NETGEAR FVG318 - ProSafe 802.11g Wireless VPN Firewall 8... User manual

202-10121-01
October 2005
NETGEAR, Inc.
4500 Great America Parkway
Santa Clara, CA 95054 USA
Reference Manual for the
ProSafe Wireless 802.11g
VPN Firewall Model
FVG318

ii
v1.0, October 2005
© 2005 by NETGEAR, Inc. All rights reserved. FullManual.
Trademarks
NETGEAR and Auto Uplink are trademarks or registered trademarks of NETGEAR, Inc..
Microsoft, Windows, and Windows NT are registered trademarks of Microsoft Corporation.
Other brand and product names are registered trademarks or trademarks of their respective holders. Portions of this
document are copyright Intoto, Inc.
October 2005
Statement of Conditions
In the interest of improving internal design, operational function, and/or reliability, NETGEAR reserves the right to
make changes to the products described in this document without notice.
NETGEAR does not assume any liability that may occur due to the use or application of the product(s) or circuit
layout(s) described herein.
EN 55 022 Declaration of Conformance
This is to certify that the ProSafe Wireless 802.11g VPN Firewall Model FVG318 is shielded against the generation of
radio interference in accordance with the application of Council Directive 89/336/EEC, Article 4a. Conformity is
declared by the application of EN 55 022 Class B (CISPR 22).
Certificate of the Manufacturer/Importer
It is hereby certified that the ProSafe Wireless 802.11g VPN Firewall Model FVG318 has been suppressed
in accordance with the conditions set out in the BMPT-AmtsblVfg 243/1991 and Vfg 46/1992. The operation of some
equipment (for example, test transmitters) in accordance with the regulations may, however, be subject to certain
restrictions. Please refer to the notes in the operating instructions.
The Federal Office for Telecommunications Approvals has been notified of the placing of this equipment on the market
and has been granted the right to test the series for compliance with the regulations.
Bestätigung des Herstellers/Importeurs
Es wird hiermit bestätigt, daß dasProSafe Wireless 802.11g VPN Firewall Model FVG318 gemäß der im BMPT-
AmtsblVfg 243/1991 und Vfg 46/1992 aufgeführten Bestimmungen entstört ist. Das vorschriftsmäßige Betreiben
einiger Geräte (z.B. Testsender) kann jedoch gewissen Beschränkungen unterliegen. Lesen Sie dazu bitte die
Anmerkungen in der Betriebsanleitung.
Das Bundesamt für Zulassungen in der Telekommunikation wurde davon unterrichtet, daß dieses Gerät auf den Markt
gebracht wurde und es ist berechtigt, die Serie auf die Erfüllung der Vorschriften hin zu überprüfen.
Voluntary Control Council for Interference (VCCI) Statement
This equipment is in the Class B category (information equipment to be used in a residential area or an adjacent area
thereto) and conforms to the standards set by the Voluntary Control Council for Interference by Data Processing
Equipment and Electronic Office Machines aimed at preventing radio interference in such residential areas. When used
near a radio or TV receiver, it may become the cause of radio interference. Read instructions for correct handling.

v1.0, October 2005
iii
FCC Information to User
This product does not contain any user serviceable components and is to be used with approved antennas only. Any
product changes or modifications will invalidate all applicable regulatory certifications and approvals
FCC Guidelines for Human Exposure
This equipment complies with FCC radiation exposure limits set forth for an uncontrolled environment. This equipment
should be installed and operated with minimum distance of 20 cm between the radiator and your body.
This transmitter must not be co-located or operating in conjunction with any other antenna or transmitter."
Declaration Of Conformity
We NETGEAR, Inc., 4500 Great America Parkway, Santa Clara, CA 95054, declare under our sole responsibility that
the model FVG318 Cardbus Card Wireless Adapter complies with Part 15 of FCC Rules. Operation is subject to the
following two conditions:
• This device may not cause harmful interference, and
• This device must accept any interference received, including interference that may cause undesired operation.
Regulatory Compliance Information
This section includes user requirements for operating this product in accordance with National laws for usage of radio
spectrum and operation of radio devices. Failure of the end-user to comply with the applicable requirements may result
in unlawful operation and adverse action against the end-user by the applicable National regulatory authority.
NOTE: This product's firmware limits operation to only the channels allowed in a particular Region or Country.
Therefore, all options described in this user's guide may not be available in your version of the product.
FCC Requirements for Operation in the United States
Radio Frequency Interference Warnings & Instructions
This equipment has been tested and found to comply with the limits for a Class B digital device, pursuant to Part 15 of
the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a residential
installation. This equipment uses and can radiate radio frequency energy and, if not installed and used in accordance
with the instructions, may cause harmful interference to radio communications. However, there is no guarantee that
interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or
television reception, which can be determined by turning the equipment off and on, the user is encouraged to try to
correct the interference by one or more of the following methods:
• Reorient or relocate the receiving antenna
• Increase the separation between the equipment and the receiver
• Connect the equipment into an electrical outlet on a circuit different from that which the radio receiver is connected
• Consult the dealer or an experienced radio/TV technician for help.

v1.0, October 2005
iv
Modifications made to the product, unless expressly approved byNETGEAR, Inc., could void the user's right to operate
the equipment.
Canadian Department of Communications Radio Interference Regulations
This digital apparatus (ProSafe Wireless 802.11g VPN Firewall Model FVG318) does not exceed the Class B limits for
radio-noise emissions from digital apparatus as set out in the Radio Interference Regulations of the Canadian
Department of Communications.
Canada ID: 4054A-WG111
Product and Publication Details
Model Number: FVG318
Publication Date: October 2005
Product Family: Product Family
Product Name: ProSafe Wireless 802.11g VPN Firewall Model FVG318
Home or Business Product: Business
Language: English
Publication Part Number: 202-10121-01
Publication Version Number: 1.0
FOR HOME OR OFFICE USE
Tested to Comply
with FCC Standards
ProSafe Wireless 802.11g VPN Firewall Model FVG318
PY3WG111

v
v1.0, October 2005
Contents
Reference Manual for the ProSafe Wireless 802.11g VPN Firewall Model
FVG318
Chapter 1
About This Manual
Audience, Scope, Conventions, and Formats ................................................................1-1
How to Use This Manual ................................................................................................1-2
How to Print this Manual .................................................................................................1-3
Chapter 2
Introduction
Key Features of the Wireless VPN Firewall ....................................................................2-1
802.11g and 802.11b Wireless Networking ..............................................................2-2
Wireless Multimedia (WMM) Support .......................................................................2-2
A Powerful, True Firewall with Content Filtering ......................................................2-2
Security ....................................................................................................................2-3
Autosensing Ethernet Connections with Auto Uplink ...............................................2-3
Extensive Protocol Support ......................................................................................2-3
Easy Installation and Management ..........................................................................2-4
Maintenance and Support ........................................................................................2-5
Package Contents ..........................................................................................................2-5
The FVG318 Front Panel .........................................................................................2-6
The FVG318 Rear Panel ..........................................................................................2-8
NETGEAR-Related Products .........................................................................................2-9
NETGEAR Product Registration, Support, and Documentation .....................................2-9
Chapter 3
Connecting the Firewall to the Internet
Prepare to Install Your FVG318 ......................................................................................3-1
First, Connect the FVG318 .............................................................................................3-1
Now, Configure the FVG318 for Internet Access and Wireless Connectivity .................3-4

vi
v1.0, October 2005
Troubleshooting Tips ......................................................................................................3-6
Overview of How to Access the FVG318 wireless VPN firewall .....................................3-7
How to Log On to the FVG318 After
Configuration Settings Have Been Applied ..............................................................3-9
How to Bypass the Configuration Assistant ...........................................................3-10
Using the Smart Setup Wizard .....................................................................................3-11
How to Manually Configure Your Internet Connection ..................................................3-12
Chapter 4
Wireless Configuration
Observing Performance, Placement, and Range Guidelines .........................................4-1
Implementing Appropriate Wireless Security .................................................................4-2
Understanding Wireless Settings ...................................................................................4-3
Default Factory Settings ...........................................................................................4-6
Before You Change the SSID and WEP Settings ....................................................4-6
How to Set Up and Test Basic Wireless Connectivity ..............................................4-7
How to Restrict Wireless Access by MAC Address .................................................4-9
How to Configure WEP ..........................................................................................4-10
How to Configure WPA with Radius .......................................................................4-12
How to Configure WPA2 with Radius .....................................................................4-14
How to Configure WPA and WPA2 with Radius .....................................................4-15
How to Configure WPA-PSK ..................................................................................4-17
How to Configure WPA2-PSK ................................................................................4-18
How to Configure WPA-PSK and WPA2-PSK ........................................................4-20
Chapter 5
Firewall Protection and
Content Filtering
Firewall Protection and Content Filtering Overview ........................................................5-1
Block Sites ......................................................................................................................5-2
Using Rules to Block or Allow Specific Kinds of Traffic ..................................................5-4
Inbound Rules (Port Forwarding) .............................................................................5-6
Outbound Rules (Service Blocking) .........................................................................5-9
Order of Precedence for Rules ..............................................................................5-11
Default DMZ Server ...............................................................................................5-13
Attack Checks ........................................................................................................5-14
Services ........................................................................................................................5-15

vii
v1.0, October 2005
Using a Schedule to Block or Allow Specific Traffic ......................................................5-17
Time Zone ..............................................................................................................5-18
Getting E-Mail Notifications of Event Logs and Alerts ..................................................5-19
Viewing Logs of Web Access or Attempted Web Access .............................................5-21
Syslog ....................................................................................................................5-22
Chapter 6
Basic Virtual Private Networking
Overview of VPN Configuration ......................................................................................6-2
Client-to-Gateway VPN Tunnels ..............................................................................6-2
Gateway-to-Gateway VPN Tunnels .........................................................................6-3
Planning a VPN ..............................................................................................................6-3
VPN Tunnel Configuration ..............................................................................................6-5
How to Set Up a Client-to-Gateway VPN Configuration .................................................6-5
Step 1: Configuring the Client-to-Gateway VPN Tunnel on the FVG318 .................6-6
Step 2: Configuring the NETGEAR ProSafe VPN Client on the Remote PC .........6-10
Monitoring the Progress and Status of the VPN Client Connection .......................6-18
Transferring a Security Policy to Another Client ....................................................6-19
How to Set Up a Gateway-to-Gateway VPN Configuration ..........................................6-22
Procedure to Configure a Gateway-to-Gateway VPN Tunnel ................................6-22
VPN Tunnel Control ......................................................................................................6-29
Activating a VPN Tunnel ........................................................................................6-29
Verifying the Status of a VPN Tunnel .....................................................................6-32
Deactivating a VPN Tunnel ....................................................................................6-33
Deleting a VPN Tunnel ...........................................................................................6-36
Chapter 7
Advanced Virtual Private Networking
Overview of FVG318 Policy-Based VPN Configuration .................................................7-1
Using Policies to Manage VPN Traffic .....................................................................7-1
Using Automatic Key Management ..........................................................................7-2
IKE Policies’ Automatic Key and Authentication Management ................................7-3
VPN Policy Configuration for Auto Key Negotiation .................................................7-6
VPN Policy Configuration for Manual Key Exchange ...............................................7-9
Using Digital Certificates for IKE Auto-Policy Authentication .......................................7-14
Certificate Revocation List (CRL) ...........................................................................7-14
Walk-Through of Configuration Scenarios on the FVG318 ..........................................7-14

viii
v1.0, October 2005
VPN Consortium Scenario 1:
Gateway-to-Gateway with Preshared Secrets .......................................................7-15
FVG318 Scenario 1: FVG318 to Gateway B IKE and VPN Policies ......................7-16
How to Check VPN Connections ...........................................................................7-20
FVG318 Scenario 2: FVG318 to FVG318 with RSA Certificates ...........................7-22
Chapter 8
Maintenance
Viewing Wireless VPN Firewall Status Information .........................................................8-1
Viewing a List of Attached Devices .................................................................................8-5
Upgrading the Firewall Software ....................................................................................8-5
Configuration File Management .....................................................................................8-6
Backing Up the Configuration ..................................................................................8-7
Restoring the Configuration .....................................................................................8-7
Erasing the Configuration .........................................................................................8-7
Changing the Administrator Password ...........................................................................8-8
Chapter 9
Advanced Configuration
How to Configure Dynamic DNS ....................................................................................9-1
Using the LAN IP Setup Options ....................................................................................9-3
Configuring LAN TCP/IP Setup Parameters ............................................................9-3
Using the Firewall as a DHCP server .......................................................................9-4
Using Address Reservation ......................................................................................9-5
Configuring Static Routes ...............................................................................................9-6
Static Route Example ...............................................................................................9-7
Enabling Remote Management Access .........................................................................9-8
Chapter 10
Troubleshooting
Basic Functioning .........................................................................................................10-1
Power LED Not On .................................................................................................10-1
LEDs Never Turn Off ..............................................................................................10-2
LAN or Internet Port LEDs Not On .........................................................................10-2
Troubleshooting the Web Configuration Interface ........................................................10-2
Troubleshooting the ISP Connection ............................................................................10-3
Troubleshooting a TCP/IP Network Using a Ping Utility ...............................................10-5
Testing the LAN Path to Your Firewall ....................................................................10-5

ix
v1.0, October 2005
Testing the Path from Your PC to a Remote Device ..............................................10-6
Restoring the Default Configuration and Password ......................................................10-7
Problems with Date and Time .......................................................................................10-7
Appendix A
Technical Specifications
Appendix B
Related Documents
Appendix C
VPN Configuration of NETGEAR FVG318
Case Study Overview .................................................................................................... B-1
Gathering the Network Information ......................................................................... B-2
Configuring the Gateways ....................................................................................... B-2
Activating the VPN Tunnel ...................................................................................... B-5
The FVG318-to-FVG318 Case ...................................................................................... B-6
Configuring the VPN Tunnel ................................................................................... B-6
Viewing and Editing the VPN Parameters ............................................................. B-10
Initiating and Checking the VPN Connections ...................................................... B-13
The FVG318-to-VPN Client Case ................................................................................ B-15
Client-to-Gateway VPN Tunnel Overview ............................................................. B-15
Configuring the VPN Tunnel ................................................................................. B-16
Initiating and Checking the VPN Connections ...................................................... B-23
Index

x
v1.0, October 2005