NETGEAR ProSafe FVS318N User manual

350 East Plumeria Drive
San Jose, CA 95134
USA
July, 2012
202-10836-04
v1.0
ProSafe Wireless-N 8-Port
Gigabit VPN Firewall
FVS318N
Reference Manual

2
ProSafe Wireless-N 8-Port Gigabit VPN Firewall FVS318N
© 2011–2012 NETGEAR, Inc. All rights reserved.
No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated
into any language in any form or by any means without the written permission of NETGEAR, Inc.
Technical Support
Thank you for choosing NETGEAR. To register your product, get the latest product updates, get support online, or
for more information about the topics covered in this manual, visit the Support website at
http://support.netgear.com.
Phone (US & Canada only): 1-888-NETGEAR
Phone (Other Countries): Check the list of phone numbers at
http://support.netgear.com/app/answers/detail/a_id/984.
Trademarks
NETGEAR, the NETGEAR logo, and Connect with Innovation are trademarks and/or registered trademarks of
NETGEAR, Inc. and/or its subsidiaries in the United States and/or other countries. Information is subject to change
without notice. Other brand and product names are registered trademarks or trademarks of their respective
holders. © 2012 NETGEAR, Inc. All rights reserved.
Statement of Conditions
To improve internal design, operational function, and/or reliability, NETGEAR reserves the right to make changes
to the products described in this document without notice. NETGEAR does not assume any liability that may occur
due to the use, or application of, the product(s) or circuit layout(s) described herein.
Revision History
Publication
Part Number Version Publish Date Comments
202-10836-04 1.0 July, 2012 Added the following features:
• Stateless IP/ICMP Translation (see Configure Stateless IP/ICMP
Translation)
• Option to turn bandwidth profiles on and off (see Create
Bandwidth Profiles)
• Support for SNMPv3 (see Use a Simple Network Management
Protocol Manager)
The following screens provide new information:
• LAN WAN Rules screen (see Configure LAN WAN Rules)
• Router Status screen (see Router Status Screen)
• Detailed Status screen (see Detailed Status Screen)
202-10836-03 1.0 April, 2012 Added the PPPoE IPv6 feature (see Configure a PPPoE IPv6
Internet Connection)
202-10836-02 1.0 March, 2012 Added the following menus and features:
• New and improved general menu structure with IPv4 and IPv6
radio buttons
• New LAN IPv6 configuration menu with the LAN Setup (IPv6)
screen (see Manage the IPv6 LAN) and a new screen, the LAN
Multi-homing (IPv6) screen (see Configure IPv6 Multihome LAN
IP Addresses on the Default VLAN)
• IPv6 DMZ (Enable and Configure the DMZ Port for IPv4 and
IPv6 Traffic)

3
ProSafe Wireless-N 8-Port Gigabit VPN Firewall FVS318N
(continued)
• IPv6 firewall rules (see Configure LAN WAN Rules, Configure
DMZ WAN Rules, Configure LAN DMZ Rules, and Examples of
Firewall Rules)
• IPv6 attack checks (see Attack Checks)
• IPv6/MAC bindings (see Set Up IP/MAC Bindings)
• Simplified wireless settings submenus for easier configuration
(see Chapter 4, Wireless Configuration and Security)
• IPSec VPN IPv6 address support (see Chapter 6, Virtual Private
Networking Using IPSec and L2TP Connections)
• IPSec VPN autoinitiate support (see Manually Add or Edit a
VPN Policy)
• SSL VPN IPv6 address support (see Chapter 7, Virtual Private
Networking Using SSL Connections)
• User login restrictions based on IPv6 addresses (see Configure
Login Restrictions Based on IPv6 Addresses)
• IPv6 remote management access (see Configure Remote
Management Access)
• IPv6 address resolution for NTP servers (see Configure Date
and Time Service)
• IPv6 diagnostics (see Diagnostics Utilities)
• Extensive list of factory default settings (see Appendix A,
Default Settings and Technical Specifications)
202-10836-01 1.0 September 2011 First publication

4
Contents
Chapter 1 Introduction
What Is the ProSafe Wireless-N 8-Port Gigabit VPN Firewall FVS318N?.10
Key Features and Capabilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11
Wireless Features. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11
Advanced VPN Support for Both IPSec and SSL. . . . . . . . . . . . . . . . . .12
A Powerful, True Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .12
Security Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13
Autosensing Ethernet Connections with Auto Uplink . . . . . . . . . . . . . . .13
Extensive Protocol Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13
Easy Installation and Management . . . . . . .. . . . . . . . . . . . . . . . . . . . .14
Maintenance and Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .15
Package Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .15
Hardware Features. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .15
Front Panel. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .15
Rear Panel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .18
Bottom Panel with Product Label . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .19
Choose a Location for the Wireless VPN Firewall . . . . . . . . . . . . . . . . . . .19
Log In to the Wireless VPN Firewall. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .20
Web Management Interface Menu Layout . . . . . . . . . . . . . . . . . . . . . . . . .22
Requirements for Entering IP Addresses. . . . . . . . . . . . . . . . . . . . . . . . . .24
Chapter 2 IPv4 and IPv6 Internet and Broadband Settings
Internet and WAN Configuration Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . .25
Tasks to Set Up an IPv4 Internet Connection to Your ISP. . . . . . . . . . .25
Tasks to Set Up an IPv6 Internet Connection to Your ISP. . . . . . . . . . .26
Configure the IPv4 Internet Connection and WAN Settings. . . . . . . . . . . .26
Configure the IPv4 WAN Mode . .. . . . . . . . . . . . . . . . . . . . . . . . . . . . .27
Let the Wireless VPN Firewall Automatically Detect and
Configure an IPv4 Internet Connection . . . . . . . . . . . . . . . . . . . . . . . . .28
Manually Configure an IPv4 Internet Connection. . . . . . . . . . . . . . . . . .31
Configure Dynamic DNS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .35
Configure the IPv6 Internet Connection and WAN Settings. . . . . . . . . . . .37
Configure the IPv6 Routing Mode . . . . . . . .. . . . . . . . . . . . . . . . . . . . .38
Use a DHCPv6 Server to Configure an IPv6 Internet Connection . . . . .39
Configure a Static IPv6 Internet Connection . . . . . . . . . . . . . . . . . . . . .41
Configure a PPPoE IPv6 Internet Connection . . . . . . . . . . . . . . . . . . . .43
Configure 6to4 Automatic Tunneling . . . . . . . . . . . . . . . . . . . . . . . . . . .46
Configure ISATAP Automatic Tunneling . . . . .. . . . . . . . . . . . . . . . . . .47
View the Tunnel Status and IPv6 Addresses . . . . . . . . . . . . . . . . . . . . .49

5
ProSafe Wireless-N 8-Port Gigabit VPN Firewall FVS318N
Configure Stateless IP/ICMP Translation. . . . . . . . . . . . . . . . . . . . . . . .49
Configure Advanced WAN Options and Other Tasks. . . . . . . . . . . . . . . . .50
Additional WAN-Related Configuration Tasks . . . . . . . . . . . . . . . . . . . . . .53
Verify the Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .53
What to Do Next. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .53
Chapter 3 LAN Configuration
Manage IPv4 Virtual LANs and DHCP Options . . . . . . . . . . . . . . . . . . . . .54
Port-Based VLANs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .55
Assign and Manage VLAN Profiles. . . . . . . . . . . . . . . . . . . . . . . . . . . . .56
VLAN DHCP Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .57
Configure a VLAN Profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .59
Configure VLAN MAC Addresses and LAN Advanced Settings. . . . . . .64
Configure IPv4 Multihome LAN IP Addresses on the Default VLAN . . . . .65
Manage IPv4 Groups and Hosts (IPv4 LAN Groups). . . . . . . . . . . . . . . . .67
Manage the Network Database . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . .68
Change Group Names in the Network Database . . . . . . . . . . . . . . . . . .71
Set Up DHCP Address Reservation. . . . . . .. . . . . . . . . . . . . . . . . . . . .72
Manage the IPv6 LAN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .73
DHCPv6 Server Options. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .73
Configure the IPv6 LAN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .75
Configure the IPv6 Router Advertisement Daemon and
Advertisement Prefixes for the LAN . . . . . . . . . . . . . . . . . . . . . . . . . . . .80
Configure IPv6 Multihome LAN IP Addresses on the Default VLAN . . . . .84
Enable and Configure the DMZ Port for IPv4 and IPv6 Traffic. . . . . . . . . .85
DMZ Port for IPv4 Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .86
DMZ Port for IPv6 Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .89
Configure the IPv6 Router Advertisement Daemon and
Advertisement Prefixes for the DMZ. . . . . . . . . . . . . . . . . . . . . . . . . . . .93
Manage Static IPv4 Routing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .98
Configure Static IPv4 Routes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .98
Configure the Routing Information Protocol . . . . . . . . . . . . . . . . . . . . .100
IPv4 Static Route Example. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .103
Manage Static IPv6 Routing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .103
Chapter 4 Wireless Configuration and Security
Overview of the Wireless Features. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .106
Wireless Equipment Placement and Range Guidelines. . . . . . . . . . . .107
Configure the Basic Radio Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . .108
Operating Frequency (Channel) Guidelines. . . . . . . . . . . . . . . . . . . . .110
Wireless Data Security Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .111
Wireless Security Profiles. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .112
Before You Change the SSID, WEP, and WPA Settings . . . . . . . . . . .114
Configure and Enable Wireless Profiles. . . . . . . . . . . . . . . . . . . . . . . .115
Restrict Wireless Access by MAC Address . . . . . . . . . . . . . . . . . . . . .120
View the Status of a Wireless Profile . . . . . . . . . . . . . . . . . . . . . . . . . .122
Configure Wi-Fi Protected Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . .123

6
ProSafe Wireless-N 8-Port Gigabit VPN Firewall FVS318N
Configure Advanced Radio Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . .125
Test Basic Wireless Connectivity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .127
Chapter 5 Firewall Protection
About Firewall Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .128
Administrator Tips. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .129
Overview of Rules to Block or Allow Specific Kinds of Traffic . . . . . . . . .129
Outbound Rules (Service Blocking) . . . . . . . . . . . . . . . . . . . . . . . . . . .130
Inbound Rules (Port Forwarding) . . . . . . . . . . . . . . . . . . . . . . . . . . . . .133
Order of Precedence for Rules. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .137
Configure LAN WAN Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .138
Create LAN WAN Outbound Service Rules . . . . . . . . . . . . . . . . . . . . .140
Create LAN WAN Inbound Service Rules . . . . . . . . . . . . . . . . . . . . . .143
Configure DMZ WAN Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .145
Create DMZ WAN Outbound Service Rules. . . . . . . . . . . . . . . . . . . . .148
Create DMZ WAN Inbound Service Rules . . . . . . . . . . . . . . . . . . . . . .150
Configure LAN DMZ Rules. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .153
Create LAN DMZ Outbound Service Rules . . . . . . . . . . . . . . . . . . . . .155
Create LAN DMZ Inbound Service Rules. . . . . . . . . . . . . . . . . . . . . . .157
Examples of Firewall Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .159
Examples of Inbound Firewall Rules . . . . . . . . . . . . . . . . . . . . . . . . . .159
Examples of Outbound Firewall Rules . . . . .. . . . . . . . . . . . . . . . . . . .164
Configure Other Firewall Features. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .166
Attack Checks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .166
Set Limits for IPv4 Sessions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .170
Manage the Application Level Gateway for SIP Sessions . . . . . . . . . .171
Services, Bandwidth Profiles, and QoS Profiles. . . . . . . . . . . . . . . . . . . .172
Add Customized Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .172
Create Bandwidth Profiles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .175
Preconfigured Quality of Service Profiles. . . . . . . . . . . . . . . . . . . . . . .177
Configure Content Filtering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .178
Set a Schedule to Block or Allow Specific Traffic. . . . . . . . . . . . . . . . . . .182
Enable Source MAC Filtering. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .183
Set Up IP/MAC Bindings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .184
Configure Port Triggering. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .190
Configure Universal Plug and Play. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .192
Chapter 6 Virtual Private Networking
Using IPSec and L2TP Connections
Use the IPSec VPN Wizard for Client and Gateway Configurations . . . .194
Create an IPv4 Gateway-to-Gateway VPN Tunnel with the Wizard. . .195
Create an IPv6 Gateway-to-Gateway VPN Tunnel with the Wizard. . .199
Create an IPv4 Client-to-Gateway VPN Tunnel with the Wizard . . . . .203
Test the Connection and View Connection and Status Information. . . . .218
Test the NETGEAR VPN Client Connection . . . . . . . . . . . . . . . . . . . .218
NETGEAR VPN Client Status and Log Information . . . . . . . . . . . . . . .220
View the Wireless VPN Firewall IPSec VPN Connection Status . . . . .220

7
ProSafe Wireless-N 8-Port Gigabit VPN Firewall FVS318N
View the Wireless VPN Firewall IPSec VPN Log . . . . . . . . . . . . . . . . .221
Manage IPSec VPN Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .222
Manage IKE Policies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .222
Manage VPN Policies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .230
Configure Extended Authentication (XAUTH) . . . . . . . . . . . . . . . . . . . . .238
Configure XAUTH for VPN Clients . . . . . . . . . . . . . . . . . . . . . . . . . . . .239
User Database Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .240
RADIUS Client and Server Configuration. . . . . . . . . . . . . . . . . . . . . . .240
Assign IPv4 Addresses to Remote Users (Mode Config). . . . . . . . . . . . .243
Mode Config Operation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .243
Configure Mode Config Operation on the Wireless VPN Firewall . . . .244
Configure the ProSafe VPN Client for Mode Config Operation . . . . . .251
Test the Mode Config Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . .258
Modify or Delete a Mode Config Record. . . . . . . . . . . . . . . . . . . . . . . .259
Configure Keep-Alives and Dead Peer Detection . . . . . . . . . . . . . . . . . .259
Configure Keep-Alives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .260
Configure Dead Peer Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .261
Configure NetBIOS Bridging with IPSec VPN . . . . . . . . . . . . . . . . . . . . .262
Configure the L2TP Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .263
View the Active L2TP Users. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .265
Chapter 7 Virtual Private Networking
Using SSL Connections
SSL VPN Portal Options. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .266
Overview of the SSL Configuration Process . .. . . . . . . . . . . . . . . . . . . .267
Create the Portal Layout. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .268
Configure Domains, Groups, and Users. . . . . . . . . . . . . . . . . . . . . . . . . .272
Configure Applications for Port Forwarding . . . . . . . . . . . . . . . . . . . . . . .273
Add Servers and Port Numbers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .273
Add a New Host Name. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .274
Configure the SSL VPN Client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .275
Configure the Client IP Address Range . . . . . . . . . . . . . . . . . . . . . . . .276
Add Routes for VPN Tunnel Clients . . . . . . . . . . . . . . . . . . . . . . . . . . .278
Use Network Resource Objects to Simplify Policies . . . . . . . . . . . . . . . .279
Add New Network Resources. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .279
Edit Network Resources to Specify Addresses . . . . . . . . . . . . . . . . . .280
Configure User, Group, and Global Policies. . . . . . . . . . . . . . . . . . . . . . .282
View Policies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .283
Add an IPv4 or IPv6 SSL VPN Policy. . . . . . . . . . . . . . . . . . . . . . . . . .284
Access the New SSL Portal Login Screen . . . .. . . . . . . . . . . . . . . . . . . .288
View the SSL VPN Connection Status and SSL VPN Log. . . . . . . . . . . .292
Chapter 8 Manage Users, Authentication, and VPN Certificates
The Wireless VPN Firewall’s Authentication Process and Options . . . . .294
Configure Authentication Domains, Groups, and Users. . . . . . . . . . . . . .296
Configure Domains. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .296
Configure Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .300

8
ProSafe Wireless-N 8-Port Gigabit VPN Firewall FVS318N
Configure User Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .303
Set User Login Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .306
Change Passwords and Other User Settings. . . . . . . . . . . . . . . . . . . .311
Manage Digital Certificates for VPN Connections . . . . . . . . . . . . . . . . . .313
VPN Certificates Screen. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .314
Manage VPN CA Certificates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .315
Manage VPN Self-Signed Certificates . . . . . . . . . . . . . . . . . . . . . . . . .316
Manage the VPN Certificate Revocation List . . . . . . . . . . . . . . . . . . . .320
Chapter 9 Network and System Management
Performance Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .322
Bandwidth Capacity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .322
Features That Reduce Traffic. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .323
Features That Increase Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .325
Use QoS and Bandwidth Assignment to Shift the Traffic Mix. . . . . . . .328
Monitoring Tools for Traffic Management. . . . . . . . . . . . . . . . . . . . . . .328
System Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .329
Change Passwords and Administrator and Guest Settings . . . . . . . . .329
Configure Remote Management Access . . . . . . . . . . . . . . . . . . . . . . .331
Use the Command-Line Interface. . . . . . . . . . . . . . . . . . . . . . . . . . . . .335
Use a Simple Network Management Protocol Manager. . . . . . . . . . . .335
Manage the Configuration File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .340
Configure Date and Time Service . . . . . . . . . . . . . . . . . . . . . . . . . . . .344
Chapter 10 Monitor System Access and Performance
Enable the WAN Traffic Meter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .346
Configure Logging, Alerts, and Event Notifications . . . . . . . . . . . . . . . . .349
How to Send Syslogs over a VPN Tunnel between Sites . . . . . . . . . .353
View Status Screens . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .356
View the System Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .356
View the VPN Connection Status and L2TP Users . . . . . . . . . . . . . . .364
View the VPN Logs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .365
View the Port Triggering Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .366
View the WAN Port Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .367
View the Attached Devices and the DHCP Log . . . . . . . . . . . . . . . . . .370
View the Status of a Wireless Profile . . . . . . . . . . . . . . . . . . . . . . . . . .372
Diagnostics Utilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .373
Send a Ping Packet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .375
Trace a Route. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .375
Look Up a DNS Address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .375
Display the Routing Tables. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .376
Capture Packets in Real Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .376
Reboot the Wireless VPN Firewall Remotely. .. . . . . . . . . . . . . . . . . .377
Chapter 11 Troubleshooting
Basic Functioning. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .379

9
ProSafe Wireless-N 8-Port Gigabit VPN Firewall FVS318N
Power LED Not On. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .379
Test LED Never Turns Off . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .379
LAN or WAN Port LEDs Not On . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .380
Troubleshoot the Web Management Interface. . . . . . . . . . . . . . . . . . . . .380
When You Enter a URL or IP Address, a Time-Out Error Occurs . . . . . .381
Troubleshoot the ISP Connection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .382
Troubleshooting the IPv6 Connection . . . . . . . . . . . . . . . . . . . . . . . . . . .383
Troubleshoot a TCP/IP Network Using a Ping Utility . . . . . . . . . . . . . . . .386
Test the LAN Path to Your Wireless VPN Firewall. . . . . . . . . . . . . . . .386
Test the Path from Your Computer to a Remote Device . . . . . . . . . . .387
Restore the Default Configuration and Password . . . . . . . . . . . . . . . . . .388
Address Problems with Date and Time . . . . . . . . . . . . . . . . . . . . . . . . . .389
Access the Knowledge Base and Documentation. . . . . . . . . . . . . . . . . .389
Appendix A Default Settings and Technical Specifications
Factory Default Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .390
Physical and Technical Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . .396
Appendix B Two-Factor Authentication
Why Do I Need Two-Factor Authentication? . . . . . . . . . . . . . . . . . . . . . .400
What Are the Benefits of Two-Factor Authentication? . . . . . . . . . . . . .400
What Is Two-Factor Authentication?. . . . . . . . . . . . . . . . . . . . . . . . . . .401
NETGEAR Two-Factor Authentication Solutions . . . . . . . . . . . . . . . . . . .401
Appendix C Notification of Compliance (Wired)
Appendix D Notification of Compliance (Wireless)
Index

10
1
1. Introduction
This chapter provides an overview of the features and capabilities of the ProSafe Wireless-N
8-Port Gigabit VPN Firewall FVS318N and explains how to log in to the device and use its web
management interface. The chapter contains the following sections:
•What Is the ProSafe Wireless-N 8-Port Gigabit VPN Firewall FVS318N?
•Key Features and Capabilities
•Package Contents
•Hardware Features
•Choose a Location for the Wireless VPN Firewall
•Log In to the Wireless VPN Firewall
•Web Management Interface Menu Layout
•Requirements for Entering IP Addresses
Note: For more information about the topics covered in this manual, visit
the FVS318N support website at http://support.netgear.com.
What Is the ProSafe Wireless-N 8-Port Gigabit VPN
Firewall FVS318N?
The ProSafe Wireless-N 8-Port Gigabit VPN Firewall FVS318N, hereafter referred to as the
wireless VPN firewall, connects your local area network (LAN) and wireless LAN (WLAN) to
the Internet through an external broadband access device such as a cable or DSL modem,
satellite or wireless Internet dish, or another router. A 2.4-GHz radio supports wireless
connections in 802.11n mode with support for legacy clients in 802.11b and 802.11g mode.
The wireless VPN firewall routes both IPv4 and IPv6 traffic. A powerful, flexible firewall
protects your IPv4 and IPv6 networks from denial of service (DoS) attacks, unwanted traffic,
and traffic with objectionable content. IPv6 traffic is supported through 6to4 and Intra-Site
Automatic Tunnel Addressing Protocol (ISATAP) tunnels.

Introduction
11
ProSafe Wireless-N 8-Port Gigabit VPN Firewall FVS318N
The wireless VPN firewall provides advanced IPSec and SSL VPN technologies with support
for up to 12 IPSec VPN tunnels and 5 SSL VPN tunnels, as well as L2TP support for easy
and secure remote connections. The use of Gigabit Ethernet WAN and LAN ports ensures
high data transfer speeds.
Key Features and Capabilities
•Wireless Features
•Advanced VPN Support for Both IPSec and SSL
•A Powerful, True Firewall
•Security Features
•Autosensing Ethernet Connections with Auto Uplink
•Extensive Protocol Support
•Easy Installation and Management
•Maintenance and Support
The wireless VPN firewall provides the following key features and capabilities:
•A single 10/100/1000 Mbps Gigabit Ethernet WAN port
•Built-in eight-port 10/100/1000 Mbps Gigabit Ethernet LAN switch for extremely fast data
transfer between local network resources
•A wireless radio with up to four wireless profiles
•Both IPv4 and IPv6 support
•Advanced IPSec VPN and SSL VPN support
•L2TP tunnel support
•Advanced stateful packet inspection (SPI) firewall with multi-NAT support
•SNMP support with SNMPv1, SNMPv2c, and SNMPv3, and management optimized for
the NETGEAR ProSafe Network Management Software (NMS200) over a LANJ
connection.
•Front panel LEDs for easy monitoring of status and activity
•Flash memory for firmware upgrade
•Internal universal switching power supply
Wireless Features
The wireless VPN firewall supports the following features:
•2.4 GHz radio. 2.4-GHz band support with 802.11b/g/n wireless modes.
•Wireless profiles. Support for up to four wireless profiles, each with its own SSID.
•Access control. The Media Access Control (MAC) address filtering feature can ensure
that only trusted wireless stations can use the wireless VPN firewall to gain access to
your LAN.

Introduction
12
ProSafe Wireless-N 8-Port Gigabit VPN Firewall FVS318N
•Hidden mode. The SSID is not broadcast, assuring that only clients configured with the
correct SSID can connect.
•Secure and economical operation. Adjustable power output allows more secure or
economical operation.
Advanced VPN Support for Both IPSec and SSL
The wireless VPN firewall supports IPSec and SSL virtual private network (VPN)
connections:
•IPSec VPN delivers full network access between a central office and branch offices, or
between a central office and telecommuters. Remote access by telecommuters requires
the installation of VPN client software on the remote computer.
-IPSec VPN with broad protocol support for secure connection to other IPSec
gateways and clients.
-Up to 12 simultaneous IPSec VPN connections.
-Bundled with a 30-day trial license for the ProSafe VPN Client software (VPN01L).
•SSL VPN provides remote access for mobile users to selected corporate resources
without requiring a preinstalled VPN client on their computers.
-Uses the familiar Secure Sockets Layer (SSL) protocol, commonly used for
e-commerce transactions, toprovide client-free access with customizable user portals
and support for a wide variety of user repositories.
-Up to five simultaneous SSL VPN connections.
-Allows browser-based, platform-independent remote access through a number of
popular browsers, such as Microsoft Internet Explorer, Mozilla Firefox, and Apple
Safari.
-Provides granular access to corporate resources based on user type or group
membership.
A Powerful, True Firewall
Unlike simple NAT routers, the wireless VPN firewall is a true firewall, using stateful packet
inspection (SPI) to defend against hacker attacks. Its firewall features have the following
capabilities:
•DoS protection.Automatically detects and thwarts denial of service (DoS) attacks such
as Ping of Death and SYN flood.
•Secure firewall.Blocks unwanted traffic from the Internet to your LAN.
•Schedule policies. Permits scheduling of firewall policies by day and time.
•Logs security incidents.Logs security events such as logins and secure logins. You can
configure the firewall to email the log to you at specified intervals.

Introduction
13
ProSafe Wireless-N 8-Port Gigabit VPN Firewall FVS318N
Security Features
The wireless VPN firewall is equipped with several features designed to maintain security:
•Computers hidden by NAT. NAT opens a temporary path to the Internet for requests
originating from the local network. Requests originating from outside the LAN are
discarded, preventing users outside the LAN from finding and directly accessing the
computers on the LAN.
•Port forwarding with NAT.Although NAT prevents Internet locations from directly
accessing the computers on the LAN, the wireless VPN firewall allows you to direct
incoming traffic to specific computers based on the service port number of the incoming
request.
•DMZ port. Incoming traffic from the Internet is usually discarded by the wireless VPN
firewall unless the traffic is a response to one of your local computers or a service for
which you have configured an inbound rule. Instead of discarding this traffic, you can use
the dedicated demilitarized zone (DMZ) port to forward the traffic to one computer on your
network.
Autosensing Ethernet Connections with Auto Uplink
With its internal eight-port 10/100/1000 Mbps switch and 10/100/1000 WAN port, the wireless
VPN firewall can connect to either a 10 Mbps standard Ethernet network, a 100 Mbps Fast
Ethernet network, or a 1000 Mbps Gigabit Ethernet network. The LAN and WAN interfaces
are autosensing and capable of full-duplex or half-duplex operation.
The wireless VPN firewall incorporates Auto UplinkTM technology. Each Ethernet port
automatically senses whether the Ethernet cable plugged into the port should have a normal
connection such as to a computer or an uplink connection such as to a switch or hub. That
port then configures itself correctly. This feature eliminates the need for you to think about
crossover cables, as Auto Uplink accommodates either type of cable to make the right
connection.
Extensive Protocol Support
The wireless VPN firewall supports the Transmission Control Protocol/Internet Protocol
(TCP/IP) and Routing Information Protocol (RIP). The wireless VPN firewall provides the
following protocol support:
•IP address sharing by NAT. The wireless VPN firewall allows many networked
computers to share an Internet account using only a single IP address, which might be
statically or dynamically assigned by your Internet service provider (ISP). This technique,
known as Network Address Translation (NAT), allows the use of an inexpensive
single-user ISP account.
•Automatic configuration of attached computers by DHCP. The wireless VPN firewall
dynamically assigns network configuration information, including IP, gateway, and
Domain Name Server (DNS) addresses, to attached computers on the LAN using the

Introduction
14
ProSafe Wireless-N 8-Port Gigabit VPN Firewall FVS318N
Dynamic Host Configuration Protocol (DHCP). This feature greatly simplifies
configuration of computers on your local network.
•DNS proxy. When DHCP is enabled and no DNS addresses are specified, the firewall
provides its own address as a DNS server to the attached computers. The firewall obtains
actual DNS addresses from the ISP during connection setup and forwards DNS requests
from the LAN.
•PPP over Ethernet (PPPoE). PPPoE is a protocol for connecting remote hosts to the
Internet over a DSL connection by simulating a dial-up connection.
•Quality of Service (QoS).The wireless VPN firewall supports QoS.
•Layer 2 Tunneling Protocol (L2TP). A tunneling protocol that is used to support virtual
private networks (VPNs).
Easy Installation and Management
You can install, configure, and operate the wireless VPN firewall within minutes after
connecting it to the network. The following features simplify installation and management
tasks:
•Browser-based management. Browser-based configuration allows you to easily
configure the wireless VPN firewall from almost any type of operating system, such as
Windows, Macintosh, or Linux. Online help documentation is built into the browser-based
web management interface.
•Auto-detection of ISP. The wireless VPN firewall automatically senses the type of
Internet connection, asking you only for the information required for your type of ISP
account.
•IPSec VPN Wizard. The wireless VPN firewall includes the NETGEAR IPSec VPN
Wizard so you can easily configure IPSec VPN tunnels according to the
recommendations of the Virtual Private Network Consortium (VPNC). This ensures that
the IPSec VPN tunnels are interoperable with other VPNC-compliant VPN routers and
clients.
•SNMP. The wireless VPN firewall supports the Simple Network Management Protocol
(SNMP) to let you monitor and manage log resources from an SNMP-compliant system
manager. The SNMP system configuration lets you change the system variables for
MIB2.
•Diagnostic functions. The wireless VPN firewall incorporates built-in diagnostic
functions such as ping, traceroute, DNS lookup, and remote reboot.
•Remote management. The wireless VPN firewall allows you to log in to the web
management interface from a remote location on the Internet. For security, you can limit
remote management access to a specified remote IP address or range of addresses.
•Visual monitoring. The wireless VPN firewall’s front panel LEDs provide an easy way to
monitor its status and activity.

Introduction
15
ProSafe Wireless-N 8-Port Gigabit VPN Firewall FVS318N
Maintenance and Support
NETGEAR offers the following features to help you maximize your use of the wireless VPN
firewall:
•Flash memory for firmware upgrades.
•Technical support seven days a week, 24 hours a day. Information about support is
available on the NETGEAR website at
http://support.netgear.com/app/answers/detail/a_id/212.
Package Contents
The wireless VPN firewall product package contains the following items:
•ProSafe Wireless-N 8-Port Gigabit VPN Firewall FVS318N
•One 12V 1A power supply unit for your region
•Rubber feet
•Ethernet cable
•ProSafe Wireless-N 8-Port Gigabit VPN Firewall FVS318N Installation Guide
•Resource CD, including:
-Application Notes and other helpful information
-30-day trial license for the ProSafe VPN Client software (VPN01L)
If any of the parts are incorrect, missing, or damaged, contact your NETGEAR dealer. Keep
the carton, including the original packing materials, in case you need to return the product for
repair.
Hardware Features
•Front Panel
•Rear Panel
•Bottom Panel with Product Label
The front panel ports and LEDs, rear panel ports, and bottom label of the wireless VPN
firewall are described in the following sections.
Front Panel
Viewed from left to right, the wireless VPN firewall front panel contains the following ports:
•LAN Ethernet ports. Eight switched N-way automatic speed negotiating, Auto MDI/MDIX,
Gigabit Ethernet ports with RJ-45 connectors.
•WAN Ethernet port. One independent N-way automatic speed negotiating, Auto
MDI/MDIX, Gigabit Ethernet port with an RJ-45 connector.

Introduction
16
ProSafe Wireless-N 8-Port Gigabit VPN Firewall FVS318N
The front panel also contains three groups of status indicator light-emitting diodes (LEDs),
including Power and Test LEDs, LAN LEDs, and WAN LEDs, all of which are explained in
detail in the following table. Some LED explanation is provided on the front panel.
Figure 1.
The following table describes the function of each LED.
Table 1. LED descriptions
LED Activity Description
Power LED On (green) Power is supplied to the wireless VPN firewall.
Off Power is not supplied to the wireless VPN firewall.
Test LED On (amber) during
startup. Test mode. The wireless VPN firewall is initializing. After approximately 2 minutes, when the wireless VPN firewall has completed its initialization, the
Test LED goes off.
On (amber) during
any other time The initialization has failed, or a hardware failure has occurred.
Blinking (amber) The wireless VPN firewall is writing to flash memory (during upgrading or
resetting to defaults).
Off The wireless VPN firewall has booted successfully.
Power
Test LED DMZ LED
Left WAN LED
Right WAN LED
Active WAN LED
Wireless LED
LED Left LAN LEDs
Right LAN LEDs
(green, one for each port)
(one for each port)
(green)

Introduction
17
ProSafe Wireless-N 8-Port Gigabit VPN Firewall FVS318N
LAN Ports
Left LED Off The LAN port has no link.
On (green) The LAN port has detected a link with a connected Ethernet device.
Blinking (green) Data is being transmitted or received by the LAN port.
Right LED Off The LAN port is operating at 10 Mbps.
On (amber) The LAN port is operating at 100 Mbps.
On (green) The LAN port is operating at 1000 Mbps.
DMZ LED Off Port 8 is operating as a normal LAN port.
On (green) Port 8 is operating as a dedicated hardware DMZ port.
WAN Port
Left LED Off The WAN port has no physical link, that is, no Ethernet cable is plugged into
the wireless VPN firewall.
On (green) The WAN port has a valid connection with a device that provides an Internet
connection.
Blinking (green) Data is being transmitted or received by the WAN port.
Right LED Off The WAN port is operating at 10 Mbps.
On (amber) The WAN port is operating at 100 Mbps.
On (green) The WAN port is operating at 1000 Mbps.
Active LED Off There is no link to the Internet.
On (green) There is a link to the Internet.
Table 1. LED descriptions (continued)
LED Activity Description

Introduction
18
ProSafe Wireless-N 8-Port Gigabit VPN Firewall FVS318N
Rear Panel
The rear panel of the wireless VPN firewall includes the antennas, a cable lock receptacle, a
console port, a Reset button, a DC power connection, and a power switch.
Figure 2.
Viewed from left to right, the rear panel contains the following components:
1. Dipole antenna.
2. Cable security lock receptacle.
3. Console port. Port for connecting to an optional console terminal. The port has a DB9 male
connector. The default baud rate is 9600 K. The pinouts are (2) Tx, (3) Rx, (5) and (7) Gnd.
4. Factory default Reset button. Using a sharp object, press and hold this button for about
8 seconds until the front panel Test LED flashes to reset the wireless VPN firewall to factory
default settings. All configuration settings are lost, and the default password is restored.
5. DC power plug receptacle. Power input is 12VDC, 1A. The power plug is localized to the
country of sale.
6. Power On/Off switch.
7. Dipole antenna.
(2) Security lock
receptacle
(3) Console port
(4) Factory default
(5) DC power
receptacle
Reset button
Antennas
(6) Power
(1) and (7)
switch

Introduction
19
ProSafe Wireless-N 8-Port Gigabit VPN Firewall FVS318N
Bottom Panel with Product Label
The product label on the bottom of the wireless VPN firewall’s enclosure displays factory
defaults settings, regulatory compliance, and other information.
Figure 3.
Choose a Location for the Wireless VPN Firewall
The wireless VPN firewall is suitable for use in an office environment where it can be
freestanding (on its runner feet) or mounted into a standard 19-inch equipment rack.
Alternatively, you can rack-mount the wireless VPN firewall in a wiring closet or equipment
room.
Consider the following when deciding where to position the wireless VPN firewall:
•The unit is accessible, and cables can be connected easily.
•Cabling is away from sources of electrical noise. These include lift shafts, microwave
ovens, and air-conditioning units.
•Water or moisture cannot enter the case of the unit.
•Airflow around the unit and through the vents in the side of the case is not restricted.
Provide a minimum of 25 mm or 1 inch clearance.
•The air is as free of dust as possible.
•Temperature operating limits are not likely to be exceeded. Install the unit in a clean,
air-conditioned environment. For information about the recommended operating
temperatures for the wireless VPN firewall, see Appendix A, Default Settings and
Technical Specifications.

Introduction
20
ProSafe Wireless-N 8-Port Gigabit VPN Firewall FVS318N
Log In to the Wireless VPN Firewall
Note: To connect the wireless VPN firewall physically to your network,
connect the cables and restart your network according to the
instructions in the ProSafe Wireless-N 8-Port Gigabit VPN Firewall
FVS318N Installation Guide. A PDF of this guide is on the
NETGEAR support website at
http://support.netgear.com/app/products/model/a_id/19435.
To configure the wireless VPN firewall, you need to use a web browser such as Microsoft
Internet Explorer 7.0 or later, Mozilla Firefox 4.0 or later, or Apple Safari 3.0 or later with
JavaScript, cookies, and SSL enabled. (Google Chrome is not supported at this time.)
Although these web browsers are qualified for use with the wireless VPN firewall’s web
management interface, SSL VPN users should choose a browser that supports JavaScript,
Java, cookies, SSL, and ActiveX to take advantage of the full suite of applications. Note that
Java is required only for the SSL VPN portal, not for the web management interface.
To log in to the wireless VPN firewall:
1. Start any of the qualified web browsers.
2. In the address field, enter https://192.168.1.1. The NETGEAR Configuration Manager Login
screen displays in the browser.
Note: The wireless VPN firewall factory default IP address is 192.168.1.1.
If you change the IP address, you need to use the IP address that
you assigned to the wireless VPN firewall to log in to the wireless
VPN firewall.