fields specify that this static route applies to all 134 177 x x addresses 3 16 LAN Configuration v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual The Gateway IP Address fields specifies that all traffic for these addresses should be forwarded to the ISDN firewall at 192 168 1 100 A Metric value of 1 will work since the ISDN firewall is on the LAN Private is selected only as a precautionary security measure in case RIP is activated Configuring Routing Information Protocol RIP RIP Routing Information Protocol RFC 2453 is an Interior Gateway Protocol IGP that is commonly used in internal networks LANs It allows a router to exchange its routing information automatically with other routers
45. firewall globally accessible using the community string but still receive traps on the host enter 0 0 0 0 as the subnet mask and an IP address for where the traps will be received Enter the trap port number of the configuration in the Port field The default is 162 Enter the trap community string of the configuration in the Community field Click Add to create the new configuration The entry displays in the SNMP Configuration table To modify an SNMP configuration click Edit in the Action column adjacent to the entry that you wish to modify VPN Firewall and Network Management 6 17 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual When you click on the SNMP System Info option arrow on the SNMP screen the VPN firewall s identification information is displayed This following identification information is available to the SNMP Manager system contact system location and system name To modify the SNMP identification information 1 Click the SNMP System Info option arrow on the SNMP screen The SNMP SysConfiguration screen displays Administration Remote Management SNMP Settings Backup amp Upgrade Time Zone SNMP SysConfiguration SysContact SysName FVS318G Figure 6 7 2 Modify any of the information that you want the SNMP Manager to use You can edit the system contact system location and system name 3 Click Apply to save your settings Managing the Configuration Fil
46. fixed IP address you may enter it here Otherwise you should leave this field blank Domain Name If you have an Internet domain name you can enter it here Otherwise you should leave this field blank E mail Address Enter the email address of a technical contact in your organization 5 Click Generate A new certificate request is created and added to the Self Certificate Requests table help Status Action Active Self Certificate Not Uploaded Prieu select all delete Upload certificate corresponding to a request above Certificate File upload Figure 5 26 5 36 Virtual Private Networking v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual 6 In the Self Certificate Requests table click view in the Action column to view the request Certificate Request Data Operation succeeded Subject Name CN VPN Router Hash Algorithm MDS signature Algorithm RSA Key Length 512 N CERTIFICATE REQUEST AwGTEXMBUGA1UEAx Figure 5 27 7 Copy the contents of the Data to supply to CA text box into a text file including all of the data contained from BEGIN CERTIFICATE REQUEST to END CERTIFICATE REQUEST 8 Submit your certificate request to a CA Connect to the website of the CA b Start the Self Certificate request procedure c When prompted for the requested data copy the data from your saved text file includin
47. new LAN WAN outbound service rule 1 Inthe LAN WAN Rules screen click Add under the Outbound Services table The Add LAN WAN Outbound Service screen displays Add LAN WAN Outbound Service Operation succeeded help Service ANY v Action BLOCK always Select Schedule Schedule 1 LAN Users Any v Start Finish WAN Users Any v Start Finish E QoS Priority Normal Service Log Never Bandwidth Profile NONE NAT IP WAN Interface Address Figure 4 2 2 Configure the settings based on the descriptions in Table 4 1 on page 4 3 Click Apply to save your changes and reset the fields on this screen The new rule will be listed in the Outbound Services table 4 10 Firewall Protection and Content Filtering v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual LAN WAN Inbound Services Rules This Inbound Services table lists all existing rules for inbound traffic If you have not defined any rules no rules will be listed By default all inbound traffic is blocked Remember that allowing inbound services opens holes in your VPN firewall Only enable those ports that are necessary for your network To create anew LAN WAN inbound service rule 1 Inthe LAN WAN Rules screen click Add under the Inbound Services table The Add LAN WAN Inbound Service screen displays Add LAN WAN Inbound Service Operation succeeded Action BLOCK always Vi Selec
48. not affect any restrictions applied to that PC 3 6 LAN Configuration v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Viewing the Network Database To view the Network Database follow these steps 1 Select Network Configuration from the main menu and LAN Settings from the submenu The LAN Setup screen displays Click the LAN Groups tab The LAN Groups screen displays Network Configuration WAN Settings Dynamic DNS LAN Setup TE irae LAN Multi homing 6 Edit Group Names help Name IP Address MAC Address Group Action o unknown 102 168 1 101 00 1 23 e2 3f 24 Groupi eai o unknown 102 168 1 16 00 1 23 e2 92 b4 Groupi Qesit DHCP Assigned IP Address amp select all delete Gisave binding Add Known PCs and Devices Name IP Address Type IP Address MAC Address Group Add foe Jace J Jos Groups e Figure 3 2 The Known PCs and Devices table lists the entries in the Network Database For each computer or device the following fields are displayed Name The name of the computer or device Computers that do not support the NetBIOS protocol will be listed as Unknown In this case the name can be edited manually for easier management If the computer was assigned an IP address by the DHCP server then an asterisk is be appended to the name IP Address The current IP address of the computer For DHCP clients of the VPN firewall this IP address
49. not light when the Ethernet connection is made check the following e Make sure that the Ethernet cable connections are secure at the VPN firewall and at the hub or workstation e Make sure that power is turned on to the connected hub or workstation e Be sure you are using the correct cable When connecting the VPN firewall s Internet port to a cable or DSL modem use the cable that was supplied with the cable or DSL modem This cable could be a standard straight through Ethernet cable or an Ethernet crossover cable 7 2 Troubleshooting v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Troubleshooting the Web Configuration Interface If you are unable to access the VPN firewall s Web Configuration interface from a PC on your local network check the following Check the Ethernet connection between the PC and the VPN firewall as described in the previous section Make sure your PC s IP address is on the same subnet as the VPN firewall If you are using the recommended addressing scheme your PC s address should be in the range of 192 168 0 2 to 192 168 0 254 _____ Note If your PC s IP address is shown as 169 254 x x Recent versions of Windows and MacOS will generate and assign an IP address if the computer cannot reach a DHCP server These auto generated addresses are in the range of 169 254 x x If your IP address is in this range check the connection from the PC to the VPN fire
50. password and the LAN IP address will be 192 168 1 1 The VPN firewall will act as a DHCP server on the LAN and act as a DHCP client to the Internet Warning When you click default the VPN firewall settings will be erased All firewall rules VPN policies LAN WAN settings and other settings will be lost Back up your settings if you intend on using them again Upgrading the Firmware You can install a different version of the VPN firewall firmware from the Settings Backup and Firmware Upgrade screen To view the current version of the firmware that your VPN firewall is running select Monitoring from the main menu In the displayed Router Status screen the System Info section shows the firmware version When you upgrade your firmware this section of the screen will change to reflect the new version To download a firmware version and upgrade the VPN firewall 1 Goto the NETGEAR website at http www netgear com support and click Downloads 2 From the Product Selection pull down menu choose the FVS318G 3 Click on the desired firmware version to reach the download page Be sure to read the release notes on the download page before upgrading the VPN firewall s software 6 20 VPN Firewall and Network Management v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual After downloading an upgrade file you may need to unzip uncompress it before upgrading the VPN firewall If Release Notes are included
51. set to Percentage of Max Sessions this is the maximum number of sessions allowed from a single source machine as a percentage of the total connection capacity Session Limit is per machine based Otherwise if the User Limit Parameter is set to Number of Sessions the user limit is an absolute value 4 22 Firewall Protection and Content Filtering v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Es Note Some protocols such as FTP or RSTP create two sessions per connection which should be considered when configuring Session Limiting The Total Number of Packets Dropped due to Session Limit field shows total number of packets dropped when session limit is reached 6 In the Session Timeout section modify the TCP UDP and ICMP timeout values as you require A session will expire if no data for the session is received for the duration of the timeout value The default timeout values are 1200 seconds for TCP sessions 180 seconds for UDP sessions and 8 seconds for ICMP sessions 7 Click Apply to save your settings Managing the Application Level Gateway for SIP Sessions The Application Level Gateway ALG facilitates multimedia sessions such as voice over IP VoIP sessions that use the Session Initiation Protocol SIP across the firewall and provides support for multiple SIP clients ALG support for SIP is disabled by default To enable ALG for SIP 1 Select Security from the main menu an
52. table rebooting the VPN firewall and capturing packets Note For normal operation diagnostics are not required Select Monitoring from the main menu and Diagnostics from the submenu The Diagnostics screen displays l 1 I Monitoring l l Router Status Traffic Meter Firewall Logs amp E mail VPN Logs Diagnostics help Ping through YPN tunnel IP Address CICO WL w ping traceroute help help Display the Routing Table EE display Reboot the Router reboot Capture Packets packet trace Figure 7 1 7 8 Troubleshooting v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Table 7 1 Diagnostics Item Ping or Trace an IP Address Perform a DNS Lookup Description Ping Used to send a ping packet request to a specified IP address most often to test a connection If the request times out no reply is received it usually means that the destination is unreachable However some network devices can be configured not to respond to a ping The ping results will be displayed in a new screen click Back on the Windows menu bar to return to the Diagnostics screen If the specified address is intended to be reached through a VPN tunnel select Ping through VPN tunnel Traceroute often called Trace Route Lists all routers between the source this device and the destination IP address The Trace Route results will be displayed ina
53. the Trusted Domains fields After each entry click Add The trusted domain will appear in the Trusted Domains table You can also edit any entry by clicking Edit in the Action column adjacent to the entry Configuring Source MAC Filtering Source MAC filtering allows you to filter out traffic coming from certain known machines or devices e By default the source MAC address filter is disabled All the traffic received from PCs with any MAC address is allowed e When enabled traffic will be dropped coming from any computers or devices whose MAC addresses are listed in MAC Addresses table Es Note For additional ways of restricting outbound traffic see Outbound Rules Service Blocking on page 4 3 To enable MAC filtering and add MAC addresses to be blocked 1 Select Security from the main menu and Address Filter from the submenu The Source MAC Filter screen displays see Figure 4 22 on page 4 34 Firewall Protection and Content Filtering 4 33 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Services Schedule Block Sites Firewall Port Triggering UPnP Bandwidth Profile Pie eure IP MAC Binding help Do you want to enable Source MAC Address Filtering Yes No Policy for MAC Addresses listed below Block and Permit the rest help MAC Addresses select at delete Add Source MAC Address MAC Address Add es Sns Figure 4 22 2 Check the Yes radio box in
54. the blocking of a particular Web component is enabled 4 30 Firewall Protection and Content Filtering v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Proxy A proxy server or simply proxy allows computers to route connections to other computers through the proxy thus circumventing certain firewall rules For example if connections to a specific IP address are blocked by a firewall rule the requests can be routed through a proxy that is not blocked by the rule rendering the restriction ineffective Enabling this feature blocks proxy servers Java Blocks java applets from being downloaded from pages that contain them Java applets are small programs embedded in Web pages that enable dynamic functionality of the page A malicious applet can be used to compromise or infect computers Enabling this setting blocks Java applets from being downloaded ActiveX Similar to Java applets ActiveX controls install on a Windows computer running Internet Explorer A malicious ActiveX control can be used to compromise or infect computers Enabling this setting blocks ActiveX applets from being downloaded Cookies Cookies are used to store session information by websites that usually require login However several websites use cookies to store tracking information and browsing habits Enabling this option filters out cookies from being created by a website Note Many websites require that cookie
55. the checkbox to the left of the policy that you want to delete or click the select all table button to select all IKE policies 2 Click the enable or disable table button To add or edit a VPN policy see Manually Adding or Editing a VPN Policy on this page Note You cannot delete or edit an IKE policy for which the VPN policy is active You first must disable or delete the VPN policy before you can delete or edit the IKE policy Manually Adding or Editing a VPN Policy To manually add a VPN policy 1 Select VPN from the main menu and Policies from the submenu The Policies submenu tabs appear with the IKE Policies screen in view see Figure 5 18 on page 5 16 2 Click the VPN Policies tab The VPN Policies screen displays see Figure 5 20 on page 5 24 3 Under the List of VPN Policies table click the add button The Add VPN Policy screen displays see Figure 5 21 on page 5 26 Virtual Private Networking 5 25 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Add PN Policy Policy Name sd Policy Type Remote Endpoint Ip address i op u gf Oregon ss C Enable NetB10s Enable Keepalive QYes No Ping IP Address ea es a Detection period Seconds Reconnect after failure count Blo Traffic Selection Local IP Remote IP Start IP Address MA A Start IP Address J A End IP Address a a ee End IP Address a ss Subnet Mask bb Ss ia Subnet Mask bib hs
56. to Block or Allow Specific Kinds of Traffic on page 4 2 is the basic way of managing the traffic through your system you can further refine your control with the following optional features of the VPN firewall Groups and hosts see Managing Groups and Hosts LAN Groups on page 3 5 Services see Services Based Rules on page 4 3 Schedules see Setting a Schedule to Block or Allow Specific Traffic on page 4 29 Block sites see Blocking Internet Sites Content Filtering on page 4 30 Source MAC filtering see Configuring Source MAC Filtering on page 4 33 Port triggering see Configuring Port Triggering on page 4 37 4 42 Firewall Protection and Content Filtering v1 1 August 2010 Chapter 5 Virtual Private Networking This chapter describes how to use the virtual private networking VPN features of the ProSafe Gigabit 8 Port VPN Firewall FVS318G This chapter includes the following sections e Using the VPN Wizard for Client and Gateway Configurations on this page e Testing the Connections and Viewing Status Information on page 5 11 e Managing VPN Policies on page 5 15 e Managing Certificates on page 5 30 e Configuring Extended Authentication XAUTH on page 5 39 e Assigning IP Addresses to Remote Users ModeConfig on page 5 44 e Configuring Keepalives and Dead Peer Detection on page 5 53 e Configuring NetBIOS Bridging with VPN on pag
57. use this software in a product an acknowledgment in the product documentation would be appreciated but is not required 2 Altered source versions must be plainly marked as such and must not be misrepresented as being the original software 3 This notice may not be removed or altered from any source distribution Jean loup Gailly jloup gzip org Mark Adler madler alumni caltech edu The data format used by the zlib library is described by RFCs Request for Comments 1950 to 1952 in the files ftp ds internic net rfc rfc1950 txt zlib format rfc1951 txt deflate format and rfc1952 txt gzip format Product and Publication Details Model Number FVS318G Publication Date August 2010 Product Family VPN Firewall Product Name ProSafe Gigabit 8 Port VPN Firewall FVS318G Home or Business Product Business Language English Publication Part Number 202 10521 02 Publication Version Number 1 1 v1 1 August 2010 vi v1 1 August 2010 Contents ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual About This Manual Conventions Formats and SCOPE siciscscarnsssvecsinsncecdernceccaadenecdedcarincdecdsiiacagederneceareriaacied xiii Howto Prnt tus Manual sessiossa ae E E ENE xiv Chapter 1 Introduction Koy FO AUUNSS cess sinters E AE EEE TAE EEE EENEN 1 1 Advanced VPN Suppor for IPSEC saiisine E O 1 2 A Powerful True Firewall with Content Filtering cccccccecssseeeeeessteceeeeeesteeeeeeees
58. 0 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Monitoring 2 Firewall Logs amp E mail Firewall Logs amp E mail Log Identifier Accepted Packets Dropped Packets O Change of time by NTP C LAN to wan C LAN to wan C Login attempts C LAN to DMZ C LAN to DMZ C Secure Login attempts O DMZ to WAN O DMZ to wan C Reboots M WAN to LAN E WAN to LAN O All Unicast Traffic C DMZ to LAN C DMZ to LAN O All Broadcast Multicast Traffic CO WAN to DMZ C wan to DMZ C wan Status O Resolved DNS Names O ven CO DHCP Server i Other Event Logs O Source MAC Filter O Session Limit C Bandwidth Limit i E Mail Server T E Return E Mail Address D Send to E Mail Addres Custom SMTP Port No Authentication Do you want logs to be emailed to you O Yes No Login Plain CRAM MDS User Name Password Respond to Identd from SMTP Server i Send E mail logs by Schedule Unit Never Day Sunday v Time 00 v am i Enable SysLogs Do you want to enable syslog Syslog Server O Yes No SysLog Severity Figure 6 10 6 24 VPN Firewall and Network Management v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual 2 Inthe Log Options section enter the name of the log in the Log Identifier field The Log Identifier is a mandatory field used to identify which device sent the log messages The identifier is appended to log messages
59. 1 This descriptive name is not supplied to the remote VPN client it is only for your reference 4 Enter a Pre shared Key in this example we are using r3m0 eC lient which must also be entered in the VPN client software The key length must be 8 characters minimum and cannot exceed 49 characters Choose which WAN port to use as the VPN tunnel end point 6 The public Remote and Local Identifier are automatically filled in by pre pending the first several letters of the model number of your gateway to form FQDNs used in the VPN policies In this example we are using GW1_remote com and GW1_local com Virtual Private Networking 5 5 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Tip To assure tunnels stay active after completing the wizard manually edit the VPN policy to enable keepalive which periodically sends ping packets to the host on the peer side of the network to keep the tunnel alive PN Wizard iS VPN Wizard Default Values i About YPN Wizard The Wizard sets most parameters to defaults as proposed by the VPN Consortium YPNC and assumes a pre shared key which greatly simplifies setup After creating the policies through the VPN Wizard you can always update the parameters through the Policies menu This PN tunnel will connect to the following peers O Gateway vPN Client What is the new Connection Name Client to GW1 What is the pre shared key r
60. 1 A access remote management 6 4 Add DMZ WAN Outbound Services screen 4 2 Add LAN DMZ Outbound Service screen 4 4 Add LAN WAN Inbound Service 4 Add LAN WAN Outbound Service screen 4 10 Add Mode Config Record screen 5 45 address reservation 3 9 Advanced Encryption Standard See AES Advanced Options MTU Size 2 13 Port Speed 2 3 Router s MAC Address 2 4 AES 5 20 5 28 5 29 ALG 4 23 Allowing Videoconference from Restricted Addresses example of 4 16 Application Level Gateway See ALG ARP broadcast enable 3 5 3 14 Attack Checks about 4 20 Attack Checks screen 4 20 authentication for IPsec VPN pre shared key 5 2 RSA signature 5 2 WiKID 6 Authentication Algorithm Index IKE Policy 5 17 Authentication Header VPN Policy 5 24 Auto Detect 2 4 Auto Uplink 3 backup and restore settings 6 19 bandwidth capacity 6 LAN side 6 WAN side 6 Bandwidth Profile screen 4 28 Block Sites 2 Content Filtering 4 30 reducing traffic 6 3 Block Sites screen 4 32 Block TCP Flood 4 2 block traffic with schedule 4 29 Blocking Instant Messenger example of 4 19 Broadband Advanced Options 2 13 Broadband ISP Settings manual setup 2 6 Broadband ISP Settings screen 2 4 2 6 2 13 C CA 5 23 about 5 30 5 31 certificate generate new CSR 5 35 Certificate Authority See CA Certificate Revocation List See CRL Certificate Signing Request see CSR Index 1 v1 1 August 2010
61. 1 2 Secu FOAMS micri a A R a iA 1 3 Autosensing Ethernet Connections with Auto Uplink ssssssssssserssreersrrierisrrnrreenens 1 3 Extensive Protocol SUPPO ssena ane E A Or AETA r 1 4 Easy Installation and Management iomorro aa 1 4 Maintenance and SUPON iarsan a aR i 1 5 Package Contents xcrcecretaci sccscossiet oenn aaae E a 1 5 VPN Firewall Front and Reat Panels sunnin ites 1 6 Default IP Address Login Name and Password ccccccccccsseeeeessteeeeeeessneeeeeeeesteeeeeeees 1 8 Qualified Web BOWS CFS as ic526 7 csrcrsikecins de tesaadt aunts coasts ca edenteskccetdlaadhiageusgsdtl A iaiia ia 1 8 Chapter 2 Connecting the VPN Firewall to the Internet Widerstanding the Connection STEPS cccenairen dante niece aeieddiee lee 2 1 Logging into the VPN Firewall sxnssesheissentae nats oh iecieadi enema i 2 2 Navigating the Menus seriais ainra aE REAREA TARERE RANA 2 3 Configuring the Internet Connection to Your ISP ou eeesceececceeeseeeceeeeeeeaeeeeeeeeesaeessinees 2 4 Manually Configuring Your Internet Connection eeeeeeeestee sete eeeeeeeeeeeeteeaeeesaes 2 6 Configuring the WAN ModE sarsies hate a aii 2 9 Gonigunng Dynamic DNS sesasine E a S RAA N RA 2 11 Configuring the Advanced Broadband Options cccceececeeeeeeceeeeeeseeeseeeeeeesaeeneaes 2 13 Additional WAN Related Configuration cccceceeeeeececeeeeeeeeececeeeeeeeeseeueeeeeaeeeeaes 2 14 vii v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318
62. 18 Virtual Private Networking v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual 3 Complete the fields select the radio buttons and make your selections from the pull down menus as explained Table 5 2 Table 5 2 Add IKE Policy Settings Item Do you want to use Mode Config Record Mode Config Record Description or Subfield and Description Specify whether or not the IKE policy uses a Mode Config Record For information about how to define a Mode Config Record see Mode Config Operation on page 5 44 Select one of the following radio buttons Yes IP addresses are assigned to remote VPN clients You must select a Mode Config record from the pull down menu Note Because Mode Config functions only in Aggressive Mode selecting the Yes radio button sets the tunnel exchange mode to Aggressive mode and disables the Main mode Mode Config also requires that both the local and remote ends are defined by their FQDNs No Disables Mode Config for this IKE policy Note An XAUTH configuration via an edge device is not possible without Mode Config and is therefore disabled too For more information about XAUTH see Configuring Extended Authentication KAUTH on page 5 39 Select Mode From the pull down menu select one of the Mode Config Config Record records that you defined on the Add Mode Config Record screen see Configuring Mode Config Operation on the VPN Firewall on page
63. 18G Reference Manual VPN Firewall Front and Rear Panels The FVS318G front panel includes eight LAN ports one WAN port and four groups of status indicator light emitting diodes LEDs including Power and Test LAN and WAN LEDs 4 Left LED On Link Blink Activity Right LED Off 10M Amber 100M Green 1000M Figure 1 1 Table 1 1 describes each item on the front panel and its operation Table 1 1 LED Descriptions Object Activity Description 4 Powe On Green Power is supplied to the VPN firewall Off Power is not supplied to the VPN firewall 2 Test On Amber Test mode The system is initializing or the initialization has failed i Off The system has booted successfully Eight LAN Ports ies On Green The port has detected a link with a connected Ethernet device pe ae pena Blinking Green Data is being transmitted or received by the port p Off The port has no link 4 Speed On Green The LAN port is operating at 1 000 Mbps ri side of port On Amber The LAN port is operating at 100 Mbps g p Off The LAN port is operating at 10 Mbps 5 DMZ On Green LAN port 8 is enabled as a DMZ port Off LAN port 8 is not enabled as a DMZ port 1 6 Introduction v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Table 1 1 LED Descriptions continued Object Activity Description One WAN Port 6 Active On Green The WAN port is connected S Off
64. 3 Inthe Routing Logs section select the network segments for which you would like logs to be sent for example LAN to WAN under Dropped Packets 4 Inthe System Logs section and the Other Event Logs section select the type of events to be logged 5 In the Enable E Mail Logs section select the Yes radio box to enable email logs Then enter a E mail Server address Enter either the IP address or Internet name of your ISP s outgoing email SMTP server If you leave this box blank no logs will be sent to you b Return E mail Address Enter an email address to appear as the sender c Send To E mail Address Enter the email address where the logs and alerts should be sent You must use the full email address for example jsmith example com d Custom SMTP Port Enter the port for the outgoing email SMTP server The default SMTP port is 25 6 The No Authentication radio box is checked by default If your SMTP server requires user authentication select the required authentication type either Login Plain or CRAM MDS5 Then enter the user name and password to be used for authentication 7 To respond to IDENT protocol messages check the Respond to Identd from SMTP Server box The Ident Protocol is a weak scheme to verify the sender of email a common daemon program for providing the ident service is identd 8 In the Send E mail logs by Schedule section enter a Schedule for sending the logs From the Unit pull down menu choos
65. 3m0 eClient Key Length 8 49 Char ii End Point Information What is the Remote Identifier Information GW1_remote com What is the Local Identifier Information GW1_local com What is the remote LAN IP Address i f i What is the remote LAN Subnet Mask l iJ J Figure 5 6 7 Click Apply to save your settings The VPN Policies screen see Figure 5 7 on page 5 7 shows that the policy is now enabled To view or modify the VPN policy see Managing VPN Policies on page 5 15 5 6 Virtual Private Networking v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual VPN Wizard Certificates Mode Config IKE Policies RADEI VPN Client Connection Status Operation succeeded i List of PN Policies Name Type Local F0 cwi toawz o Client to GW Auto Policy Auto Policy 192 168 1 0 255 255 255 0 192 168 1 0 255 255 255 0 Client Policy Remote Auth Encr Action 192 168 2 0 255 255 255 0 SHA 1 3DES eait Any SHA 1 3DES Besit select all delete a O disable add Figure 5 7 Follow these steps to configure your VPN client Use the NETGEAR VPN Client Security Policy Editor to Create a Secure Connection From a PC with the NETGEAR ProSafe VPN Client installed configure a VPN client policy to connect to the VPN firewall 1 Right click on the VPN client icon in your Windows toolbar choose Security Policy Editor and v
66. 5 45 Note Click the View Selected button to open the Selected Mode Config Record Details popup window General Policy Name A descriptive name of the IKE policy for identification and management purposes Note The name is not supplied to the remote VPN endpoint Direction Type From the pull down menu select the connection method for the VPN firewall e Initiator The VPN firewall initiates the connection to the remote endpoint e Responder The VPN firewall responds only to an IKE request from the remote endpoint Both The VPN firewall can both initiate a connection to the remote endpoint and respond to an IKE request from the remote endpoint Exchange Mode From the pull down menu select the exchange more between the VPN firewall and the remote VPN endpoint e Main This mode is slower than the Aggressive mode but more secure e Aggressive This mode is faster than the Main mode but less secure Note If you specify either a FQDN or a User FQDN name as the local ID and or remote ID see the sections below the aggressive mode is automatically selected Virtual Private Networking 5 19 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Table 5 2 Add IKE Policy Settings continued Item Local Description or Subfield and Description Identifier Type Remote From the pull down menu select one of the following ISAKMP identifiers to be used by
67. 55 Chapter 6 VPN Firewall and Network Management Performance Managment ss sesicccereiscceceinsnencee tig saneceetunsaceeedunstineedetiy ENEAN ANNEE ENEAK NENEN ENEA 6 1 Bandwidth Capa iy arm aA E a EE eee iatee eee 6 1 VPN Firewall Features That Reduce Traffic ccceccccceeseeeeeneeeeeneeeeeeeeeseaeeeeneeeee 6 2 VPN Firewall Features That Increase Traffic 0 cecceeecseeeeeeeeeeeceeeeeeeeesecaeeteeeeeee 6 4 Using QoS to Shit the Wratic MiG rescris a 6 7 Tools tor trafie Management sesine a E 6 8 Configuring Users Administrative Settings and Remote Management ssseesseesse es 6 8 Changing Passwords and Settings jiscccesiccssnteantinanchistaskcceieesndeindeian bow maceriedinies 6 8 Adding External US6rs csissssccc ssscatces sess cczeessanaberesatecaaadelaetezegeed succdarerndeacaceeiaedeaedateas 6 10 Configuring an External Server for Authentication 0 0 eee eee eeeeeereeneeeeee 6 11 Enabling Remote Management ACCESS e ccceeeeeeeeeeeeeeeeeeeeeaeseeeeeeetaeeeeeneeeeee 6 14 Using ai SNMP NANAGEE c2ceccensosctenated cesta oindino ENEAN 6 16 Managing the Configuration File ssvcctssecscciss cdscshecd ctaausetaatcecentscccadsesededncaxentocnaneerrese 6 18 Contiguring Date and Time Semvice srira aaa E 6 21 Monitoring System Performance ccceeccececeeeeeeeeeeeeeeeeteaaeseeaeeeceaaeeeseneeseeaeeeeeaeeneaes 6 23 Activating Notification of Events and Alerts ceeeseecceeeeeeeeeeeeeeeeneeeeee
68. 6 35 e Viewing the DHCP Log on page 6 36 e Viewing Port Triggering Status on page 6 36 Activating Notification of Events and Alerts The Firewall Logs can be configured to log and then email denial of access general attack information and other information to a specified email address For example the VPN firewall will log security related events such as accepted and dropped packets on different segments of your LAN or DMZ denied incoming and outgoing service requests hacker probes and Login attempts and other general information based on the settings that you enter on the Firewall Logs amp E mail screen In addition if you have set up content filtering on the Block Sites screen see Blocking Internet Sites Content Filtering on page 4 30 a log will be generated when someone on your network tries to access a blocked site You must have email notification enabled to receive the logs in an email message If you do not have email notification enabled you can view the logs on the Logs screen see Figure 6 11 on page 6 26 Selecting all events will increase the size of the log so it is good practice to select only those events which are required To configure logging and notifications 1 Select Monitoring from the main menu and then Firewall Logs amp E mail from the submenu The Firewall Logs amp E mail screen displays see Figure 6 10 on page 6 24 VPN Firewall and Network Management 6 23 v1 1 August 201
69. 8 Connecting the VPN Firewall to the Internet 2 9 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual The WAN Mode screen allows you to configure how the VPN firewalll uses the external Internet connection This screen gives you two choices for accessing the external Internet connection e Network Address Translation NAT This technique allows several computers on a LAN to share the same Internet connection IP address while using private IP address on the LAN which are hidden from the Internet e Classical Routing This method allows the VPN firewall to perform the routing but requires separate valid static Internet IP address for each PC on your LAN Network Address Translation Network Address Translation NAT allows all PCs on your LAN to share a single public Internet IP address From the Internet there is only a single device the VPN firewall and a single IP address PCs on your LAN can use any private IP address range and these IP addresses are not visible from the Internet e The VPN firewall uses NAT to select the correct PC on your LAN to receive any incoming data e If you only have a single public Internet IP address you MUST use NAT the default setting e If your ISP has provided you with multiple public IP addresses you can use one address as the primary shared address for Internet access by your PCs and you can map incoming traffic on the other public IP addresses to specifi
70. AN port If you cannot establish an Internet connection and the Internet LED blinks continuously you may have to manually select the port speed AutoSense is the default If you know that the Ethernet port on your broadband modem supports 100BaseT select 100BaseT Half_Duplex otherwise select 10BaseT Half_Duplex Use the half duplex settings unless you are sure you need full duplex Connecting the VPN Firewall to the Internet 2 13 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Router s MAC Address Each computer or router on your network has a unique 32 bit local Ethernet address This is also referred to as the computer s MAC Media Access Control address The default is Use Default Address However if your ISP requires MAC authentication then select either Use this Computer s MAC address to enable the VPN firewall to use the MAC address of the computer you are now using or Use This MAC Address to manually type in the MAC address that your ISP expects The format for the MAC address is XX XX XX XX XX XX numbers 0 9 and either uppercase or lowercase letters A F If you select Use This MAC Address and then type in a MAC address your entry will be overwritten Additional WAN Related Configuration e Ifyou want the ability to manage the VPN firewalll remotely enable remote management at this time see Enabling Remote Management Access on page 6 14 If you enable remote manage
71. Authentication on NETGEAR SSL and VPN firewall products The WiKID solution is based on a request response architecture where a one time passcode OTP that is time synchronized with the authentication server is generated and sent to the user after the validity of a user credential has been confirmed by the server B 2 Two Factor Authentication v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual The request response architecture is capable of self service initialization by end users dramatically reducing implementation and maintenance costs Here is an example of how WiKID works 1 The user launches the WiKID token software enter the PIN that has been given to them something they know and then press continue to receive the OTP from the WiKID authentication server File Actions Help Copyright 2001 2007 WIKID Systems Inc O Passcode Request ie Enter your PIN for the Token client test domain PIN Figure B 1 2 A one time passcode something they have is generated for this user File Actions Help Copyright 2001 2007 WiKID Systems Inc GREET WD Token client test Passcode 468713 PassCode expires im 31 Seconds i i W KIDA EE nnn niniy Figure B 2 Two Factor Authentication B 3 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Note The one time passcode is time synchronized to the authenticatio
72. C net DC ES O ESnet OU Certificate Authorities CN ESnet Root Nov 19 18 50 37 2009 Nov 19 18 50 37 2010 o CA1 GMT GMT select al delate Upload CRL CRL File G upload Figure 5 28 The Certificate Revocation Lists CRL table lists your active CAs and their critical release dates e CA Identify The official name of the CA which issued this CRL e Last Update The date when this CRL was released e Next Update The date when the next CRL will be released Click Browse and locate the CRL file you previously downloaded from a CA 3 Click Upload The CRL file will be uploaded and the CA Identity will appear in the Certificate Revocation Lists CRL table If you had a previous CA Identity from the same CA it will be deleted 5 38 Virtual Private Networking v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Configuring Extended Authentication XAUTH When connecting many VPN clients to a VPN gateway router an administrator may want a unique user authentication method beyond relying on a single common preshared key for all clients Although the administrator could configure a unique VPN policy for each user it is more convenient for the VPN gateway router to authenticate users from a stored list of user accounts XAUTH provides the mechanism for requesting individual authentication information from the user and a local User Database or an external authentication server such as
73. Connection Status screen in Figure 5 16 does not correspond to the example configurations that are presented in this chapter You can set a Poll Interval in seconds to check the connection status of all active IKE policies to obtain the latest VPN tunnel activity The Active IPSec SA s table also lists current data for each active IPsec SA security association e Policy Name The name of the VPN policy associated with this SA e Endpoint The IP address on the remote VPN endpoint e Tx KBytes The amount of data transmitted over this SA e Tx Packets The number of packets transmitted over this SA e State The current state of the SA Phase 1 is Authentication phase and Phase 2 is Key Exchange phase e Action Allows you to terminate or build the SA connection if required 5 14 Virtual Private Networking v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual To view VPN firewall VPN logs select Monitoring from the main menu and VPN Logs from the submenu The VPN Logs screen displays Monitoring Router Status Traffic Meter Diagnostics Firewall Logs amp E mail YPN Logs 2010 Mar 26 15 32 21 FVS318q IKE IKE started_ a 2010 Mar 26 15 32 21 FVS318q IKE Adding IKE configuration with identifer toWin7 _ 2010 Mar 26 15 32 21 FVS318q IKE Adding IPSec configuration with identifier toWin _ 2010 Mar 27 02 45 46 FVS318q IKE Invalid exchange type 243 fr
74. E NETGEAR N Network Security Policy J My Connections Connection Security t g modecia test Secure F Only Connect Manually Qs Other Connections CN a on secue 3 C Block Remote Party Identity and Addressing ID Type IP Subnet ad Subnet 192 168 2 1 Mask 255 255 255 0 x Port Ar i Connect using Secure Gateway Tunnel v Protocol Al ID Type Domain Name ind Gateway IP Address v local_id com 172 21 4 1 Figure 5 35 Enter the following information a Give the connection a descriptive name such as modecfg_test this name will only be used internally b From the ID Type pull down menu select IP Subnet c Enter the IP subnet and mask of the VPN firewall this is the LAN network IP address of the gateway d Check the Connect using radio button and select Secure Gateway Tunnel from the pull down menu e From the ID Type pull down menu select Domain name and enter the FQDN of the VPN firewall in this example it is local_id com f Select Gateway IP Address from the second pull down menu and enter the WAN IP address of the VPN firewall in this example it is 172 21 4 1 5 50 v1 1 August 2010 Virtual Private Networking ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual 2 From the left side of the menu click My Identity NI Security Policy Editor NETGEAR ProSafe VPN Client File Edit Options Help a NETGEAR
75. EnterNet or WinPOET on your PC e Quality of Service QoS QoS support for traffic prioritization Easy Installation and Management You can install configure and operate the FVS318G within minutes after connecting it to the network The following features simplify installation and management tasks e Browser Based Management Browser based configuration allows you to easily configure your VPN firewall from almost any type of personal computer such as Windows Macintosh or Linux A user friendly Setup Wizard is provided and online help documentation is built into the browser based Web Management Interface e Auto Detect The VPN firewall automatically senses the type of Internet connection asking you only for the information required for your type of ISP account e VPN Wizard The VPN firewall includes the NETGEAR VPN Wizard to easily configure VPN tunnels according to the recommendations of the Virtual Private Network Consortium VPNC to ensure the VPN tunnels are interoperable with other VPNC compliant VPN routers and clients 1 4 Introduction v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual e SNMP The VPN firewall supports the Simple Network Management Protocol SNMP to let you monitor and manage log resources from an SNMP compliant system manager The SNMP system configuration lets you change the system variables for MIB2 e Diagnostic Functions The VPN firewall incorporates built in diag
76. Firewall Protection and Content Filtering on this page e Using Rules to Block or Allow Specific Kinds of Traffic on page 4 2 e Configuring Other Firewall Features on page 4 19 e Creating Services QoS Profiles and Bandwidth Profiles on page 4 24 e Setting a Schedule to Block or Allow Specific Traffic on page 4 29 e Blocking Internet Sites Content Filtering on page 4 30 e Configuring Source MAC Filtering on page 4 33 e Configuring IP MAC Address Binding on page 4 35 e Configuring Port Triggering on page 4 37 e Configuring UPnP Universal Plug and Play on page 4 40 e Email Notifications of Event Logs and Alerts on page 4 41 e Administrator Tips on page 4 42 About Firewall Protection and Content Filtering The VPN firewall provides you with Web content filtering options plus browsing activity reporting and instant alerts via email Parents and network administrators can establish restricted access policies based on time of day Web addresses and Web address keywords You can also block Internet access by applications and services such as chat or games A firewall is a special category of router that protects one network the trusted network such as your LAN from another the untrusted network such as the Internet while allowing communication between the two You can further segment keyword blocking to certain known groups see Managing Groups and Hosts LAN
77. G Reference Manual Chapter 3 LAN Configuration Choosing the VPN Firewall DHCP Options 00 ecccceecceceeceeeeeaeeeeeeeeeeeaaeseeeeeseaaeeneeeees 3 1 Configuring the LAN Setup OpuOmS ices sasworerieysas acestiatpansremcaacorndtyevcccecgyiectevenarinnmasiass 3 2 Managing Groups and Hosts LAN GroupS scs cccsccses ccc censedeetnte nant eesti iania 3 5 Creating the Network Database siicciicades tisasteeviisehonuceinsiaettianeenciereheciaes 3 6 Viewing the Network Database ssccieissteccessjsaccceesssstcecdesteasccedtssseeeceeth ANNO ARE KARRE KNN ieee 3 7 Adding Devices to the Network Database 00 eccccceeeeesccceeeeeeceeeeeeeeeeeeeeseeeeeneneneees 3 8 Changing Group Names in the LAN Groups Database ccceceeeeeteteeeeeneeees 3 9 Setting Up DHCP Address Reservation 00 cccccceseeseeeseceeesecesesaeeeeeeeeeseaaeeneneeeen 3 9 Configuring Multi Home LAN IP Addresses 00 ceccceeseneceeeeeeeeeeeceeeeeeeeaaeeeceeeeeaeeneaes 3 10 Gonfiguring and Enabling the DMZ PO s ss2cestceeiendieiiiaresiienaieaie 3 11 Configuring Static ROUtCS ccccccseeeeeeee cece eeeeeeeceaeeeeceeeeeeaeeeeaaeeseaaeeeeeeaeseeeeeseaaeeneaes 3 14 State OUTS Example seanssi NE eave tev 3 16 Configuring Routing Information Protocol RIP cccccceeseeeeeeeeeeeeeeeseneeseeeeeeenaeeeeaes 3 17 Chapter 4 Firewall Protection and Content Filtering About Firewall Protection and Content Filtering ccccccceeeeeeeneeeeeeeee
78. Groups on page 3 5 to set up LAN Groups v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual A firewall incorporates the functions of a NAT Network Address Translation router while adding features for dealing with a hacker intrusion or attack and for controlling the types of traffic that can flow between the two networks Unlike simple Internet sharing NAT routers a firewall uses a process called stateful packet inspection to protect your network from attacks and intrusions NAT performs a very limited stateful inspection in that it considers whether the incoming packet is in response to an outgoing request but true Stateful Packet Inspection goes far beyond NAT Using Rules to Block or Allow Specific Kinds of Traffic This section includes the following topics e Services Based Rules on page 4 3 e Viewing Rules and Order of Precedence for Rules on page 4 8 e Configuring LAN WAN Rules on page 4 9 e Configuring DMZ WAN Rules on page 4 12 e Configuring LAN DMZ Rules on page 4 13 e Inbound Rules Examples on page 4 15 e Outbound Rules Example on page 4 19 Firewall rules are used to block or allow specific traffic passing through from one side to the other You can configure up to 600 rules on the VPN firewall Inbound rules WAN to LAN restrict access by outsiders to private resources selectively allowing only specific outside users to access specific r
79. HTTP management The default port number is 8080 Web browser access normally uses the standard HTTP service port 80 For greater security you can change the remote management Web interface to a custom port by entering that number in the box provided Choose a number between 1024 and 65535 but do not use the number of any common service port The default is 8080 which is a common alternate for HTTP To enable remote management over Telnet click Yes to allow Telnet Management and configure the external IP addresses that will be allowed to connect To allow access from any IP address on the Internet select Everyone b To allow access from a range of IP addresses on the Internet select IP address range Enter a beginning and ending IP address to define the allowed range c To allow access from a single IP address on the Internet select Only this PC Enter the IP address that will be allowed access Click Apply to have your changes take effect When accessing your VPN firewall from the Internet the Secure Sockets Layer SSL will be enabled You will enter https and type your VPN firewall s WAN IP address into your browser followed by a colon and the custom port number For example if your WAN IP address is 134 177 0 123 and you use port number 8080 type the following in your browser https 134 177 0 123 8080 The VPN firewall s remote login URL is https IP_address port_number or https Fully QualifiedDomainName po
80. If your external IP address is assigned dynamically by your ISP DHCP enabled the IP address may change periodically as the DHCP lease expires Consider using dynamic DNS so that external users can always find your network see Configuring Dynamic DNS on page 2 11 e If the IP address of the local server PC is assigned by DHCP it may change when the PC is rebooted To avoid this use the Reserved IP address feature to keep the PC s IP address constant see Setting Up DHCP Address Reservation on page 3 9 e Local PCs must access the local server using the PCs local LAN address Attempts by local PCs to access the server using the external WAN IP address will fail Note See Configuring Port Triggering on page 4 37 for yet another way to allow certain types of inbound traffic that would otherwise be blocked by the VPN firewall Firewall Protection and Content Filtering 4 5 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Table 4 2 Inbound Rules Item Description Services Select the desired service or application to be covered by this rule If the desired service or application does not appear in the list you must define it using the Services screen see Adding Customized Services on page 4 24 Action Select the desired action for packets covered by this rule Select Schedule BLOCK always BLOCK by schedule otherwise Allow e ALLOW always e ALL
81. LAN Users Any J Start lS Finish a a ee fe DMZ Users Any J Start Sa rt i Finish SSS Log Figure 4 7 4 Configure the settings based on the descriptions in Table 4 1 on page 4 3 4 14 Firewall Protection and Content Filtering v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual 5 Click Apply The new rule will appear in the Outbound Services table The rule is automatically enabled The procedure to add a new LAN DMZ inbound service policy is similar to the procedure described above with the exception that you click Add under the Inbound Services table you configure the settings based on the descriptions in Table 4 2 on page 4 6 and the policy is added to the Inbound Services table Inbound Rules Examples LAN WAN Inbound Rule Hosting a Local Public Web Server If you host a public Web server on your local network you can define a rule to allow inbound Web HTTP requests from any outside IP address to the IP address of your Web server at any time of day Add LAN WAN Inbound Service Operation succeeded Service HTTP v Action ALLOW always v Select Schedule Schedule 1 Send to LAN Server Single Address Start Boz hss i Jhs Finish Translate to Port Number L WAN Destination IP Address Broadband v Start Finish LAN Users Any Start Finish WAN Users Any Start Finish Bandwidth Profile NONE v Figure 4
82. N firewall will reserve the IP address for the associated MAC address MAC Address Enter the MAC address of the computer s network interface The MAC address format is six colon separated pairs of hexadecimal characters 0 9 and A F such as 01 23 45 67 89 AB Group From the pull down menu select the group to which the computer has to be assigned Group 1 is the default group 2 Click Add to add the new entry to the network database 3 As an optional step To enable DHCP address reservation for the entry that you just added to the Known PCs and Devices table select the checkbox for the table entry and click Save Binding to bind the IP address to the MAC address for DHCP assignment 3 8 LAN Configuration v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Changing Group Names in the LAN Groups Database By default the LAN Groups are named Group through Group8 You can rename these group names to be more descriptive such as Engineering or Marketing To edit the names of any of the eight available groups 1 From the LAN Groups screen click the Edit Group Names option arrow to the right of the tabs The Network Database Group Names screen appears Network Configuration WAN Settings Dynamic DNS LAN Settings DMZ Setup Routing Network Database Group Names O O O 0 O O O O Figure 3 3 Select the radio button next to any group name to make that name active for editi
83. OSC C S S E E Authentication Phase 1 Pre Shered Key z B lt Key Exchange Phase 2 ee D Other Connections Enoypion a kogy Aacettune Encrypt Alg Tiple DES v Hash Alg SHA 1 kd Seconds SALfe Unspecified v KeyGroup Diffie Hellman Group2 v Security Policy Editor NETGEAR ProSafe VPN Client cro File Edit Options Help mxm NETGEAR N Network Security Policy E My Connections r IPSec Protocols ag o Seconds _KBytes G My Identity SA Lite Unspecified _v a Security Policy E E Authentication Phase 1 Compression None z m Proposal 1 3 4 Key Exchange Phase 2 PA Sy Encrypt Ag Triple DES v Qy Other Connections Hash Aig SHA x Encapsulation Tunnel X I Authentication Protocol AH Hash Ala SHA 1 z Encapsulation Tunna gt Figure 5 11 5 10 Virtual Private Networking v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual e In the left frame click Security Policy to view the settings no changes are needed e In the left frame expand Authentication Phase 1 and click Proposal 1 no changes are needed e In the left frame expand Key Exchange Phase 2 and click Proposal 1 No changes are needed 5 In the upper left of the window click the disk icon to save the policy Testing the Connections and Viewing Status Information Both the NETGEAR VPN Client and the VPN firewall provide VPN conne
84. OW by schedule otherwise Block Note Any inbound traffic which is not allowed by rules you create will be blocked by the Default rule Select the desired time schedule that is Schedule1 Schedule2 or Schedule3 that will be used by this rule see Setting a Schedule to Block or Allow Specific Traffic on page 4 29 This pull down menu gets activated only when BLOCK by schedule otherwise Allow or ALLOW by schedule otherwise Block is selected as Action e Use the schedule screen to configure the time schedules Send to LAN This field appears only with NAT routing not classical routing This LAN address or Server range of LAN addresses determines which computer or computers on your network are hosting this service rule You can also translate these addresses to a port number Send to DMZ The DMZ server address determines which computer on your network is hosting this Server service rule You can also translate this address to a port number Translate to Port Number Check the Translate to Port Number and enter a port number if you want to assign the LAN Server to a specific port WAN Destination IP Address This setting determines the destination IP address applicable to incoming traffic This is the public IP address that will map to the internal LAN server it can either be the address of the broadband port another public IP address or an address range LAN Users WAN Users Thes
85. PN tunnels 5 27 Network Access Server See NAS Network Address Translation See NAT Network Database about 3 5 advantages of 3 6 Network Database Group Names screen 3 9 Network Time Protocol See NTP newsgroup 4 31 NTP Servers custom 6 22 default 6 22 setting 6 2 troubleshooting 7 7 O one time passcode See OTP option arrow 2 3 Oray net 2 11 OTP B 1 B 2 Outbound Rules adding 4 10 default definition 4 2 field descriptions 4 3 order of precedence 4 8 service blocking 4 3 P package contents 1 5 passwords and login timeout changing 6 68 passwords restoring 7 7 Perfect Forward Secrecy See PFS performance management 6 1 PFS 5 30 Ping Diagnostics 7 9 On Internet Ports 4 20 troubleshooting TCP IP 7 5 policies IKE exchange mode 5 19 ISAKMP identifier 5 20 ModeConfig 5 19 XAUTH 5 22 port filtering Index 5 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual service blocking 4 3 Port Forwarding Inbound Rules 4 3 4 5 increasing traffic 6 5 rules about 4 5 port numbers 4 24 Port Speed 2 3 Port Triggering about 4 37 adding arule 4 38 increasing traffic 6 6 modifying arule 4 39 tules of use 4 38 status 6 36 Port Triggering screen 4 38 6 36 ports explanation of WAN and LAN 1 6 PPP over Ethernet See PPPoE PPPoE 1 4 2 5 Internet connection 2 7 PPTP 2 5 precedence order of for rules 4 24 pre shared key 5 2 protocol numbers assigned 4 24 protoc
86. Reference Manual Table 6 2 Firewall Log Field Descriptions Field Description Date and Time The date and time the log entry was recorded Description or Action The type of event and what action was taken if any Source IP The IP address of the initiating device for this log entry Source port and The service port number of the initiating device and whether it originated from the interface LAN WAN or DMZ Destination The name or IP address of the destination device or website Destination port and The service port number of the destination device and whether it s on the LAN interface WAN or DMZ Enabling the Traffic Meter If your ISP charges by traffic volume over a given period of time or if you want to study traffic types over a period of time you can activate the traffic meter for the broadband port To monitor traffic limits on the broadband port 1 Select Administration from the main menu and Traffic Meter from the submenu The Broadband Traffic Meter screen displays see Figure 6 12 on page 6 28 2 Enable the traffic meter by clicking the Yes radio button under Do you want to enable Traffic Metering on WAN The traffic meter will record the volume of Internet traffic passing through the broadband port Select from the following options No Limit Any specified restrictions will not be applied when traffic limit is reached Download only The specified restrictions will be applied to the incoming traffic o
87. S request Ensure that NAS identifier is configured identically on both client and server The VPN firewall is acting as a NAS allowing network access to external users after verifying their authentication information In a RADIUS transaction the NAS must provide some NAS Identifier information to the RADIUS server Depending on the configuration of the RADIUS server the VPN firewall s IP address may be sufficient as an identifier or the server may require a name which you would enter here This name would also be configured on the RADIUS server although in some cases it should be left blank on the RADIUS server e Primary Authentications Type From the pull down menu select the authentication type RADIUS PAP RADIUS CHAP WIKID PAP WIKID CHAP MIAS PAP or MIAS PAP For more information see Table 6 1 on page 6 11 e As an option you can enable a backup server by selecting the Enable Backup Server checkbox If enabled specify the following fields Backup Server IP Address The IP address of the RADIUS backup server Secret Phrase Transactions between the client and the RADIUS backup server are authenticated using a shared secret phrase so the same secret phrase must be configured on both client and backup server Backup Server NAS Identifier The identifier for the NAS must be present in a RADIUS request Ensure that NAS identifier is configured identically on both client and backup server In the Authentication Se
88. SP or your network administrator Gateway IP Address Enter the IP address of the ISP s gateway provided by the ISP or your network administrator 2 8 Connecting the VPN Firewall to the Internet v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual 6 Review the Domain Name Server DNS server options help Get Automatically from ISP Use These DNS Servers Primary DNS Server 167 50 40 _ 30_ Secondary DNS Server fo jo jf jfo Figure 2 7 e If your ISP has not assigned any Domain Name Servers DNS addresses click Get Dynamically from ISP e If your ISP or your IT department has assigned DNS addresses click Use These DNS Servers and enter the DNS server IP addresses provided to you in the fields 7 Click Apply to save any changes to the broadband settings Or click Reset to discard any changes and revert to the previous settings 8 Click Test to evaluate your entries The VPN firewall will attempt to connect to the NETGEAR website If a successful connection is made NETGEAR s website appears Configuring the WAN Mode To access the WAN Mode screen select Network Configuration from the main menu and WAN Settings from the submenu The WAN Mode screen displays Network Configuration Dynamic DNS LAN Settings DMZ Setup Routing Broadband ISP Settings BUZWEATT G Use NAT or Classical Routing between WAN amp LAN interfaces NAT Classical Routing Figure 2
89. Your Internet Connection section Made the following changes and addition to Chapter 3 LAN Configuration Updated the LAN Setup screen Figure 3 1 added LDAP information and the Enable ARP Broadcast paragraph to the Configuring the LAN Setup Options section and revised this section for more clarity Updated the LAN Multi homing screen Figure 3 4 and revised the Configuring Multi Home LAN IP Addresses section for more clarity Added the Configuring and Enabling the DMZ Port section Reorganized Chapter 4 Firewall Protection and Content Filtering and added the following sections to this chapter Configuring DMZ WAN Rules Configuring LAN DMZ Rules Managing the Application Level Gateway for SIP Sessions Configuring UPnP Universal Plug and Play Made the following changes to Chapter 5 Virtual Private Networking Revised the Managing VPN Policies section Revised the Managing Certificates section Added the following section to Chapter 6 VPN Firewall and Network Management Monitoring System Performance 202 10521 02 1 1 Aug 2010 Added Multicast pass through to Attack Check screen About This Manual XV v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual xvi v1 1 August 2010 About This Manual Chapter 1 Introduction The ProSafe Gigabit 8 Port VPN Firewal
90. abit 8 Port VPN Firewall FVS318G Reference Manual Attack Checks The Attack Checks screen allows you to specify whether or not the VPN firewall should be protected against common attacks in the DMZ LAN and WAN networks To enable the appropriate attack checks for your environment 1 Select Security from the main menu and Firewall Rules from the submenu The LAN WAN Rules screen displays 2 Click the Attack Checks tab The Attack Checks screen displays LAN WAN Rules DMZ WAN Rules LAN DMZ Rules Piet gata ge Session Limit Advanced WAN Security Checks PN Pass through o Respond to Ping on Internet Ports IPsec Please Specify which IP Address should be allowed m PPTP Any E L2TP IP Address Enable Stealth Mode Multicast Pass through Block TCP flood Enable IGMP N Security Checks O Block UDP flood C Disable Ping Reply on LAN Ports Figure 4 13 3 Check the boxes for the Attack Checks you wish to monitor The various types of attack checks are listed and defined below Click Apply to save your settings The various types of attack checks listed on the Attack Checks screen are e WAN Security Checks Respond To Ping On Internet Ports By default the VPN firewall responds to an ICMP Echo ping packet coming from the Internet or WAN side Responding to a ping can be a useful diagnostic tool when there are connectivity problems If the ping option is enabled you can allow either any IP address or a spe
91. ample if the local subnet is 192 168 1 x then the remote subnet could be 192 168 10 x but could not be 192 168 1 x If this information is incorrect the tunnel will fail to connect Virtual Private Networking 5 3 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual 8 Click Apply to save your settings The VPN Policies screen shows that the policy is now enabled VPN Wizard Certificates Mode Config VPN lient Connection Status IKE Policies KLAEI CI Operation succeeded help Name Type Local Remote Auth Encr Action Gwa to Gw2 Auto Policy 192 168 1 0 255 255 255 0 192 168 2 0 255 255 255 0 SHA 1 3DES Ociit Client Policy select al delete tj enable oO disable add Figure 5 3 9 Ifyou are connecting to another NETGEAR VPN firewall use the VPN Wizard to configure the second VPN firewall to connect to the one you just configured To display the status of your VPN connections select VPN from the main menu and Connection Status from the submenu The Connection Status screen displays Policies VPN Wizard Certificates Mode Config PN Client VPN Connection Status The page will auto refresh in 3 seconds Qhelp Policy Name Endpoint Tx KB Tx Packets State Action GWi to GW2 71 202 246 81 0 00 0 IPsec SA Not Established F connect Client Policy Poll Interval 5___ Seconds zetinterval stop Figure 5 4 The tunnel will automatica
92. andards set by the Voluntary Control Council for Interference by Data Processing Equipment and Electronic Office Machines aimed at preventing radio interference in such residential areas When used near a radio or TV receiver it may become the cause of radio interference Read instructions for correct handling Additional Copyrights AES Copyright c 2001 Dr Brian Gladman brg gladman uk net Worcester UK All rights reserved TERMS Redistribution and use in source and binary forms with or without modification are permitted subject to the following conditions 1 Redistributions of source code must retain the above copyright notice this list of conditions and the following disclaimer 2 Redistributions in binary form must reproduce the above copyright notice this list of conditions and the following disclaimer in the documentation and or other materials provided with the distribution 3 The copyright holder s name must not be used to endorse or promote any products derived from this software without his specific prior written permission This software is provided as is with no express or implied warranties of correctness or fitness for purpose iii v1 1 August 2010 Open SSL MD5 Copyright c 1998 2000 The OpenSSL Project All rights reserved Redistribution and use in source and binary forms with or without modification are permitted provided that the following conditions are met
93. application properly if those PCs are used on the DMZ port A separate firewall security profile is provided for the DMZ port that is hardware independent of the standard firewall security used for the LAN LAN Configuration 3 11 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual The DMZ Setup screen allows you to set up the DMZ port It permits you to enable or disable the hardware DMZ port LAN port 8 see VPN Firewall Front and Rear Panels on page 1 6 and configure an IP address and Mask for the DMZ port To enable and configure the DMZ port 1 From the main menu select Network Configuration and then select DMZ Setup from the submenu The DMZ Setup screen displays 2 Inthe DMZ Port Setup section under Do you want to enable DMZ Port select the Yes radio box 3 Enter an IP address and the subnet mask for the DMZ port Make sure that the DMZ port IP address and LAN Port IP address are in different subnets for example an address outside the LAN Address pool such as 192 168 1 101 Network Configuration DMZ Setup ii DMZ Port Setup 2 IP Address lo p fo 0 Subnet Mask b p o o Do you want to enable DMZ Port O Yes No ii DHCP for DMZ Connected Computers 2 Disable DHCP Server Enable DHCP Server Domain Narne Sa Starting IP Addres if A Ending IP Address a a a T Primary DNS Server Em iis Secondary ONS Server a es WINS Server ES Ey
94. ation Host and Domain Name Configured DDNS Example yourname dy none Change DNS to DynDNS org Yes No User Name admin Password eeeeeseseesccces Use wildcards Update every 30 days Figure 2 9 2 Click the tab of the DNS service you want to enable Each DNS service provider requires registration After registration you can configure the required settings on the corresponding screen for the DNS service 3 Access the website of one of the DNS service providers and set up an account A link to each DNS service provider is located to the right of the tabs see the option arrow After setting up your account return to the screen for the DNS service 4 On the screen for the DNS service select the Yes radio button and complete the required fields for the DNS service that you selected a Inthe Host and Domain Name field enter the entire FQDN name that your DNS service provider gave you for example lt yourname gt dyndns org b Enter the account information for the service you have chosen for example user name password key or domain c Ifyour DNS service provider allows the use of wild cards in resolving your URL you may check the Use wildcards checkbox to activate this feature For example the wildcard feature will cause yourhost dyndns org to be aliased to the same IP address as yourhost dyndns org d If your WAN IP address does not change often you may need to force a periodic update t
95. ation Enter the following settings LDAP Server Specifies the name or the IP address of the device that hosts the LDAP server Search Base Specifies the distinguished name dn at which to start the search specified as a sequence of relative distinguished names rdn connected with commas and without any blank spaces For most users the search base is a variation of the domain name For example if your domain is yourcompany com your search base dn might be as follows dc yourcompany dc com port Specifies the port number that the LDAP server is using Leave this field blank for the default port In the Advanced Settings section configure the following settings Enable DNS Proxy If the DNS proxy is enabled which is the default setting the DHCP server will provide the VPN firewall s LAN IP address as the DNS server for address name resolution If this box is unchecked the DHCP server will provide the ISP s DNS server IP addresses The VPN firewall will still service DNS requests sent to its LAN IP address unless you disable DNS Proxy in the VPN firewall settings see Attack Checks on page 4 20 Enable ARP Broadcast If ARP broadcast is enabled which is the default setting the Address Resolution Protocol ARP is broadcasted on the LAN so that IP addresses can be mapped to physical addresses that is MAC addresses Click Apply to save your settings or click Reset to discard any changes and revert to the previous c
96. b RJ 45 port Default Settings and Technical Specifications A 3 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual A 4 Default Settings and Technical Specifications v1 1 August 2010 Appendix B Two Factor Authentication This appendix provides an overview of Two Factor Authentication and an example of how to implement the WiKID solution This appendix contains the following sections e Why do I need Two Factor Authentication on this page e NETGEAR Two Factor Authentication Solutions on page B 2 Why do I need Two Factor Authentication In today s market online identity theft and online fraud continue to be one of the fast growing cyber crime activities used by many unethical hackers and cyber criminals to steal digital assets for financial gains Many companies and corporations are losing millions of dollars and running into risks of revealing their trade secrets and other proprietary information as the results of these cyber crime activities Security threats and hackers have become more sophisticated and user names encrypted passwords and the presence of firewalls are no longer enough to protect the networks from being compromised IT professionals and security experts have recognized the need to go beyond the traditional authentication process by introducing and requiring additional factors to the authentication process NETGEAR has also recognized the need to provide more than jus
97. be made on other screens Monitoring Traffic Meter Diagnostics Firewall Logs amp E mail VPN Logs Router Status Show Statistics Operation succeeded help halp System Name FYS318G MAC Address 00 24 b2 33 d6 dd Firmware Version 3 0 6 5 IP Address 102 168 1 1 DHCP Enabled IP Subnet Mask 255 255 255 0 WAN Mode Single Port WAN State UP NAT Enabled Connection Type Static IP Connection State Connected IP Address 64 139 54 227 Subnet Mask 255 255 255 248 Gateway 64 139 54 225 Primary ONS 66 80 130 23 Secondary ONS 0 0 0 0 MAC Address 00 24 b2 33 d6 df Figure 6 14 Table 6 3 Router Status Fields Item Description System Name This is the default system name You cannot change this name Firmware Version This is the current software the VPN firewall is using This version will change if you upgrade your VPN firewall 6 30 VPN Firewall and Network Management v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Table 6 3 Router Status Fields continued Item Description LAN Port Displays the current settings for MAC address IP address DHCP status and IP subnet mask that you set in the LAN IP Setup screen DHCP can be either Enabled or Disabled Broadband e WAN Mode Single Port is the only possible option Configuration WAN State UP or DOWN NAT Enabled or Disabled Connection Type Static IP DHCP PPPoE or PPTP Connecti
98. ble periodically but does not accept RIP information from other routers e In Only The VPN firewall accepts RIP information from other routers but does not broadcast its routing table 4 From the RIP Version pull down menu select the version e Disabled The default section disables RIP versions e RIP 1 A class based routing that does not include subnet information This is the most commonly supported version e RIP 2 This includes all the functionality of RIPv1 plus it supports subnet information Though the data is sent in RIP 2 format for both RIP 2B and RIP 2M the modes in which packets are sent are different RIP 2B Sends the routing data in RIP 2 format and uses subnet broadcasting RIP 2M Sends the routing data in RIP 2 format and uses multicasting 5 Authentication for RIP2B 2M required If you selected RIP 2B or RIP 2M check the Yes radio box to enable authentication and enter the MD 5 keys to authenticate between devices in the First Key Parameters and Second Key Parameters sections on the screen 6 Click Reset to discard any changes and revert to the previous settings or click Apply to save your settings 3 18 LAN Configuration v1 1 August 2010 Chapter 4 Firewall Protection and Content Filtering This chapter describes how to use the content filtering features of the ProSafe Gigabit 8 Port VPN Firewall FVS318G to protect your network This chapter includes the following sections e About
99. c PCs on your LAN This one to one inbound mapping is configured using an inbound firewall rule Classical Routing In classical routing mode the VPN firewall performs routing but without NAT To gain Internet access each PC on your LAN must have a valid static Internet IP address If your ISP has allocated a number of static IP addresses to you and you have assigned one of these addresses to each PC you can choose classical routing Or you can use classical routing for routing private IP addresses within a campus environment To learn the status of the WAN port you can view the Router Status screen see Viewing the VPN Firewall Configuration and System Status on page 6 30 or look at the LEDs on the front panel see VPN Firewall Front and Rear Panels on page 1 6 2 10 Connecting the VPN Firewall to the Internet v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Configuring Dynamic DNS Dynamic DNS DDNS is an Internet service that allows routers with varying public IP addresses to be located using Internet domain names To use DDNS you must setup an account with a DDNS provider such as DynDNS org TZO com Oray net or 3322 org Links to DynDNS TZO Oray and 3322 are provided for your convenience on the Dynamic DNS Configuration screen The VPN firewall firmware includes software that notifies dynamic DNS servers of changes in the WAN IP address so that the services running on this netw
100. can assign the VPN firewall an IP address on each additional logical subnet To add a secondary LAN IP address 1 Select Network Configuration from the main menu and LAN Settings from the submenu The LAN Setup screen displays 2 Click the LAN Multi homing tab The LAN Multi homing screen displays Network Configuration WAN Settings Protocol Binding Dynamic DNS DMZ Setup Routing LAN Setup LAN Groups ERR IP Address Subnet Mask select al delete Add Secondary LAN IP Address IP Address Subnet Mask Figure 3 4 The Available Secondary LAN IPs table lists the secondary LAN IP addresses added to the VPN firewall IP Address The IP address alias added to the LAN port of the VPN firewall This is the gateway for computers that need to access the Internet Subnet Mask IPv4 Subnet Mask Action The Edit button allows you to make changes to the selected entry 3 10 LAN Configuration v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual 3 Inthe Add Secondary LAN IP Address section enter the additional IP address and subnet mask to be assigned to the LAN port of the VPN firewall 4 Click Add The secondary LAN IP address will be added to the Available Secondary LAN IPs table To make changes to the Available Secondary LAN IPs table use the following buttons e Select All Selects all the entries in the Available Secondary LAN IPs table e Delete Deletes selected entries
101. cation with the CA and to verify the validity of digital certificates that are signed by the CA e Self digital certificates The digital certificates that are issued to you by a CA to identify your device The Certificates screen contains four tables that are explained in detail in the following sections e Trusted Certificates CA Certificate table Contains the trusted digital certificates that were issued by CAs and that you uploaded see Viewing and Loading CA Certificates on this page e Active Self Certificates table Contains the digital self certificates that were issued by CAs and that you uploaded see Understanding and Viewing Active Self Certificates on page 5 33 e Self Certificate Requests table Contains the self certificate requests that you generated These request may or may not have been submitted to CAs and CAs may or may not have issued digital certificates for these requests Only the digital self certificates in the Active Self Certificates table are active on the VPN firewall see Obtaining a Self Certificate from a Certificate Authority on page 5 35 e Certificate Revocation Lists CRL table Contains the lists with digital certificates that have been revoked and are no longer valid that were issued by CAs and that you uploaded Note however that the table displays only the active CAs and their critical release dates see Managing your Certificate Revocation List CRL on page 5 38 V
102. ce IP Address Lists the IP address of the UPnP device accessing the VPN firewall To refresh the contents of the UPnP Portmap Table click refresh Email Notifications of Event Logs and Alerts The firewall logs can be configured to log and then email denial of access general attack information and other information to a specified email address For example your VPN firewall will log security related events such as accepted and dropped packets on different segments of your LAN denied incoming and outgoing service requests hacker probes and login attempts and other general information based on the settings that you enter on the Firewall Logs amp E mail screen In addition if you have set up content filtering on the Block Sites screen see Blocking Internet Sites Content Filtering on page 4 30 a log will be generated when someone on your network tries to access a blocked site To configure email or syslog notification or to view the logs see Activating Notification of Events and Alerts on page 6 23 Firewall Protection and Content Filtering 4 41 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Administrator Tips Consider the following operational items e Asan option you can enable remote management if you have to manage distant sites from a central location see Configuring an External Server for Authentication on page 6 11 e Although rules see Using Rules
103. ce to reset all settings to their factory defaults This is called a hard reset e To perform a hard reset push and hold the reset button for approximately 5 seconds until the TEST LED blinks rapidly Your device will return to the factory configuration settings shown in Table A 1 below e Pressing the reset button for a shorter period of time will simply cause your device to reboot Table A 1 VPN firewall Default Configuration Settings Feature Default Behavior Router Login User Login URL http 192 168 1 1 User Name case sensitive admin Login Password case sensitive password Internet Connection WAN MAC Address Use Default address WAN MTU Size 1500 Port Speed AutoSense Local Network LAN LAN IP 192 168 1 1 Subnet Mask 255 255 255 0 RIP Direction None RIP Version Disabled RIP Authentication Disabled DHCP Server Enabled DHCP Starting IP Address 192 168 1 2 DHCP Ending IP Address 192 168 1 100 DMZ Disabled Default Settings and Technical Specifications v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Table A 1 VPN firewall Default Configuration Settings continued Feature Default Behavior Management Time Zone GMT Time Zone Adjusted for Daylight Saving Disabled Time SNMP Disabled Remote Management Disabled Firewall Inbound communications coming in from Disabled except traffic on port 80
104. cific IP address only to respond to a ping You can disable the ping option to prevent hackers from easily discovering the VPN firewall via a ping Enable Stealth Mode In stealth mode the VPN firewall will not respond to port scans from the WAN or Internet which makes it less susceptible to discovery and attacks 4 20 Firewall Protection and Content Filtering v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Block TCP Flood A SYN flood is a form of denial of service attack in which an attacker sends a succession of SYN requests to a target system When the system responds the attacker does not complete the connection thus saturating the server with half open connections No legitimate connections can then be made When blocking is enabled the VPN firewall will limit the lifetime of partial connections and will be protected from a SYN flood attack e LAN Security Checks Block UDP flood A UDP flood is a form of denial of service attack in which the attacking machine sends a large number of UDP packets to random ports to the victim host As a result the victim host will check for the application listening at that port see that no application is listening at that port and reply with an ICMP Destination Unreachable packet When the victimized system is flooded it is forced to send many ICMP packets eventually making it unreachable by other clients The attacker may also spoof the IP add
105. clicking send log Click refresh log to retrieve the latest update Click clear log to delete all entries Log entries are described in Table 6 2 Monitoring Router Status Traffic Meter Diagnostics Firewall Logs amp E mail VPN Logs Last output repeated twice 2010 Mar 26 15 31 20 FVS318g vand IPSEC IPSEC Restarted 2010 Mar 26 15 31 53 FVS318g wand Fy Firewall Restarted 2010 Mar 26 15 32 21 FV 318g wand IPSEC IPSEC Restarted 2010 Mar 26 15 35 03 FVS318g kernel WAN2LAN ACCEPT IN WAN OUT LAN SRC 20 2010 Mar 26 15 35 14 FvS318q kernel WANZLAN ACCEPT IN WAN OUT LAN SRC 20 2010 Mar 26 15 50 32 FVS318g kernel WANZLAN ACCEPT IN WAN OUT LAN SRC 20 2010 Mar 26 15 53 51 FVS318g kernel WAN2LAN ACCEPT IN WAN OUT LAN SRC 20 2010 Mar 26 16 11 58 FVS318g kernel WAN2LAN ACCEPT IN WAN OUT LAN SRC 20 Last output repeated 2 times 2010 Mar 26 16 12 22 FV 318g kernel WAN2LAN ACCEPT IN WAN OUT LAN SRC 20 2010 Mar 26 16 12 23 FV 318g kernel WANZLAN ACCEPT IN WAN OUT LAN SRO 20 2010 Mar 26 16 12 28 FVS318g kernel WAN2LAN ACCEPT IN WAN OUT LAN SRC 20 2010 Mar 26 16 12 29 FVS318g kernel WANZLAN ACCEPT IN WAN OUT LAN SRC 20 2010 Mar 26 16 12 30 FVS318g kernel WAN2LAN ACCEPT IN WAN OUT LAN SRC 20 lt gt refresh toa clear log E send toa Figure 6 11 6 26 VPN Firewall and Network Management v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G
106. ct all sae enadie oO dean m Always V 1 Select Any and Allow Always or Allow by Schedule 2 Place rule below all other inbound rules Figure 4 11 4 18 Firewall Protection and Content Filtering v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Outbound Rules Example Outbound rules let you prevent users from using applications such as Instant Messenger Real Audio or other non essential sites LAN WAN Outbound Rule Blocking Instant Messenger If you want to block Instant Messenger usage by employees during working hours you can create an outbound rule to block that application from any internal IP address to any external address according to the schedule that you have created in the Schedule menu Add LAN WAN Outbound Service Operation succeeded Service AIM v Action BLOCK by schedule otherwise allow v Select Schedule Schedule 1 v LAN Users Any v Start Finish l f i el CH WAN Users Any Start H A Finish _ QoS Priority Normal Service 1 Bandwidth Profile NONE Figure 4 12 You can also have the VPN firewall log any attempt to use Instant Messenger during that blocked period Configuring Other Firewall Features You can configure attack checks set session limits and manage the Application Level Gateway ALG for SIP sessions Firewall Protection and Content Filtering 4 19 v1 1 August 2010 ProSafe Gig
107. ction and status information This information is useful for verifying the status of a connection and troubleshooting problems with a connection NETGEAR VPN Client Status and Log Information To test a client connection and view the status and log information follow these steps 1 To test the client connection from your PC right click on the VPN client icon in your Windows toolbar and choose Connect then My Connections gw1 Security Policy Editor Certificate Manager Deactivate Security Policy Reload Security Policy My Connections gw1 Log Viewer Connection Monitor Help About NETGEAR ProSafe VPN Client Remove Icon aa B PTO 3 01PM Figure 5 12 Virtual Private Networking 5 11 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Within 30 seconds you should receive the message Successfully connected to My Connections gw1 N Manual Connection Status Successfully connected to My Connections gw1 Figure 5 13 SS Wal 12 32pm To view more detailed additional status and troubleshooting information from the NETGEAR VPN client follow these steps e Right click the VPN Client icon in the system tray and select Log Viewer The VPN client icon in the system tray should state On N Log Viewer NETGEAR ProSafe VPN Client Clear Freeze Save Log Print 21 12 22 28 126 Filter table loaded 1 entries 21 12 24 52 168 This is a GA versi
108. d Firewall Rules from the submenu The LAN WAN Rules screen displays 2 Click the Advanced tab The Advanced screen displays Security Services Schedule Block Sites Address Filter Port Triggering UPnP Bandwidth Profile LAN WAN Rules DMZ WAN Rules LAN DMZ Rules Attack Checks Session Limit BU CEUTCT Enable SIP ALG O Figure 4 15 3 Select the Enable SIP ALG checkbox 4 Click Apply to save your settings Firewall Protection and Content Filtering 4 23 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Creating Services QoS Profiles and Bandwidth Profiles When you create inbound and outbound firewall rules you use firewall objects such as services QoS profiles bandwidth profiles and schedules to narrow down the firewall rules e Services A service narrows down the firewall rule to an application and a port number For information about adding services see Adding Customized Services on page 4 24 e QoS profiles A quality of service QoS profile defines the relative priority of an IP packet for traffic that matches the firewall rule For information about creating QoS profiles see Specifying Quality of Service QoS Priorities on page 4 26 e Bandwidth Profiles A bandwidth profile allocates and limits traffic bandwidth for the LAN users to which a firewall rule is applied For information about creating bandwidth profiles see Creating Bandwidth Profiles on page 4 27
109. d Packets Displays the logging option for this rule 4 36 Firewall Protection and Content Filtering v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual To edit an IP MAC binding rule click Edit adjacent to the entry The following fields of an existing IP MAC binding rule can be modified e MAC Address Specify the MAC Address for this rule e IP Addresses Specify the IP Address for this rule e Log Dropped Packets Specify the logging option for this rule To remove an entry from the table select the IP MAC binding entry and click Delete To see the counter that shows the packets that were dropped because of IP MAC binding violations and to set the poll interval click the Set Poll Interval option arrow at the top of the IP MAC Binding screen Configuring Port Triggering Port triggering allows some applications to function correctly that would otherwise be partially blocked by the VPN firewall when it functions in NAT mode Some applications require that when external devices connect to them they receive data on a specific port or range of ports The VPN firewall must send all incoming data for that application only on the required port or range of ports Using this feature requires that you know the port numbers used by the application Port triggering allows computers on the private network LAN to request that one or more ports be forwarded to them Unlike basic port forwarding which forwards po
110. d to enter either IP address or MAC addresses Instead you can just select the desired PC or device No need to reserve an IP address for a PC in the DHCP Server All IP address assignments made by the DHCP Server will be maintained until the PC or device is removed from the database either by expiry inactive for a long time or by you No need to use a fixed IP address on PCs Because the address allocated by the DHCP Server will never change you do not need to assign a fixed IP address to a PC to ensure it always has the same IP address MAC level control over PCs The Network Database uses the MAC address to identify each PC or device So changing a PC s IP address does not affect any restrictions on that PC Group and individual control over PCs You can assign PCs to groups and apply restrictions to each group using the Firewall Rules screen see Using Rules to Block or Allow Specific Kinds of Traffic on page 4 2 You can also select the groups to be covered by the Block Sites feature see Blocking Internet Sites Content Filtering on page 4 30 Ifnecessary you can also create firewall rules to apply to a single PC see Configuring Source MAC Filtering on page 4 33 Because the MAC address is used to identify each PC users cannot avoid these restrictions by changing their IP address A computer is identified by its MAC address not its IP address Hence changing a computer s IP address does
111. der of the policies is important However if you have only one policy for each remote VPN endpoint then the policy order is not important 3 The VPN tunnel is created according to the settings in the SA Security Association 4 The remote VPN endpoint must have a matching SA or it will refuse the connection To access the VPN Policies screen 1 Select VPN from the main menu and Policies from the submenu The Policies submenu tabs appear with the IKE Policies screen in view see Figure 5 18 on page 5 16 Virtual Private Networking 5 23 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual 2 Click the VPN Policies tab The VPN Policies screen is displayed VPN Wizard Certificates Mode Config VPN Client Connection Status IKE Policies RADEI Operation succeeded help Name Type Local Remote Auth Encr Action O Gwato aw2 Auto Policy 192 168 1 0 255 255 255 0 192 168 2 0 255 255 255 0 SHA 1 3DES Besit O Client to aw Auto Policy 192 168 1 0 255 255 255 0 Any SHA 1 3DES Oeiit Client Policy select all delete e O disable add Figure 5 20 Only one client policy may configured at a time noted by an next to the policy name The List of VPN Policies contains the following fields e Status Indicates whether the policy is enabled green circle or disabled grey circle To enable or disable a policy check the radio box adjacent to the circl
112. ding to the instructions below Under Connection Security verify that the Secure radio button is selected From the ID Type pull down menu choose IP Subnet Enter the LAN IP Subnet Address and Subnet Mask of the VPN firewall LAN in this example we are using 192 168 2 0 Check the Use checkbox and choose Secure Gateway Tunnel from the pull down menu From the first ID Type pull down menus choose Domain Name Enter the FQDN address which the VPN firewall VPN Wizard provided in this example we are using gw1_local com From the second ID Type pull down menu choose Gateway IP Address and enter the WAN IP Gateway address of the VPN firewall in this example we are using 21 208 216 81 5 8 Virtual Private Networking v1 1 August 2010 3 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual In the left frame click My Identity Fill in the options according to the instructions below IN Security Policy Editor NETGEAR ProSafe VPN Client File Edit Options Help Network Security Policy My Connections og owl My Identity Ej 8 Security Policy Fp Other Connections Enter Key Enter Pre Shared Key at least 8 characters This key is used during Authentication Phase if the Authentication Method Proposal is Pre Shared key r3m0 eClient ID Type Port Domain Name x Jan zl GW1_remote com Secure Interface Configuration
113. dn might be as follows dc yourcompany dc com port Specifies the port number that the LDAP server is using Leave this field blank for the default port e DHCP Relay Select this radio button to use the VPN firewall as a DHCP relay agent for a DHCP server somewhere else on your network In the Relay Gateway field enter the IP address of the DHCP server for which the VPN firewall serves as a relay 5 Inthe DNS Proxy section select the Enable DNS Proxy checkbox to enable the DHCP server to provide the VPN firewall s LAN IP address for DNS address name resolution If this checkbox is deselected the DHCP server will provide the ISP s DNS server IP addresses but the VPN firewall will still service DNS requests that are sent to its LAN IP address 6 Click Apply to save your settings or click Reset to discard any changes and revert to the previous configuration When you enable the DMZ server the DMZ LED next to LAN port 8 see VPN Firewall Front and Rear Panels on page 1 6 will light up indicating that the DMZ port has been enabled To define the DMZ WAN Rules and LAN DMZ Rules see Configuring DMZ WAN Rules on page 4 12 and Configuring LAN DMZ Rules on page 4 13 respectively Configuring Static Routes Static routes provide additional routing information to your VPN firewall Under normal circumstances the VPN firewall has adequate routing information after it has been configured for Internet access and y
114. dwidth limiting is to provide a solution for limiting the outgoing or incoming traffic thus preventing the LAN users for consuming all the bandwidth of your Internet connection For more information see See Creating Bandwidth Profiles on page 4 27 Note Bandwidth limiting does not apply to the DMZ interface The settings that specify whether the source address of the outgoing packets on the WAN should be assigned the address of the WAN interface or the address of a different interface The options are e WAN Interface Address All the outgoing packets on the WAN are to the address of the assigned WAN interface Single Address All the outgoing packets on the WAN are assigned the specified IP address for example a secondary WAN address that you have configured Inbound Rules Port Forwarding Because the VPN firewall uses Network Address Translation NAT your network presents only one IP address to the Internet and outside users cannot directly address any of your local computers However by defining an inbound rule you can make a local server for example a Web server or game server visible and available to the Internet The rule tells the VPN firewall to direct inbound traffic for a particular service to one local server based on the destination port number This is also known as port forwarding Whether or not DHCP is enabled how the PCs will access the server s LAN address impacts the inbound rules For example e
115. e The configuration settings of the VPN firewall are stored within the VPN firewall in a configuration file This file can be saved backed up to a user s PC retrieved restored from the user s PC or cleared to factory default settings Once you have installed the VPN firewall and have it working properly you should back up a copy of your settings to a file on your computer If necessary you can later restore the VPN firewall settings from this file The Settings Backup and Firmware Upgrade screen allows you to e Back up and save a copy of your current settings e Restore saved settings from the backed up file e Revert to the factory default settings e Upgrade the VPN firewall firmware from a saved file on your hard disk to use a different firmware version 6 18 VPN Firewall and Network Management v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Backing Up Settings To back up settings 1 Select Administration from the main menu and Settings Backup amp Upgrade from the submenu The Settings Backup and Firmware Upgrade screen displays Administration Settings Backup and Firmware Upgrade Save a copy of current settings taup Restore saved settings from file GF restore Revert to factory default settings default J Locate and select the upgrade file from your hard disk Ga voona Figure 6 8 2 Click backup to save a copy of your current settings
116. e Never Hourly Daily or Weekly Then set the Day and Time fields that correspond to your selection 9 In the Enable SysLogs section you can configure the VPN firewall to send system logs to an external PC that is running a syslog logging program Click the Yes radio box to enable SysLogs and send messages to the syslog server then Enter your SysLog Server IP address b Select the appropriate syslog severity from the SysLog Severity pull down menu The SysLog levels of severity are as follows e LOG_EMERG System is unusable e LOG_ALERT Action must be taken immediately e LOG_CRITICAL Critical conditions VPN Firewall and Network Management 6 25 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual e LOG_ERROR Error conditions e LOG_WARNING Warning conditions e LOG_NOTICE Normal but significant conditions e LOG_INFO Informational messages e LOG_DEBUG Debug level messages 10 Click Reset to cancel your changes and return to the previous settings or click Apply to save your settings Viewing the Logs To view the logs 1 Select Monitoring from the main menu and then Firewall Logs amp E mail from the submenu The Firewall Logs amp E mail screen displays 2 Click the View Log option arrow in the upper right hand section of the screen The Logs screen displays If the email logs option has been enabled on the Firewall Logs amp E mail screen you can send a copy of the log by
117. e 4 18 2 Click Add to add a new bandwidth profile The Add New Bandwidth Profile screen displays Add Bandwidth Profile i Bandwidth Profile Ol Profile name Direction Outbound Minimum Bandwidth b Jo Max Outbound Bandwidth Kbps Outbound Maximum Bandwidth fico i 100000 Kbps Inbound Minimum Bandwidth eo Jo Max Inbound Bandwidth Kbps Inbound Maximum Bandwidth 100____ 100 100000 Kbps Type Figure 4 19 3 Enter the following information a Enter a Profile Name This name will become available in the firewall rules definition menus b From the Direction pull down menu select whether the profile will apply to outbound inbound or both outbound and inbound traffic 4 28 Firewall Protection and Content Filtering v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual c Depending on the direction that you selected enter the minimum and maximum bandwidths to be allowed e Enter the Outbound Minimum Bandwidth and Outbound Maximum Bandwidth in Kbps Enter the Inbound Minimum Bandwidth and Inbound Maximum Bandwidth in Kbps The minimum bandwidth can range from 0 Kbps to the maximum bandwidth that you specify The maximum bandwidth can range from 100 Kbps to 100 000 Kbps d From the Type pull down menu select whether the profile will apply to a group or individual 4 Click Apply The new bandwidth profile will be added to the List of Bandwidth Profiles table
118. e 5 55 Using the VPN Wizard for Client and Gateway Configurations You use the VPN Wizard to configure multiple gateway or client VPN tunnel policies The section below provides wizard and NETGEAR VPN Client configuration procedures for the following scenarios e Using the wizard to configure a VPN tunnel between two VPN gateways e Using the wizard to configure a VPN tunnel between a VPN gateway and a VPN client Configuring a VPN tunnel connection requires that all settings on both sides of the VPN tunnel match or mirror each other precisely which can be a daunting task The VPN Wizard efficiently guides you through the setup procedure with a series of questions that will determine the Psec keys and VPN policies it sets up The VPN Wizard will also set the settings for the network connection Security Association traffic selectors authentication algorithm and encryption The settings used by the VPN wizard are based on the recommendations of the VPN Consortium VPNC an organization that promotes multi vendor VPN interoperability 5 1 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Creating Gateway to Gateway VPN Tunnels with the Wizard Gateway to Gateway Example Gateway A wares Gateway B ue Beaee FQDN VPN Router VPN Router at office A at office B Fully Qualified Domain Names FQDN optional for Fixed IP addresses required for Dynamic IP addresses Figure 5 1 Follow these
119. e Config Screen To configure the Mode Config screen 1 Select VPN from the main menu and Mode Config from the submenu The Mode Config screen displays i VPN i l i I Policies VPN Wizard Certificates VPN Client Connection Status Mode Config Operation succeeded help Record Name Pool Start IP Pool End IP Action 172 20 0 1 172 20 0 99 o Sales 0 0 0 0 0 0 0 0 eiit 0 0 0 0 0 0 0 0 lt select all edelete add Figure 5 32 2 Click Add The Add Mode Config Record screen displays see Figure 5 33 on page 5 46 Virtual Private Networking 5 45 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Add Mode Config Record i Client Pool Record Name i d First Pool Starting IP CH a a Ending IP CHO J Second Pool Starting IP fo ib lp e Ending IP fo ib lp e Third Pool StartingiP o_o Mo o endingipfo_ Jo Mo e WINS Server Primary e_o Jo o Secondary fo Jo o DNS Server Primary fo jo Jo o Secondary fo jo fo J i Traffic Tunnel Security Level Miprs Key Group LOH Group 2 1024 bit SA Lifetime Encryption Algorithm L3DES_ Y Integrity Algorithm Local IP Address fo fo fo fo Local Subnet Mask fo Ibe p fo Figure 5 33 3 Enter a descriptive Record Name such as Sales Assign at least one range of IP pool addresses in the First IP Pool field to give to remote VPN clients ES Note The IP pool should not be wit
120. e Firewall Blocks unwanted traffic from the Internet to your LAN e Block Sites Blocks access from your LAN to Internet locations or services that you specify as off limits e Logs security incidents The FVS318G will log security events such as blocked incoming traffic port scans attacks and administrator logins You can configure the VPN firewall to email the log to you at specified intervals You can also configure the VPN firewall to send immediate alert messages to your email address or email pager whenever a significant event occurs 1 2 Introduction v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual e Keyword Filtering With its URL keyword filtering feature the FVS318G prevents objectionable content from reaching your PCs The VPN firewall allows you to control access to Internet content by screening for keywords within Web addresses You can configure the VPN firewall to log and report attempts to access objectionable Internet sites Security Features The FVS318G is equipped with several features designed to maintain security as described in this section e PCs Hidden by NAT NAT opens a temporary path to the Internet for requests originating from the local network Requests originating from outside the LAN are discarded preventing users outside the LAN from finding and directly accessing the PCs on the LAN e Port Forwarding with NAT Although NAT prevents Internet locations from directl
121. e Gigabit 8 Port VPN Firewall FVS318G Reference Manual Table 5 2 Add IKE Policy Settings continued Item Extended Authentication Description or Subfield and Description XAUTH Configuration Note For more information about XAUTH and its authentication modes see Configuring XAUTH for VPN Clients on page 5 39 Select one of the following radio buttons to specify whether or not Extended Authentication XAUTH is enabled and if enabled which device is used to verify user account information e None XAUTH is disabled This the default setting Edge Device The VPN firewall functions as a VPN concentrator on which one or more gateway tunnels terminate The authentication mode that is available for this configuration is User Database RADIUS PAP or RADIUS CHAP IPSec Host The VPN firewall functions as a VPN client of the remote gateway In this configuration the VPN firewall is authenticated by a remote gateway with a user name and password combination For an Edge Device configuration from the pull down menu select one of the following authentication types User Database XAUTH occurs through the VPN firewall s user database Users must be added through the Add User screen see Configuring the User Database for XAUTH on page 5 41 Radius PAP XAUTH occurs through RADIUS Password Authentication Protocol PAP The local user database is first checked If the user account is not pre
122. e Timeout Select Keep Connected to keep the connection always on To logout after the connection is idle for a period of time click Idle Time and in the timeout field enter the number of minutes to wait before disconnecting Connection Reset Select this checkbox to to specify a time when the PPPoE WAN connection is reset that is the connection is disconnected momentarily and then re established Enter the hour and minutes in the Disconnect Time fields to specify when the connection should be disconnected Enter the seconds in the Delay field to specify the period after which the connection should be re established e PPTP Select this option if your ISP is Austria Telecom or any other ISP that uses PPTP as a login protocol Configure the following fields Account Name Also known as Host Name or System Name Enter the valid account name for the PPTP connection usually your email name as assigned by your ISP Some ISPs require entering your full email address here Domain Name Your domain name or workgroup name assigned by your ISP or your ISPs domain name You may leave this field blank Connecting the VPN Firewall to the Internet 2 7 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Idle Timeout Check the Keep Connected radio box to keep the connection always on To logout after the connection is idle for a period of time click Idle Time and enter the number of minutes to wait be
123. e and click Enable or Disable as required e Name Each policy is given a unique name the Connection Name when using the VPN Wizard e Type The type is Auto or Manual as described previously Auto is used during VPN Wizard configuration e Local IP address either a single address range of address or subnet address on your local LAN Traffic must be from or to these addresses to be covered by this policy The subnet address is supplied as the default IP address when using the VPN Wizard e Remote IP address or address range of the remote network Traffic must be to or from these addresses to be covered by this policy The VPN Wizard default requires the remote LAN IP address and subnet mask e AH Authentication Header The default setting using the VPN Wizard is SHA1 This setting must match the remote VPN e ESP Encapsulating Security Payload The default setting using the VPN Wizard is 3DES This setting must match the remote VPN e Action Allows you to access individual policies to make any changes or modifications 5 24 Virtual Private Networking v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual To delete one or more VPN polices 1 Select the checkbox to the left of the policy that you want to delete or click the select all table button to select all VPN policies 2 Click the delete table button To enable or disable one ore more VPN policies 1 Select
124. e obtained and duration of lease DHCP Relay options allow you to make the VPN firewall a DHCP relay agent The DHCP Relay Agent makes it possible for DHCP broadcast messages to be sent over routers that do not support forwarding of these types of messages The DHCP Relay Agent is therefore the routing protocol that enables DHCP clients to obtain IP addresses from a DHCP server on a remote subnet or which is not located on the local subnet If you have no configured DHCP Relay Agent your clients would only be able to obtain IP addresses from the DHCP server which is on the same subnet To enable clients to obtain IP addresses from a DHCP server on a remote subnet you have to configure the DHCP Relay Agent on the subnet that contains the remote clients so that it can relay DHCP broadcast messages to your DHCP server When the DNS Proxy option is enabled the VPN firewall will act as a proxy for all DNS requests and communicates with the ISP s DNS servers as configured on the Broadband ISP Settings screen All DHCP clients will receive the primary and or secondary DNS IP address along with the IP address where the DNS proxy is running that is the VPN firewall s LAN IP address When disabled all DHCP clients will receive the DNS IP addresses of the ISP excluding the DNS proxy IP address Configuring the LAN Setup Options The LAN Setup screen allows configuration of LAN IP services such as DHCP and allows you to configure a secondary or
125. e settings determine which computers on your network are affected by this rule Select the desired options e Any All PCs and devices on your LAN e Single address Enter the required address and the rule will be applied to that particular PC Address range If this option is selected you must enter the start and finish fields e Groups Select the Group to which this rule will apply Use the LAN Groups screen under Network Configuration to assign PCs to Groups See Managing Groups and Hosts LAN Groups on page 3 5 These settings determine which Internet locations are covered by the rule based on their IP addresses Select the desired option Any All Internet IP address are covered by this rule Single address Enter the required address in the start field Address range If this option is selected you must enter the start and end fields 4 6 Firewall Protection and Content Filtering v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Table 4 2 Inbound Rules continued Item Description Log This determines whether packets covered by this rule are logged Select the desired action e Always Always log traffic considered by this rule whether it matches or not This is useful when debugging your rules e Never Never log traffic considered by this rule whether it matches or not Bandwidth Bandwidth Limiting determines the way in which the data is sent to or from your ho
126. ed to the remote VPN endpoint 4 Enter a Pre shared Key The key must be entered both here and on the remote VPN gateway or the remote VPN client This key must be a minimum of 8 characters and should not exceed 49 characters Choose which WAN port to use as the VPN tunnel end point 6 Enter the Remote and Local WAN IP Addresses or Internet Names of the gateways which will connect e Both the remote WAN address and your local WAN address are required Q Tip To assure tunnels stay active after completing the wizard manually edit the VPN policy to enable keepalive which periodically sends ping packets to the host on the peer side of the network to keep the tunnel alive TTAN e The remote WAN IP address must be a public address or the Internet name of the remote gateway The Internet name is the Fully Qualified Domain Name FQDN as registered in a Dynamic DNS service Both local and remote endpoints should be defined as either FQDN or IP addresses A combination of IP address and FQDN is not allowed Tip For DHCP WAN configurations first set up the tunnel with IP addresses Once you validate the connection use the wizard to create new policies using FQDN for the WAN addresses Aule y 7 Enter the local LAN IP and Subnet Mask of the remote gateway in the Remote LAN IP Address and Subnet Mask fields Note The Remote LAN IP address must be in a different subnet than the Local LAN IP address For ex
127. eeeeeeeeeeeeeeaaeeeeaes 4 1 Using Rules to Block or Allow Specific Kinds of Traffic cceeeesceeeeeeeeeeeeeseceeeeeneeeee 4 2 DEIVICES BaSOd RUGS sminuire aa aaa 4 3 Viewing Rules and Order of Precedence for Rules sessssessesreerierrerirsrrerreerrrrene 4 8 Contiguring LAN WAN RUES siraga Ea 4 9 Gontiguring DMZ WAN RUGS ssseciccicsssterccsysneccettarincecxdias p noraa nesaat 4 12 Contiguning LAN DMA RUES aisian E O 4 13 Inbo nd Rules Examples smaranremini aa a EE E 4 15 Outbound Rules Example 0 cc ccccccceeeesececeeeeeeeaeee cece eeeaaeeseeeeeeaaaeseeeeeessaaeseeneees 4 19 Gontiguring Other Firewall Features insonu i 4 19 PACK GMGCKS cereias ne EENE EEEE ERER 4 20 Sening Session LINIS srias E ated E Oa 4 22 Managing the Application Level Gateway for SIP Sessions cceeeesteeeeeettees 4 23 Creating Services QoS Profiles and Bandwidth Profiles ccccccesceeeeeessteeeeeeeneaes 4 24 Adding CUSTOMIZED SEMICES x4 sszstes Sessscesksastenesnndvtaaseenctepeadns aatensenteiandenvantanedsness 4 24 Specifying Quality of Service QOS Priorities sarsies 4 26 Creating Bandwidth Pro MES siioni o hia os Peta ae quan nlesosst eet anal 4 27 Setting a Schedule to Block or Allow Specific Traffic ccecesceeeeeeeeeeeeeeseeeeeeeeeseaes 4 29 viii Contents v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Blocking Internet Sites Content Filtering cccceeeeeeeeeeeeeeeeeeeeecea
128. eeeeeeeeeeeeeeeeeaaeeneaes 4 30 Contiguring Source MAG FENNO cscs shane eerie wee aes 4 33 Contiguring IP AMAC Address Binding scassicitcarscctistinscattoduecie enn i 4 35 Configuning Port THJJErNO satoon nroa sa a aaaea 4 37 Configuring UPnP Universal Plug and Play ccccccceceeeeeeeeeeeeeeeeeeeeeseeeeeessaeeneees 4 40 Email Notifications of Event Logs and AIGHS isisicssssriishscrttie naa Neiiveartiiuean Raced 4 41 AGMINMISWALON e E E A E E A A A E E 4 42 Chapter 5 Virtual Private Networking Using the VPN Wizard for Client and Gateway Configurations seeeeeeeeeee ee 5 1 Creating Gateway to Gateway VPN Tunnels with the Wizard 0ccccsseeeeeenees 5 2 Creating a Client to Gateway VPN TUNMel eeeeeseeeeeeeeeeeeeeseeeeaeesenereeeeeenereneeeees 5 5 Testing the Connections and Viewing Status Information ccceeeeeseeseeeeeeeteeeee 5 11 NETGEAR VPN Client Status and Log Information cerisenicainen nsan 5 11 VPN Firewall VPN Connection Status and LOGS ccccceeeeeeeeeeceteeeeesstaeeeeneees 5 14 Managing VPN POICIOS ssicu 5 s taiacesichineas E 5 15 Gontgurmg IKE POlGCICS nensi a E ieee 5 15 Configuring VPN Policies soinnissa nina i aiian 5 23 Managing COnminCales iscsia cacsatscerasstncceinadandaare saccaganniaceans E nest 5 30 Understanding the Certificates Screen eecceeceeeeeseeeeeeeeeeeeeeeceaeeseeneeeteeeeeeaeeee 5 32 Viewing and Loading CA Certificates 20 0 eeeccccseeeneeeeecee
129. eeeseeeceeaeeeeaaeeeeeaeeteaaeeneaes 5 32 Understanding and Viewing Active Self Certificates 0 00 2 ceceeeeeeeeeeeeeeeteeeeneees 5 33 Obtaining a Self Certificate from a Certificate Authority c ccecseeeeeeeeeeeeeeneees 5 35 Managing your Certificate Revocation List CRL eee eeeeeeeeeeeeereeeeeeteneee 5 38 Configuring Extended Authentication XAUTH sssr irrena 5 39 Contiguring XAUTH for VPN CIEMS yess ds atone t a 5 39 Configuring the User Database for XAUT scasscssscisceuseiciavcstiieaccinntiermanicatennte 5 41 Configuring RADIUS Glients for XAUTH sesssccccetsscssreceeseececctetetsereredtisateageansiieeeaties 5 42 Assigning IP Addresses to Remote Users ModeConfig cccccccceeeeeeeeeteeeeeeeneeeee 5 44 Mode Config Operation sssrinin E aes aes 5 44 Configuring Mode Config Operation on the VPN Firewall sses 5 45 Configuring the ProSafe VPN Client for Mode Config cccccceceeeceeeeeetteeeeeneees 5 50 Configuring Keepalives and Dead Peer Detection ccecceescesecceeceeceeeeeeeeeeneeeenenes 5 53 Configuring Keepalives ccceceeescecceneeeeeneeeceeeeeeaeeeeeeeeseeaaeseeaeeeesaaeesseneeesiaeeseeneees 5 53 Gontiguring Dead Peer DEteCtOn sstvccsescesssietaseenractaxecsteatvanseneslenentsnenchavedssectaneieres 5 54 Contents ix v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Configuring NetBIOS Bridging with VPN sisccaiitiidestertuidieihnneiieadceaaiviend S 5
130. emote endpoint is defined IP Address Enter the IP address of the remote endpoint in the fields to the right of the radio button FQDN Enter the FQDN of the remote endpoint in the field to the right of the radio button Select this checkbox to allow NetBIOS broadcasts to travel over the VPN tunnel For more information about NetBIOS see Configuring NetBIOS Bridging with VPN on page 5 55 This feature is disabled by default Select a radio button to specify if Keepalive is enabled e Yes This feature is enabled periodically the VPN firewall sends ping packets to the remote endpoint to keep the tunnel alive You must enter the ping IP address detection period and the maximum number of times that the VPN firewall attempts to reconnect see below e No This feature is disabled This is the default setting Ping IP Address The IP address that the VPN firewall pings The address must be of a host that can respond to ICMP ping requests Detection period The period in seconds between the ping packets The default setting is 10 seconds Reconnect after failure count The maximum number of Keepalive requests before the VPN firewall tears down the connection and then attempts to reconnect to the remote endpoint The default is 3 Keepalive requests Virtual Private Networking 5 27 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Table 5 3 Add VPN Policy Settings conti
131. en re enable the VPN policy Configuring IKE Policies The IKE Internet Key Exchange protocol performs negotiations between the two VPN gateways and provides automatic management of the keys used in IPsec It is important to remember that e Auto generated VPN policies must use the IKE negotiation protocol e Manual generated VPN policies cannot use the IKE negotiation protocol Virtual Private Networking 5 15 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual IKE policies are activated when 1 The VPN Policy Selector determines that some traffic matches an existing VPN policy If the VPN policy is of type Auto then the auto policy settings that are defined in the VPN policy are accessed which specify which IKE policy to use 2 Ifthe VPN policy is a Manual policy then the manual policy settings that are defined in the VPN policy are accessed and the first matching IKE policy is used to start negotiations with the remote VPN gateway e If negotiations fail the next matching IKE policy is used e Ifnone of the matching IKE policies are acceptable to the remote VPN gateway then a VPN tunnel cannot be established 3 An IKE session is established using the SA Security Association settings specified in a matching IKE policy e Keys and other settings are exchanged e An IPsec SA Security Association is established using the settings in the VPN policy The VPN tunnel
132. entication Dial In User Service RFC 2865 is a protocol for managing Authentication Authorization and Accounting AAA of multiple users in a network A RADIUS server will store a database of user information and can validate a user at the request of a gateway or server in the network when a user requests access to network resources During the establishment of a VPN connection the VPN gateway can interrupt the process with an XAUTH eXtended AUTHentication request At that point the remote user must provide authentication information such as a username password or some encrypted response using his username password information The gateway will try and verify this information first against a local User Database if RADIUS PAP is enabled and then by relaying the information to a central authentication server such as a RADIUS server To configure RADIUS servers 1 Select VPN from the main menu and VPN Client from the submenu The User Database screen displays see Figure 5 30 on page 5 41 2 Select the RADIUS Client tab The RADIUS Client screen displays see Figure 5 31 on page 5 43 5 42 Virtual Private Networking v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual User Database RU wars Primary RADIUS Server l Do you want to enable a Primary RADIUS Primary Server 1P address WW Secret Phrase Primary Server NAS Identifier FVS3189 Server Yes No i Backup RADIUS Server
133. erence Manual Extensive Protocol Support The FVS318G supports the Transmission Control Protocol Internet Protocol TCP IP and Routing Information Protocol RIP For further information about TCP IP see the TCP IP Networking Basics document that you can access from the link in Related Documents in Appendix C e IP Address Sharing by NAT The VPN firewall allows several networked PCs to share an Internet account using only a single IP address which may be statically or dynamically assigned by your Internet service provider ISP This technique known as NAT allows the use of an inexpensive single user ISP account e Automatic Configuration of Attached PCs by DHCP The VPN firewall dynamically assigns network configuration information including IP gateway and domain name server DNS addresses to attached PCs on the LAN using the Dynamic Host Configuration Protocol DHCP This feature greatly simplifies configuration of PCs on your local network e DNS Proxy When DHCP is enabled and no DNS addresses are specified the VPN firewall provides its own address as a DNS server to the attached PCs The VPN firewall obtains actual DNS addresses from the ISP during connection setup and forwards DNS requests from the LAN e PPP over Ethernet PPPoE PPPoE is a protocol for connecting remote hosts to the Internet over a DSL connection by simulating a dial up connection This feature eliminates the need to run a login program such as
134. erify that the Options gt Secure gt Specified Connections selection is enabled N Security Policy Editor NETGEAR ProSafe VPN Client s Certificate Manager File Edit Help Deactivate Security Policy Secure All Connections None Global Policy Settings Reload Security Policy Policy Management Certificate Settings Disconnect Connect Log Viewer Connection Monitor Help About NETGEAR ProSafe VPN Client Remove Icon eee ow lt 4 Figure 5 8 Specified Connections Certificate Manager Virtual Private Networking 5 7 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual 2 In the upper left of the Policy Editor window click the New Document icon the first on the left to open a New Connection Give the New Connection a name in this example we are using gw1 N Security Policy Editor NETGEAR ProSafe VPN Client File Edit Options Help ia NETGEAR N Network Security Policy My Connections Connection Security 8 El Secure I Only Connect Manually Qs Other Connections C Non secure A C Block Remote Party Identity and Addressing ID Type IP Subnet gt Subnet 19216820 Mask 255 255 255 255 Botocal fr Pot O M Use Secure Gateway Tunnel x ID Type Domain Name Gateway IP Address gw1_local com 21 208 246 81 Figure 5 9 Fill in the other options accor
135. ervice rule on the the LAN WAN Rules DMZ WAN Rules or LAN DMZ Rules screen in the Action column to the right of to the rule click on of the following table buttons e edit Allows you to make any changes to the rule definition of an existing rule Depending on your selection either an Edit Outbound Service screen or Edit Inbound Service screen displays containing the data for the selected rule e up Moves the rule up one position in the table rank e down Moves the rule down one position in the table rank To enable disable or delete one or more rules on the LAN WAN Rules DMZ WAN Rules or LAN DMZ Rules screen 1 Select the checkbox to the left of the rule that you want to delete or disable or click the select all table button to select all rules 2 Click one of the following table buttons e enable Enables the rule or rules The status icon changes from a grey circle to a green circle indicating that the rule is or rules are enabled By default when a rule is added to the table it is automatically enabled e disable Disables the rule or rules The status icon changes from a green circle to a grey circle indicating that the rule is or rules are disabled e delete Deletes the rule or rules To add a new rule click Add For more information see Configuring LAN WAN Rules on this page Configuring DMZ WAN Rules on page 4 12 and Configuring LAN DMZ Rules on page 4 13 Configuring LAN
136. eseneeenee 6 23 MIG WING TG LOGS A A A E E E ETA T T EE E T 6 26 Enabling the trame Mete ponios A EEEE 6 27 Viewing the VPN Firewall Configuration and System Status ccseeeeeeeeees 6 30 Monitoring VPN Firewall Statistics aciers innn aa a 6 31 Monitoring Broadband Port Status socassa N a 6 32 Monitoring Attached DEVICES sicrusern conne A ER 6 33 Monitoring VPN Tunnel Connection Status st 0sscdeiia atone tien 6 34 viewing tne VFN LOUS sssiiacccessstncat cans n aecntinee oamme einer 6 35 Viewing thelDHG POG s ctvsce a sctcsieacceste castes steer aavtecieeueea AAEN 6 36 Viewing Port Triggering Status ccccescceceeeeeeeneee cece eeeeaeeeeeeeeeseaaeseeneeeeeaaesseneees 6 36 Chapter 7 Troubleshooting Ba SIG FUNCIO esn O 7 1 Power LEDNOKON cesan N ENE 7 2 LEDSNEVSr TUNT OI ornis aa E E EE tet 7 2 LAN or Intemet Port LEDS NOt On erripa aa RAS iS 7 2 x Contents v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Troubleshooting the Web Configuration Interface cccccccseeeeeeeeeeieeeeeeeeeteeeeeeneeetans Ttroubleshooting the ISP COnne Chon mernani aaia eee Troubleshooting a TCP IP Network Using a Ping Utility Problems with Date and Time Appendix A Default Settings and Technical Specifications Appendix B Two Factor Authentication Testing the LAN Path to Your VPN Firewall c cccccceceeeeeeeeeeeeeeaeeeceeeeeeeeeeees Testing the Path from Your PC to a Remote De
137. esources Outbound rules LAN to WAN determine what outside resources local users can have access to A firewall has two default rules one for inbound traffic and one for outbound The default rules of the VPN firewall are e Inbound Block all access from outside except responses to requests from the LAN side e Outbound Allow all access from the LAN side to the outside The firewall rules for blocking allowing traffic on the VPN firewall can be applied to LAN WAN traffic DMZ WAN traffic and LAN DMZ traffic 4 2 Firewall Protection and Content Filtering v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Services Based Rules The rules to block traffic are based on the traffic s category of service e Outbound Rules service blocking Outbound traffic is normally allowed unless the VPN firewall is configured to disallow it e Inbound Rules port forwarding Inbound traffic is normally blocked by the VPN firewall unless the traffic is in response to a request from the LAN side The VPN firewall can be configured to allow this otherwise blocked traffic e Customized Services Additional services can be added to the list of services in the factory default list These added services can then have rules defined for them to either allow or block that traffic see Adding Customized Services on page 4 24 e Quality of Service QoS priorities Each service has its own native priority that impacts it
138. ess but with the inconsistent MAC address or the other way around it will drop these packets If users have enabled the logging option for IP MAC binding these packets will be logged before they are dropped The VPN firewallwill then display the total number of dropped packets that violated either the IP to MAC binding or the MAC to IP binding Following is an example Assume that three computers on the LAN are set up as follows e Hostl MAC address 00 01 02 03 04 05 and IP address 192 168 10 10 e Host2 MAC address 00 01 02 03 04 06 and IP address 192 168 10 11 e Host3 MAC address 00 01 02 03 04 07 and IP address 192 168 10 12 If all the above host entries are added to the IP MAC Binding table the following scenarios indicate the possible outcome e Hostl Matching IP address and MAC address in the IP MAC Bindings table e Host2 Matching IP address but inconsistent MAC address in the IP MAC Bindings table e Host3 Matching MAC address but inconsistent IP address in the IP MAC Bindings table The VPN firewall will block the traffic coming from Host2 and Host3 but allow the traffic coming from Host to any external network The total count of dropped packets will be displayed To enable IP MAC binding and add IP and MAC addresses for binding 1 Select Security from the main menu and Address Filter from the submenu 2 Select the IP MAC Binding tab The IP MAC Binding screen displays see Figure 4 23 on page 4 36
139. et firewall rules on one of the the LAN WAN Rules screen and the DMZ WAN Rules screen you can configure three different schedules that is schedule 1 schedule 2 and schedule 3 for when a rule is to be applied Once a schedule is configured it affects all rules that use this schedule You specify the days of the week and time of day for each schedule See Setting a Schedule to Block or Allow Specific Traffic on page 4 29 for the procedure on how to use this feature Blocking Sites If you want to reduce traffic by preventing access to certain sites on the Internet you can use the VPN firewall s filtering feature By default this feature is disabled all requested traffic from any website is allowed VPN Firewall and Network Management 6 3 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual e Keyword and Domain Name Blocking You can specify up to 32 words that should they appear in the website name that is URL or in a newsgroup name will cause that site or newsgroup to be blocked by the VPN firewall You can apply the keywords to one or more groups Requests from the PCs in the groups for which keyword blocking has been enabled will be blocked Blocking does not occur for the PCs that are in the groups for which keyword blocking has not been enabled You can bypass keyword blocking for trusted domains by adding the exact matching domain to the list of Trusted Domains Access to the domain
140. ffic 6 7 setting up 3 2 DMZ Setup screen 3 12 DMZ WAN Rules about 4 12 example of 4 16 modifying 4 12 4 14 DMZ WAN Rules screen 4 12 DNS ISP server addresses 2 9 server IP address 3 4 3 13 DNS proxy enable 3 5 3 14 Index 2 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Domain Name router 3 4 3 13 Domain Name Blocking 4 3 Domain Name Servers See DNS DoS about protection 2 attack 4 2 DPD 5 21 Dynamic DNS Configuration screen 2 71 Dynamic DNS See DDNS DynDNS org 2 11 E Edge Device 5 40 RADIUS Server 5 39 User Database 5 39 XAUTH with ModeConfig 5 49 Edit Group Names 3 9 Email alerts 6 23 logs enabling notification 4 41 6 23 E mail Server address 6 25 Enable ARP Broadcast 3 5 3 14 Enable DHCP server 3 Enable DNS Proxy 3 5 3 14 Enable LDAP Information 3 5 3 14 Enable the DHCP Server DMZ port 3 3 Encapsulating Security Payload VPN Policy 5 24 Ending IP Address DHCP Address Pool 3 4 3 13 Ethernet Auto Uplink 3 Event Logs emailing of 4 41 6 23 exchange mode IKE policies 5 19 Extended Authentication See XAUTH F factory default login 7 8 factory default settings revert to 6 18 Firewall Logs emailing of 4 41 6 23 field descriptions 6 27 setting up 6 23 viewing 6 26 Firewall Logs amp E mail screen 4 41 6 23 firmware downloading 6 20 upgrade 6 20 Fixed IP address 2 5 fragmented IP packets 6 5
141. fic Mix The QoS priority settings determine the priority and in turn the quality of service for the traffic passing through the VPN firewall The QoS is set individually for each service e You can accept the default priority defined by the service itself by not changing its QoS setting e You can change the priority to a higher or lower value than its default setting to give the service higher or lower priority than it otherwise would have The QoS priority settings conform to the IEEE 802 1D 1998 formerly 802 1p standard for class of service tag You will not change the WAN bandwidth used by changing any QoS priority settings But you will change the mix of traffic through the WAN port by granting some services a higher priority than others The quality of a service is impacted by its QoS setting however VPN Firewall and Network Management 6 7 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual See Specifying Quality of Service QoS Priorities on page 4 26 for the procedure on how to use this feature Tools for Traffic Management The VPN firewall includes several tools that can be used to monitor the traffic conditions and control who has access to the Internet and the types of traffic they are allowed to have See Monitoring System Performance on page 6 23 for a discussion of the tools Configuring Users Administrative Settings and Remote Management You can change the administ
142. fore disconnecting in the timeout field This is useful if your ISP charges you based on the amount of time you have logged in My IP Address IP address assigned by the ISP to make the connection with the ISP server Server IP Address IP address of the PPTP server 5 Review the Internet IP Address options Current 1P Address help_ Get Dynamically from ISP Client Identifier Vendor Class Identifier Use Static IP Address IP Address fi70 ioo io Jeo IP Subnet Mask fess ss zss fo Gateway IP Address fies Jeo Ieo Jao Figure 2 6 e Get Dynamically from ISP If your ISP has not assigned a static IP address select this radio button The ISP will automatically assign an IP address to the VPN firewall using DHCP network protocol The IP address and subnet mask fields will be inactivated As an option you can select the following checkboxes Client Identifier Select this checkbox if your ISP requires the Client Identifier information to assign an IP address using DHCP Vendor Class Identifier Select this checkbox if your ISP requires the Vendor Class Identifier information to assign an IP address using DHCP e Use Static IP Address If your ISP has assigned a fixed static IP address select this radio button and configure the following fields IP Address Enter the Static IP address assigned to you that identifies the VPN firewall to your ISP Subnet Mask Enter the mask provided by the I
143. from the Available Secondary LAN IPs table Note Additional IP addresses cannot be configured in the DHCP server The hosts on the gt secondary subnets must be manually configured with the IP addresses gateway IP and DNS server IPs DMZ and any other subnet addresses that are attached to the VPN firewall Example of correct addresses WAN IP address 10 0 0 1 with subnet 255 0 0 0 DMZ IP address 192 168 10 1 with subnet 255 255 255 0 LAN IP address 192 168 1 1 with subnet 255 255 255 0 Secondary LAN IP address 192 168 20 1 with subnet 255 255 255 0 f Warning Make sure that the secondary IP addresses are different from the LAN WAN Configuring and Enabling the DMZ Port The De Militarized Zone DMZ is a network which when compared to the LAN has fewer firewall restrictions by default This zone can be used to host servers such as a Web server FTP server or email server for example and give public access to them The eighth LAN ports on the VPN firewall can be dedicated as a hardware DMZ port for safely providing services to the Internet without compromising security on your LAN The DMZ port feature is also helpful when using some online games and videoconferencing applications that are incompatible with NAT The VPN firewall is programmed to recognize some of these applications and to work properly with them but there are other applications that may not function well In some cases local PCs can run the
144. front panel 6 FVX538 features of G Gigabit Switch port Group Names editing 3 9 groups managing 3 5 H Hosting A Local Public Web Server example of 4 15 hosts managing 3 5 IGMP enable 4 2 IGP 3 17 IKE policies about 5 15 exchange mode 5 19 ISAKMP identifier 5 20 management of 5 16 ModeConfig 5 19 ModeConfig configuring with 5 47 XAUTH 5 22 XAUTH adding to 5 40 Inbound Rules Index 3 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual default definition 4 2 example 4 6 field descriptions 4 6 order of precedence 4 8 Port Forwarding 4 3 4 5 rules for use 4 5 Inbound Services field descriptions 4 6 increasing traffic 6 4 DMZ port 6 7 Port Forwarding 6 5 Port Triggering 6 6 VPN tunnels 6 7 installation 7 4 Installation instructions for 2 Interior Gateway Protocol See IGP Internet connection automatically configuring 2 4 manually configuring 2 6 Internet service connection types 2 5 IP addresses auto generated 7 3 DHCP address pool 3 how to assign 3 multi home LAN 3 0 reserved 3 9 router default 3 3 IP Subnet Mask router default 3 4 IP MAC Binding screen 4 35 IPSec Connection Status screen 6 34 IPSec Host 5 39 5 4 IPsec Host XAUTH with ModeConfig 5 49 ISAKMP identifier 5 20 ISP connection troubleshooting 7 4 K Keep Connected idle timeout 2 7 2 8 keepalive configuring 5 53 VPN tunnels 5 27 key feat
145. g BEGIN CERTIFICATE REQUEST and END CERTIFICATE REQUEST d Submit the CA form If no problems ensue the certificate will be issued 9 Store the certificate file from the CA on your computer 10 Return to the Certificates screen and locate the Self Certificate Requests section see Figure 5 26 on page 5 36 11 Select the checkbox next to the certificate request then click Browse and locate the certificate file on your PC 12 Click Upload The certificate file will be uploaded to this device and will appear in the Active Self Certificates list Virtual Private Networking 5 37 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual If you have not already uploaded the CA certificate do so now as described in Viewing and Loading CA Certificates on page 5 32 You should also periodically check the Certificate Revocation Lists CRL table as described in the following section Managing your Certificate Revocation List CRL A CRL Certificate Revocation List file shows certificates that have been revoked and are no longer valid Each CA issues their own CRLs It is important that you keep your CRLs up to date You should obtain the CRL for each CA regularly To view your currently loaded CRLs and upload a new CRL follow these steps 1 Locate the Certificate Revocation Lists CRL table at the bottom of the Certificates screen help CA Identity Last Update Next Update D
146. g e Your ISP may require a login program Ask your ISP whether they require PPP over Ethernet PPPoE or some other type of login e Tf your ISP requires a login you may have incorrectly set the login name and password 7 4 Troubleshooting v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual e Your ISP may check for your PC s host name Assign the PC Host Name of your ISP account as the Account Name on the Broadband ISP Settings screen see Figure 2 2 on page 2 4 e Your ISP only allows one Ethernet MAC address to connect to the Internet and may check for your PC s MAC address In this case Inform your ISP that you have bought a new network device and ask them to use the VPN firewall s MAC address or Configure your VPN firewall to spoof your PC s MAC address You can do this on the Broadband Advanced Options screen see Figure 2 10 on page 2 13 If your VPN firewall can obtain an IP address but your PC is unable to load any Web pages from the Internet e Your PC may not recognize any DNS server addresses A DNS server is a host on the Internet that translates Internet names such as www addresses to numeric IP addresses Typically your ISP will provide the addresses of one or two DNS servers for your use You may configure your PC manually with DNS addresses as explained in your operating system documentation e Your PC may not have the VPN firewall configured as its TCP IP ga
147. gabit 8 Port VPN Firewall FVS318G Reference Manual b Check the Enable Perfect Forward Secrecy PFS radio button and select the Diffie Hellman Group 2 from the PFS Key Group pull down menu c Enable Replay Detection should be checked 4 Click on Authentication Phase 1 on the left side of the menu and select Proposal 1 N Security Policy Editor NETGEAR ProSafe VPN Client af Network Security Policy My Connections d8 modettg_test G My Identity A Security Policy amp Authentication Phase 1 Proposal 1 Key Exchange Phase 2 Bh to_fdvg Qy Other Connections NETGEAR N Authentication Method and Algorithms Authentication Method Pre Shared Key x Encryption and Data Integrity Algorithms Encrypt lg Triple DES X HashAlg SHA d Seconds SA Life Seconds _y 3600 Key Group Diffie Hellman Group2 v Figure 5 37 Enter the authentication values to match those in the VPN firewall ModeConfig Record screen 5 Click on Key Exchange Phase 2 on the left side of the menu and select Proposal 1 M Security Policy Editor NETGEAR ProSafe VPN Client File Edit Options Help Bal ta Network Security Policy J My Connections d modetg_test G My Identity a Security Policy E Authentication Phase 1 a Proposal 1 amp Key Exchange Phase 2 B Proposal 1 Bb to_fdvg Qy Other Connections Figure 5 38 NETGEAR N IPSec Protocols
148. he IKE policy When this option is chosen you will need to specify the user name and password to be used in authenticating this gateway by the remote gateway For more information on XAUTH see Configuring XAUTH for VPN Clients on page 5 39 11 If Edge Device was enabled select the Authentication Type from the pull down menu which will be used to verify account information User Database RADIUS CHAP or RADIUS PAP Users must be added through the User Database screen see Configuring the User Database for XAUTH on page 5 41 or Configuring RADIUS Clients for XAUTH on page 5 42 Note If RADIUS PAP is selected the VPN firewall will first check the User Database to see if the user credentials are available If the user account is not present the VPN firewall will then connect to the RADIUS server 12 Click Apply The new policy will appear in the List of IKE Policies table Virtual Private Networking 5 49 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Configuring the ProSafe VPN Client for ModeConfig From a client PC running NETGEAR ProSafe VPN Client software configure the remote VPN client connection To configure the client PC 1 Right click the VPN client icon in the Windows toolbar In the upper left of the Policy Editor window click the New Policy editor icon Security Policy Editor NETGEAR ProSafe VPN Client l File Edit Options Help ASERR
149. he VPN firewall A priority is assigned to IP packets using this service Priorities are defined by the Type of Service ToS in the Internet Protocol Suite standards RFC 1349 4 26 Firewall Protection and Content Filtering v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual A ToS priority for traffic passing through the VPN firewall is one of the following e Normal Service No special priority given to the traffic The IP packets for services with this priority are marked with a ToS value of 0 e Minimize Cost Used when data has to be transferred over a link that has a lower cost The IP packets for services with this priority are marked with a ToS value of 1 e Maximize Reliability Used when data needs to travel to the destination over a reliable link and with little or no retransmission The IP packets for services with this priority are marked with a ToS value of 2 e Maximize Throughput Used when the volume of data transferred during an interval is important even if the latency over the link is high The IP packets for services with this priority are marked with a ToS value of 4 e Minimize Delay Used when the time required latency for the packet to reach the destination must be low The IP packets for services with this priority are marked with a ToS value of 8 Creating Bandwidth Profiles Bandwidth limiting determines the way in which data is communicated with your host The purpo
150. hecks Session Limit Advanced Default Outbound Policy Allow Always apply Operation succeeded Service LAN WAN Bandwidth Filter Priority Log Action Name Users Users Profile Block by schedule 1 else Normal AIM ANY ANY NONE Never up Swn PEJ allow Service select all delete endie Oo disable add LAN Server IP LAN Address Users ers Profile Filter Log Action 102 168 1 16 NONE Always up Qdown edit Always vp On Bear Allow al remote 102 168 1 15 ANY WANL NONE Never up Qeown Beaj Always select all Daa 5 enable D Esk add Figure 4 1 For LAN WAN rules DMZ WAN rules and LAN DMZ rules for any traffic attempting to pass through the VPN firewall the packet information is subjected to the rules in the order shown in the Outbound Services and Inbound Services rules tables rules tables beginning at the top and proceeding to the bottom In some cases the order of precedence of two or more rules may be important in determining the disposition of a packet For example you should place the most strict rules at the top those with the most specific services or addresses The up and down button allows you to relocate a defined rule to a new position in the table see below 4 8 Firewall Protection and Content Filtering v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual To make changes to an existing outbound or inbound s
151. her the Edit Admin Settings or Edit Guest Settings radio box Users Local Authentication Enable Local Authentication 2 Do you want to enable Local Authentication Yes No Edit Admin Settings Edit Guest Settings ii Admin Settings 2 ii Guest Settings New User Name New User Name buet Old Password L J Old Password SCS New Password ES NewPassword Retype New Password ees Retype New Password SSCS Local Authentication Settings Administrator login times out after idle for E Minutes Domain Name LOCALDOMAIN Figure 6 1 4 In either the Admin Settings or the Guest Settings section of the screen a change the password by first entering the old password and then entering the new password twice b Click Apply to save your settings 5 Inthe Local Authentication Settings section of the screen a Change the Idle Logout Time field to the number of minutes you require The default is 5 minutes b Click Apply to save your settings VPN Firewall and Network Management 6 9 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual ES Note After a factory defaults reset the password and time out value will be changed back to password and 5 minutes respectively Adding External Users You can add external users for which you then can configure an authentication method see Configuring an External Server for Authentication on
152. hin your local network IP addresses Use a different range of private IP addresses such as 172 20 xx xx If you have a WINS server on your local network enter its IP address Enter one or two DNS server IP addresses to be used by remote VPN clients If you enable Perfect Forward Secrecy PFS select DH Group 1 or 2 This setting must match exactly the configuration of the remote VPN client 8 Specify the local IP subnet to which the remote client will have access Typically this is your VPN firewall s LAN subnet such as 192 168 2 1 255 255 255 0 If not specified it will default to the LAN subnet of the VPN firewall 5 46 Virtual Private Networking v1 1 August 2010 9 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Specify the VPN policy settings These settings must match the configuration of the remote VPN client Recommended settings are e SA Lifetime 3600 seconds e Authentication Algorithm SHA 1 e Encryption Algorithm 3DES 10 Click Apply The new record should appear in the List of Mode Config Records on the Mode Config screen Configuring an IKE Policy for Mode Config Operation Next you must configure an IKE policy 1 Select VPN from the main menu and Policies from the submenu The Policies submenu tabs appear with the IKE Policies screen in view see Figure 5 18 on page 5 16 2 Click add to configure a new IKE Policy The Add IKE Policy screen displays see Figure 5 34
153. hrough the VPN firewall so that the necessary traffic gets through when there is a bottleneck and either reducing unnecessary traffic or rescheduling some traffic to low peak times to prevent bottlenecks from occurring in the first place The VPN firewall has the necessary features and tools to help the network manager accomplish these goals Bandwidth Capacity The maximum bandwidth capacity of the VPN firewall in each direction is as follows e LAN side 8000 Mbps eight LAN ports at 1000 Mbps each e WAN side 1000 Mbps one WAN port at 1000 Mbps In practice the WAN side bandwidth capacity will be much lower when DSL or cable modems are used to connect to the Internet As a result and depending on the traffic being carried the WAN side of the firewall will be the limiting factor to throughput for most installations 6 1 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual VPN Firewall Features That Reduce Traffic You can adjust the following features of the VPN firewall in such a way that the traffic load on the WAN side decreases e LAN WAN outbound rules also referred to as service blocking e DMZ WAN outbound rules also referred to as service blocking e Content filtering blocking sites e Source MAC filtering Service Blocking You can control specific outbound traffic for example from LAN to WAN and from DMZ to WAN The LAN WAN Rules screen and the DMZ WAN Rules screen list all existing ru
154. iewing and Loading CA Certificates The Trusted Certificates CA Certificates table lists the certificates of CAs and contains the following data e CA Identity Subject Name The organization or person to whom the certificate is issued e Issuer Name The name of the CA that issued the certificate e Expiry Time The date after which the certificate becomes invalid 5 32 Virtual Private Networking v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual To view the VPN certificates Select VPN from the main menu and Certificates from the submenu The Certificates screen displays The top section of the Certificates screen displays the Trusted Certificates CA Certificates section Policies VPN Wizard Mode Config VPN Client Connection Status Certificates Operation succeeded help CA Identity Subject Name Issuer Name Expiry Time Mar 29 o OmRoot CA OUmhttp www cacert org CN CA Cert OmRoot CA OUMhttp www cacert org CN CA Cert 12 29 49 Signing Authority emailAddress support cacert org Signing Authority emailAddress support cacert org 2033 GMT select all delate Upload Trusted Certificate Trusted Certificate File Ra upload Figure 5 22 When you obtain a self certificate from a CA you will also receive the CA certificate In addition many CAs make their certificates available on their Websites To load a CA certificate into your VPN firewall 1 Store the CA cert
155. ificate cannot be used for secure Web management The extKeyUsage would govern the certificate acceptance criteria in the VPN firewall when the same digital certificate is being used for secure Web management In the VPN firewall the uploaded digital certificate is checked for validity and also the purpose of the certificate is verified Upon passing the validity test and the purpose matches its use has to be SSL and VPN the digital certificate is accepted The additional check for the purpose of the uploaded digital certificate must correspond to use for VPN and secure Web remote management via HTTPS If the purpose defined is for VPN and HTTPS then the certificate is uploaded to the HTTPS certificate repository and as well in the VPN certificate repository If the purpose defined is only for VPN then the certificate is only uploaded to the VPN certificate repository Thus certificates used by HTTPS and IPsec will be different if their purpose is not defined to be VPN and HTTPS The VPN firewall uses digital certificates to authenticate connecting VPN gateways or clients and to be authenticated by remote entities A certificate that authenticates a server for example is a file that contains e A public encryption key to be used by clients for encrypting messages to the server e Information identifying the operator of the server e A digital signature confirming the identity of the operator of the server Ideally the signature is from a t
156. ificate file on your computer 2 Under Upload Trusted Certificates in the Certificates menu click Browse and locate the CA certificate file 3 Click Upload The CA Certificate will appear in the Trusted Certificates CA Certificates table Understanding and Viewing Active Self Certificates Instead of obtaining a digital certificate from a CA you can generate and sign your own digital certificate However a self signed digital certificate triggers a warning from most browsers because it provides no protection against identity theft of the server Figure 5 23 on page 5 34 shows an image of a browser security alert Virtual Private Networking 5 33 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual There can be three reasons why a security alert is generated for a security certificate e The security certificate was issued by a company you have not chosen to trust e The date of the security certificate is invalid e The name on the security certificate is invalid or does not match the name of the site When a security alert is generated the user can decide whether or not to trust the host Security Alert formation you exchange with this ste cannot be viewed or charged ahars However there is a problem with the ste s A The name on the security certificate is invalid or does not match the name of the ste ves m vecna Figure 5 23 The Active Self Certificates table on the Certifica
157. in menu and External Authentication from the submenu The External Users screen displays 2 Select the External Authentication tab The External Authentication screen displays Users External Users External Authentication Enable External Authentication 2 Do you want to enable Remote Authentication O Yes No Primary Server IP Address blo Jo Jo Secret Phrase Primary Server NAS Identifier Primary Authentications Type Enable Backup Server Backup Server IP Address ono CC Secret Phrase n Backup Server NAS Identifier Fvs3i8g Domain Name Retry Timeout B Sec Maximum Retry Count B Users Default Timeout Minutes Figure 6 4 3 Inthe Enable External Authentication section of the screen select the Yes radio button 4 Click Apply to save the settings and enable external authentication 5 In the RADIUS Server Configuration section of the screen configure the following fields e Primary RADIUS Server IP address The IP address of the RADIUS server 6 12 VPN Firewall and Network Management v1 1 August 2010 7 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual e Secret Phrase Transactions between the client and the RADIUS server are authenticated using a shared secret phrase so the same secret phrase must be configured on both client and server e Primary Server NAS Identifier The identifier for the Network Access Server NAS must be present in a RADIU
158. in the download read them before continuing 4 Select Administration from the main menu and Settings Backup amp Upgrade from the submenu The Settings Backup and Firmware Upgrade screen displays 5 Click Browse in the Router Upgrade section 6 Locate the downloaded file and click Upload This will start the software upgrade to your VPN firewall The software upgrade process might take some time At the conclusion of the upgrade your VPN firewall will reboot Warning After you have clicked Upload do not try to go online turn off the VPN firewall shutdown the computer or do anything else to the VPN firewall until the VPN firewall finishes the upgrade When the Test light turns off wait a few more seconds before doing anything 7 After the VPN firewall has rebooted select Monitoring to display the Router Status screen and confirm the new firmware version to verify that your VPN firewall now has the new software installed Note In some cases such as a major upgrade it may be necessary to erase the configuration and manually reconfigure your VPN firewall after upgrading it Refer to the Release Notes included with the software to find out if this is required Configuring Date and Time Service Date time and NTP server designations can be configured on the Time Zone screen Network Time Protocol NTP is a protocol that is used to synchronize computer clock times in a network of computers To set time da
159. ingle port number enter the same number in both fields 3 Click Add The new custom service will be added to the Custom Services Table Firewall Protection and Content Filtering 4 25 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Modifying a Service To edit the settings of a service 1 Inthe Custom Services Table click the Edit icon adjacent to the service you want to edit The Edit Service screen displays Edit Service Operation succeeded help Name ICMP Type 3389 Start Port Finish Port Default QoS Priority Normal Service v Figure 4 17 2 Modify the settings you wish to change Click Reset to cancel the changes and restore the previous settings or click Apply to confirm your changes The modified service displays in the Custom Services Table Specifying Quality of Service QoS Priorities The Quality of Service QoS Priorities setting determines the priority of a service which in turn determines the quality of that service for the traffic passing through the firewall The user can change this priority e On the Services screen in the Custom Services Table for customized services see Figure 4 16 e On the Add LAN WAN Outbound Services screen see Figure 4 2 on page 4 10 e Onthe Add DMZ WAN Outbound Services screen see Figure 4 5 on page 4 13 The QoS priority definition for a service determines the queue that is used for the traffic passing through t
160. irewall FVS318G Reference Manual 6 Inthe Destination IP Address field enter the destination IP address to the host or network to which the route leads 7 Inthe IP Subnet Mask field enter the IP subnet mask for this destination If the destination is a single host enter 255 255 255 255 8 From the Interface pull down menu select the physical network interface Broadband DMZ or LAN through which this route is accessible 9 In the Gateway IP Address field enter the gateway IP address through which the destination host or network can be reached This must be a device on the same LAN segment as the VPN firewall 10 In the Metric field enter the metric priority for this route If multiple routes to the same destination exit the route with the lowest metric is chosen The value must be between and 15 11 Click Reset to discard any changes and revert to the previous settings or click Apply to save your settings The new static route will be added to Static Routes table You can edit the route s settings by clicking Edit in the Action column adjacent to the route Static Route Example For example you may require a static route if e your primary Internet access is through a cable modem to an ISP and e you have an ISDN firewall on your home network for connecting to the company where you are employed This firewall s address on your LAN is 192 168 1 100 and e your company s network is 134 177 0 0 When you first
161. irewall Protection and Content Filtering v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual To define a new service first you must determine which port number or range of numbers is used by the application This information can usually be determined by contacting the publisher of the application or from user groups of newsgroups When you have the port number information you can enter it on the Services screen To add a customized service 1 Select Security from the main menu and Services from the submenu The Services screen displays Security Services Name Start Port Finish Port Priority Action remote 3389 3389 Normal Service ea linuxvne c 5901 5901 Normal Service aiit vnc2 6000 6000 Normal Service esit select all delete Add Custom Service Name Type ICMP Type Start Port Finish Port Default QoS Priority Add CJ fer CJ _ Nermarservice 9 za Figure 4 16 2 Inthe Add Custom Services section of the screen specify a new service Enter a descriptive name for the service this is for your convenience Select the Layer 3 Protocol that the service uses as its transport protocol It can be TCP UDP or ICMP c Enter the first TCP or UDP port of the range that the service uses If the service uses only one port then the Start Port and the Finish Port will be the same d Enter the last port of the range that the service uses If the service only uses a s
162. is then available for data transfer The IKE Policies Screen When you use the VPN Wizard to set up a VPN tunnel an IKE Policy is established and populated in the List of IKE Policies table on the IKE Policies screen and is given the same name as the new VPN connection name You can also edit exiting policies or add new IKE policies directly on the IKE Policies screen To view the IKE Policies screen select VPN from the main menu and Policies from the submenu The IKE Policies screen displays VPN Wizard Certificates Mode Config VPN Client Connection Status IKE Policies VPN Policies Operation succeeded help Name Mode Remote ID Encr Auth DH Action O Gwato ew M 71 202 246 81 3DES SHA 1 Group 2 1024 bit edit O Client to Gw g9 GW1_remote com 3DES SHA 1 Group 2 1024 bit edit Client Policy select all deete ada Figure 5 18 5 16 Virtual Private Networking v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Each policy that is listed in the List of IKE Policies table contains the following data Name Uniquely identifies each IKE policy The name is chosen by you and used for the purpose of managing your policies it is not supplied to the remote VPN Server Mode Two modes are available either Main or Aggressive Main Mode is slower but more secure Aggressive mode is faster but less secure If specifying either a FQDN or a User FQDN na
163. itoring port status 2 5 6 32 WAN Security Check about 4 20 Index 8 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Web Components 4 30 blocking 4 33 filtering about 4 30 Web configuration troubleshooting 7 3 WiKID 6 11 authentication overview B WinPoET 2 7 WINS server 3 4 3 13 X XAUTH IKE policies 5 22 IPSec Host 5 39 types of 5 39 Index 9 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Index 10 v1 1 August 2010
164. k interface card and for the hub ports if any that are connected to your workstation and VPN firewall e Wrong network configuration Verify that the Ethernet card driver software and TCP IP software are both installed and configured on your PC or workstation Verify that the IP address for your VPN firewall and your workstation are correct and that the addresses are on the same subnet Testing the Path from Your PC to a Remote Device After verifying that the LAN path works correctly test the path from your PC to a remote device From the Windows run menu type PING n 10 lt IP address gt where lt P address gt is the IP address of a remote device such as your ISP s DNS server If the path is functioning correctly replies as in the previous section are displayed If you do not receive replies Check that your PC has the IP address of your VPN firewall listed as the default gateway If the IP configuration of your PC is assigned by DHCP this information will not be visible in your PC s Network Control Panel Check to see that the network address of your PC the portion of the IP address specified by the netmask is different from the network address of the remote device Check that your cable or DSL modem is connected and functioning 7 6 Troubleshooting v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Ifyour ISP assigned a host name to your PC enter that ho
165. l FVS318G with eight 10 100 1000 Mbps Gigabit Ethernet LAN ports and one 10 100 1000 Mbps Gigabit Ethernet WAN port connects your local area network LAN to the Internet through an external access device such as a cable modem or DSL modem The FVS318G is a complete security solution that protects your network from attacks and intrusions For example the FVX538 provides support for Stateful Packet Inspection Denial of Service DoS attack protection and multi NAT support The VPN firewall supports multiple Web content filtering options plus browsing activity reporting and instant alerts both via email Network administrators can establish restricted access policies based on time of day website addresses and address keywords The FVS318G is a plug and play device that can be installed and configured within minutes This chapter contains the following sections e Key Features on this page e Package Contents on page 1 5 e VPN Firewall Front and Rear Panels on page 1 6 e Default IP Address Login Name and Password on page 1 8 e Qualified Web Browsers on page 1 8 Key Features The FVS318G provides the following features e One 10 100 1000 Mbps Ethernet WAN port for connection to a WAN device such as a cable modem or DSL modem e Built in eight port 10 100 1000 Mbps Gigabit Ethernet LAN switch for extremely fast data transfer between local network resources e Support for up to 253 internal LAN users
166. les for outbound traffic If you have not defined any rules only the default rule will be listed The default rule allows all outgoing traffic See Using Rules to Block or Allow Specific Kinds of Traffic on page 4 2 for the procedure on how to use this feature Warning This feature is for advanced administrators only Incorrect configuration will cause serious problems Each rule lets you specify the desired action for the connections covered by the rule e BLOCK always e BLOCK by schedule otherwise Allow e ALLOW always e ALLOW by schedule otherwise Block As you define your firewall rules you can further refine their application according to the following criteria e LAN Users These settings determine which computers on your network are affected by this rule Select the desired options Any All PCs and devices on your LAN Single address The rule will be applied to the address of a particular PC Address range The rule is applied to a range of addresses Groups The rule is applied to a group see Managing Groups and Hosts LAN Groups on page 3 Sto assign PCs to a group using Network Database 6 2 VPN Firewall and Network Management v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual WAN Users These settings determine which Internet locations are covered by the rule based on their IP address Any The rule applies to all Internet IP address
167. ll always blocks DoS Denial of Service attacks A DoS attack does not attempt to steal data or damage your PCs but overloads your Internet connection so you can not use it that is the service is unavailable You can also create additional firewall rules that are customized to block or allow specific traffic See Using Rules to Block or Allow Specific Kinds of Traffic on page 4 2 for the procedure on how to use this feature AN Warning This feature is for advanced administrators only Incorrect configuration will cause serious problems You can control specific inbound traffic that is from WAN to LAN and from WAN to DMZ The LAN WAN Rules screen and the DMZ WAN Rules screen list all existing rules for inbound traffic If you have not defined any rules only the default rule will be listed The default rule blocks all inbound traffic Each rule lets you specify the desired action for the connections covered by the rule e BLOCK always e BLOCK by schedule otherwise Allow e ALLOW always e ALLOW by schedule otherwise Block You can also enable a check on special rules e VPN Passthrough Passes the VPN traffic without any filtering specially used when this firewall is between two VPN tunnel end points e Drop fragmented IP packets Drops any fragmented IP packets e UDP Flooding Limits the number of UDP sessions created from one LAN machine e TCP Flooding Protects the VPN firewall from SYN flood attack e Enable DNS
168. lly establish when both the local and target gateway policies are appropriately configured and enabled Note When using FQDN if the dynamic DNS service is slow to update their servers when your DHCP WAN address changes the VPN tunnel will fail because the FQDN does not resolve to your new address If you have the option to configure the update interval set it to an appropriately short time 5 4 Virtual Private Networking v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Creating a Client to Gateway VPN Tunnel Road Warrior Example Client B Gateway A WAN IP LAN IP _ a i ans A FQDN lt Q VPN Router ee at employer s main office Fully Qualified Domain Names FQDN Remote PC optional for Fixed IP addresses running NETGEAR required for Dynamic IP addresses ProSafe VPN Client Figure 5 5 Follow these steps to configure the a VPN client tunnel e Configure the client policies on the gateway e Configure the VPN client to connect to the gateway Use the VPN Wizard Configure the Gateway for a Client Tunnel 1 Select VPN from the main menu and VPN Wizard from the submenu The VPN Wizard screen displays see Figure 5 6 on page 5 6 To view the wizard default settings click the VPN Wizard Default Values option arrow You can modify these settings after completing the wizard 2 Select VPN Client as your VPN tunnel connection Create a Connection Name such as Client to GW
169. ly email traffic will be allowed All other traffic will be blocked e Send E mail alert You must configure the email capability in order for this function to work see Activating Notification of Events and Alerts on page 6 23 5 Click Apply to save your settings The Internet Traffic Statistics section of the screen displays statistics on Internet traffic through the WAN port If you have not enabled the traffic meter these statistics are not available To display a report of Internet traffic by type click the Traffic by Protocol option arrow in the upper right hand section of the Traffic Meter screen The volume of traffic for each protocol will be displayed in a popup window Traffic counters are updated in MBytes scale the counter starts only when traffic passed is at least 1 MB Traffic by Protocol Start Date End Date Incoming Traffic Outgoing Traffic Protocol Total MB MB Per Day Total MB MB Per Day o o o o Figure 6 13 VPN Firewall and Network Management 6 29 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Viewing the VPN Firewall Configuration and System Status The Router Status screen provides status and usage information Select Monitoring from the main menu and Router Status from the submenu The Router Status screen displays This screen displays current settings and statistics for your VPN firewall Because this information is read only any changes must
170. mand prompt CLI text code italics URL links e Formats This manual uses the following formats to highlight special messages Note This format is used to highlight information of importance or special interest 6 Tip This format is used to highlight a procedure that will save time or resources Warning Ignoring this type of note may result in a malfunction or damage to the equipment Danger This is a safety warning Failure to take heed of this notice may result in personal injury or death xiii v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual e Scope This manual is written for the VPN firewall according to these specifications Product Version ProSafe Gigabit 8 Port VPN Firewall FVS318G Manual Publication Date August 2010 For more information about network Internet firewall and VPN technologies see the links to the NETGEAR website in Appendix C Related Documents Note Product updates are available on the NETGEAR Inc website at http kb netgear com app home How to Print This Manual To print this manual your computer must have the free Adobe Acrobat reader installed in order to view and print PDF files The Acrobat reader is available on the Adobe website at http www adobe com yuy Tip If your printer supports printing two pages on a single sheet of paper you can save paper and printer ink
171. me as the Local ID Remote ID aggressive mode is automatically selected Local ID The IKE ISAKMP identifier of this device The remote VPN must have this value as their Remote ID Remote ID The IKE ISAKMP identifier of the remote VPN gateway The remote VPN must have this value as their Local ID Encr Encryption Algorithm used for the IKE SA The default setting using the VPN Wizard is 3DES This setting must match the remote VPN Auth Authentication Algorithm used for the IKE SA The default setting using the VPN Wizard is SHA1 This setting must match the remote VPN DH Diffie Hellman Group The Diffie Hellman algorithm is used when exchanging keys The DH Group sets the number of bits The VPN Wizard default setting is Group 2 This setting must match the remote VPN Enable Dead Peer Detection Dead Peer Detection is used to detect whether the peer is alive or not If the peer is detected as dead the IPSec and IKE Security Association are deleted To delete one or more IKE polices 1 Select the checkbox to the left of the policy that you want to delete or click the select all button to select all IKE policies 2 Click the delete button To add or edit an IKE policy see Manually Adding or Editing an IKE Policy on page 5 18 first must disable or delete the VPN policy before you can delete or edit the IKE Note You cannot delete or edit an IKE policy for which the VPN policy is active You
172. ment NETGEAR strongly recommends that you change your password see Changing Passwords and Settings on page 6 8 e At this point you can set up the traffic meter for each WAN if desired See Enabling the Traffic Meter on page 6 27 2 14 Connecting the VPN Firewall to the Internet v1 1 August 2010 Chapter 3 LAN Configuration This chapter describes how to configure the advanced LAN features of your ProSafe Gigabit 8 Port VPN Firewall FVS318G including the following sections e Choosing the VPN Firewall DHCP Options on this page e Configuring the LAN Setup Options on page 3 2 e Managing Groups and Hosts LAN Groups on page 3 5 e Configuring Multi Home LAN IP Addresses on page 3 10 e Configuring and Enabling the DMZ Port on page 3 11 e Configuring Static Routes on page 3 14 e Configuring Routing Information Protocol RIP on page 3 17 Choosing the VPN Firewall DHCP Options By default the VPN firewall will function as a DHCP Dynamic Host Configuration Protocol server allowing it to assign IP DNS server WINS Server and default gateway addresses to all computers connected to the VPN firewall LAN The assigned default gateway address is the LAN address of the VPN firewall IP addresses will be assigned to the attached PCs from a pool of addresses that you must specify Each pool address is tested before it is assigned to avoid duplicate addresses on the LAN The DHCP o
173. ming traffic using one of these ports will be sent to the IP address above Time Remaining The time remaining before this rule is released and thus available for other PCs This timer is restarted whenever incoming or outgoing traffic is received VPN Firewall and Network Management 6 37 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual 6 38 VPN Firewall and Network Management v1 1 August 2010 Chapter 7 Troubleshooting This chapter provides troubleshooting tips and information for your ProSafe Gigabit 8 Port VPN Firewall FVS318G This chapter includes the following sections e Basic Functions on this page e Troubleshooting the Web Configuration Interface on page 7 3 e Troubleshooting the ISP Connection on page 7 4 e Troubleshooting a TCP IP Network Using a Ping Utility on page 7 5 e Restoring the Default Configuration and Password on page 7 7 e Problems with Date and Time on page 7 7 e Using the Diagnostics Utilities on page 7 8 Basic Functions After you turn on power to the VPN firewall the following sequence of events should occur 1 When power is first applied verify that the PWR LED is on 2 After approximately 2 minutes verify that a The TEST LED is not lit b The LAN port LEDs are lit for any local ports that are connected c The Internet port LED is lit If a port s LED is lit a link has been established
174. n Protocols Authentication Protocol Description RADIUS A network validated PAP or CHAP password based authentication method that functions with Remote Authentication Dial In User Service RADIUS MIAS A network validated PAP or CHAP password based authentication method that functions with Microsoft Internet Authentication Service MIAS which is a component of Microsoft Windows 2003 Server WiKID WiKID Systems is a PAP or CHAP key based two factor authentication method that functions with public key cryptography The client sends an encrypted PIN to the WiKID server and receives a one time pass code with a short expiration period The client logs in with the pass code See Appendix B Two Factor Authentication for more on WiKID authentication PAP Password Authentication Protocol PAP is a simple protocol in which the client sends a password in clear text CHAP Challenge Handshake Authentication Protocol CHAP executes a three way handshake in which the client and server trade challenge messages each responding with a hash of the other s challenge message that is calculated using a shared secret value The chosen authentication protocol must be configured on the external server and on the authenticating client devices VPN Firewall and Network Management 6 11 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual To configure external authentication 1 Select Users from the ma
175. n server so that the OTP can only be used once and must be used before the expiration time If a user does not use this passcode before it is expired the user must go through the request process again to generate a new OTP 3 The user then proceeds to the Two Factor Authentication login page and enters the generated one time passcode as the login password 2 Factor Authentication ff Passcode Req Token client test UserName user w en d Passcode Password eeeeoe 468713 Domain WiKID PassCode expires in 51 Seconds Figure B 3 B 4 Two Factor Authentication v1 1 August 2010 Appendix C Related Documents This appendix provides links to reference documents you can use to gain a more complete understanding of the technologies used in your NETGEAR product Document TCP IP Networking Basics Wireless Networking Basics Preparing Your Network Virtual Private Networking Basics Glossary Link http documentation netgear com reference enu tcpip index htm http documentation netgear com reference enu wireless index htm http documentation netgear com reference enu wsdhcp index htm http documentation netgear com reference enu vpn index htm http documentation netgear com reference enu glossary index htm Related Documents C 1 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual C 2 v1 1 August 2010 Related Documents Numerics 3322 org 2 1
176. nects to the Internet Logging into the VPN Firewall To connect to the VPN firewall your computer needs to be configured to obtain an IP address automatically via DHCP If you need instructions on how to configure you computer for DHCP refer to the Preparing Your Network document that you can access from the link in Appendix C Related Documents To log in to the VPN firewall 1 Connect to the VPN firewall by typing http 192 168 1 1 in the address field of your browser User Name admin Password Passcode eeeeeeee Domain LOCALDOMAIN v Figure 2 1 2 When prompted enter admin for the VPN firewall user name and password for the VPN firewall password both in lower case letters The VPN firewall user name and password are not the same as any user name or password you may use to log in to your Internet connection 2 2 Connecting the VPN Firewall to the Internet v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual 3 Click Login The Router Status screen displays For more information about this screen see Viewing the VPN Firewall Configuration and System Status on page 6 30 Note You might want to enable remote management at this time so that you can log in remotely in the future to manage the VPN firewall see Configuring an External Server for Authentication on page 6 11 If you enable remote management NETGEAR strongly advises you to change you
177. new screen click Back on the Windows menu bar to return to the Diagnostics screen A DNS Domain Name Server converts the Internet name such as www netgear com to an IP address If you need the IP address of a Web FTP Mail or other server on the Internet you can do a DNS lookup to find the IP address Display the Routing Table Reboot the Router Packet Trace This operation will display the internal routing table This information is used most often by Technical Support Route Display Interface Name Destination Mask Gateway Metric LAN 192 168 1 0 255 255 255 0 0 0 0 0 0 10 1 32 0 255 255 255 0 0 0 0 0 o default 0 0 0 0 10 11 32 13 o Used to perform a remote reboot restart You can use this if the VPN firewall seems to have become unstable or is not operating normally Note Rebooting will break any existing connections either to the VPN firewall such as a management session or through the VPN firewall for example LAN users accessing the Internet However connections to the Internet will automatically be re established when possible Packet Trace selects the interface and starts the packet capture on that interface Troubleshooting v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual 7 10 v1 1 August 2010 Troubleshooting Appendix A Default Settings and Technical Specifications You can use the reset button located on the front of your devi
178. ng 2 3 Type a new name in the field 4 Select and edit other group names if desired 5 Click Apply to save your settings Setting Up DHCP Address Reservation When you specify a reserved IP address for a device on the LAN based on the MAC address of the device that computer or device will always receive the same IP address each time it accesses the VPN firewall s DHCP server Reserved IP addresses should be assigned to servers or access points that require permanent IP settings The Reserved IP address that you select must be outside of the DHCP Server pool To reserve an IP address manually enter the device on the LAN Groups screen specifying Reserved DHCP Client as described in Adding Devices to the Network Database on page 3 8 LAN Configuration 3 9 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual VPN firewall s DHCP server Reboot the PC or access its IP configuration and Note The reserved address will not be assigned until the next time the PC contacts the force a DHCP release and renew Configuring Multi Home LAN IP Addresses If you have computers on your LAN using different IP address ranges for example 172 16 2 0 or 10 0 0 0 you can add aliases to the LAN port giving computers on those networks access to the Internet through the VPN firewall This allows the VPN firewall to act as a gateway to additional logical subnets on your LAN You
179. ng and leaving the group The relevant multicast traffic will be forwarded from WAN to LAN Firewall Protection and Content Filtering 4 21 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Setting Session Limits Session Limit allows you to specify the total number of sessions allowed per user over an IP Internet Protocol connection across the VPN firewall This feature is enabled on the Session Limit screen and shown below in Figure 4 14 Session Limit is disabled by default To set session limits 1 Select Security from the main menu and Firewall Rules from the submenu The LAN WAN Rules screen displays Click the Session Limit tab The Session Limit screen displays Security Services Schedule Block Sites Address Filter Port Triggering UPnP Bandwidth Profile LAN WAN Rules LAN DMZ Rules Attack Checks EXSRTUMEIIT a Advanced Do you want to enable Session Limit Yes O No User Limit Parameter User Limit Total Number of Packets Dropped due to Session Limit 0 TCP Timeout eei UDP Timeout Se ICMP Timeout se Figure 4 14 Click the Yes radio button under Do you want to enable Session Limit From the User Limit Parameter pull down menu define the maximum number of sessions per IP either as a percentage of maximum sessions or as an absolute The percentage is computed on the total connection capacity of the device Enter the User Limit If the User Limit Parameter is
180. ng the VPN Firewall to the Internet v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual When Auto Detect successfully detects an active Internet service it reports which connection type it discovered The options are described in Table 2 1 Table 2 1 Internet connection methods Note When you click Auto Detect while the WAN port already has a connection you might lose the connection because the VPN firewall will enter its detection mode Connection 3 Method Data Required PPPoE Login Username Password Account Name Domain Name PPTP Login Username Password Account Name Local IP address and PPTP Server IP address DHCP Dynamic IP No data is required ISP If Auto Detect does not find a connection you will be prompted to check the physical connection between your VPN firewall and the cable or DSL line or to check your VPN Fixed Static IP Static IP address Subnet and Gateway IP and related data supplied by your firewall s MAC address see Manually Configuring Your Internet Connection on page 2 6 3 Click the Broadband Status option arrow at the top right of the screen to verify the WAN port connection status Click Connect if there is no connection Connection Status Connection Time Connection Type Connection State IP Address Subnet Mask Gateway DNS Server DHCP Server Lease Obtained Lease Duration renew Figu
181. nly Both Directions The specified restrictions will be applied to both incoming and outgoing traffic only Monthly Limit Use this option if your ISP charges for additional traffic Enter the monthly volume limit and select the desired behavior when the limit is reached If enabled enter the monthly volume limit and select the desired behavior when the limit is reached Note Both incoming and outgoing traffic are included in the limit VPN Firewall and Network Management 6 27 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual e Increase this month limit by Temporarily increase the traffic limit if you have reached the monthly limit but need to continue accessing the Internet Select the checkbox and enter the desired increase The checkbox will automatically be cleared when saved so that the increase is only applied once e This month limit Displays the limit for the current month Monitoring Broadband Traffic Meter 8 Traffic by Protocol ii Enable Traffic Meter No Limit Download only Do you want to enable Traffic Metering on Broadband Cnm Monthly Limit o MB man Yes O No 256000 MB 250 GB Increase this month limit by 2 MB max 256000 MB 250 GB This month limit O MB Traffic Counter 2 i When Limit is reached p O Restart Traffic Counter Now Block All Traffic Both Directions Restart Traffic Counter at Specific Time
182. nostic functions such as Ping Trace Route DNS lookup and remote reboot e Remote Management The VPN firewall allows you to login to the Web Management Interface from a remote location on the Internet For security you can limit remote management access to a specified remote IP address or range of addresses e Visual monitoring The VPN firewall s front panel LEDs provide an easy way to monitor its status and activity Maintenance and Support NETGEAR offers the following features to help you maximize your use of the FVS318G e Flash memory for firmware upgrade e Technical support seven days a week 24 hours a day according to the terms identified in the Warranty and Support information card provided with your product Package Contents e The product package should contain the following items e FVS318G ProSafe Gigabit 8 Port VPN Firewall FVS318G e AC power cable e Rubber feet e Category 5 Cat5 Ethernet cable e ProSafe Gigabit Port VPN Firewall FVS318G Installation Guide e Resource CD including e Application Notes and other helpful information e ProSafe VPN Client software one user license e Warranty and Support Information Card If any of the parts are incorrect missing or damaged contact your NETGEAR dealer Keep the carton including the original packing materials in case you need to return the VPN firewall for repair Introduction 1 5 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS3
183. nual Configuring the Internet Connection to Your ISP To automatically configure the broadband port and connect to the Internet 1 Select Network Configuration from the main menu and Broadband ISP Settings from the submenu The Broadband ISP Settings screen displays Network Configuration Dynamic DNS LAN Settings DMZ Setup Routing TCU E C LETS TES WAN Mode 38 Advanced 6 Broadband Status ii ISP Login 2 p Does Your Internet Connection Require a Login Login admin O Yes No Password 990eeseseesese d Account Name L J Domain Name C J Keep Connected Idle Time Minutes Idle Timeout Which type of ISP connection do you use Austria PPTP Connection Reset Other PPPoE Disconnect Time l0 HH 0 mm Delay fo Sec My IP Address 40 1000 Server IP Address Sl a a A Get Dynamically from ISP Get Automatically from ISP C client Identifier Use These DNS Servers C vendor Class Identifier Primary ONS Server fo o 10 Use Static IP Address Secondary ONS Server cn Ce Oe IP Address 0 o o 0 IP Subnet Mask fifo a Gateway IP Address me ne o J Apply Reset Test Auto Detect Figure 2 2 2 Click Auto Detect at the bottom of the screen to automatically detect the type of Internet connection provided by your ISP Auto Detect will probe for different connection methods and suggest one that your ISP will most likely support 2 4 Connecti
184. nued Item Traffic Selection Description or Subfield and Description Local IP From the pull down menu select the address or addresses that are part of the VPN tunnel on the VPN firewall Any All PCs and devices on the network Note You cannot select Any for both the VPN firewall and the remote endpoint e Single A single IP address on the network Enter the IP address in the Start IP Address field Range A range of IP addresses on the network Enter the starting IP address in the Start IP Address field and the ending IP address in the End IP Address field e Subnet A subnet on the network Enter the starting IP address in the Start IP Address field and the subnet mask in the Subnet Mask field Remote IP From the pull down menu select the address or addresses that are part of the VPN tunnel on the remote endpoint The menu choices are the same as for the Local IP pull down menu see above Manual Policy Parameters Note These fields apply only when you select Manual Policy as the policy type When you specify the settings for the fields in this section a security association SA is created SPI Incoming The Security Parameters Index SPI for the inbound policy Enter a hexadecimal value between 3 and 8 characters for example 0x1234 Encryption Algorithm Key In From the pull down menu select one of the following five algorithms to negotiate the security association SA DES Da
185. o the DDNS service to prevent your account from expiring If it appears you can select the Update every 30 days checkbox to enable a periodic update 5 Click Apply to save your configuration or click Reset to return to the previous settings 2 12 Connecting the VPN Firewall to the Internet v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Configuring the Advanced Broadband Options To configure the advanced broadband options 1 Select Network Configuration from the main menu and Broadband ISP Settings from the submenu The Broadband ISP Settings screen displays 2 Click the Advanced option arrow at the right of the tabs to display the Broadband Advanced Options screen Network Configuration WAN Settings Dynamic DNS LAN Settings DMZ Setup Routing Broadband Advanced Options Default Custom 1500 Bytes J Use Default Address Use this computer s MAC Use this MAC Address 00 24 b2 31 e1 83 Figure 2 10 3 Edit the default information you want to change MTU Size The normal MTU Maximum Transmit Unit value for most Ethernet networks is 1500 Bytes or 1492 Bytes for PPPoE connections For some ISPs you may have to reduce the MTU But this is rarely required and should not be done unless you are sure it is necessary for your ISP connection Port Speed In most cases your VPN firewall can automatically determine the connection speed of the Internet W
186. oSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual 8 Set the Time Out Period in seconds that the VPN firewall should wait for a response from the RADIUS server 9 Set the Maximum Retry Count This is the number of attempts that the VPN firewall will make to contact the RADIUS server before giving up 10 Click Reset to cancel any changes and revert to the previous settings or click Apply to save the settings Es Note Selection of the Authentication Protocol usually PAP or CHAP is configured on the individual IKE policy screens Assigning IP Addresses to Remote Users ModeConfig To simply the process of connecting remote VPN clients to the VPN firewall you can use the ModeConfig screen to assign IP addresses to remote users including a network access IP address subnet mask and name server addresses from the VPN firewall Remote users are given IP addresses available in secured network space so that remote users appear as seamless extensions of the network In the following example we configured the VPN firewall using ModeConfig and then configured a PC running ProSafe VPN Client software using these IP addresses e NETGEAR ProSafe Gigabit 8 Port VPN Firewall FVS318G WAN IP address 172 21 4 1 LAN IP address subnet 192 168 2 1 255 255 255 0 e NETGEAR ProSafe VPN Client software IP address 192 168 1 2 Mode Config Operation After the IKE Phase 1 negotiation is complete the VPN connection initiat
187. oining the LAN will be assigned an IP address between this address and the Ending IP Address The IP address 192 168 1 2 is the default start address Ending IP Address Specifies the last of the contiguous addresses in the IP address pool The IP address 192 168 1 100 is the default ending address Note The starting and ending DHCP addresses should be in the same subnet as the LAN IP address of the VPN firewall the IP address that is configured in the LAN TCP IP Setup section of the LAN Setup screen Primary DNS Server Optional If an IP address is specified the VPN firewall will provide this address as the primary DNS server IP address If no address is specified the VPN firewall will provide its own LAN IP address as the primary DNS server IP address Secondary DNS Server Optional If an IP address is specified the VPN firewall will provide this address as the secondary DNS server IP address WINS Server Optional Specifies the IP address of a local Windows NetBIOS Server if one is present in your network Lease Time This specifies the duration for which IP addresses will be leased to clients 3 4 LAN Configuration v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual If you will use a Lightweight Directory Access Protocol LDAP authentication server for network validated domain based authentication select Enable LDAP Information to enable the DHCP server to provide LDAP server inform
188. ols Routing Information Protocol 4 Q Qos 4 3 about 4 26 priority definitions 4 26 shifting traffic mix 6 7 Quality of Service See QoS R rack mounting 8 RADIUS description 6 11 RADIUS CHAP 5 22 RADIUS PAP 5 22 WiKID 6 RADIUS Server about 5 42 configuring 5 42 Edge Device 5 39 RADIUS CHAP 5 39 5 41 AUTH using with 5 39 RADIUS PAP 5 39 5 41 XAUTH using with 5 39 rear panel 6 reducing traffic 6 2 Block Sites 6 3 Service Blocking 6 2 Source MAC Filtering 6 4 remote management 6 access 6 14 configuration 6 4 remote users assigning addresses 5 44 ModeConfig 5 44 reserved IP address restrictions 3 8 setting up 3 9 Restore saved settings 6 8 Return E mail Address 6 25 RFC 1349 4 26 RFC1700 protocol numbers 4 24 RIP 3 17 about 3 17 configuring parameters 3 7 static routes use with 3 5 versions of 3 18 RIP Configuration screen 3 17 router administration tips on 4 42 router broadcast RIP use with 3 8 Router Status screen 6 30 Router Upgrade about 6 20 Router s MAC Address 2 4 Index 6 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Routing Information Protocol See RIP Routing screen 3 5 RSA signatures 5 2 tules blocking traffic 4 2 inbound example 4 16 order of precedence 4 24 service blocking 4 3 services based 4 3 running tracert 6 6 S SA IKE policies 5 20 VPN policies 5 28 5 29 save binding button 3
189. om 98 232 20 132 S01 2010 Mar 27 02 45 46 FV 318q IKE Could not find configuration for 98 232 20 132 500 Last output repeated twice 2010 Mar 27 02 45 48 FVS318g IKE Invalid exchange type 243 from 98 232 20 132 501 Last output repeated twice 2010 Mar 27 02 45 51 FVS318g IKE Could not find configuration for 98 232 20 132 500 2010 Mar 27 02 45 55 FVS318g IKE Invalid exchange type 243 from 98 232 20 132 501 2010 Mar 27 02 45 55 FV 318g IKE Could not find configuration for 98 232 20 132 500 2010 Mar 27 06 11 54 FV S318g IKE Could not find configuration for 72 187 52 76 500 _ Last output repeated 7 times 2010 Mar 27 08 16 43 FV 318qg IKE Invalid exchange type 243 from 58 64 55 19 500 2010 Mar 27 08 16 45 FV 318q9 IKE Could not find configuration for 58 64 55 19 500 _ lt gt refresh z clear log Figure 5 17 Managing VPN Policies When you use the VPN Wizard to set up a VPN tunnel both a VPN policy and an IKE policy are established and populated in both policy tables The name you selected as the VPN tunnel connection name during Wizard setup identifies both the VPN policy and IKE policy You can edit existing policies or add new VPN and IKE policies directly in the policy tables Note You cannot modify an IKE policy that is associated with an enabled VPN policy To modify the IKE policy first disable the VPN policy After you have modified and saved the IKE policy you can th
190. om dropping and to force a reconnection if the tunnel drops for any reason For Dead Peer Detection to function the peer VPN device on the other end of the tunnel must also support Dead Peer Detection Keepalive though less reliable than Dead Peer Detection does not require any support from the peer device Configuring Keepalives The keepalive feature maintains the IPSec SA by sending periodic ping requests to a host across the tunnel and monitoring the replies To configure the keepalive on a configured VPN policy follow these steps 1 Select VPN from the main menu and Policies from the submenu The Policies submenu tabs appear with the IKE Policies screen in view see Figure 5 18 on page 5 16 2 Click the VPN Policies tab The VPN Policies screen displays see Figure 5 20 on page 5 24 In the List of VPN Policies table click the edit button to the right of the VPN policy that you want to edit The Edit VPN Policy screen displays Virtual Private Networking 5 53 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual 4 9 In the General section of the Edit VPN Policy screen locate the keepalive configuration settings help Policy Name GWitoGw2 Policy Type Select Local Gateway wani O wanz Remote Endpoint IP Address 71_ f2o2 feae Jei O FQDN 71 202 246 81 Enable NetBIOS Enable Keepalive Yes ONo Ping IP Address 0 _ fo lo fo Detection period Bo j Sec
191. om the main menu and Block Sites from the submenu The Block Sites screen displays Operation succeeded amp Content Filtering Turn Content Filtering On Yes No Web Components O Proxy i Apply Keyword Blocking to Group Name 4 Groupi Group2 Groups Group4 Groups Group6 Group 0 0 0 0 0 0 0 0 0000 Groups select at enable oO disabte Blocked Keywords Blocked Keyword select at delete Add Blocked Keyword i Trusted Domains Add Trusted Domain Figure 4 21 4 32 Firewall Protection and Content Filtering v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Check the Yes radio button to enable content filtering Click Apply to activate the screen controls Check the radio boxes of any Web components you wish to block yi e Y amp BN Check the radio buttons of the groups to which you wish to apply keyword blocking Click Enable to activate keyword blocking or disable to deactivate keyword blocking 6 Build your list of blocked keywords or domain names in the Blocked Keyword fields After each entry click Add The keyword or domain name will be added to the Blocked Keywords table You can also edit an entry by clicking Edit in the Action column adjacent to the entry 7 Build a list of trusted domains in
192. om the submenu The Policies submenu tabs appear with the IKE Policies screen in view see Figure 5 18 on page 5 16 Virtual Private Networking 5 39 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual 2 You can add XAUTH to an existing IKE policy by clicking the edit button adjacent to the policy to be modified or you can create a new IKE policy incorporating XAUTH by clicking add Figure 5 29 shows the Add IKE Policy screen Bf add Ike Policy Add New VPN Policy Mode Config Record Do you want to use Mode Config Record i SalesPerson m es Policy Name SalesPerson Select Mode Config Record pirecion Type Responder anse P view selected Exchange Mode Aggressive Select Local Gateway wani O wanz Identifier Type Identifier Type Identifier Identifier Encryption Algorithm Authentication Algorithm Authentication Method Pre shared key ORSA Signature Pre shared key 12345678 Key Length 8 49 Char Diffie Hellman DH Group SA Lifetime sec Enable Dead Peer Detection Yes No Detection Period 10 Seconds Reconnect after failure count Sl 2 Extended Authentication UTH Configuration Authentication Type User Database none EE Username oO Edge Device fe Password j IPSec Host Figure 5 29 3 In the Extended Authentication section of the Add IKE Policy or Edit IKE Policy screen select the Authentication
193. on State Connected or Disconnected IP Address The IP address of the WAN interface Subnet Mask The IP subnet mask of the WAN interface Gateway The gateway IP address for the WAN interface e Primary DNS The IP address of the primary DNS server for the WAN interface Secondary DNS The IP address of the secondary DNS server for the WAN interface MAC Address The MAC address of the WAN interface Monitoring VPN Firewall Statistics To display the VPN firewall statistics 1 Select Monitoring from the main menu and Router Status from the submenu The Router Status screen displays see Figure 6 14 on page 6 30 2 Click the Show Statistics option arrow in the upper right hand section of the screen The Router Statistics screen displays Monitoring Router Status Traffic Meter Diagnostics Firewall Logs amp E mail VPN Logs Router Statistics The page will auto refresh in 1 seconds System up Time 0 Days 00 13 15 bhelp Collisions Tx B s Rx B s Up Time o 1746 840 O Days 00 11 13 489 221 0 Days 00 13 28 N A N A N A Poll Interval Seconds 2e interval stop Figure 6 15 VPN Firewall and Network Management 6 31 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual For each interface Broadband LAN and DMZ the number of transmitted Tx Pkts and received Rx Pkts packets the number of collided packets the transmitted Tx B s and received Rx
194. on of NETGEAR ProSafe VPN Client 21 12 24 57 592 Filter table loaded 2 entries 12 24 5 528 My Connections Other Connections Filter record 2 updated 19 542 beers My Connections campfrog Initiating IKE Phase 1 IP ADDR 21 208 246 81 4 1 20 164 My Connections campfrog SENDING gt gt gt gt ISAKMP OAK AG SA KE NON ID VID 6x 21 12 31 20 790 My Connections campfrog RECEIVED lt lt lt ISAKMP OAK AG SA KE NON ID HASH VID 3x NAT D 2x YID 21 12 31 20 792 My Connections campfrog Peer is NAT T draft 02 capable 12 31 20 792 My Connections campfrog NAT is detected for Client 12 31 20 792 My Connections campfrag Floating to IKE non 500 port 12 31 20 879 My Connections campfrog SENDING gt gt gt gt ISAKMP OAK AG HASH NAT D 2x NOTIFY STATUS_REPLAY_ 12 31 20 879 My Connections campfrag Established IKE SA 1 20 879 My Connections campfrog MY COOKIE ef 40 8b d7 cc abd a8 1 20 879 My Connections campfrog HIS COOKIE c9 93 de ea 4a 32 5e ec 1 20 923 My Connections camptrog Initiating IKE Phase 2 with Client IDs message id 1F44FC04 21 12 31 20 923 My Connections campfrog Initiator IP ADDR 192 168 1 2 prot 0 port 0 21 12 31 20 923 My Connections campfrog Responder IP SUBNET MASK 192 168 2 0 255 255 255 255 prot 0 port 0 12 31 20 923 My Connections campfrog SENDING gt gt gt gt ISAKMP OAK QM HASH SA NON ID 2x 21 12 31 21 179 My Connections campfrog RECEIVED lt lt lt
195. on page 5 48 3 Inthe Mode Config Record section enable Mode Config by checking the Yes radio box and selecting the Mode Config record you just created from the pull down menu You can view the settings of the selected record by clicking the view selected button Mode Config works only in Aggressive Mode and Aggressive Mode requires that both ends of the tunnel be defined by a FQDN 4 Inthe General section e Enter a description name in the Policy Name field such as SalesPerson This name will be used as part of the remote identifier in the VPN client configuration e Set Direction Type to Responder e The Exchange Mode will automatically be set to Aggressive 5 In the Local section select FQDN for the Identity Type 6 Inthe Local section choose which WAN port to use as the VPN tunnel end point In the Remote section enter an identifier in the Identity Type field that is not used by any other IKE policies This identifier will be used as part of the local identifier in the VPN client configuration 8 In the IKE SA Parameters section specify the IKE SA settings These settings must be matched in the configuration of the remote VPN client Virtual Private Networking 5 47 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Recommended settings are e Encryption Algorithm 3DES e Authentication Algorithm SHA 1 e Diffie Hellman Group 2 e SA Lifetime 3600 seconds y Add IKE Policy GP
196. onds Reconnect after failure count Figure 5 39 Click the Yes radio button to enable keepalive In the Ping IP Address boxes enter an IP address on the remote LAN This must be the address of a host that can respond to ICMP ping requests Enter the Detection Period to set the time between ICMP ping requests The default is 10 seconds In Reconnect after failure count set the number of consecutive missed responses that will be considered a tunnel connection failure The default is 3 missed responses When the VPN firewall senses a tunnel connection failure it forces a reestablishment of the tunnel Click Apply at the bottom of the screen Configuring Dead Peer Detection The Dead Peer Detection feature maintains the IKE SA by exchanging periodic messages with the remote VPN peer To configure Dead Peer Detection on a configured IKE policy follow these steps 1 Select VPN from the main menu and Policies from the submenu The Policies submenu tabs appear with the IKE Policies screen in view see Figure 5 18 on page 5 16 2 Inthe List of IKE Policies table click the edit button to the right of the IKE policy that you want to edit The Edit IKE Policy screen displays 5 54 Virtual Private Networking v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual 3 In the IKE SA Parameters section of the Edit IKE Policy screen locate the Dead Peer Detection configuration settings help Encr
197. onfiguration Note Once you have completed the LAN IP setup all outbound traffic is allowed and all inbound traffic is discarded To change these traffic rules refer to Chapter 4 Firewall Protection and Content Filtering Managing Groups and Hosts LAN Groups The Known PCs and Devices table on the Groups and Hosts screen contains a list of all known PCs and network devices as well as hosts that are assigned dynamic IP addresses by this VPN firewall Collectively these entries make up the Network Database LAN Configuration 3 5 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual The Network Database is updated by these methods DHCP Client Requests By default the DHCP server in this VPN firewall is enabled and will accept and respond to DHCP client requests from PCs and other network devices These requests also generate an entry in the Network Database Because of this leaving the DHCP Server feature on the LAN screen enabled is strongly recommended Scanning the Network The local network is scanned using standard methods such as ARP This will detect active devices which are not DHCP clients However sometimes the name of the PC or device cannot be accurately determined and will be shown as Unknown Manual Entry You can manually enter information about a network device Creating the Network Database Some advantages of the Network Database are Generally you do not nee
198. onfiguration from the main menu and LAN Settings from the submenu The LAN Setup screen displays Click the DHCP Log option arrow in the upper right hand section of the screen The DHCP Log popup screen displays 2010 Mar 29 22 02 53 FVS318g dhcod Wrote 17 leases to leases file Last output repeated 3 times 2010 Mar 29 22 20 17 FVS3189 dheod DHCPREQUEST for 102 168 1 2010 Mar 29 22 20 17 FVS318g dhcod DHCPACK on 102 168 1 18 tc gt J refresh clear log Figure 6 20 To view the most recent entries click refresh To delete all the existing log entries click clear log Viewing Port Triggering Status To display the port triggering status 1 Select Security from the main menu and Port Triggering from the submenu The Port Triggering screen displays Click the Status option arrow in the upper right hand section of the screen The Port Triggering Status popup screen displays Port Triggering Status Rule LAN IP Address Open Ports Time Remaining Sec E refresh Figure 6 21 6 36 VPN Firewall and Network Management v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual To view the most recent entries click refresh Table 6 6 Port Triggering Status Data Item Description Rule The name of the rule LAN IP Address The IP address of the PC currently using this rule Open Ports The Incoming ports which are associated the this rule Inco
199. or which is the remote user with a VPN client requests the IP configuration settings such as the IP address subnet mask and name server addresses The Mode Config feature will allocate an IP address from the configured IP address pool and will activate a temporary IPsec policy using the template security proposal information configured in the Mode Config record The Mode Config feature allocates an IP address from the configured IP address pool and activates a temporary IPsec policy using the information that is specified in the Traffic Tunnel Security Level section of the Mode Config record on the Add Mode Config Record screen that is shown in Figure 5 33 on page 5 46 5 44 Virtual Private Networking v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Note After configuring a Mode Config record you must manually configure an IKE policy and select the newly created Mode Config record from the Select Mode Config Record pull down menu see Configuring Mode Config Operation on the VPN Firewall You do not need to make changes to any VPN policy Note An IP address that is allocated to a VPN client is released only after the VPN client has gracefully disconnected or after the SA lifetime for the connection has timed out Configuring Mode Config Operation on the VPN Firewall You need to configure two screens the ModeConfig screen and the IKE Policies screen Configuring the Mod
200. ork can be accessed by others on the Internet If your network has a permanently assigned IP address you can register a domain name and have that name linked with your IP address by public Domain Name Servers DNS However if your Internet account uses a dynamically assigned IP address you will not know in advance what your IP address will be and the address can change frequently hence the need for a commercial DDNS service which allows you to register an extension to its domain and restores DNS requests for the resulting FQDN to your frequently changing IP address After you have configured your account information on the VPN firewall whenever your ISP assigned IP address changes your VPN firewall will automatically contact your DDNS service provider log in to your account and register your new IP address Note If your ISP assigns a private WAN IP address such as 192 168 x x or 10 x x x the dynamic DNS service will not work because private addresses will not be routed on the Internet To configure Dynamic DNS 1 Select Network Configuration from the main menu and Dynamic DNS from the submenu The Dynamic DNS screen displays see Figure 2 9 on page 2 12 Connecting the VPN Firewall to the Internet 2 11 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Network Configuration l l l l l i WAN Settings LAN Settings DMZ Setup Routing Maurits DNS TZO DNS Oray DNS 3322 8 DynDNS Inform
201. ormation you include in your CSR To generate a new Certificate Signing Request CSR file 1 Locate the Generate Self Certificate Request section of the Certificates screen help Name o Subject _________ Hash Algorithm mos Signature Algorithm RSA SJ Signature Key Length si2_ E IP Address Optional CIC Domain Name Optional E mail Address Optional B generate hele Name Status Action lt select al delete Upload certificate corresponding to a request above Certificate File Browse upload Figure 5 25 Virtual Private Networking 5 35 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual 2 Configure the following fields Name Enter a descriptive name that will identify this certificate Subject This is the name which other organizations will see as the holder owner of the certificate Since this name will be seen by other organizations you should use your registered business name or official company name Using the same name or a derivation of the name in the Title field would be useful 3 From the pull down menus choose the following values Hash Algorithm MD5 or SHA2 Signature Algorithm RSA Signature Key Length 512 1024 2048 Larger key sizes may improve security but may also decrease performance 4 Complete the optional fields if desired with the following information IP Address If you have a
202. ou do not need to configure additional static routes You should configure static routes only for unusual cases such as multiple firewalls or multiple IP subnets located on your network 3 14 LAN Configuration v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual To add a static route 1 Select Network Configuration from the main menu and Routing from the submenu The Routing screen displays Network Configuration Routing RIP Configuration Static Routes Gateway Interface Metric select all delete add Figure 3 6 2 Click Add The Add Static Route screen displays Add Static Route Operation succeeded ii Static Route help Active Private Destination IP Address Coy Vy i 7 1P Subnet Mask _ lf lf We Interface Gateway IP Address ___ lf Metric i Figure 3 7 Enter a route name for this static route in the Route Name field for identification and management Select the Active checkbox to make this route effective A route can be added to the Static Routes table and made inactive if not needed This allows routes to be used as needed without deleting the entry and re adding it An inactive route is not broadcast if RIP is enabled Select the Private checkbox if you want to limit access to the LAN only The static route will not be advertised in RIP LAN Configuration 3 15 v1 1 August 2010 ProSafe Gigabit 8 Port VPN F
203. owser The changes may have occurred but the Web browser may be caching the old configuration Troubleshooting the ISP Connection If your VPN firewall is unable to access the Internet you should first determine whether the VPN firewall is able to obtain a WAN IP address from the ISP Unless you have been assigned a static IP address your VPN firewall must request an IP address from the ISP You can determine whether the request was successful using the Web Configuration Manager To check the WAN IP address 1 Launch your browser and select an external site such as www netgear com 2 Access the Main Menu of the VPN firewall s configuration at http 192 168 1 1 3 Select Monitoring from the main menu and Router Status from the submenu 4 Check that an IP address is shown for the WAN Port If 0 0 0 0 is shown your VPN firewall has not obtained an IP address from your ISP If your VPN firewall is unable to obtain an IP address from the ISP you may need to force your cable or DSL modem to recognize your new VPN firewall by performing the following procedure 1 Turn off power to the cable or DSL modem 2 Turn off power to your VPN firewall 3 Wait five minutes and reapply power to the cable or DSL modem 4 When the modem s LEDs indicate that it has reacquired sync with the ISP reapply power to your VPN firewall If your VPN firewall is still unable to obtain an IP address from the ISP the problem may be one of the followin
204. page 6 11 To add an external users 1 Select Users from the main menu and External Authentication from the submenu The External Users screen displays Users ZAGUEIROS External Authentication Operation succeeded i Users 2 help User Name User Type Idle Timeout Action o Sales1_EMEA Guest 30 E select al delete add Figure 6 2 2 Click Add The Add External User screen displays Users Add External User Operation succeeded i Add User User Type Idle Timeout L Minutes Figure 6 3 6 10 VPN Firewall and Network Management v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual 3 Configure the following fields User Name Enter a unique identifier using any alphanumeric characters User Type Select either Admin or Guest c Idle Timeout This is the period after which an idle user will be automatically logged out of the Web Configuration Manager 4 Click Apply to save and apply your entries The new user appears in the Users table on the External Users screen Configuring an External Server for Authentication When an external user logs in the VPN firewall will validate with the appropriate RADIUS MIAS or WIKID server that the external user is authorized to log in When specifying external authentication you are presented with several authentication protocol choices as summarized in the following table Table 6 1 Authenticatio
205. port multiple public IP addresses on one WAN interface The inbound rule instructs the VPN firewall to host an additional public IP address 10 1 0 5 and to associate this address with the Web server on the LAN at 192 168 1 1 We also instruct the VPN firewall to translate the incoming HTTP port number port 80 to a different port number port 8080 4 16 Firewall Protection and Content Filtering v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Add LAN WAN Inbound Service Operation succeeded bound Service E __ hep Action ALLOW always v Select Schedule Schedule 1 Send to LAN Server Start mea Jm Finish pais Translate to Port Number L WAN Destination IP Address Start i Jo s Finish f ea Ss LAN Users any Start Finish f ae a WAN Users Start ae es eS es Finish C Bandwidth Profile Figure 4 10 The following addressing scheme is used in this example e VPN firewall FVS318G WAN primary public IP address 10 1 0 1 WAN additional public IP address 10 1 0 5 LANP address 192 168 1 1 e Web server PC on the VPN firewall s LAN LANP address 192 168 1 11 Port number for Web service 8080 To test the connection from a PC on the WAN side type http 10 1 0 5 The home page of the Web server should appear LAN WAN or DMZ WAN Inbound Rule Specifying an Exposed Host Specifying an exposed host allows you to set up a computer or se
206. ption that you click Add under the Inbound Services table you configure the settings based on the descriptions in Table 4 2 on page 4 6 and the policy is added to the Inbound Services table Configuring LAN DMZ Rules The LAN DMZ Rules screen allows you to create rules that define the movement of traffic between the LAN and the DMZ The Default Outbound and Inbound Policies is to allow all traffic between the local LAN and DMZ network Firewall rules can then be applied to block specific types of traffic from either going out from the LAN to the DMZ outbound or coming in from the DMZ to the LAN inbound Firewall Protection and Content Filtering 4 13 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual To create a new LAN DMZ outbound service policy 1 Select Security from the main menu and Firewall Rules from the submenu The LAN WAN Rules screen displays 2 Select the LAN DMZ Rules tab The LAN DMZ Rules screen displays AN DMZ Rules utbound Services E EEEE lt elect at delete enarie O disable 20 i Inbound Services Service Name Filter DMZ Users LAN Users tog lt elect all delete endie disable add Figure 4 6 3 Click Add under the Outbound Services table The Add LAN DMZ Outbound Service screen displays Add LAN DMZ Outbound Service Operation succeeded Service Action Select Schedule Schedulei
207. ptions are available for both the LAN and DMZ settings For most applications the default DHCP and TCP IP settings of the VPN firewall are satisfactory See the link to TCP IP Networking Basics in Appendix C Related Documents for an explanation of DHCP and information about how to assign IP addresses for your network If another device on your network will be the DHCP server or if you will manually configure the network settings of all of your computers clear the Enable DHCP server radio box by selecting the Disable DHCP Server radio box Otherwise leave it checked Specify the pool of IP addresses to be assigned by setting the starting IP address and ending IP address These addresses should be part of the same IP address subnet as the VPN firewall s LAN IP address Using the default addressing scheme you should define a range between 192 168 1 2 and 192 168 1 100 although you may wish to save part of the range for devices with fixed addresses 3 1 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual The VPN firewall will deliver the following settings to any LAN device that requests DHCP e An IP address from the range that you have defined e Subnet mask e Gateway IP address the VPN firewall s LAN IP address e Primary DNS server the VPN firewall s LAN IP address e WINS server if you entered a WINS server address in the DHCP section of the LAN Setup screen e Lease time dat
208. r 2 Name IP Address field If you select this option and leave either the Server 1 or Server 2 fields empty they will be set to the default Netgear NTP servers Note If you select the default NTP servers or if you enter a custom server FQDN the VPN firewall must determine the IP address of the NTP server by a DNS lookup You must configure a DNS server address on the Broadband ISP Settings screen before the VPN firewall can perform this lookup 5 Click Apply to save your settings or click Cancel to revert to your previous settings 6 22 VPN Firewall and Network Management v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Monitoring System Performance You can be alerted to important events such as WAN traffic limits reached login failures and attacks You can also view status information about the VPN firewall broadband port LAN ports and VPN tunnels This section includes the following subsections e Activating Notification of Events and Alerts on page 6 23 e Viewing the Logs on page 6 26 e Enabling the Traffic Meter on page 6 27 e Viewing the VPN Firewall Configuration and System Status on page 6 30 e Monitoring VPN Firewall Statistics on page 6 31 e Monitoring Broadband Port Status on page 6 32 e Monitoring Attached Devices on page 6 33 e Monitoring VPN Tunnel Connection Status on page 6 34 e Viewing the VPN Logs on page
209. r password see Changing Passwords and Settings on page 6 8 Navigating the Menus The Web Configuration Manager menus are organized in a layered structure of main categories and submenus e Main menu The horizontal orange bar near the top of the page is the main menu containing the primary configuration categories Clicking on a primary category changes the contents of the submenu bar e Submenu The horizontal grey bar immediately below the main menu is the submenu containing subcategories of the currently selected primary category e Tab Immediately below the submenu bar at the top of the menu active window are one or more tabs further subdividing the currently selected subcategory if necessary e Option arrow To the right of the tabs on some menus are one or more blue dots with an arrow in the center Clicking an option arrow brings up either a popup window or an advanced option menu Tip In the instructions in this manual we may refer to a menu using the notation primary subcategory such as Network Configuration WAN Settings In this example Network is the selected primary category in the main menu and WAN Settings is the selected subcategory in the submenu You can now proceed to the first configuration task configuring the VPN firewall s Internet connection Connecting the VPN Firewall to the Internet 2 3 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Ma
210. r the Start Port range 1 65534 b Enter the End Port range 1 65534 7 Click Add The Port Triggering Rule will be added to the Port Triggering table To edit or modify a rule 1 Click Edit in the Action column opposite the rule you wish to edit The Edit Port Triggering Rule screen displays Edit Port Triggering Rule Operation succeeded Name Abstracts Enable Protocol Outgoing Trigger Port Range Incoming Response Port Range Figure 4 25 2 Modify any of the fields for this rule help Start Port 1 65534 Click Reset to cancel any changes and return to the previous settings or click Apply to save your modifications Your changes will appear in the Port Triggering table Firewall Protection and Content Filtering v1 1 August 2010 4 39 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual To check the status of the port triggering rules click the Status option arrow on the Port Triggering screen Port Triggering Status Rule LAN IP Address Open Ports Time Remaining Sec retresh Figure 4 26 Configuring UPnP Universal Plug and Play The UPnP Universal Plug and Play feature allows the VPN Firewall to automatically discover and configure the devices when it searches over LAN and WAN 1 To access the UPnP screen click Security gt UPnP in the main submenu The UPnP screen is displayed Security Do you want to enable UPnP Advertisemen
211. rator and guest passwords and settings configure authentication for external users configure an SNMP manager backup settings and upgrade firmware and enable remote management This section includes the following subsections e Changing Passwords and Settings on page 6 8 e Adding External Users on page 6 10 e Configuring an External Server for Authentication on page 6 11 e Enabling Remote Management Access on page 6 14 e Using an SNMP Manager on page 6 16 e Managing the Configuration File on page 6 18 e Configuring Date and Time Service on page 6 21 Changing Passwords and Settings The default passwords for the VPN firewall s Web Configuration Manager is password Netgear recommends that you change this password to a more secure password You can also configure a separate password for guests Administrator access is read write and guest access is read only To modify the local authentication settings 1 Select Users from the main menu and Local Authentication from the submenu The Local Authentication screen displays see Figure 6 1 on page 6 9 2 Inthe Enable Local Authentication section of the screen a Enable local authentication by selecting the Yes radio box b Click Apply to save your settings 6 8 VPN Firewall and Network Management v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual 3 In the User Selection section of the screen select eit
212. re 2 3 Operation succeeded 0 Days 01 18 55 DHCP Connected 10 1 31 40 255 255 255 0 10 1 31 13 10 1 1 6 10 1 1 6 Mon Sep 18 22 31 00 GMT 2006 1 Day 00 00 00 F release Connecting the VPN Firewall to the Internet v1 1 August 2010 2 5 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual The Connection Status window should show a valid IP address and gateway If the configuration was not successful skip ahead to Manually Configuring Your Internet Connection following this section or see Troubleshooting the ISP Connection on page 7 4 gt Note If the configuration process was successful you are connected to the Internet a through the WAN port If your WAN ISP configuration was successful you can skip ahead to Manually Configuring Your Internet Connection on page 2 6 Manually Configuring Your Internet Connection If you know your ISP connection type you can bypass the Auto Detect feature and connect your VPN firewall manually Ensure that you have all of the relevant connection information such as IP addresses account information type of ISP connection and so on before you begin Unless your ISP automatically assigns your configuration automatically via DHCP you will need these configuration settings from your ISP To manually configure your broadband ISP settings 1 Select Network Configuration from the main menu and Broadband ISP Settings from the submenu
213. ress and log in again For example if you change the default IP address 192 168 1 1 to 10 0 0 1 you must now enter https 10 0 0 1 in your browser to reconnect to the Web Configuration Manager LAN Configuration v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual IP Subnet Mask The subnet mask specifies the network number portion of an IP address Your VPN firewall will automatically calculate the subnet mask based on the IP address that you assign Unless you are implementing subnetting use 255 255 255 0 as the subnet mask Always make sure that the LAN port IP address and DMZ port IP address are in different subnets In the DHCP section select Disable DHCP Server Enable DHCP Server or DHCP Relay By default the VPN firewall will function as a DHCP server providing TCP IP configuration settings for all computers connected to the VPN firewall s LAN If another device on your network will be the DHCP server or if you will manually configure all devices click Disable DHCP Server If the VPN firewall will function as a DHCP relay agent select DHCP Relay and enter the IP address of the DHCP relay gateway in the Relay Gateway field If the DHCP server is enabled enter the following settings Domain Name Optional The DHCP will assign the entered domain to DHCP clients Starting IP Address Specifies the first of the contiguous addresses in the IP address pool Any new DHCP client j
214. ress of the UDP packets ensuring that the excessive ICMP return packets do not reach him making the attacker s network location anonymous If flood checking is enabled the VPN firewall will not accept more than 20 simultaneous active UDP connections from a single computer on the LAN Disable Ping Reply on LAN Ports To prevent the VPN firewall from responding to ping requests from the LAN click this checkbox e VPN Pass through When the VPN firewall functions in NAT mode all packets going to the Remote VPN Gateway are first filtered through NAT and then encrypted per the VPN policy Ifa VPN client or gateway on the LAN side of the VPN firewall wants to connect to another VPN endpoint on the WAN with the VPN firewall between the two VPN end points all encrypted packets will be sent to the VPN firewall Since the VPN firewall filters the encrypted packets through NAT the packets become invalid IPsec PPTP and L2TP represent different types of VPN tunnels that can pass through the VPN firewall To allow the VPN traffic to pass through without filtering enable those options for the type of tunnel s that will pass through the VPN firewall e Multicast Pass through IGMP is a communications protocol used to manage IP multicast groups Checking this option results in IGMP Proxy being enabled for WAN upstream and LAN downstream interfaces If checked the router will keep track of IGMP group membership reports from LAN hosts joini
215. riggering application there is a time out period before the application can be used by another PC This is required because the VPN firewall cannot detect when the application has terminated gt Note For additional ways of allowing inbound traffic see Inbound Rules Port 9 Forwarding on page 4 5 To add a port triggering Rule 1 Select Security from the main menu and Port Triggering from the submenu The Port Triggering screen displays Security Services Schedule Block Sites Firewall Address Filter Port Triggering help Enable Outgoing Ports Incoming Ports Action Start Port End Port Start Port End Port Oli Abstracts 20 22 20 40 ea select at setete Add Port Triggering Rule Name Enable Protocol Outgoing Trigger Port Range Incoming Response Port Range Add End Port Start Port End Port No TCP v add Figure 4 24 Enter a user defined name for this rule in the Name field From the Enable pull down menu indicate if the rule is enabled or disabled From the Protocol pull down menu select either the TCP or UDP protocol ya PF w BN In the Outgoing Trigger Port Range fields 4 38 Firewall Protection and Content Filtering v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual a Enter the Start Port range 1 65534 b Enter the End Port range 1 65534 6 Inthe Incoming Response Port Range fields a Ente
216. riggering application at any time 6 6 VPN Firewall and Network Management v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual After a PC has finished using a port triggering application there is a time out period before the application can be used by another PC This is required because the firewall cannot be sure when the application has terminated See Configuring Port Triggering on page 4 37 for the procedure on how to use this feature DMZ Port The DMZ Setup screen allows you to set up the DMZ port Specifying a Default DMZ server allows you to set up a computer or server that is available to anyone on the Internet for services that you haven t defined The default setting of the rules is that the DMZ port and both inbound and outbound traffic is disabled Enabling the DMZ port increases the traffic through the WAN port The VPN firewall makes LAN port 8 a dedicated hardware DMZ port when DMZ is enabled see VPN Firewall Front and Rear Panels on page 1 6 See Configuring and Enabling the DMZ Port on page 3 11 and Configuring DMZ WAN Rules on page 4 12 for the procedure on how to use this feature VPN Tunnels The VPN firewall permits up to 200 VPN tunnels at a time Each tunnel requires extensive processing for encryption and authentication See Chapter 5 Virtual Private Networking for the procedure on how to use this feature Using QoS to Shift the Traf
217. rmine which DMZ computers on the DMZ network are affected by this rule Select the desired options e Any All PCs and devices on your DMZ network e Single address Enter the required address and the rule will be applied to that particular PC on the DMZ network e Address range If this option is selected you must enter the start and finish fields of the DMZ computers Specifies the priority of a service which in turn determines the quality of that service for the traffic passing through the VPN firewall By default the priority shown is that of the selected service The user can change it accordingly If the user does not make a selection leaves it as Normal Service then the native priority of the service will be applied to the policy See Specifying Quality of Service QoS Priorities on page 4 26 This determines whether packets covered by this rule are logged Select the desired action e Always Always log traffic considered by this rule whether it matches or not This is useful when debugging your rules e Never Never log traffic considered by this rule whether it matches or not 4 4 Firewall Protection and Content Filtering v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Table 4 1 Outbound Rules continued Item Bandwidth Profile NAT IP Description Bandwidth Limiting determines the way in which the data is sent to or from your host The purpose of ban
218. rs that are used to validate the users to make that you are who you said you are These factors are e Something you know for example your password or your PIN e Something you have for example a token with generated passcode that is either 6 to 8 digits in length e Something you are for example biometrics such as fingerprints or retinal This appendix focuses and discusses only the first two factors something you know and something you have This new security method can be viewed as a two tiered authentication approach because it typically relies on what you know and what you have A common example of two factor authentication is a bank ATM card that has been issued by a bank institute e The PIN to access your account is something you know e The ATM card is something you have You must have both of these factors to gain access to your bank account Similar to the ATM card access to the corporate networks and data can also be strengthen using combination of the multiple factors such as a PIN and a token hardware or software to validate the users and reduce the incidence of online identity theft NETGEAR Two Factor Authentication Solutions NETGEAR has implemented 2 Two Factor Authentication solutions from WiKID WiKID is the software based token solution So instead of using only Windows Active Directory or LDAP as the authentication server administrators now have the option to use WiKID to perform Two Factor
219. rs when Extended Authentication is enabled as an Edge device Whether or not you use an external RADIUS server you may want some users to be authenticated locally These users must be added to the User Database Configured Users table To add a new user 1 Select VPN from the main menu and VPN Client from the submenu The User Database screen displays i VPN i i l i l Policies VPN Wizard Certificates Mode Config Connection Status UELLE RADIUS Client Operation succeeded help User Name Action o TestUser EEJ select all delete Add New User User Name Password Confirm Password Add C x Figure 5 30 Virtual Private Networking 5 41 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual 2 Enter a User Name This is the unique ID of a user which will be added to the User Name database 3 Enter a Password for the user and reenter the password in the Confirm Password field 4 Click add The user name will be added to the Configured Users table To edit the user name or password 1 Click the edit button adjacent to the user that you want to modify The Edit User screen displays 2 Make the required changes to the User Name or Password Click Reset to cancel your changes or click Apply to save your settings and return to the previous settings The modified user name and password displays in the Configured Users table Configuring RADIUS Clients for XAUTH RADIUS Remote Auth
220. rt_number VPN Firewall and Network Management 6 15 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Note To maintain security the VPN firewall will reject a login that uses http address rather than the SSL https address 4 Note The first time that you remotely connect to the VPN firewall with a browser via SSL you may get a warning message regarding the SSL certificate If you are using a Windows computer with Internet Explorer 5 5 or higher simply click Yes to accept the certificate 4 Note If you are unable to remotely connect to the VPN firewall after enabling HTTPS remote management check whether other user policies such as the default user policy are preventing access gt Note If you disable secure HTTP remote management all SSL VPN user connections will also be disabled yes Tip If you are using a dynamic DNS service such as TZO you can identify the WAN IP 16 address of your VPN firewall by running tracert from the Windows Run menu kad option Trace the route to your registered FQDN For example enter tracert FVS318G mynetgear net and the WAN IP address that your ISP assigned to the VPN firewall is displayed Using an SNMP Manager Simple Network Management Protocol SNMP lets you monitor and manage your VPN firewall from an SNMP Manager It provides a remote means to monitor and control network devices and to manage configura
221. rts to only one preconfigured IP address port triggering waits for an outbound request from the private network on one of the defined outgoing ports It then automatically sets up forwarding to the IP address that sent the request When the application ceases to transmit data over the port the VPN firewall waits for a timeout interval and then closes the port or range of ports making them available to other computers on the private network Once configured port triggering operates as follows 1 APC makes an outgoing connection using a port number defined in the Port Triggering table 2 The VPN firewall records this connection opens the additional incoming port or ports associated with this entry in the Port Triggering table and associates them with the PC 3 The remote system receives the PCs request and responds using the different port numbers that you have now opened 4 The VPN firewall matches the response to the previous request and forwards the response to the PC Firewall Protection and Content Filtering 4 37 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Without port triggering this response would be treated as a new connection request rather than a response As such it would be handled in accordance with the port forwarding rules Note these restrictions with port triggering e Only one PC can use a port triggering application at any time e After a PC has finished using a port t
222. rusted third party whose identity can be verified absolutely You can obtain a certificate from a well known commercial Certificate Authority CA such as Verisign or Thawte or you can generate and sign your own certificate Because a commercial CA takes steps to verify the identity of an applicant a certificate from a commercial CA provides a strong assurance of the server s identity A self signed certificate will trigger a warning from most browsers as it provides no protection against identity theft of the server The VPN firewall contains a self signed certificate from NETGEAR We recommend that you replace this certificate prior to deploying the VPN firewall in your network Virtual Private Networking 5 31 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Understanding the Certificates Screen To display the Certificates screen select VPN form the main menu and Certificates from the submenu Because of the large size of this screen and because of the way the information is presented the Certificates screen is divided and presented in this manual in different figures The Certificates screen lets you to view the currently loaded digital certificates upload a new digital certificate and generate a Certificate Signing Request CSR The VPN firewall typically holds two types of digital certificates e CA digital certificates Each CA issues its own CA identity digital certificate to validate communi
223. rver that is available to anyone on the Internet for services that you have not yet defined Firewall Protection and Content Filtering 4 17 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual To expose one of the PCs on your LAN or DMZ as this host 1 Create an inbound rule that allows all protocols 2 Place the rule below all other inbound rules Note For security NETGEAR strongly recommends that you avoid creating an exposed host When a computer is designated as the exposed host it loses much of the protection of the firewall and is exposed to many exploits from the Internet If compromised the computer can be used to attack your network Security Address Filter Port Triggering UPnP Bandwidth Profile wR Loni te DMZ WAN Rules LAN DMZ Rules Attack Checks Session Limit Advanced Default Outbound Policy Allow Always apply Operation succeeded Outbound Services 7 Service Name Filter LAN Users WAN Users Priority Bandwidth Profile Log select all derete enadle oO disable add Inbound Services LAN Server IP LAN Bandwidth Filter Allow 192 168 1 45 WANI Never up Always 4 Block by schedule 192 116 1 11 172 16 88 1 172 16 98 254 WANI Never up 1 else allow Allow 192 168 1 11 8080 10 1 0 5 NONE Never Always Allow a 192 168 0 50 ANY WANL NONE Never up sele
224. s 1 Press and hold the Factory Defaults button until the Test LED turns on and begins to blink about 10 seconds 2 Release the reset button and wait for the VPN firewall to reboot Problems with Date and Time The Time Zone screen select Administration from the main and Time Zone from the submenu displays the current date and time of day The VPN firewall uses the Network Time Protocol NTP to obtain the current time from one of several Network Time Servers on the Internet Each entry in the log is stamped with the date and time of day Troubleshooting 7 7 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Problems with the date and time function can include e Date and time shown is Thu Jan 01 00 01 52 GMT 1970 Cause The VPN firewall has not yet successfully reached a Network Time Server Check that your Internet access settings are configured correctly If you have just completed configuring the VPN firewall wait at least five minutes and check the date and time again e Time is off by one hour Cause The VPN firewall does not automatically sense Daylight Savings Time Go to the Time Zone screen see Configuring Date and Time Service on page 6 21 and select or deselect the checkbox marked Automatically Adjust for Daylight Savings Time Using the Diagnostics Utilities You can perform diagnostics such as pinging an IP address performing a DNS lookup displaying the routing
225. s quality of performance and tolerance for jitter or delays You can change the QoS priority which will change the traffic mix through the system see Specifying Quality of Service QoS Priorities on page 4 26 Outbound Rules Service Blocking The VPN firewall allows you to block the use of certain Internet services by PCs on your network This is called service blocking or port filtering Note See Configuring Source MAC Filtering on page 4 33 for yet another way to block outbound traffic from selected PCs that would otherwise be allowed by the VPN firewall Table 4 1 Outbound Rules Item Description Service Select the desired service or application to be covered by this rule If the desired service or application does not appear in the list you must define it using the Services menu see Adding Customized Services on page 4 24 Action Select the desired action for outgoing connections covered by this rule e BLOCK always e BLOCK by schedule otherwise Allow e ALLOW always e ALLOW by schedule otherwise Block Note Any outbound traffic that is not blocked by rules you create will be allowed by the default rule ALLOW rules are only useful if the traffic is already covered by a BLOCK rule That is you wish to allow a subset of traffic that is currently blocked by another rule Firewall Protection and Content Filtering 4 3 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G
226. s be accepted in order for the site to be accessed properly Blocking cookies may interfere with useful functions provided by these websites Keyword Blocking Domain Name Blocking You can specify up to 32 words that should they appear in the website name URL or in a newsgroup name will cause that site or newsgroup to be blocked by the VPN firewall You can apply the keywords to one or more groups Requests from the PCs in the groups for which keyword blocking has been enabled will be blocked Blocking does not occur for the PCs that are in the groups for which keyword blocking has not been enabled You can bypass keyword blocking for trusted domains by adding the exact matching domain to the list of Trusted Domains Access to the domains or keywords on this list by PCs even those in the groups for which keyword blocking has been enabled will still be allowed without any blocking Keyword application examples If the keyword XXX is specified the URL lt http www badstuff com xxx html gt is blocked as is the newsgroup alt pictures XXX If the keyword com is specified only Web sites with other domain suffixes such as edu or gov can be viewed If you wish to block all Internet browsing access enter the keyword Firewall Protection and Content Filtering 4 31 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual To enable Content Filtering 1 Select Security fr
227. s on the selected integrity algorithm e MD5 enter 16 characters e SHA 1 enter 20 characters Key Out The integrity key for he outbound policy The length of the key depends on the selected integrity algorithm The required key lengths are the same as for the Key In se above Auto Policy Parameters Note These fields apply only when you select Auto Policy as the policy type SA Lifetime The lifetime of the Security Association SA is the period or the amount of transmitted data after which the SA becomes invalid and must be renegotiated From the pull down menu select how the SA lifetime is specified Seconds In the SA Lifetime field enter a period in seconds The minimum value is 300 seconds The default value is 3600 seconds e KBytes In the SA Lifetime field enter a number of kilobytes The minimum value is 1920000 KB Encryption From the pull down menu select one of the following five algorithms to negotiate Algorithm the security association SA DES Data Encryption Standard DES 3DES Triple DES This is the default algorithm AES 128 Advanced Encryption Standard AES with a 128 bits key size AES 192 AES with a 192 bits key size e AES 256 AES with a 256 bits key size Integrity Algorithm From the pull down menu select one of the following two algorithms to be used in the VPN header for the authentication process SHA 1 Hash algorithm that produces a 160 bit digest This is
228. s on this list by PCs even in the groups for which keyword blocking has been enabled will still be allowed without any blocking e Web Component blocking You can block the following Web component types Proxy Java ActiveX and Cookies Sites on the Trusted Domains list are still subject to Web component blocking when the blocking of a particular Web component has been enabled See Blocking Internet Sites Content Filtering on page 4 30 for the procedure on how to use this feature Source MAC Filtering If you want to reduce outgoing traffic by preventing Internet access by certain PCs on the LAN you can use the source MAC filtering feature to drop the traffic received from the PCs with the specified MAC addresses By default this feature is disabled all traffic received from PCs with any MAC address is allowed See Configuring Source MAC Filtering on page 4 33 for the procedure on how to use this feature VPN Firewall Features That Increase Traffic The following features of the VPN firewall tend to increase the traffic load on the WAN side e LAN WAN inbound rules also referred to as port forwarding e DMZ WAN inbound rules also referred to as port forwarding e Port triggering e Enabling the DMZ port e Configuring Exposed hosts e Configuring VPN tunnels 6 4 VPN Firewall and Network Management v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Port Forwarding The VPN firewa
229. se of bandwidth limiting is to provide a method for limiting traffic thus preventing LAN users from consuming all the bandwidth on your broadband link Bandwidth limiting does not apply to the DMZ interface For example when a new connection is established by a device the device will locate the firewall rule corresponding to the connection e Ifthe rule has a bandwidth profile specification then the device will create a bandwidth class in the kernel e If multiple connections correspond to the same firewall rule they will share the same class An exception occurs for an individual bandwidth profile if the classes are per source IP The source IP is the IP of the first packet of the connection The class is deleted when all the connections using the class expire Firewall Protection and Content Filtering 4 27 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual To add a bandwidth profile 1 Select Security from the main menu and Bandwidth Profile from the submenu The Bandwidth Profile screen displays Security Services Schedule Block Sites Firewall Address Filter Port Triggering UPnP Bandwidth Profile i List of Bandwidth Profiles 2 Name Outbound Bandwidth Range kbps Inbound Bandwidth Range kbps Type Direction Action O FTP Limit 0 2000 250 1000 Individual Both Qeiit Packets Dropped due to Bandwidth Limit 0 select all delete add Figur
230. sent in the local user database the VPN firewall connects to a RADIUS server For more information see Configuring RADIUS Clients for XAUTH on page 5 42 Radius CHAP XAUTH occurs through RADIUS Challenge Handshake Authentication Protocol CHAP For more information see Configuring RADIUS Clients for XAUTH on page 5 42 The user name for XAUTH Authentication Type e e Username Password The password for XAUTH 4 Click Apply to save your settings The IKE policy is added to the List of IKE Policies table To edit an IKE policy 1 Select VPN from the main menu and Policies from the submenu The Policies submenu tabs appear with the IKE Policies screen in view see Figure 5 18 on page 5 16 2 In the List of IKE Policies table click the edit button to the right of the IKE policy that you want to edit The Edit IKE Policy screen is displayed This screen shows the same field as the Add IKE Policy screen see Figure 5 19 on page 5 18 3 Modify the settings that you wish to change see Table 5 2 on page 5 19 5 22 Virtual Private Networking v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual 4 Click Apply to save your changes The modified IKE policy is displayed in the List of IKE Policies table Configuring VPN Policies You can create two types of VPN policies When using the VPN Wizard to create a VPN policy only the Auto method is available
231. set firewall rules on one of the the LAN WAN Rules screen and the DMZ WAN Rules screen you can configure three different schedules that is schedule 1 schedule 2 and schedule 3 for when a rule is to be applied Once a schedule is configured it affects all rules that use this schedule You specify the days of the week and time of day for each schedule See Setting a Schedule to Block or Allow Specific Traffic on page 4 29 for the procedure on how to use this feature Port Triggering Port triggering allows some applications to function correctly that would otherwise be partially blocked by the VPN firewall Using this feature requires that you know the port numbers used by the Application Once configured Port Triggering operates as follows A PC makes an outgoing connection using a port number defined in the Port Triggering table The VPN firewall records this connection opens the additional incoming port or ports associated with this entry in the Port Triggering table and associates them with the PC The remote system receives the PCs request and responds using the different port numbers that you have now opened The VPN firewall matches the response to the previous request and forwards the response to the PC Without port triggering this response would be treated as a new connection request rather than a response As such it would be handled in accordance with the Port Forwarding rules Only one PC can use a port t
232. splays i Outbound Services Filter DMZ Users WAN Users Priority Log select all delete enable O disable add Service Name Inbound Services Service Name Filter DMZ Server IP Address DMZ Users WAN Users Destination Log select all delete enable oO disable add Note Inbound rules configured in the LAN WAN Rules page will take precedence over the Inbound rules configured in the DMZ WAN Rules page As a result if an inbound packet matches an Inbound rule in the LAN WAN Rules page then it will not be matched against the Inbound rules in the DMZ WAN Rules page Figure 4 4 3 Click Add under the Outbound Services table The Add DMZ WAN Outbound Service screen displays see Figure 4 5 on page 4 13 4 12 Firewall Protection and Content Filtering v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Add DMZ WAN Outbound Service Operation succeeded Service ANY v Action BLOCK always Select Schedule Schedule 1 Finish Finish QoS Priority Normal Service NAT IP WAN Interface Address Figure 4 5 4 Configure the settings based on the descriptions in Table 4 1 on page 4 3 5 Click Apply The new rule will appear in the Outbound Services table The rule is automatically enabled The procedure to add a new DMZ WAN inbound service policy is similar to the procedure described above with the exce
233. st The Profile purpose of bandwidth limiting is to provide a solution for limiting the outgoing or incoming traffic thus preventing the LAN users for consuming all the bandwidth of your Internet connection For more information see See Creating Bandwidth Profiles on page 4 27 Note Bandwidth limiting does not apply to the DMZ interface Note Some residential broadband ISP accounts do not allow you to run any server processes such as a Web or FTP server from your location Your ISP may periodically check for servers and may suspend your account if it discovers any active services at your location If you are unsure refer to the Acceptable Use Policy of your ISP Remember that allowing inbound services opens holes in your VPN firewall Only enable those ports that are necessary for your network It is also advisable to turn on the server application security and invoke the user password or privilege levels if provided Firewall Protection and Content Filtering 4 7 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Viewing Rules and Order of Precedence for Rules To view the firewall rules select Security from the main menu and Firewall from the submenu The LAN WAN Rules screen appears Figure 4 1 shows some examples As you define new rules they are added to the tables in the Rules menu as the last item in the list Security WOR LOE ite DMZ WAN Rules LAN DMZ Rules Attack C
234. st name as the Account Name on the Broadband ISP Settings screen see Figure 2 2 on page 2 4 Your ISP could be rejecting the Ethernet MAC addresses of all but one of your PCs Many broadband ISPs restrict access by only allowing traffic from the MAC address of your broadband modem but some ISPs additionally restrict access to the MAC address of a single PC connected to that modem If this is the case you must configure your VPN firewall to clone or spoof the MAC address from the authorized PC You can do this on the Broadband Advanced Options screen see Figure 2 10 on page 2 13 Restoring the Default Configuration and Password This section explains how to restore the factory default configuration settings changing the VPN firewall s administration password to password and the IP address to 192 168 1 1 You can erase the current configuration and restore factory defaults in two ways e Restore the VPN firewall to factory default settings from the Settings Backup and Firmware Upgrade screen see Reverting to Factory Default Settings on page 6 20 e Use the reset button on the rear panel of the VPN firewall Use this method for cases when the administration password or IP address is not known To restore the factory default configuration settings without knowing the administration password or IP address you must use the Factory Defaults button on the rear panel of the VPN firewall To restore the factory default
235. steps to set up a gateway VPN tunnel using the VPN Wizard 1 Select VPN from the main menu and VPN Wizard from the submenu The VPN Wizard screen displays ies CsCCertificat 8 VPN Wizard Default Values About YPN Wizard The Wizard sets most parameters to defaults as proposed by the VPN Consortium PNC and assumes a pre shared key which greatly simplifies setup After creating the policies through the VPN Wizard you can always update the parameters through the Policies menu This PN tunnel will connect to the following peers Gateway VPN Client ii Connection Name and Remote IP Type What is the new Connection Name What is the pre shared key r3snSreda Jew Length 8 49 Char What is the Remote WAN s IP Address or Internet Name 71 202 246 81 What is the Local WAN s IP Address or Internet Name 99 180 226 100 Secure Connection Remote Accessibility What is the remote LAN IP Address What is the remote LAN Subnet Mask Less Hess Iess o Figure 5 2 5 2 Virtual Private Networking v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual To view the wizard default settings click the VPN Wizard Default Values option arrow You can modify these settings after completing the wizard 2 Select Gateway as your connection type Create a Connection Name Enter a descriptive name for the connection This name used to help you manage the VPN settings is not suppli
236. t Period in minutes Yes No Advertisement Time To Live a in hops i UPnP Portmap Table 2 help Active Protocol Int Port Ext Port IP Address 10297 10297 102 168 1 5 10297 10297 102 168 1 5 refresh Figure 4 27 2 To enable the UPnP feature click the Yes radio button The feature is enabled by default To disable the feature click or No 4 40 Firewall Protection and Content Filtering v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual 3 Configure the following fields Advertisement Period Enter the period in minutes that specified how often the VPN firewall should broadcast its UPnP information to all devices within its range Advertisement Time to Live Enter a number that specifies how many steps hops each UPnP packet is allowed to propagate before being discarded Small values will limit the UPnP broadcast range 4 Click Apply to save your settings The UPnP Portmap Table shows the IP addresses and other settings of UPnP devices that have accessed the VPN firewall Active A Yes or No indicates if the UPnP device port that established a connection is currently active Protocol Indicates the network protocol such as HTTP or FTP that is used by the device to connect to the VPN firewall Int Port Indicates if any internal ports are opened by the UPnP device Ext Port Indicates if any external ports are opened by the UPnP devi
237. t Schedule Schedule 1 Send to LAN Server Single Address Start Finish Translate to Port Number LJ WAN Destination IP Address Broadband v Start Finish LAN Users Any Start Finish P WAN Users Start Finish Bandwidth Profile NONE Figure 4 3 2 Configure the settings based on the descriptions in Table 4 2 on page 4 6 Click Apply to save your changes and reset the fields on this screen The new rule will be listed in the Inbound Services table Firewall Protection and Content Filtering 4 11 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Configuring DMZ WAN Rules The firewall rules for traffic between the DMZ and the WAN Internet are configured on the DMZ WAN Rules screen The Default Outbound Policy is to allow all traffic from and to the Internet to pass through Firewall rules can then be applied to block specific types of traffic from either going out from the DMZ to the Internet outbound or coming in from the Internet to the DMZ inbound The default outbound policy can be changed to block all outbound traffic and enable only specific services to pass through the VPN firewall by adding an outbound services rule To create anew DMZ WAN outbound service policy 1 Select Security from the main menu and Firewall Rules from the submenu The LAN WAN Rules screen displays 2 Select the DMZ WAN Rules tab The DMZ WAN Rules screen di
238. t a firewall to protect the networks As part the new maintenance firmware release NETGEAR has implemented a more robust authentication system known as Two Factor Authentication 2FA or T FA on its SSL and IPsec VPN firewall product line to help address the fast growing network security issues What are the benefits of Two Factor Authentication e Stronger security Passwords cannot efficiently protect the corporate networks because attackers can easily guess simple passwords or users cannot remember complex and unique passwords One time passcode OTP strengthens and replaces the need to remember complex password e No need to replace existing hardware Two Factor Authentication can be added to existing NETGEAR products through via firmware upgrade Two Factor Authentication B 1 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual e Quick to deploy and manage The WiKID solution integrates seamlessly with the NETGEAR SSL and VPN firewall products e Proven regulatory compliance Two Factor Authentication has been used as a mandatory authentication process for many corporations and enterprises worldwide What is Two Factor Authentication Two factor authentication is a new security solution that enhances and strengthens security by implementing multiple factors to the authentication process that challenge and confirm the users identities before they can gain access to the network There are several facto
239. ta Encryption Standard DES 3DES Triple DES This is the default algorithm AES 128 Advanced Encryption Standard AES with a 128 bits key size e AES 192 AES with a 192 bits key size e AES 256 AES with a 256 bits key size The encryption key for he inbound policy The length of the key depends on the selected encryption algorithm DES enter 8 characters 3DES enter 24 characters e AES 128 enter 16 characters e AES 192 enter 24 characters e AES 256 enter 32 characters Key Out SPl Outgoing The encryption key for he outbound policy The length of the key depends on the selected encryption algorithm The required key lengths are the same as for the Key In se above The Security Parameters Index SPI for the outbound policy Enter a hexadecimal value between 3 and 8 characters for example 0x1234 5 28 Virtual Private Networking v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Table 5 3 Add VPN Policy Settings continued Item Integrity Algorithm Key In Description or Subfield and Description From the pull down menu select one of the following two algorithms to be used in the VPN header for the authentication process SHA 1 Hash algorithm that produces a 160 bit digest This is the default setting MD5 Hash algorithm that produces a 128 bit digest The integrity key for the inbound policy The length of the key depend
240. te and NTP servers 1 Select Administration from the main menu and Time Zone from the submenu The Time Zone screen displays see Figure 6 9 on page 6 22 VPN Firewall and Network Management 6 21 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Administration Remote Management SNMP Settings Backup amp Upgrade Time Zone Date Time GMT 08 00 Pacific Time Canada Pacific Time US v Automatically Adjust for Daylight Savings Time Use Default NTP Servers Use Custom NTP Servers Server 1 Name IP Address time b netgear com Server 2 Name IP Address time c netgear com Current Time Mon Mar 29 19 44 35 GMT 0700 2010 Figure 6 9 2 From the Date Time pull down menu select the local time zone This is required in order for scheduling to work correctly The VPN firewall includes a Real Time Clock RTC which it uses for scheduling 3 If supported in your region check the Automatically Adjust for Daylight Savings Time radio box 4 Select a NTP Server option by checking one of the following radio boxes e Use Default NTP Servers The RTC is updated regularly by contacting a NETGEAR NTP server on the Internet A primary and secondary backup server are preloaded e Use Custom NTP Servers To use a particular NTP server enter the name or IP address of the NTP Server in the Server 1 Name IP Address field You can enter the address of a backup NTP server in the Serve
241. teps A PDF of the Installation Guide is on the NETGEAR website at hittp kbserver netgear com Log in to the VPN Firewall After logging in you are ready to set up and configure your VPN firewall You can also change your password and enable remote management at this time See Logging into the VPN Firewall on page 2 2 Configure the Internet connection to your ISP During this phase you will connect to your ISP See Configuring the Internet Connection to Your ISP on page 2 4 Configure the WAN mode Select either NAT or classical routing See Configuring the WAN Mode on page 2 9 Configure dynamic DNS on the WAN port optional As an option configure your fully qualified domain names during this phase See Configuring Dynamic DNS on page 2 11 2 1 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual 6 Configure the WAN options optional As an option change the VPN firewall s Media Access Control MAC address the factory default MTU size and the port speed However these are advanced features and changing them is not usually required See Configuring the Advanced Broadband Options on page 2 13 Each of these tasks is detailed separately in this chapter The configuration of firewall and VPN features is described in later chapters s Note In this manual WAN port and broadband port both indicate the same port _ through which the VPN firewall con
242. tes screen shows the certificates issued to you by a CA and available for use Ohele Name Subject Name Serial Number Issuer Name Expiry Time select al delete Figure 5 24 For each self certificate the following information is listed e Name The name you used to identify this certificate e Subject Name This is the name that other organizations will see as the holder owner of this certificate This should be your registered business name or official company name Generally all of your certificates should have the same value in the Subject field e Serial Number This is a serial number maintained by the CA It is used to identify the certificate with in the CA 5 34 Virtual Private Networking v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual e Issuer Name The name of the CA that issued the certificate e Expiry Time The date on which the certificate expires You should renew the certificate before it expires Obtaining a Self Certificate from a Certificate Authority To use a self certificate you must first request the certificate from the CA then download and activate the certificate on your system To request a self certificate from a CA you must generate a Certificate Signing Request CSR for your VPN firewall The CSR is a file containing information about your company and about the device that will hold the certificate Refer to the CA for guidelines on the inf
243. teway Troubleshooting a TCP IP Network Using a Ping Utility Most TCP IP terminal devices and VPN firewalls contain a ping utility that sends an echo request packet to the designated device The device then responds with an echo reply Troubleshooting a TCP IP network is made very easy by using the Ping utility in your PC or workstation Testing the LAN Path to Your VPN Firewall You can ping the VPN firewall from your PC to verify that the LAN path to your VPN firewall is set up correctly To ping the VPN firewall from a PC running Windows 95 or later 1 From the Windows toolbar click Start and select Run 2 In the field provided type ping followed by the IP address of the VPN firewall for example ping 192 168 1 1 3 Click OK A message similar to the following should display Troubleshooting 7 5 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Pinging lt IP address gt with 32 bytes of data If the path is working you will see this message Reply from lt IP address gt bytes 32 time NN ms TTL xxx If the path is not working you will see this message Request timed out If the path is not functioning correctly you could have one of the following problems e Wrong physical connections Make sure the LAN port LED is on If the LED is off follow the instructions in LAN or Internet Port LEDs Not On on page 7 2 Check that the corresponding Link LEDs are on for your networ
244. the Add VPN Policy screen see Figure 5 21 on page 5 26 4 Modify the settings that you wish to change see Table 5 3 Click Apply to save your changes The modified VPN policy is displayed in the List of VPN Policies table Managing Certificates Digital Self Certificates are used to authenticate the identity of users and systems and are issued by various CAs Certification Authorities Digital Certificates are used by this VPN firewall during the IKE Internet Key Exchange authentication phase as an alternative authentication method The VPN firewall uses Digital Certificates also known as X509 Certificates during the Internet Key Exchange IKE authentication phase to authenticate connecting VPN gateways or clients or to be authenticated by remote entities The same Digital Certificates are extended for secure Web access via SSL VPN connections over HTTPS 5 30 Virtual Private Networking v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Digital Certificates can be either self signed or can be issued by Certification Authorities CA such as via an in house Windows server or by an external organization such as Verisign or Thawte However if the Digital Certificates contain the extKeyUsage extension then the certificate must be used for one of the purposes defined by the extension For example if the Digital Certificate contains the extKeyUsage extension defined to SNMPV2 then the same cert
245. the LAN TCP IP Setup section of the screen Primary DNS Server Optional If an IP address is specified the VPN firewall will provide this address as the primary DNS server IP address If no address is specified the VPN firewall will provide its own LAN IP address as the primary DNS server IP address Secondary DNS Server Optional If an IP address is specified the VPN firewall will provide this address as the secondary DNS server IP address WINS Server Optional Specifies the IP address of a local Windows NetBIOS Server if one is present in your network Lease Time This specifies the duration for which IP addresses will be leased to clients LAN Configuration 3 13 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual If you will use a Lightweight Directory Access Protocol LDAP authentication server for network validated domain based authentication select Enable LDAP Information to enable the DHCP server to provide LDAP server information Enter the following settings LDAP Server Specifies the name or the IP address of the device that hosts the LDAP server Search Base Specifies the distinguished name dn at which to start the search specified as a sequence of relative distinguished names rdn connected with commas and without any blank spaces For most users the search base is a variation of the domain name For example if your domain is yourcompany com your search base
246. the MAC Filtering Enable section 3 Select the action to be taken on outbound traffic from the listed MAC addresses e Block this list and permit all other MAC addresses e Permit this list and block all other MAC addresses 4 Enter a MAC Address in the Add Source MAC Address checkbox and click Add The MAC address will appear in the MAC Addresses table Repeat this process to add additional MAC addresses A valid MAC address is six colon separated pairs of hexadecimal digits 0 to 9 and a to f For example 01 23 45 ab cd ef 5 Click Reset to cancel a MAC address entry before adding it to the table or click Apply to save your settings You can edit the MAC address by clicking Edit in the Action column adjacent to the MAC Address To remove an entry from the table select the MAC address entry and click Delete To select all the list of MAC addresses click Select All A checkmark will appear in the box to the left of each MAC address in the MAC Addresses table 4 34 Firewall Protection and Content Filtering v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Configuring IP MAC Address Binding IP MAC binding allows you to bind an IP address to a MAC address and the other way around Some devices are configured with static addresses To prevent users from changing their static IP addresses IP MAC binding must be enabled on the VPN firewall If the VPN firewall detects packets with a matching IP addr
247. the VPN firewall and then specify the identifier in the field below Local Wan IP The WAN IP address of the VPN firewall When you select this option the Identifier field automatically shows the IP address of the selected WAN interface FQDN The Internet address for the VPN firewall e User FQDN The email address for a local VPN client or the VPN firewall DER ASN1 DN A distinguished name DN that identifies the VPN firewall in the DER encoding and ASN 1 format Identifier Depending on the selection of the Identifier Type pull down menu enter the IP address email address FQDN or distinguished name Identifier Type IKE SA Parameters From the pull down menu select one of the following ISAKMP identifiers to be used by the remote endpoint and then specify the identifier in the field below Local Wan IP The WAN IP address of the remote endpoint When you select this option the Identifier field automatically shows the IP address of the selected WAN interface FQDN The FQDN for a remote gateway User FQDN The email address for a remote VPN client or gateway DER ASN1 DN A distinguished name DN that identifies the remote endpoint in the DER encoding and ASN 1 format Identifier Depending on the selection of the Identifier Type pull down menu enter the IP address email address FQDN or distinguished name Encryption Algorithm Authentication Algorithm From the pull do
248. the default setting MD5 Hash algorithm that produces a 128 bit digest Virtual Private Networking 5 29 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Table 5 3 Add VPN Policy Settings continued Item Description or Subfield and Description PFS Key Group Select this checkbox to enable Perfect Forward Secrecy PFS and then select a Diffie Hellman DH group from the pull down menu The DH Group sets the strength of the algorithm in bits The higher the group the more secure the exchange From the pull down menu select one of the following three strengths e Group 1 768 bit Group 2 1024 bit This is the default setting Group 5 1536 bit Select IKE Policy Select an existing IKE policy that defines the characteristics of the Phase 1 negotiation Click the view selected button to display the selected IKE policy 5 Click Apply to save your settings The VPN policy is added to the List of VPN Policies table To edit a VPN policy 1 Select VPN from the main menu and Policies from the submenu The Policies submenu tabs appear with the IKE Policies screen in view see Figure 5 18 on page 5 16 2 Click the VPN Policies tab The VPN Policies screen displays see Figure 5 20 on page 5 24 3 In the List of VPN Policies table click the edit button to the right of the VPN policy that you want to edit The Edit VPN Policy screen displays This screen shows the same field as
249. the strength of the algorithm in bits The higher the group the more secure the exchange From the pull down menu select one of the following three strengths e Group 1 768 bit Group 2 1024 bit This is the default setting e Group 5 1536 bit Note Ensure that the DH Group is configured identically on both sides The period in seconds for which the IKE SA is valid When the period times out the next rekeying must occur The default is 28800 seconds 8 hours Enable Dead Peer Detection Note See also Configuring Keepalives and Dead Peer Detection on page 5 53 Select a radio button to specify whether or not Dead Peer Detection DPD is enabled e Yes This feature is enabled when the VPN firewall detects an IKE connection failure it deletes the IPsec and IKE SA and forces a reestablishment of the connection You must enter the detection period and the maximum number of times that the VPN firewall attempts to reconnect see below e No This feature is disabled This is the default setting Detection Period The period in seconds between consecutive DPD R U THERE messages which are sent only when the IPsec traffic is idle The maximum number of DPD failures before the VPN firewall tears down the connection and then attempts to reconnect to the peer The default is 3 failures Reconnect after failure count Virtual Private Networking 5 21 v1 1 August 2010 ProSaf
250. tion and or software v1 1 August 2010 PPP Copyright c 1989 Carnegie Mellon University All rights reserved Redistribution and use in source and binary forms are permitted provided that the above copyright notice and this paragraph are duplicated in all such forms and that any documentation advertising materials and other materials related to such distribution and use acknowledge that the software was developed by Carnegie Mellon University The name of the University may not be used to endorse or promote products derived from this software without specific prior written permission THIS SOFTWARE IS PROVIDED AS IS AND WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES INCLUDING WITHOUT LIMITATION THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE Zlib zlib h Interface of the zlib general purpose compression library version 1 1 4 March 11th 2002 Copyright C 1995 2002 Jean loup Gailly and Mark Adler This software is provided as is without any express or implied warranty In no event will the authors be held liable for any damages arising from the use of this software Permission is granted to anyone to use this software for any purpose including commercial applications and to alter it and redistribute it freely subject to the following restrictions 1 The origin of this software must not be misrepresented you must not claim that you wrote the original software If you
251. tions statistics collection performance and security The SNMP Configuration table lists the SNMP configurations by e IP Address The IP address of the SNMP manager e Port The trap port of the configuration e Community The trap community string of the configuration 6 16 VPN Firewall and Network Management v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual To create a new SNMP configuration entry 1 Select Administration from the main menu and SNMP from the submenu The SNMP screen displays Administration Settings Backup amp Upgrade Time Zone snmp system Info Subnet Mask select all delete Create New SNMP Configuration Entry IP Address Subnet Mask Port Community Add CH MH H CHM KH Ld e Figure 6 6 2 Under Create New SNMP Configuration Entry enter the IP address of the SNMP manager in the IP Address field and the subnet mask in the Subnet Mask field Note the following e Ifyou want to allow only the host address to access the VPN firewall and receive traps enter an IP Address of for example 192 168 1 100 with a subnet mask of 255 255 255 255 e Ifyou want to allow a subnet access to the VPN firewall through SNMP enter an IP address of for example 192 168 1 100 with a subnet mask of 255 255 255 0 The traps will still be received on 192 168 1 100 but the entire subnet will have access through the community string e If you want to make the VPN
252. to the connected device If a LAN port is connected to a 100 Mbps device verify that the port s LED is green If the port is 10 Mbps the LED will be amber If any of these conditions does not occur refer to the appropriate following section 7 1 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Power LED Not On If the Power and other LEDs are off when your VPN firewall is turned on e Make sure that the power cord is properly connected to your VPN firewall and that the power supply adapter is properly connected to a functioning power outlet e Check that you are using the 12 V DC power adapter supplied by NETGEAR for this product If the error persists you have a hardware problem and should contact technical support LEDs Never Turn Off When the VPN firewall is turned on the LEDs turns on for about 10 seconds and then turn off If all the LEDs stay on there is a fault within the VPN firewall If all LEDs are still on one minute after power up e Cycle the power to see if the VPN firewall recovers e Clear the VPN firewall s configuration to factory defaults This will set the VPN firewall s IP address to 192 168 1 1 This procedure is explained in Restoring the Default Configuration and Password on page 7 7 If the error persists you might have a hardware problem and should contact technical support LAN or Internet Port LEDs Not On If either the LAN LEDs or Internet LED do
253. ttings section of the screen configure the following fields Domain Name The name of the external domain that will be displayed on the login screen Retry Timeout The period in seconds that the VPN firewall should wait for a response from the RADIUS server Maximum Retry Count The number of attempts that the VPN firewall will make to contact the RADIUS server When this number is exceeded the connection to the RADIUS server cannot be set up Users Default Timeout The period in minutes that a user is automatically logged out when the connection is idle Click Reset to cancel the changes or click Apply to save the settings VPN Firewall and Network Management 6 13 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Enabling Remote Management Access Using the Remote Management screen you can allow an administrator on the Internet to configure upgrade and check the status of your VPN firewall You must be logged in locally to enable remote management see Logging into the VPN Firewall on page 2 2 Note Be sure to change the default configuration password of the VPN firewall to a very secure password The ideal password should contain no dictionary words from any language and should be a mixture of letters both upper and lower case numbers and symbols Your password can be up to 30 characters See Changing Passwords and Settings on page 6 8 for the procedure on how to do this
254. ubleshooting 7 5 technical specifications A Time daylight savings troubleshooting 7 8 setting 6 21 troubleshooting 7 7 Time Zone setting of 6 27 Time Zone screen 6 2 ToS See QoS tracert use with DDNS 6 6 traffic increasing 6 4 management 6 8 meter 2 14 reducing 6 2 troubleshooting 7 browsers 7 3 configuration settings using sniffer 7 3 defaults 7 3 ISP connection 7 4 testing your setup 7 6 Web configuration 7 3 Trusted Certificates 5 32 5 33 Trusted Domains building list of 4 33 two factor authentication WiKID 6 11 Two Factor Authentication See WiKID TZO com 2 11 U UDP flood 4 2 special rule 6 5 upgrade software 6 20 User Database 5 39 5 4 adding user 5 41 editing user 5 42 User Database screen 5 41 V VoIP voice over IP sessions 4 23 VPN Client configuring 5 5 VPN firewall Connecting 2 1 VPN Logs monitoring 6 35 VPN Logs screen 6 35 VPN passthrough 4 21 VPN Policies screen 5 4 5 6 VPN Policy Auto 5 23 Auto generated 5 15 Manual 5 23 VPN Tunnel Connection monitoring status 6 34 VPN tunnels IKE policies exchange mode 5 19 ISAKMP identifier 5 20 ModeConfig 5 19 XAUTH 5 22 increasing traffic 6 7 keepalive feature 5 27 NetBIOS 5 27 pre shared key 5 27 RSA signature 5 21 viewing VPN tunnel status 6 34 VPN Wizard Gateway tunnel 5 VPN Client configuring 5 5 VPNC 5 1 W WAN bandwidth capacity 6 1 configuring Advanced options 2 13 configuring WAN Mode 2 9 mon
255. uipment has been tested and found to comply with the limits for a Class B digital device pursuant to part 15 of the FCC Rules These limits are designed to provide reasonable protection against harmful interference in a residential installation This equipment generates uses and can radiate radio frequency energy and if not installed and used in accordance with the instructions may cause harmful interference to radio communications However there is no guarantee that interference will not occur in a particular installation If this equipment does cause harmful interference to radio or television reception which can be determined by turning the equipment off and on the user is encouraged to try to correct the interference by one or more of the following measures e Reorient or relocate the receiving antenna e Increase the separation between the equipment and receiver e Connect the equipment into an outlet on a circuit different from that to which the receiver is connected e Consult the dealer or an experienced radio TV technician for help EU Regulatory Compliance Statement The ProSafe Gigabit 8 Port VPN Firewall FVS318G is compliant with the following EU Council Directives 89 336 EEC and LVD 73 23 EEC Compliance is verified by testing to the following standards EN55022 Class B EN55024 and EN60950 1 Visit the NETGEAR EU Declarations of Conformity website at http kb netgear com app answers detail a_id 11621 sno 0 v1 1 Aug
256. ures Keyword Blocking 4 3 applying 4 33 Keyword Filtering 3 L LAN configuration 3 using LAN IP setup options 3 2 LAN DMZ Rules 4 3 LAN DMZ Rules screen 4 4 LAN Groups menu 3 7 LAN Security Checks 4 2 LAN Setup screen 3 3 6 36 LAN side bandwidth capacity 6 LAN WAN Inbound Services Rules about 4 11 add 4 11 example of 4 15 4 16 4 17 LAN WAN Outbound Rules about 4 0 example of 4 19 LAN WAN Rules default outbound 4 9 example of 4 16 LAN WAN Rules screen 4 9 LDAP overview 3 5 3 14 lease time 3 4 3 3 LEDs explanation of 6 troubleshooting 7 2 Lightweight Directory Access Protocol See LDAP logging in default login 2 2 Index 4 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual MAC address 7 7 blocked adding 4 33 configuring 2 5 format of 2 14 spoofing 7 5 main menu 2 3 MD5 IKE polices 5 20 VPN policies 5 29 ModeConfig 5 44 about 5 44 assigning remote addresses example 5 44 Client Configuration 5 50 IKE Policies menu configuring 5 45 menu configuring 5 45 record 5 19 testing Client 5 53 monitoring devices 6 33 by DHCP Client Requests 3 6 6 33 by Scanning the Network 3 6 6 33 MTU Size 2 13 Multi Home LAN IPs 3 10 Multicast pass through 4 2 multi NAT 4 16 N NAS Identifier 5 43 6 13 NAT configuring 2 0 features of 3 firewall use with 4 2 multi NAT 4 6 one to one mapping 2 0 NetBIOS bridging over VPN 5 55 V
257. ust 2010 Bestatigung des Herstellers Importeurs Es wird hiermit best tigt da das ProSafe Gigabit 8 Port VPN Firewall FVS318G gem der im BMPT AmtsblVfg 243 1991 und Vfg 46 1992 aufgef hrten Bestimmungen entst rt ist Das vorschriftsmafige Betreiben einiger Ger te z B Testsender kann jedoch gewissen Beschr nkungen unterliegen Lesen Sie dazu bitte die Anmerkungen in der Betriebsanleitung Das Bundesamt fiir Zulassungen in der Telekommunikation wurde davon unterrichtet da dieses Ger t auf den Markt gebracht wurde und es ist berechtigt die Serie auf die Erf llung der Vorschriften hin zu berpr fen Certificate of the Manufacturer Importer It is hereby certified that the ProSafe Gigabit 8 Port VPN Firewall FVS318G has been suppressed in accordance with the conditions set out in the BMPT AmtsblVfg 243 1991 and Vfg 46 1992 The operation of some equipment for example test transmitters in accordance with the regulations may however be subject to certain restrictions Please refer to the notes in the operating instructions Federal Office for Telecommunications Approvals has been notified of the placing of this equipment on the market and has been granted the right to test the series for compliance with the regulations Voluntary Control Council for Interference VCCI Statement This equipment is in the second category information equipment to be used in a residential area or an adjacent area thereto and conforms to the st
258. ute Am w all day or at specific times during the day End Time 12 Hour 00_ minute Pm All Day Specific Times Figure 4 20 2 Check the radio button for All Days or Specific Days If you chose Specific Days check the radio button for each day you want the schedule to be in effect 3 Check the radio button to schedule the time of day All Day or Specific Times If you chose Specific Times enter the Start Time and End Time fields Hour Minute AM PM which will limit access during certain times for the selected days 4 Click Apply to save your settings to Schedule 1 Repeat these steps to set to a schedule for Schedule 2 and Schedule 3 Blocking Internet Sites Content Filtering If you want to restrict internal LAN users from access to certain sites on the Internet you can use the VPN firewall s Content Filtering and Web Components filtering By default these features are disabled all requested traffic from any website is allowed If you enable one or more of these features and users try to access a blocked site they will see a Blocked by NETGEAR message Several types of blocking are available e Web Components blocking You can block the following Web component types Proxy Java ActiveX and Cookies Some of these components are can be used by malicious Websites to infect computers that access them Even sites on the Trusted Domains list will be subject to Web Components blocking when
259. vice ec ceeceeeeeeeseeeeeeseseeeeeees Restoring the Default Configuration and Password ccccecceeceeseeeeeeeeesteeeeeeenteeeeeess Using ihe Diagnostics UUES sicceustiitassiivecss saaa ivindeeoiage ieee Why do need Two Factor Authentication 0 cccseeeeseeeeseeeeeeeeeeaeeeeeeeeeeaeeeseneeeeaas B 1 What are the benefits of Two Factor Authentication 0 cccececeesseeeeeeeesteeeeeees B 1 What is Two Factor Authentication wss c2cceccsssazcesscsiccadendsisecdeha sissadeicasteesdaeialaat iia B 2 NETGEAR Two Factor Authentication Solutions ccccccecccceesssssscesceeeeeeeeeeeeseeseenees B 2 Appendix C Related Documents Index Contents xi v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual xii v1 1 August 2010 Contents About This Manual The NETGEAR ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual describes how to install configure and troubleshoot the ProSafe Gigabit 8 Port VPN Firewall FVS318G The information in this manual is intended for readers with intermediate computer and Internet skills Conventions Formats and Scope The conventions formats and scope of this manual are described in the following paragraphs e Typographical Conventions This manual uses the following typographical conventions Italics Emphasis books CDs file and server names extensions Bold User input IP addresses GUI screen text Fixed Com
260. wall and reboot your PC If your VPN firewall s IP address has been changed and you do not know the current IP address clear the VPN firewall s configuration to factory defaults This will set the VPN firewall s IP address to 192 168 1 1 This procedure is explained in Restoring the Default Configuration and Password on page 7 7 D Make sure your browser has Java JavaScript or ActiveX enabled If you are using Internet Explorer click Refresh to be sure the Java applet is loaded Tip If you do not want to revert to the factory default settings and lose your configuration settings you can reboot the VPN firewall and use sniffer to capture packets sent during the reboot Look at the ARP packets to locate the VPN firewall s LAN interface address 1AN Try quitting the browser and launching it again Make sure you are using the correct login information The factory default login name is admin and the password is password Make sure that Caps Lock is off when entering this information Troubleshooting 7 3 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual If the VPN firewall does not save changes you have made in the Web Configuration Interface check the following e When entering configuration settings be sure to click the Apply button before moving to another menu or tab or your changes are lost e Click the Refresh or Reload button in the Web br
261. will not change If a computer is assigned a static IP address you must to update this entry manually when the IP address of the computer changes MAC Address The MAC address of the computer s network interface Group Each PC or device can be assigned to a single group By default a computer is assigned to the first group Group 1 To change the group assignment by selecting the Edit button in the Action column Action Edit Allows modification of the selected entry LAN Configuration 3 7 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Adding Devices to the Network Database To add devices manually to the network database 1 To add computers to the network database manually make the following selections Name The name of the PC or device IP Address Type From the pull down menu choose how this device receives its IP address Select Fixed Set on PC if the IP address is statically assigned on the computer Select Reserved DHCP Client to direct the VPN firewall to reserve the IP address for allocation by the DHCP server see Setting Up DHCP Address Reservation on page 3 9 Es Note When assigning a reserved IP address to a client the IP address selected must be outside the range of addresses allocated to the DHCP server pool IP Address Enter the IP address that this computer or device is assigned If the IP Address Type is Reserved DHCP Client the VP
262. wn menu select one of the following five algorithms to negotiate the security association SA DES Data Encryption Standard DES 3DES Triple DES This is the default algorithm AES 128 Advanced Encryption Standard AES with a 128 bits key size e AES 192 AES with a 192 bits key size e AES 256 AES with a 256 bits key size From the pull down menu select one of the following two algorithms to use in the VPN header for the authentication process SHA 1 Hash algorithm that produces a 160 bit digest This is the default setting MDS Hash algorithm that produces a 128 bit digest 5 20 Virtual Private Networking v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual Table 5 2 Add IKE Policy Settings continued Item Authentication Method Description or Subfield and Description Select one of the following radio buttons to specify the authentication method e Pre shared key A secret that is shared between the VPN firewall and the remote endpoint e RSA Signature Uses the active Self Certificate that you uploaded on the Certificates screen see Managing Certificates on page 5 30 The Pre shared key is masked out when you select the RSA Signature option Pre shared key A key with a minimum length of 8 characters no more than 49 characters Do not use a double quote in the key Diffie Hellman DH Group SA Lifetime sec The DH Group sets
263. y accessing the PCs on the LAN the VPN firewall allows you to direct incoming traffic to specific PCs based on the service port number of the incoming request You can specify forwarding of single ports or ranges of ports e DMZ port Incoming traffic from the Internet is normally discarded by the VPN firewall unless the traffic is a response to one of your local computers or a service for which you have configured an inbound rule Instead of discarding this traffic you can have it forwarded to one computer on your network Autosensing Ethernet Connections with Auto Uplink With its internal 8 port 10 100 1000 Mbps switch and 10 100 1000 WAN port the FVS318G can connect to either a 10 Mbps standard Ethernet network a 100 Mbps Fast Ethernet network or a 1000 Mbps Gigabit Ethernet network The LAN and WAN interfaces are autosensing and capable of full duplex or half duplex operation The VPN firewall incorporates Auto Uplink technology Each Ethernet port will automatically sense whether the Ethernet cable plugged into the port should have a normal connection such as to a PC or an uplink connection such as to a switch or hub That port will then configure itself to the correct configuration This feature also eliminates the need to worry about crossover cables as Auto Uplink will accommodate either type of cable to make the right connection Introduction 1 3 v1 1 August 2010 ProSafe Gigabit 8 Port VPN Firewall FVS318G Ref
264. yption Algorithm Authentication Algorithm Authentication Method Pre shared key ORSA Signature Pre shared key Key Length 8 49 Char Diffie Hellman DH Group Enable Dead Peer Detection Yes O No Detection Period Seconds Reconnect after failure count Figure 5 40 4 Click the Yes radio button to Enable Dead Peer Detection Enter the Detection Period to set the interval between consecutive DPD R U THERE messages DPD R U THERE messages are sent only when the IPSec traffic is idle The default is 10 seconds 6 In Reconnect after failure count set the number of DPD failures allowed before tearing down the connection The default is 3 failures When the VPN firewall detects an IKE connection failure it deletes the IPSec and IKE Security Association and forces a reestablishment of the connection 7 Click Apply at the bottom of the screen Configuring NetBIOS Bridging with VPN Windows networks use the Network Basic Input Output System NetBIOS for several basic network services such as naming and neighborhood device discovery Because VPN routers do not normally pass NetBIOS traffic these network services do not work for hosts on opposite ends of a VPN connection To solve this problem you can configure the VPN firewall to bridge NetBIOS traffic over the VPN tunnel To enable NetBIOS bridging on a configured VPN tunnel follow these steps 1 Select VPN from the main menu and Policies from the submenu

Netgear Modem FVS318G User's Manual

Contents

Download Pdf Manuals

Related Search

Related Contents