NETGEAR SSL312-100NAS - ProSafe SSL312 SSL VPN Concentrator... User manual

202-10208-05
November 2008
v2.1
NETGEAR, Inc.
350 East Plumeria Drive
San Jose, California 95134 USA
NETGEAR ProSafe SSL
VPN Concentrator 25
SSL312 Reference
Manual

ii
v2.1, November 2008
© 2008 by NETGEAR, Inc. All rights reserved.
Technical Support
Please register to obtain technical support. Please retain your proof of purchase and warranty information.
To register your product, get product support or obtain product information and product documentation, go to
http://www.NETGEAR.com. If you do not have access to the World Wide Web, you may register your product by filling
out the registration card and mailing it to NETGEAR customer service.
You will find technical support information at: http://www.NETGEAR.com/ through the customer service area. If you
want to contact technical support by telephone, see the support information card for the correct telephone number for
your country.
Trademarks
NETGEAR, the NETGEAR logo, ProSafe and Auto Uplink are trademarks or registered trademarks of NETGEAR, Inc.
Microsoft, Windows, and Windows NT are registered trademarks of Microsoft Corporation.
Other brand and product names are registered trademarks or trademarks of their respective holders.
Statement of Conditions
In the interest of improving internal design, operational function, and/or reliability, NETGEAR reserves the right to
make changes to the products described in this document without notice.
NETGEAR does not assume any liability that may occur due to the use or application of the product(s) or circuit
layout(s) described herein.
FCC Statement
This device complies with part 15 of the FCC Rules. Operation is subject to the following two conditions:
• This device may not cause harmful interference.
• This device must accept any interference received, including interference that may cause undesired operation.
FCC Requirements for Operation in the United States
Radio Frequency Interference Warnings & Instructions This equipment has been tested and found to comply
with the limits for a Class B digital device, pursuant to part 15 of the FCC Rules. These limits are designed to provide
reasonable protection against harmful interference in a residential installation. This equipment generates, uses, and can
radiate radio frequency energy and, if not installed and used in accordance with the instructions, may cause harmful
interference to radio communications. However, there is no guarantee that interference will not occur in a particular
installation. If this equipment does cause harmful interference to radio or television reception, which can be determined
by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the
following measures:
• Reorient or relocate the receiving antenna
• Increase the separation between the equipment and receiver
• Connect the equipment into an outlet on a circuit different from that to which the receiver is connected
• Consult the dealer or an experienced radio/TV technician for help.

v2.1, November 2008
iii
EU Regulatory Compliance Statement
ProSafe SSL VPN Concentrator 25 is compliant with the following EU Council Directives: 89/336/EEC and
LVD 73/23/EEC. Compliance is verified by testing to the following standards: EN55022 Class B, EN55024 and
EN60950.
Certificate of the Manufacturer/Importer
It is hereby certified that the ProSafe SSL VPN Concentrator 25 has been suppressed in accordance with the conditions
set out in the BMPT-AmtsblVfg 243/1991 and Vfg 46/1992. The operation of some equipment (for example, test
transmitters) in accordance with the regulations may, however, be subject to certain restrictions. Please refer to the notes
in the operating instructions.
The Federal Office for Telecommunications Approvals has been notified of the placing of this equipment on the market
and has been granted the right to test the series for compliance with the regulations.
Bestätigung des Herstellers/Importeurs
Es wird hiermit bestätigt, daß dasProSafe SSL VPN Concentrator 25 gemäß der im BMPT-AmtsblVfg 243/1991 und
Vfg 46/1992 aufgeführten Bestimmungen entstört ist. Das vorschriftsmäßige Betreiben einiger Geräte (z.B. Testsender)
kann jedoch gewissen Beschränkungen unterliegen. Lesen Sie dazu bitte die Anmerkungen in der Betriebsanleitung.
Das Bundesamt für Zulassungen in der Telekommunikation wurde davon unterrichtet, daß dieses Gerät auf den Markt
gebracht wurde und es ist berechtigt, die Serie auf die Erfüllung der Vorschriften hin zu überprüfen.
Export
This software product and related technology is subject to U.S. export control and may be subject to export or import
regulations in other countries. Purchaser must strictly comply with all such laws and regulations. A license to export or
reexport may be required by the U.S. Department of Commerce.
Licensing
This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit
(http://www.openssl.org/).
This product includes software developed by the Apache Software Foundation (http://www.apache.org/).
This product includes SSLeay cryptographic software written by Tim Hudson ([email protected]) and Eric Young
([email protected]).

v2.1, November 2008
iv
Product and Publication Details
Model Number: SSL312
Publication Date: November 2008
Product Family: Concentrator
Product Name: ProSafe SSL VPN Concentrator 25
Home or Business Product: Business
Language: English
Publication Part Number: 202-10208-05
Publication Version Number: 2.1

v
v2.1, November 2008
Contents
About This Manual
Conventions, Formats and Scope .................................................................................... ix
Using This Manual .............................................................................................................x
Printing this Manual ...........................................................................................................x
Revision History ................................................................................................................xii
Chapter 1
Introduction
About the ProSafe SSL VPN Concentrator 25 ...............................................................1-1
Key Features ..................................................................................................................1-1
Web Browser Requirements ...........................................................................................1-2
What’s in the Box ............................................................................................................1-3
Hardware Description .....................................................................................................1-3
Front Panel ...............................................................................................................1-4
Back Panel ...............................................................................................................1-5
Steps for Deploying the SSL312 .....................................................................................1-5
Chapter 2
Installing the SSL312
Choosing a Network Topology ........................................................................................2-1
Single Arm ................................................................................................................2-1
Routing .....................................................................................................................2-2
Initial Connection to the SSL VPN Concentrator ............................................................2-3
Accessing the Management Interface ............................................................................2-4
Configuring Basic Network Settings ...............................................................................2-6
Installing the SSL VPN Concentrator .............................................................................2-8
Managing Certificates .....................................................................................................2-8
Obtaining a Certificate from a Certificate Authority ..................................................2-9
Generating a Self-Signed Certificate ......................................................................2-11
Uploading and Enabling the New Certificate ..........................................................2-12
Viewing and Deleting Certificates ..........................................................................2-14

vi
v2.1, November 2008
Steps for Further Configuration ....................................................................................2-15
Chapter 3
Authenticating Users
Authentication Domains ..................................................................................................3-1
Local User Database Authentication ..............................................................................3-2
RADIUS and NT Domain Authentication ........................................................................3-3
Configuring for RADIUS Domain Authentication ......................................................3-4
Configuring for NT Domain Authentication ...............................................................3-5
LDAP Authentication ......................................................................................................3-7
Sample LDAP Attributes ..........................................................................................3-7
LDAP Attribute Rules ...............................................................................................3-8
Sample LDAP Users and Attributes Settings ...........................................................3-8
Querying an LDAP Server ........................................................................................3-9
Configuring for LDAP Authentication .......................................................................3-9
Kerberos Authentication (Active Directory) ...................................................................3-11
Troubleshooting Active Directory Authentication ...................................................3-12
Deleting a Domain ........................................................................................................3-12
Chapter 4
Setting Up User and Group Access Policies
Determine Your Requirements .......................................................................................4-1
Users, Groups and Global Policies .................................................................................4-2
Global Policies ................................................................................................................4-3
Editing Global Policy Settings ..................................................................................4-4
Adding and Editing Global Policies ..........................................................................4-6
Defining and Editing Global Bookmarks ...................................................................4-7
Groups Configuration .....................................................................................................4-8
Adding a New Group ................................................................................................4-8
Editing Group Settings .............................................................................................4-9
Defining and Editing Group Policies .......................................................................4-11
Defining and Editing Group Bookmarks .................................................................4-12
Deleting a Group ....................................................................................................4-13
Users Configuration ......................................................................................................4-14
Adding a New User ................................................................................................4-15
Editing a User .........................................................................................................4-17
Defining and Editing User Policies .........................................................................4-20

vii
v2.1, November 2008
Defining and Editing a User Bookmarks ................................................................4-21
Deleting a User ......................................................................................................4-22
Using Network Resource Objects to Simplify Policies ..................................................4-22
Chapter 5
Configuring the Remote Access Web Portal
Creating the Portal ..........................................................................................................5-1
Portal Options ..........................................................................................................5-2
Adding Portal Layouts ..............................................................................................5-3
Adding Terminal Services Applications to the Portal ................................................5-6
Customizing the Banner ...........................................................................................5-7
Duplicating and Editing Portal Layouts ...........................................................................5-8
Preparing the Client for Using Portal Services ...............................................................5-9
Terminal Services Client Compatibility .....................................................................5-9
Creating a User Guide for Portal Services .............................................................5-10
Chapter 6
Configuring the SSL VPN Tunnel Client and Port Forwarding
Two Approaches for VPN ...............................................................................................6-1
SSL VPN Client Configuration ........................................................................................6-2
Adding IP Address Ranges ......................................................................................6-3
Adding Routes for VPN Tunnel Clients ....................................................................6-4
Configuring Applications for Port Forwarding .................................................................6-6
Configuring Host Name Resolution ..........................................................................6-8
Chapter 7
Additional System Configuration
Configuring Network Settings .........................................................................................7-1
Sample SSL VPN Concentrator Configuration .........................................................7-1
Network Interface and Default Gateway Configuration ............................................7-2
Static Route Configuration .......................................................................................7-4
Network Host Table Settings ....................................................................................7-6
Configuring DNS Settings ........................................................................................7-7
Setting Date and Time ....................................................................................................7-9
System Configuration Utilities .......................................................................................7-10
Encrypting the Configuration File ...........................................................................7-11
Exporting and Saving a Backup Configuration File ................................................7-11
Importing a Configuration File ................................................................................7-12

viii
v2.1, November 2008
Erasing the Configuration and Restoring the Default Settings ...............................7-13
Upgrading the SSL VPN Concentrator Firmware ..................................................7-13
Additional Notes on the Management Interface ...........................................................7-14
Chapter 8
Monitoring and Logging
SSL VPN Concentrator Status ........................................................................................8-1
Active Users ...................................................................................................................8-3
Event Log .......................................................................................................................8-4
Log Settings ....................................................................................................................8-5
Diagnostics .....................................................................................................................8-9
Appendix A
Default Settings and Technical Specifications
Factory Default Settings ................................................................................................ A-1
Technical Specifications ................................................................................................. A-2
Appendix B
Related Documents
Index

-ix
v2.1, November 2008
About This Manual
The NETGEAR®Prosafe™ SSL VPN Concentrator 25 SSL312 Reference Manual describes how
to install and configure the SSL312. The information in this manual is intended for administrators
who will configure the SSL312. You should have intermediate computer and Internet skills.
Conventions, Formats and Scope
The conventions, formats, and scope of this manual are described in the following paragraphs:
•Typographical Conventions. This manual uses the following typographical conventions:
•Formats. This manual uses the following formats to highlight special messages:
Italics Emphasis, books, CDs, file and server names, extensions
Bold User input, IP addresses, GUI screen text
Fixed Command prompt, CLI text, code
italic URL links
Note: This format is used to highlight information of importance or special interest.
Tip: This format is used to highlight a procedure that will save time or resources.
Warning: Ignoring this type of note could result in a malfunction or damage to the
equipment.

NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual
-x
v2.1, November 2008
•Scope. This manual is written for the SSL VPN Concentrator according to these
specifications:
For more information about network, Internet, firewall, and VPN technologies, see the links to the
NETGEAR website in Appendix B, “Related Documents”.
Using This Manual
The HTML version of this manual includes the following:
• Buttons, and , for browsing forwards or backwards through the manual one page
at a time
• A button that displays the table of contents and an button. Double-click on a
link in the table of contents or index to navigate directly to where the topic is described in the
manual.
• A button to access the full NETGEAR, Inc. online knowledge base for the product
model.
• Links to PDF versions of the full manual and individual chapters.
Printing this Manual
To print this manual you can choose one of the following several options, according to your needs.
•Printing a Page in the HTML View.
Danger: This is a safety warning. Failure to take heed of this notice could result in
personal injury or death.
Product Version ProSafe SSL VPN Concentrator 25 SSL312
Manual Publication Date November 2008
Note: Product updates are available on the NETGEAR, Inc. website at
http://kbserver.netgear.com/products/SSL312.asp.