NETGEAR FVS328 - ProSafe VPN Firewall Manual de usuario

May 2004, 202-10031-01

202-10031-01

May 2004

NETGEAR, Inc.

4500 Great America Parkway

Santa Clara, CA 95054 USA

Phone 1-888-NETGEAR

Model FVS328 ProSafe

VPN Firewall with Dial

Back-up Reference

Manual

May 2004, 202-10031-01

Trademarks

NETGEAR and Auto Uplink are trademarks or registered trademarks of NETGEAR, Inc.

Microsoft, Windows, and Windows NT are registered trademarks of Microsoft Corporation.

Other brand and product names are registered trademarks or trademarks of their respective holders. Portions of this

document are copyright Intoto, Inc.

Statement of Conditions

In the interest of improving internal design, operational function, and/or reliability, NETGEAR reserves the right to

make changes to the products described in this document without notice.

NETGEAR does not assume any liability that may occur due to the use or application of the product(s) or circuit

layout(s) described herein.

EN 55 022 Declaration of Conformance

This is to certify that the FVS328 ProSafe VPN Firewall with Dial Back-up is shielded against the generation of radio

interference in accordance with the application of Council Directive 89/336/EEC, Article 4a. Conformity is declared by

the application of EN 55 022 Class B (CISPR 22).

Certificate of the Manufacturer/Importer

It is hereby certified that the FVS328 ProSafe VPN Firewall with Dial Back-up has been suppressed in accordance with

the conditions set out in the BMPT-AmtsblVfg 243/1991 and Vfg 46/1992. The operation of some equipment (for

example, test transmitters) in accordance with the regulations may, however, be subject to certain restrictions. Please

refer to the notes in the operating instructions.

The Federal Office for Telecommunications Approvals has been notified of the placing of this equipment on the market

and has been granted the right to test the series for compliance with the regulations.

May 2004, 202-10031-01

iii

Bestätigung des Herstellers/Importeurs

Es wird hiermit bestätigt, daß dasFVS328 ProSafe VPN Firewall with Dial Back-up gemäß der im BMPT-AmtsblVfg

243/1991 und Vfg 46/1992 aufgeführten Bestimmungen entstört ist. Das vorschriftsmäßige Betreiben einiger Geräte

(z.B. Testsender) kann jedoch gewissen Beschränkungen unterliegen. Lesen Sie dazu bitte die Anmerkungen in der

Betriebsanleitung.

Das Bundesamt für Zulassungen in der Telekommunikation wurde davon unterrichtet, daß dieses Gerät auf den Markt

gebracht wurde und es ist berechtigt, die Serie auf die Erfüllung der Vorschriften hin zu überprüfen.

Voluntary Control Council for Interference (VCCI) Statement

This equipment is in the second category (information equipment to be used in a residential area or an adjacent area

thereto), and conforms to the standards set by the Voluntary Control Council for Interference by Data Processing

Equipment and Electronic Office Machines, aimed at preventing radio interference in such residential areas.

When used near a radio or TV receiver, it may become the cause of radio interference.

Read instructions for correct handling.

Technical Support

Refer to the Support Information Card that shipped with your FVS328 ProSafe VPN Firewall with Dial Back-up.

World Wide Web

NETGEAR maintains a World Wide Web home page that you can access at the universal resource locator (URL)

http://www.netgear.com. A direct connection to the Internet and a Web browser such as Internet Explorer

or Netscape are required.

May 2004, 202-10031-01

Contents i

May 2004, 202-10031-01

Contents

Chapter 1

About This Manual

Audience .........................................................................................................................1-1

Scope .............................................................................................................................1-1

Typographical Conventions ............................................................................................1-2

Special Message Formats ..............................................................................................1-2

How to Use this Manual ..................................................................................................1-3

How to Print this Manual .................................................................................................1-4

Chapter 2

Introduction

About the FVS328 ..........................................................................................................2-1

Key Features ..................................................................................................................2-1

Full Routing on Both the Broadband and Serial Ports .............................................2-1

Virtual Private Networking ........................................................................................2-2

A Powerful, True Firewall .........................................................................................2-2

Content Filtering .......................................................................................................2-3

Configurable Auto Uplink™ Ethernet Connection ....................................................2-3

Protocol Support ......................................................................................................2-3

Easy Installation and Management ..........................................................................2-4

What’s in the Box? ..........................................................................................................2-5

The Firewall’s Front Panel .......................................................................................2-5

The Firewall’s Rear Panel ........................................................................................2-7

Chapter 3

Connecting the FVS328 to the Internet

What You Will Need Before You Begin ...........................................................................3-1

LAN Hardware Requirements ..................................................................................3-1

LAN Configuration Requirements ............................................................................3-1

Internet Configuration Requirements .......................................................................3-2

Where Do I Get the Internet Configuration Parameters? ..................................3-2

May 2004, 202-10031-01

ii Contents

Worksheet for Recording Your Internet Connection Information ..............................3-3

Connecting the FVS328 to Your LAN .............................................................................3-4

How to Connect the FVS328 to Your LAN ...............................................................3-4

Configuring a Wizard-Detected Login Account ........................................................3-8

Configuring a Wizard-Detected Dynamic IP Account ...............................................3-9

Configuring a Wizard-Detected Fixed IP (Static) Account ......................................3-10

How to Configure the Serial Port for an Internet Connection .......................................3-10

Testing Your Internet Connection ..................................................................................3-13

Manually Configuring Your Internet Connection ...........................................................3-14

How to Manually Configure the Primary Internet Connection ................................3-15

Chapter 4

Serial Port Configuration

Configuring a Serial Port Modem ...................................................................................4-2

Basic Requirements for Serial Port Modem Configuration .......................................4-2

How to Configure a Serial Port Modem ....................................................................4-2

Configuring Auto-Rollover ..............................................................................................4-3

Basic Requirements for Auto-Rollover .....................................................................4-3

How to Configure Auto-Rollover ...............................................................................4-3

Configuring Dial-in on the Serial Port .............................................................................4-4

Basic Requirements for Dial-in .................................................................................4-5

How to Configure Dial-in ..........................................................................................4-5

Configuring LAN-to-LAN Settings ...................................................................................4-6

Basic Requirements for LAN-to-LAN Connections ..................................................4-6

How to Configure LAN-to-LAN Connections ............................................................4-6

Chapter 5

WAN and LAN Configuration

Configuring LAN IP Settings ...........................................................................................5-1

Using the Router as a DHCP Server ........................................................................5-2

How to Configure LAN TCP/IP Setup Settings ........................................................5-3

How to Configure Reserved IP Addresses ...............................................................5-4

Configuring WAN Settings ..............................................................................................5-4

Connecting Automatically, as Required ...................................................................5-5

Setting Up a Default DMZ Server .............................................................................5-5

How to Assign a Default DMZ Server ......................................................................5-5

Responding to Ping on Internet WAN Port ...............................................................5-6

Contents iii

May 2004, 202-10031-01

How to Set the MTU Size .........................................................................................5-6

Configuring Dynamic DNS ..............................................................................................5-6

How to Configure Dynamic DNS ..............................................................................5-7

Using Static Routes ........................................................................................................5-7

Static Route Example ...............................................................................................5-7

How to Configure Static Routes ...............................................................................5-8

Chapter 6

Protecting Your Network

Protecting Access to Your FVS328 Firewall ...................................................................6-1

How to Change the Built-In Password .....................................................................6-1

How to Change the Administrator Login Timeout ....................................................6-2

Configuring Basic Firewall Services ...............................................................................6-2

Using the Block Sites Menu to Screen Content ..............................................................6-3

Services and Rules Regulate Inbound and Outbound Traffic .........................................6-4

Defining a Service ....................................................................................................6-5

Using Inbound/Outbound Rules to Block or Allow Services .....................................6-6

Examples of Using Services and Rules to Regulate Traffic ...........................................6-8

Inbound Rules (Port Forwarding) .............................................................................6-8

Example: Port Forwarding to a Local Public Web Server ..................................6-9

Example: Port Forwarding for Videoconferencing .............................................6-9

Example: Port Forwarding for VPN Tunnels when NAT is Off .........................6-10

Outbound Rules (Service Blocking or Port Filtering) ..............................................6-11

Outbound Rule Example: Blocking Instant Messaging ....................................6-12

Other Rules Considerations .........................................................................................6-12

Order of Precedence for Rules ..............................................................................6-12

Rules Menu Options ...............................................................................................6-13

Setting Times and Scheduling Firewall Services ..........................................................6-13

How to Set Your Time Zone ...................................................................................6-14

How to Schedule Firewall Services ........................................................................6-15

Chapter 7

Virtual Private Networking

Overview of FVS328 Policy-Based VPN Configuration ..................................................7-1

Using Policies to Manage VPN Traffic .....................................................................7-1

Using Automatic Key Management ..........................................................................7-2

IKE Policies’ Automatic Key and Authentication Management ................................7-3

May 2004, 202-10031-01

iv Contents

VPN Policy Configuration for Auto Key Negotiation .................................................7-6

VPN Policy Configuration for Manual Key Exchange ...............................................7-9

Using Digital Certificates for IKE Auto-Policy Authentication .......................................7-14

Certificate Revocation List (CRL) ...........................................................................7-14

How to Use the VPN Wizard to Configure a VPN Tunnel .............................................7-15

Walk-Through of Configuration Scenarios ....................................................................7-17

VPNC Scenario 1: Gateway-to-Gateway with Preshared Secrets .........................7-18

FVS328 Scenario 1: How to Configure the IKE and VPN Policies .........................7-20

How to Check VPN Connections ...........................................................................7-24

FVS328 Scenario 2: Authenticating with RSA Certificates ....................................7-25

Chapter 8

Managing Your Network

Network Management ....................................................................................................8-1

How to Configure Remote Management ..................................................................8-1

Viewing Router Status and Usage Statistics ............................................................8-3

Viewing Attached Devices ........................................................................................8-6

Viewing, Selecting, and Saving Logged Information ................................................8-7

Changing the Include in Log Settings ................................................................8-9

Enabling the Syslog Feature .............................................................................8-9

Enabling Security Event E-mail Notification .................................................................8-10

Backing Up, Restoring, or Erasing Your Settings .........................................................8-11

How to Back Up the FVS328 Configuration to a File .............................................8-11

How to Restore a Configuration from a File ...........................................................8-12

How to Erase the Configuration .............................................................................8-13

Running Diagnostic Utilities and Rebooting the Router ................................................8-13

Upgrading the Router’s Firmware .................................................................................8-14

How to Upgrade the Router ...................................................................................8-15

Chapter 9

Troubleshooting

Basic Functions ..............................................................................................................9-1

Power LED Not On ...................................................................................................9-2

Test LED Never Turns On or Test LED Stays On .....................................................9-2

Local or Internet Port Link LEDs Not On ..................................................................9-3

Troubleshooting the Web Configuration Interface ..........................................................9-3

Troubleshooting the ISP Connection ..............................................................................9-4

Contents v

May 2004, 202-10031-01

Troubleshooting a TCP/IP Network Using a Ping Utility .................................................9-5

How to Test the LAN Path to Your Firewall ..............................................................9-6

How to Test the Path from Your PC to a Remote Device .........................................9-6

Restoring the Default Configuration and Password ........................................................9-7

How to Use the Default Reset Button ......................................................................9-7

Problems with Date and Time .........................................................................................9-8

Appendix A

Technical Specifications

Appendix B

Firewall Log Formats

Action List ...................................................................................................................... B-1

Field List ........................................................................................................................ B-1

Outbound Log ................................................................................................................ B-1

Inbound Log ................................................................................................................... B-2

Other IP Traffic .............................................................................................................. B-2

Router Operation ........................................................................................................... B-3

Other Connections and Traffic to this Router ................................................................ B-4

DoS Attack/Scan ........................................................................................................... B-4

Access Block Site .......................................................................................................... B-6

All Web Sites and News Groups Visited ........................................................................ B-6

System Admin Sessions ................................................................................................ B-6

Policy Administration LOG ............................................................................................. B-7

Appendix C

Networks, Routing, and Firewall Basics

Related Publications ......................................................................................................C-1

Basic Router Concepts ..................................................................................................C-1

What is a Router? ...................................................................................................C-1

Routing Information Protocol ...................................................................................C-2

IP Addresses and the Internet .................................................................................C-2

Netmask ..................................................................................................................C-4

Subnet Addressing ..................................................................................................C-4

Private IP Addresses ...............................................................................................C-7

Single IP Address Operation Using NAT .................................................................C-7

MAC Addresses and Address Resolution Protocol .................................................C-9

Related Documents .................................................................................................C-9

May 2004, 202-10031-01

vi Contents

Domain Name Server ..............................................................................................C-9

IP Configuration by DHCP ....................................................................................C-10

Internet Security and Firewalls ....................................................................................C-10

What is a Firewall? ................................................................................................ C-11

Stateful Packet Inspection ..................................................................................... C-11

Denial of Service Attack ........................................................................................ C-11

Ethernet Cabling ..........................................................................................................C-12

Uplink Switches and Crossover Cables ................................................................C-12

Cable Quality .........................................................................................................C-13

Appendix D

Preparing Your Network

Preparing Your Computers for TCP/IP Networking .......................................................D-1

Configuring Windows 95, 98, and Me for TCP/IP Networking .......................................D-2

Install or Verify Windows Networking Components .................................................D-2

Enabling DHCP to Automatically Configure TCP/IP Settings .................................D-4

Selecting Windows’ Internet Access Method ....................................................D-4

Verifying TCP/IP Properties ....................................................................................D-5

Configuring Windows NT, 2000 or XP for IP Networking ...............................................D-5

Installing or Verifying Windows Networking Components .......................................D-5

Verifying TCP/IP Properties ....................................................................................D-6

Configuring the Macintosh for TCP/IP Networking ........................................................D-6

MacOS 8.6 or 9.x ....................................................................................................D-6

MacOS X .................................................................................................................D-7

Verifying TCP/IP Properties for Macintosh Computers ...........................................D-8

Verifying the Readiness of Your Internet Account .........................................................D-9

Are Login Protocols Used? .....................................................................................D-9

What Is Your Configuration Information? ................................................................D-9

Obtaining ISP Configuration Information for Windows Computers .......................D-10

Obtaining ISP Configuration Information for Macintosh Computers ..................... D-11

Restarting the Network ................................................................................................D-12

Appendix E

Virtual Private Networking

What is a VPN? ............................................................................................................. E-1

What is IPSec and How Does It Work? ......................................................................... E-2

IPSec Security Features ......................................................................................... E-2

Otros manuales para FVS328 - ProSafe VPN Firewall

Tabla de contenidos

Otros manuales de Cortafuegos de NETGEAR

NETGEAR

NETGEAR FVS328 - ProSafe VPN Firewall Manual de usuario

NETGEAR

NETGEAR FVX538v2 - ProSafe VPN Firewall Dual WAN Instrucciones de instalación y funcionamiento

NETGEAR

NETGEAR FVS336G - ProSafe Dual WAN Gigabit Firewall Manual de usuario

NETGEAR

NETGEAR UTM5 - ProSecure Unified Threat Management... Manual de usuario

NETGEAR

NETGEAR FVG318 - ProSafe 802.11g Wireless VPN Firewall 8... Manual de usuario

NETGEAR

NETGEAR FVS338 - ProSafe VPN Firewall 50 Router Manual de usuario

NETGEAR

NETGEAR FVG318 - ProSafe 802.11g Wireless VPN Firewall 8... Manual de usuario

NETGEAR

NETGEAR FVS318G - ProSafe Gigabit VPN Firewall Data Sheet... Manual de usuario

NETGEAR

NETGEAR ProSafe FVX538 Manual de usuario

NETGEAR

NETGEAR FVS336Gv1 - ProSafe Dual WAN Gigabit... Manual de usuario

NETGEAR

NETGEAR FVS318G-100NAS Manual de usuario

NETGEAR

NETGEAR ProSafe FVS318N Manual de usuario

NETGEAR

NETGEAR ProSafe FVS318N Manual de usuario

NETGEAR

NETGEAR ProSAFE FVS336G v3 Manual de usuario

NETGEAR

NETGEAR ProSafe FVS318v3 Manual de usuario

NETGEAR

NETGEAR FVS318G - ProSafe Gigabit VPN Firewall Data Sheet... Manual de usuario

NETGEAR

NETGEAR ProSafe FWAG114 Manual de usuario

NETGEAR

NETGEAR FWG114P - ProSafe 802.11g Wireless Firewall Manual de usuario

NETGEAR

NETGEAR ProSafe VPN Firewall 200 FVX538 Manual de usuario

NETGEAR

NETGEAR FVS336Gv2 - ProSafe Dual WAN Gigabit... Manual de usuario

NETGEAR

NETGEAR FVS124G - ProSafe VPN Firewall 25 Manual de usuario

NETGEAR

NETGEAR FWG114P - ProSafe 802.11g Wireless Firewall Manual de usuario

NETGEAR

NETGEAR FVG318 - ProSafe 802.11g Wireless VPN Firewall 8... Manual de usuario

NETGEAR

NETGEAR FVS336G - ProSafe Dual WAN Gigabit Firewall Manual de usuario

Manuales populares de Cortafuegos de otras marcas

Cisco

Cisco S190 Manual de usuario

Fortinet

Fortinet FortiGate Voice Series Manual de usuario

ADTRAN

ADTRAN NetVanta 2300 Manual de usuario

SecureLogix

SecureLogix ETM System Manual de usuario

Lanner

Lanner FW-8877 Manual de usuario

Huawei

Huawei USG6000 Series Manual de instalación y operación

H3C

H3C SecPath F5000-AI-15 Manual de usuario

Nexcom

Nexcom DNA 1150 Manual de usuario

Fortinet

Fortinet FortiGate-60 series Manual de usuario

Cisco

Cisco 3110 Manual

Draytek

Draytek Vigor2860 Series Manual de usuario

Lanner electronics

Lanner electronics FW-7650 Series Manual de usuario

Swisscom

Swisscom Internet Backup Manual de usuario

SonicWALL

SonicWALL NSa 5700 Manual de usuario

DPtech

DPtech FW1000 SERIES Manual de usuario

FEITIAN

FEITIAN MultiPass FIDO Manual de usuario

EBLOCKER

EBLOCKER PRO Manual de usuario

GTA

GTA GB-200 Manual de usuario