NETGEAR ProSafe FVS318v3 User manual

202-10059-03
January 2012
v5.0
NETGEAR, Inc.
350 East Plumeria Drive
San Jose, CA 95134 USA
ProSafe VPN Firewall
FVS318v3 Reference
Manual

ii
v5.0, January 2012
© 2012 by NETGEAR, Inc. All rights reserved.
Trademarks
NETGEAR and the NETGEAR logo are trademarks of NETGEAR, Inc.
Microsoft, Windows, and Windows NT are registered trademarks of Microsoft Corporation.
Other brand and product names are registered trademarks or trademarks of their respective holders.
Statement of Conditions
In the interest of improving internal design, operational function, and/or reliability, NETGEAR reserves the right to
make changes to the products described in this document without notice.
NETGEAR does not assume any liability that may occur due to the use or application of the product(s) or circuit
layout(s) described herein.
Federal Communications Commission (FCC) Compliance Notice: Radio Frequency Notice
This equipment has been tested and found to comply with the limits for a Class B digital device, pursuant to
part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a
residential installation. This equipment generates, uses, and can radiate radio frequency energy and, if not installed and
used in accordance with the instructions, may cause harmful interference to radio communications. However, there is no
guarantee that interference will not occur in a particular installation. If this equipment does cause harmful interference to
radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try
to correct the interference by one or more of the following measures:
• Reorient or relocate the receiving antenna.
• Increase the separation between the equipment and receiver.
• Connect the equipment into an outlet on a circuit different from that to which the receiver is connected.
• Consult the dealer or an experienced radio/TV technician for help.
EN 55 022 Declaration of Conformance
This is to certify that the ProSafe VPN Firewall is shielded against the generation of radio interference in accordance
with the application of Council Directive 89/336/EEC, Article 4a. Conformity is declared by the application of EN 55
022 Class B (CISPR 22).
Bestätigung des Herstellers/Importeurs
Es wird hiermit bestätigt, daß das ProSafe VPN Firewall gemäß der im BMPT-AmtsblVfg 243/1991 und Vfg 46/1992
aufgeführten Bestimmungen entstört ist. Das vorschriftsmäßige Betreiben einiger Geräte (z.B. Testsender) kann jedoch
gewissen Beschränkungen unterliegen. Lesen Sie dazu bitte die Anmerkungen in der Betriebsanleitung.
Das Bundesamt für Zulassungen in der Telekommunikation wurde davon unterrichtet, daß dieses Gerät auf den Markt
gebracht wurde und es ist berechtigt, die Serie auf die Erfüllung der Vorschriften hin zu überprüfen.
Certificate of the Manufacturer/Importer
It is hereby certified that the ProSafe VPN Firewall has been suppressed in accordance with the conditions set out in the
BMPT-AmtsblVfg 243/1991 and Vfg 46/1992. The operation of some equipment (for example, test transmitters) in
accordance with the regulations may, however, be subject to certain restrictions. Please refer to the notes in the operating
instructions.

v5.0, January 2012
iii
Federal Office for Telecommunications Approvals has been notified of the placing of this equipment on the market
and has been granted the right to test the series for compliance with the regulations.
Voluntary Control Council for Interference (VCCI) Statement
This equipment is in the second category (information equipment to be used in a residential area or an adjacent area
thereto) and conforms to the standards set by the Voluntary Control Council for Interference by Data Processing
Equipment and Electronic Office Machines aimed at preventing radio interference in such residential areas.
When used near a radio or TV receiver, it may become the cause of radio interference.
Read instructions for correct handling.
Product and Publication Details
Model Number: FVS318v3
Publication Date: January 2012
Product Family: VPN Firewall
Product Name: ProSafe VPN Firewall
Home or Business Product: Business
Language: English
Publication Part Number: 202-10059-03
Publication Version Number 5.0

v5.0, January 2012
iv

v
v5.0, January 2012
Contents
About This Manual
Conventions, Formats and Scope .................................................................................... xi
How to Print this Manual .................................................................................................. xii
Revision History ...............................................................................................................xiii
Chapter 1
Introduction
Key Features of the VPN Firewall ..................................................................................1-1
A Powerful, True Firewall with Content Filtering ......................................................1-2
Security ....................................................................................................................1-2
Autosensing Ethernet Connections with Auto Uplink ...............................................1-2
Extensive Protocol Support ......................................................................................1-3
Easy Installation and Management ..........................................................................1-3
Maintenance and Support ........................................................................................1-4
Package Contents ..........................................................................................................1-4
The FVS318v3 Front Panel ......................................................................................1-5
The FVS318v3 Rear Panel ......................................................................................1-6
NETGEAR-Related Products .........................................................................................1-7
NETGEAR Product Registration, Support, and Documentation .....................................1-7
Chapter 2
Connecting the Firewall to the Internet
Prepare to Install Your ProSafe VPN Firewall ...............................................................2-1
First, Connect the FVS318v3 .........................................................................................2-1
Now, Configure the FVS318v3 for Internet Access ........................................................2-4
Troubleshooting Tips ......................................................................................................2-6
Accessing the VPN Firewall Overview ...........................................................................2-7
Logging On to the FVS318v3 After Configuration Settings Have Been Applied ......2-9
Bypassing the Configuration Assistant ...................................................................2-10

vi
v5.0, January 2012
Using the Smart Setup Wizard .....................................................................................2-11
Manually Configuring Your Internet Connection ...........................................................2-11
Chapter 3
Firewall Protection and Content Filtering
Firewall Protection and Content Filtering Overview ........................................................3-1
Block Sites ......................................................................................................................3-2
Using Rules to Block or Allow Specific Kinds of Traffic ..................................................3-3
Inbound Rules (Port Forwarding) .............................................................................3-5
Inbound Rule Example: A Local Public Web Server .........................................3-6
Inbound Rule Example: Allowing a Videoconference from Restricted
Addresses ..........................................................................................................3-6
Considerations for Inbound Rules .....................................................................3-7
Outbound Rules (Service Blocking) .........................................................................3-7
Order of Precedence for Rules ................................................................................3-9
Default DMZ Server .................................................................................................3-9
Respond to Ping on Internet WAN Port .................................................................3-10
Services ........................................................................................................................3-10
Using a Schedule to Block or Allow Specific Traffic .....................................................3-13
Getting E-Mail Notifications of Event Logs and Alerts ..................................................3-15
Viewing Logs of Web Access or Attempted Web Access .............................................3-17
Chapter 4
Basic Virtual Private Networking
Overview of VPN Configuration ......................................................................................4-2
Client-to-Gateway VPN Tunnels ..............................................................................4-2
Gateway-to-Gateway VPN Tunnels .........................................................................4-2
Planning a VPN ..............................................................................................................4-3
VPN Tunnel Configuration ..............................................................................................4-5
Setting Up a Client-to-Gateway VPN Configuration .......................................................4-5
Step 1: Configuring the Client-to-Gateway VPN Tunnel on the FVS318v3 .............4-6
Step 2: Configuring the NETGEAR ProSafe VPN Client on the Remote PC ...........4-9
Monitoring the Progress and Status of the VPN Client Connection .......................4-17
Transferring a Security Policy to Another Client ....................................................4-18
Exporting a Security Policy ..............................................................................4-18
Importing a Security Policy ..............................................................................4-19
Setting Up a Gateway-to-Gateway VPN Configuration ................................................4-21

vii
v5.0, January 2012
Activating the VPN Tunnel .....................................................................................4-27
Using a Web browser to Activate the VPN Tunnel ..........................................4-27
Using the VPN Status Page to Activate a VPN Tunnel ...................................4-27
Pinging the Remote Endpoint ..........................................................................4-28
Verifying the Status of a VPN Tunnel .....................................................................4-30
Deactivating a VPN Tunnel ....................................................................................4-31
Deleting a VPN Tunnel ...........................................................................................4-33
Chapter 5
Advanced Virtual Private Networking
Overview of FVS318v3 Policy-Based VPN Configuration ..............................................5-1
Using Policies to Manage VPN Tunnel Traffic .........................................................5-1
IKE Policy Automatic Key and Authentication Management ....................................5-2
VPN Policy Configuration for Auto Key Negotiation .................................................5-5
VPN Policy Configuration for Manual Key Exchange ...............................................5-9
Using Digital Certificates for IKE Auto-Policy Authentication .......................................5-13
Trusted Certificates ................................................................................................5-13
Certificate Revocation List (CRL) ...........................................................................5-14
VPN Configuration Scenarios for the FVS318v3 ..........................................................5-14
FVS318v3 Scenario 1: Gateway-to-Gateway with Preshared Secrets ..................5-15
FVS318v3 Scenario 2: FVS318v3 to FVS318v3 with RSA Certificates .................5-21
Checking VPN Connections ...................................................................................5-26
Chapter 6
Maintenance
Viewing VPN Firewall Status Information .......................................................................6-1
Viewing a List of Attached Devices ................................................................................6-5
Upgrading the Firewall Software ....................................................................................6-5
Configuration File Management .....................................................................................6-6
Backing Up the Configuration ..................................................................................6-7
Restoring the Configuration .....................................................................................6-7
Erasing the Configuration .........................................................................................6-7
Changing the Administrator Password ...........................................................................6-8
Chapter 7
Advanced Configuration
How to Configure Dynamic DNS ....................................................................................7-1
Using the LAN IP Setup Options ....................................................................................7-2

viii
v5.0, January 2012
Configuring LAN TCP/IP Setup Parameters ............................................................7-2
Using the Firewall as a DHCP server .......................................................................7-4
Using Address Reservation ......................................................................................7-4
Configuring Static Routes ...............................................................................................7-5
Enabling Remote Management Access .........................................................................7-7
Chapter 8
Troubleshooting
Basic Functioning ...........................................................................................................8-1
Power LED Not On ...................................................................................................8-1
LEDs Never Turn Off ................................................................................................8-1
LAN or Internet Port LEDs Not On ...........................................................................8-2
Troubleshooting the Web Configuration Interface ..........................................................8-2
Troubleshooting the ISP Connection ..............................................................................8-3
Troubleshooting a TCP/IP Network Using a Ping Utility .................................................8-5
Testing the LAN Path to Your Firewall .....................................................................8-5
Testing the Path from Your PC to a Remote Device ................................................8-6
Restoring the Default Configuration and Password ........................................................8-6
Problems with Date and Time ........................................................................................8-7
Appendix A
Technical Specifications and Factory Default Settings
Appendix B
Related Documents
Appendix C
Sample VPN Configurations with FVS318v3
Case Study Overview .................................................................................................... C-1
Gathering the Network Information ......................................................................... C-1
Configuring the Gateways ....................................................................................... C-2
Activating the VPN Tunnel ...................................................................................... C-5
The FVS318v3-to-FVS318v3 Case ............................................................................... C-5
Configuring the VPN Tunnel ................................................................................... C-6
Viewing and Editing the VPN Parameters ............................................................... C-8
Initiating and Checking the VPN Connections ...................................................... C-11
The FVS318v3-to-FVS318v2 Case ............................................................................. C-12
Configuring the VPN Tunnel ................................................................................. C-13
Viewing and Editing the VPN Parameters ............................................................. C-15

ix
v5.0, January 2012
Initiating and Checking the VPN Connections ...................................................... C-17
The FVS318v3-to-FVL328 Case ................................................................................. C-18
Configuring the VPN Tunnel ................................................................................. C-19
Viewing and Editing the VPN Parameters ............................................................. C-21
Initiating and Checking the VPN Connections ...................................................... C-24
The FVS318v3-to-VPN Client Case ............................................................................ C-25
Client-to-Gateway VPN Tunnel Overview ............................................................. C-26
Configuring the VPN Tunnel ................................................................................. C-26
Initiating and Checking the VPN Connections ...................................................... C-33
Index

x
v5.0, January 2012

-xi
v5.0, January 2012
About This Manual
The NETGEAR®ProSafe™ VPN Firewall FVS318v3 Reference Manual describes how to install,
configure and troubleshoot the ProSafe VPN Firewall . The information in this manual is intended
for readers with intermediate computer and Internet skills.
Conventions, Formats and Scope
The conventions, formats, and scope of this manual are described in the following paragraphs:
•Typographical Conventions. This manual uses the following typographical conventions:
•Formats. This manual uses the following formats to highlight special messages:
Italics Emphasis, books, CDs, URL names
Bold User input
Fixed Screen text, file and server names, extensions, commands, IP addresses
Note: This format is used to highlight information of importance or special interest.
Tip: This format is used to highlight a procedure that will save time or resources.
Warning: Ignoring this type of note may result in a malfunction or damage to the
equipment.
Danger: This is a safety warning. Failure to take heed of this notice may result in
personal injury or death.

ProSafe VPN Firewall FVS318v3 Reference Manual
-xii
v5.0, January 2012
•Scope. This manual is written for the VPN firewall according to these specifications:
For more information about network, Internet, firewall, and VPN technologies, see the links to the
NETGEAR website in .Appendix B, “Related Documents”
How to Print this Manual
To print this manual you can choose one of the following several options, according to your needs.
•Printing from PDF. Your computer must have the free Adobe Acrobat reader installed in
order to view and print PDF files. The Acrobat reader is available on the Adobe Web site at
http://www.adobe.com.
–Printing a PDF Chapter. Use the PDF of This Chapter link at the top left of any page.
• Click the PDF of This Chapter link at the top left of any page in the chapter you want
to print. The PDF version of the chapter you were viewing opens in a browser
window.
• Click the print icon in the upper left of your browser window.
–Printing a PDF version of the Complete Manual. Use the Complete PDF Manual link
at the top left of any page.
• Click the print icon in the upper left of your browser window.
Product Version ProSafe VPN Firewall
Manual Publication Date January 2012
Note: Product updates are available on the NETGEAR, Inc. website at
http://support.netgear.com/app/products/model/a_id/2423.
Tip: If your printer supports printing two pages on a single sheet of paper, you can
save paper and printer ink by selecting this feature.

ProSafe VPN Firewall FVS318v3 Reference Manual
-xiii
v5.0, January 2012
Revision History
Part Number Version
Number Description
202-10059-02 4.0 Documenation change only: (a) Corrected VPN client screen captures and (b)
deleted use of Schedules for Block Sites.
202-10059-03 5.0 Documentation change only: Web address keywords changed to 64 entries.

ProSafe VPN Firewall FVS318v3 Reference Manual
-xiv
v5.0, January 2012

1-1
v5.0, January 2012
Chapter 1
Introduction
This chapter describes the features of the NETGEAR ProSafe VPN Firewall .
Key Features of the VPN Firewall
The ProSafe VPN Firewall with eight-port switch connects your local area network (LAN) to the
Internet through an external access device such as a cable modem or DSL modem.
The FVS318v3 is a complete security solution that protects your network from attacks and
intrusions. Unlike simple Internet sharing firewalls that rely on Network Address Translation
(NAT) for security, the FVS318v3 uses stateful packet inspection for Denial of Service attack
(DoS) protection and intrusion detection. The FVS318v3 allows Internet access for up to 253
users. The VPN firewall provides you with multiple Web content filtering options, plus browsing
activity reporting and instant alerts — both via e-mail. Parents and network administrators can
establish restricted access policies based on time-of-day, Web site addresses and address
keywords, and share high-speed cable/DSL Internet access for up to 253 personal computers. In
addition to NAT, the built-in firewall protects you from hackers.
With minimum setup, you can install and use the firewall within minutes.
The VPN firewall provides the following features:
• Easy, Web-based setup for installation and management.
• Content filtering and site blocking security.
• Built-in eight-port 10/100 Mbps switch.
• Ethernet connection to a WAN device, such as a cable modem or DSL modem.
• Extensive protocol support.
• Login capability.
• Front panel LEDs for easy monitoring of status and activity.
• Flash memory for firmware upgrade.

ProSafe VPN Firewall FVS318v3 Reference Manual
1-2 Introduction
v5.0, January 2012
A Powerful, True Firewall with Content Filtering
Unlike simple Internet sharing NAT firewalls, the FVS318v3 is a true firewall, using stateful
packet inspection to defend against hacker attacks. Its firewall features include:
• DoS protection.
Automatically detects and thwarts DoS attacks such as Ping of Death, SYN Flood, LAND
Attack, and IP Spoofing.
• Blocks unwanted traffic from the Internet to your LAN.
• Blocks access from your LAN to Internet locations or services that you specify as off-limits.
• Logs security incidents.
The FVS318v3 logs security events such as blocked incoming traffic, port scans, attacks, and
administrator logins. You can configure the firewall to email the log to you at specified
intervals. You can also configure the firewall to send immediate alert messages to your e-mail
address or email pager whenever a significant event occurs.
• With its content filtering feature, the FVS318v3 prevents objectionable content from reaching
your PCs. The firewall allows you to control access to Internet content by screening for
keywords within Web addresses. You can configure the firewall to log and report attempts to
access objectionable Internet sites.
Security
The VPN firewall is equipped with several features designed to maintain security, as described in
this section.
•PCs Hidden by NAT. NAT opens a temporary path to the Internet for requests originating
from the local network. Requests originating from outside the LAN are discarded, preventing
users outside the LAN from finding and directly accessing the PCs on the LAN.
•Port Forwarding with NAT. Although NAT prevents Internet locations from directly
accessing the PCs on the LAN, the firewall allows you to direct incoming traffic to specific
PCs based on the service port number of the incoming request, or to one designated “DNS”
host computer. You can specify forwarding of single ports or ranges of ports.
Autosensing Ethernet Connections with Auto Uplink
With its internal eight-port 10/100 switch, the FVS318v3 can connect to either a 10 Mbps standard
Ethernet network or a 100 Mbps Fast Ethernet network. Both the LAN and WAN interfaces are
autosensing and capable of full-duplex or half-duplex operation.

ProSafe VPN Firewall FVS318v3 Reference Manual
Introduction 1-3
v5.0, January 2012
The firewall incorporates Auto UplinkTM technology. Each Ethernet port automatically senses
whether the Ethernet cable plugged into the port should have a normal connection such as to a PC
or an uplink connection such as to a switch or hub. That port then configures itself to the correct
configuration. This feature also eliminates the need to worry about crossover cables, as Auto
Uplink will accommodate either type of cable to make the right connection.
Extensive Protocol Support
The VPN firewall supports the Transmission Control Protocol/Internet Protocol (TCP/IP) and
Routing Information Protocol (RIP). For further information about TCP/IP, refer to “Internet
Networking and TCP/IP Addressing” in Appendix B, “Related Documents.”
•IP Address Sharing by NAT. The VPN firewall allows several networked PCs to share an
Internet account using only a single IP address, which may be statically or dynamically
assigned by your Internet service provider (ISP). This technique, known as NAT, allows the
use of an inexpensive single-user ISP account.
•Automatic Configuration of Attached PCs by DHCP. The VPN firewall dynamically
assigns network configuration information, including IP, gateway, and Domain Name Server
(DNS) addresses, to attached PCs on the LAN using the Dynamic Host Configuration Protocol
(DHCP). This feature greatly simplifies configuration of PCs on your local network.
•DNS Proxy. When DHCP is enabled and no DNS addresses are specified, the firewall
provides its own address as a DNS server to the attached PCs. The firewall obtains actual DNS
addresses from the ISP during connection setup and forwards DNS requests from the LAN.
•Point-to-Point Protocol over Ethernet (PPPoE). PPPoE is a protocol for connecting remote
hosts to the Internet over a DSL connection by simulating a dial-up connection. This feature
eliminates the need to run a login program such as Entersys or WinPOET on your PC.
Easy Installation and Management
You can install, configure, and operate the ProSafe VPN Firewall within minutes after connecting
it to the network. The following features simplify installation and management tasks:
•Browser-based management. Browser-based configuration allows you to easily configure
your firewall from almost any type of personal computer, such as Windows, Macintosh, or
Linux. A user-friendly Setup Wizard is provided and online help documentation is built into
the browser-based Web Management Interface.
•Smart Wizard. The VPN firewall automatically senses the type of Internet connection, asking
you only for the information required for your type of ISP account.

ProSafe VPN Firewall FVS318v3 Reference Manual
1-4 Introduction
v5.0, January 2012
•Diagnostic functions. The firewall incorporates built-in diagnostic functions such as Ping,
DNS lookup, and remote reboot.
•Remote management. The firewall allows you to login to the Web Management Interface
from a remote location on the Internet. For security, you can limit remote management access
to a specified remote IP address or range of addresses, and you can choose a nonstandard port
number.
•Visual monitoring. The VPN firewall’s front panel LEDs provide an easy way to monitor its
status and activity.
Maintenance and Support
NETGEAR offers the following features to help you maximize your use of the VPN firewall:
• Flash memory for firmware upgrade.
• Free technical support seven days a week, 24 hours a day.
Package Contents
The product package should contain the following items:
• ProSafe VPN Firewall .
• AC power adapter.
• Category 5 (Cat 5) Ethernet cable.
• Installation Guide.
•Resource CD, including:
– This guide.
– Application Notes and other helpful information.
• Registration and Warranty Card.
If any of the parts are incorrect, missing, or damaged, contact your NETGEAR dealer. Keep the
carton, including the original packing materials, in case you need to return the firewall for repair.
Note: The FVS318v3 firmware is not backward compatible with earlier versions of the
FVS318 firewall.

ProSafe VPN Firewall FVS318v3 Reference Manual
Introduction 1-5
v5.0, January 2012
The FVS318v3 Front Panel
The front panel of the VPN firewall contains the status LEDs described below.
You can use some of the LEDs to verify connections. Viewed from left to right, Table 1-1
describes the LEDs on the front panel of the firewall. These LEDs are green when lit.
Figure 1-1
Table 1-1. LED Descriptions
LED Label Activity Description
PWR On Power is supplied to the firewall.
TEST On
Off
The system is initializing.
The system is ready and running.
INTERNET
100 (100 Mbps) On
Off
The Internet (WAN) port is operating at 100 Mbps.
The Internet (WAN) port is operating at 10 Mbps.
LINK/ACT
(Link/Activity)
On
Blinking
The Internet port has detected a link with an attached device.
Data is being transmitted or received by the Internet port.
LOCAL
100 (100 Mbps) On
Off
The Local port is operating at 100 Mbps.
The Local port is operating at 10 Mbps.
LINK/ACT
(Link/Activity)
On
Blinking
The Local port has detected a link with an attached device.
Data is being transmitted or received by the Local port.
PWR Internet LOCAL Ports
Test

ProSafe VPN Firewall FVS318v3 Reference Manual
1-6 Introduction
v5.0, January 2012
The FVS318v3 Rear Panel
The rear panel of the VPN firewall contains the port connections listed below.
Viewed from left to right, the rear panel contains the following features:
• Factory default reset push button
• Eight Ethernet LAN ports
• Internet Ethernet WAN port for connecting the firewall to a cable or DSL modem
• DC power input
• ON/OFF switch
Figure 1-2
FACTORY DEFAULTS
Reset Button
ON/OFF
Switch
DC PowerINTERNET
Port
LOCAL
Ports