1.0, March 2009

vi

Product and Publication Details

Model Number:

FVX538

Publication Date:

March 2009

Product Family:

VPN Firewall

Product Name:

ProSafe VPN Firewall 200

Home or Business Product:

Business

Language:

English

Publication Part Number:

202-10062-09

Publication Version Number

1.0

vii

v1.0, March 2009

Contents

About This Manual

Conventions, Formats and Scope

...................................................................................

xv

Revision History

...............................................................................................................

xvi

Chapter 1

Introduction

Key Features

..................................................................................................................

1-1

Dual WAN Ports for Increased Reliability or Outbound Load Balancing

..................

1-2

A Powerful, True Firewall with Content Filtering

......................................................

1-2

Security Features

.....................................................................................................

1-3

Autosensing Ethernet Connections with Auto Uplink

...............................................

1-3

Extensive Protocol Support

......................................................................................

1-4

Easy Installation and Management

..........................................................................

1-4

Maintenance and Support

........................................................................................

1-5

Package Contents

..........................................................................................................

1-5

Router Front and Rear Panels

........................................................................................

1-6

Rack Mounting Hardware

.........................................................................................

1-8

The Router’s IP Address, Login Name, and Password

..................................................

1-9

Chapter 2

Connecting the FVX538 to the Internet

Logging into the VPN Firewall

........................................................................................

2-1

Configuring the Internet Connections to Your ISPs

........................................................

2-2

Setting the Router’s MAC Address

..........................................................................

2-4

Manually Configuring Your Internet Connection

.......................................................

2-4

Programming the Traffic Meter (if Desired)

..............................................................

2-6

Configuring the WAN Mode (Required for Dual WAN)

...................................................

2-8

Setting Up Auto-Rollover Mode

................................................................................

2-9

Setting Up Load Balancing

.....................................................................................

2-12

Configuring Dynamic DNS (If Needed)

.........................................................................

2-14

Configuring the Advanced WAN Options (If Needed)

...................................................

2-17

ProSafe VPN Firewall 200 FVX538 Reference Manual

viii

Contents

v1.0, March 2009

Chapter 3

LAN Configuration

Choosing the Firewall DHCP Options

............................................................................

3-1

Configuring the LAN Setup Options

.........................................................................

3-2

Configuring Multi Home LAN IPs

.............................................................................

3-5

Managing Groups and Hosts (LAN Groups)

...................................................................

3-6

Creating the Network Database

...............................................................................

3-7

Setting Up Address Reservation

..............................................................................

3-9

Configuring and Enabling the DMZ Port

.......................................................................

3-10

Static Routes

................................................................................................................

3-12

Configuring Static Routes

.......................................................................................

3-12

Routing Information Protocol (RIP)

........................................................................

3-14

Static Route Example

.............................................................................................

3-16

Chapter 4

Firewall Protection and Content Filtering

About Firewall Protection and Content Filtering

.............................................................

4-1

Using Rules to Block or Allow Specific Kinds of Traffic

..................................................

4-2

Services-Based Rules

..............................................................................................

4-2

Outbound Rules (Service Blocking)

...................................................................

4-3

Inbound Rules (Port Forwarding)

......................................................................

4-6

Order of Precedence for Rules

................................................................................

4-9

Setting LAN WAN Rules

..........................................................................................

4-9

LAN WAN Outbound Services Rules

...............................................................

4-11

LAN WAN Inbound Services Rules

.................................................................

4-12

Setting DMZ WAN Rules

........................................................................................

4-12

Setting LAN DMZ Rules

.........................................................................................

4-14

LAN DMZ Outbound Services Rules

...............................................................

4-15

LAN DMZ Inbound Services Rules

..................................................................

4-16

Attack Checks

........................................................................................................

4-16

Session Limit

..........................................................................................................

4-18

Inbound Rules Examples

.......................................................................................

4-20

LAN WAN Inbound Rule: Hosting A Local Public Web Server

........................

4-20

LAN WAN Inbound Rule: Allowing Videoconference from Restricted Addresses 4-20

LAN WAN or DMZ WAN Inbound Rule: Setting Up One-to-One NAT Mapping 4-21

LAN WAN or DMZ WAN Inbound Rule: Specifying an Exposed Host

.............

4-23

ProSafe VPN Firewall 200 FVX538 Reference Manual

Contents

ix

v1.0, March 2009

Outbound Rules Example

......................................................................................

4-24

LAN WAN Outbound Rule: Blocking Instant Messenger

.................................

4-25

Adding Customized Services

.................................................................................

4-25

Setting Quality of Service (QoS) Priorities

.............................................................

4-27

Setting a Schedule to Block or Allow Specific Traffic

....................................................

4-28

Setting Block Sites (Content Filtering)

..........................................................................

4-29

Enabling Source MAC Filtering

....................................................................................

4-31

IP/MAC Binding

............................................................................................................

4-33

Port Triggering

..............................................................................................................

4-35

Bandwidth Limiting

.......................................................................................................

4-37

E-Mail Notifications of Event Logs and Alerts

...............................................................

4-39

Administrator Tips

.........................................................................................................

4-43

Chapter 5

Virtual Private Networking

Considerations for Dual WAN Port Systems

..................................................................

5-1

Using the VPN Wizard for Client and Gateway Configurations

......................................

5-3

Creating Gateway to Gateway VPN Tunnels with the Wizard

.................................

5-3

Creating a Client to Gateway VPN Tunnel

...............................................................

5-6

Use the VPN Wizard Configure the Gateway for a Client Tunnel

......................

5-7

Use the NETGEAR VPN Client Security Policy Editor to Create a Secure Connection

5-8

Testing the Connections and Viewing Status Information

.............................................

5-12

NETGEAR VPN Client Status and Log Information

...............................................

5-12

FVX538 VPN Connection Status and Logs

............................................................

5-14

VPN Tunnel Policies

.....................................................................................................

5-15

IKE Policy

...............................................................................................................

5-15

Managing IKE Policies

.....................................................................................

5-15

IKE Policy Table

...............................................................................................

5-16

VPN Policy

.............................................................................................................

5-17

Managing VPN Policies

...................................................................................

5-17

VPN Policy Table

.............................................................................................

5-18

Certificate Authorities

...................................................................................................

5-19

Generating a Self Certificate Request

....................................................................

5-20

Uploading a Trusted Certificate

..............................................................................

5-22

Managing your Certificate Revocation List (CRL)

..................................................

5-22

ProSafe VPN Firewall 200 FVX538 Reference Manual

x

Contents

v1.0, March 2009

Extended Authentication (XAUTH) Configuration

.........................................................

5-23

Configuring XAUTH for VPN Clients

......................................................................

5-24

User Database Configuration

.................................................................................

5-25

RADIUS Client Configuration

.................................................................................

5-27

Assigning IP Addresses to Remote Users (ModeConfig)

.............................................

5-29

Mode Config Operation

..........................................................................................

5-29

Configuring the VPN Firewall

.................................................................................

5-30

Configuring the ProSafe VPN Client for ModeConfig

.............................................

5-33

Chapter 6

Router and Network Management

Performance Management

.............................................................................................

6-1

Bandwidth Capacity

.................................................................................................

6-1

VPN Firewall Features That Reduce Traffic

.............................................................

6-2

Service Blocking

................................................................................................

6-2

Block Sites

.........................................................................................................

6-4

Source MAC Filtering

........................................................................................

6-4

VPN Firewall Features That Increase Traffic

...........................................................

6-5

Port Forwarding

.................................................................................................

6-5

Port Triggering

...................................................................................................

6-6

DMZ Port

...........................................................................................................

6-7

VPN Tunnels

......................................................................................................

6-7

Using QoS to Shift the Traffic Mix

............................................................................

6-7

Tools for Traffic Management

...................................................................................

6-8

Administration

.................................................................................................................

6-8

Changing Passwords and Settings

..........................................................................

6-8

RADIUS Server External Authentication

................................................................

6-10

Enabling Remote Management Access

.................................................................

6-11

Using a SNMP Manager

........................................................................................

6-14

Settings Backup and Firmware Upgrade

...............................................................

6-15

Backup and Restore Settings

..........................................................................

6-16

Router Upgrade

...............................................................................................

6-17

Setting the Time Zone

............................................................................................

6-19

Monitoring the Router

...................................................................................................

6-20

Enabling the Traffic Meter

......................................................................................

6-20

Setting Login Failures and Attacks Notification

......................................................

6-22