Page 1 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Re fe re nce Manual April 2013 202-10536-05 350 East Plumeria Drive San Jose, CA 95134...
Page 2 Trademarks NETGEAR, the NETGEAR logo, and Connect with Innovation are trademarks and/or registered trademarks of NETGEAR, Inc. and/or its subsidiaries in the United States and/or other countries. Information is subject to change without notice. © NETGEAR, Inc. All rights reserved.
Page 3 Attack Checks • Set Limits for IPv4 Sessions • Create IP Groups • Use the NETGEAR VPN Client Wizard to Create a Secure Connection • Manually Create a Secure Connection Using the NETGEAR VPN Client • Configure the ProSafe VPN Client for Mode Config Operation •...
Page 4: Table Of Contents
Contents Chapter 1 Introduction What Is the ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308? . 12 Key Features and Capabilities ........12 Quad-WAN Ports for Increased Reliability and Load Balancing.
Page 5 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Configure a Static IPv6 Internet Connection..... .58 Configure a PPPoE IPv6 Internet Connection ....61 Configure 6to4 Automatic Tunneling .
Page 6 Test the Connection and View Connection and Status Information ..227 Test the NETGEAR VPN Client Connection ....227 NETGEAR VPN Client Status and Log Information .
Page 7 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Configure Extended Authentication (XAUTH) .....245 Configure XAUTH for VPN Clients ......246 User Database Configuration .
Page 8 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Change Passwords and Other User Settings....318 Manage Digital Certificates for VPN Connections ....320 VPN Certificates Screen.
Page 9 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 LAN or WAN Port LEDs Not On ......394 Troubleshoot the Web Management Interface .
Page 10 What Is Two-Factor Authentication? ......450 NETGEAR Two-Factor Authentication Solutions ....451...
Page 11: Chapter 1 Introduction
Note: Firmware updates with new features and bug fixes are made available from time to time on downloadcenter.netgear.com. Some products can regularly check the site and download new firmware, or you can check for and download new firmware manually. If the features or behavior of your product do not match what is described in this guide, you might need to update your firmware.
Page 12: What Is The Prosafe Gigabit Quad Wan Ssl Vpn Firewall Srx5308
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 What Is the ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308? The ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308, hereafter referred to as the VPN firewall, connects your local area network (LAN) to the Internet through up to four external broadband access devices such as cable or DSL modems or satellite or wireless Internet dishes.
Page 13: Quad-Wan Ports For Increased Reliability And Load Balancing
Advanced IPSec VPN and SSL VPN support with support for up to 125 concurrent IPSec VPN tunnels and up to 50 concurrent SSL VPN tunnels. • Bundled with a single-user license of the NETGEAR ProSafe VPN Client software (VPN01L). •...
Page 14: Advanced Vpn Support For Both Ipsec And Ssl
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Advanced VPN Support for Both IPSec and SSL The VPN firewall supports IPSec and SSL virtual private network (VPN) connections: • IPSec VPN delivers full network access between a central office and branch offices, or between a central office and telecommuters.
Page 15: Security Features
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Security Features The VPN firewall is equipped with several features designed to maintain security: • Computers hidden by NAT. NAT opens a temporary path to the Internet for requests originating from the local network. Requests originating from outside the LAN are discarded, preventing users outside the LAN from finding and directly accessing the computers on the LAN.
Page 16: Easy Installation And Management
ISP account. • IPSec VPN Wizard. The VPN firewall includes the NETGEAR IPSec VPN Wizard so you can easily configure IPSec VPN tunnels according to the recommendations of the Virtual Private Network Consortium (VPNC).
Page 17: Maintenance And Support
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Maintenance and Support NETGEAR offers the following features to help you maximize your use of the VPN firewall: • Flash memory for firmware upgrades. • Technical support seven days a week, 24 hours a day. Information about support is available on the NETGEAR website at http://support.netgear.com/app/answers/detail/a_id/212.
Page 18 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 The front panel also contains three groups of status indicator light-emitting diodes (LEDs), including Power and Test LEDs, LAN LEDs, and WAN LEDs, all of which are described in the following table. DMZ LED Left WAN LEDs Power LED...
Page 19: Rear Panel
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 1. LED descriptions (continued) Activity Description DMZ LED On (green) Port 4 operates as a dedicated hardware DMZ port. Port 4 operates as a normal LAN port. WAN Ports Left LED On (green) The WAN port has a valid connection with a device that provides an Internet connection.
Page 20: Bottom Panel With Product Label
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 • Factory Defaults Reset button. Using a sharp object, press and hold this button for about 8 seconds until the front panel Test LED flashes to reset the VPN firewall to factory default settings.
Page 21: Use The Rack-Mounting Kit
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Installation Guide. A PDF of this guide is on the NETGEAR support website at http://kb.netgear.com/app/products/model/a_id/13568. To configure the VPN firewall, you need to use a web browser such as Microsoft Internet Explorer 7.0 or later, Mozilla Firefox 4.0 or later, or Apple Safari 3.0 or later with JavaScript,...
Page 22 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Note: The VPN firewall factory default IP address is 192.168.1.1. If you change the IP address, you need to use the IP address that you assigned to the VPN firewall to log in to the VPN firewall. Figure 5.
Page 23: Web Management Interface Menu Layout
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Click Login. The web management interface displays, showing the Router Status screen. The following figure shows the top part of the Router Status screen. For more information, View the System Status on page 369. Note: After 5 minutes of inactivity (the default login time-out), you are automatically logged out.
Page 24 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 The web management interface menu consists of the following components: • 1st level: Main navigation menu links. The main navigation menu in the orange bar across the top of the web management interface provides access to all the configuration functions of the VPN firewall, and remains constant.
Page 25: Requirements For Entering Ip Addresses
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 When a screen includes a table, table buttons display to let you configure the table entries. The nature of the screen determines which table buttons are shown. The following figure shows an example: Figure 9.
Page 26: Chapter 2 Ipv4 And Ipv6 Internet And Wan Settings
IPv4 and IPv6 Internet and WAN Settings This chapter explains how to configure the IPv4 and IPv6 Internet and WAN settings. The chapter contains the following sections: • Internet and WAN Configuration Tasks • Configure the IPv4 Internet Connection and WAN Settings •...
Page 27: Internet And Wan Configuration Tasks
Typically, the VPN firewall is installed as a network gateway to function as a combined LAN switch and firewall to protect the network from incoming threats and provide secure connections. To complement the firewall protection, NETGEAR advises that you use a gateway security appliance such as a NETGEAR ProSecure STM appliance.
Page 28: Roadmap To Setting Up Ipv6 Internet Connections To Your Isps
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 (Optional) Configure Dynamic DNS on the WAN interfaces. If necessary, configure your fully qualified domain names. This task is described in Configure Dynamic DNS on page 49. (Optional) Configure the WAN options. If necessary, change the factory default MTU size, port speed, and MAC address of the VPN firewall.
Page 29: Configure The Ipv4 Internet Connection And Wan Settings
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 (Optional) Configure the WAN options. If necessary, change the factory default MTU size, port speed, and MAC address of the VPN firewall. These are advanced features, and you usually do not need to change the settings. These tasks are described in Configure Advanced WAN Options and Other Tasks page 71.
Page 30: Classical Routing
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 • If your ISP has provided you with multiple public IP addresses, you can use one address as the primary shared address for Internet access by your computers, and you can map incoming traffic on the other public IP addresses to specific computers on your LAN.
Page 31: Let The Vpn Firewall Automatically Detect And Configure An Ipv4 Internet Connection
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Click Apply to save your settings. These settings apply to all WAN ports. Let the VPN Firewall Automatically Detect and Configure an IPv4 Internet Connection  To automatically configure a WAN port for an IPv4 connection to the Internet: Select Network Configuration >...
Page 32 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 12. Click the Auto Detect button at the bottom of the screen. The autodetect process probes the WAN port for a range of connection methods and suggests one that your ISP is most likely to support.
Page 33 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 2. IPv4 Internet connection methods Connection Method Manual Data Input Required DHCP (Dynamic IP) No manual data input is required. PPPoE The following fields are required: • Login • Password • Account Name •...
Page 34: Manually Configure An Ipv4 Internet Connection
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 13. The Connection Status screen should show a valid IP address and gateway, and you are connected to the Internet. If the configuration was not successful, skip ahead to Manually Configure an IPv4 Internet Connection on page 34, or see Troubleshoot the ISP Connection...
Page 35 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 The IPv4 WAN Settings table displays the following fields: • WAN. The WAN interface (WAN1, WAN2, WAN3, and WAN4). • Status. The status of the WAN interface (UP or DOWN). • WAN IP. The IPv4 address of the WAN interface. •...
Page 36 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 16. If your connection is PPTP or PPPoE, your ISP requires an initial login. Enter the settings as described in the following table: Table 3. PPTP and PPPoE settings Setting Description Austria (PPTP) If your ISP is Austria Telecom or any other ISP that uses PPTP for login, select this radio button, and enter the following settings:...
Page 37 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 3. PPTP and PPPoE settings (continued) Setting Description Other (PPPoE) If you have installed login software, your connection type is PPPoE. Select this radio button, and enter the following settings: Note: For login Account Name The valid account name for the PPPoE connection.
Page 38 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 4. Internet IP address settings Setting Description Get Dynamically If your ISP has not assigned you a static IP address, select the Get Dynamically from from ISP ISP radio button. The ISP automatically assigns an IP address to the VPN firewall using DHCP network protocol.
Page 39 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 5. DNS server settings Setting Description Get Automatically If your ISP has not assigned any Domain Name Server (DNS) addresses, select the from ISP Get Automatically from ISP radio button. Use These DNS If your ISP has assigned DNS addresses, select the Use These DNS Servers radio Servers button.
Page 40: Configure Load Balancing Or Auto-Rollover For Ipv4 Interfaces
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Note: If your ISP requires MAC authentication and another MAC address has been previously registered with your ISP, you need to enter that address on the WAN Advanced Options screen for the WAN interface (see Configure Advanced WAN Options and Other Tasks on page 71).
Page 41 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Configure Load Balancing Mode and Optional Protocol Binding for IPv4 Interfaces To use multiple ISP links simultaneously, configure load balancing. In load balancing mode, any WAN port carries any outbound protocol unless protocol binding is configured. When a protocol is bound to a particular WAN port, all outgoing traffic of that protocol is directed to the bound WAN port.
Page 42 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 b. From the corresponding drop-down list on the right, select one of the following load balancing methods: • Weighted LB. With weighted load balancing, balance weights are calculated based on WAN link speed and available WAN bandwidth. This is the default setting and most efficient load balancing algorithm.
Page 43 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 • Destination Network. The Internet locations (based on their IP address) or groups that are covered by the protocol binding rule. • Action. The Edit table button, which provides access to the Edit Protocol Binding screen for the corresponding service.
Page 44 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 6. Add Protocol Binding screen settings (continued) Setting Description Destination The destination network settings determine which Internet locations (based on their IP Network address) are covered by the rule. Select one of the following options from the drop-down list: All Internet IP address.
Page 45 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Configure the Auto-Rollover Mode and Failure Detection Method for IPv4 Interfaces To use a redundant ISP link for backup purposes, ensure that the backup WAN interface has already been configured. Then select the WAN interface that should function as the primary link for this mode, and configure the WAN failure detection method on the WAN Mode screen to support auto-rollover.
Page 46 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 In the Load Balancing Settings section of the screen, configure the following settings: a. Select the Primary WAN Mode radio button. b. From the corresponding drop-down list on the right, select a WAN interface to function as the primary WAN interface.
Page 47: Configure Secondary Wan Addresses
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 7. Failure detection method settings Setting Description Failure Detection Select a failure detection method from the drop-down list: Method • WAN DNS. DNS queries are sent to the DNS server that is configured in the Domain Name Server (DNS) Servers section of the WAN ISP screen (see Manually Configure an IPv4 Internet Connection on page 34).
Page 48 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 After you have configured secondary WAN addresses, these addresses are displayed on the following firewall rule screens: • In the WAN Destination IP Address drop-down lists of the following inbound firewall rule screens: Add LAN WAN Inbound Service screen Add DMZ WAN Inbound Service screen...
Page 49: Configure Dynamic Dns
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 25. The List of Secondary WAN addresses table displays the secondary LAN IP addresses added for the selected WAN interface. In the Add WAN Secondary Addresses section of the screen, enter the following settings: •...
Page 50 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 After you have configured your account information on the VPN firewall, when your ISP-assigned IP address changes, your VPN firewall automatically contacts your DDNS service provider, logs in to your account, and registers your new IP address. Consider the following: •...
Page 51 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 26. Click the Information option arrow in the upper right of a DNS screen for registration information (for example, DynDNS Information). Figure 27. Access the website of the DDNS service provider, and register for an account (for example, for DynDNS.org, go to http://www.dyndns.com/).
Page 52: Configure The Ipv6 Internet Connection And Wan Settings
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Configure the DDNS service settings as described in the following table: Table 8. DDNS service settings Setting Description WAN1 (... Status: ...) Select the Yes radio button to enable the DDNS service. The fields that display on the screen depend on the DDNS service provider that you have selected.
Page 53: Configure The Ipv6 Routing Mode
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Note: You can configure only one WAN interface for IPv6. This restriction might be lifted in a later release. You can configure the other three WAN interfaces for IPv4. The nature of your IPv6 network determines how you need to configure the IPv6 Internet connections: •...
Page 54 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 These are the options: • IPv4-only mode. The VPN firewall communicates only with devices that have IPv4 addresses. • IPv4/IPv6 mode. The VPN firewall communicates with both devices that have IPv4 addresses and devices that have IPv6 addresses. Note: IPv6 always functions in classical routing mode between the WAN interface and the LAN interfaces;...
Page 55: Use A Dhcpv6 Server To Configure An Ipv6 Internet Connection
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 WARNING: Changing the IP routing mode causes the VPN firewall to reboot. Click Apply to save your changes. Use a DHCPv6 Server to Configure an IPv6 Internet Connection The VPN firewall can autoconfigure its ISP settings through a DHCPv6 server by using either stateless or stateful address autoconfiguration: •...
Page 56 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 The IPv6 WAN Settings table displays the following fields: • WAN. The WAN interface (WAN1, WAN2, WAN3, and WAN4). • Status. The status of the WAN interface (UP or DOWN). • WAN IP. The IPv6 address of the WAN interface. •...
Page 57 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 As an optional step: If you have selected the Stateless Address Auto Configuration radio button, you can select the Prefix Delegation check box: • Prefix delegation check box is selected. A prefix is assigned by the ISP’s stateful DHCPv6 server through prefix delegation, for example, 2001:db8:: /64.
Page 58: Configure A Static Ipv6 Internet Connection
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Configure a Static IPv6 Internet Connection To configure a static IPv6 or PPPoE IPv6 Internet connection, you need to enter the IPv6 address information that you should have received from your ISP. ...
Page 59 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 33. In the Internet Address section of the screen, from the IPv6 drop-down list, select Static IPv6. In the Static IP Address section of the screen, enter the settings as described in the following table.
Page 60 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Click Apply to save your changes. Verify the connection: a. Select Network Configuration > WAN Settings > WAN Setup. b. In the upper right of the screen, select the IPv6 radio button. The WAN Setup screen displays the IPv6 settings (see Figure 32 on page 58).
Page 61: Configure A Pppoe Ipv6 Internet Connection
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Configure a PPPoE IPv6 Internet Connection To configure a PPPoE IPv6 Internet connection, you need to enter the PPPoE IPv6 information that you should have received from your ISP.  To configure PPPoE IPv6 ISP settings for a WAN interface: Select Network Configuration >...
Page 62 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 36. In the Internet Address section of the screen, from the IPv6 drop-down list, select PPPoE. In the PPPoE IPv6 section of the screen, enter the settings as described in the following table.
Page 63 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 10. WAN IPv6 ISP Settings screen settings for a PPPoE IPv6 connection (continued) Setting Description DHCPv6 Option From the DHCPv6 Option drop-down list, select one of the following DHCPv6 server options, as directed by your ISP: •...
Page 64: Configure 6To4 Automatic Tunneling
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Note: If your ISP requires MAC authentication and another MAC address has been previously registered with your ISP, you need to enter that address on the WAN Advanced Options screen for the corresponding WAN interface (see Configure Advanced WAN Options and Other Tasks...
Page 65: Configure Isatap Automatic Tunneling
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 37. Select the Enable Automatic Tunneling check box. Click Apply to save your changes. Configure ISATAP Automatic Tunneling If your network is an IPv4 network or IPv6 network that consists of both IPv4 and IPv6 devices, you need to make sure that the IPv6 packets can travel over the IPv4 intranet by enabling and configuring Intra-Site Automatic Tunnel Addressing Protocol (ISATAP) tunneling.
Page 66 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308  To configure an ISATAP tunnel: Select Network Configuration > WAN Settings > ISATAP Tunnels. The ISATAP Tunnels screen displays. (The following figure shows some examples.) Figure 38. Click the Add table button under the List of Available ISATAP Tunnels table. The Add ISATAP Tunnel screen displays: Figure 39.
Page 67: View The Tunnel Status And Ipv6 Addresses
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308  To edit an ISATAP tunnel: On the ISATAP Tunnels screen, click the Edit button in the Action column for the tunnel that you want to modify. The Edit ISATAP Tunnel screen displays. This screen is identical to the Add ISATAP Tunnel screen.
Page 68: Configure Auto-Rollover For Ipv6 Interfaces
IPv6 address so that the IPv4-translated address becomes 0::ffff:0:a.b.c.d/96. For SIIT to function, the routing mode needs to be IPv4 / IPv6. NETGEAR’s implementation of SIIT lets you enter a single IPv4 address on the SIIT screen. This IPv4 address is then used in the IPv4-translated address for IPv6 devices to enable communication between IPv4-only devices on the VPN firewall’s LAN and IPv6-only devices on the WAN.
Page 69 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 To use a redundant ISP link for backup purposes, ensure that the backup WAN interface has already been configured. Then select the WAN interface that should function as the primary link for this mode, and configure the WAN failure detection method on the WAN Mode screen to support auto-rollover.
Page 70 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Note: Ensure that the backup WAN interface is configured before enabling auto-rollover mode. Click Apply to save your settings. Configure the Failure Detection Method for IPv6 Interfaces  To configure the failure detection method: Select Network Configuration >...
Page 71: Configure Advanced Wan Options And Other Tasks
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Note: The default time to roll over after the primary WAN interface has failed is 2 minutes. The minimum test period is 30 seconds, and the minimum number of tests is 2. Click Apply to save your settings.
Page 72 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 45. Click the Advanced option arrow in the upper right of the screen. The WAN Advanced Options screen displays for the WAN interface that you selected. (The following figure shows the WAN2 Advanced Options screen as an example.) IPv4 and IPv6 Internet and WAN Settings...
Page 73 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 46. Enter the settings as described in the following table: Table 13. WAN Advanced Options screen settings Setting Description MTU Size Make one of the following selections: Default Select the Default radio button for the normal maximum transmit unit (MTU) value.
Page 74 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 13. WAN Advanced Options screen settings (continued) Setting Description Speed In most cases, the VPN firewall can automatically determine the connection speed of the WAN port of the device (modem, dish, or router) that provides the WAN connection. If you cannot establish an Internet connection, you might need to manually select the port speed.
Page 75 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 13. WAN Advanced Options screen settings (continued) Setting Description Failure Detection Method Note: This is the failure detection method for IPv4 interfaces. For information about failure detection for IPfv6 interfaces, see Configure the Failure Detection Method for IPv6 Interfaces on page 70.
Page 76: Configure Wan Qos Profiles
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 WARNING: Depending on the changes that you made, when you click Apply, the VPN firewall might restart, or services such as HTTP and SMTP might restart. If you want to configure the advanced settings for an additional WAN interface, select another WAN interface and repeat these steps.
Page 77 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Note: To configure and apply QoS profiles successfully, familiarity with QoS concepts such QoS priority queues, IP precedence, DHCP, and their values is helpful.  To enable and configure QoS for the WAN interfaces: Select Network Configuration >...
Page 78 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 • Hosts. The IP address, IP addresses, or group to which the rate control profile applies. (The information in this column does not apply to priority profiles). • Action. The Edit table button provides access to the Edit QoS screen for the corresponding profile.
Page 79 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 14. Add QoS screen settings for a rate control profile (continued) Setting Description Diffserv QoS Match Enter a DSCP value in the range of 0 through 63. Packets are classified against this value.
Page 80 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 14. Add QoS screen settings for a rate control profile (continued) Setting Description Inbound Maximum Enter the inbound maximum bandwidth in Kbps that is allocated to the host. Bandwidth Diffserv QoS Remark Enter a DSCP value in the range of 0 through 63.
Page 81 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 15. Add QoS screen settings for a priority profile (continued) Setting Description Service From the drop-down list, select a service or application to be covered by this profile. If the service or application does not appear in the list, you need to define it using the Services screen (see Add Customized Services page 177).
Page 82: Additional Wan-Related Configuration Tasks
If you want the ability to manage the VPN firewall remotely, enable remote management (see Configure Remote Management Access on page 338). If you enable remote management, NETGEAR strongly recommends that you change your password (see Change Passwords and Administrator and Guest Settings on page 336).
Page 83: Chapter 3 Lan Configuration
LAN Configuration This chapter describes how to configure the LAN features of your VPN firewall. The chapter contains the following sections: • Manage IPv4 Virtual LANs and DHCP Options • Configure IPv4 Multihome LAN IP Addresses on the Default VLAN •...
Page 84: Manage Ipv4 Virtual Lans And Dhcp Options
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Manage IPv4 Virtual LANs and DHCP Options • Port-Based VLANs • Assign and Manage VLAN Profiles • VLAN DHCP Options • Configure a VLAN Profile • Configure VLAN MAC Addresses and LAN Advanced Settings A local area network (LAN) can generally be defined as a broadcast domain.
Page 85: Port-Based Vlans
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Port-Based VLANs The VPN firewall supports port-based VLANs. Port-based VLANs help to confine broadcast traffic to the LAN ports. Even though a LAN port can be a member of more than one VLAN, the port can have only one VLAN ID as its port VLAN identifier (PVID).
Page 86: Assign And Manage Vlan Profiles
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Assign and Manage VLAN Profiles  To assign VLAN profiles to the LAN ports and manage VLAN profiles: Select Network Configuration > LAN Setting. In the upper right of the screen, the IPv4 radio button is selected by default.
Page 87: Vlan Dhcp Options
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 VLAN DHCP Options For each VLAN, you need to specify the Dynamic Host Configuration Protocol (DHCP) options (see Configure a VLAN Profile on page 88). The configuration of the DHCP options for the VPN firewall’s default VLAN, or VLAN 1, is described in Configure the IPv4 Internet Connection and WAN Settings on page 29.
Page 88: Configure A Vlan Profile
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 firewall’s LAN IP address). When the DNS proxy option is disabled for a VLAN, all DHCP clients receive the DNS IP addresses of the ISP but without the DNS proxy IP address. LDAP Server A Lightweight Directory Access Protocol (LDAP) server allows a user to query and modify directory services that run over TCP/IP.
Page 89 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 52. Enter the settings as described in the following table: Table 16. Add VLAN Profile screen settings Setting Description VLAN Profile Profile Name Enter a unique name for the VLAN profile. VLAN ID Enter a unique ID number for the VLAN profile.
Page 90 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 16. Add VLAN Profile screen settings (continued) Setting Description Port Membership Port 1, Port 2, Port 3, Select one, several, or all port check boxes to make the ports members of this Port 4 / DMZ VLAN.
Page 91 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 16. Add VLAN Profile screen settings (continued) Setting Description Enable DHCP Server Select the Enable DHCP Server radio button to enable the VPN firewall to function as a Dynamic Host Configuration Protocol (DHCP) server, providing TCP/IP configuration for all computers connected to the VLAN.
Page 92 O (for organization) • C (for country) • DC (for domain) For example, to search the Netgear.net domain for all last names of Johnson, you would enter: cn=Johnson,dc=Netgear,dc=net Port The port number for the LDAP server. The default setting is 0 (zero).
Page 93: Configure Vlan Mac Addresses And Lan Advanced Settings
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308  To edit a VLAN profile: On the LAN Setup screen for IPv4 (see Figure 51 on page 88), click the Edit button in the Action column for the VLAN profile that you want to modify. The Edit VLAN Profile screen displays.
Page 94: Configure Ipv4 Multihome Lan Ip Addresses On The Default Vlan
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 53. From the MAC Address for VLANs drop-down list, select Unique. (The default is Same.) As an option, you can disable the broadcast of ARP packets for the default VLAN by clearing the Enable ARP Broadcast check box.
Page 95: The Following Is An Example Of Correctly Configured Ip Addresses
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 The following is an example of correctly configured IPv4 addresses: • WAN IP address. 10.0.0.1 with subnet 255.0.0.0 • DMZ IP address. 176.16.2.1 with subnet 255.255.255.0 • Primary LAN IP address. 192.168.1.1 with subnet 255.255.255.0 •...
Page 96: Manage Ipv4 Groups And Hosts (Ipv4 Lan Groups)
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Modify the IP address or subnet mask, or both. Click Apply to save your settings.  To delete one or more secondary LAN IP addresses: On the LAN Multi-homing screen for IPv4 (see the previous figure), select the check box to the left of each secondary IP address that you want to delete, or click the Select All table button to select secondary IP addresses.
Page 97: Manage The Network Database
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 • There is no need to reserve an IP address for a computer in the DHCP server. All IP address assignments made by the DHCP server are maintained until the computer or device is removed from the network database, either by expiration (inactive for a long time) or by you.
Page 98 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 The Known PCs and Devices table lists the entries in the network database. For each computer or device, the following fields display: • Check box. Allows you to select the computer or device in the table. •...
Page 99 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 17. Add Known PCs and Devices section settings (continued) Setting Description IP Address Enter the IP address that this computer or device is assigned to: • If the IP address type is Fixed (set on PC), the IP address needs to be outside of the address range that is allocated to the DHCP server pool to prevent the IP address from also being allocated by the DHCP server.
Page 100: Change Group Names In The Network Database
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 56. Modify the settings as described in Table 17 on page 98. Click Apply to save your settings in the Known PCs and Devices table. Deleting Computers or Devices from the Network Database ...
Page 101: Set Up Dhcp Address Reservation
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 57. Select the radio button next to the group name that you want to change. Type a new name in the field. The maximum number of characters is 15. Do not use a double quote (''), single quote('), or space in the name.
Page 102: Manage The Ipv6 Lan
LAN use. Note: Site-local addresses, that is, addresses that start with fec0, have been depreciated. However, NETGEAR has implemented a site-local address as a temporary default IPv6 LAN address that you can replace with another LAN address. The firewall restricts external communication of this default site-local address.
Page 103: Dhcpv6 Server Options
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 DHCPv6 Server Options The IPv6 clients in the LAN can autoconfigure their own IPv6 address or obtain an IPv6 address through a DHCPv6 server. For the LAN, there are three DHCPv6 options: Stateless DHCPv6 Server The IPv6 clients in the LAN generate their own IP address by using a combination of locally available information and router advertisements, but receive DNS server information from the...
Page 104: Configure The Ipv6 Lan
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Stateful DHCPv6 Server The IPv6 clients in the LAN obtain an interface IP address, configuration information such as DNS server information, and other parameters from the DHCPv6 server. The IP address is a dynamic address.
Page 105: Configure The Ipv6 Router Advertisement Daemon And
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Enter the settings as described in the following table. The IPv6 address pools and prefixes for prefix delegation are described in the sections following the table. Table 18. LAN Setup screen settings for IPv6 Setting Description IPv6 LAN Setup...
Page 106: Ipv6 Lan Address Pools
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 18. LAN Setup screen settings for IPv6 (continued) Setting Description DHCP Status Server Preference Enter the DHCP server preference value. The possible values (continued) are 0–255, with 255 as the default setting. This is an optional setting that specifies the server’s preference value in a server advertise message.
Page 107 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 59. Enter the settings as described in the following table: Table 19. LAN IPv6 Config screen settings Setting Description Start IPv6 Address Enter the start IP address. This address specifies the first of the contiguous addresses in the IP address pool.
Page 108 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Delegation table to enable the DHCPv6 server to assign these prefixes to its IPv6 LAN clients.  To add an IPv6 prefix: On the LAN Setup screen for IPv6, under the List of Prefixes for Prefix Delegation table, click Add.
Page 109: Configure The Ipv6 Router Advertisement Daemon And Advertisement Prefixes For The Lan
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Configure the IPv6 Router Advertisement Daemon and Advertisement Prefixes for the LAN Note: If you do not configure stateful DHCPv6 for the LAN but use stateless DHCPv6, you need to configure the Router Advertisement Deamon (RADVD) and advertisement prefixes.
Page 110: Figure
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308  To configure the Router Advertisement Daemon for the LAN: Select Network Configuration > LAN Settings. In the upper right of the screen, select the IPv6 radio button. The LAN Setup screen displays the IPv6 settings (see Figure 58 on page 104.)
Page 111: Advertisement Prefixes For The Lan
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 21. RADVD screen settings for the LAN (continued) Setting Description RA Flags Specify what type of information the DHCPv6 server provides in the LAN by making a selection from the drop-down list: •...
Page 112 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 62. Enter the settings as described in the following table: Table 22. Add Advertise Prefixes screen settings for the LAN Setting Description IPv6 Prefix Type Specify the IPv6 prefix type by making a selection from the drop-down list: •...
Page 113: Configure Ipv6 Multihome Lan Ip Addresses On The Default Vlan
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Click Apply to save your settings.  To delete one or more advertisement prefixes: On the RADVD screen for the LAN (see Figure 61 on page 110), select the check box to the left of each advertisement prefix that you want to delete, or click the Select All table button to select all advertisement prefixes.
Page 114: Enable And Configure The Dmz Port For Ipv4 And Ipv6 Traffic
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 In the Add Secondary LAN IP Address section of the screen, enter the following settings: • IPv6 Address. Enter the secondary address that you want to assign to the LAN ports. • Prefix Length.
Page 115: Dmz Port For Ipv4 Traffic
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 By default, the DMZ port and both inbound and outbound DMZ traffic are disabled. Enabling the DMZ port and allowing traffic to and from the DMZ increases the traffic through the WAN ports.
Page 116 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 64. Enter the settings as described in the following table: Table 23. DMZ Setup screen settings for IPv4 Setting Description DMZ Port Setup Do you want to Select one of the following radio buttons: enable DMZ Port? •...
Page 117 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 23. DMZ Setup screen settings for IPv4 (continued) Setting Description DHCP for DMZ Connected Computers Disable DHCP Server If another device on your network is the DHCP server for the VLAN, or if you intend to manually configure the network settings of all of your computers, select the Disable DHCP Server radio button to disable the DHCP server.
Page 118: Dmz Port For Ipv6 Traffic
O (for organization) • C (for country) • DC (for domain) For example, to search the Netgear.net domain for all last names of Johnson, you would enter: cn=Johnson,dc=Netgear,dc=net Port The port number for the LDAP server. The default setting is 0 (zero).
Page 119 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 For the DMZ, there are two DHCPv6 server options: • Stateless DHCPv6 server. The IPv6 clients in the DMZ generate their own IP address by using a combination of locally available information and router advertisements, but receive DNS server information from the DHCPv6 server.
Page 120 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Enter the settings as described in the following table: Table 24. DMZ Setup screen settings for IPv6 Setting Description DMZ Port Setup Do you want to Select one of the following radio buttons: enable DMZ Port? •...
Page 121 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 24. DMZ Setup screen settings for IPv6 (continued) Setting Description DHCP Status DNS Server Select one of the DNS server options from the drop-down lists: (continued) • Use DNS Proxy. The VPN firewall acts as a proxy for all DNS requests and communicates with the ISP’s DNS servers that you configured on the WAN IPv6 ISP Settings screen (see...
Page 122: Configure The Ipv6 Router Advertisement Daemon And Advertisement Prefixes For The Dmz
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Enter the settings as described in the following table: Table 25. DMZ IPv6 Config screen settings Setting Description Start IPv6 Address Enter the start IP address. This address specifies the first of the contiguous addresses in the IP address pool.
Page 123 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Hosts and routers in the LAN use NDP to determine the link-layer addresses and related information of neighbors in the LAN that can forward packets on their behalf. The VPN firewall periodically distributes router advertisements (RAs) throughout the DMZ to provide such information to the hosts and routers in the DMZ.
Page 124 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 67. Enter the settings as described in the following table: Table 27. RADVD screen settings for the DMZ Setting Description RADVD Status Specify the RADVD status by making a selection from the drop-down list: •...
Page 125 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 27. RADVD screen settings for the DMZ (continued) Setting Description RA Flags Specify what type of information the DHCPv6 server provides in the DMZ by making a selection from the drop-down list: •...
Page 126 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 68. Enter the settings as described in the following table: Table 28. Add Advertisement Prefix screen settings for the DMZ Setting Description IPv6 Prefix Type Specify the IPv6 prefix type by making a selection from the drop-down list: •...
Page 127: Manage Static Ipv4 Routing
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Click Apply to save your settings.  To delete one or more advertisement prefixes: On the RADVD screen for the DMZ screen (see Figure 67 on page 124), select the check box to the left of each advertisement prefix that you want to delete, or click the Select All table button to select all advertisement prefixes.
Page 128 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Click the Add table button under the Static Routes table. The Add Static Route screen displays: Figure 70. Enter the settings as described in the following table: Table 29. Add Static Route screen settings for IPv4 Setting Description Route Name...
Page 129: Configure The Routing Information Protocol
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 displays. This screen is identical to the Add Static Route screen (see the previous figure). Modify the settings as described in the previous table. Click Apply to save your settings.  To delete one or more routes: On the Static Routing screen for IPv4 (see Figure 69 on page 127), select the check box...
Page 130 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Enter the settings as described in the following table: Table 30. RIP Configuration screen settings Setting Description RIP Direction From the RIP Direction drop-down list, select the direction in which the VPN firewall sends and receives RIP packets: •...
Page 131: Ipv4 Static Route Example
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 30. RIP Configuration screen settings (continued) Setting Description Authentication for Not Valid Before The beginning of the lifetime of the MD5 key. Enter the month, RIP-2B/2M required? date, year, hour, minute, and second. Before this date and (continued) time, the MD5 key is not valid.
Page 132: Manage Static Ipv6 Routing
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Manage Static IPv6 Routing NETGEAR’s implementation of IPv6 does not support RIP next generation (RIPng) to exchange routing information, and dynamic changes to IPv6 routes are not possible. To enable routers to exchange information over a static IPv6 route, you need to manually configure the static route information on each router.
Page 133 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Enter the settings as described in the following table: Table 31. Add IPv6 Static Routing screen settings Setting Description Route Name The route name for the static route (for purposes of identification and management).
Page 134: Chapter 4 Firewall Protection
Firewall Protection This chapter describes how to use the firewall features of the VPN firewall to protect your network. The chapter contains the following sections: • About Firewall Protection • Overview of Rules to Block or Allow Specific Kinds of Traffic •...
Page 135: About Firewall Protection
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 About Firewall Protection A firewall protects one network (the trusted network, such as your LAN) from another (the untrusted network, such as the Internet), while allowing communication between the two. You can further segment keyword blocking to certain known groups. For information about how to set up LAN groups, see Manage IPv4 Groups and Hosts (IPv4 LAN Groups) on page 96.
Page 136: Overview Of Rules To Block Or Allow Specific Kinds Of Traffic
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Overview of Rules to Block or Allow Specific Kinds of Traffic • Outbound Rules (Service Blocking) • Inbound Rules (Port Forwarding) • Order of Precedence for Rules Firewall rules are used to block or allow specific traffic passing through from one side to the other.
Page 137: Outbound Rules (Service Blocking)
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 • Bandwidth profiles. After you have a configured a bandwidth profile (see Create Bandwidth Profiles on page 181), you can assign it to a rule. Outbound Rules (Service Blocking) The VPN firewall allows you to block the use of certain Internet services by computers on your network.
Page 138 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 33. Outbound rules overview (continued) Setting Description Outbound Rules Select Schedule The time schedule (that is, Schedule1, Schedule2, or Schedule3) All rules when BLOCK that is used by this rule. by schedule, otherwise allow or ALLOW by •...
Page 139 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 33. Outbound rules overview (continued) Setting Description Outbound Rules QoS Profile The priority assigned to IP packets of this service. The priorities QoS Profile: are defined by Type of Service in the Internet Protocol Suite •...
Page 140: Inbound Rules (Port Forwarding)
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Inbound Rules (Port Forwarding) If you have enabled Network Address Translation (NAT), your network presents one IP address only to the Internet, and outside users cannot directly access any of your local computers (LAN users).
Page 141 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Note: When the Block TCP Flood and Block UDP Flood check boxes are selected on the Attack Checks screen (which they are by default; Attack Checks on page 170), multiple concurrent connections of the same application from one host or IP address (such as multiple DNS queries from one computer) trigger the VPN firewall’s DoS protection.
Page 142 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 34. Inbound rules overview (continued) Setting Description Inbound Rules Send to LAN Server The LAN server address determines which computer on your IPv4 LAN WAN rules network is hosting this service rule. (You can also translate this address to a port number.) The options are: •...
Page 143 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 34. Inbound rules overview (continued) Setting Description Inbound Rules WAN Users The settings that determine which Internet locations are covered LAN WAN rules by the rule, based on their IP address. The options are: DMZ WAN rules •...
Page 144: Order Of Precedence For Rules
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 34. Inbound rules overview (continued) Setting Description Inbound Rules Bandwidth Profile Bandwidth limiting determines how the data is sent to and from IPv4 LAN WAN rules your host. The purpose of bandwidth limiting is to provide a solution for limiting the outgoing and incoming traffic, thus preventing the LAN users from consuming all the bandwidth of the Internet link.
Page 145: Configure Lan Wan Rules
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 For any traffic attempting to pass through the firewall, the packet information is subjected to the rules in the order shown in the Outbound Services and Inbound Services tables, beginning at the top of each table and proceeding to the bottom of each table. In some cases, the order of precedence of two or more rules might be important in determining the disposition of a packet.
Page 146: Figure
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 To change an existing outbound or inbound service rule, in the Action column to the right of the rule, click one of the following table buttons: • Up. Moves the rule up one position in the table rank. •...
Page 147: Create Lan Wan Outbound Service Rules
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308  To enable, disable, or delete one or more IPv4 or IPv6 rules: Select the check box to the left of each rule that you want to enable, disable, or delete, or click the Select All table button to select all rules. Click one of the following table buttons: •...
Page 148 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 77. Enter the settings as described in Table 33 on page 137. In addition to selections from the Service, Action, and Log drop-down lists, you need to make selections from the following drop-down lists: •...
Page 149: Create Lan Wan Inbound Service Rules
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 78. Enter the settings as described in Table 33 on page 137. In addition to selections from the Service, Action, and Log drop-down lists, you need to make selections from the following drop-down lists: •...
Page 150 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 IPv4 LAN WAN Inbound Service Rules  To create an IPv4 LAN WAN inbound rule: In the upper right of the LAN WAN Rules screen, the IPv4 radio button is selected by default. The screen displays the IPv4 settings (see Figure 75 on page 145).
Page 151 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 The following configurations are optional: • Translate to Port Number • QoS Profile • Bandwidth Profile Click Apply to save your changes. The new rule is now added to the Inbound Services table.
Page 152: Configure Dmz Wan Rules
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Configure DMZ WAN Rules • Create DMZ WAN Outbound Service Rules • Create LAN WAN Inbound Service Rules The firewall rules for traffic between the DMZ and the Internet are configured on the DMZ WAN Rules screen.
Page 153 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 To change an existing outbound or inbound service rule, in the Action column to the right of the rule, click one of the following table buttons: • Up. Moves the rule up one position in the table rank. •...
Page 154: Create Dmz Wan Outbound Service Rules
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308  To enable, disable, or delete one or more IPv4 or IPv6 rules: Select the check box to the left of each rule that you want to enable, disable, or delete, or click the Select All table button to select all rules. Click one of the following table buttons: •...
Page 155 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Enter the settings as described in Table 33 on page 137. In addition to selections from the Service, Action, and Log drop-down lists, you need to make selections from the following drop-down lists: •...
Page 156: Create Dmz Wan Inbound Service Rules
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Unless your selection from the Action drop-down list is BLOCK always, you also need to make selections from the following drop-down lists: • Select Schedule • QoS Priority Click Apply. The new rule is now added to the Outbound Services table. The rule is automatically enabled.
Page 157 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Enter the settings as described in Table 34 on page 141. In addition to selections from the Service, Action, and Log drop-down lists, you need to make selections from the following drop-down lists: •...
Page 158: Configure Lan Dmz Rules
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Unless your selection from the Action drop-down list is BLOCK always, you also need to make selections from the following drop-down list: • Select Schedule Click Apply to save your changes. The new rule is now added to the Inbound Services table.
Page 159 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 To change an existing outbound or inbound service rule, in the Action column to the right of the rule, click one of the following table buttons: • Up. Moves the rule up one position in the table rank. •...
Page 160: Create Lan Dmz Outbound Service Rules
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Click one of the following table buttons: • Enable. Enables the rule or rules. The ! status icon changes from a gray circle to a green circle, indicating that the selected rule or rules are enabled. (By default, when a rule is added to the table, it is automatically enabled.) •...
Page 161 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Unless your selection from the Action drop-down list is BLOCK always, you also need to make a selection from the following drop-down list: • Select Schedule Click Apply. The new rule is now added to the Outbound Services table. The rule is automatically enabled.
Page 162: Create Lan Dmz Inbound Service Rules
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Create LAN DMZ Inbound Service Rules The Inbound Services table lists all existing rules for inbound traffic. If you have not defined any rules, no rules are listed. By default, all inbound traffic (from the LAN to the DMZ) is blocked.
Page 163 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 IPv6 LAN DMZ Inbound Service Rules  To create an IPv6 LAN DMZ inbound rule: In the upper right of the LAN DMZ Rules screen, select the IPv6 radio button. The screen displays the IPv6 settings (see Figure 88 on page 159).
Page 164: Examples Of Firewall Rules
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Examples of Firewall Rules • Examples of Inbound Firewall Rules • Examples of Outbound Firewall Rules Examples of Inbound Firewall Rules IPv4 LAN WAN Inbound Rule: Host a Local Public Web Server If you host a public web server on your local network, you can define a rule to allow inbound web (HTTP) requests from any outside IP address to the IP address of your web server at any time of the day.
Page 165 LAN. The following addressing scheme is used to illustrate this procedure: • NETGEAR VPN firewall: WAN IP address. 10.1.0.118 LAN IP address subnet. 192.168.1.1 with subnet 255.255.255.0 DMZ IP address subnet. 176.16.10.1 with subnet 255.255.255.0 •...
Page 166 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Tip: If you arrange with your ISP to have more than one public IP address for your use, you can use the additional public IP addresses to map to servers on your LAN or DMZ. One of these public IP addresses is used as the primary IP address of the router that provides Internet access to your LAN computers through NAT.
Page 167 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 this address on the WAN2 Secondary Addresses screen (see Configure Secondary WAN Addresses on page 47) before you can select it from the WAN Destination IP Address drop-down list. Click Apply to save your settings. The rule is now added to the Inbound Services table of the LAN WAN Rules screen.
Page 168: Examples Of Outbound Firewall Rules
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 WARNING: For security, NETGEAR strongly recommends that you avoid creating an exposed host. When a computer is designated as the exposed host, it loses much of the protection of the firewall and is exposed to many exploits from the Internet.
Page 169 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 98. IPv6 DMZ WAN Outbound Rule: Allow a Group of DMZ User to Access an FTP Site on the Internet If you want to allow a group of DMZ users to access a particular FTP site on the Internet during working hours, you can create an outbound rule to allow such traffic by specifying the IPv6 DMZ start and finish addresses and the IPv6 WAN address.
Page 170: Configure Other Firewall Features
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Configure Other Firewall Features • Attack Checks • Set Limits for IPv4 Sessions • Configure Multicast Pass-Through for IPv4 Traffic • Manage the Application Level Gateway for SIP Sessions You can configure attack checks, set session limits, configure multicast pass-through, and manage the application level gateway (ALG) for SIP sessions.
Page 171 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Enter the settings as described in the following table: Table 35. Attack Checks screen settings for IPv4 Setting Description WAN Security Checks Respond to Ping on Select the Respond to Ping on Internet Ports check box to enable the VPN firewall Internet Ports to respond to a ping from the Internet to its IPv4 address.
Page 172 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 35. Attack Checks screen settings for IPv4 (continued) Setting Description VPN Pass through IPSec When the VPN firewall functions in NAT mode, all packets going to the remote VPN gateway are first filtered through NAT and then encrypted according to the VPN PPTP policy.
Page 173: Set Limits For Ipv4 Sessions
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Set Limits for IPv4 Sessions The session limits feature allows you to specify the total number of sessions that are allowed, per user, over an IPv4 connection across the VPN firewall. The session limits feature is disabled by default.
Page 174: Configure Multicast Pass-Through For Ipv4 Traffic
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 36. Session Limit screen settings (continued) Setting Description User Limit Parameter From the User Limit Parameter drop-down list, select one of the following options: • Percentage of Max Sessions. A percentage of the total session connection capacity of the VPN firewall.
Page 175 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 103. In the Multicast Pass through section of the screen, select the Yes radio button to enable multicast pass-through. (By default, the Yes radio button is selected and multicast pass-through is enabled.) When you enable multicast pass-through, an Internet Group Management Protocol (IGMP) proxy is enabled for the upstream (WAN) and downstream (LAN) interfaces.
Page 176: Manage The Application Level Gateway For Sip Sessions
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308  To delete one or more multicast source addresses: In the Alternate Networks table, select the check box to the left of each address that you want to delete, or click the Select All table button to select all addresses. Click the Delete table button.
Page 177: Add Customized Services
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 • QoS profiles and priorities. A Quality of Service (QoS) profile defines the relative priority of an IP packet for traffic that matches the firewall rule. For information about creating QoS profiles for IPv4 firewall rules, see Create Quality of Service Profiles for IPv4 Firewall Rules on page 184.
Page 178 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 105. In the Add Customer Service section of the screen, enter the settings as described in the following table: Table 37. Services screen settings Setting Description Name A descriptive name of the service for identification and management purposes. Type From the Type drop-down list, select the Layer 3 protocol that the service uses as its transport protocol:...
Page 179: Create Ip Groups
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 106. Modify the settings that you wish to change (see the previous table). Click Apply to save your changes. The modified service is displayed in the Custom Services table.  To delete one or more services: In the Custom Services table, select the check box to the left of each service that you want to delete, or click the Select All table button to select all services.
Page 180 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 In the Add New Custom IP Group section of the screen, do the following: • In the IP Group Name field, enter a name for the group. • From the IP Group Type drop-down list, select LAN Group or WAN Group. Click Apply to save your changes.
Page 181: Create Bandwidth Profiles
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308  To delete an IP group: In the Custom IP Groups table, select the check box to the left of the IP group that you want to delete, or click the Select All table button to select all groups. Click the Delete table button.
Page 182 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 109. Under the List of Bandwidth Profiles table, click the Add table button. The Add Bandwidth Profile screen displays: Figure 110. Enter the settings as described in the following table: Table 38. Add Bandwidth Profile screen settings Setting Description Profile Name...
Page 183 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 38. Add Bandwidth Profile screen settings (continued) Setting Description Inbound Minimum The inbound minimum allocated bandwidth in Kbps. There is no default setting. Bandwidth Inbound Maximum The inbound maximum allowed bandwidth in Kbps. The maximum allowable Bandwidth bandwidth is 100,000 Kbps, and you cannot configure less than 100 Kbps.
Page 184: Create Quality Of Service Profiles For Ipv4 Firewall Rules
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Create Quality of Service Profiles for IPv4 Firewall Rules A Quality of Service (QoS) profile defines the relative priority of an IP packet when multiple connections are scheduled for simultaneous transmission on the VPN firewall. A QoS profile becomes active only when it is associated with a nonblocking inbound or outbound firewall rule or service, and traffic matching the firewall rule or service is processed by the VPN firewall.
Page 185 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 112. Enter the settings as described in the following table. Table 39. Add QoS Profile screen settings Setting Description Profile Name A descriptive name of the QoS profile for identification and management purposes. Re-Mark Select the Re-Mark check box to set the Differentiated Services (DiffServ) mark in the Type of Service (ToS) byte of an IP header by specifying the QoS type (IP precedence...
Page 186: Quality Of Service Priorities For Ipv6 Firewall Rules
If you enable one or more of these features and users try to access a blocked site, they see a “Blocked by NETGEAR” message. Note: Content filtering is supported for IPv4 users and groups only.
Page 187 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Several types of blocking are available: • Web component blocking. You can block the following web component types: proxy, Java, ActiveX, and cookies. Even sites that are listed in the Trusted Domains table are subject to web component blocking when the blocking of a particular web component is enabled.
Page 188 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 • If the keyword “.com” is specified, only websites with other domain suffixes (such as .edu, .org, or .gov) can be viewed. • If you wish to block all Internet browsing access, enter . (period) as the keyword. ...
Page 189: Set A Schedule To Block Or Allow Specific Traffic
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 In the Web Components section of the screen, select the components that you want to block (by default, none of these components are blocked, that is, none of these check boxes are selected): •...
Page 190: Enable Source Mac Filtering
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308  To set a schedule: Select Security > Services > Schedule 1. The Schedule 1 screen displays: Figure 114. In the Scheduled Days section, select one of the following radio buttons: • All Days.
Page 191 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Note: For additional ways of restricting outbound traffic, see Outbound Rules (Service Blocking) on page 137.  To enable MAC filtering and add MAC addresses to be permitted or blocked: Select Security > Address Filter. The Address Filter submenu tabs display, with the Source MAC Filter screen in view.
Page 192: Set Up Ip/Mac Bindings
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 WARNING: If you select Permit and Block the rest from the drop-down list but do not add the MAC address of the computer from which you are accessing the web management interface, you are locked out of the web management interface.
Page 193 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 • Host 2 has changed its MAC address to 00:01:02:03:04:09. The packet has an IP address that matches the IP address in the IP/MAC Bindings table but a MAC address that does not match the MAC address in the IP/MAC Bindings table. •...
Page 194 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 In the IP/MAC Bindings sections of the screen, enter the settings as described in the following table: Table 40. IP/MAC Binding screen settings for IPv4 Setting Description Name A descriptive name of the binding for identification and management purposes. MAC Address The MAC address of the computer or device that is bound to the IP address.
Page 195 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Click the Set Interval button. Wait for the confirmation that the operation has succeeded before you close the window. IPv6/MAC Bindings  To set up a binding between a MAC address and an IPv6 address: Select Security >...
Page 196 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 41. IP/MAC Binding screen settings for IPv6 (continued) Setting Description IP Address The IPv6 address of the computer or device that is bound to the MAC address. Log Dropped To log the dropped packets, select Enable from the drop-down list. The default setting Packets is Disable.
Page 197: Configure Port Triggering
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Configure Port Triggering Port triggering allows some applications running on a LAN network to be available to external applications that would otherwise be partially blocked by the firewall. Using the port triggering feature requires that you know the port numbers used by the application.
Page 198 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 120. In the Add Port Triggering Rule section, enter the settings as described in the following table: Table 42. Port Triggering screen settings Setting Description Name A descriptive name of the rule for identification and management purposes. Enable From the drop-down list, select Yes to enable the rule.
Page 199: Configure Universal Plug And Play
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308  To remove one or more port triggering rules from the table: Select the check box to the left of each port triggering rule that you want to delete, or click the Select All table button to select all rules. Click the Delete table button.
Page 200 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 The UPnP Portmap Table in the lower part of the screen shows the IP addresses and other settings of UPnP devices that have accessed the VPN firewall and that have been automatically detected by the VPN firewall: •...
Page 201: Chapter 5 Virtual Private Networking Using Ipsec And L2Tp Connections
Virtual Private Networking Using IPSec and L2TP Connections This chapter describes how to use the IP security (IPSec) virtual private networking (VPN) features of the VPN firewall to provide secure, encrypted communications between your local network and a remote network or computer. The chapter contains the following sections: •...
Page 202: Considerations For Dual Wan Port Systems
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Considerations for Dual WAN Port Systems If two WAN ports are configured for either IPv4 or IPv6, you can enable either auto-rollover mode for increased system reliability or load balancing mode for optimum bandwidth efficiency.
Page 203: Use The Ipsec Vpn Wizard For Client And Gateway Configurations
Configurations You can use the IPSec VPN Wizard to configure multiple gateway or client VPN tunnel policies. The following sections provide wizard and NETGEAR ProSafe VPN Client software configuration procedures: • Create an IPv4 Gateway-to-Gateway VPN Tunnel with the Wizard on page 204 •...
Page 204: Create An Ipv4 Gateway-To-Gateway Vpn Tunnel With The Wizard
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Create an IPv4 Gateway-to-Gateway VPN Tunnel with the Wizard Figure 125.  To set up an IPv4 gateway-to-gateway VPN tunnel using the VPN Wizard: Select VPN > IPSec VPN > VPN Wizard. In the upper right of the screen, the IPv4 radio button is selected by default.
Page 205 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 To view the wizard default settings, click the VPN Wizard default values option arrow in the upper right of the screen. A pop-up screen displays (see the following figure), showing the wizard default values. The default values are the same for IPv4 and IPv6. Figure 127.
Page 206 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 44. IPSec VPN Wizard settings for an IPv4 gateway-to-gateway tunnel (continued) Setting Description This VPN tunnel will use the Select a WAN interface from the drop-down list to specify which local WAN following local WAN Interface interface the VPN tunnel uses as the local endpoint.
Page 207 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 128. Configure a VPN policy on the remote gateway that allows connection to the VPN firewall. Activate the IPSec VPN connection: a. Select VPN > Connection Status. The Connection Status submenu tabs display with the IPSec VPN Connection Status screen in view: Figure 129.
Page 208: Create An Ipv6 Gateway-To-Gateway Vpn Tunnel With The Wizard
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Create an IPv6 Gateway-to-Gateway VPN Tunnel with the Wizard Figure 130.  To set up an IPv6 gateway-to-gateway VPN tunnel using the VPN Wizard: Select VPN > IPSec VPN > VPN Wizard. In the upper right of the screen, select the IPv6 radio button.
Page 209 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 To view the wizard default settings, click the VPN Wizard default values option arrow in the upper right of the screen. A pop-up screen displays (see the following figure), showing the wizard default values. The default values are the same for IPv4 and IPv6. Figure 132.
Page 210 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 45. IPSec VPN Wizard settings for an IPv6 gateway-to-gateway tunnel (continued) Setting Description This VPN tunnel will use the Select a WAN interface from the drop-down list to specify which local WAN following local WAN Interface interface the VPN tunnel uses as the local endpoint.
Page 211 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 133. Configure a VPN policy on the remote gateway that allows connection to the VPN firewall. Activate the IPSec VPN connection: a. Select VPN > Connection Status. The Connection Status submenu tabs display with the IPSec VPN Connection Status screen in view: Figure 134.
Page 212: Create An Ipv4 Client-To-Gateway Vpn Tunnel With The Wizard
Use the VPN Wizard to Configure the Gateway for a Client Tunnel on page 212. • Use the NETGEAR VPN Client Wizard to Create a Secure Connection on page 215 or Manually Create a Secure Connection Using the NETGEAR VPN Client on page 220.
Page 213 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 136. To display the wizard default settings, click the VPN Wizard default values option arrow in the upper right of the screen. A pop-up screen displays (see Figure 127 on page 205), showing the wizard default values.
Page 214 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 46. IPSec VPN Wizard settings for a client-to-gateway tunnel (continued) Setting Description This VPN tunnel will use the Select a WAN interface from the drop-down list to specify which local WAN following local WAN Interface interface the VPN tunnel uses as the local endpoint.
Page 215 Router’s LAN network IPv4 address 192.168.1.0 Router’s WAN IPv4 address 192.168.15.175 Use the NETGEAR VPN Client Wizard to Create a Secure Connection The VPN client lets you set up the VPN connection manually (see Manually Create a Secure Connection Using the NETGEAR VPN Client on page 220) or with the integrated Configuration Wizard, which is the easier and preferred method.
Page 216 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Note: Perform these tasks from a computer that has the NETGEAR ProSafe VPN Client installed. The VPN Client supports IPv4 only; a future release of the VPN Client might support IPv6. ...
Page 217 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 139. Select the A router or a VPN gateway radio button, and click Next. The VPN tunnel parameters wizard screen (screen 2 of 3) displays: Figure 140. Specify the following VPN tunnel parameters: •...
Page 218 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 141. This screen is a summary screen of the new VPN configuration. Click Finish. Specify the local and remote IDs: a. In the tree list pane of the Configuration Panel screen, click Gateway (the default name given to the authentication phase).
Page 219 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 c. Specify the settings that are described in the following table. Table 48. VPN client advanced authentication settings Setting Description Advanced features Aggressive Mode Select this check box to enable aggressive mode as the mode of negotiation with the VPN firewall.
Page 220 Instead of using the wizard on the VPN client, you can also manually configure the VPN client, which is described in the following section. Manually Create a Secure Connection Using the NETGEAR VPN Client Note: Perform these tasks from a computer that has the NETGEAR ProSafe VPN Client installed.
Page 221 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Configure the Authentication Settings (Phase 1 Settings)  To create new authentication settings: Right-click the VPN client icon in your Windows system tray, and select Configuration Panel. The Configuration Panel screen displays: Figure 144.
Page 222 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Note: This is the name for the authentication phase that is used only for the VPN client, not during IKE negotiation. You can view and change this name in the tree list pane. This name needs to be a unique name. The Authentication pane displays in the Configuration Panel screen, with the Authentication tab selected by default.
Page 223 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Click Apply to use the new settings immediately, and click Save to keep the settings for future use. Click the Advanced tab in the Authentication pane. The Advanced pane displays: Figure 147. Specify the settings that are described in the following table.
Page 224 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 50. VPN client advanced authentication settings (continued) Setting Description Local and Remote ID Local ID As the type of ID, select DNS from the Local ID drop-down list because you specified FQDN in the VPN firewall configuration. As the value of the ID, enter remote.com as the local ID for the VPN client.
Page 225 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 148. Specify the settings that are described in the following table. Table 51. VPN client IPSec configuration settings Setting Description VPN Client address Either enter 0.0.0.0 as the IP address, or enter a virtual IP address that the VPN client uses in the VPN firewall’s LAN;...
Page 226 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Click Apply to use the new settings immediately, and click Save to keep the settings for future use. Configure the Global Parameters  To specify the global parameters: Click Global Parameters in the left column of the Configuration Panel screen.
Page 227: Test The Connection And View Connection And Status Information
• View the VPN Firewall IPSec VPN Log Both the NETGEAR ProSafe VPN Client and the VPN firewall provide VPN connection and status information. This information is useful for verifying the status of a connection and troubleshooting problems with a connection.
Page 228 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 151. • Use the system-tray icon. Right-click the system tray icon, and select Open tunnel ‘Tunnel’. Figure 152. Whichever way you choose to open the tunnel, when the tunnel opens successfully, the Tunnel opened message displays above the system tray: Figure 153.
Page 229: Netgear Vpn Client Status And Log Information
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 NETGEAR VPN Client Status and Log Information  To view detailed negotiation and error information on the NETGEAR VPN client: Right-click the VPN client icon in the system tray, and select Console. The VPN Client Console Active screen displays: Figure 155.
Page 230: View The Vpn Firewall Ipsec Vpn Log
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 The Active IPSec SA(s) table lists each active connection with the information that is described in the following table. The default poll interval is 10 seconds. To change the poll interval period, enter a new value in the Poll Interval field, and click the Set Interval button. To stop polling, click the Stop button.
Page 231: Manage Ipsec Vpn Policies
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Manage IPSec VPN Policies • Manage IKE Policies • Manage VPN Policies After you have used the VPN Wizard to set up a VPN tunnel, a VPN policy and an IKE policy are stored in separate policy tables.
Page 232 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 158. Each policy contains the data that are described in the following table. These fields are described in more detail in Table 54 on page 234. Table 53. IKE Policies screen information for IPv4 and IPv6 Item Description Name...
Page 233 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Note: You cannot delete or edit an IKE policy for which the VPN policy is active without first disabling or deleting the VPN policy. Manually Add or Edit an IKE Policy  To manually add an IKE policy for IPv4 or IPv6: Select VPN >...
Page 234 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Complete the settings as described in the following table: Table 54. Add IKE Policy screen settings Setting Description Mode Config Record Do you want to use Specify whether the IKE policy uses a Mode Config record. For information about Mode Config Record? how to define a Mode Config record, see Mode Config Operation...
Page 235 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 54. Add IKE Policy screen settings (continued) Setting Description Identifier From the drop-down list, select one of the following ISAKMP identifiers to be used by the VPN firewall, and specify the identifier in the Identifier field: •...
Page 236 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 54. Add IKE Policy screen settings (continued) Setting Description Authentication Method Select one of the following radio buttons to specify the authentication method: • Pre-shared key. A secret that is shared between the VPN firewall and the remote endpoint.
Page 237 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 54. Add IKE Policy screen settings (continued) Setting Description Extended Authentication XAUTH Configuration Select one of the following radio buttons to specify whether Extended Authentication (XAUTH) is enabled, and, if enabled, which device is used to verify user account information: Note: For more...
Page 238: Manage Vpn Policies
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Click Apply to save your changes. The modified IKE policy is displayed in the List of IKE Policies table. Manage VPN Policies You can create two types of VPN policies. When you use the VPN Wizard to create a VPN policy, only the Auto method is available.
Page 239 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 160. Each policy contains the data that are described in the following table. These fields are described in more detail in Table 56 on page 241. Table 55. VPN Policies screen information for IPv4 and IPv6 Item Description ! (Status)
Page 240 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 For information about how to add or edit a VPN policy, see Manually Add or Edit a VPN Policy on this page. Manually Add or Edit a VPN Policy  To manually add a VPN policy: Select VPN >...
Page 241 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 162. Add New VPN Policy screen for IPv6 Complete the settings as described in the following table. The only differences between IPv4 and IPv6 settings are the subnet mask (IPv4) and prefix length (IPv6). Table 56.
Page 242 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 56. Add New VPN Policy screen settings for IPv4 and IPv6 (continued) Setting Description Policy Type From the drop-down list, select one of the following policy types: • Auto Policy. Some settings (the ones in the Manual Policy Parameters section of the screen) for the VPN tunnel are generated automatically.
Page 243 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 56. Add New VPN Policy screen settings for IPv4 and IPv6 (continued) Setting Description Traffic Selection Local IP From the drop-down list, select the address or addresses that are part of the VPN tunnel on the VPN firewall: •...
Page 244 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 56. Add New VPN Policy screen settings for IPv4 and IPv6 (continued) Setting Description Key-Out The encryption key for the outbound policy. The length of the key depends on the selected encryption algorithm: •...
Page 245: Configure Extended Authentication (Xauth)
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 56. Add New VPN Policy screen settings for IPv4 and IPv6 (continued) Setting Description Integrity Algorithm From the drop-down list, select one of the following two algorithms to be used in the VPN header for the authentication process: •...
Page 246: Configure Xauth For Vpn Clients
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 requesting individual authentication information from the user. A local user database or an external authentication server, such as a RADIUS server, provides a method for storing the authentication information centrally in the local network. You can enable XAUTH when you manually add or edit an IKE policy.
Page 247: User Database Configuration
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 In the Extended Authentication section on the screen, complete the settings as described in the following table: Table 57. Extended authentication settings for IPv4 and IPv6 Setting Description Select one of the following radio buttons to specify whether Extended Authentication (XAUTH) is enabled, and, if enabled, which device is used to verify user account information: •...
Page 248 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 name and password information. The gateway then attempts to verify this information first against a local user database (if RADIUS-PAP is enabled) and then by relaying the information to a central authentication server such as a RADIUS server. Note: Even though you can configure RADIUS servers with IPv4 addresses only, the servers can be used for authentication,...
Page 249 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 58. RADIUS Client screen settings (continued) Setting Description Primary Server NAS The primary Network Access Server (NAS) identifier that needs to be present Identifier in a RADIUS request. Note: The VPN firewall functions as an NAS, allowing network access to external users after verification of their authentication information.
Page 250: Assign Ipv4 Addresses To Remote Users (Mode Config)
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Assign IPv4 Addresses to Remote Users (Mode Config) • Mode Config Operation • Configure Mode Config Operation on the VPN Firewall • Configure the ProSafe VPN Client for Mode Config Operation • Test the Mode Config Connection •...
Page 251 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308  To configure Mode Config on the VPN firewall: Select VPN > IPSec VPN > Mode Config. The Mode Config screen displays: Figure 164. As an example, the screen shows two Mode Config records with the names EMEA Sales and NA Sales: •...
Page 252 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Complete the settings as described in the following table: Table 59. Add Mode Config Record screen settings Setting Description Client Pool Record Name A descriptive name of the Mode Config record for identification and management purposes.
Page 253 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 59. Add Mode Config Record screen settings (continued) Setting Description Integrity Algorithm From the drop-down list, select one of the following two algorithms to be used in the VPN header for the authentication process: •...
Page 254 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 166. On the Add IKE Policy screen, complete the settings as described in the following table. Note: The IKE policy settings that are described in the following table are specifically for a Mode Config configuration. Table 54 on page 234 explains the general IKE policy settings.
Page 255 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 60. Add IKE Policy screen settings for a Mode Config configuration Setting Description Mode Config Record Do you want to use Select the Yes radio button. Mode Config Record? Note: Because Mode Config functions only in Aggressive mode, selecting the Yes radio button sets the tunnel exchange mode to Aggressive mode.
Page 256 The period in seconds for which the IKE SA is valid. When the period times out, the next rekeying occurs. The default setting is 28800 seconds (8 hours). However, for a Mode Config configuration, NETGEAR recommends 3600 seconds (1 hour). Enable Dead Peer...
Page 257: Configure The Prosafe Vpn Client For Mode Config Operation
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 60. Add IKE Policy screen settings for a Mode Config configuration (continued) Setting Description Extended Authentication XAUTH Configuration Select one of the following radio buttons to specify whether Extended Authentication (XAUTH) is enabled, and, if enabled, which device is used to verify user account information: Note: For more...
Page 258 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Note: Perform these tasks from a computer that has the NETGEAR ProSafe VPN Client installed. To configure the VPN client for Mode Config operation, create authentication settings (phase 1 settings), create an associated IPSec configuration (phase 2 settings), and specify the global parameters.
Page 259 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Change the name of the authentication phase (the default is Gateway): a. Right-click the authentication phase name. b. Select Rename. c. Type GW_ModeConfig. d. Click anywhere in the tree list pane. Note: This is the name for the authentication phase that is used only for the VPN client, not during IKE negotiation.
Page 260 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 61. VPN client authentication settings (Mode Config) (continued) Setting Description Encryption Select the 3DES encryption algorithm from the drop-down list. Authentication Select the SHA1 authentication algorithm from the drop-down list. Key Group Select the DH2 (1024) key group from the drop-down list.
Page 261 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 62. VPN client advanced authentication settings (Mode Config) (continued) Setting Description NAT-T Select Automatic from the drop-down list to enable the VPN client and VPN firewall to negotiate NAT-T. Local and Remote ID Local ID As the type of ID, select DNS from the Local ID drop-down list because you specified FQDN in the VPN firewall configuration.
Page 262 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 171. Specify the settings that are described in the following table. Table 63. VPN client IPSec configuration settings (Mode Config) Setting Description VPN Client This field is masked out because Mode Config is selected. After an IPSec connection is address established, the IP address that is issued by the VPN firewall displays in this field (see Figure 176...
Page 263 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 63. VPN client IPSec configuration settings (Mode Config) (continued) Setting Description Encryption Select 3DES as the encryption algorithm from the drop-down list. Authentication Select SHA-1 as the authentication algorithm from the drop-down list. Mode Select Tunnel as the encapsulation mode from the drop-down list.
Page 264: Test The Mode Config Connection
Authentication (IKE), Default. Enter 3600 seconds. Note: The default setting is 28800 seconds (8 hours). However, for a Mode Config configuration, NETGEAR recommends 3600 seconds (1 hour). • Encryption (IPSec), Default. Enter 3600 seconds. Select the Dead Peer Detection (DPD) check box, and configure the following DPD settings to match the configuration on the VPN firewall: •...
Page 265: Modify Or Delete A Mode Config Record
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Verify that the VPN firewall issued an IP address to the VPN client. This IP address displays in the VPN Client address field on the IPSec pane of the VPN client. (The following figure shows the upper part of the IPSec pane only.) Figure 175.
Page 266: Configure Keep-Alives
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 keep-alive and Dead Peer Detection (DPD) features to prevent the tunnel from being disconnected and to force a reconnection if the tunnel disconnects for any reason. For DPD to function, the peer VPN device on the other end of the tunnel also needs to support DPD.
Page 267: Configure Dead Peer Detection
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Enter the settings as described in the following table: Table 64. Keep-alive settings Setting Description General Enable Keepalive Select the Yes radio button to enable the keep-alive feature. Periodically, the VPN firewall sends keep-alive requests (ping packets) to the remote endpoint to keep the tunnel alive.
Page 268: Configure Netbios Bridging With Ipsec Vpn
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 177. In the IKE SA Parameters section of the screen, locate the DPD fields, and complete the settings as described the following table: Table 65. Dead Peer Detection settings Setting Description IKE SA Parameters Enable Dead Peer Select the Yes radio button to enable DPD.
Page 269: Configure The Pptp Server
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Specify the IP version for which you want to edit a VPN policy: • IPv4. In the upper right of the screen, the IPv4 radio button is already selected by default. Go to Step •...
Page 270 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308  To enable the PPTP server and configure the PPTP server pool, authentication, and encryption: Select VPN > PPTP Server. The PPTP Server screen displays. (The following figure contains an example.) Figure 179. Enter the settings as described in the following table: Table 66.
Page 271: View The Active Pptp Users
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 66. PPTP Server screen settings (continued) Setting Description Encryption If the authentication is MSCHAP or MSCHAPv2, the PPTP server can support Microsoft Point-to-Point Encryption (MPPE). Select one or more of the following types of MPPE: •...
Page 272: Configure The L2Tp Server
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Configure the L2TP Server As an alternate solution to IPSec VPN tunnels, you can configure a Layer 2 Tunneling Protocol (L2TP) server on the VPN firewall to allow users to access L2TP clients over L2TP tunnels.
Page 273: View The Active L2Tp Users
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Enter the settings as described in the following table: Table 68. L2TP Server screen settings Setting Description L2TP Server Configuration Enable To enable the L2TP server, select the Enable check box. Starting IP Address The first IP address of the pool.
Page 274 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 69. L2TP Active Users screen information (continued) Item Description L2TP IP The IP address that is assigned by the L2TP server on the VPN firewall. Action Click the Disconnect table button to terminate the L2TP connection. Virtual Private Networking Using IPSec and L2TP Connections...
Page 275: Chapter 6 Virtual Private Networking Using Ssl Connections
Virtual Private Networking Using SSL Connections The VPN firewall provides a hardware-based SSL VPN solution designed specifically to provide remote access for mobile users to their corporate resources, bypassing the need for a preinstalled VPN client on their computers. Using the familiar Secure Sockets Layer (SSL) protocol, commonly used for e-commerce transactions, the VPN firewall can authenticate itself to an SSL-enabled client, such as a standard web browser.
Page 276: Ssl Vpn Portal Options
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 SSL VPN Portal Options The VPN firewall’s SSL VPN portal can provide two levels of SSL service to the remote user: • SSL VPN tunnel. The VPN firewall can provide the full network connectivity of a VPN tunnel using the remote user’s browser instead of a traditional IPSec VPN client.
Page 277: Create The Portal Layout
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 resources to which the users are granted access. Because you need to assign a portal layout when creating a domain, the domain is created after you have created the portal layout. b. Create one or more groups for your SSL VPN users. When you define the SSL VPN policies that determine network resource access for your SSL VPN users, you can define global policies, group policies, or individual policies.
Page 278 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 You apply portal layouts by selecting one from the available portal layouts in the configuration of a domain. When you have completed your portal layout, you can apply the portal layout to one or more authentication domains (see Configure Domains on page 303).
Page 279 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 The List of Layouts table displays the following fields: • Layout Name. The descriptive name of the portal. • Description. The banner message that is displayed at the top of the portal (see Figure 196 on page 298).
Page 280 <meta http-equiv=”cache-control” content=”no-cache”> <meta http-equiv=”cache-control” content=”must-revalidate”> Note: NETGEAR strongly recommends enabling HTTP meta tags for security reasons and to prevent out-of-date web pages, themes, and data being stored in a user’s web browser cache. Virtual Private Networking Using SSL Connections...
Page 281: Configure Domains, Groups, And Users
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 70. Add Portal Layout screen settings (continued) Setting Description ActiveX web cache Select this check box to enable ActiveX cache control to be loaded when users cleaner log in to the SSL VPN portal. The web cache cleaner prompts the user to delete all temporary Internet files, cookies, and browser history when the user logs out or closes the web browser window.
Page 282: Configure Applications For Port Forwarding
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 For information about how to configure domains, groups, and users, see Configure Authentication Domains, Groups, and Users on page 303. Configure Applications for Port Forwarding • Add Servers and Port Numbers • Add a New Host Name Port forwarding provides access to specific defined network services.
Page 283: Add A New Host Name
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 In the Add New Application for Port Forwarding section of the screen, specify information in the following fields: • IP Address. The IP address of an internal server or host computer that a remote user has access to.
Page 284: Configure The Ssl Vpn Client
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308  To add servers and host names for client name resolution: Select VPN > SSL VPN > Port Forwarding. The Port Forwarding screen displays (see Figure 186 on page 282). In the Add New Host Name for Port Forwarding section of the screen, specify information in the following fields: •...
Page 285: Configure The Client Ip Address Range
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 • Select whether you want to enable full-tunnel or split-tunnel support based on your bandwidth: A full tunnel sends all of the client’s traffic across the VPN tunnel. A split tunnel sends only traffic that is destined for the local network based on the specified client routes.
Page 286 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 188. SSL VPN Client screen for IPv6 Complete the settings as described in the following table: Table 72. SSL VPN Client screen settings for IPv4 and IPv6 Setting Description Client IP Address Range Enable Full Tunnel Support Select this check box to enable full-tunnel support.
Page 287: Add Routes For Vpn Tunnel Clients
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 72. SSL VPN Client screen settings for IPv4 and IPv6 (continued) Setting Description Client Address The last IP address of the IPv4 address range that you IPv4 screen only Range End want to assign to the VPN tunnel clients.
Page 288: Use Network Resource Objects To Simplify Policies
Defining network resources is optional; smaller organizations can choose to create access policies using individual IP addresses or IP networks rather than predefined network resources. But for most organizations, NETGEAR recommends that you use network resources. If your server or network configuration changes, you can perform an update quickly by using network resources instead of individually updating all of the user and group policies.
Page 289: Edit Network Resources To Specify Addresses
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 189. In the Add New Resource section of the screen, specify information in the following fields: • Resource Name. A descriptive name of the resource for identification and management purposes. • Service.
Page 290 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 190. Complete the settings as described in the following table: Table 73. Resources screen settings to edit a resource Setting Description Add Resource Addresses Resource Name The unique identifier for the resource. You cannot modify the resource name after you have created it on the first Resources screen.
Page 291: Configure User, Group, And Global Policies
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 73. Resources screen settings to edit a resource (continued) Setting Description Object Type IPv4 screen only: Enter the network mask (0–31) for the locations that are (continued) permitted to use this resource. Mask Length IPv6 screen only: Enter the prefix length for the locations that are permitted...
Page 292: View Policies
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 includes the following addresses: 10.0.0.5–10.0.0.20 and the FQDN ftp.company.com, which resolves to 10.0.1.3. Assuming that no conflicting user or group policies have been configured, if a user attempted to access FTP servers at the following addresses, the actions listed would occur: •...
Page 293: Add An Ipv4 Or Ipv6 Ssl Vpn Policy
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Make your selection from the following Query options: • To view all global policies, select the Global radio button. • To view group policies, select the Group radio button, and select the relevant group’s name from the drop-down list.
Page 294 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 193. Add SSL VPN Policy screen for IPv6 Complete the settings as described in the following table: Table 74. Add SSL VPN Policy screen settings Setting Description Policy For Select one of the following radio buttons to specify the type of SSL VPN policy: •...
Page 295 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 74. Add SSL VPN Policy screen settings (continued) Setting Description Apply Network Policy Name A descriptive name of the SSL VPN policy for identification and Policy to? Resource management purposes. (continued) Defined From the drop-down list, select a network resource that you Resources...
Page 296 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 74. Add SSL VPN Policy screen settings (continued) Setting Description Apply IP Network Service From the drop-down list, select the service to which the SSL Policy to? (continued) VPN policy is applied: (continued) •...
Page 297: Access The New Ssl Portal Login Screen
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308  To delete one or more SSL VPN policies: On the Policies screen (see Figure 191 on page 292), select the check box to the left of each SSL VPN policy that you want to delete, or click the Select All table button to select all policies.
Page 298 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 In the Portal URL field of the List of Layouts table, click the URL that corresponds to the SSL portal login screen that you want to open. The SSL portal login screen displays. (The following figure shows the CustSupport layout that was defined in Create the Portal Layout on page 277.)
Page 299: View The Ssl Vpn Connection Status And Ssl Vpn Log
Note: The first time that a user attempts to connect through the VPN tunnel, the NETGEAR SSL VPN tunnel adapter is installed; the first time that a user attempts to connect through the port forwarding tunnel, the NETGEAR port forwarding engine is installed.
Page 300 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 199. The active user’s name, group, and IP address are listed in the table with a time stamp indicating the time and date that the user connected. To disconnect an active user, click the Disconnect table button to the right of the user’s table entry.
Page 301: Chapter 7 Manage Users, Authentication, And Vpn Certificates
Manage Users, Authentication, and VPN Certificates This chapter describes how to manage users, authentication, and security certificates for IPSec VPN and SSL VPN. The chapter contains the following sections: • The VPN Firewall’s Authentication Process and Options • Configure Authentication Domains, Groups, and Users •...
Page 302: The Vpn Firewall's Authentication Process And Options
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 The VPN Firewall’s Authentication Process and Options Users are assigned to a group, and a group is assigned to a domain. Therefore, you should first create any domains, then groups, then user accounts. Note: Do not confuse the authentication groups with the LAN groups that are described in...
Page 303: Configure Authentication Domains, Groups, And Users
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 75. External authentication protocols and methods (continued) Authentication Description Protocol or Method MIAS A network-validated PAP or CHAP password-based authentication method that functions with Microsoft Internet Authentication Service (MIAS), which is a component of Microsoft Windows 2003 Server.
Page 304 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Create Domains  To create a domain: Select Users > Domains. The Domains screen displays. (The following figure shows the VPN firewall’s default domain—geardomain—and, as an example, other domains in the List of Domains table.) Figure 201.
Page 305 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 202. Complete the settings as described in the following table: Table 76. Add Domain screen settings Setting Description Domain Name A descriptive (alphanumeric) name of the domain for identification and management purposes. Authentication Type From the drop-down list, select the authentication method that the VPN firewall applies:...
Page 306 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 76. Add Domain screen settings (continued) Setting Description Authentication Type • MIAS-PAP. Microsoft Internet Authentication Service (MIAS) PAP. Complete (continued) the following fields: Authentication Server Note: If you select Authentication Secret any type of RADIUS •...
Page 307: Configure Groups
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Note: A combination of local and external authentication is supported. WARNING: If you disable local authentication, make sure that there is at least one external administrative user; otherwise, access to the VPN firewall is blocked.
Page 308: Create Groups
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 IMPORTANT: When you create a domain on the Domains screen (see the previous section), a group with the same name as the new domain is created automatically. You cannot delete such a group. However, when you delete the domain with which it is associated, the group is deleted automatically.
Page 309 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Note: When you create a domain on the Domains screen, a group with the same name as the new domain is created automatically. You cannot delete such a group on the Groups screen. However, when you delete the domain with which the group is associated, the group is deleted automatically.
Page 310: Configure User Accounts
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Edit Groups For groups that were automatically created when you created a domain, you can modify only the idle time-out settings but not the group name or associated domain. For groups that you created on the Add Groups screen, you can modify the domain and the idle time-out settings but not the group name.
Page 311 Guest user. A user who can only view the VPN firewall configuration (that is, read-only access). • IPSec VPN user. A user who can make an IPSec VPN connection only through a NETGEAR ProSafe VPN Client, and only when the XAUTH feature is enabled (see Configure Extended Authentication (XAUTH) on page 245). •...
Page 312 Guest (readonly). A user who can only view the VPN firewall configuration (that is, read-only access). • IPSEC VPN User. A user who can make an IPSec VPN connection only through a NETGEAR ProSafe VPN Client, and only when the XAUTH feature is enabled (see Configure Extended Authentication (XAUTH) on page 245).
Page 313: Set User Login Policies
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308  To delete one or more user accounts: In the List of Users table, select the check box to the left of each user account that you want to delete, or click the Select All table button to select all accounts. You cannot delete a default user account.
Page 314 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Note: For security reasons, the Deny Login from WAN Interface check box is selected by default for guests and administrators. The Disable Login check box is disabled (masked out) for administrators. Click Apply to save your settings. Configure Login Restrictions Based on IPv4 Addresses ...
Page 315 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 In the Add Defined Addresses section of the screen, add an address to the Defined Addresses table by entering the settings as described in the following table: Table 79. Defined addresses settings for IPv4 Setting Description Source Address Type Select the type of address from the drop-down list:...
Page 316 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 209. In the Defined Addresses Status section of the screen, select one of the following radio buttons: • Deny Login from Defined Addresses. Deny logging in from the IP addresses in the Defined Addresses table.
Page 317 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308  To delete one or more IPv6 addresses: In the Defined Addresses table, select the check box to the left of each address that you want to delete, or click the Select All table button to select all addresses. Click the Delete table button.
Page 318: Change Passwords And Other User Settings
All other users have read-only access. Note: The default administrator and default guest passwords for the web management interface are both password. NETGEAR recommends that you change the password for the administrator account to a more secure password, and that you configure a separate secure password for the guest account.
Page 319 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 211. Change the settings as described in the following table: Note: Once established, you cannot change the user name or the group. If you need to change the user name or the group, delete the user account and recreate it with the correct name or group.
Page 320: Manage Digital Certificates For Vpn Connections
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Manage Digital Certificates for VPN Connections • VPN Certificates Screen • Manage VPN CA Certificates • Manage VPN Self-Signed Certificates • Manage the VPN Certificate Revocation List The VPN firewall uses digital certificates (also known as X509 certificates) during the Internet Key Exchange (IKE) authentication phase to authenticate connecting IPSec VPN gateways or clients, or to be authenticated by remote entities: •...
Page 321: Vpn Certificates Screen
The VPN firewall contains a self-signed digital certificate from NETGEAR. This certificate can be downloaded from the VPN firewall login screen for browser import. However, NETGEAR recommends that you replace this digital certificate with a digital certificate from a well-known commercial CA before you deploy the VPN firewall in your network.
Page 322: Manage Vpn Ca Certificates
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Manage VPN CA Certificates  To view and upload trusted certificates: Select VPN > Certificates. The Certificates screen displays. (The following figure shows the top section of the screen with the trusted certificate information and an example certificate in the Trusted Certificates [CA Certificate] table.) Figure 212.
Page 323: Manage Vpn Self-Signed Certificates
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Manage VPN Self-Signed Certificates Instead of obtaining a digital certificate from a CA, you can generate and sign your own digital certificate. However, a self-signed digital certificate triggers a warning from most browsers because it provides no protection against identity theft of the server.
Page 324 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 214. Certificates, screen 2 of 3 In the Generate Self Certificate Request section of the screen, enter the settings as described in the following table: Table 82. Generate self-signed certificate request settings Setting Description Name...
Page 325 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 82. Generate self-signed certificate request settings (continued) Setting Description Optional Fields IP Address Enter your fixed (static) IP address. If your IP address is dynamic, leave this field blank. Domain Name Enter your Internet domain name, or leave this field blank.
Page 326: Manage The Vpn Certificate Revocation List
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Select the check box next to the self-signed certificate request. Click the Browse button and navigate to the digital certificate file from the CA that you just stored on your computer. Click the Upload table button. If the verification process on the VPN firewall approves the digital certificate for validity and purpose, the digital certificate is added to the Active Self Certificates table.
Page 327 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 216. Certificates, screen 3 of 3 The Certificate Revocation Lists (CRL) table lists the active CAs and their critical release dates: • CA Identity. The official name of the CA that issued the CRL. •...
Page 328: Chapter 8 Network And System Management
Network and System Management This chapter describes the tools for managing the network traffic to optimize its performance and the system management features of the VPN firewall. The chapter contains the following sections: • Performance Management • System Management...
Page 329: Performance Management
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Performance Management • Bandwidth Capacity • Features That Reduce Traffic • Features That Increase Traffic • Use QoS and Bandwidth Assignment to Shift the Traffic Mix • Monitoring Tools for Traffic Management Performance management consists of controlling the traffic through the VPN firewall so that the necessary traffic gets through when there is a bottleneck.
Page 330: Features That Reduce Traffic
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Features That Reduce Traffic You can adjust the following features of the VPN firewall in such a way that the traffic load on the WAN side decreases: • LAN WAN outbound rules (also referred to as service blocking) •...
Page 331: Content Filtering
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 • LAN users (or DMZ users). You can specify which computers on your network are affected by an outbound rule. There are several options: Any. The rule applies to all computers and devices on your LAN or DMZ. Single address.
Page 332: Features That Increase Traffic
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 In order to reduce traffic, the VPN firewall provides the following methods to filter web content: • Keyword blocking. You can specify words that, should they appear in the website name (URL) or newsgroup name, cause that site or newsgroup to be blocked by the VPN firewall.
Page 333 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Each rule lets you specify the desired action for the connections covered by the rule: • BLOCK always • BLOCK by schedule, otherwise allow • ALLOW always • ALLOW by schedule, otherwise block The following section summarizes the various criteria that you can apply to inbound rules and that might increase traffic.
Page 334: Port Triggering
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Address range. The rule applies to a range of Internet IP addresses. IP Groups. The rule applies to a group of individual WAN IP addresses. Use the IP Groups screen (under the Network Security main navigation menu) to assign IP addresses to groups.
Page 335: Use Qos And Bandwidth Assignment To Shift The Traffic Mix
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 VPN, L2TP, and PPTP Tunnels The VPN firewall supports site-to-site IPSec VPN tunnels, dedicated SSL VPN tunnels, L2TP tunnels, and PPTP tunnels. Each tunnel requires extensive processing for encryption and authentication, thereby increasing traffic through the WAN ports. For information about IPSec VPN, L2TP, and PPTP tunnels, see Chapter 5, Virtual Private Networking Using IPSec and L2TP...
Page 336: Monitoring Tools For Traffic Management
The default administrator and default guest passwords for the web management interface are both password. NETGEAR recommends that you change the password for the administrator account to a more secure password, and that you configure a separate secure password for the guest account.
Page 337 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 217. In the Action column of the List of Users table, click the Edit table button for the user with the name admin. The Edit Users screen displays: Figure 218. You cannot modify the administrator user name, user type, or group assignment. Select the Check to Edit Password check box.
Page 338: Configure Remote Management Access
IP address and default password. Because a malicious WAN user can reconfigure the VPN firewall and misuse it in many ways, NETGEAR highly recommends that you change the admin and guest default passwords before...
Page 339 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 continuing (see Change Passwords and Administrator and Guest Settings on page 336).  To configure the VPN firewall for remote management: Select Administration > Remote Management. The Remote Management screen displays the IPv4 settings (see the next figure). Specify the IP version for which you want to configure remote management: •...
Page 340 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 220. Remote Management screen for IPv6 Enter the settings as described in the following table: Table 83. Remote Management screen settings for IPv4 and IPv6 Setting Description Secure HTTP Management Allow Secure HTTP To enable secure HTTP management, select the Yes radio button, which is the Management? default setting.
Page 341 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 83. Remote Management screen settings for IPv4 and IPv6 (continued) Setting Description Telnet Management Allow Telnet To enable Telnet management, select the Yes radio button. To disable Telnet Management? management, select the No radio button, which is the default setting. Specify the addresses through which access is allowed by selecting one of the following radio buttons: •...
Page 342: Use The Command-Line Interface
Simple Network Management Protocol (SNMP) forms part of the Internet Protocol Suite as defined by the Internet Engineering Task Force (IETF). SNMP is used in network management systems such as the NETGEAR ProSafe Network Management Software (NMS200) to monitor network-attached devices for conditions that warrant administrative attention.
Page 343 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 221. The SNMPv3 Users table includes the default SNMPv3 users that are preconfigured on the VPN firewall. The SNMPv3 Users table shows the following columns: • Username. The default user names (admin or guest). •...
Page 344 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 To specify a new SNMP configuration, in the Create New SNMP Configuration Entry section of the screen, configure the settings as described in the following table: Table 84. SNMP screen settings Setting Description Access From WAN Enable access from...
Page 345 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 222. Modify the settings as described in the previous table. Click Apply to save your settings.  To delete one or more SNMP configurations: On the SNMP screen (see Figure 221 on page 343), select the check box to the left of each SNMP configuration that you want to delete, or click the Select All table button to select all SNMP configurations.
Page 346 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 85. Edit User screen settings for SNMPv3 users (continued) Setting Description Security Level From the drop-down list, select the security level for communication between the SNMPv3 user and the SNMP agent that collects the MIB objects from the VPN firewall: •...
Page 347: Manage The Configuration File
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Enter the settings as described in the following table: Table 86. SNMP SysConfiguration screen settings Setting Description SysContact Enter the SNMP system contact information that is available to the SNMP manager. This setting is optional. SysLocation Enter the physical location of the VPN firewall.
Page 348: Back Up Settings
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 225. Back Up Settings The backup feature saves all VPN firewall settings to a file. Back up your settings periodically, and store the backup file in a safe place. Tip: You can use a backup file to export all settings to another VPN firewall that has the same language and management software versions.
Page 349: Restore Settings
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Restore Settings WARNING: Restore only settings that were backed up from the same software version. Restoring settings from a different software version can corrupt your backup file or the VPN firewall system software. ...
Page 350: Upgrade The Firmware
 To download a firmware version and upgrade the firmware: Go to the NETGEAR website at http://support.netgear.com. Navigate to the SRX5308 support page, and click the Downloads tab. Click the desired firmware version to reach the download page. Be sure to read the release notes on the download page before upgrading the VPN firewall’s software.
Page 351 In some cases, such as a major upgrade, it might be necessary to erase the configuration and manually reconfigure your VPN firewall after upgrading it. See the firmware release notes that NETGEAR makes available. Select the Firmware and Reboot the VPN Firewall After you have upgraded the firmware, the newly installed firmware is the active firmware, and the previously installed firmware has become the secondary firmware.
Page 352: Configure Date And Time Service
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Select Monitoring. The Router Status screen displays, showing the selected firmware version in the System Info section of the screen. Configure Date and Time Service Configure date, time, and NTP server designations on the System Date & Time screen. Network Time Protocol (NTP) is a protocol that is used to synchronize computer clock times in a network of computers.
Page 353 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 87. Time Zone screen settings (continued) Setting Description Resolve IPv6 address Select this check box to force the use of IPv6 addresses and FQDN (domain for servers name) resolution in the Server 1 Name / IP Address and Server 2 Name / IP Address fields when you have selected the Use Custom NTP Servers radio button.
Page 354 Note: If you select the Use Custom NTP Servers option but leave either the Server 1 or Server 2 field blank, both fields are set to the default NETGEAR NTP servers. Note: A list of public NTP servers is available at http://support.ntp.org/bin/view/Servers/WebHome.
Page 355: Chapter 9 Monitor System Access And Performance
Monitor System Access and Performance This chapter describes the system-monitoring features of the VPN firewall. You can be alerted to important events such WAN traffic limits reached, login failures, and attacks. You can also view status information about the firewall, WAN ports, LAN ports, active VPN users and tunnels, and more.
Page 356: Configure And Enable The Wan Traffic Meter
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Configure and Enable the WAN Traffic Meter If your ISP charges by traffic volume over a given period, or if you want to study traffic types over a period, you can activate the traffic meter for IPV4 traffic on a WAN port. ...
Page 357 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 88. WAN1 Traffic Meter screen settings Setting Description Enable Traffic Meter Do you want to Select one of the following radio buttons to configure traffic metering: enable Traffic • Yes. Traffic metering is enabled, and the traffic meter records the volume of Metering on WAN1? Internet traffic passing through the WAN interface.
Page 358 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 88. WAN1 Traffic Meter screen settings (continued) Setting Description When Limit is reached Block Traffic Select one of the following radio buttons to specify which action the VPN firewall performs when the traffic limit has been reached: •...
Page 359: Configure And Enable The Lan Traffic Meter
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Configure and Enable the LAN Traffic Meter If your ISP charges by traffic volume over a period and you need to charge the costs to individual accounts, or if you want to study the traffic volume that is requested or sent over a LAN IP address over a period, activate the traffic meter for individual LAN IP addresses.
Page 360 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 • Traffic (MB). The traffic usage in MB. • State. The state that indicates whether traffic to and from the IP address is allowed or blocked. • Action. The Edit table button provides access to the Edit LAN Traffic Meter screen for the corresponding IP address.
Page 361 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 89. Add LAN Traffic Meter Account screen settings (continued) Setting Description Send e-mail report An email report is sent immediately before the counter restarts. Ensure that emailing before restarting of logs is enabled on the Firewall Logs & E-mail screen (see Configure Logging, counter Alerts, and Event Notifications...
Page 362: Configure Logging, Alerts, And Event Notifications
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Configure Logging, Alerts, and Event Notifications You can configure the VPN firewall to log routing events such as dropped and accepted packets, to log system events such as a change of time by an NTP server, secure login attempts, and reboots, and to log other events.
Page 363 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Enter the settings as described in the following table: Table 90. Firewall Logs & E-mail screen settings Setting Description Log Options Log Identifier Enter the name of the log identifier. The identifier is appended to log messages to identify the device that sent the log messages.
Page 364 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 90. Firewall Logs & E-mail screen settings (continued) Setting Description Enable E-mail Logs Do you want Select the Yes radio button to enable the VPN firewall to email logs to a specified email logs to be address.
Page 365 Click Apply to save your settings. Note: Enabling routing and other event logs might generate a significant volume of log messages. NETGEAR recommends that you enable firewall logs for debugging purposes only.  To view the routing logs, system logs, and other event logs onscreen: Select Monitoring >...
Page 366 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 234. You can refresh the logs, clear the logs, or send the logs to an email address.  To view the DNS logs onscreen: Select Monitoring > Firewall Logs & E-mail. The Firewall Logs & E-mail screen displays.
Page 367: How To Send Syslogs Over A Vpn Tunnel Between Sites
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 How to Send Syslogs over a VPN Tunnel between Sites  To send syslogs from one site to another over a gateway-to-gateway VPN tunnel: At Site 1, set up a syslog server that is connected to Gateway 1. Set up a VPN tunnel between Gateway 1 at Site 1 and Gateway 2 at Site 2.
Page 368 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 In the Traffic Selector section of the screen, make the following changes: • From the Remote IP drop-down list, select Single. • In the Start IP fields, type 10.0.0.2, which is the WAN IP address of Gateway 2. Click Apply to save the settings.
Page 369: View Status Screens
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 View Status Screens • View the System Status • View the VPN Connection Status, L2TP Users, and PPTP Users • View the VPN Logs • View the Port Triggering Status • View the WAN Port Status •...
Page 370 Table 91. Router Status screen information Item Description System Info System Name The NETGEAR system name. Firmware Version The installed firmware version. Secondary Firmware Version The secondary software version. This version is for display only. (You cannot configure or select this version.) LAN (VLAN) IPv4 Information For each of the four LAN ports, the screen shows the IPv4 LAN address and subnet mask.
Page 371 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 91. Router Status screen information (continued) Item Description LAN IPv6 Information MAC Address The MAC address of the VPN firewall. IPv6 Address The IPv6 LAN address that is assigned to the VPN firewall. For information about configuring the IPv6 address, see Configure the IPv6 Internet Connection and WAN Settings...
Page 372 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 237. The following table explains the fields of the Router Statistics screen. To change the poll interval period, enter a new value (in seconds) in the Poll Interval field, and click Set interval. To stop polling, click Stop. Table 92.
Page 373 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 238. Monitor System Access and Performance...
Page 374 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 The following table explains the fields of the Detailed Status screen: Table 93. Detailed Status screen information Item Description LAN Port Configuration The following fields are shown for each of the LAN ports. VLAN Profile The name of the VLAN profile that you assigned to the LAN port on the LAN Setup screen (see...
Page 375 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 93. Detailed Status screen information (continued) Item Description DMZ IPv6 Configuration IPv6 Address The IPv6 address and prefix length for the DMZ. DHCP Status The status of the DHCPv6 server for the DMZ For information about configuring (Enabled or Disabled).
Page 376 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 93. Detailed Status screen information (continued) Item Description IP Address The IPv4 address of the WAN port. For information about configuring the IPv4 address of the WAN port, see Configure the IPv4 Internet Connection and WAN Settings page 29.
Page 377 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 The following table explains the fields of the VLAN Status screen: Table 94. VLAN Status screen information Item Description Profile Name The unique name for the VLAN that you have assigned on the Add VLAN Profile screen.
Page 378: View The Vpn Connection Status, L2Tp Users, And Pptp Users
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 View the VPN Connection Status, L2TP Users, and PPTP Users The Connection Status screens display a list of IPSec VPN connections, SSL VPN connections, and L2TP users who are logged in to the VPN firewall. ...
Page 379 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 The active user’s user name, group, and IP address are listed in the table with a time stamp indicating the time and date that the user connected. To disconnect an active connection, click the Disconnect table button to the right of the policy’s table entry.
Page 380: View The Vpn Logs
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 The List of PPTP Active Users table lists each active connection with the information that is described in the following table. Table 96. PPTP Active Users screen information Item Description Username The name of the PPTP user that you have defined (see Configure User Accounts page 310).
Page 381: View The Port Triggering Status
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 246. View the Port Triggering Status  To view the status of the port triggering feature: Select Security > Port Triggering. The Port Triggering screen displays. (The following figure shows one rule in the Port Triggering Rules table as an example.) Figure 247.
Page 382: View The Wan Port Status
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 248. The Port Triggering Status screen displays the information that is described in the following table: Table 97. Port Triggering Status screen information Item Description The sequence number of the rule onscreen. Rule The name of the port triggering rule that is associated with this entry.
Page 383 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 249. In the Action column, click the Status button of the WAN interface for which you want to display the Connection Status pop-up screen. (The following figure shows a static IP address configuration.) Figure 250.
Page 384 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 98. Connection Status screen information for an IPv4 connection (continued) Item Description DHCP Server DHCP only. The DHCP server that was automatically detected. This field displays only if your ISP does not require a login and the IP address is acquired dynamically from your ISP.
Page 385: View The Attached Devices And The Dhcp Log
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 252. The type of connection determines the information that is displayed on the Connection Status screen. The screen can display the information that is described in the following table: Table 99. Connection Status screen information for an IPv6 connection Item Description Connection Time...
Page 386 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 View the Attached Devices  To view the attached devices on the LAN Groups screen: Select Network Configuration > LAN Settings > LAN Groups. The LAN Groups screen displays. (The following figure shows some examples in the Known PCs and Devices table.) Figure 253.
Page 387 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Note: If the VPN firewall is rebooted, the data in the Known PCs and Devices table is lost until the VPN firewall rediscovers the devices. View the DHCP Log  To review the most recent entries in the DHCP log: Select Network Configuration >...
Page 388: Diagnostics Utilities
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Diagnostics Utilities • Send a Ping Packet • Trace a Route • Look Up a DNS Address • Display the Routing Tables • Capture Packets in Real Time • Reboot the VPN Firewall Remotely The VPN firewall provides diagnostic tools that help you analyze the status of the network and traffic conditions.
Page 389: Send A Ping Packet
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 • IPv6. Select the IPv6 radio button. The Diagnostics screen displays the IPv6 settings: Figure 256. The various tasks that you can perform on the Diagnostics screen are described in the following sections. Send a Ping Packet Use the ping utility to send a ping packet request in order to check the connection between the VPN firewall and a specific IP address or FQDN.
Page 390: Trace A Route
To return to the Diagnostics screen, click Back on the browser menu bar. Look Up a DNS Address A Domain Name Server (DNS) converts the Internet name (for example, www.netgear.com) to an IP address. If you need the IP address of a web, FTP, mail, or other server on the Internet, request a DNS lookup to find the IP address.
Page 391: Capture Packets In Real Time
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Capture Packets in Real Time Capturing packets can assist NETGEAR technical support in diagnosing packet transfer problems. You can also use a traffic analyzer to do your own problem diagnoses.  To capture packets in real time: In Router Options section of the screen, next to Capture Packets, click the Packet Trace button.
Page 392: Chapter 10 Troubleshooting
Troubleshooting This chapter provides troubleshooting tips and information for the VPN firewall. After each problem description, instructions are provided to help you diagnose and solve the problem. For the common problems listed, go to the section indicated. • Is the VPN firewall on? Go to Basic Functioning on page 393.
Page 393: Basic Functioning
VPN firewall and that the power supply adapter is correctly connected to a functioning power outlet. If the error persists, you have a hardware problem and should contact NETGEAR technical support. Test LED Never Turns Off When the VPN firewall is powered on, the Test LED turns on for approximately 2 minutes and then turns off when the VPN firewall has completed its initialization.
Page 394: Lan Or Wan Port Leds Not On
IP address to 192.168.1.1. This procedure is described in Restore the Default Configuration and Password on page 401. If the error persists, you might have a hardware problem and should contact NETGEAR technical support. LAN or WAN Port LEDs Not On ...
Page 395: When You Enter A Url Or Ip Address, A Time-Out Error Occurs
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 • Make sure that you are using the SSL https://address login rather than the http://address login. • Make sure that your browser has Java, JavaScript, or ActiveX enabled. If you are using Internet Explorer, click Refresh to be sure that the Java applet is loaded.
Page 396: Troubleshoot The Isp Connection
 To check the WAN IP address: Launch your browser and navigate to an external site such as www.netgear.com. Access the web management interface of the VPN firewall’s configuration at https://192.168.1.1.
Page 397: Troubleshooting The Ipv6 Connection
A DNS server is a host on the Internet that translates Internet names (such as www.netgear.com) to numeric IP addresses. Typically, your ISP provides the addresses of one or two DNS servers for your use. You can configure your computer manually with DNS addresses, as described in your operating system documentation.
Page 398 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Windows Server 2003, all versions Windows Server 2003 R2, all versions Linux and other UNIX-based systems with a correctly configured kernel MAC OS X • Make sure that IPv6 is enabled on the computer. On a computer that runs a Windows-based operating system, do the following (note that the steps might differ on the various Windows operating systems): a.
Page 399 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 c. Click or double-click View status of this connection. The Local Area Connection Status screen displays: Figure 259. d. Make sure that Internet access shows for the IPv6 connection. (The previous figure shows that there is no Internet access.) e.
Page 400: Troubleshoot A Tcp/Ip Network Using A Ping Utility
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 f. Make sure that an IPv6 address shows. The previous figure does not show an IPv6 address for the computer but only a link-local IPv6 address and an IPv6 default gateway address, both of which start, in this case, with FE80. Troubleshoot a TCP/IP Network Using a Ping Utility •...
Page 401: Test The Path From Your Computer To A Remote Device
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Test the Path from Your Computer to a Remote Device After verifying that the LAN path works correctly, test the path from your computer to a remote device. From the Windows Run dialog box, type: ping -n 10 <IP address>...
Page 402 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 261. b. In the Backup / Restore Settings section of the screen, click the Default button. The VPN firewall reboots. During the reboot process, the Settings Backup and Firmware Upgrade screen might remain visible, or a status message with a counter might show the number of seconds left until the reboot process is complete.
Page 403: Address Problems With Date And Time
Automatically Adjust for Daylight Savings Time check box. Access the Knowledge Base and Documentation  To access NETGEAR’s knowledge base for the VPN firewall: Select Web Support > Knowledgebase.  To access NETGEAR’s documentation library for your VPN firewall model: Select Web Support > Documentation. Troubleshooting...
Page 404: Appendix A Default Settings And Technical Specifications
Default Settings and Technical Specifications This appendix provides the default settings and the physical and technical specifications of the VPN firewall in the following sections: • Factory Default Settings • Physical and Technical Specifications...
Page 405: Factory Default Settings
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Factory Default Settings You can use the factory default Reset button on the rear panel to reset all settings to their factory defaults. This is called a hard reset (for more information, see Revert to Factory Default Settings on page 349):...
Page 406 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 100. VPN firewall factory default configuration settings (continued) Feature Default Behavior IPv4 LAN, DMZ, and routing settings LAN IPv4 address for the default VLAN 192.168.1.1 LAN IPv4 subnet mask for the default VLAN 255.255.255.0 VLAN 1 membership All ports...
Page 407 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 100. VPN firewall factory default configuration settings (continued) Feature Default Behavior Firewall and security settings Inbound LAN WAN rules (communications coming in from All traffic is blocked, except for traffic the Internet) in response to requests from the LAN.
Page 408 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 100. VPN firewall factory default configuration settings (continued) Feature Default Behavior QoS priorities (for IPv6 firewall rules) Normal-Service Minimize-Cost Maximize-Reliability Maximize-Throughput Minimize-Delay Content filtering Disabled Proxy server blocking Disabled Java applets blocking Disabled ActiveX controls blocking Disabled...
Page 409 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 100. VPN firewall factory default configuration settings (continued) Feature Default Behavior VPN IPsec Wizard: IKE policy settings for IPv4 gateway-to-client tunnels Exchange mode Aggressive ID type FQDN Local WAN ID remote.com Remote WAN ID local.com Encryption algorithm...
Page 410: Physical And Technical Specifications
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 100. VPN firewall factory default configuration settings (continued) Feature Default Behavior Administrative and monitoring settings Secure HTTP management Enabled Telnet management Disabled Traffic meter Disabled SNMP Disabled Time zone Time zone adjusted for daylight saving time Disabled Routing logs Disabled...
Page 411 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 101. VPN firewall physical and technical specifications (continued) Feature Specification Environmental specifications Operating temperatures 0º to 45º C 32º to 113º F Storage temperatures –20º to 70º C –4º to 158º F Operating humidity 90% maximum relative humidity, noncondensing Storage humidity...
Page 412 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 The following table shows the SSL VPN specifications for the VPN firewall: Table 103. VPN firewall SSL VPN specifications Setting Specification Network Management Web-based configuration and status monitoring Number of concurrent users supported SSL versions SSLv3, TLS1.0 SSL encryption algorithm...
Page 413: Appendix B Network Planning For Multiple Wan Ports
Network Planning for Multiple WAN Ports This appendix describes the factors to consider when planning a network using a firewall that has more than one WAN port. This appendix contains the following sections: • What to Consider Before You Begin •...
Page 414: What To Consider Before You Begin
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 What to Consider Before You Begin • Cabling and Computer Hardware Requirements • Computer Network Configuration Requirements • Internet Configuration Requirements The VPN firewall is a powerful and versatile solution for your networking needs. To make the configuration process easier and to understand all of the choices that are available to you, consider the following before you begin: Plan your network.
Page 415: Cabling And Computer Hardware Requirements
• The VPN firewall can be managed remotely, but you need to enable remote management locally after each factory default reset. NETGEAR strongly advises you to change the default management password to a strong password before enabling remote management. •...
Page 416: Internet Configuration Requirements
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Internet Configuration Requirements Depending on how your ISP sets up your Internet accounts, you need the following Internet configuration information to connect VPN firewall to the Internet: • Host and domain names •...
Page 417: Internet Connection Information
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Internet Connection Information Print this page with the Internet connection information. Fill in the configuration settings that are provided to you by ISP. _________________________________________________________________________ • ISP login name. The login name and password are case-sensitive and need to be entered exactly as given by your ISP.
Page 418: Overview Of The Planning Process
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Overview of the Planning Process The areas that require planning when you use a firewall that has multiple WAN ports such as the VPN firewall include the following: • Inbound traffic (port forwarding, port triggering) •...
Page 419: Inbound Traffic
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Features such as multiple exposed hosts are not supported in auto-rollover mode because the IP addresses of each WAN port need to be in the identical range of fixed addresses. • Dual WAN ports in load balancing mode. Load balancing for a VPN firewall with dual WAN ports is similar to a single WAN gateway configuration when you specify the IP address.
Page 420: Inbound Traffic To A Dual Wan Port System
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 265. Inbound Traffic to a Dual WAN Port System The IP address range of the VPN firewall’s WAN port needs to be both fixed and public so that the public can send incoming traffic to the multiple exposed hosts when this feature is supported and enabled.
Page 421: Virtual Private Networks
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 267. Virtual Private Networks • VPN Road Warrior (Client-to-Gateway) • VPN Gateway-to-Gateway • VPN Telecommuter (Client-to-Gateway through a NAT Router) When implementing virtual private network (VPN) tunnels, you need to use a mechanism for determining the IP addresses of the tunnel endpoints.
Page 422: Vpn Road Warrior (Client-To-Gateway)
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 always changes. Therefore, the use of an FQDN is always required, even when the IP address of each WAN port is fixed. Note: When the VPN firewall’s WAN port rolls over, the VPN tunnel collapses and needs to be reestablished using the new WAN IP address.
Page 423 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 VPN Road Warrior: Single-Gateway WAN Port (Reference Case) In a single WAN port gateway configuration, the remote computer client initiates the VPN tunnel because the IP address of the remote computer client is not known in advance. The gateway WAN port needs to act as the responder.
Page 424 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 272. The purpose of the FQDN in this case is to toggle the domain name of the gateway firewall between the IP addresses of the active WAN port (that is, WAN1 and WAN2) so that the remote computer client can determine the gateway IP address to establish or reestablish a VPN tunnel.
Page 425: Vpn Gateway-To-Gateway
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 VPN Gateway-to-Gateway The following situations exemplify the requirements for a gateway VPN firewall to establish a VPN tunnel with another gateway VPN firewall: • Single-gateway WAN ports • Redundant dual-gateway WAN ports for increased reliability (before and after rollover) •...
Page 426 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 275. The IP addresses of the gateway WAN ports can be either fixed or dynamic, but you always need to use an FQDN because the active WAN ports could be either WAN_A1, WAN_A2, WAN_B1, or WAN_B2 (that is, the IP address of the active WAN ports is not known in advance).
Page 427: Vpn Telecommuter (Client-To-Gateway Through A Nat Router)
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Figure 277. The IP addresses of the gateway WAN ports can be either fixed or dynamic. If an IP address is dynamic, you need to use an FQDN. If an IP address is fixed, an FQDN is optional. VPN Telecommuter (Client-to-Gateway through a NAT Router) Note:...
Page 428 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 The IP address of the gateway WAN port can be either fixed or dynamic. If the IP address is dynamic, you need to use an FQDN. If the IP address is fixed, an FQDN is optional. VPN Telecommuter: Dual-Gateway WAN Ports for Improved Reliability In a gateway configuration with dual WAN ports that function in auto-rollover mode, the remote computer client initiates the VPN tunnel with the active gateway WAN port (port...
Page 429 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 VPN Telecommuter: Dual-Gateway WAN Ports for Load Balancing In a gateway configuration with dual WAN ports that function in load balancing mode, the remote computer client initiates the VPN tunnel with the appropriate gateway WAN port (that is, port WAN1 or WAN2 as necessary to balance the loads of the two gateway WAN ports) because the IP address of the remote NAT router is not known in advance.
Page 430: Appendix C System Logs And Error Messages
System Logs and Error Messages This appendix provides examples and explanations of system logs and error message. When applicable, a recommended action is provided. This appendix contains the following sections: • System Log Messages • Routing Logs • Other Event Logs •...
Page 431: Log Message Terms
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Log Message Terms This appendix uses the following log message terms. Table 106. Log message terms Term Description [SRX5308] System identifier. [kernel] Message from the kernel. CODE Protocol code (for example, protocol is ICMP, type 8) and CODE=0 means successful reply.
Page 432: Ntp
Table 107. System logs: NTP Message Nov 28 12:31:13 [SRX5308] [ntpdate] Looking Up time-f.netgear.com Nov 28 12:31:13 [SRX5308] [ntpdate] Requesting time from time-f.netgear.com Nov 28 12:31:14 [SRX5308] [ntpdate] adjust time server 69.25.106.19 offset 0.140254 sec Nov 28 12:31:14 [SRX5308] [ntpdate] Synchronized time with time-f.netgear.com...
Page 433: System Startup
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 108. System logs: login/logout (continued) Recommended action None Message Nov 28 14:55:09 [SRX5308] [seclogin] Logout succeeded for user admin Nov 28 14:55:13 [SRX5308] [seclogin] Login succeeded: user admin from 192.168.1.214 Explanation Secure login/logout of user admin from host with IP address 192.168.1.214.
Page 434: Ipsec Restart
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 IPSec Restart This section describes logs that are generated when IPSec restarts. Table 112. System logs: IPSec restart Message Jan 23 16:20:44 [SRX5308] [wand] [IPSEC] IPSEC Restarted Explanation Log generated when the IPSec is restarted. This message is logged when IPSec restarts after any changes in the configuration are applied.
Page 435: Wan Status
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Multicast/Broadcast Logs Table 115. System logs: multicast/broadcast Message Jan 1 07:24:13 [SRX5308] [kernel] MCAST-BCAST IN=WAN OUT=SELF SRC= 192.168.1.73 DST=192.168.1.255 PROTO=UDP SPT=138 DPT=138 Explanation • This multicast or broadcast packet is sent to the device from the WAN network. •...
Page 436: Ppp Logs
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 This section describes the logs generated when the WAN mode is set to auto-rollover. Table 117. System logs: WAN status, auto-rollover Message Nov 17 09:59:09 [SRX5308] [wand] [LBFO] WAN1 Test Failed 1 of 3 times_ Nov 17 09:59:39 [SRX5308] [wand] [LBFO] WAN1 Test Failed 2 of 3 times_ Nov 17 10:00:09 [SRX5308] [wand] [LBFO] WAN1 Test Failed 3 of 3 times_ Nov 17 10:01:01 [SRX5308] [wand] [LBFO] WAN1 Test Failed 4 of 3 times_...
Page 437 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 • PPPoE Idle Timeout Logs Table 118. System logs: WAN status, PPPoE idle time-out Message Nov 29 13:12:46 [SRX5308] [pppd] Starting connection Nov 29 13:12:49 [SRX5308] [pppd] Remote message: Success Nov 29 13:12:49 [SRX5308] [pppd] PAP authentication succeeded Nov 29 13:12:49 [SRX5308] [pppd] local IP address 50.0.0.62 Nov 29 13:12:49 [SRX5308] [pppd] remote IP address 50.0.0.1 Nov 29 13:12:49 [SRX5308] [pppd] primary DNS address 202.153.32.3...
Page 438: Resolved Dns Names
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 119. System logs: WAN status, PPTP idle time-out (continued) Explanation Message 1: Starting PPP connection process. Message 2: Message from the server for authentication success. Message 3: Local IP address assigned by the server. Message 4: Server side IP address.
Page 439: Vpn Log Messages
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 VPN Log Messages This section explains logs that are generated by IPSec VPN and SSL VPN policies. These logs are generated automatically and do not need to be enabled. IPSec VPN Logs This section describes the log messages generated by IPSec VPN policies.
Page 440 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 122. System logs: IPSec VPN tunnel, tunnel establishment (continued) Messages 22 and 23 2000 Jan 1 04:13:40 [SRX5308] [IKE] Responding to new phase 2 negotiation: 20.0.0.2[0]<=>20.0.0.1[0]_ 2000 Jan 1 04:13:40 [SRX5308] [IKE] Using IPSec SA configuration: 192.168.11.0/24<->192.168.10.0/24_ Messages 24 and 25 2000 Jan 1 04:13:41 [SRX5308] [IKE] IPSec-SA established: ESP/Tunnel...
Page 441 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 123. System logs: IPSec VPN tunnel, SA lifetime (150 sec in phase 1; 300 sec in phase 2), VPN tunnel is reestablished (continued) Explanation Message 1: Informational exchange for deleting the payload. Message 2–6: Phase 2 configuration is purged and confirms that no phase 2 is bounded.
Page 442 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 125. System logs: IPSec VPN tunnel, Dead Peer Detection and keep-alive (default 30 sec) (continued) Explanation Message 1–4: After receiving a request for phase 1 negotiation, a Dead Peer Detection Vendor ID is received. Message 5: DPD is enabled.
Page 443 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 128. System logs: IPSec VPN tunnel, client policy behind a NAT device 2000 Jan 1 01:54:21 [SRX5308] [IKE] Floating ports for NAT-T with peer 20.0.0.1[4500]_ 2000 Jan 1 01:54:21 [SRX5308] [IKE] NAT-D payload matches for 20.0.0.2[4500]_ Message 3 2000 Jan 1 01:54:21 [SRX5308] [IKE] NAT-D payload does not match for...
Page 444: Traffic Meter Logs
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 131. System logs: VPN log messages, port forwarding, LAN host and interface Message 2000 Jan 1 01:35:41 [SRX5308] [portforwarding] id=SRX5308 time="2000-1-1 1:35:41" fw=192.168.11.1 pri=6 rule=access-policy proto="Virtual Transport (Java)" src=192.168.11.2 user=sai dst=192.168.11.1 arg= ""...
Page 445: Lan To Wan Logs
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 LAN to WAN Logs Table 133. Routing logs: LAN to WAN Message Nov 29 09:19:43 [SRX5308] [kernel] LAN2WAN[ACCEPT] IN=LAN OUT=WAN SRC=192.168.10.10 DST=72.14.207.99 PROTO=ICMP TYPE=8 CODE=0 Explanation • This packet from LAN to WAN has been allowed by the firewall. •...
Page 446: Dmz To Lan Logs
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 DMZ to LAN Logs Table 137. Routing logs: DMZ to WAN Message Nov 29 09:44:06 [SRX5308] [kernel] DMZ2LAN[DROP] IN=DMZ OUT=LAN SRC= 192.168.20.10 DST=192.168.10.10 PROTO=ICMP TYPE=8 CODE=0 Explanation • This packet from DMZ to LAN has been dropped by the firewall. •...
Page 447: Source Mac Filter Logs
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Source MAC Filter Logs Table 140. Other event logs: source MAC filter logs Message 2000 Jan 1 06:40:10 [SRX5308] [kernel] SRC_MAC_MATCH[DROP] SRC MAC = 00:12:3f:34:41:14 IN=LAN OUT=WAN SRC=192.168.11.3 DST=209.85.153.103 PROTO=ICMP TYPE=8 CODE=0 Explanation Because MAC address 00:12:3f:34:41:14 of LAN host with IP address 192.168.11.3 is filtered so that it cannot access the Internet, the packets sent by...
Page 448 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 Table 143. DHCP logs Message 1 2000 Jan 1 07:27:28 [SRX5308] [dhcpd] Listening on LPF/eth0.1/00:11:22:78:89:90/192.168.11/24 Message 2 2000 Jan 1 07:27:37 [SRX5308] [dhcpd] DHCPRELEASE of 192.168.10.2 from 00:0f:1f:8f:7c:4a via eth0.1 (not found) Message 3 2000 Jan 1 07:27:47 [SRX5308] [dhcpd] DHCPDISCOVER from 00:0f:1f:8f:7c:4a via eth0.1...
Page 449: Appendix D Two-Factor Authentication
Two-Factor Authentication This appendix provides an overview of two-factor authentication, and an example of how to implement the WiKID solution. This appendix contains the following sections: • Why Do I Need Two-Factor Authentication? • NETGEAR Two-Factor Authentication Solutions...
Page 450: Why Do I Need Two-Factor Authentication
NETGEAR has also recognized the need to provide more than just a firewall to protect the networks. NETGEAR has implemented a more robust authentication system known as two-factor authentication (2FA or T-FA) to help address the fast-growing network security issues.
Page 451: Netgear Two-Factor Authentication Solutions
NETGEAR Two-Factor Authentication Solutions NETGEAR has implemented 2 two-factor authentication solutions from WiKID. WiKID is the software-based token solution. So instead of using only Windows Active Directory or LDAP as the authentication server, administrators now can use WiKID to perform two-factor authentication on NETGEAR SSL and VPN firewall products.
Page 452 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 A one-time passcode (something the user has) is generated. Figure 283. Note: The one-time passcode is time-synchronized to the authentication server so that the OTP can be used only once and needs to be used before the expiration time.
Page 453: Appendix E Notification Of Compliance
This transmitter must not be co-located or operating in conjunction with any other antenna or transmitter. FCC Declaration Of Conformity We, NETGEAR, Inc., 350 East Plumeria Drive, San Jose, CA 95134, declare under our sole responsibility that the ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 complies with Part 15 of FCC Rules.
Page 454 Connect the equipment into an electrical outlet on a circuit different from that which the radio receiver is connected. • Consult the dealer or an experienced radio/TV technician for help. Modifications made to the product, unless expressly approved by NETGEAR, Inc., could void the user's right to operate the equipment. Notification of Compliance...
Page 455: Index
Index Numerics IKE policy settings Mode Config settings 10BASE-T, 100BASE-T, and 1000BASE-T speeds SNMPv3 user settings – – 3322.org VPN policy settings 6to4 tunnels alternate network, multicast pass-through configuring globally application level gateway (ALG) DMZ, configuring for ARP (Address Resolution Protocol) LAN, configuring for broadcasting, configuring requests...
Page 456 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 IPv6 See also configuring MIAS (Microsoft Internet Authentication Ser- vice) described RADIUS authentication VPN IPSec WiKID autosensing port speed classical routing (IPv4), configuring CLI (command-line interface) client identifier backing up configuration file command-line interface (CLI) –...
Page 457 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 DMZ port WAN QoS priority queue IPv4 address and subnet mask delegating, IPv6 prefixes IPv6 address and prefix length LAN DHCPv6 server WAN DHCPv6 client settings domain, users demilitarized zone. See DMZ. DPD settings denial of service (DoS) factory...
Page 458 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 SSL VPN settings IKE policies server IPv6 addresses broadband settings DMZ settings factory default settings LAN settings – list of SSL VPN settings reverting to DNS logs, viewing Factory Defaults Reset button documentation, online failover attempts, DNS lookup or ping domain name blocking...
Page 459 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 global addresses, IPv6 LAN-to-DMZ rules LAN-to-WAN rules global IPv6 tunnels DMZ, configuring for order of precedence LAN, configuring for overview QoS profile, ToS group and global policies, configuring for SSL VPN scheduling groups –...
Page 460 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 DHCP, address pool SSL VPN DMZ port clients, configuring DNS servers policies, configuring dynamically assigned resources, configuring errors static or permanent ISATAP tunnel address tunnel addresses, viewing L2TP server unique global address MAC bindings VPN tunnels port forwarding, SSL VPN...
Page 461 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 limits IPv4 sessions Java, blocking LAN traffic volume WAN traffic volume link-local addresses, IPv6 link-local advertisements, IPv6 keep-alives, VPN tunnels DMZ, configuring for keyword blocking LAN, configuring for kit, rack-mounting load balancing mode knowledge base bandwidth capacity –...
Page 462 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 management default settings LAN groups PPTP and PPPoE accounts maximum transmission unit (MTU) default NAS (Network Access Server) IPv6 DMZ packets NAT (Network Address Translation) IPv6 LAN packets configuring MCHAP (Microsoft CHAP) described firewall, use with mapping, one-to-one...
Page 463 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 IPv6 Point-to-Point Tunneling Protocol (PPTP) server settings DMZ-to-WAN rules settings LAN-to-DMZ rules policies LAN-to-WAN rules order of precedence exchange mode overview QoS profile, ToS ISAKMP identifier reducing traffic managing scheduling Mode Config operation service blocking XAUTH –...
Page 464 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 – PPPoE (PPP over Ethernet) protection from common attacks described – protocol binding, configuring IPv4 settings protocols IPv6 settings compatibilities PPTP (Point-to-Point Tunneling Protocol) server settings service numbers settings traffic volume by protocol users PSK.
Page 465 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 remote users, assigning addresses (Mode Config) Secure Hash Algorithm 1. See SHA-1. requirements, hardware secure HTTP management reserved IPv4 addresses, configuring security association. See SA. Reset button security checks, LAN – resources, SSL VPN, configuring security level, SNMPv3 users restarting traffic meter (or counter) security lock...
Page 466 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 SPI (stateful packet inspection) system date and time settings, configuring split tunnel, SSL VPN logs spoofing MAC addresses – status, viewing SSL certificate, warning and downloading updating firmware SSL VPN system log messages, explanation ActiveX web cache cleaner ActiveX-based client authentication...
Page 467 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 rate-limiting user name, default – reducing user passwords, changing volume by protocol user policies, configuring for SSL VPN volume, limiting user portal – user types users Transmission Control Protocol (TCP) active VPN, PPTP, and L2TP traps, SNMP administrative (admin) settings troubleshooting...
Page 468 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 – FQDNs FQDNs, configuring endpoints gateway-to-gateway advanced settings (IPv4 and IPv6) auto-rollover auto-rollover mode load balancing DDNS single WAN port mode IPv4 gateway-to-gateway, using IPSec VPN Wizard – configuring described IKE policies IPv6 exchange mode configuring...
Page 469 ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308 LAN WAN outbound rules, configuring locking yourself out configuring an exposed host disabling local authentication disabling secure HTTP management enabling MAC filtering resetting to factory defaults restoring settings from a backup file SSL certificate message web component blocking web management interface...

NETGEAR ProSAFE SRX5308 Reference Manual

Chapter 1 Introduction

Chapter 2 Ipv4 and Ipv6 Internet and WAN Settings

Chapter 3 LAN Configuration

Chapter 4 Firewall Protection

Chapter 5 Virtual Private Networking Using Ipsec and L2TP Connections

Chapter 6 Virtual Private Networking Using SSL Connections

Chapter 7 Manage Users, Authentication, and VPN Certificates

Chapter 8 Network and System Management

Chapter 9 Monitor System Access and Performance

Chapter 10 Troubleshooting

Appendix A Default Settings and Technical Specifications

Appendix B Network Planning for Multiple WAN Ports

Appendix C System Logs and Error Messages

Appendix D Two-Factor Authentication

Appendix E Notification of Compliance

Index

Quick Links

Troubleshooting

Related Manuals for NETGEAR ProSAFE SRX5308

Summary of Contents for NETGEAR ProSAFE SRX5308