NETGEAR FVG318 - ProSafe 802.11g Wireless VPN Firewall 8... User manual

BETA
BETA Version 1 August 2005
NETGEAR, Inc. 4500 Great America Parkway Santa Clara, CA 95054 USA
Reference Manual for the ProSafe 802.11g Wireless VPN Firewall FVG318

ii
BETA
© 2005 by NETGEAR, Inc. All rights reserved. Trademarks NETGEAR is a trademark of Netgear, Inc. Microsoft, Windows, and Windows NT are registered trademarks of Microsoft Corporation. Other brand and product names are registered trademarks or trademarks of their respective holders. Statement of Conditions In the interest of improving internal design, operational function, and/or reliability, NETGEAR reserves the right to make changes to the products described in this document without notice. NETGEAR does not assume any liability that may occur due to the use or application of the product(s) or circuit
layout(s) described herein.
Federal Communications Commission (FCC) Compliance Notice: Radio Frequency Notice This equipment has been tested and found to comply with the limits for a Class B digital device, pursuant to
part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a residential installation. This equipment generates, uses, and can radiate radio frequency energy and, if not installed and used in accordance with the instructions, may cause harmful interference to radio communications. However, there is no guarantee that interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures: • Reorient or relocate the receiving antenna. • Increase the separation between the equipment and receiver. • Connect the equipment into an outlet on a circuit different from that to which the receiver is connected. • Consult the dealer or an experienced radio/TV technician for help.
EN 55 022 Declaration of Conformance This is to certify that the FVG318 ProSafe 802.11g Wireless VPN Firewall is shielded against the generation of radio interference in accordance with the application of Council Directive 89/336/EEC, Article 4a. Conformity is declared by the application of EN 55 022 Class B (CISPR 22).

BETA
iii
Bestätigung des Herstellers/Importeurs Es wird hiermit bestätigt, daß das FVG318 ProSafe 802.11g Wireless VPN Firewall gemäß der im BMPT-AmtsblVfg
243/1991 und Vfg 46/1992 aufgeführten Bestimmungen entstört ist. Das vorschriftsmäßige Betreiben einiger Geräte
(z.B. Testsender) kann jedoch gewissen Beschränkungen unterliegen. Lesen Sie dazu bitte die Anmerkungen in der Betriebsanleitung. Das Bundesamt für Zulassungen in der Telekommunikation wurde davon unterrichtet, daß dieses Gerät auf den Markt gebracht wurde und es ist berechtigt, die Serie auf die Erfüllung der Vorschriften hin zu überprüfen.
Certificate of the Manufacturer/Importer It is hereby certified that the FVG318 ProSafe 802.11g Wireless VPN Firewall has been suppressed in accordance with the conditions set out in the BMPT-AmtsblVfg 243/1991 and Vfg 46/1992. The operation of some equipment (for example, test transmitters) in accordance with the regulations may, however, be subject to certain restrictions. Please
refer to the notes in the operating instructions. Federal Office for Telecommunications Approvals has been notified of the placing of this equipment on the market and has been granted the right to test the series for compliance with the regulations.
Voluntary Control Council for Interference (VCCI) Statement This equipment is in the second category (information equipment to be used in a residential area or an adjacent area thereto) and conforms to the standards set by the Voluntary Control Council for Interference by Data Processing
Equipment and Electronic Office Machines aimed at preventing radio interference in such residential areas. When used near a radio or TV receiver, it may become the cause of radio interference. Read instructions for correct handling.

BETA
iv Product and Publication Details
Model Number: FVG318 Publication Date: August 2005 Product Family: Router Product Name: FVG318 ProSafe 802.11g Wireless VPN Firewall Home or Business Product: Business Language: English

Contents v
BETA
Contents
Chapter 1 About This Manual
Audience, Scope, Conventions, and Formats ................................................................1-1 How to Use This Manual ................................................................................................1-2 How to Print this Manual .................................................................................................1-3
Chapter 2 Introduction
Key Features of the Wireless VPN Firewall ....................................................................2-1
802.11g and 802.11b Wireless Networking ..............................................................2-2 Wireless Multimedia (WMM) Support .......................................................................2-2 A Powerful, True Firewall with Content Filtering ......................................................2-2 Security ....................................................................................................................2-3 Autosensing Ethernet Connections with Auto Uplink ...............................................2-3 Extensive Protocol Support ......................................................................................2-4 Easy Installation and Management ..........................................................................2-4 Maintenance and Support ........................................................................................2-5
Package Contents ..........................................................................................................2-6
The FVG318 Front Panel .........................................................................................2-7 The FVG318 Rear Panel ..........................................................................................2-8
NETGEAR-Related Products .........................................................................................2-9 NETGEAR Product Registration, Support, and Documentation .....................................2-9
Chapter 3 Connecting the Firewall to the Internet
Prepare to Install Your FVG318 ......................................................................................3-1 First, Connect the FVG318 .............................................................................................3-1 Now, Configure the FVG318 for Internet Access and Wireless Connectivity .................3-3 Troubleshooting Tips ......................................................................................................3-4
Be sure to restart your network in the correct sequence. .................................3-4 Make sure the Ethernet cables are securely plugged in. ...................................3-4

BETA
vi Contents
Make sure the computer & router wireless settings match exactly. ..................3-5 Make sure the network settings of the computer are correct. ...........................3-5 Check the router status lights to verify correct router operation. ......................3-5
Overview of How to Access the FVG318 Wireless VPN Firewall ...................................3-6
How to Log On to the FVG318 After Configuration Settings Have Been Applied ..............................................................3-7 How to Bypass the Configuration Assistant .............................................................3-8
Using the Smart Setup Wizard .......................................................................................3-9 How to Manually Configure Your Internet Connection ..................................................3-10
Chapter 4 Wireless Configuration
Observing Performance, Placement, and Range Guidelines .........................................4-1 Implementing Appropriate Wireless Security ..................................................................4-2 Understanding Wireless Settings ...................................................................................4-3
Default Factory Settings ...........................................................................................4-6 Before You Change the SSID and WEP Settings ....................................................4-7 How to Set Up and Test Basic Wireless Connectivity ..............................................4-8 How to Restrict Wireless Access by MAC Address .................................................4-9 How to Configure WEP ..........................................................................................4-10 How to Configure WPA with Radius .......................................................................4-12 How to Configure WPA2 with Radius .....................................................................4-14 How to Configure WPA and WPA2 with Radius .....................................................4-16 How to Configure WPA-PSK ..................................................................................4-18
How to Configure WPA2-PSK ................................................................................4-20 How to Configure WPA-PSK and WPA2-PSK ........................................................4-21
Chapter 5 Firewall Protection and Content Filtering
Firewall Protection and Content Filtering Overview ........................................................5-1 Block Sites ......................................................................................................................5-2 Using Rules to Block or Allow Specific Kinds of Traffic ..................................................5-3
Inbound Rules (Port Forwarding) .............................................................................5-5
Inbound Rule Example: A Local Public Web Server ..........................................5-5 Inbound Rule Example: Allowing a Videoconference from Restricted Addresses 5-6 Considerations for Inbound Rules .....................................................................5-6
Outbound Rules (Service Blocking) .........................................................................5-7

Contents vii
BETA
Outbound Rule Example: Blocking Instant Messenger .....................................5-7
Order of Precedence for Rules ................................................................................5-8 Default DMZ Server .................................................................................................5-8 Respond to Ping on Internet WAN Port ...................................................................5-9
Services ........................................................................................................................5-10 Using a Schedule to Block or Allow Specific Traffic ......................................................5-12
Time Zone ..............................................................................................................5-13
Getting E-Mail Notifications of Event Logs and Alerts ..................................................5-14 Viewing Logs of Web Access or Attempted Web Access .............................................5-16
Syslog ....................................................................................................................5-17
Chapter 6 Basic Virtual Private Networking
Overview of VPN Configuration ......................................................................................6-2
Client-to-Gateway VPN Tunnels ..............................................................................6-2 Gateway-to-Gateway VPN Tunnels .........................................................................6-2
Planning a VPN ..............................................................................................................6-3 VPN Tunnel Configuration ..............................................................................................6-5 How to Set Up a Client-to-Gateway VPN Configuration .................................................6-5
Step 1: Configuring the Client-to-Gateway VPN Tunnel on the FVG318 .................6-6 Step 2: Configuring the NETGEAR ProSafe VPN Client on the Remote PC ...........6-9 Monitoring the Progress and Status of the VPN Client Connection .......................6-16 Transferring a Security Policy to Another Client ....................................................6-18
Exporting a Security Policy ..............................................................................6-18 Importing a Security Policy ..............................................................................6-19
How to Set Up a Gateway-to-Gateway VPN Configuration ..........................................6-20
Procedure to Configure a Gateway-to-Gateway VPN Tunnel ................................6-21
VPN Tunnel Control ......................................................................................................6-26
Activating a VPN Tunnel ........................................................................................6-26
Start Using a VPN Tunnel to Activate It ...........................................................6-26 Using the VPN Status Page to Activate a VPN Tunnel ....................................6-26 Activate the VPN Tunnel by Pinging the Remote Endpoint .............................6-27
Verifying the Status of a VPN Tunnel .....................................................................6-29 Deactivating a VPN Tunnel ....................................................................................6-30
Using the Policy Table on the VPN Policies Page to Deactivate a VPN Tunnel 6-30 Using the VPN Status Page to Deactivate a VPN Tunnel ...............................6-31

BETA
viii Contents
Deleting a VPN Tunnel ...........................................................................................6-32
Chapter 7 Advanced Virtual Private Networking
Overview of FVG318 Policy-Based VPN Configuration .................................................7-1
Using Policies to Manage VPN Traffic .....................................................................7-2 Using Automatic Key Management ..........................................................................7-2 IKE Policies’ Automatic Key and Authentication Management ................................7-3 VPN Policy Configuration for Auto Key Negotiation .................................................7-5 VPN Policy Configuration for Manual Key Exchange ...............................................7-9
Using Digital Certificates for IKE Auto-Policy Authentication .......................................7-13
Certificate Revocation List (CRL) ...........................................................................7-14
Walk-Through of Configuration Scenarios on the FVG318 ..........................................7-14
VPN Consortium Scenario 1: Gateway-to-Gateway with Preshared Secrets .......................................................7-15 FVG318 Scenario 1: FVG318 to Gateway B IKE and VPN Policies ......................7-16 How to Check VPN Connections ...........................................................................7-21
Testing the Gateway A FVG318 LAN and the Gateway B LAN .......................7-21
FVG318 Scenario 2: FVG318 to FVG318 with RSA Certificates ...........................7-22
Chapter 8 Maintenance
Viewing Wireless VPN Firewall Status Information .........................................................8-1 Viewing a List of Attached Devices .................................................................................8-5 Upgrading the Firewall Software ....................................................................................8-5 Configuration File Management .....................................................................................8-7
Backing Up the Configuration ..................................................................................8-7 Restoring the Configuration .....................................................................................8-7 Erasing the Configuration .........................................................................................8-8
Changing the Administrator Password ...........................................................................8-8
Chapter 9 Advanced Configuration
How to Configure Dynamic DNS ....................................................................................9-1 Using the LAN IP Setup Options ....................................................................................9-2
Configuring LAN TCP/IP Setup Parameters ............................................................9-3 Using the Firewall as a DHCP server .......................................................................9-4 Using Address Reservation ......................................................................................9-5
Configuring Static Routes ...............................................................................................9-5

Contents ix
BETA
Static Route Example ...............................................................................................9-7
Enabling Remote Management Access .........................................................................9-7
Chapter 10 Troubleshooting
Basic Functioning .........................................................................................................10-1
Power LED Not On .................................................................................................10-1 LEDs Never Turn Off ..............................................................................................10-2 LAN or Internet Port LEDs Not On .........................................................................10-2
Troubleshooting the Web Configuration Interface ........................................................10-3 Troubleshooting the ISP Connection ............................................................................10-4 Troubleshooting a TCP/IP Network Using a Ping Utility ...............................................10-5
Testing the LAN Path to Your Firewall ....................................................................10-5 Testing the Path from Your PC to a Remote Device ..............................................10-6
Restoring the Default Configuration and Password ......................................................10-7 Problems with Date and Time .......................................................................................10-7
Appendix A Technical Specifications Appendix B VPN Configuration of NETGEAR FVS318v3
Case Study Overview .................................................................................................... B-1
Gathering the Network Information ......................................................................... B-1 Configuring the Gateways ....................................................................................... B-2 Activating the VPN Tunnel ...................................................................................... B-5
The FVG318-to-FVG318 Case ...................................................................................... B-6
Configuring the VPN Tunnel ................................................................................... B-6 Viewing and Editing the VPN Parameters ............................................................... B-9 Initiating and Checking the VPN Connections .......................................................B-11
The FVG318-to-FVS318v2 Case ................................................................................ B-13
Configuring the VPN Tunnel ................................................................................. B-13 Viewing and Editing the VPN Parameters ............................................................. B-16 Initiating and Checking the VPN Connections ...................................................... B-18
The FVG318-to-FVL328 Case ..................................................................................... B-20
Configuring the VPN Tunnel ................................................................................. B-20 Viewing and Editing the VPN Parameters ............................................................. B-23 Initiating and Checking the VPN Connections ...................................................... B-25

BETA
xContents
The FVG318-to-VPN Client Case ................................................................................ B-27
Client-to-Gateway VPN Tunnel Overview ............................................................. B-27 Configuring the VPN Tunnel ................................................................................. B-28 Initiating and Checking the VPN Connections ...................................................... B-36