NETGEAR UTM5 - ProSecure Unified Threat Management... User manual

350 East Plumeria Drive
San Jose, CA 95134
USA
April 2012
202-10780-02
1.0
ProSecure Unified Threat
Management (UTM)
Appliance
Reference Manual

2
ProSecure Unified Threat Management (UTM) Appliance
© 2009–2012 NETGEAR, Inc. All rights reserved.
No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated
into any language in any form or by any means without the written permission of NETGEAR, Inc.
NETGEAR, the NETGEAR logo, and Connect with Innovation are trademarks and/or registered trademarks of
NETGEAR, Inc. and/or its subsidiaries in the United States and/or other countries. Information is subject to change
without notice. Other brand and product names are registered trademarks or trademarks of their respective
holders. NETGEAR, Inc. © 2009–2012 All rights reserved.
Technical Support
Thank you for choosing NETGEAR. To register your product, get the latest product updates, get support online, or
for more information about the topics covered in this manual, visit the Support website at visit us at
http://support.netgear.com.
Phone (US & Canada only): 1-888-NETGEAR
Phone (Other Countries): Check the list of phone numbers at
http://support.netgear.com/app/answers/detail/a_id/984.
Product Updates
Product updates are available on the NETGEAR website at http://prosecure.netgear.com or
http://kb.netgear.com/app/home.
ProSecure Forum
Go to http://prosecure.netgear.com/community/forum.php for information about the ProSecure forum and to
become part of the ProSecure community.
Statement of Conditions
To improve internal design, operational function, and/or reliability, NETGEAR reserves the right to make changes
to the products described in this document without notice. NETGEAR does not assume any liability that may occur
due to the use, or application of, the product(s) or circuit layout(s) described herein.

3
ProSecure Unified Threat Management (UTM) Appliance
Revision History
Publication
Part Number Version Publish Date Comments
202-10780-02 1.0 April 2012 • Added new features for all UTM models:
- Application control (see Configure Application Control)
- Traffic metering for LAN usage (see Create Traffic Meter
Profiles)
- The use of custom user groups in firewall rules (see Use
Rules to Block or Allow Specific Kinds of Traffic and VLAN
Rules)
Application control and traffic metering also affect the way that
firewall rules are implemented (see Use Rules to Block or
Allow Specific Kinds of Traffic)
• Support of the following features for all UTM models (these
features were previously supported on the UTM9S only):
- ReadyNAS integration, quarantine options, and quarantine
logs (see Connect to a ReadyNAS and Configure
Quarantine Settings, Query the Quarantine Logs, and
Appendix D, ReadyNAS Integration)
- PPTP server (see Configure the PPTP Server)
- L2TP server (see Configure the L2TP Server)
• Upgrade of the following existing features:
- Firewall scheduling (see Set a Schedule to Block or Allow
Specific Traffic and Use Rules to Block or Allow Specific
Kinds of Traffic)
- IPS (see Use the Intrusion Prevention System)
- System status, dashboard, and report functions (see
Chapter 11, Monitoring System Access and Performance)
- Diagnostics (see Use Diagnostics Utilities)
• Reorganization of the web management interface (GUI)
menus (for example, the Email Notification configuration
menu link has been moved to the Monitoring main menu; the
Custom Groups configuration menu link have been moved to
the Users main menu)
202-10780-01 1.0 September 2011 • Addition of the UTM9S with the following major new features:
- xDSL module (see Chapter 1, Introduction and Chapter 3,
Manually Configuring Internet and WAN Settings)
- Wireless module (see Chapter 1, Introduction and
Appendix B, Wireless Module for the UTM9S)
- ReadyNAS integration, quarantine options, and quarantine
logs (see Connect to a ReadyNAS and Configure
Quarantine Settings, Query the Quarantine Logs, and
Appendix D, ReadyNAS Integration)
- PPTP server (see Configure the PPTP Server)
- L2TP server (see Configure the L2TP Server)
• Update of the VPN client sections with the new VPN client
(see Chapter 7, Virtual Private Networking
Using IPSec Connections)

4
ProSecure Unified Threat Management (UTM) Appliance
202-10674-02 1.0 March 2011 • Addition of the UTM150.
• Removal of platform-specific chapters and sections because
the UTM5, UTM10, and UTM25 now support the same web
management interface menu layout that was already
supported on the UTM50. The major changes for the UTM5,
UTM10, and UTM25 are documented in Chapter 3, Manually
Configuring Internet and WAN Settings, and in the following
sections:
- Set Exception Rules for Web and Application Access
- Configure Authentication Domains, Groups, and Users
• Added new features (for all UTM models). The major new
features are documented in the following sections:
- Electronic Licensing
- VLAN Rules
- Create Service Groups
- Create IP Groups
- Manage Digital Certificates for HTTPS Scans
- Update the Firmware
- View, Schedule, and Generate Reports
202-10674-01 1.0 September 2010 • Addition of the UTM50 and UTM50-specific chapters and
sections.
• Revision of DMZ WAN and LAN DMZ default policies.
202-10482-03 1.0 May 2010 • Applied numerous nontechnical edits.
• Added the Requirements for Entering IP Addresses section.
• Added a note about the processing of normal email traffic in
the Configure Distributed Spam Analysis section.
• Updated the NTP section.
202-10482-02 1.0 January 2010 Updated the web management interface screens, made the
manual platform-independent, added a model comparison table,
and removed performance specifications (see marketing
documentation for such specifications).
202-10482-01 1.0 September 2009 Initial publication of this reference manual.

5
Contents
Chapter 1 Introduction
What Is the ProSecure Unified Threat Management (UTM) Appliance? . .14
Key Features and Capabilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .15
Multiple WAN Port Models for Increased Reliability or
Outbound Load Balancing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .16
Wireless Features. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .16
DSL Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .16
Advanced VPN Support for Both IPSec and SSL. . . . . . . . . . . . . . . . . .17
A Powerful, True Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .17
Stream Scanning for Content Filtering . . . . . . . . . . . . . . . . . . . . . . . . . .17
Security Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .18
Autosensing Ethernet Connections with Auto Uplink . . . . . . . . . . . . . . .19
Extensive Protocol Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .19
Easy Installation and Management . . . . . . . . . . . . . . . . . . . . . . . . . . . .20
Maintenance and Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .20
Model Comparison . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .21
Service Registration Card with License Keys. . . . . . . . . . . . . . . . . . . . . . .21
Package Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .23
Hardware Features. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .23
Front Panel UTM5 and UTM10 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .24
Front Panel UTM25 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .24
Front Panel UTM50 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .25
Front Panel UTM150 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .26
Front Panel UTM9S and Modules . . . . . . . . . . . . . . . . . . . . . . . . . . . . .26
LED Descriptions, UTM5, UTM10, UTM25, UTM50, and UTM150 . . . .28
LED Descriptions, UTM9S and Modules . . . . . . . . . . . . . . . . . . . . . . . .29
Rear Panel UTM5, UTM10, and UTM25 . . . . . . . . . . . . . . . . . . . . . . . .31
Rear Panel UTM50 and UTM150. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .32
Rear Panel UTM9S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .32
Bottom Panels with Product Labels . . . . . . . . . . . . . . . . . . . . . . . . . . . .33
Choose a Location for the UTM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .36
Use the Rack-Mounting Kit. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .37
Chapter 2 Using the Setup Wizard to Provision the UTM in Your
Network
Steps for Initial Connection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .38
Qualified Web Browsers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .39
Requirements for Entering IP Addresses. . . . . . . . . . . . . . . . . . . . . . . .39
Log In to the UTM. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .39

6
ProSecure Unified Threat Management (UTM) Appliance
Web Management Interface Menu Layout . . . . . . . . . . . . . . . . . . . . . . .41
Use the Setup Wizard to Perform the Initial Configuration. . . . . . . . . . . . .43
Setup Wizard Step 1 of 10: LAN Settings. . . . . . . . . . . . . . . . . . . . . . . .44
Setup Wizard Step 2 of 10: WAN Settings. . . . . . . . . . . . . . . . . . . . . . .47
Setup Wizard Step 3 of 10: System Date and Time. . . . . . . . . . . . . . . .50
Setup Wizard Step 4 of 10: Services . . . . . . . . . . . . . . . . . . . . . . . . . . .51
Setup Wizard Step 5 of 10: Email Security. . . . . . . . . . . . . . . . . . . . . . .53
Setup Wizard Step 6 of 10: Web Security . . . . . . . . . . . . . . . . . . . . . . .54
Setup Wizard Step 7 of 10: Web Categories to Be Blocked. . . . . . . . . .56
Setup Wizard Step 8 of 10: Email Notification . . . . . . . . . . . . . . . . . . . .58
Setup Wizard Step 9 of 10: Signatures & Engine. . . . . . . . . . . . . . . . . .59
Setup Wizard Step 10 of 10: Saving the Configuration . . . . . . . . . . . . .60
Verify Correct Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .60
Test Connectivity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .61
Test HTTP Scanning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .61
Register the UTM with NETGEAR . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .61
Electronic Licensing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .63
Automatic Retrieval of Licenses After a Factory Default Reset . . . . . . .63
What to Do Next. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .64
Chapter 3 Manually Configuring Internet and WAN Settings
Internet and WAN Configuration Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . .65
Automatically Detecting and Connecting the Internet Connections . . . . . .66
Set the UTM’s MAC Address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .70
Manually Configure the Internet Connection . . . . . . . . . . . . . . . . . . . . . . .70
Configure the WAN Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .74
Configure Network Address Translation (All Models). . . . . . . . . . . . . . .76
Configure Classical Routing (All Models). . . . . . . . . . . . . . . . . . . . . . . .76
Configure Auto-Rollover Mode and the Failure Detection
Method (Multiple WAN Port Models) . . . . . . . . . . . . . . . . . . . . . . . . . . .77
Configure Load Balancing and Optional Protocol Binding . . . . . . . . . . .80
Configure Secondary WAN Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . .84
Configure Dynamic DNS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .85
Configure Advanced WAN Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .89
Additional WAN-Related Configuration Tasks . . . . . . . . . . . . . . . . . . . .91
Chapter 4 LAN Configuration
Manage Virtual LANs and DHCP Options . . . . . . . . . . . . . . . . . . . . . . . . .92
Port-Based VLANs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .93
Assign and Manage VLAN Profiles . . . . . . . . . . . . . . . . . . . . . . . . . . . .94
VLAN DHCP Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .95
Configure a VLAN Profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .96
Configure VLAN MAC Addresses and Advanced LAN Settings. . . . . .102
Configure Multihome LAN IPs on the Default VLAN . . . . . . . . . . . . . . . .103
Manage Groups and Hosts (LAN Groups). . . . . . . . . . . . . . . . . . . . . . . .105
Manage the Network Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .106
Change Group Names in the Network Database. . . . . . . . . . . . . . . . .109

7
ProSecure Unified Threat Management (UTM) Appliance
Set Up Address Reservation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .110
Configure and Enable the DMZ Port . . . . . . . . . . . . . . . . . . . . . . . . . . . .111
Manage Routing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .115
Configure Static Routes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .115
Configure Routing Information Protocol . . . . . . . . . . . . . . . . . . . . . . . .117
Static Route Example. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .119
Chapter 5 Firewall Protection
About Firewall Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .120
Administrator Tips. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .121
Use Rules to Block or Allow Specific Kinds of Traffic. . . . . . . . . . . . . . . .121
Service-Based Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .122
Order of Precedence for Rules. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .130
Set LAN WAN Rules. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .130
Set DMZ WAN Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .134
Set LAN DMZ Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .137
Inbound Rule Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .140
Outbound Rule Example. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .144
Configure Other Firewall Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .145
VLAN Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .145
Attack Checks, VPN Pass-through, and Multicast Pass-through . . . . .148
Set Session Limits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .151
Manage the Application Level Gateway for SIP Sessions . . . . . . . . . .152
Create Services, QoS Profiles, and Bandwidth Profiles. . . . . . . . . . . . . .153
Add Customized Services. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .154
Create Service Groups. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .156
Create IP Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .158
Create Quality of Service Profiles. . . . . . . . . . . . . . . . . . . . . . . . . . . . .160
Create Bandwidth Profiles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .162
Create Traffic Meter Profiles. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .166
Set a Schedule to Block or Allow Specific Traffic. . . . . . . . . . . . . . . . . . .168
Enable Source MAC Filtering. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .170
Set Up IP/MAC Bindings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .172
Configure Port Triggering. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .174
Configure Universal Plug and Play. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .177
Use the Intrusion Prevention System . . . . . . . . . . . . . . . . . . . . . . . . . . . .178
Chapter 6 Content Filtering and Optimizing Scans
About Content Filtering and Scans. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .183
Default Email and Web Scan Settings . . . . . . . . . . . . . . . . . . . . . . . . .184
Configure Email Protection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .185
Customize Email Protocol Scan Settings . . . . . . . . . . . . . . . . . . . . . . .185
Customize Email Antivirus and Notification Settings . . . . . . . . . . . . . .186
Email Content Filtering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .190
Protect Against Email Spam. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .193
Configure Web and Services Protection. . . . . . . . . . . . . . . . . . . . . . . . . .201
Customize Web Protocol Scan Settings. . . . . . . . . . . . . . . . . . . . . . . .201

8
ProSecure Unified Threat Management (UTM) Appliance
Configure Web Malware Scans . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .202
Configure Web Content Filtering . . . . . . . . . . . . . . . . . . . . . . . . . . . . .204
Configure Web URL Filtering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .211
Configure HTTPS (SSL) Scanning. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .215
Manage Digital Certificates for HTTPS Scans . . . . . . . . . . . . . . . . . . .218
Specify Trusted Hosts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .223
Configure FTP Scanning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .224
Configure Application Control. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .226
Set Exception Rules for Web and Application Access. . . . . . . . . . . . . . .234
Create Custom Categories for Exceptions for Web and
Application Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .243
Set Scanning Exclusions for IP Addresses and Ports . . . . . . . . . . . . . . .247
Chapter 7 Virtual Private Networking
Using IPSec Connections
Considerations for Dual WAN Port Systems
(Multiple WAN Port Models Only). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .249
Use the IPSec VPN Wizard for Client and Gateway Configurations . . . .251
Create Gateway-to-Gateway VPN Tunnels with the Wizard . . . . . . . .251
Create a Client-to-Gateway VPN Tunnel . . . . . . . . . . . . . . . . . . . . . . .255
Test the Connection and View Connection and Status Information. . . . .270
Test the NETGEAR VPN Client Connection . . . . . . . . . . . . . . . . . . . .270
NETGEAR VPN Client Status and Log Information . . . . . . . . . . . . . . .272
View the UTM IPSec VPN Connection Status . . . . . . . . . . . . . . . . . . .272
View the UTM IPSec VPN Log. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .273
Manage IPSec VPN Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .274
Manage IKE Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .274
Manage VPN Policies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .282
Configure Extended Authentication (XAUTH) . . . . . . . . . . . . . . . . . . . . .290
Configure XAUTH for VPN Clients. . . . . . . . . . . . . . . . . . . . . . . . . . . .291
User Database Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .292
RADIUS Client Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .292
Assign IP Addresses to Remote Users (Mode Config) . . . . . . . . . . . . . .294
Mode Config Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .294
Configure Mode Config Operation on the UTM . . . . . . . . . . . . . . . . . .295
Configure the ProSafe VPN Client for Mode Config Operation . . . . . .301
Test the Mode Config Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . .308
Modify or Delete a Mode Config Record . . . . . . . . . . . . . . . . . . . . . . .309
Configure Keep-Alives and Dead Peer Detection . . . . . . . . . . . . . . . . . .310
Configure Keep-Alives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .310
Configure Dead Peer Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .311
Configure NetBIOS Bridging with IPSec VPN . . . . . . . . . . . . . . . . . . . . .312
Configure the PPTP Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .313
View the Active PPTP Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .315
Configure the L2TP Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .316
View the Active L2TP Users. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .318

9
ProSecure Unified Threat Management (UTM) Appliance
Chapter 8 Virtual Private Networking
Using SSL Connections
SSL VPN Portal Options. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .319
Use the SSL VPN Wizard for Client Configurations . . . . . . . . . . . . . . . . .320
SSL VPN Wizard Step 1 of 6 (Portal Settings). . . . . . . . . . . . . . . . . . .321
SSL VPN Wizard Step 2 of 6 (Domain Settings) . . . . . . . . . . . . . . . . .323
SSL VPN Wizard Step 3 of 6 (User Settings). . . . . . . . . . . . . . . . . . . .328
SSL VPN Wizard Step 4 of 6 (Client Addresses and Routes) . . . . . . .329
SSL VPN Wizard Step 5 of 6 (Port Forwarding). . . . . . . . . . . . . . . . . .330
SSL VPN Wizard Step 6 of 6 (Verify and Save Your Settings). . . . . . .332
Access the New SSL Portal Login Screen . . . . . . . . . . . . . . . . . . . . . .333
View the UTM SSL VPN Connection Status. . . . . . . . . . . . . . . . . . . . .335
View the UTM SSL VPN Log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .335
Manually Configure and Edit SSL Connections . . . . . . . . . . . . . . . . . . . .336
Create the Portal Layout. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .337
Configure Domains, Groups, and Users. . . . . . . . . . . . . . . . . . . . . . . .341
Configure Applications for Port Forwarding . . . . . . . . . . . . . . . . . . . . .341
Configure the SSL VPN Client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .344
Use Network Resource Objects to Simplify Policies. . . . . . . . . . . . . . .347
Configure User, Group, and Global Policies. . . . . . . . . . . . . . . . . . . . .349
Chapter 9 Managing Users, Authentication, and VPN Certificates
Authentication Process and Options . . . . . . . . . . . . . . . . . . . . . . . . . . . .356
Configure Authentication Domains, Groups, and Users. . . . . . . . . . . . . .358
Login Portals. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .358
Active Directories and LDAP Configurations . . . . . . . . . . . . . . . . . . . .362
Configure Domains. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .365
Configure Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .372
Configure Custom Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .375
Configure User Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .378
Set User Login Policies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .381
Change Passwords and Other User Settings. . . . . . . . . . . . . . . . . . . .385
DC Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .387
Configure RADIUS VLANs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .393
Configure Global User Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .394
View and Log Out Active Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .395
Manage Digital Certificates for VPN Connections . . . . . . . . . . . . . . . . . .397
VPN Certificates Screen. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .398
Manage CA Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .399
Manage Self-Signed Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . .400
Manage the Certificate Revocation List . . . . . . . . . . . . . . . . . . . . . . . .404
Chapter 10 Network and System Management
Performance Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .405
Bandwidth Capacity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .405
Features That Reduce Traffic. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .406

10
ProSecure Unified Threat Management (UTM) Appliance
Features That Increase Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .409
Use QoS and Bandwidth Assignments to Shift the Traffic Mix. . . . . . .412
Monitoring Tools for Traffic Management. . . . . . . . . . . . . . . . . . . . . . .412
System Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .412
Change Passwords and Administrator and Guest Settings . . . . . . . . .413
Configure Remote Management Access . . . . . . . . . . . . . . . . . . . . . . .415
Use a Simple Network Management Protocol Manager. . . . . . . . . . . .417
Manage the Configuration File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .418
Update the Firmware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .421
Update the Scan Signatures and Scan Engine Firmware . . . . . . . . . .426
Configure Date and Time Service . . . . . . . . . . . . . . . . . . . . . . . . . . . .428
Connect to a ReadyNAS and Configure Quarantine Settings . . . . . . . . .430
Log Storage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .430
Connect to a ReadyNAS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .431
Configure the Quarantine Settings. . . . . . . . . . . . . . . . . . . . . . . . . . . .432
Chapter 11 Monitoring System Access and Performance
Enable the WAN Traffic Meter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .434
Configure Logging, Alerts, and Event Notifications . . . . . . . . . . . . . . . . .438
Configure the Email Notification Server . . . . . . . . . . . . . . . . . . . . . . . .438
Configure and Activate System, Email, and Syslog Logs. . . . . . . . . . .439
How to Send Syslogs over a VPN Tunnel between Sites . . . . . . . . . .443
Configure and Activate Update Failure and Attack Alerts . . . . . . . . . .445
Configure and Activate Firewall Logs. . . . . . . . . . . . . . . . . . . . . . . . . .448
Monitor Real-Time Traffic, Security, and Statistics . . . . . . . . . . . . . . . . .449
Monitor Application Use in Real-Time . . . . . . . . . . . . . . . . . . . . . . . . . . .455
View Status Screens . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .458
View the System Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .458
View the Active VPN Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .469
View the VPN Tunnel Connection Status. . . . . . . . . . . . . . . . . . . . . . .470
View the PPTP and L2TP Server Status . . . . . . . . . . . . . . . . . . . . . . .471
View the Port Triggering Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .472
View the WAN Ports Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .474
View Attached Devices and the DHCP Leases . . . . . . . . . . . . . . . . . .475
Query the Logs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .478
Query and Download Logs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .479
Example: Use the Logs to Identify Infected Clients . . . . . . . . . . . . . . .484
Log Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .484
Query the Quarantine Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .485
Query the Quarantined Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .485
View and Manage the Quarantined Spam Table . . . . . . . . . . . . . . . . .488
View and Manage the Quarantined Infected Files Table . . . . . . . . . . .489
Spam Reports for End Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .490
View, Schedule, and Generate Reports. . . . . . . . . . . . . . . . . . . . . . . . . .491
Enable Application Session Monitoring . . . . . . . . . . . . . . . . . . . . . . . .492
Report Filtering Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .493
Use Report Templates and View Reports Onscreen . . . . . . . . . . . . . .495

11
ProSecure Unified Threat Management (UTM) Appliance
Schedule, Email, and Manage Reports . . . . . . . . . . . . . . . . . . . . . . . .500
Use Diagnostics Utilities. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .502
Use the Network Diagnostic Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . .503
Use the Real-Time Traffic Diagnostics Tool. . . . . . . . . . . . . . . . . . . . .504
Gather Important Log Information and Generate a
Network Statistics Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .506
Chapter 12 Troubleshooting and Using Online Support
Basic Functioning. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .509
Power LED Not On. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .509
Test LED Never Turns Off . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .509
LAN or WAN Port LEDs Not On . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .510
Troubleshoot the Web Management Interface. . . . . . . . . . . . . . . . . . . . .510
When You Enter a URL or IP Address, a Time-Out Error Occurs . . . . . .511
Troubleshoot the ISP Connection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .511
Troubleshoot a TCP/IP Network Using a Ping Utility . . . . . . . . . . . . . . . .513
Test the LAN Path to Your UTM. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .513
Test the Path from Your PC to a Remote Device. . . . . . . . . . . . . . . . .514
Restore the Default Configuration and Password . . . . . . . . . . . . . . . . . .514
Problems with Date and Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .515
Use Online Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .516
Enable Remote Troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . . . . . .516
Send Suspicious Files to NETGEAR for Analysis . . . . . . . . . . . . . . . .517
Access the Knowledge Base and Documentation . . . . . . . . . . . . . . . .517
Appendix A xDSL Module for the UTM9S
xDSL Module Configuration Tasks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .518
Configure the xDSL Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .519
Automatically Detecting and Connecting the Internet Connection . . . . . .521
Set the UTM’s MAC Address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .524
Manually Configure the Internet Connection . . . . . . . . . . . . . . . . . . . . . .524
Configure the WAN Mode. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .528
Configure Network Address Translation. . . . . . . . . . . . . . . . . . . . . . . .529
Configure Classical Routing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .530
Configure Auto-Rollover Mode and the Failure Detection Method. . . .530
Configure Load Balancing and Optional Protocol Binding . . . . . . . . . .533
Configure Secondary WAN Addresses . . . . . . . . . . . . . . . . . . . . . . . . . .537
Configure Dynamic DNS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .539
Configure Advanced WAN Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . .541
Additional WAN-Related Configuration Tasks . . . . . . . . . . . . . . . . . . .543
Appendix B Wireless Module for the UTM9S
Overview of the Wireless Module. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .544
Configuration Order . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .545
Wireless Equipment Placement and Range Guidelines. . . . . . . . . . . .545
Configure the Basic Radio Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . .546

12
ProSecure Unified Threat Management (UTM) Appliance
Operating Frequency (Channel) Guidelines. . . . . . . . . . . . . . . . . . . . .549
Wireless Data Security Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .549
Wireless Security Profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .551
Before You Change the SSID, WEP, and WPA Settings. . . . . . . . . . .552
Configure and Enable Wireless Security Profiles. . . . . . . . . . . . . . . . .553
Configure the Access Point . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .557
Restrict Wireless Access by MAC Address . . . . . . . . . . . . . . . . . . . . .560
View the Access Point Status and Connected Clients . . . . . . . . . . . . .561
Configure a Wireless Distribution System . . . . . . . . . . . . . . . . . . . . . . . .563
Configure Advanced Radio Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . .564
Configure Advanced Profile and WMM QoS Priority Settings . . . . . . . . .566
Advanced Profile Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .566
WMM QoS Priority Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .568
Test Basic Wireless Connectivity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .570
Appendix C Network Planning for Dual WAN Ports
(Multiple WAN Port Models Only)
What to Consider Before You Begin . . . . . . . . . . . . . . . . . . . . . . . . . . . .571
Cabling and Computer Hardware Requirements . . . . . . . . . . . . . . . . .572
Computer Network Configuration Requirements . . . . . . . . . . . . . . . . .573
Internet Configuration Requirements . . . . . . . . . . . . . . . . . . . . . . . . . .573
Overview of the Planning Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .575
Inbound Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .576
Inbound Traffic to a Single WAN Port System . . . . . . . . . . . . . . . . . . .576
Inbound Traffic to a Dual WAN Port System . . . . . . . . . . . . . . . . . . . .577
Virtual Private Networks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .578
VPN Road Warrior (Client-to-Gateway) . . . . . . . . . . . . . . . . . . . . . . . .579
VPN Gateway-to-Gateway . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .582
VPN Telecommuter (Client-to-Gateway through a NAT Router) . . . . .584
Appendix D ReadyNAS Integration
Supported ReadyNAS Models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .587
Install the UTM Add-On on the ReadyNAS . . . . . . . . . . . . . . . . . . . . . . .588
Connect to the ReadyNAS on the UTM . . . . . . . . . . . . . . . . . . . . . . . . . .590
Appendix E Two-Factor Authentication
Why Do I Need Two-Factor Authentication? . . . . . . . . . . . . . . . . . . . . . .593
What Are the Benefits of Two-Factor Authentication? . . . . . . . . . . . . .593
What Is Two-Factor Authentication? . . . . . . . . . . . . . . . . . . . . . . . . . .594
NETGEAR Two-Factor Authentication Solutions . . . . . . . . . . . . . . . . . . .594
Appendix F System Logs and Error Messages
System Log Messages. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .598
System Startup. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .598
Reboot . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .598

13
ProSecure Unified Threat Management (UTM) Appliance
Service Logs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .598
NTP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .599
Login/Logout. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .599
Firewall Restart. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .600
IPSec Restart . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .600
WAN Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .600
Traffic Metering Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .604
Unicast, Multicast, and Broadcast Logs . . . . . . . . . . . . . . . . . . . . . . . .604
Invalid Packet Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .605
Content-Filtering and Security Logs. . . . . . . . . . . . . . . . . . . . . . . . . . . . .607
Web Filtering and Content-Filtering Logs. . . . . . . . . . . . . . . . . . . . . . .607
Spam Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .609
Traffic Logs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .609
Virus Logs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .610
Email Filter Logs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .610
IPS Logs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .611
Port Scan Logs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .611
Application Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .611
Routing Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .612
LAN-to-WAN Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .612
LAN-to-DMZ Logs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .612
DMZ-to-WAN Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .612
WAN-to-LAN Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .613
DMZ-to-LAN Logs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .613
WAN-to-DMZ Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .613
Appendix G Default Settings and Technical Specifications
Default Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .614
Physical and Technical Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . .616
Appendix H Notification of Compliance (Wired)
Appendix I Notification of Compliance (Wireless)
Index

14
1
1. Introduction
This chapter provides an overview of the features and capabilities of the NETGEAR ProSecure®
Unified Threat Management (UTM) Appliance. This chapter contains the following sections:
•What Is the ProSecure Unified Threat Management (UTM) Appliance?
•Key Features and Capabilities
•Service Registration Card with License Keys
•Package Contents
•Hardware Features
•Choose a Location for the UTM
Note: For more information about the topics covered in this manual, visit
the NETGEAR support website at http://support.netgear.com.
What Is the ProSecure Unified Threat Management (UTM)
Appliance?
The ProSecure Unified Threat Management (UTM) Appliance, hereafter referred to as the
UTM, connects your local area network (LAN) to the Internet through one or two external
broadband access devices such as cable modems, DSL modems, satellite dishes, or
wireless ISP radio antennas, or a combination of those. Dual wide area network (WAN) ports
allow you to increase the effective data rate to the Internet by utilizing both WAN ports to
carry session traffic, or to maintain a backup connection in case of failure of your primary
Internet connection.
As a complete security solution, the UTM combines a powerful, flexible firewall with a content
scan engine that uses NETGEAR Stream Scanning technology to protect your network from
denial of service (DoS) attacks or distributed DoS (DDoS) attacks, unwanted traffic, traffic
with objectionable content, spam, phishing, and web-borne threats such as spyware, viruses,
and other malware threats.

Introduction
15
ProSecure Unified Threat Management (UTM) Appliance
The UTM provides advanced IPSec and SSL VPN technologies for secure and simple
remote connections. The use of Gigabit Ethernet LAN and WAN ports ensures extremely
high data transfer speeds.
The UTM is a plug-and-play device that can be installed and configured within minutes.
Key Features and Capabilities
The UTM provides the following key features and capabilities:
•For the single WAN port models, a single 10/100/1000 Mbps Gigabit Ethernet WAN port.
For the multiple WAN port models, dual or quad 10/100/1000 Mbps Gigabit Ethernet
WAN ports for load balancing or failover protection of your Internet connection, providing
increased system reliability or increased data rate.
•Built-in four- or six-port 10/100/1000 Mbps Gigabit Ethernet LAN switch for extremely fast
data transfer between local network resources.
•Wireless module (UTM9S only) for either 2.4-GHz or 5-GHz wireless modes.
•xDLS module (UTM9S only) for ADSL and VDSL.
•Advanced IPSec VPN and SSL VPN support.
•Depending on the model, bundled with a one-user license of the NETGEAR ProSafe
VPN Client software (VPN01L).
•Advanced Stateful Packet Inspection (SPI) firewall with multi-NAT support.
•Patent-pending Stream Scanning technology that enables scanning of real-time protocols
such as HTTP.
•Comprehensive web and email security, covering six major network protocols: HTTP,
HTTPS, FTP, SMTP, POP3, and IMAP.
•Malware database containing hundreds of thousands of signatures of spyware, viruses,
and other malware threats.
•Very frequently updated malware signatures, hourly if required. The UTM can
automatically check for new malware signatures as frequently as every 15 minutes.
•Multiple antispam technologies to provide extensive protection against unwanted mail.
•Application control for multiple categories of applications and individual applications to
safeguard data, protect users, and enhance productivity.
•Easy, web-based wizard setup for installation and management.
•SNMP manageable.
•Front panel LEDs for easy monitoring of status and activity.
•Flash memory for firmware upgrade.
•Internal universal switching power supply.

Introduction
16
ProSecure Unified Threat Management (UTM) Appliance
Multiple WAN Port Models for Increased Reliability or
Outbound Load Balancing
The UTM product line offers models with two broadband WAN ports. The second WAN port
allows you to connect a second broadband Internet line that can be configured on a mutually
exclusive basis to:
•Provide backup and rollover if one line is inoperable, ensuring that you are never
disconnected.
•Load balance, or use both Internet lines simultaneously for outgoing traffic. A UTM with
dual WAN ports balances users between the two lines for maximum bandwidth efficiency.
See Appendix C, Network Planning for Dual WAN Ports (Multiple WAN Port Models Only) for
the planning factors to consider when implementing the following capabilities with dual WAN
port gateways:
•Single or multiple exposed hosts
•Virtual private networks
Wireless Features
Wireless client connections are supported on the UTM9S with a UTM9SWLSN wireless
module installed. The UTM9S supports the following wireless features:
•2.4-GHz radio and 5-GHz radio. Either 2.4-GHz band support with 802.11b/g/n/ wireless
modes or 5-GHz band support with 802.11a/n wireless modes.
•WMM QoS priority. Wi-Fi Multimedia (WMM) Quality of Service (QoS) priority settings to
map one of four queues to each Differentiated Services Code Point (DSCP) value.
•Wireless Distribution System (WDS). WDS enables expansion of a wireless network
through two or more access points that are interconnected.
•Access control. The Media Access Control (MAC) address filtering feature can ensure
that only trusted wireless stations can use the UTM to gain access to your LAN.
•Hidden mode. The SSID is not broadcast, assuring that only clients configured with the
correct SSID can connect.
•Secure and economical operation. Adjustable power output allows more secure or
economical operation.
DSL Features
DSL is supported on the UTM9S with a UTM9SDSL xDSL module installed. The UTM9S
automatically detects the following types of DSL connections:
•ADSL, ADSL2, and ADLS2+
•VDSL and VDSL2
Annex A, Annex B, and Annex M are supported to accommodate PPPoE, PPPoA, and IPoA
ISP connections.

Introduction
17
ProSecure Unified Threat Management (UTM) Appliance
Advanced VPN Support for Both IPSec and SSL
The UTM supports IPSec and SSL virtual private network (VPN) connections.
•IPSec VPN delivers full network access between a central office and branch offices, or
between a central office and telecommuters. Remote access by telecommuters requires
the installation of VPN client software on the remote computer.
-IPSec VPN with broad protocol support for secure connection to other IPSec
gateways and clients.
-Depending on the model, bundled with a one-user license of the NETGEAR ProSafe
VPN Client software (VPN01L).
•SSL VPN provides remote access for mobile users to selected corporate resources
without requiring a preinstalled VPN client on their computers.
-Uses the familiar Secure Sockets Layer (SSL) protocol, commonly used for
e-commerce transactions, to provide client-free access with customizable user
portals and support for a wide variety of user repositories.
-Allows browser-based, platform-independent remote access through a number of
popular browsers, such as Microsoft Internet Explorer, Mozilla Firefox, and Apple
Safari.
-Provides granular access to corporate resources based on user type or group
membership.
A Powerful, True Firewall
Unlike simple NAT routers, the UTM is a true firewall, using Stateful Packet Inspection (SPI)
to defend against hacker attacks. Its firewall features have the following capabilities:
•DoS protection.Automatically detects and thwarts (distributed) denial of service (DoS)
attacks such as Ping of Death and SYN flood.
•Secure firewall.Blocks unwanted traffic from the Internet to your LAN.
•Schedule policies. Permits scheduling of firewall policies by day and time.
•Logs security incidents.Logs security events such as blocked incoming traffic, port
scans, attacks, and administrator logins. You can configure the firewall to email the log to
you at specified intervals. You can also configure the firewall to send immediate alert
messages to your email address or email pager whenever a significant event occurs.
Stream Scanning for Content Filtering
Stream Scanning is based on the simple observation that network traffic travels in streams.
The UTM scan engine starts receiving and analyzing traffic as the stream enters the network.
As soon as a number of bytes are available, scanning starts. The scan engine continues to
scan more bytes as they become available, while at the same time another thread starts to
deliver the bytes that have been scanned.
This multithreaded approach, in which the receiving, scanning, and delivering processes
occur concurrently, ensures that network performance remains unimpeded. The result is that

Introduction
18
ProSecure Unified Threat Management (UTM) Appliance
file scanning is up to five times faster than with traditional antivirus solutions—a performance
advantage that you will notice.
Stream Scanning also enables organizations to withstand massive spikes in traffic, as in the
event of a malware outbreak. The scan engine has the following capabilities:
•Real-time protection. The patent-pending Stream Scanning technology enables
scanning of previously undefended real-time protocols, such as HTTP. Network activities
susceptible to latency (for example, web browsing) are no longer brought to a standstill.
•Comprehensive protection. Provides both web and email security, covering six major
network protocols: HTTP, HTTPS, FTP, SMTP, POP3, and IMAP. The UTM uses
enterprise-class scan engines employing both signature-based and distributed spam
analysis to stop both known and unknown threats. The malware database contains
hundreds of thousands of signatures of spyware, viruses, and other malware.
•Objectionable traffic protection. The UTM prevents objectionable content from
reaching your computers. You can control access to the Internet content by screening for
web services, web addresses, and keywords within web addresses. You can log and
report attempts to access objectionable Internet sites.
•Application control. The UTM provides application control for entire categories of
applications, individual applications, or a combination of both. You can either globally
allow or block applications or configure custom application control profiles for groups of
users, individual users, or a combination of both. The UTM supports multiple applications.
•Automatic signature updates. Malware signatures are updated as frequently as every
hour, and the UTM can check automatically for new signatures as frequently as every 15
minutes.
Security Features
The UTM is equipped with several features designed to maintain security:
•PCs hidden by NAT. NAT opens a temporary path to the Internet for requests originating
from the local network. Requests originating from outside the LAN are discarded,
preventing users outside the LAN from finding and directly accessing the computers on
the LAN.
•Port forwarding with NAT.Although NAT prevents Internet locations from directly
accessing the PCs on the LAN, the UTM allows you to direct incoming traffic to specific
PCs based on the service port number of the incoming request. You can specify
forwarding of single ports or ranges of ports.
•DMZ port. Incoming traffic from the Internet is usually discarded by the UTM unless the
traffic is a response to one of your local computers or a service for which you have
configured an inbound rule. Instead of discarding this traffic, you can use the dedicated
demilitarized zone (DMZ) port to forward the traffic to one PC on your network.

Introduction
19
ProSecure Unified Threat Management (UTM) Appliance
Autosensing Ethernet Connections with Auto Uplink
With its internal four- or six-port 10/100/1000 Mbps switch and single or dual
(model-dependant) 10/100/1000 WAN ports, the UTM can connect to either a 10 Mbps
standard Ethernet network, a 100 Mbps Fast Ethernet network, or a 1000 Mbps Gigabit
Ethernet network. The four LAN and one or two WAN interfaces are autosensing and capable
of full-duplex or half-duplex operation.
The UTM incorporates Auto UplinkTM technology. Each Ethernet port automatically senses
whether the Ethernet cable plugged into the port should have a normal connection such as to
a PC or an uplink connection such as to a switch or hub. That port then configures itself
correctly. This feature eliminates the need for you to think about crossover cables, as Auto
Uplink accommodates either type of cable to make the right connection.
Extensive Protocol Support
The UTM supports the Transmission Control Protocol/Internet Protocol (TCP/IP) and Routing
Information Protocol (RIP). For further information about TCP/IP, see Internet Configuration
Requirements on page 573. The UTM provides the following protocol support:
•IP address sharing by NAT. The UTM allows many networked PCs to share an Internet
account using only a single IP address, which might be statically or dynamically assigned
by your Internet service provider (ISP). This technique, known as Network Address
Translation (NAT), allows the use of an inexpensive single-user ISP account.
•Automatic configuration of attached PCs by DHCP. The UTM dynamically assigns
network configuration information, including IP, gateway, and Domain Name Server
(DNS) addresses, to attached PCs on the LAN using the Dynamic Host Configuration
Protocol (DHCP). This feature greatly simplifies configuration of PCs on your local
network.
•DNS proxy. When DHCP is enabled and no DNS addresses are specified, the firewall
provides its own address as a DNS server to the attached PCs. The firewall obtains
actual DNS addresses from the ISP during connection setup and forwards DNS requests
from the LAN.
•PPP over Ethernet (PPPoE). PPPoE is a protocol for connecting remote hosts to the
Internet over a DSL connection by simulating a dial-up connection.
•Quality of Service (QoS).The UTM supports QoS, including traffic prioritization and
traffic classification with Type of Service (ToS) and Differentiated Services Code Point
(DSCP) marking.

Introduction
20
ProSecure Unified Threat Management (UTM) Appliance
Easy Installation and Management
You can install, configure, and operate the UTM within minutes after connecting it to the
network. The following features simplify installation and management tasks:
•Browser-based management. Browser-based configuration allows you to easily
configure the UTM from almost any type of operating system, such as Windows,
Macintosh, or Linux. A user-friendly Setup Wizard is provided, and online help
documentation is built into the browser-based web management interface.
•Autodetection of ISP. The UTM automatically senses the type of Internet connection,
asking you only for the information required for your type of ISP account.
•IPSec VPN Wizard. The UTM includes the NETGEAR IPSec VPN Wizard so you can
easily configure IPSec VPN tunnels according to the recommendations of the Virtual
Private Network Consortium (VPNC). This ensures that the IPSec VPN tunnels are
interoperable with other VPNC-compliant VPN routers and clients.
•SSL VPN Wizard. The UTM includes the NETGEAR SSL VPN Wizard so you can easily
configure SSL connections over VPN according to the recommendations of the VPNC.
This ensures that the SSL connections are interoperable with other VPNC-compliant VPN
routers and clients.
•SNMP. The UTM supports the Simple Network Management Protocol (SNMP) to let you
monitor and manage log resources from an SNMP-compliant system manager. The
SNMP system configuration lets you change the system variables for MIB2.
•Diagnostic functions. The UTM incorporates built-in diagnostic functions such as ping,
traceroute, DNS lookup, and remote reboot.
•Remote management. The UTM allows you to log in to the web management interface
from a remote location on the Internet. For security, you can limit remote management
access to a specified remote IP address or range of addresses.
•Visual monitoring. The UTM’s front panel LEDs provide an easy way to monitor its
status and activity.
Maintenance and Support
NETGEAR offers the following features to help you maximize your use of the UTM:
•Flash memory for firmware upgrades.
•Technical support seven days a week, 24 hours a day. Information about support is
available on the NETGEAR ProSecure website at
http://prosecure.netgear.com/support/index.php.