Reference Manual for the ProSafe VPN Firewall FVS318v3 NETGEAR, Inc. 4500 Great America Parkway Santa Clara, CA 95054 USA 202-10059-02 Version 3 January 2005 January 2005 © 2005 by NETGEAR, Inc. All rights reserved. Trademarks NETGEAR is a trademark of Netgear, Inc. Microsoft, Windows, and Windows NT are registered trademarks of Microsoft Corporation. Other brand and product names are registered trademarks or trademarks of their respective holders. Statement of Conditions In the interest of improving internal design, operational function, and/or reliability, NETGEAR reserves the right to make changes to the products described in this document without notice. NETGEAR does not assume any liability that may occur due to the use or application of the product(s) or circuit layout(s) described herein. Federal Communications Commission (FCC) Compliance Notice: Radio Frequency Notice This equipment has been tested and found to comply with the limits for a Class B digital device, pursuant to part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a residential installation. This equipment generates, uses, and can radiate radio frequency energy and, if not installed and used in accordance with the instructions, may cause harmful interference to radio communications. However, there is no guarantee that interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures: · · · · Reorient or relocate the receiving antenna. Increase the separation between the equipment and receiver. Connect the equipment into an outlet on a circuit different from that to which the receiver is connected. Consult the dealer or an experienced radio/TV technician for help. EN 55 022 Declaration of Conformance This is to certify that the FVS318v3 ProSafe VPN Firewall is shielded against the generation of radio interference in accordance with the application of Council Directive 89/336/EEC, Article 4a. Conformity is declared by the application of EN 55 022 Class B (CISPR 22). ii January 2005 Bestätigung des Herstellers/Importeurs Es wird hiermit bestätigt, daß das FVS318v3 ProSafe VPN Firewall gemäß der im BMPT-AmtsblVfg 243/1991 und Vfg 46/1992 aufgeführten Bestimmungen entstört ist. Das vorschriftsmäßige Betreiben einiger Geräte (z.B. Testsender) kann jedoch gewissen Beschränkungen unterliegen. Lesen Sie dazu bitte die Anmerkungen in der Betriebsanleitung. Das Bundesamt für Zulassungen in der Telekommunikation wurde davon unterrichtet, daß dieses Gerät auf den Markt gebracht wurde und es ist berechtigt, die Serie auf die Erfüllung der Vorschriften hin zu überprüfen. Certificate of the Manufacturer/Importer It is hereby certified that the FVS318v3 ProSafe VPN Firewall has been suppressed in accordance with the conditions set out in the BMPT-AmtsblVfg 243/1991 and Vfg 46/1992. The operation of some equipment (for example, test transmitters) in accordance with the regulations may, however, be subject to certain restrictions. Please refer to the notes in the operating instructions. Federal Office for Telecommunications Approvals has been notified of the placing of this equipment on the market and has been granted the right to test the series for compliance with the regulations. Voluntary Control Council for Interference (VCCI) Statement This equipment is in the second category (information equipment to be used in a residential area or an adjacent area thereto) and conforms to the standards set by the Voluntary Control Council for Interference by Data Processing Equipment and Electronic Office Machines aimed at preventing radio interference in such residential areas. When used near a radio or TV receiver, it may become the cause of radio interference. Read instructions for correct handling. iii January 2005 Product and Publication Details Model Number: Publication Date: Product Family: Product Name: Home or Business Product: Language: FVS318v3 January 2005 Router FVS318v3 ProSafe VPN Firewall Business English iv January 2005 Contents Chapter 1 About This Manual Audience, Scope, Conventions, and Formats ................................................................1-1 How to Use This Manual ................................................................................................1-2 How to Print this Manual .................................................................................................1-3 Chapter 2 Introduction Key Features of the VPN Firewall ..................................................................................2-1 A Powerful, True Firewall with Content Filtering ......................................................2-2 Security ....................................................................................................................2-2 Autosensing Ethernet Connections with Auto Uplink ...............................................2-3 Extensive Protocol Support ......................................................................................2-3 Easy Installation and Management ..........................................................................2-4 Maintenance and Support ........................................................................................2-4 Package Contents ..........................................................................................................2-5 The FVS318v3 Front Panel ......................................................................................2-5 The FVS318v3 Rear Panel ......................................................................................2-6 NETGEAR-Related Products .........................................................................................2-7 NETGEAR Product Registration, Support, and Documentation .....................................2-7 Chapter 3 Connecting the Firewall to the Internet Prepare to Install Your FVS318v3 ProSafe VPN Firewall ...............................................3-1 First, Connect the FVS318v3 .........................................................................................3-1 Now, Configure the FVS318v3 for Internet Access ........................................................3-4 Troubleshooting Tips ......................................................................................................3-6 Overview of How to Access the FVS318v3 VPN Firewall ..............................................3-8 How to Log On to the FVS318v3 After Configuration Settings Have Been Applied ..............................................................3-9 How to Bypass the Configuration Assistant ...........................................................3-10 Contents January 2005 v Using the Smart Setup Wizard ..................................................................................... 3-11 How to Manually Configure Your Internet Connection ..................................................3-12 Chapter 4 Firewall Protection and Content Filtering Firewall Protection and Content Filtering Overview ........................................................4-1 Block Sites ......................................................................................................................4-2 Using Rules to Block or Allow Specific Kinds of Traffic ..................................................4-3 Inbound Rules (Port Forwarding) .............................................................................4-5 Inbound Rule Example: A Local Public Web Server ..........................................4-5 Inbound Rule Example: Allowing a Videoconference from Restricted Addresses 4-6 Considerations for Inbound Rules .....................................................................4-6 Outbound Rules (Service Blocking) .........................................................................4-7 Outbound Rule Example: Blocking Instant Messenger .....................................4-7 Order of Precedence for Rules ................................................................................4-8 Default DMZ Server .................................................................................................4-8 Respond to Ping on Internet WAN Port ...................................................................4-9 Services ........................................................................................................................4-10 Using a Schedule to Block or Allow Specific Traffic ......................................................4-12 Time Zone ..............................................................................................................4-13 Getting E-Mail Notifications of Event Logs and Alerts ..................................................4-14 Viewing Logs of Web Access or Attempted Web Access .............................................4-16 Syslog ....................................................................................................................4-17 Chapter 5 Basic Virtual Private Networking Overview of VPN Configuration ......................................................................................5-2 Client-to-Gateway VPN Tunnels ..............................................................................5-2 Gateway-to-Gateway VPN Tunnels .........................................................................5-2 Planning a VPN ..............................................................................................................5-3 VPN Tunnel Configuration ..............................................................................................5-5 How to Set Up a Client-to-Gateway VPN Configuration .................................................5-5 Step 1: Configuring the Client-to-Gateway VPN Tunnel on the FVS318v3 ..............5-6 Step 2: Configuring the NETGEAR ProSafe VPN Client on the Remote PC ...........5-9 Monitoring the Progress and Status of the VPN Client Connection .......................5-16 Transferring a Security Policy to Another Client ....................................................5-18 Exporting a Security Policy ..............................................................................5-18 vi January 2005 Contents Importing a Security Policy ..............................................................................5-19 How to Set Up a Gateway-to-Gateway VPN Configuration ..........................................5-20 Procedure to Configure a Gateway-to-Gateway VPN Tunnel ................................5-21 VPN Tunnel Control ......................................................................................................5-26 Activating a VPN Tunnel ........................................................................................5-26 Start Using a VPN Tunnel to Activate It ...........................................................5-26 Using the VPN Status Page to Activate a VPN Tunnel ....................................5-26 Activate the VPN Tunnel by Pinging the Remote Endpoint .............................5-27 Verifying the Status of a VPN Tunnel .....................................................................5-29 Deactivating a VPN Tunnel ....................................................................................5-30 Using the Policy Table on the VPN Policies Page to Deactivate a VPN Tunnel 5-30 Using the VPN Status Page to Deactivate a VPN Tunnel ...............................5-31 Deleting a VPN Tunnel ...........................................................................................5-32 Chapter 6 Advanced Virtual Private Networking Overview of FVS318v3 Policy-Based VPN Configuration ..............................................6-1 Using Policies to Manage VPN Traffic .....................................................................6-2 Using Automatic Key Management ..........................................................................6-2 IKE Policies' Automatic Key and Authentication Management ................................6-3 VPN Policy Configuration for Auto Key Negotiation .................................................6-5 VPN Policy Configuration for Manual Key Exchange ...............................................6-9 Using Digital Certificates for IKE Auto-Policy Authentication .......................................6-13 Certificate Revocation List (CRL) ...........................................................................6-14 Walk-Through of Configuration Scenarios on the FVS318v3 .......................................6-14 VPN Consortium Scenario 1: Gateway-to-Gateway with Preshared Secrets .......................................................6-15 FVS318v3 Scenario 1: FVS318v3 to Gateway B IKE ...