NETGEAR STM150 - ProSecure Web And Email Threat Management... User manual

350 East Plumeria Drive
San Jose, CA 95134
USA
January 2011
202-10519-06
1.0
ProSecure Web/Email
Security Threat Management
Appliance STM150,
STM300, or STM600
Reference Manual

2 |
ProSecure Web/Email Security Threat Management (STM) Appliance
© 2009–2011 NETGEAR, Inc. All rights reserved.
No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated
into any language in any form or by any means without the written permission of NETGEAR, Inc.
Technical Support
Thank you for choosing NETGEAR. To register your product, get the latest product updates, or get support online,
visit us at http://support.netgear.com.
Phone (US & Canada only): 1-888-NETGEAR
Phone (Other Countries): See Support information card.
Product Updates
Product updates are available on the NETGEAR website at http://prosecure.netgear.com or
http://kb.netgear.com/app/home.
ProSecure Forum
Go to http://prosecure.netgear.com/community/forum.php for information about the ProSecure forum and to
become part of the ProSecure community.
Trademarks
NETGEAR, the NETGEAR logo, ReadyNAS, ProSafe, ProSecure, Smart Wizard, Auto Uplink, X-RAID2, and
NeoTV are trademarks or registered trademarks of NETGEAR, Inc. Microsoft, Windows, Windows NT, and Vista
are registered trademarks of Microsoft Corporation. Other brand and product names are registered trademarks or
trademarks of their respective holders.
Statement of Conditions
To improve internal design, operational function, and/or reliability, NETGEAR reserves the right to make changes
to the products described in this document without notice. NETGEAR does not assume any liability that may occur
due to the use, or application of, the product(s) or circuit layout(s) described herein.
Revision History
Manual Part
Number Manual Version
Number
Publication Date Description
202-10519-06 1.0 February 2011 Made the following changes:
• Upgraded the book to the new format.
• Entirely revised Chapter 6, Monitoring System Access and
Performance, to document the new Logs, Reports, and Alerts
configuration menus that replaced the old Logs & Report
configuration menu.
• Added Appendix A, Report Templates.
• Separated the traffic logs into email traffic logs and Web traffic
logs (see Configuring and Activating System, Email, and Syslog
Logs and Querying Logs).
• Under the Monitoring main navigation menu, replaced all
screen shots that showed the old Logs & Reports configuration
menu with screen shots that show the new Alerts, Logs, and
Reports configuration menus.

| 3
ProSecure Web/Email Security Threat Management (STM) Appliance
202-10519-06
(continued) 1.0 February 2011 (continued) (continued)
• Revised the Setup Wizard update settings information (see
Setup Wizard Step 7 of 11: Update Settings), software update
information (see Updating the Software), and system status
information (see Viewing System Status).
202-10519-05 1.0 July 2010 Added the following major new features:
• Network refresh and permanent MAC address bindings (see
Configuring the Network Refresh and Permanent MAC Address
Bindings)
• Setting exceptions for custom groups and custom categories,
and setting exceptions for file extensions and protocols (see
Setting Scanning Exclusions and Web Access Exceptions)
• Creating custom groups (see Creating Custom Groups for Web
Access Exceptions)
• Creating custom categories—see Creating Custom Categories
for Web Access Exceptions)
• Using the DC Agent (see Understanding the ProSecure DC
Agent, Requirements for the ProSecure DC Agent Software
and DC Agent Server, and Downloading ProSecure DC Agent
Software, and Creating and Deleting DC Agents)
Also added the following minor features:
• Requirement to accept terms of service agreement on the
Real-Time Blacklist screen
• Capability to set the public host, IP address, and port on the
Distributed Spam Analysis screen
• Capability to replace the content of a blocked page with custom
text
• Capability to enable and disable SSLv2
• Refinements in the active users search methods.
• Domain information in the output screens that are accessible
from the Monitoring menu
• Testing a URL as part of the diagnostics tools
202-10519-01 1.1 October 2009 Index update.
202-10519-01 1.0 September 2009 Initial publication of this reference manual.

Contents |4
Contents
Chapter 1 Introduction
What Is the ProSecure Web/Email Security Threat Management Appliance
STM150, STM300, or STM600?. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .8
What Can You Do with an STM? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9
Key Features and Capabilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9
Stream Scanning for Content Filtering . . . . . . . . . . . . . . . . . . . . . . . . . .10
Autosensing Ethernet Connections with Auto Uplink . . . . . . . . . . . . . . .11
Easy Installation and Management . . . . . . . . . . . . . . . . . . . . . . . . . . . .11
Maintenance and Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .12
STM Model Comparison. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .12
Service Registration Card with License Keys. . . . . . . . . . . . . . . . . . . . . . .12
Package Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13
Hardware Features. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .14
Front Panel Ports and LEDs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .14
Rear Panel Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .20
Bottom Panel with Product Label . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .22
Choosing a Location for the STM. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .23
Using the Rack-Mounting Kit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .24
Chapter 2 Using the Setup Wizard to Provision the STM in Your
Network
Choosing a Deployment Scenario . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .25
Gateway Deployment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .25
Server Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .26
Segmented LAN Deployment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .27
Understanding the Steps for Initial Connection . . . . . . . . . . . . . . . . . . . . .27
Qualified Web Browsers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .28
Logging In to the STM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .28
Understanding the Web Management Interface Menu Layout. . . . . . . .30
Using the Setup Wizard to Perform the Initial Configuration . . . . . . . . . . .32
Setup Wizard Step 1 of 10: Introduction. . . . . . . . . . . . . . . . . . . . . . . . .33
Setup Wizard Step 2 of 11: Networking Settings . . . . . . . . . . . . . . . . . .33
Setup Wizard Step 3 of 11: Time Zone . . . . . . . . . . . . . . . . . . . . . . . . .35
Setup Wizard Step 4 of 11: Email Security. . . . . . . . . . . . . . . . . . . . . . .37
Setup Wizard Step 5 of 11: Web Security . . . . . . . . . . . . . . . . . . . . . . .39
Setup Wizard Step 6 of 11: Email Notification Server Settings . . . . . . .42
Setup Wizard Step 7 of 11: Update Settings . . . . . . . . . . . . . . . . . . . . .43
Setup Wizard Step 8 of 11: HTTP Proxy Settings . . . . . . . . . . . . . . . . .45
Setup Wizard Step 9 of 11: Web Categories . . . . . . . . . . . . . . . . . . . . .46

Contents |5
ProSecure Web/Email Security Threat Management (STM) Appliance
Setup Wizard Step 10 of 11: Configuration Summary . . . . . . . . . . . . . .48
Setup Wizard Step 11 of 11: Restarting the System . . . . . . . . . . . . . . .49
Verifying Correct Installation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .49
Testing Connectivity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .49
Testing HTTP Scanning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .49
Registering the STM with NETGEAR. . . . . . . . . . . . . . . . . . . . . . . . . . . . .50
What to Do Next. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .51
Chapter 3 Performing Network and System Management
Configuring Network Settings. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .52
Configuring Session Limits and Timeouts . . . . . . . . . . . . . . . . . . . . . . . . .56
Configuring the Network Refresh and
Permanent MAC Address Bindings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .57
Managing Permanent MAC Address Bindings . . . . . . . . . . . . . . . . . . . .59
Configuring the HTTP Proxy Settings. . . . . . . . . . . . . . . . . . . . . . . . . . . . .60
About Users with Administrative and Guest Privileges. . . . . . . . . . . . . . . .61
Changing Administrative Passwords and Timeouts . . . . . . . . . . . . . . . .62
Configuring Remote Management Access. . . . . . . . . . . . . . . . . . . . . . . . .64
Using an SNMP Manager. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .65
Supported MIB Browsers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .67
Managing the Configuration File. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .67
Backing Up Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .68
Restoring Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .69
Reverting to Factory Default Settings. . . . . . . . . . . . . . . . . . . . . . . . . . .70
Updating the Software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .71
Scheduling Updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .71
Performing a Manual Update . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .73
Critical Updates That Require a Restart. . . . . . . . . . . . . . . . . . . . . . . . .74
Configuring Date and Time Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .74
Managing Digital Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .76
Managing the Certificate for HTTPS Scans . . . . . . . . . . . . . . . . . . . . . .78
Managing Trusted Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .79
Managing Untrusted Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .80
Managing the Quarantine Settings. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .81
Managing the STM’s Performance. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .82
Chapter 4 Content Filtering and Optimizing Scans
About Content Filtering and Scans. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .84
Default Email and Web Scan Settings . . . . . . . . . . . . . . . . . . . . . . . . . .85
Configuring Email Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .87
Customizing Email Protocol Scan Settings. . . . . . . . . . . . . . . . . . . . . . .87
Customizing Email Anti-Virus Settings . . . . . . . . . . . . . . . . . . . . . . . . . .88
Email Content Filtering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .94
Protecting Against Email Spam . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .97
Configuring Web and Services Protection . . . . . . . . . . . . . . . . . . . . . . . .105
Customizing Web Protocol Scan Settings . . . . . . . . . . . . . . . . . . . . . .105
Configuring Web Malware Scans . . . . . . . . . . . . . . . . . . . . . . . . . . . . .107

6| Contents
ProSecure Web/Email Security Threat Management (STM) Appliance
Configuring Web Content Filtering . . . . . . . . . . . . . . . . . . . . . . . . . . . .109
Configuring Web URL Filtering. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .116
HTTPS Scan Settings. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .119
Specifying Trusted Hosts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .124
Configuring FTP Scans . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .125
Configuring Application Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .127
Setting Scanning Exclusions and Web Access Exceptions . . . . . . . . . . .130
Setting Scanning Exclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .130
Setting Access Exception Rules for Web Access. . . . . . . . . . . . . . . . .132
Creating Custom Groups for Web Access Exceptions. . . . . . . . . . . . .139
Creating Custom Categories for Web Access Exceptions . . . . . . . . . .142
Chapter 5 Managing Users, Groups, and Authentication
About Users, Groups, and Domains. . . . . . . . . . . . . . . . . . . . . . . . . . . . .147
Configuring Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .148
Creating and Deleting Groups by Name. . . . . . . . . . . . . . . . . . . . . . . .149
Editing Groups by Name . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .150
Creating and Deleting Groups by IP Address and Subnet. . . . . . . . . .151
Configuring User Accounts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .152
Creating and Deleting User Accounts . . . . . . . . . . . . . . . . . . . . . . . . .153
Editing User Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .154
Configuring Authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .154
Understanding the STM’s Authentication Options . . . . . . . . . . . . . . . .155
Understanding Active Directories and LDAP Configurations . . . . . . . .157
Creating and Deleting LDAP and Active Directory Domains . . . . . . . .161
Editing LDAP and Active Directory Domains . . . . . . . . . . . . . . . . . . . .164
Understanding the ProSecure DC Agent . . . . . . . . . . . . . . . . . . . . . . .164
Requirements for the ProSecure DC Agent Software and
DC Agent Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .165
Downloading ProSecure DC Agent Software, and Creating
and Deleting DC Agents. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .165
Creating and Deleting RADIUS Domains. . . . . . . . . . . . . . . . . . . . . . .167
Editing RADIUS Domains and Configuring VLANs . . . . . . . . . . . . . . .169
Global User Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .170
Viewing and Logging Out Active Users . . . . . . . . . . . . . . . . . . . . . . . . . .172
Chapter 6 Monitoring System Access and Performance
Configuring Logging, Alerts, and Event Notifications. . . . . . . . . . . . . . . .175
Configuring the Email Notification Server. . . . . . . . . . . . . . . . . . . . . . .176
Configuring and Activating System, Email, and Syslog Logs. . . . . . . .177
Configuring Alerts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .182
Monitoring Real-Time Traffic, Security, Statistics, and Web Usage. . . . .184
Understanding the Information on the Dashboard Screen. . . . . . . . . .184
Monitoring Web Usage. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .190
Viewing System Status. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .192
Querying Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .194
Example: Using Logs to Identify Infected Clients. . . . . . . . . . . . . . . . .199

Contents |7
ProSecure Web/Email Security Threat Management (STM) Appliance
Log Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .199
Viewing, Scheduling, and Generating Reports. . . . . . . . . . . . . . . . . . . . .200
Report Templates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .200
Generating Reports for Downloading . . . . . . . . . . . . . . . . . . . . . . . . . .202
Scheduling Automatic Generation and Emailing of Reports. . . . . . . . .203
Advanced Report Filtering Options. . . . . . . . . . . . . . . . . . . . . . . . . . . .204
Viewing and Managing the Quarantine Files . . . . . . . . . . . . . . . . . . . . . .208
Using Diagnostics Utilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .215
Using the Network Diagnostic Tools. . . . . . . . . . . . . . . . . . . . . . . . . . .216
Using the Realtime Traffic Diagnostics Tool. . . . . . . . . . . . . . . . . . . . .217
Gathering Important Log Information and
Generating a Network Statistics Report . . . . . . . . . . . . . . . . . . . . . . . .218
Restarting and Shutting Down the STM . . . . . . . . . . . . . . . . . . . . . . . .219
Chapter 7 Troubleshooting and Using Online Support
Basic Functioning. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .223
Power LED Not On. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .223
Test LED or Status LED Never Turns Off. . . . . . . . . . . . . . . . . . . . . . .223
LAN or WAN Port LEDs Not On . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .224
Troubleshooting the Web Management Interface . . . . . . . . . . . . . . . . . .224
When You Enter a URL or IP Address a Time-Out Error Occurs. . . . . . .225
Troubleshooting a TCP/IP Network Using a Ping Utility. . . . . . . . . . . . . .225
Testing the LAN Path to Your STM . . . . . . . . . . . . . . . . . . . . . . . . . . .226
Testing the Path from Your PC to a Remote Device . . . . . . . . . . . . . .226
Restoring the Default Configuration and Password . . . . . . . . . . . . . . . . .227
Problems with Date and Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .228
Using Online Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .228
Enabling Remote Troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . . . . .228
Installing Hot Fixes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .229
Sending Suspicious Files to NETGEAR for Analysis . . . . . . . . . . . . . .230
Accessing the Knowledge Base and Documentation. . . . . . . . . . . . . .231
Appendix A Report Templates
Appendix B Default Settings and Technical Specifications
Appendix C Related Documents
Appendix D Notification of Compliance
Index

Chapter 1. Introduction |8
1
1. Introduction
This chapter provides an overview of the features and capabilities of the ProSecure
Web/Email Security Threat Management Appliance STM150, STM300, and STM600. It also
identifies the physical features of the appliances and the contents of the product packages.
This chapter contains the following sections:
• What Is the ProSecure Web/Email Security Threat Management Appliance STM150,
STM300, or STM600? on this page
• What Can You Do with an STM? on page 9
• Key Features and Capabilities on page 9
• Service Registration Card with License Keys on page 12
• Package Contents on page 13
• Hardware Features on page 14
• Choosing a Location for the STM on page 23
What Is the ProSecure Web/Email Security Threat
Management Appliance STM150, STM300, or STM600?
The ProSecure Web/Email Security Threat Management Appliance STM150, STM300, or
STM600, hereafter referred to as the STM, is an appliance-based, Web and email security
solution that protects the network perimeter against Web-borne threats from spyware,
viruses, email, and blended threats. Ideally deployed at the gateway, it serves as the
network’s first line of defense against all types of threats, and complements firewalls,
intrusion detection systems (IDS)/intrusion prevention systems (IPS), dedicated Intranet
security products, and endpoint antivirus and antispyware software.
Powered by patent-pending Stream Scanning technology and backed by one of the most
comprehensive malware databases in the industry, the STM can detect and stop all known
spyware and viruses at the gateway, preventing them from reaching your desktops and
servers, where cleanup would be much more difficult.
InadditiontoscanningHTTP,HTTPS,FTP,SMTP,POP3,andIMAPtraffic,theSTMprotects
networks against spam phishing attacks and unwanted Web use. The STM is a
plug-and-play device that can be installed and configured within minutes.

Chapter 1. Introduction |9
ProSecure Web/Email Security Threat Management (STM) Appliance
What Can You Do with an STM?
The STM combines robust protection against malware threats with ease of use and
advanced reporting and notification features to help you deploy and manage the device with
minimal effort.
Here are some of the things that you can do with the STM:
• Protect the network instantly. The STM is a plug-and-play security solution that can be
instantly added to networks without the need for network reconfiguration.
• Scan network traffic for malware. Using the Stream Scanning technology, you can
configure the STM to scan HTTP, HTTPS, FTP, SMTP, POP3, and IMAP protocols.
Unlike traditional batch-based scan engines that need to cache the entire file before they
can scan, this scan engine checks traffic as it enters the network, ensuring unimpeded
network performance.
• Set access policies for individual users or groups. You can configure Web and email
access policies for individual users and groups based on the STM’s local database, on a
group IP address, on a Lightweight Directory Access Protocol (LDAP) domain, group, or
user, or on a RADIUS VLAN.
• Receive real-time alerts and generate comprehensive reports. You can configure the
STM to send alerts when a malware attack or outbreak is detected on the network.
Real-time alerts can be sent by email, allowing you to monitor malware events wherever
you are.
By configuring the STM to send malware alerts, you can isolate and clean the infected
computer before the malware incident can develop into a full-blown outbreak. The STM
also provides comprehensive reports that you can use to analyze network and malware
trends.
• Manage through SNMP support. You can enable and configure the STM’s Simple
Network Management Protocol (SNMP) settings to receive SNMP traps through a
supported management information base (MIB) browser.
• Allow automated component updates. Downloading components regularly is the key to
ensuring updated protection against new threats. The STM makes this administrative
task easier by supporting automatic malware pattern, program, and engine updates.
Key Features and Capabilities
The STM provides the following key features and capabilities:
• Up to two pairs of 10/100/1000 Mbps Gigabit Ethernet WAN ports (see STM Model
Comparison on page 12).
• Scalable support (see STM Model Comparison on page 12) for:
-Up to 600 concurrent users
-Up to 6000 concurrently scanned HTTP sessions

10 | Chapter 1. Introduction
ProSecure Web/Email Security Threat Management (STM) Appliance
-Up to 239 MB/s HTTP throughput
-Up to 960,000 emails per hour SMTP throughput
• Stream Scanning technology that enables scanning of real-time protocols such as HTTP.
• Comprehensive Web and email inbound and outbound security, covering six major
network protocols: HTTP, HTTPS, FTP, SMTP, POP3, and IMAP.
• URL content filtering with 64 categories.
• Malware database containing hundreds of thousands of signatures of spyware, viruses,
and other malware threats.
• Very frequently updated malware signatures, hourly if required. The STM can
automatically check for new malware signatures as frequently as every 15 minutes.
• Multiple antispam technologies to provide extensive protection against unwanted emails.
• Spam and malware quarantine for easy analysis.
• Web application control, including access control for instant messaging, media
applications, peer-to-peer applications, and Web-based tools and toolbars.
• User management with LDAP, Active Directory, and RADIUS integration, allowing you to
configure access policies per user and per group.
• Easy, Web-based wizard setup for installation and management.
• SNMP-manageable.
• Dedicated management interface. (This feature is model dependent; see STM Model
Comparison on page 12.)
• Hardware bypass port to prevent network disruption in case of failure. (This feature is
model dependent; see STM Model Comparison on page 12.)
• Front panel LEDs for easy monitoring of status and activity.
• Internal universal switching power supply.
Stream Scanning for Content Filtering
Stream Scanning is based on the simple observation that network traffic travels in streams.
The STM scan engine starts receiving and analyzing traffic as the stream enters the network.
As soon as a number of bytes are available, scanning starts. The scan engine continues to
scan more bytes as they become available, while at the same time another thread starts to
deliver the bytes that have been scanned.
This multithreaded approach, in which the receiving, scanning, and delivering processes
occur concurrently, ensures that network performance remains unimpeded. The result is file
scanning that is up to five times faster than with traditional antivirus solutions—a performance
advantage that you will notice.
Stream Scanning also enables organizations to withstand massive spikes in traffic, as in the
event of a malware outbreak. The scan engine has the following capabilities:
• Real-time protection. The Stream Scanning technology enables scanning of previously
undefended real-time protocols, such as HTTP. Network activities susceptible to latency
(for example, Web browsing) are no longer brought to a standstill.

Chapter 1. Introduction |11
ProSecure Web/Email Security Threat Management (STM) Appliance
• Comprehensive protection. Provides both Web and email security, covering six major
network protocols: HTTP, HTTPS, FTP, SMTP, POP3, and IMAP. The STM uses
enterprise-class scan engines employing both signature-based and distributed spam
analysis to stop both known and unknown threats. The malware database contains
hundreds of thousands of signatures of spyware, viruses, and other malware.
• Objectionable traffic protection. The STM prevents objectionable content from
reaching your computers. You can control access to the Internet content by screening for
Web categories, Web addresses, and Web services. You can log and report attempts to
access objectionable Internet sites.
• Automatic signature updates. Malware signatures are updated as frequently as every
hour, and the STM can check automatically for new signatures as frequently as every 15
minutes.
Autosensing Ethernet Connections with Auto Uplink
With its internal 10/100/1000 ports, the STM can connect to either a 10 Mbps standard
Ethernet network, a 100 Mbps Fast Ethernet network, or a 1000 Mbps Gigabit Ethernet
network. The interfaces are autosensing and capable of full-duplex or half-duplex operation.
The STM incorporates Auto UplinkTM technology. Each Ethernet port automatically senses
whether the Ethernet cable plugged into the port should have a “normal” connection such as
to a PC or an “uplink” connection such as to a switch or hub. That port then configures itself
correctly. This feature eliminates the need to think about crossover cables, as Auto Uplink
accommodates either type of cable to make the right connection.
Easy Installation and Management
You can install, configure, and operate the STM within minutes after connecting it to the
network. The following features simplify installation and management tasks:
• Browser-based management. Browser-based configuration allows you to easily
configure the STM from almost any type of operating system, such as Windows,
Macintosh, or Linux. A user-friendly Setup Wizard is provided, and online help
documentation is built into the browser-based Web Management Interface.
• SNMP. The STM supports SNMP to let you monitor and manage log resources from an
SNMP-compliant system manager. The SNMP system configuration lets you change the
system variables for MIB2.
• Diagnostic functions. The STM incorporates built-in diagnostic functions such as a ping
utility, traceroute utility, DNS lookup utility, and remote restart.
• Remote management. The STM allows you to log in to the Web Management Interface
from a remote location on the Internet. For security, you can limit remote management
access to a specified remote IP address or range of addresses.
• Visual monitoring. The STM’s front panel LEDs provide an easy way to monitor its
status and activity.

12 | Chapter 1. Introduction
ProSecure Web/Email Security Threat Management (STM) Appliance
Maintenance and Support
NETGEAR offers technical support seven days a week, 24 hours a day. Information about
support is available on the NETGEAR ProSecure website at
http://prosecure.netgear.com/support/index.php.
STM Model Comparison
The following table compares the three STM models to show the differences:
Service Registration Card with License Keys
Be sure to store the license key card that came with your STM in a secure location. You do
need these keys to activate your product during the initial setup.
Table 1. Differences between the STM Models
Feature STM150 STM300 STM600
Performance and Sizing Guidelines
Concurrent users Up to 150 Up to 300 Up to 600
Web scan throughput 42 Mbps 136 Mbps 307 Mbps
Concurrent scanned HTTP connections 1500 3000 6000
SMTP throughput (emails per hour) 122,000 355,000 550,000
Hardware
Gigabit RJ-45 ports Total of 5 ports:
• 1 uplink
• 4 downlink
Total of 3 ports:
• 1 pair of ports
(1 uplink and
1 downlink)
• 1 management
Total of 5 ports:
• 2 pairs of portsa
(2 uplink and
2 downlink)
• 1 management
a. The STM600 provides two pairs of ports, allowing for support of two separate networks or subnets with
strict traffic separation.
Gigabit RJ45 port pairs with failure bypass 0 1 pair of ports 2 pairs of ports
Dedicated management VLAN RJ45 ports 0 1 1

Chapter 1. Introduction |13
ProSecure Web/Email Security Threat Management (STM) Appliance
Figure 1.
Note: If you reset the STM to the original factory default settings after you
have entered the license keys to activate the STM (see Registering
the STM with NETGEAR on page 50), the license keys are erased.
The license keys and the different types of licenses that are
available for the STM are no longer displayed on the Registration
screen. However, after you have reconfigured the STM to connect to
the Internet and to the NETGEAR registration server, the STM
retrieves and restores all registration information based on its MAC
address and hardware serial number. You do not need to reenter the
license keys and reactivate the STM.
Package Contents
The STM product package contains the following items:
• ProSecure Web/Email Security Threat Management Appliance STM150, STM300, or
STM600
• One AC power cable
• Rubber feet (4) with adhesive backing
• One rack-mount kit
• Straight-through Category 5 Ethernet cable

14 | Chapter 1. Introduction
ProSecure Web/Email Security Threat Management (STM) Appliance
• ProSecure™ Web/Email Security Threat Management Applliance STM150, STM300, or
STM600 Installation Guide
• Depending on the model purchased, service registration card with one or more license
keys
If any of the parts are incorrect, missing, or damaged, contact your NETGEAR dealer. Keep
the carton, including the original packing materials, in case you need to return the product for
repair.
Hardware Features
The front panel ports and LEDs, rear panel ports, and bottom label of the STM models are
described in this section.
Front Panel Ports and LEDs
The front panels of the three STM models provide different components.
STM150 Front Panel
The following figure shows the front panel ports and status light-emitting diodes (LEDs) of the
STM150:
Figure 2.
From left to right, the STM150’s front panel shows the following ports and LEDs:
1. Power LED.
2. Test LED.
3. One nonfunctioning USB port. This port is included for future management enhancements.
The port is currently not operable on any STM model.
4. One uplink (WAN) Gigabit Ethernet port with an RJ-45 connector, left LED, and right LED.
5. Four downlink (LAN) Gigabit Ethernet ports with RJ-45 connectors, left LEDs, and right
LEDs.
1) Power LED
2) Test LED 3) USB port
4) Uplink port
5) Downlink ports
4) Uplink LEDs 5) Downlink LEDs

Chapter 1. Introduction |15
ProSecure Web/Email Security Threat Management (STM) Appliance
Note: All Gigabit Ethernet ports provide switched N-way, automatic
speed-negotiating, auto MDI/MDIX technology.
The function of each STM150 LED is described in the following table:
Table 2. LED Descriptions for the STM150
Object Activity Description
Power On (green) Power is supplied to the STM.
Off Power is not supplied to the STM.
Test On (amber) during
startup The STM is initializing. After approximately 2 minutes, when the STM has completed its initialization, the Test LED turns off. If the Test LED remains
on, the initialization has failed.
Off The system has completed its initialization successfully. The Test LED
should be off during normal operation.
Blinking (amber) The STM is shutting down.
Software is being updated.
A hotfix is being installed.
One of the three licenses has expired. To stop the Test LED from blinking,
renew the license, or click the Stop LED Blinking button on the System
Status screen (see Viewing System Status on page 192).
Uplink (WAN) Port
Left LED Off The WAN port has no physical link, that is, no Ethernet cable is plugged into
the STM.
On (green) The WAN port has a valid connection with a device that provides an Internet
connection.
Blink (green) Data is being transmitted or received by the WAN port.
Right LED Off The WAN port is operating at 10 Mbps.
On (amber) The WAN port is operating at 100 Mbps.
On (green) The WAN port is operating at 1000 Mbps.
Downlink (LAN) Ports
Left LED Off The LAN port has no link.
On (green) The LAN port has detected a link with a connected Ethernet device.
Blink (green) Data is being transmitted or received by the LAN port.

16 | Chapter 1. Introduction
ProSecure Web/Email Security Threat Management (STM) Appliance
Front Panel STM300
The following figure shows the front panel ports and LEDs of the STM300:
Figure 3.
From left to right, the STM300’s front panel shows the following ports and LEDs:
1. Console port. Port for connecting to an optional console terminal. The port has a DB9
male connector. The default baud rate is 9600 K. The pinouts are (2) Tx, (3) Rx, (5) and
(7) Gnd.
2. Power LED.
3. Status LED.
4. Hard drive (HDD) LED.
5. One nonfunctioning USB port. This port is included for future management enhancements.
The port is currently not operable on any STM model.
6. Dedicated management (Mgmt) Gigabit Ethernet port with an RJ-45 connector.
7. One uplink (WAN) Gigabit Ethernet port with an RJ-45 connector, left LED, and right LED.
8. One downlink (LAN) Gigabit Ethernet port with RJ-45 connectors, left LED, and right LED.
Note: All Gigabit Ethernet ports provide switched N-way, automatic
speed-negotiating, auto MDI/MDIX technology.
Right LED Off The LAN port is operating at 10 Mbps.
On (amber) The LAN port is operating at 100 Mbps.
On (green) The LAN port is operating at 1000 Mbps.
Table 2. LED Descriptions for the STM150 (Continued)
Object Activity Description
3) Status LED
4) HDD LED
5) USB port
7) Uplink port
8) Downlink port
7) Uplink LEDs
8) Downlink LEDs
2) Power LED
1) Console port
6) Mgmt port

Chapter 1. Introduction |17
ProSecure Web/Email Security Threat Management (STM) Appliance
The function of each STM300 LED is described in the following table:
Table 3. LED Descriptions for the STM300
Object Activity Description
Power On (green) Power is supplied to the STM.
Off Power is not supplied to the STM.
Status On (amber) during
startup The STM is initializing. After approximately 2 minutes, when the STM has completed its initialization, the Status LED turns off. If the Status LED
remains on, the initialization has failed.
Off The system has completed its initialization successfully. The Status LED
should be off during normal operation.
Blinking (amber) The STM is shutting down.
Software is being updated.
A hotfix is being installed.
One of the three licenses has expired. To stop the Status LED from blinking,
renew the license, or click the Stop LED Blinking button on the System
Status screen (see Viewing System Status on page 192).
HDD On (Green) Information is being written to the hard drive.
Off No hard drive activity.
Uplink (WAN) Port
Left LED Off The WAN port has no physical link, that is, no Ethernet cable is plugged into
the STM.
On (green) The WAN port has a valid connection with a device that provides an Internet
connection.
Blink (green) Data is being transmitted or received by the WAN port.
Right LED Off The WAN port is operating at 10 Mbps.
On (green) The WAN port is operating at 100 Mbps.
On (amber) The WAN port is operating at 1000 Mbps.
Downlink (LAN) Ports
Left LED Off The LAN port has no link.
On (green) The LAN port has detected a link with a connected Ethernet device.
Blink (green) Data is being transmitted or received by the LAN port.
Right LED Off The LAN port is operating at 10 Mbps.
On (green) The LAN port is operating at 100 Mbps.
On (amber) The LAN port is operating at 1000 Mbps.

18 | Chapter 1. Introduction
ProSecure Web/Email Security Threat Management (STM) Appliance
Front Panel STM600
The following figure shows the front panel ports and LEDs of the STM600:
Figure 4.
From left to right, the STM600’s front panel shows the following ports and LEDs:
1. Console port. Port for connecting to an optional console terminal. The ports has a DB9
male connector. The default baud rate is 9600 K. The pinouts are (2) Tx, (3) Rx, (5) and
(7) Gnd.
2. Power LED.
3. Status LED.
4. Hard drive (HDD) LED.
5. One nonfunctioning USB port. This port is included for future management enhancements.
The port is currently not operable on any STM model.
6. Dedicated management (Mgmt) Gigabit Ethernet port with an RJ-45 connector.
7. Pair 1 uplink (WAN) and downlink (LAN) Gigabit Ethernet ports with RJ-45 connectors, left
LEDs, and right LEDs.
8. Pair 2 uplink (WAN) and downlink (LAN) Gigabit Ethernet ports with RJ-45 connectors, left
LEDs, and right LEDs.
Note: All Gigabit Ethernet ports provide switched N-way, automatic
speed-negotiating, auto MDI/MDIX technology.
3) Status LED
4) HDD LED
5) USB port
2) Power LED
1) Console port
6) Mgmt port
7) Pair 1 LEDs
8) Pair 2 LEDs
7) Pair 1 ports
8) Pair 2 ports

Chapter 1. Introduction |19
ProSecure Web/Email Security Threat Management (STM) Appliance
The function of each STM600 LED is described in the following table:
Table 4. LED Descriptions for the STM600
Object Activity Description
Power On (green) Power is supplied to the STM.
Off Power is not supplied to the STM.
Status On (amber) during
startup The STM is initializing. After approximately 2 minutes, when the STM has completed its initialization, the Status LED turns off. If the Status LED
remains on, the initialization has failed.
Off The system has completed its initialization successfully. The Status LED
should be off during normal operation.
Blinking (amber) The STM is shutting down.
Software is being updated.
A hotfix is being installed.
One of the three licenses has expired. To stop the Status LED from blinking,
renew the license, or click the Stop LED Blinking button on the System
Status screen (see Viewing System Status on page 192).
HDD On (green) Information is being written to the hard drive.
Off No hard drive activity.
Uplink (WAN) Port
Left LED Off The WAN port has no physical link, that is, no Ethernet cable is plugged into
the STM.
On (green) The WAN port has a valid connection with a device that provides an Internet
connection.
Blink (green) Data is being transmitted or received by the WAN port.
Right LED Off The WAN port is operating at 10 Mbps.
On (green) The WAN port is operating at 100 Mbps.
On (amber) The WAN port is operating at 1000 Mbps.
Downlink (LAN) Ports
Left LED Off The LAN port has no link.
On (green) The LAN port has detected a link with a connected Ethernet device.
Blink (green) Data is being transmitted or received by the LAN port.
Right LED Off The LAN port is operating at 10 Mbps.
On (green) The LAN port is operating at 100 Mbps.
On (amber) The LAN port is operating at 1000 Mbps.

20 | Chapter 1. Introduction
ProSecure Web/Email Security Threat Management (STM) Appliance
Rear Panel Features
The rear panel of the STM150 differs from the rear panels of the STM300 and STM600.
Rear Panel STM150
The following figure shows the rear panel components of the STM150:
Figure 5.
From left to right, the STM150’s rear panel components are:
1. Console port. Port for connecting to an optional console terminal. The port has a DB9
male connector. The default baud rate is 9600 K. The pinouts are (2) Tx, (3) Rx, (5) and
(7) Gnd.
2. Kensington lock. Attach an optional Kensington lock to prevent unauthorized removal of the
STM150.
3. Power button. Press to restart the STM150. Restarting does not reset the STM150 to its
factory defaults.
4. Reset button. Using a sharp object, press and hold this button for about 10 seconds until the
front panel Test LED flashes and the STM150 returns to factory default settings.
Note: If you reset the STM150, all configuration settings are lost and the
default passwords are restored.
5. AC power socket. Attach the power cord to this socket.
1) Console port 2) Lock
3) Power button
4) Reset button
5) AC power socket