NETGEAR FVS318G - ProSafe Gigabit VPN Firewall Data Sheet... User manual

202-10521-01
v1.1
November, 2009
NETGEAR, Inc.
350 East Plumeria Drive
San Jose, CA 95134
ProSafe Gigabit 8 Port
VPN Firewall FVS318G
Reference Manual

ii
1.1 November, 2009
© 2009 by NETGEAR, Inc. All rights reserved..
Technical Support
Please refer to the support information card that shipped with your product. By registering your product at
http://www.netgear.com/register, we can provide you with faster expert technical support and timely notices of product
and software upgrades.
NETGEAR, INC. Support Information
Phone: 1-888-NETGEAR, for US & Canada only. For other countries, see your Support information card.
E-mail: [email protected]
North American NETGEAR website: http://www.netgear.com
Trademarks
NETGEAR, the NETGEAR logo, ProSafe, Smart Wizard, and Auto Uplink are trademarks or registered trademarks of
NETGEAR, Inc. Microsoft, Windows, Windows NT and Vista are registered trademarks of Microsoft
Corporation.Other brand and product names are registered trademarks or trademarks of their respective holders.
Statement of Conditions
In the interest of improving internal design, operational function, and/or reliability, NETGEAR reserves the right to
make changes to the products described in this document without notice.
NETGEAR does not assume any liability that may occur due to the use or application of the product(s) or circuit
layout(s) described herein.
Certificate of the Manufacturer/Importer
It is hereby certified that the ProSafe VPN Firewall has been suppressed in accordance with the conditions set out in the
BMPT-AmtsblVfg 243/1991 and Vfg 46/1992. The operation of some equipment (for example, test transmitters) in
accordance with the regulations may, however, be subject to certain restrictions. Please refer to the notes in the operating
instructions.
The Federal Office for Telecommunications Approvals has been notified of the placing of this equipment on the market
and has been granted the right to test the series for compliance with the regulations.
Bestätigung des Herstellers/Importeurs
Es wird hiermit bestätigt, daß dasProSafe VPN Firewall gemäß der im BMPT-AmtsblVfg 243/1991 und Vfg 46/1992
aufgeführten Bestimmungen entstört ist. Das vorschriftsmäßige Betreiben einiger Geräte (z.B. Testsender) kann jedoch
gewissen Beschränkungen unterliegen. Lesen Sie dazu bitte die Anmerkungen in der Betriebsanleitung.
Das Bundesamt für Zulassungen in der Telekommunikation wurde davon unterrichtet, daß dieses Gerät auf den Markt
gebracht wurde und es ist berechtigt, die Serie auf die Erfüllung der Vorschriften hin zu überprüfen.
Voluntary Control Council for Interference (VCCI) Statement
This equipment is in the Class B category (information equipment to be used in a residential area or an adjacent area
thereto) and conforms to the standards set by the Voluntary Control Council for Interference by Data Processing
Equipment and Electronic Office Machines aimed at preventing radio interference in such residential areas. When used
near a radio or TV receiver, it may become the cause of radio interference. Read instructions for correct handling.

1.1 November, 2009
iii
Model Number: FVS318G
Publication Date: November, 2009
Product Family: VPN Firewall Router
Product Name: ProSafe VPN Firewall
Home or Business Product: Business
Language: English
Publication Part Number: 202-10521-01
Publication Version Number: 1.1

1.1 November, 2009
iv

Contents v
1.1November, 2009
Contents
About This Manual
Conventions, Formats, and Scope ................................................................................... xi
How to Print This Manual ................................................................................................ xii
Revision History ............................................................................................................... xii
Chapter 1
Introduction
Key Features of the VPN Firewall ..................................................................................1-1
Advanced VPN Support for Both IPsec and SSL .....................................................1-2
A Powerful, True Firewall with Content Filtering ......................................................1-2
Autosensing Ethernet Connections with Auto Uplink ...............................................1-3
Extensive Protocol Support ......................................................................................1-3
Easy Installation and Management ................................................................................1-4
Maintenance and Support ..............................................................................................1-4
Package Contents ..........................................................................................................1-5
Front Panel Features ......................................................................................................1-5
Rear Panel Features ......................................................................................................1-7
Default IP Address, Login Name, and Password Location .............................................1-8
Qualified Web Browsers .................................................................................................1-8
Chapter 2
Connecting the FVS318G to the Internet
Understanding the Connection Steps .............................................................................2-1
Logging into the VPN Firewall Router Router .................................................................2-2
Navigating the Menus .....................................................................................................2-3
Configuring the Internet Connections .............................................................................2-4
Automatically Detecting and Connecting .................................................................2-5
Manually Configuring the Internet Connection .........................................................2-7
Configuring the WAN Mode ..........................................................................................2-11
Network Address Translation .................................................................................2-11

vi Contents
1.1 November, 2009
Classical Routing ...................................................................................................2-12
Configuring Dynamic DNS (Optional) ...........................................................................2-13
Configuring the Advanced WAN Options (Optional) .....................................................2-15
Chapter 3
LAN Configuration
Choosing the Firewall DHCP Options ............................................................................3-1
Configuring the LAN Setup Options .........................................................................3-2
Managing Groups and Hosts (LAN Groups) ...................................................................3-5
Viewing the LAN Groups Database ..........................................................................3-6
Changing Group Names in the LAN Groups Database ...........................................3-9
Configuring DHCP Address Reservation ........................................................................3-9
Configuring Multi Home LAN IP Addresses ..................................................................3-10
Configuring Static Routes .............................................................................................3-11
Configuring Routing Information Protocol (RIP) ...........................................................3-13
Chapter 4
Firewall Protection and Content Filtering
About Firewall Protection and Content Filtering .............................................................4-1
Using Rules to Block or Allow Specific Kinds of Traffic...................................................4-2
About Services-Based Rules ...................................................................................4-3
Viewing the Rules ....................................................................................................4-8
Order of Precedence for Rules ................................................................................4-8
Setting the Default Outbound Policy ........................................................................4-9
Creating a LAN WAN Outbound Services Rule .......................................................4-9
Creating a LAN WAN Inbound Services Rule ........................................................4-10
Inbound Rules Examples .......................................................................................4-13
Outbound Rules Example ......................................................................................4-16
Adding Customized Services .................................................................................4-16
Setting Quality of Service (QoS) Priorities .............................................................4-18
Attack Checks ...............................................................................................................4-19
Blocking Internet Sites (Content Filtering).....................................................................4-21
Configuring Source MAC Filtering ................................................................................4-24
Configuring IP/MAC Address Binding Alerts ................................................................4-26
Configuring Port Triggering ..........................................................................................4-27
Setting a Schedule to Block or Allow Specific Traffic ...................................................4-29

Contents vii
1.1November, 2009
Configuring a Bandwidth Profile ...................................................................................4-30
Configuring Session Limits ...........................................................................................4-31
E-Mail Notifications of Event Logs and Alerts ...............................................................4-33
Administrator Tips .........................................................................................................4-33
Chapter 5
Virtual Private Networking Using IPsec
Using the VPN Wizard for Client and Gateway Configurations ......................................5-1
Creating Gateway to Gateway VPN Tunnels with the Wizard .................................5-2
Creating a Client to Gateway VPN Tunnel ...............................................................5-5
Testing the Connections and Viewing Status Information ............................................5-11
NETGEAR VPN Client Status and Log Information ...............................................5-11
FVS318G VPN Connection Status and Logs .........................................................5-13
Managing VPN Policies ................................................................................................5-14
Managing IKE Policies ...........................................................................................5-14
Managing VPN Policies ..........................................................................................5-16
Configuring Extended Authentication (XAUTH) ............................................................5-17
Configuring XAUTH for VPN Clients ......................................................................5-18
User Database Configuration .................................................................................5-19
RADIUS Client Configuration .................................................................................5-19
Assigning IP Addresses to Remote Users (ModeConfig) .............................................5-21
Mode Config Operation ..........................................................................................5-22
Configuring the VPN Firewall Router .....................................................................5-22
Configuring the ProSafe VPN Client for ModeConfig .............................................5-25
Configuring Keepalives and Dead Peer Detection .......................................................5-27
Configuring Keepalive ............................................................................................5-27
Configuring NetBIOS Bridging with VPN ......................................................................5-29
Chapter 6
Managing Users, Authentication, and Certificates
Managing Users ............................................................................................................. 6-1
Changing the Administrator Login ........................................................................... 6-2
Changing the Guest Login ...................................................................................... 6-3
Setting administrator timeout and domain display name ........................................ 6-4
Changing Passwords and Settings ......................................................................... 6-6

viii Contents
1.1 November, 2009
RADIUS Server External Authentication ................................................................. 6-7
Managing Certificates .................................................................................................... 6-8
Viewing and Loading CA Certificates .................................................................... 6-10
Viewing Active Self Certificates ............................................................................. 6-11
Obtaining a Self Certificate from a Certificate Authority ........................................ 6-11
Managing your Certificate Revocation List (CRL) ................................................. 6-14
Chapter 7
Router and Network Management
Performance Management .............................................................................................7-1
Bandwidth Capacity .................................................................................................7-1
Features That Reduce Traffic ..................................................................................7-2
Features That Increase Traffic .................................................................................7-5
Using QoS to Shift the Traffic Mix ............................................................................7-7
Tools for Traffic Management ..................................................................................7-8
Changing Passwords and Administrator Settings ..........................................................7-8
Enabling Remote Management Access .......................................................................7-10
Using the Command Line Interface ..............................................................................7-13
Using an SNMP Manager .............................................................................................7-13
Configuration File Management ...................................................................................7-15
Upgrading the Firmware ...............................................................................................7-17
Configuring Date and Time Service ..............................................................................7-18
Chapter 8
Troubleshooting
Basic Functions ..............................................................................................................8-1
Power LED Not On ...................................................................................................8-2
LEDs Never Turn Off ................................................................................................8-2
LAN or WAN Port LEDs Not On ...............................................................................8-2
Troubleshooting the Web Configuration Interface ..........................................................8-3
Troubleshooting the ISP Connection ..............................................................................8-4
Troubleshooting a TCP/IP Network Using a Ping Utility .................................................8-5
Testing the LAN Path to Your VPN Firewall Router..................................................8-5
Testing the Path from Your PC to a Remote Device ................................................8-6
Restoring the Default Configuration and Password ........................................................8-7

Contents ix
1.1November, 2009
Problems with Date and Time ........................................................................................8-8
Using the Diagnostics Utilities ........................................................................................8-9
Appendix A
Technical Specifications and Factory Default Settings
Appendix B
Related Documents
Appendix C
Two Factor Authentication
Why do I need Two-Factor Authentication? ...................................................................C-1
What are the benefits of Two-Factor Authentication? ...................................................C-1
What is Two-Factor Authentication ................................................................................C-2
NETGEAR Two-Factor Authentication Solutions ..........................................................C-2

x Contents
1.1 November, 2009

xi
1.1 November, 2009
About This Manual
The NETGEAR®FVS318G ProSafe™ Gigabit 8 Port VPN Firewall Reference Manual describes
how to install, configure and troubleshoot the ProSafe VPN Firewall. The information in this
manual is intended for readers with intermediate computer and Internet skills.
Conventions, Formats, and Scope
The conventions, formats, and scope of this manual are described in the following paragraphs:
•Typographical Conventions.This manual uses the following typographical conventions::
•Formats.This manual uses the following formats to highlight special messages:
Italic Emphasis, books, CDs, file and server names, extensions
Bold User input, IP addresses, GUI screen text
Fixed Command prompt, CLI text, code
italic URL links
Note: This format is used to highlight information of importance or special interest.
Tip: This format is used to highlight a procedure that will save time or resources.
Warning: Ignoring this type of note may result in a malfunction or damage to the
equipment.

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual
xii About This Manual
1.1 November, 2009
•Scope.This manual is written for the VPN firewall according to these specifications:
For more information about network, Internet, firewall, and VPN technologies, see the links to the
NETGEAR website in Appendix B, “Related Documents.”
How to Print This Manual
To print this manual, your computer must have the free Adobe Acrobat reader installed in order to
view and print PDF files. The Acrobat reader is available on the Adobe Web site at
http://www.adobe.com.
Revision History
Danger: This is a safety warning. Failure to take heed of this notice may result in
personal injury or death.
Product Version ProSafe VPN Firewall
Manual Publication Date November, 2009
Note: Product updates are available on the NETGEAR, Inc. website at
http://kbserver.netgear.com/products/FVS318G.asp.
Tip: If your printer supports printing two pages on a single sheet of paper, you can
save paper and printer ink by selecting this feature.
Part Number Version
Number Date Description
202-10521-01 1.0 July 2009 Product update: New firmware and new user Interface
202-10521-01 1.1 November 2009 Update to LAN and Firewall configuration

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual
About This Manual xiii
1.1 November, 2009

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual
xiv About This Manual
1.1 November, 2009

1-1
1.1 November, 2009
Chapter 1
Introduction
The ProSafe VPN Firewall connects your local area network (LAN) to the Internet through an
external access device such as a cable modem or DSL modem.
The FVS318G is a complete security solution that protects your network from attacks and
intrusions. Unlike simple Internet sharing firewalls that rely on Network Address Translation
(NAT) for security, the FVS318G uses stateful packet inspection for Denial of Service attack
(DoS) protection and intrusion detection.
The FVS318G allows Internet access for up to 253 users. The use of Gigabit Ethernet LAN and
WAN ports ensures extremely high data transfer speeds.
The VPN firewall provides you with multiple Web content filtering options, plus browsing activity
reporting and instant alerts — both via e-mail. Parents and network administrators can establish
restricted access policies based on time-of-day, web site addresses and address keywords, and
share high-speed cable/DSL Internet access for up to 253 personal computers. In addition to NAT,
the built-in firewall protects you from hackers.
With minimum setup, you can install and use the firewall within minutes.
This chapter contains the following sections:
•“Key Features of the VPN Firewall Router” on page 1-1
•“Package Contents” on page 1-5
•“Front Panel Features” on page 1-5
•“Rear Panel Features” on page 1-7
•“Default IP Address, Login Name, and Password Location” on page 1-8
•“Qualified Web Browsers” on page 1-8
Key Features of the VPN Firewall Router
The VPN firewall provides the following features:
• Easy, Web-based setup for installation and management.
• Content filtering and site blocking security.

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual
1-2 Introduction
1.1 November, 2009
• Built-in eight-port 10/100/1000 Mbps Gigabit Ethernet LAN switch for extremely fast data
transfer between local network resources..
• 10/100/1000 Mbps Gigabit Ethernet WAN port for connection to a WAN device, such as a
cable modem or DSL modem.
• Advanced IPsec VPN support.
• Advanced stateful packet inspection (SPI) firewall with multi-NAT support.Login capability.
• Front panel LEDs for easy monitoring of status and activity.
• Flash memory for firmware upgrade.
Advanced VPN Support for IPsec
The VPN firewall supports IPsec virtual private network (VPN) connections.
IPsec VPN delivers full network access between a central office and branch offices, or between a
central office and telecommuters. Remote access by telecommuters requires the installation of
VPN client software on the remote computer.
• IPsec VPN with broad protocol support for secure connection to other IPsec gateways and
clients.
• Bundled with the single-user license of the NETGEAR ProSafe VPN Client software
(VPN01L)
• Supports 5 concurrent IPsec VPN tunnels.
A Powerful, True Firewall with Content Filtering
Unlike simple Internet sharing NAT routers, the FVS318G is a true firewall, using stateful packet
inspection (SPI) to defend against hacker attacks. Its firewall features include:
• Automatically detects and thwarts denial of service (DoS) attacks such as Ping of Death and
SYN Flood.
• Blocks unwanted traffic from the Internet to your LAN.
• Blocks access from your LAN to Internet locations or services that you specify as off-limits.
• Prevents objectionable content from reaching your PCs. You can control access to Internet
content by screening for Web services, Web addresses, and keywords within Web addresses.
You can configure the firewall to log and report attempts to access objectionable Internet sites.
• Permits scheduling of firewall policies by day and time.

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual
Introduction 1-3
1.1 November, 2009
• Logs security events such as blocked incoming traffic, port scans, attacks, and administrator
logins. You can configure the firewall to email the log to you at specified intervals. You can
also configure the firewall to send immediate alert messages to your email address or email
pager whenever a significant event occurs.
Autosensing Ethernet Connections with Auto Uplink
With its internal 8-port 10/100/1000 Mbps switch and 10/100/1000 WAN port, the FVS318G can
connect to either a 10 Mbps standard Ethernet network, a 100 Mbps Fast Ethernet network, or a
1000 Mbps Gigabit Ethernet network. The LAN and WAN interfaces are autosensing and capable
of full-duplex or half-duplex operation.
The FVS318G incorporates Auto UplinkTM technology. Each Ethernet port will automatically
sense whether the Ethernet cable plugged into the port should have a “normal” connection such as
to a PC or an “uplink” connection such as to a switch or hub. That port will then configure itself to
the correct configuration. This feature eliminates the need to worry about crossover cables, as
Auto Uplink will accommodate either type of cable to make the right connection.
Extensive Protocol Support
The VPN firewall supports the Transmission Control Protocol/Internet Protocol (TCP/IP) and
Routing Information Protocol (RIP). For further information about TCP/IP, refer to “Internet
Configuration Requirements” on page C-3.
•IP Address Sharing by NAT. The VPN firewall allows many networked PCs to share an
Internet account using only a single IP address, which may be statically or dynamically
assigned by your Internet service provider (ISP). This technique, known as NAT, allows the
use of an inexpensive single-user ISP account.
•Automatic Configuration of Attached PCs by DHCP. The VPN firewall dynamically
assigns network configuration information, including IP, gateway, and domain name server
(DNS) addresses, to attached PCs on the LAN using the Dynamic Host Configuration Protocol
(DHCP). This feature greatly simplifies configuration of PCs on your local network.
•DNS Proxy. When DHCP is enabled and no DNS addresses are specified, the firewall
provides its own address as a DNS server to the attached PCs. The firewall obtains actual DNS
addresses from the ISP during connection setup and forwards DNS requests from the LAN.
•PPP over Ethernet (PPPoE). PPPoE is a protocol for connecting remote hosts to the Internet
over a DSL connection by simulating a dial-up connection. This feature eliminates the need to
run a login program such as EnterNet or WinPOET on your PC.
•Quality of Service (QoS) support for traffic prioritization.

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual
1-4 Introduction
1.1 November, 2009
Easy Installation and Management
You can install, configure, and operate the ProSafe VPN Firewallwithin minutes after connecting
it to the network. The following features simplify installation and management tasks:
•Browser-Based Management. Browser-based configuration allows you to easily configure
your firewall from almost any type of personal computer, such as Windows, Macintosh, or
Linux. A user-friendly Setup Wizard is provided and online help documentation is built into
the browser-based Web Management Interface.
•Auto Detection of ISP. The VPN firewall automatically senses the type of Internet
connection, asking you only for the information required for your type of ISP account.
•VPN Wizard. The VPN firewall includes the NETGEAR VPN Wizard to easily configure
IPsec VPN tunnels according to the recommendations of the Virtual Private Network
Consortium (VPNC) to ensure the IPsec VPN tunnels are interoperable with other VPNC-
compliant VPN routers and clients.
•Diagnostic Functions. The firewall incorporates built-in diagnostic functions such as Ping,
Trace Route, DNS lookup, and remote reboot.
•Remote Management. The firewall allows you to login to the Web Management Interface
from a remote location on the Internet. For security, you can limit remote management access
to a specified remote IP address or range of addresses.
•Visual monitoring. The VPN firewall’s front panel LEDs provide an easy way to monitor its
status and activity.
Maintenance and Support
NETGEAR offers the following features to help you maximize your use of the VPN firewall:
• Flash memory for firmware upgrade.
• Free technical support seven days a week, 24 hours a day, according to the terms identified in
the Warranty and Support information card provided with your product.

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual
Introduction 1-5
1.1 November, 2009
Package Contents
The product package should contain the following items:
• ProSafe VPN Firewall.
• One AC power adapter.
• Rubber feet.
• One Category 5e (Cat5e) Ethernet cable (yellow).
•ProSafe Gigabit 8 Port VPN Firewall FVS318G Installation Guide
•Resource CD, including:
– Application Notes and other helpful information.
– ProSafe VPN Client Software – one user license.
•Warranty Information and Technical Support card.
If any of the parts are incorrect, missing, or damaged, contact your NETGEAR dealer. Keep the
carton, including the original packing materials, in case you need to return the firewall for repair.
Front Panel Features
The ProSafe VPN Firewall front panel shown below includes four groups of status indicator light-
emitting diodes (LEDs), including Power and Test, WAN, and LAN lights:
Figure 1-1

ProSafe Gigabit 8 Port VPN Firewall FVS318G Reference Manual
1-6 Introduction
1.1 November, 2009
The function of each LED is described in the following table:
Table 1-1. LED Descriptions
Object Activity Description
Power On (Green)
Off Power is supplied to the VPN firewall. Power is not supplied to the VPN firewall.
Test On (Amber)
Off Test mode: The system is initializing or the initialization has failed. The system has booted successfully.
WAN Port
Active (left
side of port) On (Green) Off) The WAN port is connected. The Internet connection is down The WAN port is either not enabled
or has no link.
Speed (right
side of port) On (Green) On (Amber)
Off
The port is operating at 1,000 Mbps.
The port is operating at 100 Mbps.
The port is operating at 10 Mbps.
LAN Ports
Link and
Activity(left
side of port)
On (Green)
Blinking (Green)
Off
The port has detected a link with a connected Ethernet device.
Data is being transmitted or received by the port.
The port has no link.
Speed (right
side of port) On (Green) On (Amber)
Off
The LAN port is operating at 1,000 Mbps.
The LAN port is operating at 100 Mbps.
The LAN port is operating at 10 Mbps.
DMZ On (Green)
Off LAN port 8 is enabled as a DMZ port. LAN port 8 is not enabled as a DMZ port.