NETGEAR FVS124G - ProSafe VPN Firewall 25 User manual

1-1
v1.0, January 2007
Chapter 1
Introduction
This chapter describes the features of the NETGEAR ProSafe VPN Firewall 25 with 4 Gigabit
LAN and Dual WAN Ports.
Key Features of the VPN Firewall
The ProSafe VPN Firewall 25 with 4 Gigabit LAN and Dual WAN Ports with 4 port switch
connects your local area network (LAN) to the Internet through an external access device such as a
cable modem or DSL modem.
The FVS124G is a complete security solution that protects your network from attacks and
intrusions. Unlike simple Internet sharing firewalls that rely on Network Address Translation
(NAT) for security, the FVS124G uses Stateful Packet Inspection for Denial of Service (DoS)
attack protection and intrusion detection. The VPN Firewall provides you with multiple Web
content filtering options, plus browsing activity reporting and instant alerts—both via e-mail.
Network administrators can establish restricted access policies based on time-of-day, Website
addresses and address keywords.
With minimum setup, you can install and use the firewall within minutes.
The VPN Firewall provides the following features:
• Two 10/100 Mbps ports for an Ethernet connection to a WAN device, such as a cable modem
or DSL modem.
• Dual WAN ports that provide for increased system reliability and load balancing.
• Support for up to 10 VPN tunnels.
• Easy, web-based setup for installation and management.
• URL keyword Content Filtering and Site Blocking Security.
• Quality of Service (QoS) support for traffic prioritization.
• Built in 4-port 10/100/1000 Mbps switch.
• Extensive Protocol Support.
• Login capability.
• Front panel LEDs for easy monitoring of status and activity.

FVS124G ProSafe VPN Firewall 25 Reference Manual
1-2
v1.0, January 2007
• Flash memory for firmware upgrade.
Dual WAN Ports for Increased Reliability or Outbound Load
Balancing
The VPN Firewall has two broadband WAN ports, WAN1 and WAN2, each capable of operating
independently at speeds of either 10 Mbps or 100 Mbps. The two WAN ports let you connect a
second broadband Internet line that can be configured on a mutually-exclusive basis to:
• Provide backup and rollover if one line is inoperable, ensuring you are never disconnected.
• Load balance, or use both Internet lines simultaneously for the outgoing traffic. The firewall
balances users between the two lines for maximum bandwidth efficiency.
See “Dual WAN Port Network Planning” on page B-1 for the planning factors to consider when
implementing the following capabilities with dual WAN port gateways:
• Inbound traffic (e.g., port forwarding, port triggering).
• Virtual Private Networks (VPNs).
A Powerful, True Firewall with Content Filtering
Unlike simple Internet sharing NAT routers, the FVS124G is a true firewall, using stateful packet
inspection to defend against hacker attacks. Its firewall features include:
• DoS protection. Automatically detects and thwarts DoS attacks such as Ping of Death, SYN
Flood, LAND Attack, and IP Spoofing.
• Blocks unwanted traffic from the Internet to your LAN.
• Blocks access from your LAN to Internet locations or services that you specify as off-limits.
• Logs security incidents.
• The FVS124G will log security events such as blocked incoming traffic, port scans, attacks,
and administrator logins. You can configure the firewall to email the log to you at specified
intervals. You can also configure the firewall to send immediate alert messages to your email
address or email pager whenever a significant event occurs.
• With its URL keyword filtering feature, the FVS124G prevents objectionable content from
reaching your PCs. The firewall allows you to control access to Internet content by screening
for keywords within Web addresses. You can configure the firewall to log and report attempts
to access objectionable Internet sites.

FVS124G ProSafe VPN Firewall 25 Reference Manual
1-3
v1.0, January 2007
Security
The VPN Firewall is equipped with several features designed to maintain security, as described in
this section.
• PCs Hidden by NAT
NAT opens a temporary path to the Internet for requests originating from the local network.
Requests originating from outside the LAN are discarded, preventing users outside the LAN
from finding and directly accessing the PCs on the LAN.
• Port Forwarding with NAT
Although NAT prevents Internet locations from directly accessing the PCs on the LAN, the
firewall allows you to direct incoming traffic to specific PCs based on the service port number
of the incoming request. You can specify forwarding of single ports or ranges of ports.
• Powerful Firewall Rules
Both inbound and outbound traffic can be controlled tightly by defining your own rules
regarding permitted users, services, protocols, schedules, and destinations.
Autosensing Ethernet Connections with Auto Uplink
With its internal 4-port 10/100/1000 switch, the FVS124G can connect to either a 10 Mbps
standard Ethernet network, a 100 Mbps Fast Ethernet network, or a 1000 Mbps Gigabit Ethernet.
Both the LAN and WAN interfaces are autosensing and capable of full-duplex or half-duplex
operation.
The firewall incorporates Auto UplinkTM technology. Each Ethernet port will automatically sense
whether the Ethernet cable plugged into the port should have a “normal” connection such as to a
PC or an “uplink” connection such as to a switch or hub. That port will then configure itself to the
correct configuration. This feature also eliminates the need to worry about crossover cables, as
Auto Uplink will accommodate either type of cable to make the right connection.
Extensive Protocol Support
The VPN Firewall supports the Transmission Control Protocol/Internet Protocol (TCP/IP) and
Routing Information Protocol (RIP). For a link to further information about TCP/IP, see
Appendix C, “Related Documents”.
• IP Address Sharing by NAT
The VPN Firewall allows several networked PCs to share an Internet account using only a
single IP address, which may be statically or dynamically assigned by your Internet service
provider (ISP). This technique, known as NAT, allows the use of an inexpensive single-user
ISP account.

FVS124G ProSafe VPN Firewall 25 Reference Manual
1-4
v1.0, January 2007
• Automatic Configuration of Attached PCs by DHCP
The VPN Firewall dynamically assigns network configuration information, including
IP, gateway, and domain name server (DNS) addresses, to attached PCs on the LAN using the
Dynamic Host Configuration Protocol (DHCP). This feature greatly simplifies configuration
of PCs on your local network.
• DNS Proxy
When DHCP is enabled and no DNS addresses are specified, the firewall provides its own
address as a DNS server to the attached PCs. The firewall obtains actual DNS addresses from
the ISP during connection setup and forwards DNS requests from the LAN.
• PPP over Ethernet (PPPoE)
PPPoE is a protocol for connecting remote hosts to the Internet over a DSL connection by
simulating a dial-up connection. This feature eliminates the need to run a login program such
as EnterNet or WinPOET on your PC.
Easy Installation and Management
You can install, configure, and operate the ProSafe VPN Firewall 25 with 4 Gigabit LAN and Dual
WAN Ports within minutes after connecting it to the network. The following features simplify
installation and management tasks:
• Browser-based management
Browser-based configuration allows you to easily configure your firewall from almost any
type of personal computer, such as Windows, Macintosh, or Linux. A user-friendly Setup
Wizard is provided and online help documentation is built into the browser-based Web
Management Interface.
• Smart Wizard
The VPN Firewall automatically senses the type of Internet connection, asking you only for
the information required for your type of ISP account.
•VPNWizard
The VPN Firewall includes the NETGEAR VPN Wizard to easily configure VPN tunnels
according to the recommendations of the Virtual Private Network Consortium (VPNC) to
ensure the VPN tunnels are interoperable with other VPNC-compliant VPN routers and
clients.
•SNMP
The VPN Firewall supports the Simple Network Management Protocol (SNMP) to let you
monitor and manage log resources from an SNMP-compliant system manager. The SNMP
system configuration lets you change the system variables for MIB2.

FVS124G ProSafe VPN Firewall 25 Reference Manual
1-5
v1.0, January 2007
• Diagnostic functions
The firewall incorporates built-in diagnostic functions such as Ping, Trace Route, DNS
lookup, and remote reboot.
• Remote management
The firewall allows you to securely login to the Web Management Interface from a remote
location on the Internet. For additional security, you can limit remote management access to a
specified remote IP address or range of addresses, and you can choose a nonstandard port
number.
• Visual monitoring
The front panel LEDs of the VPN Firewall provide an easy way to monitor its status and
activity.
Maintenance and Support
NETGEAR offers the following features to help you maximize your use of the VPN Firewall:
• Flash memory for firmware upgrade.
• Free technical support seven days a week, twenty-four hours a day.
Package Contents
The product package should contain the following items:
• ProSafe VPN Firewall 25 with 4 Gigabit LAN and Dual WAN Ports.
• AC power adapter (varies by region).
• Rubber feet.
• Category 5 (Cat 5) Ethernet cable.
•Resource CD , including:
– This guide.
– Application Notes and other helpful information.
– ProSafe VPN Client Software—one user license.
• Warranty and Support Information Card.
If any of the parts are incorrect, missing, or damaged, contact your NETGEAR dealer. Keep the
carton, including the original packing materials, in case you need to return the firewall for repair.

FVS124G ProSafe VPN Firewall 25 Reference Manual
1-6
v1.0, January 2007
Router Front Panel
The ProSafe VPN Firewall 25 with 4 Gigabit LAN and Dual WAN Ports front panel shown below
in Figure 1-1 contains the port connections, status LEDs, and the factory defaults reset button.
The activity status of the router is shown by the LEDs on the router.Table 1-1 below describes each
item on the front panel of the firewall and its operation.
Figure 1-1
Table 1-1. FVS124G front panel
Object Activity Description
PWR LED On (Green)
Off
Power is supplied to the firewall.
Power is not supplied to the firewall.
TEST LED On (Amber)
Blinking (Amber)
Off
Test mode: The system is initializing or the initialization has failed.
Writing to Flash memory (during upgrading or resetting to defaults).
The system has booted successfully.
WAN Port
LEDs
Link/Act LED
On (Green)
Blinking (Green)
Off
The WAN port has detected a link with a connected Ethernet device.
Data is being transmitted or received by the WAN port.
The WAN port has no link.
100 LED
On (Green)
Off
The WAN port is operating at 100 Mbps.
The WAN port is operating at 10 Mbps.
Active LED
On (Green)
On (Amber)
Off
The WAN port has a valid Internet connection.
The Internet connection is down or not being used.
The WAN port is either not enabled or has no link.
Power
LED Test
LED
WAN1 Port
LEDs
WAN2 Port
LEDs Gigabit LAN Port LEDs

FVS124G ProSafe VPN Firewall 25 Reference Manual
1-7
v1.0, January 2007
Router Rear Panel
The rear panel of the ProSafe VPN Firewall 25 with 4 Gigabit LAN and Dual WAN Ports
(Figure 1-2) contains the factory defaults reset button, LAN and WAN ports, and DC power input
connection.
Viewed from left to right, the rear panel contains the following elements:
Gigabit LAN
Port LEDs
Link/Act LED
On (Green)
Blinking (Green)
Off
The LAN port has detected a link with a connected Ethernet device.
Data is being transmitted or received by the LAN port.
The LAN port has no link.
Speed LED
On (Green)
On (Amber)
Off
The LAN port is operating at 1,000 Mbps.
The LAN port is operating at 100 Mbps.
The LAN port is operating at 10 Mbps.
Figure 1-2
Table 1-2. FVS124G rear panel
Item Description
Factory Defaults
Button
Factory Defaults reset push button (see “” on page 1-9 for the factory defaults).
LAN Ports (local
ports)
4-port RJ-45 10/100/1000 Mbps Fast Ethernet Switch, N-way automatic speed
negotiation, auto MDI/MDIX.
Table 1-1. FVS124G front panel (continued)
Object Activity Description
Factory
Defaults
Button
LAN Ports WAN2 Port WAN1 Port AC Power
Adapter
Connection

FVS124G ProSafe VPN Firewall 25 Reference Manual
1-8
v1.0, January 2007
Router IP Address, Login Name, and Password
You need the address, login name and password to set up the Router. Check the label on the bottom
of the FVS124G enclosure if you forget the following factory default information:
• IP Address: http://192.168.1.1 to reach the Web-based GUI from the LAN
•Username:admin
• Password: password
Logging into the Router
To log into the FVS124G once it is connected:
WAN Ports
(Internet ports)
Two RJ-45 WAN ports, N-way automatic speed negotiation, Auto MDI/MDIX.
AC Power
Adapter
Connection
12 VDC, 1.2A
Figure 1-3
Table 1-2. FVS124G rear panel (continued)
Item Description
LAN IP Address
User Name
Password

FVS124G ProSafe VPN Firewall 25 Reference Manual
1-9
v1.0, January 2007
1. Open a Web browser and enter http://192.168.1.1 as the URL.
2. Once you get the login screen, enter the following information:
•admin for User Name
•password for Password
Figure 1-4
Note: Read-only access is provided by logging in as username guest and default
password password.

FVS124G ProSafe VPN Firewall 25 Reference Manual
1-10
v1.0, January 2007