NETGEAR FVS338 manuale d’uso

September 2006 202-10046-03 v1.0 NETGEAR , Inc. 4500 Great America Parkway Santa Clara, CA 95054 USA FVS338 ProSafe VPN Firewall 50 Reference Manual[...]

ii v1.0, September 2006 © 2006 by NETGEAR, Inc. All rights reserved. T rademarks NETGEAR, the NETGEAR logo a nd ProSafe are trademarks and/or regist ered trademarks of Netgear , Inc. Microsoft, W indows, and W indow s NT are registered trademar ks of Microsoft Corporation. Other brand and product names are registered tradem arks or trademarks o f [...]

v1.0, September 2006 iii Federal Of fice for T elecommuni cations Approvals has been notified of the placing of this equipment on the market and has been granted the right to test the series for complianc e with the regulations. V olunt ary Control Council for Interfe rence (VCCI) St atement This equipment is in the second category (information equ[...]

v1.0, Septembe r 2006 iv Open SSL Copyright (c) 1998-2000 The OpenSSL Project. All rights reserved. Redistribution and use in source and binary forms, with or withou t modification, are permitte d provided that the follo wing conditions * are me t: 1. Redistributions of source code must retain the above copyrigh t notice, this list of co nditions a[...]

v1.0, September 2006 v MD5 Copyright (C) 1990, RSA Data Se curity , Inc. All rights reserved. License to copy and u se this software is granted provided that it is id entified as the "RSA Data Security , Inc. MD5 Message-Digest Algori thm" in all material mentioning or referencing this software or this function. License is also gr anted t[...]

v1.0, Septembe r 2006 vi Product and Publication Det ails Model Number: FVS338 Publication Date: September 2006 Product Family: VPN firewall Product Name: ProSafe VPN Firewall 50 Home or Business Prod uc t: Business Language: Engl ish Publication Part Number: 202-10046-03 Publication V ersion Number 1.0[...]

vii v1.0, September 2006 Content s About This Manual Conventions, Formats and Scope ................ ................ ............. ................ ............. ......... xiii How to Use This Manual ........................ ................ ............. ................ ............. ................ xiv How to Print this Manual .............. .[...]

viii v1.0, September 2006 Manually Configuring Y our Internet Connecti on ........... .......................... .................. 2-9 Programming the T raffic Meter (if Desired) ..... ............. ............. ............. ................ 2-12 Configuring the WAN Mode ... ................ .......... ... ............. ............. ...........[...]

ix v1.0, September 2006 S pecifying Qualit y of Service (QoS) Priorities . ... ... ... .... ... ... ... .... ... ... ... ............. ... .... ... ... 4-19 Setting a Schedule to Block or Allow T raffic ............. .... ... ... ... .... ... ............. ... ... ... .... ... ... 4-20 Setting Block Sites (C ontent F iltering) ...... ..............[...]

x v1.0, September 2006 Configuring the ProSafe VPN Client for Mode Config ................... ....... ...... ....... ...... 5-30 Certificates ............. ................ ................ ................ ................ ................. ................ .... .. 5-33 T r usted Certificates (CA Certificates) ........ ................ ...........[...]

xi v1.0, September 2006 DHCP Log ............. ............. ................ ............. ................ ............. ............. ............. 6-25 Performing Diagnostics ................ ............. ............. ............. ............. ............ .......... 6-26 Chapter 7 T roubleshooting Basic Functions .................. .......[...]

xii v1.0, September 2006[...]

xiii v1.0, September 2006 About This Manual The NETGEAR ® ProSafe™ VPN Fir ewall 50 FVS338 Refer ence Manual describes how to install, configure and trou bleshoot the ProSafe VPN Fire wall 50. The information i n this manual is intended for readers with intermedia te computer and Internet skills. Conventions, Format s and Scope The conventions, [...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual xiv v1.0, September 2006 • Scope. This manual is written for the VPN fir ewall according to these specifications: For more information about networ k, Internet, firewall, and VPN technologies, see the links to the NETGEAR website in Appendix B, “Related Documents” . How to Use This Manual The [...]

FVS338 ProSafe VPN Firewall 50 Reference Manual xv v1.0, September 2006 • Click the PDF of This Chapter link at the top left of any page in the chapter you want to print. The PDF version of the chapter you were viewing opens in a bro wser window . • Click the print icon in the upper left of your browser window . – Printing a PDF version of th[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual xvi v1.0, September 2006[...]

Introduction 1-1 v1.0, September 2006 Chapter 1 Introduction The ProSafe VPN Firewall 50 with 8 port switch c onnects your local area network (LAN) to the Internet through an extern al access device such as a cable modem or DSL modem. The FVS338 is a complete security solution that protects your network from attacks and intrusions. For example, the[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 1-2 Introduction v1.0, September 2006 Full Routing on Both the Br oadband and Serial W AN Port s Y ou can install, configure, and op erate the FVS338 to take full advantage of a variety of routing options on both the serial and b roadband W A N ports, including: • Internet access via either the se[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Introduction 1-3 v1.0, September 2006 • Port Forwarding with NA T . Although NA T prevents Intern et locations from directly accessing the PCs on the LAN, the firewall allows you to direct incomi ng traffic to specific PCs based on the service port number of the incoming request. Y ou can specify fo[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 1-4 Introduction v1.0, September 2006 T rend Micro Integration If you have installed the T rend Micro Client/S erver/Messa ging Suite for SMB on your local network, you can have the firewall enforce its use. When Antivirus Enforcement is selected, local PCs will not be allowed W eb access unless the[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Introduction 1-5 v1.0, September 2006 • Remote management. The firewall allows you to secure ly login to the W eb Management Interface from a remote location on the Internet. For additio nal security , you can limit remote management access to a specified remote IP a ddress or range of addresses, an[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 1-6 Introduction v1.0, September 2006 Router Front Panel The ProSafe VPN Firewall 50 front panel show n be low contains the port con n ections, status LEDs, and the factory de faults reset button. The table below describes each item on the front panel and its operation. Figure 1-1 T able 1-1. Object[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Introduction 1-7 v1.0, September 2006 Router Rear Panel The rear panel of the ProSafe VPN Firewall 50 ( Figure 1-2 ) contains the On/Off switch and AC power connection. V iewed from left to right, the rear panel contains the following elements: • Modem port – serves as the W AN2 Internet port thro[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 1-8 Introduction v1.0, September 2006 Rack Mounting Hardware The FVS338 can be mounted either on a des ktop (using included rub b er feet) or in a 19-inch rack (using the included rack moun ting hardware illustrated in Figure 1-3 ). Factory Default Login Check the label on the bottom of the FVS3 38?[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Introduction 1-9 v1.0, September 2006 T o log in to the FVS3 38 once it is connected: 1. Open a W eb browser . 2. Enter http://192.168.1.1 as the URL. 3. Once the login screen displays ( Figure 1-5 ), enter the following: • admin for User Name • password for Password Figure 1-5[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 1-10 Introduction v1.0, September 2006[...]

2-1 v1.0, September 2006 Chapter 2 Connecting the FVS338 to the Internet This section provides instructio ns for connecting the VPN firewa ll. Setting up VPN tunnels are covered in Chapter 5, “V irtual Private Networking” : 1. Connect the fir ewall physi cally to your network . Connect the cables, tu rn on your ro uter and wait for the T est LE[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 2-2 Connecting the FVS338 to the Intern et v1.0, September 2006 T o log in to the VPN firewall: 1. Open a Internet Explorer , Netscape® Navigator , or Firefox browser . In the browser window , enter http://192.168.1.1 in the address field. The FVS338 login screen will display . 2. Enter admin for t[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Connecting the FVS3 3 8 to the Internet 2-3 v1.0, September 2006 2. Click Auto Detect at the bottom of the screen to automatic ally detect the type of Internet connection provided by your IS P . Auto Detect will probe for different connection methods and suggest one that your ISP will most likely su p[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 2-4 Connecting the FVS338 to the Intern et v1.0, September 2006 3. Click Connection S tatus at the top right of the screen to verify your Broadband con nection status. Click Conne ct if connection not already present. If Auto Detect does not find a connection, you will be prompted to check the physi[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Connecting the FVS3 3 8 to the Internet 2-5 v1.0, September 2006 1. Select Network Configuration from the main menu, W AN Se tti ng s from the submenu and click the Dialup ISP Settings tab to display the Dialup settings screen. 2. Enter the following Dialup Account settings: a. Account/User name : Ent[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 2-6 Connecting the FVS338 to the Intern et v1.0, September 2006 3. Specify the method to use for your Dial-up Connection S tatus. The VPN firewall can automatically dial to the ISP wh en a connection is needed or can be configured to wait for manual intervention.: a. Check the Connect automatically [...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Connecting the FVS3 3 8 to the Internet 2-7 v1.0, September 2006 Set up the traffic meter for the Dialup ISP if desired (see “Programming the T raffic Meter (if Desired)” on page 2-12 ). Setting the Router ’ s MAC Address (Advanced Options) Each computer or router on your network has a unique 48[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 2-8 Connecting the FVS338 to the Intern et v1.0, September 2006 This could occur on some older broadband modems. If you k now that the Ethernet port on your broadband mo dem supports 100Bas eT , select 100BaseT ; oth erwise, select 10BaseT . Use the half-duplex settings if full-duplex modes do not w[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Connecting the FVS3 3 8 to the Internet 2-9 v1.0, September 2006 . Manually Configuring Y o ur Internet Connection If you know your Broadband ISP connection type, you can bypass the Auto Detect feature and connect your router manually . Ensure that you h ave all of the relevant c onnection information[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 2-10 Connecting the FVS338 to the Intern et v1.0, September 2006 T o manually configure your W AN1 ISP setting s: 1. Does your Internet connection require a login ? If you need to enter login information every time you connect to the Internet through your ISP , select Y es. Otherwise, select No. 2. [...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Connecting th e FVS33 8 to the In te rn et 2-11 v1.0, September 2006 – Domain Name : Y our domain name or workgroup name assigned by your ISP , or your ISPs domain name. Y ou may leave this field blank. – Idle Timeout : Check the Keep Connected radio bo x to keep the connection always on. T o logo[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 2-12 Connecting the FVS338 to the Intern et v1.0, September 2006 4. If your ISP has not assigned any Domain Name Servers (DNS) addresses, select the Get dynamically from ISP radio box. If your ISP has a ssigned DNS addresses, select the Use these DNS Servers radio box. Ensure that you fill in valid [...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Connecting th e FVS33 8 to the In te rn et 2-13 v1.0, September 2006 Figure 2-8[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 2-14 Connecting the FVS338 to the Intern et v1.0, September 2006 T able 2-2. T raffic Meter Settings Parameter Description Enable T raffic Meter Check this if you wish to record the volume of Internet traffic passing through the Router's Broadband or Dial up po rt. Broadband or Dialup can be se[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Connecting th e FVS33 8 to the In te rn et 2-15 v1.0, September 2006 Configuring the W AN Mode The WA N M o d e screen allows you to configure how your router uses your external Internet connections; for example, your W AN port or dialup modem co nnections. • NA T . NA T is the technology which allo[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 2-16 Connecting the FVS338 to the Intern et v1.0, September 2006 • If you have both ISP lin ks co nnected for Internet connectivity , check the Primary Broadband with Dialup as backup for auto-rollover . 4. The W AN Failure Detection Method must be config ured to notify the router of a link failur[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Connecting th e FVS33 8 to the In te rn et 2-17 v1.0, September 2006 This router firmware includes software that not ifies dynamic DNS servers of changes in the W AN IP address, so that the services running on this network can be acce ssed by others on the Internet. After you have configured y our acc[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 2-18 Connecting the FVS338 to the Intern et v1.0, September 2006 2. Check the Dynamic DNS Service radio box you wa nt to enable. The fields corresponding to the selection you have selected will be highl ighted. Each DNS service provider requires its own parameters. 3. Access the W eb site of one of [...]

LAN Configuration 3-1 v1.0, September 2006 Chapter 3 LAN Configuration This chapter describes how to configure LAN Setu p, LAN Groups and Routin g (Static IP) features of your ProSafe VPN Firewall 50. These features can be found under the Network Configuration menu of the router interface. Configuring Y our LAN (Local Area Network) By default, the [...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 3-2 LAN Configuration v1.0, September 2006 T o modify your LAN setup: 1. Select Network Configuration from the main menu and LAN Setup from the submenu. The LAN Setup screen will display . 2. Enter the IP Address of your router (factory default: 192.168.1.1 ). (Always make sure that the LAN Port IP [...]

FVS338 ProSafe VPN Firewall 50 Reference Manual LAN Configuration 3-3 v1.0, September 2006 b. Enter the S tarting IP Address . This address specifies the firs t of the contiguous addresses in the IP address pool. Any new DHCP client joining the LAN will be assigned an IP address between this address and the Ending IP Address. The IP address 192.168[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 3-4 LAN Configuration v1.0, September 2006 Configuring Multi-Home LAN IPs If you have computers that are using different IP address ranges in the LAN (for example, 172.16.2.0 or 10.0.0.0), then yo u can add “aliases” to the LAN port which give computers on those networks access to the Internet. [...]

FVS338 ProSafe VPN Firewall 50 Reference Manual LAN Configuration 3-5 v1.0, September 2006 Managing Group s and Hosts The Known PCs and Devices table on th e Groups and Hosts screen contains a list of all known PCs and network devices, as well as hosts, that ar e assigned dynamic IP addresses by this router . Collectively , these entries make up th[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 3-6 LAN Configuration v1.0, September 2006 • A computer is identified by its MAC address —not its IP address. Hence, changing a computer ’ s IP address does not affect any restrictions applied to that PC. This Known PCs and Devices table lists entries in the Network Database. For each computer[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual LAN Configuration 3-7 v1.0, September 2006 T o edit an entry in the Known PCs and Devices table: 1. Click Edit adjacent to the entry you want to modify . The Edit Known PCs and Devices screen will display . Make your modifications to the entry . 2. Click Apply to save your settings. The changes will a[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 3-8 LAN Configuration v1.0, September 2006 Setting Up Address Reservation When you specify a reserved IP address for a de vice on the LAN (based on the MAC address of the device), that computer or device will always receive the same IP address each time it accesses the firewall’ s DHCP server . Re[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual LAN Configuration 3-9 v1.0, September 2006 5. Ty p e t h e Destination IP Address or network of the route’ s final destination. 6. Enter the IP Subnet Mask for this destinat ion. If the des tination is a single host, enter 255.255.255.2 55. 7. From the Interface pull-down menu, selection the phys ic[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 3-10 LAN Configuration v1.0, September 2006 • Y ou have an ISDN firewall on your home network for con necting to the company where you are employed. This firewall’ s address on your LAN is 192.168.1 .100. • Y our com pany’ s network is 13 4.177.0.0. When you first con figured your firewall, [...]

FVS338 ProSafe VPN Firewall 50 Reference Manual LAN Configuration 3-11 v1.0, September 2006 T o enable RIP: 1. Select Network Configuration from the main menu and Routing from the submenu. The Routing screen will display . 2. Click the RIP Configuration link. The RIP Configuration screen will display . 3. From the RIP Direction pull-down menu, sele[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 3-12 LAN Configuration v1.0, September 2006 • None – the router neither broadcasts its rout e table nor does it accept any RIP packets from other routers. This effectively disables RIP . 4. Select the RIP V ersion from the pull-down menu: • RIP-1 – classful routing and does not include subne[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual LAN Configuration 3-13 v1.0, September 2006 3. Enter the IP address of the OfficeScan Server on your local network. 4. Enter the 5-digit port number us ed for communic ations between the OfficeScan clients and the server . 5. Click Apply to enable T rend Micro. The Host Exclusion List table lists PCs [...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 3-14 LAN Configuration v1.0, September 2006[...]

Firewall Protection and Conten t Filtering 4-1 v1.0, September 2006 Chapter 4 Firewall Protection and Content Filtering The ProSafe VPN Firewall 50 provides you with W e b content filtering options such as Block Sites and Keyword Blocking. Parents and network administ rators can establish re stricted access policies based on time-of-day , W eb addr[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 4-2 Firewall Protection and Content Filtering v1.0, September 2006 • Outbound : Allow all access from the LAN side to the outside. Services-Based Rules The rules to block traffic are based on the traffic’ s category of service. • Inbound Rules (port forwarding ). Inbound traffic is normally bl[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Firewall Protection and Content Filtering 4- 3 v1.0, September 2006 T able 4-1. Outbound Rules Fields Item Description Services Select the desired Service or appli c ati on to be covered by this rule. If the desired service or application does not appear in the list, you must define it using the Servi[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 4-4 Firewall Protection and Content Filtering v1.0, September 2006 Inbound Rules (Port Forwarding) Because the FVS338 uses N etwork Address T ransla tion (NA T), your network presents only one IP address to the Internet and outside users cannot directly address any of your local computers. However ,[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Firewall Protection and Content Filtering 4- 5 v1.0, September 2006 T able 4-2. Inbound Rules Fields Item Description Services Select the desired Service or appli c ati on to be covered by this rule. If the desired service or application does not appear in the list, you must define it using the Servic[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 4-6 Firewall Protection and Content Filtering v1.0, September 2006 Remember that allowing inbound services opens holes in your VPN firewall. Only enable those ports that are necessary fo r your network. It is also advisable to turn on the server application security and invoke the user password or p[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Firewall Protection and Content Filtering 4- 7 v1.0, September 2006 Setting LAN W AN Rules The Default Outbound Policy is to allow all traf fic from and to the Inte rnet to pass through. Firewall rules can then be applie d to block specific types of traf fic from either go ing out from the LAN to the [...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 4-8 Firewall Protection and Content Filtering v1.0, September 2006 • Down – to move the rule down on e position in the table rank. 2. Check the radio box adjacen t to the rule and click: • Click Disable to disable the rule. The “!” S tatus icon will change from green to grey , indicating t[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Firewall Protection and Content Filtering 4- 9 v1.0, September 2006 . LAN W AN Inbound Services Rules This Inbound Services Rules tabl e lists all existing rules for in bound traf fic. If you have not defined any rules, no rules will be listed. By default, all inbound traffic is blocked. W AN Users : [...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 4-10 Firewall Protection and Content Filtering v1.0, September 2006 Att ack Checks This screen allows you to specify whether or no t the router should be protected against common attacks in the LAN and W AN networks. The vari ous types of attack checks are listed on the Attack Checks screen and defi[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Firewall Protection and Content Filtering 4 -11 v1.0, September 2006 • LAN Security Ch ecks. A UDP flood is a form of denial of service attack that can be initiated when one machine sends a large nu mber of UDP packets to random ports on a remote host. As a result, the distant host will (1) check fo[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 4-12 Firewall Protection and Content Filtering v1.0, September 2006 . Inbound Rules Examples Hosting A Local Public W eb Server If you host a public W eb server on your local network, you can define a rule to allow inbound W eb (HTTP) requests from any outside IP address to the IP address of your W [...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Firewall Protection and Content Filtering 4 -13 v1.0, September 2006 Allowing Vi deoconference from Restricted Addresses If you want to allow incoming vi deoconferencing to be initiated from a restricted range of outside IP addresses, such as from a branch office, you can create an inbound rule. In th[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 4-14 Firewall Protection and Content Filtering v1.0, September 2006 3. From the service pull-down menu, sel ect the HTTP se rvice for a W eb server . 4. From the Action pull-down menu, select Allow Always. 5. In the Send to LAN Server field, enter th e local IP address of your W eb server PC. 6. Fro[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Firewall Protection and Content Filtering 4 -15 v1.0, September 2006 . T o test the connection from a PC on the Internet, type http:// <IP_address> , where <IP_address> is the public IP address you have mapped to your W eb server . Y ou should see the home page of your W eb server . Spec i[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 4-16 Firewall Protection and Content Filtering v1.0, September 2006 Outbound Rules Example – Bl ocking Inst ant Messenger Outbound rules let you prev ent users from using applications such as AOL Instant Messenger , Real Audio or othe r non-essential sites. If you want to block AOL Instant Messeng[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Firewall Protection and Content Filtering 4 -17 v1.0, September 2006 . Adding Customized Services Services are functions performed by server computer s at the request of clie nt computers . Y ou ca n configure up to 125 custom services. For example, W eb servers serve W eb pages, time servers serve ti[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 4-18 Firewall Protection and Content Filtering v1.0, September 2006 T o add a service: 1. Select Security from the main menu and Services from the submenu. The Services screen will display . 2. In the Add Custom Service table, enter a descriptive name for the service (this is for your convenience). [...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Firewall Protection and Content Filtering 4 -19 v1.0, September 2006 T o edit the parameters of a service: 1. In the Custom Services T able, click the Edit icon adjacent to the serv ice you want to edit. The Edit Service screen will display . 2. Modify the parameters you wish to change. 3. Click Reset[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 4-20 Firewall Protection and Content Filtering v1.0, September 2006 Setting a Schedule to Block or Allow T raffic If you defined an outbound or inbound rule to use a schedule, you can set up a schedule for when blocking occurs or when access is restricted. Th e firewall allows you to specify when bl[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Firewall Protection and Content Filtering 4 -21 v1.0, September 2006 Setting Block Sites (Content Filtering) If you want restrict internal LAN users from access to certain sites on the Internet, you can use the VPN firewall’ s Content Filtering and W eb Components f iltering. By default, these featu[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 4-22 Firewall Protection and Content Filtering v1.0, September 2006 5. Build your list of block ed Keywor ds or Domain Names in the Blocked Keyword fields. After each entry , click Add. The Keyword or Domain name will be added to the Blocked Keywords table. (Y ou can also edit a n entry by clicking [...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Firewall Protection and Content Filtering 4 -23 v1.0, September 2006 Enabling Source MAC Filtering Source MAC Filter allows you to filter out tr af fic coming from certain known machines or devices. • By default, the source MAC address filter is disabled. All the traf fic received from PCs with any [...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 4-24 Firewall Protection and Content Filtering v1.0, September 2006 3. Build your list of Source MAC Addresses to be block by entering the first MAC a ddress in the MAC Address field in the form xx:xx:xx:xx:xx:xx wh ere x is a numeric (0 to 9) or an alphabet between and a and f (inclusi ve), for exa[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Firewall Protection and Content Filtering 4 -25 v1.0, September 2006 T o add a Port triggering rule: 1. Select Security from the main menu and Port T riggering from the submenu. The Port T riggering screen will display . 1. Enter a user-def ined name for this rule in the Name field. 2. From the Enable[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 4-26 Firewall Protection and Content Filtering v1.0, September 2006 b. Enter the End Port range (1 - 65534). 5. In the Incoming (Response) Port Range fields: a. Enter the St a r t P o r t range (1 - 65534). b. Enter the End Port range (1 - 65534). 6. Click Add. The Port T riggering Rule will be adde[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Firewall Protection and Content Filtering 4 -27 v1.0, September 2006 E-Mail Notifications of Event Logs and Alert s The Firewall Logs can be configure d to log an d then e-mail denial of access, ge neral attack information, and other information to a specified email address. For example, your VPN fire[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 4-28 Firewall Protection and Content Filtering v1.0, September 2006 : T o set up Firewall Logs and E-mail alerts: 1. Select Monitoring from the main me nu and then Fir ewall Logs & E-mail from the submenu. The Fir ewall Logs & E-mail screen will display . 2. Enter the name of the log in the [...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Firewall Protection and Content Filtering 4 -29 v1.0, September 2006 4. In the Security Logs section, check the network segment s radio box for which you would like logs to be sent (for example, L AN to W AN under Dropped Packets). 5. In the System Logs section, check the radio box for the ty pe of sy[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 4-30 Firewall Protection and Content Filtering v1.0, September 2006 T o view the Firewall logs: 1. Click on the Vi e w L o g icon opposite the Firewall Logs & E-mail tab. The Logs screen will display . 2. If the E-mail Logs options as been enabled, you can send a copy of the log by clicking send[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Firewall Protection and Content Filtering 4 -31 v1.0, September 2006 Administrator Information Consider the following operational items: 1. As an option, you can en able remote manageme nt if you have to manage distant sites from a central location (see “Enabling Remote Management Access” on page [...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 4-32 Firewall Protection and Content Filtering v1.0, September 2006[...]

Virtual Private Networking 5-1 v1.0, September 2006 Chapter 5 V irtual Private Networking This chapter describes how to u se the V irtua l Private Networking (VPN) features of the VPN firewall. VPN tunnels provide secure, encrypted communications between your local network an d a remote network or computer . Dual W AN Port Systems The dual W AN por[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 5-2 Virtual Private Networking v1.0, September 2006 Setting up a VPN Connect ion using the VPN Wizard Setting up a VPN tunnel connection requires that al l settings and parameters on both sides of the VPN tunnel match or mirror each other pre cisely , whic h can be a daunting tas k. The VPN W izard [...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Virtual Private Networking 5-3 v1.0, September 2006 The Local W AN IP address is the address used in the IKE negotiation phase. Automatically , the W AN IP address assigned by your ISP may display . Y ou can modify the address to use your FQDN; required if the W AN Mode you selected is auto-rollover .[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 5-4 Virtual Private Networking v1.0, September 2006 6. Click Apply . The VPN Client screen will display showing that the VPN Client has been enabled. Click the IKE Policies tab to view the corresponding IKE Client Poli cy . IKE Policies The IKE (Internet Key Exchange) protocol performs negotiations [...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Virtual Private Networking 5-5 v1.0, September 2006 IKE Policy T able When you use the VPN W izard to set up a VPN tu nnel, an IKE Policy is established and populated in the Policy T able and is given the same name as the new VPN connectio n name. Y ou can also edit exiting policies or add new IKE pol[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 5-6 Virtual Private Networking v1.0, September 2006 • Manual . All settings (including the keys) for the VP N tunnel are manually input at each end (both VPN endpoints). No third party se rver or organization is involved. • Auto . Some parameters for the VPN tunnel are generated automatically by[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Virtual Private Networking 5-7 v1.0, September 2006 • Local . IP address (either a single address, range of address or subnet ad dre ss) on your local LAN. T raffic must be from (or to) these addre sses to be covered by this policy . (Subnet address is the default IP address when using the VPN W iza[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 5-8 Virtual Private Networking v1.0, September 2006 Creating a VPN Gateway Conn ection: Between FVS338 and FVX538 This section describes how to configure a VP N connection between a NETGEAR FVS338 VPN Firewall and a NETGEAR FVX538 VPN Firewall. Using each firewall's VPN W izard, we will create [...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Virtual Private Networking 5-9 v1.0, September 2006 The IKE Policies screen will display showin g the new “to_fvx” policy . Y ou can view the IKE para meters by clicking Edit in the Action column adjacent to the “to- fvs” policy . It should not be necessary to make any changes. Figure 5-1 Figu[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 5-10 Virtual Private Ne tworking v1.0, September 2006 Click the IKE Policies tab to view the corresp onding IKE Policy . The IKE Policies screen will display . Y ou can view the VPN parameters by clicking Edit in the Actions column adjacent to “to_fvx”. It should no t be n ecessary to make any c[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Virtual Private Ne tworking 5-11 v1.0, September 2006 Configuring the FVX538 T o configure the FVX538 using the VPN W izard: 1. Select VPN from the main menu. The Policies screen will display . Click the VPN Wizard link. The VPN Wizard screen will display . 2. Check the Gateway radio box to establish [...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 5-12 Virtual Private Ne tworking v1.0, September 2006 6. Enter the remote LAN IP address and subnet mask. 7. Click Apply to create the “to_fvs” IKE and VPN policies. T e sting the Connectio n 1. From a PC on either firewa ll’ s LAN, try to ping a PC on the other firewall’ s LAN. Establishing[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Virtual Private Ne tworking 5-13 v1.0, September 2006 Using the FVS338 VPN W izard, we will create a si ngle set of policies (IKE and VPN) that will allow up to 50 remote PCs to connect from locatio ns in which their IP addresses are un known in advance. The PCs may be directly connected to the Intern[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 5-14 Virtual Private Ne tworking v1.0, September 2006 Configuring the VPN Client On a remote PC that has a NETGEAR ProSafe VPN C lient installed, configure the client using the FVS338 VPN Client default parameters (display ed in both the IKE Policy table and the VPN Policy table of the FVS338 under [...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Virtual Private Ne tworking 5-15 v1.0, September 2006 T o configure the VPN Client: 1. Right-click on the VPN client icon in your W indows toolbar and select the Security Pol icy Editor . The Security Policy Editor screen will display . 2. In the upper left of the Polic y Editor window , click the New[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 5-16 Virtual Private Ne tworking v1.0, September 2006 8. In the left frame, click on My Identity (shown in Figure 5-1 0 ). 9. From the Select Certificate pull-down menu, select None . 10. From the ID T ype pull-down menu, select Domain Name . The value entered under Domain Name will be in the form ?[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Virtual Private Ne tworking 5-17 v1.0, September 2006 12. Before leaving the My Identity menu, click Pr e-Shared Key . 13. Click Enter Key , and type your preshared key . Click OK . This key will be shared by all users of the FVS338 policy “home”. Figure 5-10 Figure 5-1 1 10.0.0.12 home11.fvs_remo[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 5-18 Virtual Private Ne tworking v1.0, September 2006 14. In the left frame, click Security Policy (shown in Figure 5-12 ). 15. Select Phase 1 Negotiation Mo de by checking the Aggressive Mode radio box. 16. PFS Key Group should be disabled, and Enable Replay Detection should be enabled. 17. In the [...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Virtual Private Ne tworking 5-19 v1.0, September 2006 18. In the left frame, expand Key Exchange (Phase 2) and select Proposal 1 . Compare with the figure below . No changes should be neces sary . 19. In the upper left of the window , click the disk icon to save t he policy . T e sting the Connectio n[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 5-20 Virtual Private Ne tworking v1.0, September 2006 Extended Authentication (XAUTH) Configuration When connecting many VPN clients to a VPN gateway router , an administrator may want a unique user authentication method beyond relying on a single common preshared key for all clien ts. Although the [...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Virtual Private Ne tworking 5-21 v1.0, September 2006 . Configuring XAUTH for VPN Client s Once the XAUTH has been enabled, you must establish user ac count s on the Local Database to be authenticated against XAUTH, or you must en able a RADIUS-CHAP or RADIUS-P AP server . T o enable and configure XAU[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 5-22 Virtual Private Ne tworking v1.0, September 2006 • IPSec Host if you want to be authenticated by the remote gateway . In the adjacent Username and Password fields, type in the information user name and password associated with the IKE policy for authenticating this gateway (by the remote gate[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Virtual Private Ne tworking 5-23 v1.0, September 2006 3. Enter a Password for the user , and reenter the password in the Confirm Password field. 4. Click Add. The User Name will be added to the Configured Hosts table. T o edit the user name or password: 1. Click Edit opposite the user ’ s name. The [...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 5-24 Virtual Private Ne tworking v1.0, September 2006 information such as a username/password or some encrypted response using his username/ password information. The gateway will try and verify this information first against a local User Database (if RADIUS-P AP is enabled) and then by relaying the[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Virtual Private Ne tworking 5-25 v1.0, September 2006 Manually Assigning IP Addresses to Remote Users (ModeConfig) T o simply the process of connecting remote VPN clients to the FVS338, the ModeConfig module can be used to assign IP addresses to remote u sers, including a netw ork acce ss IP address, [...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 5-26 Virtual Private Ne tworking v1.0, September 2006 ModeConfig Operation After IKE Phase 1 is complete, the VPN connectio n initiator (remote user/client) asks for IP configuration parameters such as IP address, subnet mask and name server addresses. The ModeConfig module will allocat e an IP addr[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Virtual Private Ne tworking 5-27 v1.0, September 2006 9. Specify the VPN policy settings . These settings must match the configuration of the remote VPN client. Recommended settings are: • SA Lifetime: 3600 sec onds • Authentication Algorithm: SHA-1 • Encryption Algori thm: 3DES 10. Click Apply [...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 5-28 Virtual Private Ne tworking v1.0, September 2006 2. Click Add to configure a new IKE Policy . The Add IKE Policy screen will display . 3. Enable Mode Config by checking the Ye s radio box and selecting the Mode Config record you just created from the pull-down menu. (Y ou ca n view the paramete[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Virtual Private Ne tworking 5-29 v1.0, September 2006 9. If Edge Device was enabled, select the Authentication T ype from the pull down menu which will be used to verify accoun t information: User Database, RADIUS-CHAP or RADIUS-P AP . Users must be added thorough the User Database screen (see “User[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 5-30 Virtual Private Ne tworking v1.0, September 2006 Configuring the ProSafe VP N Client for ModeConfig From a client PC running NETGEAR ProSafe VP N Client software, configure the remote VPN client connection. T o configure the client PC: 1. Right-click the VPN client icon in the W indows toolbar [...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Virtual Private Ne tworking 5-31 v1.0, September 2006 b. From the Select Certificate pull-down menu, select None. c. From the ID T ype pull-down menu, select Doma in Name and create an identifier based on the name of the IKE pol icy you created; fo r example “salesperson11.remote_id.com”. d. Under[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 5-32 Virtual Private Ne tworking v1.0, September 2006 5. Click on Key Exchange (Phase 2) on the left-sid e of the menu and select Proposal 1. Enter the values to match your configuration of the VPN firewall ModeConfig Record menu. (The SA Lifetime can be longer , such as 8 hours (28800 seconds)). 6.[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Virtual Private Ne tworking 5-33 v1.0, September 2006 T o test the connection: 1. Right-click on the VPN client icon in th e W indows toolbar and select Connect. The connection policy you configured will appear; in this case “M y Connectionsm odecfg_test”. 2. Click on the connection. W ithin 30 s[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 5-34 Virtual Private Ne tworking v1.0, September 2006 2. Click Br owse to locate the trusted certificate on your computer and then click Upload . The certificate will be stored on the router and will display in the T rusted Certificates tabl e. Self Certificates Active Self certificates are certific[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Virtual Private Ne tworking 5-35 v1.0, September 2006 • Name – Enter a name that will identify this Certificate. • Subject – This is the name which other organizatio ns will see as the Hol der (owner) of the Certificate. Since this name will be seen by other organizations, you should use your [...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 5-36 Virtual Private Ne tworking v1.0, September 2006 . T o submit your Self Certificate request to a CA: 1. Connect to the web site of the CA. 2. Start the Self Certificate request procedure. 3. When prompted for the requested data, copy the data from your saved data file (including “--- -BEGIN C[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Virtual Private Ne tworking 5-37 v1.0, September 2006 When you obtain th e certificate from the CA, you can then upload it to your computer . Click Browse to locate the Certificate file and then click Upload. The certificate will display in the Active Self Certificates table (see Figure 5 -25 ). Certi[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 5-38 Virtual Private Ne tworking v1.0, September 2006[...]

Router and Network Ma nagement 6-1 v1.0, September 2006 Chapter 6 Router and Network Management This chapter describes how to use the network manag eme nt features of your ProSa fe VPN Firewall 50. These features can be found by cli cking on the appropriate heading in the Main Menu of the browser interface. The ProSafe VPN Firewall 50 offers many t[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 6-2 Router and Network Man a ge m en t v1.0, September 2006 Service Blocking Y ou can control specific outbound traffic (for example., from LAN to W AN). Outbound Services lists all existing rules for outbound traffic. If you have not defined any rules, only the default rule will be listed. The defa[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Router and Network Ma nagement 6-3 v1.0, September 2006 See “Using Rules to Block or Allo w Specific Kinds of Traf fic ” on page 4-1 for the procedure on how to use this feature. Services. The Rules menu contains a list of predefined Services for creating firewall rules. If a service does not appe[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 6-4 Router and Network Man a ge m en t v1.0, September 2006 Y ou can bypass keyword blocking fo r trusted domains by adding th e exact matching domain to the list of T rusted Domains. Access to the doma ins on this list by PCs even in the groups for which keyword blocking has been enabled w ill stil[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Router and Network Ma nagement 6-5 v1.0, September 2006 Y ou can control specific inbound traffic (i .e., from W AN to LAN and from W AN to DMZ). Inbound Services lists all existing rules for inbound traf fic. If you have not defined any rules, only the default rule will be listed. The defa ult rule b[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 6-6 Router and Network Man a ge m en t v1.0, September 2006 • Services – Y ou can specify the desired Services or applications to be covered by this rule. If the desired service or application does not app ear in the list, you must define it using the Services menu (see “Adding Cus tomized Ser[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Router and Network Ma nagement 6-7 v1.0, September 2006 Using QoS to Shif t the T raffic Mix The QoS priority settings determine the priority and, in turn, the quality of service for t he traffic passing through the firewall. The QoS is set individually for each service. • Y ou can accept the defaul[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 6-8 Router and Network Man a ge m en t v1.0, September 2006 T o modify User or Admin settings: 1. Select Administration from the main menu and Set Password from the submenu. The Set Password screen will display . 2. Select the Settings you wish to edit by checking either the Edit Admin Settings or E[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Router and Network Ma nagement 6-9 v1.0, September 2006 Enabling Remote Management Access Using the Remote Manage ment page, you can allo w an administrator on the In ternet to configure, upgrade, and check the statu s of your VPN firewa ll. Y o u must be logged in locally to enable remote management [...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 6-10 Router and Networ k Management v1.0, September 2006 a. Specify what external addresses will be a llowed to access the firewall’ s remote management. b. T o allow access from any IP address on the Interne t, select Everyone. c. T o allow access from a range of IP addresses on the Internet, sel[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Router and Network Ma nageme nt 6-11 v1.0, September 2006 Using a SNMP Manager Simple Network Manage ment Protocol (SNMP) lets you moni tor and manage y our router from an SNMP Manager . It provides a remote means to monitor and control netwo rk devices, and to manage configurations, statistics co lle[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 6-12 Router and Networ k Management v1.0, September 2006 6. Click Edit in the Action column adjacent to the entry to modify or change the selected configuration. The SNMP System Info link displays the VPN firewall identif ication information available to t he SNMP Manager . System Contact, Sy stem L[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Router and Network Ma nageme nt 6-13 v1.0, September 2006 • Revert to the factory default settings. • Upgrade the VPN firewall firmwa re from a saved file on your hard disk to use a dif ferent firmware version. Backup and Restore Settings T o backup and restore settings: 1. Select Administration f[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 6-14 Router and Networ k Management v1.0, September 2006 Router Upgrade Y ou can install a different version of the VPN firewall firmware from the Settings Backup & Upgrade screen. T o vie w the current version of the fi rmware that your VPN firewall is running, select Monitoring from the main m[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Router and Network Ma nageme nt 6-15 v1.0, September 2006 2. Click Br owse in the Router Upgrade section. 3. Locate the download ed file and click upload. T his will start the software upgrade to your VPN firewall router . This may take some time. At th e conclusion of the upgrade, your router will re[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 6-16 Router and Networ k Management v1.0, September 2006 If required, you can also enter the address of another NTP server in the Server 2 Name/IP Address field. If you select this option and leave either the Server 1 or Server 2 fields empty , they will be set to the Default Netgear NTP servers. 5.[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Router and Network Ma nageme nt 6-17 v1.0, September 2006 • T raffic by Protocol – Click this button to display Intern et T raffic details. The volume of traffic for each protocol will be displayed in a sub-window . Traf fic co unters are updated in MBytes scale and the counter starts only when tr[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 6-18 Router and Networ k Management v1.0, September 2006 Setting Login Failures and Att acks Notification Figure 6-8 shows the Firewall Logs & E-mail screen that is invoked by selecting Monitorin g from the main menu and selecting Firewall Logs & E-mail from the submenu. Y ou can send a Syst[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Router and Network Ma nageme nt 6-19 v1.0, September 2006 Figure 6-8 Select the types of Enable email alerts. events to email. View System Logs Select the segments to track for System Log events. Syslog Server enabled[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 6-20 Router and Networ k Management v1.0, September 2006 Monitoring Att ached Devices The Gr oups and Hosts menu contains a table of all IP devices that the VPN firewall has discovered on the local network. Select Network Configuration from the main menu and LAN Groups from the submenu. The Gr oups [...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Router and Network Ma nageme nt 6-21 v1.0, September 2006 V iewing Port T riggering St atus Y ou can view the status of Port Triggering by selecting Security from the main menu and Port T riggering from the submenu. When the Port T riggering screen display , click the St a t u s link. T able 6-1. Know[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 6-22 Router and Networ k Management v1.0, September 2006 V iewing Router Configuration and System S tat us The Router S tatus menu provides status and us age information. From the main menu of the browser interface, click on Ma nagement , then select Router S tatus , The Router S tatus scree n will [...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Router and Network Ma nageme nt 6-23 v1.0, September 2006 Monitoring W AN Port s St atus Y ou can monitor the status of both of th e W AN connections, the Dynamic DNS Server connections, and the DHCP Se rver connections. Select Network Configuration from the main menu and W A N Se ttings from the subm[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 6-24 Router and Networ k Management v1.0, September 2006 . Monitoring VPN T unnel Connection St atus Y ou can view the status of the VPN tunnels by selecting VPN from the main menu and Connection S tatus from the submenu. The IPSec Connection S tatus screen will display . Figure 6-12 Figure 6-13 T a[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Router and Network Ma nageme nt 6-25 v1.0, September 2006 VPN Logs The VPN Logs screen gives log details for recent VPN activity . Select Monitoring from the main menu and VPN Logs from the submenu to view the VPN Logs . Y ou can refresh the log display to view the most recent entries, or clear th e l[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 6-26 Router and Networ k Management v1.0, September 2006 Performing Diagnostics Y ou can perform diagnostics such as pinging an IP address, performing a DNS lookup, displaying the routing table, rebooti ng the firewall, and capturing packets. Select Monitoring from the ma in menu and Diagnostics fro[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Router and Network Ma nageme nt 6-27 v1.0, September 2006 Figure 6-16 T able 6-4. Diagnostics Fields Item Description Ping or T race an IP address Ping – Used to send a ping packet requ es t to a specified IP address—most often, to test a connection. If the request times ou t (no reply is received[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 6-28 Router and Networ k Management v1.0, September 2006 Reboot the Router Used to perform a remote reboot (restart). Y ou can use this if th e Router seems to have become unstable or is not operating normally . Note : Rebooting will break any e xisting connec tions either to the Router (such as thi[...]

Troubleshooting 7-1 v1.0, September 2006 Chapter 7 T roubleshooting This chapter provides troubleshooting tips and information for your Pr oSafe VPN Firewall 50. After each problem description, instructions ar e provided to help yo u diagnose and solve the problem. Basic Functions After you turn on power to th e firewall, the following seque nce of[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 7-2 Troubleshooting v1.0, September 2006 LEDs Never T urn Off When the firewall is turned on, the LEDs turns on for about 10 sec onds and then turn off. If all the LEDs stay on, there is a fault within the firewall. If all LEDs are still on one minute after power up: • Cycle the power to see if th[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Troubleshooting 7-3 v1.0, September 2006 • Make sure your PC’ s IP address is on the sam e subnet as the firewall. If you are using the recommended addressing sch eme, yo ur PC’ s address should be in the range of 192.168.0 .2 to 192.168.0. 254. • If your firewall’ s IP address ha s been cha[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 7-4 Troubleshooting v1.0, September 2006 T roubleshooting the ISP Connection If your firewall is unable to a ccess the Internet, you should first determine whether the firewall is able to obtain a W AN IP address from the ISP . Un less you have been assigned a static IP address, your firewall must r[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Troubleshooting 7-5 v1.0, September 2006 – Configu re y our firewall to spoof your PC’ s MAC ad dress. This can be do ne in the Basic Settings menu. Refer to “Configuring your Internet Connection ” on page 2-2 . If your firewall can obtain an IP addre ss, but your PC is unable to load an y W e[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 7-6 Troubleshooting v1.0, September 2006 If the path is not functioning correctly , you could h ave one of the following problems: • W rong ph ysical connections – Make sure the LAN port LED is on. If the LED is off, follow the instruct ions in “LAN or Internet Port LEDs Not On ” on page 7-2[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Troubleshooting 7-7 v1.0, September 2006 Restoring the Default Co nfiguration and Password This section explains how to restore the fact ory default configuratio n settings, changing the firewall’ s administration password to password and the IP address to 192.168.1.1. Y ou can erase the current con[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual 7-8 Troubleshooting v1.0, September 2006[...]

Default Settings and Technical Specifications A-1 v1.0, September 2006 Appendix A Default Settings and T echnical S pecifications Y ou can use the reset button located on the front of your device to reset all settings to their factory defaults. This is called a hard reset. • T o perform a hard reset, push and hold the reset button for approximate[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual A-2 Default Settings and Technical Specifications v1.0, September 2006 T echnical Specifications for the ProSafe VPN Firewall 50 are listed in t he following table. T ime Zone GMT T ime Zone Adj usted for Daylight Saving Ti m e Disabl ed SNMP Disabled Remote Manageme nt Disabled Firewall Inbound (co[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Default Settings and Technical Specifications A-3 v1.0, September 2006 Environmental S pecifications Operating temperature: 0 ° to 40 ° C (32º to 104º F) Operating humidity: 90% maximum relative humidity , noncondensi ng Electromagnetic Emissions Meets requirements of: FCC Part 15 Class B VCCI Cla[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual A-4 Default Settings and Technical Specifications v1.0, September 2006[...]

Related Documents B-1 v1.0, September 2006 Appendix B Related Document s This appendix provides links to reference documents you c an use to gain a more com ple te understanding of the technolog ies used in your NETGEAR prod uct. Document Link Internet Netw orking and TCP/IP Addressing: http://documentation.netgear .com/ r efere nce/enu/tcpip/index[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual B-2 Related Documents v1.0, September 2006[...]

Index-1 v1.0, September 2006 Index A Add LAN W AN Inbound Service scr een 4-9 , 4-13 Add LAN W AN Outbound Service screen 4-8 address reservation 3-8 AH VPN Policies, use with 5-7 antivirus scanning T rend Micro 3-12 ARP 3-5 Attached Devices monitoring of 6-20 Attack Checks Block TCP Flood 4-10 Respond T o Ping On Internet 4-10 Stealth Mode 4-10 At[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual Index-2 v1.0, September 2006 managing 5-37 crossover cable 1-3 , 7-2 Customized Services 4-2 service port numbers 4-17 D date troubleshooting 7-7 Daylight Savings T ime setting 6-15 default configuration restoring 7-7 default firewall rules 4-1 Inbound 4-1 Outbound 4-2 Default Outbound Policy LAN W [...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Index-3 v1.0, September 2006 by MAC address Source MAC filtering 4-23 firewall alerts, emailing of 4- 27 connecting 2-1 , 2- 2 features 1-2 logging in to 2-1 rear panel 1-7 security , about 4-1 status 6-22 technical specification s A-1 firewall access remote management 6- 9 Firewall Logs configuring 4[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual Index-4 v1.0, September 2006 IPSec Connection Status Fields, description of 6-24 VPN T unnel, use with 4-1 1 IPSec Connection Stat us screen 5-7 , 6-24 IPSec Host authentication 5-22 XAUTH, use with 5-20 , 5-22 ISP connection troubleshooting 7-4 K Keyword Blocking 6-3 Content Filtering 4-21 examples[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Index-5 v1.0, September 2006 Network Database adding computers 3-6 creating 3-5 Network T i me Protocol. See NTP . newsgroup 4-21 NTP servers, configuring 6-15 troubleshooting 7-7 O OfficeScan Server 3-13 One-to-One NA T Mapping 4-13 Outbound Rules 4- 2 examples of 4-16 Fields, description of 4-3 fire[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual Index-6 v1.0, September 2006 To S 4-19 RFC 2453 RIP 3-10 RIP 1-3 about 3-1 0 enabling 3-1 1 multicasting guidelines 3-12 RIP Configuration screen 3-1 1 rollover 5-1 Router St at us 6-22 Router St atus screen 6-22 Router Upgrade 6-14 Routing Information Protocol. See RIP Routing screen 3-8 rules allo[...]

FVS338 ProSafe VPN Firewall 50 Reference Manual Index-7 v1.0, September 2006 setting of 6-15 T ime Zone screen 6-15 To S service levels 4-19 used with QoS 4-19 Tr a f f i c features that incr ea se 6-4 management of 6-7 reducing 6-1 Tr a f f i c M e t e r about 6-1 6 traffic meter programming 2-12 T rend Micro 3-12 T rend Micro integration 1-2 T re[...]

FVS338 ProSafe VPN Firewall 50 Re fe rence Manual Index-8 v1.0, September 2006 content filtering 4-21 W eb configuration troubleshooting 7-2 W indows NetBios Server IP . See WINS Server IP . WINS Server IP LAN Setup 3-3 with 1-2 X XAUTH 5-13 about 5-2 0 configuring 5-21 Edge Device 5-20 IPSec Host 5- 20 RADIUS-CHAP 5-21 RADIUS-P AP 5-21 User Databa[...]