NETGEAR ProSafe FVX538 Manuals

May 2008 202-10161-03 v1.0 NETGEAR, Inc. 4500 Great America Parkway Santa Clara, CA 95054 USA DGFV338 ProSafe Wireless ADSL Modem VPN Firewall Router Reference Manual

24/7 T E C H N I C A L S U P P O R T* 1-888-NETGEAR (638-4327) Email: [email protected] ProSafe® Dual WAN VPN Firewall with 8-port 10/100 Switch Data Sheet FVX538 High-performance, Manageable Dual WAN Security Firewall At the heart of your office network, NETGEAR’s high performance security appliance, ProSafe® Dual WAN VPN Firewall offers a complete security solution for small and medium-sized companies.This rack-mountable, stateful packet inspection (SPI) firewall is equipped with support for up to 200 security associations (VPN tunnels). The FVX538 can serve as a DHCP server, supports Simple Network Management Protocol (SNMP), Quality of Service (QoS) and has a powerful SPI firewall to protect your PCs against intruders and most common Internet attacks. Featuring eight auto-sensing 10/100 Mbps LAN ports, one Gigabit LAN port and two 10/100 WAN ports, the ProSafe® VPN Firewall FVX538 lets multiple computers in your office share two Internet connections. The dual WAN ports let you connect a second Internet line as a backup to insure that you’re never disconnected. One LAN port can be dedicated as a hardware DMZ port for safely providing services to the Internet without compromising security on your LAN. Richer Security This powerful VPN Firewall extends security from the network core to the perimeter by preventing unauthorized network access using a SPI firewall, blocking denial-of-service (DoS) and other attacks, encrypting traffic traveling across the Internet. Capacity to Spare Dual WAN ports support two broadband connections. A second WAN port supports an additional broadband connection. This second WAN connection may be configured as a failover connection in case the primary connection fails or can be used to balance the workload by distributing traffic across the two connections for optimal per-user bandwidth. Superior Value and Usability Competitively priced and SNMP manageable, convenient VPN Wizard gathers basic information about your networks and recommends a VPN solution with supporting instructions. Bundled with NETGEAR’s ProSafe VPN client software (VPN05L) — a five-user license is included. Virtual Private Network Consortium (VPNC) certified VPN supports secure data connectivity and transmission over the Internet and ensures interoperability with many other popular security products. PC with GA311 Desktop PCs with GA311 network card installed Servers FVX538 ProSafe VPN firewall GSM7352S ProSafe 48-port Gigabit Layer 3 Managed Stackable Switch with 4 10 Gigabit Slots Broadband modems VPN Tunnel encrypts your data Internet Broadband modems PDA with Web browser Telecommuter with ProSafe VPN Client Software VPN01L (IPsec VPN) PCs with GA311 WG302 access point Laptop with SSL VPN Remote Access via Kiosk or Laptop Gigabit Ethernet Fast Ethernet FVX538 ProSafe VPN firewall 100-user Office VPN Router *

Application Note Creating a VPN Policy for the FVX538 or FVS338 ProSafe® VPN Firewall with a Remote Endpoint of 0.0.0.0 Summary This application note describes how to configure a VPN policy to support a remote gateway IP set to 0.0.0.0.on one WAN interface of a NETGEAR FVX538 or FVS338 ProSafe VPN Firewall. This is an updated version using the version 2.x router firmware. Procedure This application note describes how to create a VPN Client policy using the VPN Wizard and then editing that policy to set a remote endpoint of 0.0.0.0. It also describes how to set the remote endpoint to 0.0.0.0. for VPN policies that were manually created. This procedure was tested using the following: • NETGEAR FVX538 ProSafe VPN Firewall with version V 2.x firmware o IP address subnet: 192.168.1.1; 255.255.255.0 Using the VPN Wizard to Create a VPN Policy VPN menu, select the VPN Wizard submenu. 1. From the Select the VPN client radio button. 2. 3. Type the connection name and preshared key. 4. Click Apply.

������������������ FVX538 ProSafe™ VPN Firewall 200 Start Here Follow these instructions to set up your firewall. You can also consult the online FVX538 ProSafe VPN Firewall 200 Reference Manual or the NETGEAR Knowledgebase at http://kbserver.netgear.com. A link to the online Reference Manual is on the Resource CD. Prepare to Install Your FVX538 VPN Firewall This guide provides instructions for setting up a simple dual WAN port rollover configuration. Refer to the Reference Manual for other WAN port configuration options. First, Connect the FVX538 1. CONNECT THE CABLES BETWEEN THE FVX538, THE MODEMS, AND A COMPUTER a. Turn off and unplug the broadband modems. b. Insert an Ethernet cable from a modem into the WAN1 port (1) of the FVX538. c. Insert an Ethernet cable from the other modem into the WAN2 port (2) of the FVX538. d. Insert the Ethernet cable that came with your firewall into a LAN port on the router (3) and insert the other end into the Ethernet port of your computer. Your network cables are connected and you are ready to restart your network. 5 1 4 2 3 2. RESTART YOUR NETWORK IN THE CORRECT SEQUENCE Warning: Failure to restart your network in the correct sequence could prevent you from connecting to the Internet. a. First, power on the broadband modems. Wait approximately 2 minutes until they power up. b. Now, power on the FVX538. c. Last, turn on your computer. d. Before configuring your FVX538, check the status lights to verify the following: • Power. The power light (5) should turn solid green. If it does not turn solid green, see the Troubleshooting section of the full manual. • Test. When you first turn on the router, the amber test light (4) will be lit for approximately 2 minutes. If it is still on after several minutes, see the Troubleshooting Tips below. • WAN. The Link/Act lights on each WAN port (1) and (2) should be lit. If not, make sure the Ethernet cable is securely attached to the modem and the WAN port, and that the modem is powered on. • LAN. A LAN light (3) should be lit. Green indicates your computer is communicating at 100 Mbps; amber indicates communication at 10 Mbps. If a LAN light is not lit, ensure that the Ethernet cable from the computer to the router is securely attached at both ends, and that the computer is turned on. Next, Configure the FVX538 for Internet Access Before you begin, be sure you have the configuration parameters from your ISP handy. 1. LOG IN TO THE ROUTER a. Use a browser to connect to http://192.168.1.1 Note: To connect to the firewall, your computer needs to be configured to obtain an IP address automatically via DHCP. If you need instructions on how to do this, please refer to the online reference manual. A link to the manual is on your Resource CD. http://192.168.1.1 b. For security reasons, the firewall has its own user name and password. When prompted, enter admin for the firewall User Name and password for the firewall Password. c. Click Login. You are now connected to the firewall. The WAN1 ISP Settings screen will display. The Web Support tab on the main menu contains links to the online NETGEAR FVX538 product documentation and support Knowledgebase. Be aware that the default login time-out is 5 minutes of inactivity, after which automatic logout wil occur. 2. CONNECT TO THE INTERNET a. Click Auto Detect at the bottom of the WAN1 ISP Settings screen. The router will automatically attempt to detect your connection type. If you know your ISP connection type, you can manually configure the router settings on the WAN1 ISP screen. If connecting manually, click Apply to save your settings. b. When finished, click Test to verify that the Internet connection is active. c. Select the WAN2 ISP tab and complete the same steps you just completed in steps a and b.

Application Note Configuring a Hub-and-Spoke VPN Using the NETGEAR VPN Client Summary A Hub-and-Spoke VPN allows multiple sites to communicate through a central hub site. This application note describes how to configure a Hub-and-Spoke VPN when one of the spokes is the NETGEAR VPN client. It has been tested with the FVX538 router, firmware version 2.x and NETGEAR ProSafe® VPN client, version 10.7.2 (Build 12). Note: See Hub-and-Spoke VPN for general instructions on configuration that does not use the VPN Client. In this configuration, there is a gateway-to-gateway VPN tunnel between FVX538 #1 and FVX538 #2. By establishing a VPN connection to the FVX538#1, the software VPN client gains access to Local Area Network #2 behind FVX538 #2 through FVX538 #1. Procedure This procedure was developed and tested using: • NETGEAR FVX538 ProSafe VPN Firewall with version 2.x firmware o WAN1 (10.1.1.2 ) IP address: 192.168.1.0 o WAN1 IP address subnet: 255.255.255.0 o WAN2 (10.1.2.2) IP address: 192.168.2.0