NETGEAR FVL328 - Cable/DSL ProSafe VPN Firewall Router Reference Manual Download Page 217 | Manualshive

Page: 217 / 240

background image

Reference Manual for the NETGEAR ProSafe VPN Client

NETGEAR VPN Client to NETGEAR FVL328 or FWAG114 VPN Router

H-17

202-10015-01

Viewing the FVL328 VPN Status and Log Information

Information on the status of the VPN client connection can be viewed by opening the FVL328
VPN Status screen. To view this screen, click the VPN Status link on the FVL328 main menu.

The FVL328 VPN Status screen for a successful connection is shown below:

Figure H-16: FVL328 VPN Status screen

«
...
215
216
217
218
219
...
»

Summary of Contents for FVL328 - Cable/DSL ProSafe VPN Firewall Router

Page 1: ...M 10144 01 M 10144 01 December 2003 NETGEAR Inc 4500 Great America Parkway Santa Clara CA 95054 USA Phone 1 888 NETGEAR Model FVL328 ProSafe High Speed VPN Firewall Reference Manual...

Page 2: ...EN 55 022 Declaration of Conformance This is to certify that the FVL328 Prosafe High Speed VPN Firewall is shielded against the generation of radio interference in accordance with the application of C...

Page 3: ...ce VCCI Statement This equipment is in the second category information equipment to be used in a residential area or an adjacent area thereto and conforms to the standards set by the Voluntary Control...

Page 4: ...M 10144 01 iv...

Page 5: ...res 2 1 Virtual Private Networking 2 2 A Powerful True Firewall 2 2 ICSA Small Medium Business Category 2 3 Content Filtering 2 3 Configurable Auto Uplink Ethernet Connection 2 3 Protocol Support 2 3...

Page 6: ...ttings 4 1 Using the Router as a DHCP Server 4 2 How to Configure LAN TCP IP Setup Settings 4 3 How to Configure Reserved IP Addresses 4 4 Configuring WAN Settings 4 4 Connecting Automatically as Requ...

Page 7: ...Private Networking Overview of FVL328 Policy Based VPN Configuration 6 1 Using Policies to Manage VPN Traffic 6 1 Using Automatic Key Management 6 2 IKE Policies Automatic Key and Authentication Manag...

Page 8: ...ic Functions 8 1 Power LED Not On 8 2 Test LED Never Turns On or Test LED Stays On 8 2 Local or Internet Port Link LEDs Not On 8 3 Troubleshooting the Web Configuration Interface 8 3 Troubleshooting t...

Page 9: ...rking C 2 Install or Verify Windows Networking Components C 2 Enabling DHCP to Automatically Configure TCP IP Settings C 4 Selecting Windows Internet Access Method C 4 Verifying TCP IP Properties C 5...

Page 10: ...ivate Networking What is a VPN E 1 What Is IPSec and How Does It Work E 2 IPSec Security Features E 2 IPSec Components E 2 Encapsulating Security Payload ESP E 3 Authentication Header AH E 4 IKE Secur...

Page 11: ...DUT G 3 Create an IP Filter Called To Win2K G 7 Configure the General Properties G 12 Configure the FVL328 IKE policy G 14 Configure the FVL328 VPN policy G 15 FVL328 to SSH Sentinel 1 3 Remote VPN G...

Page 12: ...8 or FVM318 with FQDN to FVL328 Configuration Template I 1 Using DDNS and Fully Qualified Domain Names FQDN I 2 Step By Step Configuration of FVS318 or FVM318 Gateway A I 3 Step By Step Configuration...

Page 13: ...ation is provided in the Appendices and on the NETGEAR Web site Scope This manual is written for the FVL328 Firewall according to these specifications Table 1 1 Manual Specifications Product Version F...

Page 14: ...This guide uses the following formats to highlight special messages Table 1 2 Typographical conventions italics Emphasis bold times roman User input Enter Named keys in text are shown enclosed in squ...

Page 15: ...ross the top to navigate print pages and more The Show in Contents button locates the current topic in the Contents tab Previous Next buttons display the previous or next topic The PDF button links to...

Page 16: ...op right of any page Click the PDF of This Chapter link at the top right of any page in the chapter you want to print A new browser window opens showing the PDF version of the chapter you were viewing...

Page 17: ...work from attacks and intrusions and enables secure communications using Virtual Private Networks VPN Unlike simple Internet sharing routers that rely on Network Address Translation NAT for security t...

Page 18: ...amic DNS feature is enabled with one of the supported service providers VPNC Certified A Powerful True Firewall Unlike simple Internet sharing NAT routers the FVL328 is a true firewall using stateful...

Page 19: ...e firewall to log and report attempts to access objectionable Internet sites Configurable Auto Uplink Ethernet Connection With its internal 8 port 10 100 switch the FVL328 can connect to either a 10 M...

Page 20: ...actual DNS addresses from the ISP during connection setup and forwards DNS requests from the LAN PPP over Ethernet PPPoE PPPoE is a protocol for connecting remote hosts to the Internet over a DSL con...

Page 21: ...est Internet connectivity and reboot the firewall You can use these diagnostic functions directly from the FVL328 when your are connected on the LAN or when you are connected over the Internet via the...

Page 22: ...green when lit except for the TEST LED which is amber Note Product updates are available on the NETGEAR Inc Web site at http www netgear com support main asp Documentation updates are available on the...

Page 23: ...following elements Factory Default Reset push button Eight Local Ethernet RJ 45 ports for connecting the firewall to local computers Internet WAN Ethernet RJ 45 port for connecting the firewall to a c...

Page 24: ...Model FVL328 ProSafe High Speed VPN Firewall Reference Manual 2 8 Introduction M 10144 01...

Page 25: ...equirements The FVL328 Firewall connects to your LAN via twisted pair Ethernet cables To use the FVL328 Firewall on your network each computer must have an installed Ethernet Network Interface Card NI...

Page 26: ...rmation you can ask your ISP to provide it or you can try one of the options below If you have a computer already connected using the active Internet access account you can gather the configuration in...

Page 27: ...the following information For example 169 254 141 148 could be a valid IP address Fixed or Static Internet IP Address ______ ______ ______ ______ Subnet Mask ______ ______ ______ ______ Gateway IP Add...

Page 28: ...s an animated Installation Assistant to help you through this procedure How to Connect the FVL328 to Your LAN There are three steps to connecting your firewall Connect the firewall to your network Log...

Page 29: ...technology Each Ethernet port will automatically sense whether the cable plugged into the port should have a normal connection e g connecting to a PC or an uplink connection e g connecting to a switch...

Page 30: ...log in to your Internet connection do not run that software Now that the cable or DSL modem firewall and the computer are turned on verify the following When power on the firewall was first turned on...

Page 31: ...user name and password When prompted enter admin for the firewall User Name and password for the firewall Password both in lower case letters This default password should be changed later as describe...

Page 32: ...Connection on page 3 14 Unless your ISP automatically assigns your configuration automatically via DHCP you will need the configuration parameters from your ISP as you recorded them previously in Wor...

Page 33: ...learn the domain automatically from the ISP If this is not successful you may need to enter it manually 2 Enter the PPPoE login user name and password provided by your ISP These fields are case sensit...

Page 34: ...available enter it also If you enter an address here after you finish configuring the firewall reboot your computers so that the settings take effect 5 Enter the Router s MAC Address Each computer or...

Page 35: ...m the ISP If this is not successful you may need to enter it manually 2 If you know that your ISP does not automatically transmit DNS addresses to the firewall during login select Use these DNS server...

Page 36: ...s feature allows your firewall to masquerade as that computer by using its MAC address 4 Click Apply to save your settings 5 Click the Test button to test your Internet connection If the NETGEAR Web s...

Page 37: ...nternet connection configuration your can test your Internet connection Log in to the firewall then from the Setup Basic Settings link click the Test button If the NETGEAR Web site does not appear wit...

Page 38: ...nually Configuring Your Internet Connection You can manually configure your firewall using the menu below or you can allow the Setup Wizard to determine your configuration as described in the previous...

Page 39: ...e If you want to change the login timeout enter a new value in minutes This determines how long the firewall keeps the Internet connection active after there is no Internet activity from the LAN Enter...

Page 40: ...an address you must obtain it from the ISP and enter it manually here If you enter an address here you should reboot your computers after configuring the firewall Router s MAC Address This section de...

Page 41: ...ge for use in private networks and should be suitable in most applications If your network has a requirement to use a different IP addressing scheme you can make those changes The LAN TCP IP Setup par...

Page 42: ...assigned to the attached PCs from a pool of addresses specified in this menu Each pool address is tested before it is assigned to avoid duplicate addresses on the LAN For most applications the default...

Page 43: ...y DNS address in the Basic Settings menu otherwise the firewall s LAN IP address Secondary DNS Server if you entered a Secondary DNS address in the Basic Settings menu How to Configure LAN TCP IP Setu...

Page 44: ...PC or server Note If the PC is already present on your network you can copy its MAC address from the Attached Devices menu and paste it here 4 Click Apply to enter the reserved address into the table...

Page 45: ...with them but there are other applications that may not function well In some cases one local PC can run the application properly if that PC s IP address is entered as the default DMZ server Incoming...

Page 46: ...1 Under MTU Size select Custom 2 Enter a new size between 64 and 1500 3 Click Apply to save the new configuration Configuring Dynamic DNS If your network has a permanently assigned IP address you can...

Page 47: ...tes provide additional routing information to your firewall Under normal circumstances the firewall has adequate routing information after it has been configured for Internet access and you do not nee...

Page 48: ...In this example The Destination IP Address and IP Subnet Mask fields specify that this static route applies to all 134 177 x x addresses The Gateway IP Address fields specifies that all traffic for th...

Page 49: ...limit access to the LAN only The static route will not be reported in RIP e Type the Destination IP Address of the final destination f Type the IP Subnet Mask for this destination If the destination i...

Page 50: ...Model FVL328 ProSafe High Speed VPN Firewall v2 Reference Manual 4 10 WAN and LAN Configuration M 10144 01...

Page 51: ...user name and password are not the same as any user name or password your may use to log in to your Internet connection NETGEAR recommends that you change this password to a more secure password The i...

Page 52: ...backup so that the saved settings file includes the new password How to Change the Administrator Login Timeout For security the administrator s login to the firewall configuration will time out after...

Page 53: ...cking to limit access from your LAN to Internet locations or services that you specify as off limits Denial of Service DoS protection Automatically detects and thwarts DoS attacks such as Ping of Deat...

Page 54: ...e keyword com is specified only Web sites with other domain suffixes such as edu or gov can be viewed If the keyword is entered all Internet browsing access will be blocked Up to 32 entries are suppor...

Page 55: ...cess to A firewall has two default rules one for inbound traffic and one for outbound The default rules of the FVL328 are Inbound Block all access from outside except responses to requests from the LA...

Page 56: ...on on the left side of the table and click Move At the script prompt enter the number of the desired new position and click OK Rules Menu Options Enable VPN Passthrough IPSec PPTP L2TP if LAN users ne...

Page 57: ...ule you can make a local server for example a Web server or game server visible and available to the Internet The rule tells the firewall to direct inbound traffic for a particular service to one loca...

Page 58: ...the Schedule menu Send to LAN Server enter the IP address of the PC or Server on your LAN which will receive the inbound traffic covered by this rule WAN Users these settings determine which packets...

Page 59: ...igure 5 5 Rule example Videoconferencing from Restricted Addresses Considerations for Inbound Rules If your external IP address is assigned dynamically by your ISP the IP address may change periodical...

Page 60: ...of the Internet site being contacted destination address Time of day Type of service being requested service port number Following is an application example of outbound rules Outbound Rule Example Bl...

Page 61: ...dress Select the desired option Any All IP addresses are covered by this rule Address range If this option is selected you must enter the Start and Finish fields Single address Enter the required addr...

Page 62: ...e rules may be important in determining the disposition of a packet The Move button allows you to relocate a defined rule to a new position in the table Regulating Access to Network Services Services...

Page 63: ...mbers you are not limited to these choices Use the procedure below to create your own service definitions How to Define Services 1 Log in to the firewall at its default LAN address of http 192 168 0 1...

Page 64: ...from one of several Network Time Servers on the Internet The FVL328 includes a battery backed real time clock so time will persist if power is removed In order to localize the time for your log entrie...

Page 65: ...Savings Time box if your time zone is currently in daylight savings time Note If your region uses Daylight Savings Time you must manually check Adjust for Daylight Savings Time on the first day of Day...

Page 66: ...all at its default LAN address of http 192 168 0 1 with its default User Name of admin default password of password or using whatever password and LAN address you have chosen for the firewall 2 Click...

Page 67: ...state of the art firewall and security technology to facilitate controlled and actively monitored VPN connectivity Since the FVL328 strictly conforms to Internet Engineering Task Force IETF standards...

Page 68: ...bound VPN parameters on other end and vice versa When the network traffic enters into the FVL328 from the LAN network interface if there is no VPN policy found for a type of network traffic then that...

Page 69: ...10144 01 IKE Policies Automatic Key and Authentication Management Click the IKE Policies link from the VPN section of the main menu and then click the Add button of the IKE Policies screen to display...

Page 70: ...ient connections where the IP address of the remote client is unknown If Remote Access is selected the Exchange Mode MUST be Aggressive and the Identities below both Local and Remote MUST be Name On t...

Page 71: ...more secure and is the default Authentication Algorithm If you enable Authentication Headers AH this menu lets you select from these authentication algorithms MD5 the default SHA 1 more secure Authent...

Page 72: ...tworking M 10144 01 VPN Policy Configuration for Auto Key Negotiation An already defined IKE policy is required for VPN Auto Policy configuration From the VPN Policies section of the main menu you can...

Page 73: ...must have this FVL328 s Local Identity Data entered as its Remote VPN Endpoint By its IP Address By its Fully Qualified Domain Name FQDN your domain name SA Life Time The duration of the Security Asso...

Page 74: ...venting for example remote management or response to ping Single IP Address Range of IP Addresses Subnet Address Authenticating Header AH Configuration AH specifies the authentication protocol for the...

Page 75: ...ink from the VPN section of the main menu to display the menu shown below Authentication Algorithm If you enable AH then use this menu to select which authentication algorithm will be employed The cho...

Page 76: ...Model FVL328 ProSafe High Speed VPN Firewall Reference Manual 6 10 Virtual Private Networking M 10144 01 Figure 6 4 VPN Manual Policy Menu...

Page 77: ...lished If network traffic meets all criteria then a VPN tunnel will be created Local IP The drop down menu allows you to configure the source IP address of the outbound network traffic for which this...

Page 78: ...re secure Enter the keys in the fields provided For MD5 the keys should be 16 characters For SHA 1 the keys should be 20 characters Key In Enter the keys For MD5 the keys should be 16 characters For S...

Page 79: ...the remote VPN endpoint has the same value in its Encryption Algorithm Key In field Enable Authentication Use this check box to enable or disable ESP authentication for this VPN policy Authentication...

Page 80: ...the middle security threats A self certificate has your public key and the name of your CA and relies on the CA s certificate to authenticate Each CA has its own certificate The certificates of a CA a...

Page 81: ...ame scenarios is to help you determine where the two vendors use different vocabulary Seeing the examples presented in these different ways will reveal how systems from different vendors do the same t...

Page 82: ...needed for configuring Gateway A Note The 24 after the IP address refers to the full range of IP addresses For example 10 5 6 0 24 refers to IP address 10 5 6 0 with the netmask 255 255 255 0 The IKE...

Page 83: ...ss from an FVL328 to an FVL328 1 Log in to the FVL328 labeled Gateway A as in the illustration Log in to the firewall at its default LAN address of http 192 168 0 1 with its default user name of admin...

Page 84: ...AT is disabled only standard routing is performed by this Router c Configure the WAN Internet Address according to the settings in Figure 6 6 above and click Apply to save your settings For more infor...

Page 85: ...to the built in Web based configuration manager of the FVL328 3 Set up the IKE Policy illustrated below on the FVL328 a From the main menu VPN section click the IKE Policies link and then click the A...

Page 86: ...main menu VPN section click the VPN Policies link and then click the Add Auto Policy button Figure 6 9 Scenario 1 VPN Auto Policy b Configure the IKE Policy according to the settings in the illustrat...

Page 87: ...connectivity and view VPN status information on the FVL328 1 To test connectivity between the Gateway A FVL328 LAN and the Gateway B LAN follow these steps a Using our example from a computer attache...

Page 88: ...ee of security you should turn off this feature when you are finished with testing 3 To view the FVL328 event log and status of Security Associations follow these steps a Go to the FVL328 main menu VP...

Page 89: ...ight provide it to you via e mail b Save the certificate as a text file called trust txt 2 Install the trusted CA certificate for the Trusted Root CA a Log in to the FVL328 b From the main menu VPN se...

Page 90: ...s the holder owner of this certificate This should be your registered business name or official company name Generally all certificates should have the same value in the Subject field Hash Algorithm S...

Page 91: ...nto a text file b Give the certificate request data to the CA In the case of a Windows 2000 internal CA you might simply e mail it to the CA administrator The procedures of a CA like Verisign and a CA...

Page 92: ...strator might simply email it to back to you Follow the procedures of your CA Save the certificate you get back from the CA as a text file called final txt 6 Upload the new certificate a From the main...

Page 93: ...Certificates table 7 Associate the new certificate and the Trusted Root CA certificate on the FVL328 a Create a new IKE policy called Scenario_2 with all the same properties of Scenario_1 see Scenario...

Page 94: ...s a text file Note The procedure for obtaining a CRL differs from a CA like Verisign and a CA such as a Windows 2000 certificate server which an organization operates for providing certificates for it...

Page 95: ...hatever password and LAN address you have chosen for the firewall 2 In the Advanced section on the left navigator select Remote Management 3 Select the Turn Remote Management On check box 4 Specify wh...

Page 96: ...nnect to your ISP There are 2 solutions to this problem a Have your ISP allocate you a Fixed IP address b Use the DDNS Dynamic DNS feature so you can connect using a domain name rather than an IP addr...

Page 97: ...his screen shows the following parameters Table 7 1 Router Status Fields Field Description System Name This field displays the Host Name assigned to the firewall in the Basic Settings menu Firmware Ve...

Page 98: ...t access via this Router by sharing this Router s WAN IP address You should only turn NAT OFF if you are sure you do not require it MAC Address This field displays the Ethernet MAC address being used...

Page 99: ...em up Time The time elapsed since the last power cycle or reset WAN or LAN Port The statistics for the WAN Internet and LAN local ports For each port the screen displays Status The link status of the...

Page 100: ...tached devices click the Refresh button Viewing Selecting and Saving Logged Information The firewall logs security related events such as denied incoming service requests hacker probes and administrat...

Page 101: ...rce port and interface The service port number of the initiating device and whether it originated from the LAN or WAN Destination The name or IP address of the destination device or Web site Destinati...

Page 102: ...Web based interface of this Router Other connections and traffic to this Router if selected this will log traffic sent to this Router rather than through this Router to the Internet Allow duplicate lo...

Page 103: ...heck box if you want to receive e mail logs and alerts from the firewall Your outgoing mail server Enter the name or IP address of your ISP s outgoing SMTP mail server such as mail myISP com You may b...

Page 104: ...the Weekly Daily or Hourly option is selected and the log fills up before the specified period the log is automatically e mailed to the specified e mail address After the log is sent the log is cleare...

Page 105: ...ser name of admin default password of password or using whatever Password and LAN address you have chosen for the firewall 2 From the Maintenance heading of the main menu select the Settings Backup me...

Page 106: ...Reset Button on page 8 7 Running Diagnostic Utilities and Rebooting the Router The FVL328 Firewall has a diagnostics feature You can use the diagnostics menu to perform the following functions from th...

Page 107: ...m the NETGEAR Web site If the upgrade file is compressed ZIP file you must first extract the binary BIN or IMG file before uploading it to the firewall The Web browser used to upload new firmware into...

Page 108: ...der the Maintenance heading select the Router Upgrade heading to display the menu shown in Figure 7 10 Figure 7 10 Router Upgrade menu 4 In the Router Upgrade menu click Browse to locate the binary BI...

Page 109: ...member the firewall s configuration password or I want to clear the configuration and start over again Go to Restoring the Default Configuration and Password on page 8 7 Is there a new version of the...

Page 110: ...are using the 12VDC power adapter supplied by NETGEAR for this product If the error persists you have a hardware problem and should contact technical support Test LED Never Turns On or Test LED Stays...

Page 111: ...uter s IP address is on the same subnet as the firewall If you are using the recommended addressing scheme your computer s address should be in the range of 192 168 0 2 to 192 168 0 254 Refer to Verif...

Page 112: ...rewall is able to obtain a WAN IP address from the ISP Unless you have been assigned a static IP address your firewall must request an IP address from the ISP You can determine whether the request was...

Page 113: ...dress but your computer is unable to load any Web pages from the Internet Your computer may not recognize any DNS server addresses A DNS server is a host on the Internet that translates Internet names...

Page 114: ...u see this message Request timed out If the path is not functioning correctly you could have one of the following problems Wrong physical connections Make sure the LAN port LED is on If the LED is off...

Page 115: ...thernet MAC addresses of all but one of your computers Many broadband ISPs restrict access by only allowing traffic from the MAC address of your broadband modem but some ISPs additionally restrict acc...

Page 116: ...e from one of several Network Time Servers on the Internet Each entry in the log is stamped with the date and time of day Problems with the date and time function can include Date shown is January 1 2...

Page 117: ...r Ethernet PPPoE Power Adapter North America 120V 60 Hz input United Kingdom Australia 240V 50 Hz input Europe 230V 50 Hz input Japan 100V 50 60 Hz input All regions output 12 V DC 1 2A output 20W max...

Page 118: ...B VCCI Class B EN 55 022 CISPR 22 Class B Interface Specifications Local 10BASE T or 100BASE Tx RJ 45 Internet 10BASE T or 100BASE Tx RJ 45 Certifications Firewall ICSA Certified Small Medium Business...

Page 119: ...wever providing high bandwidth between a local network and the Internet can be very expensive Because of this expense Internet access is usually provided by a slower speed wide area network WAN link s...

Page 120: ...Internet Protocol IP uses a 32 bit address structure The address is usually written in dot notation also called dotted decimal notation in which each group of eight bits is written in decimal form sep...

Page 121: ...up to 65 354 hosts on a network A Class B address uses a 16 bit network number and a 16 bit node number Class B addresses are in this range 128 1 x x to 191 254 x x Class C Class C addresses can have...

Page 122: ...and C addresses are 255 0 0 0 255 255 0 0 and 255 255 255 0 respectively For example the address 192 168 170 237 is a Class C IP address whose network portion is the upper 24 bits When combined using...

Page 123: ...ending the number of addresses available subnet addressing provides other benefits Subnet addressing allows a network manager to construct an address scheme for the network by using different subnets...

Page 124: ...subnet mask 255 255 255 0 into 16 subnets 4 bits the new subnet mask becomes 255 255 255 240 The following table displays several common netmask values in both the dotted decimal and the masklength fo...

Page 125: ...168 0 0 192 168 255 255 NETGEAR recommends that you choose your private network number from this range The DHCP server of the FVL328 Firewall is preconfigured to automatically assign private addresse...

Page 126: ...figure illustrates a single IP address operation Figure 8 3 Single IP Address Operation Using NAT This scheme offers the additional benefit of firewall like protection because the internal LAN addres...

Page 127: ...the ARP request All other stations discard the request Related Documents The station with the correct IP address responds with its own MAC address directly to the sending device The receiving station...

Page 128: ...st Configuration Protocol DHCP server The DHCP server stores a list or pool of IP addresses along with other information such as gateway and DNS addresses that it may assign to the other devices on th...

Page 129: ...ing to protect your network from attacks and intrusions Since user level applications such as FTP and Web browsers can create complex patterns of network traffic it is necessary for the firewall to an...

Page 130: ...ir must be exchanged with the receive pair This exchange is done by one of two mechanisms Most hubs provide an uplink switch which will exchange the pairs on one port allowing that port to be connecte...

Page 131: ...T will often tolerate low quality cables but at 100 Mbits second 10BASE Tx the cable must be rated as Category 5 or Cat 5 by the Electronic Industry Association EIA This rating will be printed on the...

Page 132: ...Model FVL328 ProSafe High Speed VPN Firewall Reference Manual B 14 Networks Routing and Firewall Basics M 10144 01...

Page 133: ...he software components for establishing a TCP IP network Windows 3 1 does not include a TCP IP component You need to purchase a third party TCP IP application package such as NetManage Chameleon Macin...

Page 134: ...ll assigns the following TCP IP configuration information automatically when the computers are rebooted PC or workstation IP addresses 192 168 0 2 through 192 168 0 254 Subnet mask 255 255 255 0 Gatew...

Page 135: ...teps a Click the Add button b Select Adapter and then click Add c Select the manufacturer and model of your Ethernet adapter and then click OK If you need TCP IP a Click the Add button b Select Protoc...

Page 136: ...ended default addresses follow these steps 1 Connect all computers to the firewall then restart the firewall and allow it to boot 2 On each attached PC open the Network control panel refer to the prev...

Page 137: ...the values below if you are using the default TCP IP settings that NETGEAR recommends The IP address is between 192 168 0 2 and 192 168 0 254 The subnet mask is 255 255 255 0 The default gateway is 1...

Page 138: ...n 1 On the Windows taskbar click the Start button and then click Run The Run window opens 2 Type cmd and then click OK A command window opens 3 Type ipconfig all Your IP Configuration information will...

Page 139: ...face 3 From the Configure box select Using DHCP Server You can leave the DHCP Client ID box empty 4 Close the TCP IP Control Panel 5 Repeat this for each Macintosh on your network MacOS X 1 From the A...

Page 140: ...Apple menu select Control Panels then TCP IP The panel is updated to show your settings which should match the values below if you are using the default TCP IP settings that NETGEAR recommends The IP...

Page 141: ...t port is connected to the broadband modem the firewall appears to be a single PC to the ISP The firewall then allows the computers on the local network to masquerade as the single PC to access the In...

Page 142: ...These procedures are described next Obtaining ISP Configuration Information for Windows Computers As mentioned above you may need to collect configuration information from your PC so that you can use...

Page 143: ...r Macintosh so that you can use this information when you configure the FVL328 Firewall Following this procedure is only necessary when your ISP does not dynamically supply the account information To...

Page 144: ...to work with the firewall you must reset the network for the devices to be able to communicate correctly Restart any computer that is connected to the firewall After configuring all of your computers...

Page 145: ...nd modified prior to being forwarded and or replied to Field List DATE TIME Log s date and time EVENT Event is that access the device or access other host via the device PKT_TYPE Packet type pass Fire...

Page 146: ...ult rule match PKT_TYPE UDP packet TCP connection ICMP packet Inbound Log Incoming packets that match the Firewall rules are logged The format is DATE TIME PKT_TYPE SRC_IP SRC_INF DST_IP DST_INF ACTIO...

Page 147: ...acket Wed 2003 07 30 18 44 50 IP Packet Type Field 321 Source 18 7 21 69 192 168 0 3 Drop Notes DESCRIPTION VPN Packet PKT_TYPE GRE AH ESP IP packet Type Field Num IPSEC ACTION Forward Drop Router Ope...

Page 148: ...i 2003 12 05 22 59 56 ICMP Packet Echo Request Source 192 168 0 10 Destination 192 168 0 1 Receive The format is DATE TIME EVENT SRC_IP SRC_PORT SRC_INF DST_IP DST_PORT DST_INF ACTION Wed 2003 07 30 1...

Page 149: ...3 WAN Destination 172 31 12 157 LAN Drop ICMP Flood Fri 2003 12 05 21 33 52 UDP Packet Source 127 0 0 1 0 WAN Destination 172 31 12 157 0 LAN Drop Fragment Attack Fri 2003 12 05 19 20 00 TCP Session S...

Page 150: ...rce 192 168 0 10 LAN Destination www google com WAN Drop Notes EVENT Attempt to access blocked sites SRC_INF LAN DST_INF WAN All Web Sites and News Groups Visited All Web sites and News groups that yo...

Page 151: ...bound Policy to Service BGP is Added Fri 2003 12 05 21 49 41 Administrator Action Outbound Policy to Service BGP is Added Fri 2003 12 05 21 50 14 Administrator Action Inbound Policy to Service BGP is...

Page 152: ...User Manual for the NETGEAR 7300 Series Layer 3 Managed Switch Software D 8 Firewall Log Formats 202 10009 01...

Page 153: ...ing across the network is protected by encryption technologies Private networks lack data security which allows data attackers to tap directly into the network and read the data IPSec based VPNs use e...

Page 154: ...nsively installed on existing Internet connections What Is IPSec and How Does It Work IPSec is an Internet Engineering Task Force IETF standard suite of protocols that provides data authentication int...

Page 155: ...ble identifier for each packet which is a data equivalent of a fingerprint This fingerprint allows the device to determine if a packet has been tampered with Furthermore packets that are not authentic...

Page 156: ...addition AH does not protect the data s confidentiality If data is intercepted and only AH is used the message contents can be read ESP protects data confidentiality For added protection in certain ca...

Page 157: ...h IPSec the new IP packet contains the old IP header with the source and destination IP addresses unchanged and the processed packet payload Transport mode does not shield the information in the IP he...

Page 158: ...ortium has developed specific scenarios to aid system administrators in the often confusing process of connecting two different vendor implementations of the IPSec standard The case studies in this ap...

Page 159: ...Network behind it In most cases each Gateway will have a public facing address WAN side and a private facing address LAN side These addresses are referred to as the network interface in documentation...

Page 160: ...erstand how to open specific protocols ports and addresses that you intend to allow Setting Up a VPN Tunnel Between Gateways An SA frequently called a tunnel is the set of information that allows two...

Page 161: ...by IPSec As illustrated below the most common method of accomplishing this process is via the Internet Key Exchange IKE protocol which automates some of the negotiation procedures Alternatively you ca...

Page 162: ...s to use in the IPSec SAs b The master key is used to derive the IPSec keys for the SAs Once the SA keys are created and exchanged the IPSec SAs are ready to protect user data between the two VPN gate...

Page 163: ...is working Common problems encountered in setting up VPNs include Parameters may be configured differently on Gateway A vs Gateway B Two LANs set up with similar or overlapping addressing schemes So m...

Page 164: ...407 D Piper The Internet IP Security Domain of Interpretation for ISAKMP November 1998 RFC 2474 K Nichols S Blake F Baker D Black Definition of the Differentiated Services Field DS Field in the IPv4 a...

Page 165: ...rmation before you begin the configuration process Verify whether the firmware is up to date all of the addresses that will be necessary and all of the parameters that need to be set on both sides Che...

Page 166: ...ration Out of the box the FVS318 or FVM318 is set for its default LAN address of http 192 168 0 1 with its default user name of admin and default password of password For this example we will assume y...

Page 167: ...entifier name for the NETGEAR FVS318 Gateway A This name must be entered in the other endpoint as Remote IPSec Identifier In this example we used 14 15 16 17 as the local identifier Enter a Remote IPS...

Page 168: ...IP address 22 23 24 25 in our example of Gateway B in the Remote WAN IP or FQDN field Figure F 4 Figure 4 NETGEAR FVS318 VPN Settings part 2 Main Mode From the Secure Association drop down box select...

Page 169: ...Step By Step Configuration of FVL328 Gateway B 1 Log in to the NETGEAR FVL328 labeled Gateway B as in the illustration Out of the box the FVL328 is set for its default LAN address of http 192 168 0 1...

Page 170: ...policies In our example we have used FVS318 as the Policy Name In the Policy Name field type FVS318 From the Direction Type drop down box select Both Directions From the Exchange Mode drop down box s...

Page 171: ...hr5xb84l6aa9r6 You must make sure the key is the same for both gateways From the Diffie Hellman DH Group drop down box select Group 1 768 Bit In the SA Life Time field type 28800 3 Click the Apply Bu...

Page 172: ...the FVS318 IKE Policy From the Remote VPN Endpoint Address Type drop down box select IP Address Type the WAN IP Address of Gateway A 14 15 16 17 in our example in the Remote VPN Endpoint Address Data...

Page 173: ...f Gateway A 0 0 0 0 in our example in the Remote IP Finish IP Address field Type the LAN Subnet Mask of Gateway A 255 255 255 0 in our example in the Remote IP Subnet Mask field From the AH Configurat...

Page 174: ...teway B LAN Interface address example address 172 23 9 1 2 From a PC behind the FVL328v2 gateway B attempt to ping the remote NETGEAR FVS318 or FVM318 gateway A LAN Interface address example address 1...

Page 175: ...3 24 25 13 19 46 FVS318 IPsec main_inR3 13 19 46 FVS318 IKE toFVL328 RX MM_R3 22 23 24 25 13 19 46 FVS318 IPsec Decoded Peer s ID is ID_IPV4_ADDR 22 23 24 25and 22 23 24 25in st 13 19 46 FVS318 IPsec...

Page 176: ...Model FVL328 ProSafe High Speed VPN Firewall v2 Reference Manual F 12 NETGEAR VPN Configuration FVS318 or FVM318 to FVL328 M 10144 01...

Page 177: ...72 16 9 10 Windows 2000 Server configuration This example shows how to create an IP Security Policy The following steps should be performed in this order 1 Create an IP Security Policy called DUT To W...

Page 178: ...Windows 2000 Server and SSH Sentinel VPN Configuration M 10144 01 3 Click Next then type the policy name for example DUT To Win2K DUT in this example refers to Device Under Test Click Next 4 Clear th...

Page 179: ...anual FVL328 to Windows 2000 Server and SSH Sentinel VPN Configuration G 3 M 10144 01 Create an IP Filter called To DUT 1 Click Add Type To DUT and then click Add 2 Type the Source IP address and the...

Page 180: ...e High Speed VPN Firewall Reference Manual G 4 FVL328 to Windows 2000 Server and SSH Sentinel VPN Configuration M 10144 01 4 Click the Filter Action tab Select the Require Security check box and click...

Page 181: ...rewall Reference Manual FVL328 to Windows 2000 Server and SSH Sentinel VPN Configuration G 5 M 10144 01 6 Select High ESP then click OK and OK to go back to the Filter Action 7 Click the Tunnel Settin...

Page 182: ...328 to Windows 2000 Server and SSH Sentinel VPN Configuration M 10144 01 8 Click the Authentication Methods tab Click Edit Select the Use this string preshared key check box then type 12345678 9 Click...

Page 183: ...328 ProSafe High Speed VPN Firewall Reference Manual FVL328 to Windows 2000 Server and SSH Sentinel VPN Configuration G 7 M 10144 01 Create an IP Filter Called To Win2K 1 Click Add Type To Win2K and c...

Page 184: ...afe High Speed VPN Firewall Reference Manual G 8 FVL328 to Windows 2000 Server and SSH Sentinel VPN Configuration M 10144 01 2 Type the Source IP address and the Destination IP address 3 Click OK then...

Page 185: ...e High Speed VPN Firewall Reference Manual FVL328 to Windows 2000 Server and SSH Sentinel VPN Configuration G 9 M 10144 01 4 Click the Filter Action tab Select the Require Security check box and click...

Page 186: ...ll Reference Manual G 10 FVL328 to Windows 2000 Server and SSH Sentinel VPN Configuration M 10144 01 6 Select High ESP then click OK Click OK to return to the Filter Action tab 7 Click the Tunnel Sett...

Page 187: ...28 to Windows 2000 Server and SSH Sentinel VPN Configuration G 11 M 10144 01 8 Click Authentication Methods and click Edit Select the Use this string preshared key check box then type 12345678 9 Click...

Page 188: ...ProSafe High Speed VPN Firewall Reference Manual G 12 FVL328 to Windows 2000 Server and SSH Sentinel VPN Configuration M 10144 01 Configure the General Properties 1 Click General 2 Click Advanced 3 C...

Page 189: ...Windows 2000 Server and SSH Sentinel VPN Configuration G 13 M 10144 01 4 Click Edit select Integrity Algorithm SHA1 and Encryption algorithm 3DES DH Low Click OK then OK again Close the window 5 Righ...

Page 190: ...Model FVL328 ProSafe High Speed VPN Firewall Reference Manual G 14 FVL328 to Windows 2000 Server and SSH Sentinel VPN Configuration M 10144 01 Configure the FVL328 IKE policy...

Page 191: ...Model FVL328 ProSafe High Speed VPN Firewall Reference Manual FVL328 to Windows 2000 Server and SSH Sentinel VPN Configuration G 15 M 10144 01 Configure the FVL328 VPN policy...

Page 192: ...44 01 FVL328 to SSH Sentinel 1 3 Remote VPN LAN WAN LAN PCa FVL328 NAT router PC b with SSH 1 3 installed FVL328 LAN IP 192 168 0 1 WAN IP 172 16 7 119 24 NAT router support IPSec passthrough LAN IP 1...

Page 193: ...rence Manual FVL328 to Windows 2000 Server and SSH Sentinel VPN Configuration G 17 M 10144 01 2 Select the Key Management tab a Click Add b Select Create a preshared key and click Next c Type the same...

Page 194: ...Model FVL328 ProSafe High Speed VPN Firewall Reference Manual G 18 FVL328 to Windows 2000 Server and SSH Sentinel VPN Configuration M 10144 01 d You will see the FVL328 under My Keys Click Apply...

Page 195: ...t the Security Policy tab a Under VPN Connections click Add b Click the IP button and type the Gateway IP Address Select FVL328 for the Authentication key Select the Use legacy proposal check box Clic...

Page 196: ...FVL328 ProSafe High Speed VPN Firewall Reference Manual G 20 FVL328 to Windows 2000 Server and SSH Sentinel VPN Configuration M 10144 01 d Click Properties and check the VPN policy settings e Click Se...

Page 197: ...roSafe High Speed VPN Firewall Reference Manual FVL328 to Windows 2000 Server and SSH Sentinel VPN Configuration G 21 M 10144 01 f Configure the settings below then click OK Click OK and then OK again...

Page 198: ...ProSafe High Speed VPN Firewall Reference Manual G 22 FVL328 to Windows 2000 Server and SSH Sentinel VPN Configuration M 10144 01 4 Right click on the icon click Select VPN and choose the one you jus...

Page 199: ...Model FVL328 ProSafe High Speed VPN Firewall Reference Manual FVL328 to Windows 2000 Server and SSH Sentinel VPN Configuration G 23 M 10144 01 Create the FVL328 IKE Policy Create the FVL328 VPN Policy...

Page 200: ...Model FVL328 ProSafe High Speed VPN Firewall Reference Manual G 24 FVL328 to Windows 2000 Server and SSH Sentinel VPN Configuration M 10144 01 Ping a PC to Bring Up the Tunnel...

Page 201: ...and configuration mechanics defined by the VPN Consortium Gather all the necessary information before you begin the configuration process Verify whether the firmware is up to date all of the addresse...

Page 202: ...p 192 168 0 1 with its default user name of admin and default password of password Even though the remainder of this document will refer to the FVL328 the login procedures and configuration menu scree...

Page 203: ...help you manage the IKE policies In our example we used VPNclient as the Policy Name From the Direction Type drop down box select Remote Access From the Exchange Mode drop down box select Aggressive M...

Page 204: ...ection Security Policy Authentication Phase 1 on page H 11 From the Authentication Method radio button select Pre shared Key This will also be selected in the NETGEAR ProSafe VPN Client Security Polic...

Page 205: ...ke you to the VPN Policies Menu page Click Add Auto Policy This will open a new screen titled VPN Auto Policy Figure H 3 NETGEAR FVL328 VPN Auto Policy General settings Enter a unique name to identify...

Page 206: ...Addressing ID Type field as seen in Security Policy Editor New Connection on page H 8 Type the starting LAN IP Address of the FVL328 in the Local IP Start IP Address field For this example we used 19...

Page 207: ...ection Security Policy Key Exchange Phase 2 on page H 12 Select the NETBIOS Enable check box to enable networking features like Windows Network Neighborhood Click Apply to save your changes You will b...

Page 208: ...it has a dynamically assigned IP address 1 Install the NETGEAR VPN Client Software on the PC You may need to insert your Windows CD to complete the installation Reboot your PC after installing the cl...

Page 209: ...using Secure Gateway Tunnel check box is selected c In this example select IP Subnet as the ID Type 192 168 0 0 in the Subnet field the Subnet address is the LAN IP Address of the FVL328 with 0 as th...

Page 210: ...ick Pre Shared Key Figure H 8 Connection Identity Pre Shared Key c Enter hr5xb84l6aa9r6 which is the same Pre Shared Key entered in the FVL328 d Click OK 4 Configure the Connection Identity Settings a...

Page 211: ...Connection Security Policy In this step you will provide the authentication IKE Phase 1 settings and the key exchange Phase 2 settings The setting choices in this procedure follow the VPNC guidelines...

Page 212: ...igure the Key Exchange Phase 2 Expand the Key Exchange Phase 2 heading and click on Proposal 1 For this example ensure that the following settings are configured In the SA Life menu select Unspecified...

Page 213: ...ow to Specify Internal Network Address check box and click OK 7 Save the VPN Client Settings From the File menu at the top of the Security Policy Editor window select Save After you have configured an...

Page 214: ...ect option of the NETGEAR VPN Client popup menu Figure H 13 Connecting the PC to the FVL328 over the VPN tunnel 1 Open the popup menu by right clicking on the system tray icon 2 Select Connect to open...

Page 215: ...d out to reply To test the connection to a computer connected to the FVL328 simply ping the IP address of that computer Once connected you can open a browser on the remote PC and enter the LAN IP Addr...

Page 216: ...ection Monitor screen In this example the following connection options apply The FVL328 has a public IP WAN address of 66 120 188 153 The FVL328 has a LAN IP address of 192 168 0 1 The VPN client PC i...

Page 217: ...ing the FVL328 VPN Status and Log Information Information on the status of the VPN client connection can be viewed by opening the FVL328 VPN Status screen To view this screen click the VPN Status link...

Page 218: ...Reference Manual for the NETGEAR ProSafe VPN Client H 18 NETGEAR VPN Client to NETGEAR FVL328 or FWAG114 VPN Router 202 10015 01...

Page 219: ...PN Consortium Gather all the necessary information before you begin the configuration process Verify whether the firmware is up to date all of the addresses that will be necessary and all of the param...

Page 220: ...provides a central public database where information such as email addresses host names and IP addresses can be stored and retrieved Now a gateway can be configured to use a 3rd party service in lieu...

Page 221: ...on necessary to set up the gateways Step By Step Configuration of FVS318 or FVM318 Gateway A 1 Log in to the FVS318 or FVM318 labeled Gateway A as in the illustration Out of the box the FVS318 or FVM3...

Page 222: ...DN we are using is netgear dyndns org and the Host Name is netgear Type the Password or key for your dynamic DNS account 5 Click Apply to save your configuration 6 Click on the VPN Settings link on th...

Page 223: ...me for the remote NETGEAR FVL328 Gateway B This name must be entered in the other endpoint as Local IPSec Identifier In this example we used 22 23 24 25 as the remote identifier Choose a subnet from l...

Page 224: ...e Secure Association drop down box select Main Mode Next to Perfect Forward Secrecy select the Enabled radio button From the Encryption Protocol drop down box select 3DES In the PreShared Key box type...

Page 225: ...Enable check box is selected Step By Step Configuration of FVL328 Gateway B 1 Log in to the NETGEAR FVL328 labeled Gateway B in the illustration Out of the box the FVL328 is set for its default LAN ad...

Page 226: ...ample we have used FVS318 as the Policy Name In the Policy Name field type FVS318 From the Direction Type drop down box select Both Directions From the Exchange Mode drop down box select Main Mode Fro...

Page 227: ...You must make sure the key is the same for both gateways From the Diffie Hellman DH Group drop down box select Group 1 768 Bit In the SA Life Time field type 28800 3 Click Apply This will bring you ba...

Page 228: ...Address Type drop down box select IP Address Type the WAN IP Address of Gateway A 14 15 16 17 in our example in the Remote VPN Endpoint Address Data field Type 300 in the SA Life Time Seconds field T...

Page 229: ...ess of Gateway A 0 0 0 0 in our example in the Remote IP Finish IP Address field Type the LAN Subnet Mask of Gateway A 255 255 255 0 in our example in the Remote IP Subnet Mask field From the AH Confi...

Page 230: ...1 From a PC behind the NETGEAR FVS318 or FVM318 Gateway A attempt to ping the remote FVL328 Gateway B LAN Interface address example address 172 23 9 1 2 From the FVS318 or FVM318 click the Router Sta...

Page 231: ...h a financial institution such as a credit card company which provides it with information to confirm an individual s claimed identity CAs are a critical component in data security and electronic comm...

Page 232: ...erver resolves descriptive names of network resources such as www NETGEAR com to numeric IP addresses Dynamic Host Configuration Protocol DHCP An Ethernet protocol specifying how a centralized DHCP se...

Page 233: ...ny type of Internet access Because it s a simpler version of X 500 LDAP is sometimes called X 500 lite local area network LAN A communications network serving users within a limited area such as one f...

Page 234: ...A block of information sent over a network A packet typically contains a source and destination network address some protocol and length information a block of data and a checksum PPP See Point to Po...

Page 235: ...x Ethernet networks VPN Virtual Private Network A method for securely transporting data between two private networks by using a public network such as the Internet as a connection VPNC Virtual Private...

Page 236: ...Model FVL328 ProSafe High Speed VPN Firewall Reference Manual 6 Glossary M 10144 01...

Page 237: ...and time 8 8 Daylight Savings Time 5 15 8 8 daylight savings time 5 15 Default DMZ Server 4 5 default reset button 8 7 Denial of Service DoS protection 2 2 5 3 denial of service attack B 11 DHCP 2 4...

Page 238: ...8 3 private B 7 translating B 9 IP configuration by DHCP B 10 IP networking for Macintosh C 6 for Windows C 2 C 5 IPSec E 1 IPSec Components E 2 IPSec SA negotiation E 9 IPSec Security Features E 2 IS...

Page 239: ...ts B 1 Routing Information Protocol 2 3 B 2 rules inbound 5 7 order of precedence 5 12 outbound 5 10 S SA E 4 Scope of Document 1 1 Secondary DNS Server 3 10 3 11 3 13 3 15 3 16 service blocking 5 10...

Page 240: ...working 2 3 VPN E 1 VPN Consortium E 6 VPN Process Overview E 7 VPNC IKE Phase I Parameters E 10 VPNC IKE Phase II Parameters E 11 W Windows configuring for IP routing C 2 C 5 winipcfg utility C 5 Win...

Reviews:

No comments

Related manuals for FVL328 - Cable/DSL ProSafe VPN Firewall Router

Firebox Vclass V200

Brand: Watchguard Pages: 29

Brand: Lanner electronics Pages: 56

ELITECONNECT SMC2504W

Brand: SMC Networks Pages: 242

EtherFire IEF-G9010-2MGSFP Series

Brand: Moxa Technologies Pages: 11

Brand: Global Technology Associates Pages: 2

Brands by name

0 1 2 3 4 5 6 7 8 9 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

Popular brands

Load more brands