NETGEAR FVS336G - ProSafe Dual WAN Gigabit Firewall User manual

1-1
v1.0, October 2007
Chapter 1
Introduction
The ProSafe Dual WAN Gigabit Firewall with SSL & IPsec VPN connects your local area network
(LAN) to the Internet through one or two external broadband access devices such as cable modems
or DSL modems. Dual wide area network (WAN) ports allow you to increase throughput to the
Internet by using both ports together, or to maintain a backup connection in case of failure of your
primary Internet connection.
As a complete security solution, the FVS336G incorporates a powerful and flexible firewall to
safeguard your network, while providing advanced IPsec and SSL VPN technologies for secure
and simple remote connections.
The use of Gigabit Ethernet LAN and WAN ports ensures extremely high data transfer speeds
The FVS336G is a plug-and-play device that can be installed and configured within minutes.
This chapter contains the following sections:
•“Key Features”
•“Package Contents”
•“Front Panel Features”
•“Rear Panel Features”
•“Default IP Address, Login Name, and Password Location”
•“Qualified Web Browsers”
Key Features
The VPN firewall provides the following key features:
• Dual 10/100/1000 Mbps Gigabit Ethernet WAN ports for load balancing or failover protection
of your Internet connection, providing increased system reliability or increased throughput.
• Built-in four-port 10/100/1000 Mbps Gigabit Ethernet LAN switch for extremely fast data
transfer between local network resources.
• Advanced IPsec and SSL VPN support.

ProSafe Dual WAN Gigabit Firewall with SSL & IPsec VPN FVS336G Reference Manual
1-2 Introduction
v1.0, October 2007
• Advanced stateful packet inspection (SPI) firewall with multi-NAT support.
• Easy, web-based setup for installation and management.
• Front panel LEDs for easy monitoring of status and activity.
• Flash memory for firmware upgrade.
• Internal universal switching power supply.
Dual WAN Ports for Increased Reliability or Outbound Load
Balancing
The FVS336G has two broadband WAN ports. The second WAN port allows you to connect a
second broadband Internet line that can be configured on a mutually-exclusive basis to:
• Provide backup and rollover if one line is inoperable, ensuring you are never disconnected.
• Load balance, or use both Internet lines simultaneously for outgoing traffic. The firewall
balances users between the two lines for maximum bandwidth efficiency.
See “Network Planning for Dual WAN Ports” on page C-1 for the planning factors to consider
when implementing the following capabilities with dual WAN port gateways:
• Single or multiple exposed hosts.
• Virtual private networks.
Advanced VPN Support for Both IPsec and SSL
The VPN firewall supports IPsec and SSL virtual private network (VPN) connections.
• IPsec VPN delivers full network access between a central office and branch offices, or
between a central office and telecommuters. Remote access by telecommuters requires the
installation of VPN client software on the remote computer.
– IPsec VPN with broad protocol support for secure connection to other IPsec gateways and
clients.
– Bundled with the single-user license of the NETGEAR ProSafe VPN Client software
(VPN01L)
– Supports 25 concurrent IPsec VPN tunnels.
• SSL VPN provides remote access for mobile users to selected corporate resources without
requiring a pre-installed VPN client on their computers.

ProSafe Dual WAN Gigabit Firewall with SSL & IPsec VPN FVS336G Reference Manual
Introduction 1-3
v1.0, October 2007
– Uses the familiar Secure Sockets Layer (SSL) protocol, commonly used for e-commerce
transactions, to provide client-free access with customizable user portals and support for a
wide variety of user repositories.
– Browser based, platform-independent, remote access through a number of popular
browsers, such as Microsoft Internet Explorer or Apple Safari.
– Provides granular access to corporate resources based upon user type or group
membership.
– Supports 10 concurrent SSL VPN sessions.
A Powerful, True Firewall with Content Filtering
Unlike simple Internet sharing NAT routers, the FVS336G is a true firewall, using stateful packet
inspection (SPI) to defend against hacker attacks. Its firewall features include:
•Automatically detects and thwarts denial of service (DoS) attacks such as Ping of Death and
SYN Flood.
• Blocks unwanted traffic from the Internet to your LAN.
• Blocks access from your LAN to Internet locations or services that you specify as off-limits.
• Prevents objectionable content from reaching your PCs. You can control access to Internet
content by screening for Web services, Web addresses, and keywords within Web addresses.
You can configure the firewall to log and report attempts to access objectionable Internet sites.
• Permits scheduling of firewall policies by day and time.
• Logs security events such as blocked incoming traffic, port scans, attacks, and administrator
logins. You can configure the firewall to email the log to you at specified intervals. You can
also configure the firewall to send immediate alert messages to your email address or email
pager whenever a significant event occurs.
Autosensing Ethernet Connections with Auto Uplink
With its internal 4-port 10/100/1000 Mbps switch and dual 10/100/1000 WAN ports, the FVS336G
can connect to either a 10 Mbps standard Ethernet network, a 100 Mbps Fast Ethernet network, or
a 1000 Mbps Gigabit Ethernet network. The four LAN and two WAN interfaces are autosensing
and capable of full-duplex or half-duplex operation.
The FVS336G incorporates Auto UplinkTM technology. Each Ethernet port will automatically
sense whether the Ethernet cable plugged into the port should have a “normal” connection such as
to a PC or an “uplink” connection such as to a switch or hub. That port will then configure itself to

ProSafe Dual WAN Gigabit Firewall with SSL & IPsec VPN FVS336G Reference Manual
1-4 Introduction
v1.0, October 2007
the correct configuration. This feature eliminates the need to worry about crossover cables, as
Auto Uplink will accommodate either type of cable to make the right connection.
Extensive Protocol Support
The VPN firewall supports the Transmission Control Protocol/Internet Protocol (TCP/IP) and
Routing Information Protocol (RIP). For further information about TCP/IP, refer to “Internet
Configuration Requirements” on page C-4.
•IP Address Sharing by NAT. The VPN firewall allows many networked PCs to share an
Internet account using only a single IP address, which may be statically or dynamically
assigned by your Internet service provider (ISP). This technique, known as NAT, allows the
use of an inexpensive single-user ISP account.
•Automatic Configuration of Attached PCs by DHCP. The VPN firewall dynamically
assigns network configuration information, including IP, gateway, and domain name server
(DNS) addresses, to attached PCs on the LAN using the Dynamic Host Configuration Protocol
(DHCP). This feature greatly simplifies configuration of PCs on your local network.
•DNS Proxy. When DHCP is enabled and no DNS addresses are specified, the firewall
provides its own address as a DNS server to the attached PCs. The firewall obtains actual DNS
addresses from the ISP during connection setup and forwards DNS requests from the LAN.
•PPP over Ethernet (PPPoE). PPPoE is a protocol for connecting remote hosts to the Internet
over a DSL connection by simulating a dial-up connection. This feature eliminates the need to
run a login program such as EnterNet or WinPOET on your PC.
•Quality of Service (QoS) support for traffic prioritization.
Easy Installation and Management
You can install, configure, and operate the ProSafe Dual WAN Gigabit Firewall with SSL & IPsec
VPN within minutes after connecting it to the network. The following features simplify
installation and management tasks:
•Browser-Based Management. Browser-based configuration allows you to easily configure
your firewall from almost any type of personal computer, such as Windows, Macintosh, or
Linux. A user-friendly Setup Wizard is provided and online help documentation is built into
the browser-based Web Management Interface.
•Auto Detection of ISP. The VPN firewall automatically senses the type of Internet
connection, asking you only for the information required for your type of ISP account.

ProSafe Dual WAN Gigabit Firewall with SSL & IPsec VPN FVS336G Reference Manual
Introduction 1-5
v1.0, October 2007
•VPN Wizard. The VPN firewall includes the NETGEAR VPN Wizard to easily configure
IPsec VPN tunnels according to the recommendations of the Virtual Private Network
Consortium (VPNC) to ensure the IPsec VPN tunnels are interoperable with other VPNC-
compliant VPN routers and clients.
•SNMP. The VPN firewall supports the Simple Network Management Protocol (SNMP) to let
you monitor and manage log resources from an SNMP-compliant system manager. The SNMP
system configuration lets you change the system variables for MIB2.
•Diagnostic Functions. The firewall incorporates built-in diagnostic functions such as Ping,
Trace Route, DNS lookup, and remote reboot.
•Remote Management. The firewall allows you to login to the Web Management Interface
from a remote location on the Internet. For security, you can limit remote management access
to a specified remote IP address or range of addresses.
•Visual monitoring. The VPN firewall’s front panel LEDs provide an easy way to monitor its
status and activity.
Maintenance and Support
NETGEAR offers the following features to help you maximize your use of the VPN firewall:
• Flash memory for firmware upgrade.
• Free technical support seven days a week, 24 hours a day, according to the terms identified in
the Warranty and Support information card provided with your product.
Package Contents
The product package should contain the following items:
• ProSafe Dual WAN Gigabit Firewall with SSL & IPsec VPN.
• One AC power cable.
• Rubber feet.
• One Category 5 (Cat5) Ethernet cable.
•Installation Guide, FVS336G ProSafe Dual WAN Gigabit Firewall with SSL & IPsec VPN.
•Resource CD, including:
– Application Notes and other helpful information.

ProSafe Dual WAN Gigabit Firewall with SSL & IPsec VPN FVS336G Reference Manual
1-6 Introduction
v1.0, October 2007
– ProSafe VPN Client Software – one user license.
• Warranty and Support Information Card.
If any of the parts are incorrect, missing, or damaged, contact your NETGEAR dealer. Keep the
carton, including the original packing materials, in case you need to return the firewall for repair.
Front Panel Features
The ProSafe Dual WAN Gigabit Firewall with SSL & IPsec VPN front panel shown below
includes four groups of status indicator light-emitting diodes (LEDs), including Power and Test,
WAN1, WAN2, and the LAN lights:
The function of each LED is described in the following table:
Figure 1-1
Table 1-1. LED Descriptions
Object Activity Description
PWR
(Power) On (Green) Off Power is supplied to the VPN firewall. Power is not supplied to the VPN firewall.
TEST On (Amber)
Blinking (Amber)
Off
Test mode: The system is initializing or the initialization has failed.
Writing to Flash memory (during upgrading or resetting to defaults).
The system has booted successfully.
WAN Ports
ACTIVE On (Green)
On (Amber)
Off
The WAN port has a valid Internet connection.
The Internet connection is down or not being used because the port
is in standby for failover.
The WAN port is either not enabled or has no link.
SPEED On (Green)
On (Amber)
Off
The LAN port is operating at 1,000 Mbps.
The LAN port is operating at 100 Mbps.
The LAN port is operating at 10 Mbps.

ProSafe Dual WAN Gigabit Firewall with SSL & IPsec VPN FVS336G Reference Manual
Introduction 1-7
v1.0, October 2007
Rear Panel Features
The rear panel of the ProSafe Dual WAN Gigabit Firewall with SSL & IPsec VPN includes
Gigabit Ethernet LAN and WAN connections, a cable lock receptacle, power and reset switches,
and an AC power connection.
Viewed from left to right, the rear panel contains the following elements:
1. Factory Defaults button.
Using a sharp object, press and hold this button for about ten seconds until the front panel
TEST light flashes to reset the VPN firewall to factory default settings. All configuration
settings will be lost and the default password will be restored.
2. LAN Ethernet ports.
Four switched N-way automatic speed negotiating, Auto MDI/MDIX, Gigabit Ethernet ports
with RJ-45 connectors.
LINK/ACT
(Link and
Activity)
On (Green)
Blinking (Green)
Off
The WAN port has detected a link with a connected Ethernet device.
Data is being transmitted or received by the WAN port.
The WAN port has no link.
LAN Ports
SPEED On (Green)
On (Amber)
Off
The LAN port is operating at 1,000 Mbps.
The LAN port is operating at 100 Mbps.
The LAN port is operating at 10 Mbps.
LINK/ACT
(Link and
Activity)
On (Green)
Blinking (Green)
Off
The WAN port has detected a link with a connected Ethernet device.
Data is being transmitted or received by the WAN port.
The WAN port has no link.
Figure 1-2
Table 1-1. LED Descriptions (continued)
Object Activity Description

ProSafe Dual WAN Gigabit Firewall with SSL & IPsec VPN FVS336G Reference Manual
1-8 Introduction
v1.0, October 2007
3. WAN Ethernet ports.
Two independent N-way automatic speed negotiating, Auto MDI/MDIX, Gigabit Ethernet
ports with RJ-45 connectors.
4. Cable security lock receptacle.
5. AC power receptacle.
Universal AC input (100-240 VAC, 50-60 Hz).
6. On/off power switch.
Default IP Address, Login Name, and Password Location
Check the label on the bottom of the FVS336G’s enclosure if you need a reminder of the following
factory default information:
Qualified Web Browsers
To configure the ProSafe Dual WAN Gigabit Firewall with SSL & IPsec VPN, an administrator
must use Internet Explorer 5.1 or higher, Apple Safari 1.2 or higher, or Mozilla Firefox l.x Web
browser with JavaScript, cookies, and SSL enabled.
Although these web browsers are qualified for use with the VPN firewall’s Web Management
Interface for configuring the VPN firewall, SSL VPN users should choose a browser that supports
Figure 1-3
IP Address
User Name
Password

ProSafe Dual WAN Gigabit Firewall with SSL & IPsec VPN FVS336G Reference Manual
Introduction 1-9
v1.0, October 2007
JavaScript, Java, cookies, SSL, and ActiveX to take advantage of the full suite of applications.
Note that Java is only required for the SSL VPN portal, not the Web Management Interface.

ProSafe Dual WAN Gigabit Firewall with SSL & IPsec VPN FVS336G Reference Manual
1-10 Introduction
v1.0, October 2007