Netgear FWG114P FWG114P Reference Manual
Netgear FWG114P - ProSafe 802.11g Wireless Firewall Manual
 |
UPC - 606449029819
View all Netgear FWG114P manuals
Add to My Manuals
Save this manual to your list of manuals |
Netgear FWG114P manual content summary:
- Netgear FWG114P | FWG114P Reference Manual - Page 1
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P NETGEAR, Inc. 4500 Great America Parkway Santa Clara, CA 95054 USA 202-10027-01 Version 2.0 March 2004 March 2004, 202-10027-01 - Netgear FWG114P | FWG114P Reference Manual - Page 2
generates, uses, and can radiate radio frequency energy and, if not installed and used in accordance with the instructions, may cause user authority to operate the equipment. EN 55 022 Declaration of Conformance This is to certify that the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P - Netgear FWG114P | FWG114P Reference Manual - Page 3
Manufacturer/Importer It is hereby certified that the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P has been suppressed in accordance with the conditions set areas. When used near a radio or TV receiver, it may become the cause of radio interference. Read instructions for correct - Netgear FWG114P | FWG114P Reference Manual - Page 4
iv March 2004, 202-10027-01 - Netgear FWG114P | FWG114P Reference Manual - Page 5
Manual Audience, Conventions, Scope 1-1 How to Use this Manual 1-2 How to Print this Manual 1-3 Chapter 2 Introduction Key Features of the FWG114P 2-1 Full Routing on Both the Broadband and Serial Ports 2-2 802.11g and 802.11b Wireless the FWG114P Wireless Firewall/Print Server 3-4 Verify - Netgear FWG114P | FWG114P Reference Manual - Page 6
Basic Setup Troubleshooting Tips 3-9 FWG114P Setup Wizard Auto Detection 3-9 Wizard-Detected Login Account Setup 3-10 Wizard-Detected Dynamic IP Account Setup 3-12 Wizard-Detected Fixed IP Account Setup 3-13 How to Configure the Serial Port as the Primary Internet Connection 3-14 Testing Your - Netgear FWG114P | FWG114P Reference Manual - Page 7
For Windows XP and 2000, Use TCP/IP LPR Printing 7-2 For Windows 95/98/Me, Use the Netgear Printer Port Driver 7-5 Printing from the Macintosh 7-8 Windows Printer Port Management 7-9 Troubleshooting the Print Server 7-11 Chapter 8 Virtual Private Networking Overview of FWG114P Policy-Based VPN - Netgear FWG114P | FWG114P Reference Manual - Page 8
PC 8-46 Monitoring the PC VPN Connection 8-46 Viewing the FWG114P VPN Status and Log Information 8-47 Chapter 9 Maintenance Viewing Wireless Firewall/Print Server Status Information 9-1 Viewing a List of Attached Devices 9-5 Upgrading the Router Software 9-6 Configuration File Management - Netgear FWG114P | FWG114P Reference Manual - Page 9
LAN TCP/IP Setup Parameters 10-5 Using the Router as a DHCP server 10-7 Using Address Reservation 10-7 Configuring Static Routes 10-8 Enabling Remote Management Access 10-10 Using Universal Plug and Play (UPnP 10-11 Advanced Wireless Settings 10-12 Chapter 11 Troubleshooting Basic Functioning - Netgear FWG114P | FWG114P Reference Manual - Page 10
8.6 or 9.x ...C-6 MacOS X ...C-7 Verifying TCP/IP Properties for Macintosh Computers C-8 Verifying the Readiness of Your Internet Account C-9 Are Login Protocols Used C-9 What Is Your Configuration Information C-9 Obtaining ISP Configuration Information for Windows Computers C-10 Obtaining ISP - Netgear FWG114P | FWG114P Reference Manual - Page 11
D-6 System Admin Sessions D-6 Policy Administration LOG D-7 Appendix E Wireless Networking Basics Wireless Networking Overview E-1 Infrastructure Mode E-1 Ad Hoc Mode (Peer-to-Peer Workgroup E-2 Network Name: Extended Service Set Identification (ESSID E-2 Authentication and WEP Data Encryption - Netgear FWG114P | FWG114P Reference Manual - Page 12
10 VPNC IKE Phase I Parameters F-10 VPNC IKE Phase II Parameters F-11 Testing and Troubleshooting F-11 Additional Reading ...F-11 Appendix G NETGEAR VPN Configuration FVS318 or FVM318 to FWG114P Configuration Template G-1 Step-By-Step Configuration of FVS318 or FVM318 Gateway A G-2 Step-By-Step - Netgear FWG114P | FWG114P Reference Manual - Page 13
Step-By-Step Configuration of FVS328 Gateway B H-7 Test the VPN Connection H-11 Glossary List of Glossary Terms G-1 Index Contents xiii March 2004, 202-10027-01 - Netgear FWG114P | FWG114P Reference Manual - Page 14
xiv Contents March 2004, 202-10027-01 - Netgear FWG114P | FWG114P Reference Manual - Page 15
these specifications. Table 1-1. Manual Specifications Product Version ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P v2 Firmware Version Version 2 Release 06 Manual Veraion and Publication Date Manual Version 2.0, March 2004 Note: Product updates are available on the NETGEAR - Netgear FWG114P | FWG114P Reference Manual - Page 16
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P How to Use this Manual The HTML version of this manual includes a variety of navigation features as well as links to PDF versions of the full manual and individual chapters. 1 2 3 Figure Preface -2: HTML - Netgear FWG114P | FWG114P Reference Manual - Page 17
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P How to Print this Manual To print this manual you may choose one of the following options, according to your needs: • Printing a "How To" Sequence of Steps in the HTML View. Use the Print button on the upper - Netgear FWG114P | FWG114P Reference Manual - Page 18
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P 1-4 About This Manual March 2004, 202-10027-01 - Netgear FWG114P | FWG114P Reference Manual - Page 19
. With minimum setup, you can install and use the router within minutes. The FWG114P Wireless Firewall/Print Server provides the following features: • 802.11g and 802.11b standards-based wireless networking. • Easy, Web-based setup for installation and management. • Supports two VPN tunnels, Content - Netgear FWG114P | FWG114P Reference Manual - Page 20
to log in remotely through the serial port to access a server on your LAN, other LAN resources, or the Internet, based on a user name and password you define. • LAN-to-LAN access between two FWG114P wireless firewall/print servers through the serial port, with the option of enabling auto-failover - Netgear FWG114P | FWG114P Reference Manual - Page 21
remote networks or clients. Its VPN features include: • Support for up to 2 simultaneous VPN connections. • Support for industry standard VPN protocols. The ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P supports standard keying methods (Manual or IKE), standard authentication methods - Netgear FWG114P | FWG114P Reference Manual - Page 22
preventing users outside the LAN from finding and directly accessing the PCs on the LAN. • Port forwarding with NAT. Although NAT prevents Internet locations from directly accessing the PCs on the LAN, the router allows you to direct incoming traffic to specific PCs based on the service port number - Netgear FWG114P | FWG114P Reference Manual - Page 23
ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P • The ability to enable or disable IP address sharing by NAT. The FWG114P allows several networked PCs to share an Internet account using only a single IP address, which may be statically or dynamically assigned by your Internet service - Netgear FWG114P | FWG114P Reference Manual - Page 24
for firmware upgrades. Package Contents The product package should contain the following items: • ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P. • AC power adapter. • Category 5 (Cat 5) Ethernet cable. • FWG114P Installation Guide (M-10150-02). • Resource CD for the ProSafe Wireless - Netgear FWG114P | FWG114P Reference Manual - Page 25
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P The FWG114P Front Panel The front panel of the FWG114P contains the status LEDs. Use the LEDs to verify various operations. Viewed from left to right, Table 2-1 describes the LEDs on the front of the router. - Netgear FWG114P | FWG114P Reference Manual - Page 26
FWG114P Rear Panel Viewed from left to right, the rear panel contains the following features: • Wireless antenna. • DB-9 serial port for modem connection. • USB 2.0 Printer Port. • Factory Default Reset push button. • Four Ethernet LAN ports. • Internet Ethernet WAN port for connecting the router - Netgear FWG114P | FWG114P Reference Manual - Page 27
how to set up the router on your local area network (LAN) and connect to the Internet. You will find out how to configure your ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P for Internet access using the Setup Wizard, or how to manually configure your Internet connection. What - Netgear FWG114P | FWG114P Reference Manual - Page 28
settings for each tab page. - For Macintosh computers, open the TCP/IP or Network control panel. Record all the settings for each section. • You may also refer to the FWG114P Resource CD for the NETGEAR Router ISP Guide which provides Internet connection information for many ISPs. Once you locate - Netgear FWG114P | FWG114P Reference Manual - Page 29
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Record Your Internet Connection Information Print this page. Fill in the configuration parameters from your Internet Service Provider (ISP). ISP Login Name: The login name and password are case sensitive and must - Netgear FWG114P | FWG114P Reference Manual - Page 30
have your broadband Internet service settings handy. • The computer is configured to obtain an IP address automatically via DHCP. For instructions on how to do this, please see the Reference Manual on the Resource CD for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P (SW-10023-02 - Netgear FWG114P | FWG114P Reference Manual - Page 31
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P c. Securely insert the Ethernet cable from your broadband modem into the Internet port (B) on the FWG114P. Internet Port MODEM USB BLOCAL 4 3 2 10/100M 1 IN TER N ET 12VDC, 1.0A Broadband modem Figure 3-2: - Netgear FWG114P | FWG114P Reference Manual - Page 32
, do not run that software, or cancel it if it starts automatically. Broadband ProSafe 802.11g Wireless Firewall/Print Server PWR ACT TEST ALERT PR IN TER ACT LINK M O DEM 100 1 LNK/ACT IN TER N ET 2 3 LO CA L MODEL FWG114P 100 4 LNK/ACT W LA N Power Test Internet Port Local Port 4 Figure - Netgear FWG114P | FWG114P Reference Manual - Page 33
to the wireless firewall/print server by typing http://192.168.0.1 in the address field of Internet Explorer or Netscape® Navigator. Figure 3-5: Log in to the firewall c. Enter admin for the router user name and password for the router password, both in lower case letters.A login window opens as - Netgear FWG114P | FWG114P Reference Manual - Page 34
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P 4. RUN THE SETUP WIZARD TO CONNECT TO THE INTERNET Figure 3-7: Setup Wizard a. You are now connected to the router. If you do not see the menu above, click the Setup Wizard link on the upper left of the main menu. - Netgear FWG114P | FWG114P Reference Manual - Page 35
turned NAT off and are managing the IP addresses directly. For instructions on these configuration settings, please see the Reference Manual on the Resource CD for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P (SW-10023-02). FWG114P Setup Wizard Auto Detection There are two ways - Netgear FWG114P | FWG114P Reference Manual - Page 36
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P • Fixed IP address assignment Next, the Setup Wizard will report which connection type it has discovered, and then display the appropriate configuration menu. If the Setup Wizard finds no connection, you will be - Netgear FWG114P | FWG114P Reference Manual - Page 37
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Note: You will no longer need to launch the ISP's login program on your computer in order to access the Internet. When you start an Internet application, your firewall will automatically log you in. 3. The Idle - Netgear FWG114P | FWG114P Reference Manual - Page 38
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Wizard-Detected Dynamic IP Account Setup If the Setup Wizard determines that your Internet service account uses Dynamic IP assignment, you will be directed to the menu shown in Figure 3-9 below: Figure 3-9: Setup - Netgear FWG114P | FWG114P Reference Manual - Page 39
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P If your ISP allows access from only one specific computer's Ethernet MAC address, select "Use this MAC address." The firewall will then capture and use the MAC address of the computer that you are now using. You - Netgear FWG114P | FWG114P Reference Manual - Page 40
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P 1. Enter your assigned IP Address, Subnet Mask, and the IP Address of your ISP's gateway router. This information should have been provided to you by your ISP. You will need the configuration parameters from your - Netgear FWG114P | FWG114P Reference Manual - Page 41
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Figure 3-11: Serial Internet Connection To configure the Internet IP settings, fill in the address parameters your ISP provided. d. Configure the Modem parameters. Connecting the FWG114P to the Internet March - Netgear FWG114P | FWG114P Reference Manual - Page 42
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Note: You can validate modem string settings by first connecting the modem directly to a computer, establishing a connection to your ISP, and then copying the modem - Netgear FWG114P | FWG114P Reference Manual - Page 43
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Manually Configuring Your Internet Connection You can manually configure your firewall using the menu below, or you can allow the Setup Wizard to determine your configuration as described in the previous section. - Netgear FWG114P | FWG114P Reference Manual - Page 44
the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P How to Manually Configure the Primary Internet Connection Use these steps to manually configure the primary Internet connection in the Basic Settings menu. 1. Select your Internet connection type (broadband with or without login, or - Netgear FWG114P | FWG114P Reference Manual - Page 45
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P 7. Router's MAC Address: This section determines the Ethernet MAC address that will be used by the firewall on the Internet port. Some ISPs will register the Ethernet MAC address of the network interface card in - Netgear FWG114P | FWG114P Reference Manual - Page 46
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P 3-20 Connecting the FWG114P to the Internet March 2004, 202-10027-01 - Netgear FWG114P | FWG114P Reference Manual - Page 47
, please see Appendix A, "Technical Specifications." The operating distance or range of your wireless connection can vary significantly based on the physical placement of the FWG114P Wireless Firewall/Print Server. The latency, data throughput performance, and notebook power consumption also - Netgear FWG114P | FWG114P Reference Manual - Page 48
Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Implementing Appropriate Wireless Security Note: Indoors, computers can connect to wireless this reason, use the security features of your wireless equipment. The FWG114P Wireless Firewall/Print Server provides highly - Netgear FWG114P | FWG114P Reference Manual - Page 49
Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P wireless device driver and software availability may be limited. Understanding Wireless Settings To configure the wireless settings of your FWG114P, click the Wireless link in the Setup section of the main menu. The wireless - Netgear FWG114P | FWG114P Reference Manual - Page 50
in the 802.11b/g wireless network will need to use this SSID for that network. The FWG114P default SSID is: NETGEAR. - Region. This field identifies the region where the FWG114P can be used. It may not be legal to operate the wireless features of the wireless firewall/print server in a region other - Netgear FWG114P | FWG114P Reference Manual - Page 51
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P • Security Options Table 4-1. Field Disable WEP (Wired Equivalent Privacy) Wireless Security Options Description Wireless security is not used. You can select the following WEP options: Authentication Type • Open - Netgear FWG114P | FWG114P Reference Manual - Page 52
is required on the client. Windows XP and Windows 2000 with Service Pack 3 do include the client software that supports WPA. Nevertheless, the wireless adapter hardware and driver must also support WPA. WPA User authentication is implemented using RADIUS servers. For a full explanation of WPA - Netgear FWG114P | FWG114P Reference Manual - Page 53
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Default Factory Settings The FWG114P default factory settings shown below. You can restore these defaults with the Factory Default Restore button on the rear panel as seen in the illustration "FWG114P Rear Panel" - Netgear FWG114P | FWG114P Reference Manual - Page 54
: The Service Set Identification (SSID) identifies the wireless local area network. Wireless is the default FWG114P SSID. However, you may customize it by using up to 32 alphanumeric characters. Write your customized SSID on the line below. Note: The SSID in the wireless firewall/print server is the - Netgear FWG114P | FWG114P Reference Manual - Page 55
. The default SSID is NETGEAR. Note: The characters are case sensitive. An access point always functions in infrastructure mode. The SSID for any wireless device communicating with the access point must match the SSID configured in the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P. If - Netgear FWG114P | FWG114P Reference Manual - Page 56
, follow these steps: 1. Log in at the default LAN address of http://192.168.0.1 with the default user name of admin and default password of password. 2. Click Wireless in the main menu of the FWG114P. From the Wireless Settings menu, click Setup Access List. 3. Click the Turn Access Control On - Netgear FWG114P | FWG114P Reference Manual - Page 57
or access the wireless firewall/print server from a wired computer to make any further changes. To configure WEP data encryption, follow these steps: 1. Log in at the default LAN address of http://192.168.0.1 with the default user name of admin and default password of password, or using whatever LAN - Netgear FWG114P | FWG114P Reference Manual - Page 58
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P How to Configure WPA Note: Not all wireless adapters support WPA. Furthermore, client software is required on the client. Windows XP and Windows 2000 with Service Pack 3 do include the client software that supports - Netgear FWG114P | FWG114P Reference Manual - Page 59
Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P How to Configure WPA-PSK Note: Not all wireless adapters support WPA. Furthermore, client software is required on the client. Windows XP and Windows 2000 with Service Pack 3 do include the client software that supports - Netgear FWG114P | FWG114P Reference Manual - Page 60
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P 4-14 March 2004, 202-10027-01 Wireless Configuration - Netgear FWG114P | FWG114P Reference Manual - Page 61
Configuration This chapter describes how to configure the serial port options of your ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P. The FWG114P serial port lets you share the broadband connection of another FWG114P, share resources between two LANs, and take advantage of the routing - Netgear FWG114P | FWG114P Reference Manual - Page 62
Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Configuring a Serial Port Modem You can configure a serial port modem Port section. Figure 5-1: Serial Port Modem configuration menu 2. Select the Serial Line Speed. This is the maximum speed the modem will attempt to use. - Netgear FWG114P | FWG114P Reference Manual - Page 63
Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P - For dial-up, "Standard Modem" should work in most cases. Otherwise, select your modem from the list. - If your modem is not on the list, select "User Defined" and enter the Modem Properties. If you are using the "User - Netgear FWG114P | FWG114P Reference Manual - Page 64
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Figure 5-2: Auto-Rollover configuration menu 3. Configure the Auto-Rollover settings. 4. Click Apply for the changes to take effect. Configuring Dial-in on the Serial Port Dial-in lets a single remote computer - Netgear FWG114P | FWG114P Reference Manual - Page 65
Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Basic Requirements for Dial-in Dial-in requires these elements: 1. A broadband connection to the FWG114P. 2. An analog phone line. 3. A serial modem properly configured and attached to the DB9 connector on the serial port - Netgear FWG114P | FWG114P Reference Manual - Page 66
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Configuring LAN-to-LAN Settings LAN-to-LAN enables direct communications between two FWG114P wireless firewall/print servers. 6HULDO&RQQHFWLRQ )LUHZDOO$ )LUHZDOO% Á?aM?™a +Á.?wjËo 8‰ÁjjÄÄˉÁj jÁÜjÁ - Netgear FWG114P | FWG114P Reference Manual - Page 67
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Figure 5-5: LAN-to-LAN configuration menu 3. Configure the LAN-to-LAN settings. Note: The LAN subnet address of each FWG114P must be different. 4. Click Apply for the changes to take effect. Serial Port - Netgear FWG114P | FWG114P Reference Manual - Page 68
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P 5-8 Serial Port Configuration March 2004, 202-10027-01M-10207-01, Reference Manual v2 - Netgear FWG114P | FWG114P Reference Manual - Page 69
describes how to use the content filtering features of the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P to protect addresses, and Web address keywords. You can also block Internet access by applications and services, such as chat or games. A firewall is a special category of router - Netgear FWG114P | FWG114P Reference Manual - Page 70
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P • Web addresses • Web address keywords These options Proxy: blocks use of a proxy server • Java: blocks use of Java applets • ActiveX: blocks use of ActiveX components (OCX files) used by IE on Windows • Cookies: - Netgear FWG114P | FWG114P Reference Manual - Page 71
the Trusted User will be identified by an IP address, you should configure that computer with a fixed or reserved IP address. Services and Rules Regulate Inbound and Outbound Traffic The ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P firewall lets you regulate what ports are available - Netgear FWG114P | FWG114P Reference Manual - Page 72
or Allow Services Firewall rules are used to block or allow specific traffic passing through from one side of the wireless firewall/print server to the other. Inbound rules (WAN to LAN) restrict access by outsiders to private resources, selectively allowing only specific outside users to access - Netgear FWG114P | FWG114P Reference Manual - Page 73
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P These default rules are shown in the Rules table of the Rules menu in Figure 6-2: Figure 6-2: Rules menu You can define additional rules that will specify exceptions to the default rules. By adding custom rules, - Netgear FWG114P | FWG114P Reference Manual - Page 74
how you combine Services and Rules to regulate how the TCP/IP protocols are used on your firewall to enable either blocking or allowing specific Internet traffic on your wireless firewall/print server. Inbound Rules (Port Forwarding) Because the FWG114P uses Network Address Translation (NAT), your - Netgear FWG114P | FWG114P Reference Manual - Page 75
the server using the external WAN IP address will fail. Remember that allowing inbound services opens holes in your FWG114P Wireless Firewall/Print Server. Only enable those ports that are necessary for your network. Following are two application examples of inbound rules: Example: Port Forwarding - Netgear FWG114P | FWG114P Reference Manual - Page 76
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P This rule is shown in Figure 6-3. Example: Port Forwarding for Videoconferencing If you want to allow incoming videoconferencing to be initiated from a restricted range of outside IP addresses, such as from a - Netgear FWG114P | FWG114P Reference Manual - Page 77
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Figure 6-5: Service example: port forwarding for VPN when NAT is Off In the example shown in Figure 6-5, UDP port 500 connections are defined as the IPSec service. Figure 6-6: Inbound rule example: VPN IPSec when - Netgear FWG114P | FWG114P Reference Manual - Page 78
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P • IP address of the Internet site being contacted (destination address) • Time of day • Type of service being requested (service port number) Outbound Rule Example: Blocking Instant Messaging If you want to block - Netgear FWG114P | FWG114P Reference Manual - Page 79
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Order of Precedence for Rules As you define new rules, they are added to the tables in the Rules menu. For any traffic attempting to - Netgear FWG114P | FWG114P Reference Manual - Page 80
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Using a Schedule to Block or Allow Content or Traffic If you enabled content filtering in the Block Sites menu, or if you defined an outbound rule to use a schedule, you can set up a schedule for when blocking - Netgear FWG114P | FWG114P Reference Manual - Page 81
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Note: Enter the values in 24- finished configuring this menu. Setting the Time Zone The FWG114P Wireless Firewall/Print Server uses the Network Time Protocol (NTP) to obtain the current time and date from one - Netgear FWG114P | FWG114P Reference Manual - Page 82
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Figure 6-9: E-mail menu • Turn e-mail notification on. Select this check box if you want to receive e-mail logs and alerts from the router. • Send alerts and logs by e-mail. If you enable e-mail notification, - Netgear FWG114P | FWG114P Reference Manual - Page 83
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P - If a Denial of Service attack is detected. - If a Port Scan is detected. - If a user on your LAN attempts to access a website that you blocked using Keyword blocking. • Send logs according to this schedule. You - Netgear FWG114P | FWG114P Reference Manual - Page 84
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Viewing Logs of Web Access or Attempted Web Access The router will log security-related events, such as denied incoming and outgoing service requests, hacker probes, and administrator logins. If you enable content - Netgear FWG114P | FWG114P Reference Manual - Page 85
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Log action buttons are described in Table • Other connections and traffic to this Router - If checked, this will log traffic sent to this Router (rather than through this Router to the Internet). • Allow duplicate - Netgear FWG114P | FWG114P Reference Manual - Page 86
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Enable one of these three options, as required: • Disable - select this if you do not have a Syslog server. • Broadcast on LAN - the Syslog data is broadcast, rather than sent to a specific Syslog server. Use this - Netgear FWG114P | FWG114P Reference Manual - Page 87
LAN IP address of the FWG114P. • For Windows 95/98/Me, NT4.0, 2000, and XP: Netgear Printer Port Driver - Install the Netgear Printer Port Driver on Each computer. - After installing the Print Port Driver from the Resource CD for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P (SW - Netgear FWG114P | FWG114P Reference Manual - Page 88
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P For Windows XP and 2000, Use TCP/IP LPR Printing Follow these instructions to set up TCP/IP printing on your Windows XP and 2000 PCs. Install the FWG114P, connect your printer to the USB port on the FWG114P, and - Netgear FWG114P | FWG114P Reference Manual - Page 89
ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Complete the Add Standard TCP/IP Printer Port Wizard. a. Click Next to proceed with the Add Standard TCP/IP Printer Port Wizard. The Add Port screen will display. b. From the Add Port screen, enter 192.168.0.1, the FWG114P default LAN IP - Netgear FWG114P | FWG114P Reference Manual - Page 90
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Identify the printer connected to FWG114P USB printer port. a. From the Install Printer Software screen selection lists, find the manufacturer and model of the printer you connected to the USB port on the FWG114P. - Netgear FWG114P | FWG114P Reference Manual - Page 91
Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P For Windows 95/98/Me, Use the Netgear Printer Port Driver Follow these instructions to set up the Netgear Printer Port Drive on Windows 9x PCs. Install the Netgear Printer Port Driver and configuration utility software - Netgear FWG114P | FWG114P Reference Manual - Page 92
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Set up the Netgear printer port driver. a. Click Finish when the Installation Wizard is done. The Printer Port Setup utility displays, and queries the network to locate the print server in the FWG114P. After a - Netgear FWG114P | FWG114P Reference Manual - Page 93
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Identify the printer connected to the FWG114P USB printer port. a. From the Add Printer Wizard screen selection lists, find the manufacturer and model of the printer you connected to the USB port on the FWG114P. - Netgear FWG114P | FWG114P Reference Manual - Page 94
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Print a test page to verify successful printing on your network. a. Upon completion of the Add Printer Wizard, print a test page. - From the Windows Start menu, select Setup > Printers. - Highlight the printer you - Netgear FWG114P | FWG114P Reference Manual - Page 95
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P 7. In the Printer Address field, type the name or IP address of the FWG114P Wireless Firewall/ Print Server. The IP address will usually be 192.168.0.1. You can leave the Queue Name blank. Click Verify to make sure - Netgear FWG114P | FWG114P Reference Manual - Page 96
supports multi-port models, but the FWG114P Wireless Firewall/Print Server is a single-port print server. The Port Name is shown in the Printer's Properties. • Banner Check this option to print a banner page before each print job. The User Name you enter will be printed on the banner page. If using - Netgear FWG114P | FWG114P Reference Manual - Page 97
. b. Look for an entry with a name like "NETGEAR ProSafe Firewall Router", "NETGEAR Print Server", "Print Server Driver" or "Print Server Port". c. Select this item, click Add/Remove, and confirm the deletion. Question: I am using Windows 95. The Printer Driver installed and ran, but when I selected - Netgear FWG114P | FWG114P Reference Manual - Page 98
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P c. For Network Path or Queue, enter a dummy value, such as \\123, as shown below. Select NO for "Do you print from MS-DOS-based programs?". d. Click Next. Figure 7-2: Windows Add Printer Wizard e. The printer - Netgear FWG114P | FWG114P Reference Manual - Page 99
ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P g. Right-click the new printer and select Properties. Then select the Details tab, as shown below. Figure 7-3: Windows Printer Properties h. Click the Add Port button. On the resulting screen, select Other, then select the NETGEAR Print - Netgear FWG114P | FWG114P Reference Manual - Page 100
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P k. Click OK to return to the Printers folders, and right-click on the new printer. Make sure that the Work Offline option is NOT checked. l. From the printer Properties page, General tab, print a test page to - Netgear FWG114P | FWG114P Reference Manual - Page 101
VPN) features of the FWG114P Wireless Firewall/Print Server. VPN tunnels provide secure, encrypted communications between your local network and a remote network or computer. The FWG114P supports 2 VPN tunnels. Overview of FWG114P Policy-Based VPN Configuration The FWG114P uses FWG114P VPN routers - Netgear FWG114P | FWG114P Reference Manual - Page 102
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Using Policies to Manage VPN Traffic You create policy definitions to manage VPN traffic on the FWG114P. There are two kinds of policies: • IKE Policies: Define the authentication scheme and automatically generate - Netgear FWG114P | FWG114P Reference Manual - Page 103
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P IKE Policies' Automatic Key and Authentication Management Click the IKE Policies link from the VPN section of the main menu, and then click the Add button of the IKE Policies screen to display the IKE Policy - Netgear FWG114P | FWG114P Reference Manual - Page 104
Local FWG114P Wireless Firewall/Print Server. Use this field to identify the local FWG114P. You can choose one of the following four options from the drop-down list: • By its Internet (WAN) port IP address. • By its Fully Qualified Domain Name (FQDN) -- your domain name. • By a Fully Qualified User - Netgear FWG114P | FWG114P Reference Manual - Page 105
Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Table 8-1. IKE Policy Configuration Fields Field Description Remote These parameters apply to the target remote FWG114P, VPN gateway, or VPN client. Remote Identity Type Use this field to identify the remote FWG114P - Netgear FWG114P | FWG114P Reference Manual - Page 106
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P VPN Policy Configuration for Auto Key Negotiation An already defined IKE policy is required for VPN - Auto Policy configuration. From the VPN Policies section of the main menu, you can navigate to the VPN - Auto - Netgear FWG114P | FWG114P Reference Manual - Page 107
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P The VPN Auto Policy fields are defined in the following table. Table 8-1. VPN Auto Policy Configuration Fields Field Description General These settings identify this policy and determine its major - Netgear FWG114P | FWG114P Reference Manual - Page 108
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Table 8-1. VPN Auto Policy Configuration Fields Field Description Traffic Selector These settings determine if and when a VPN tunnel will be established. If network traffic meets all criteria, then a VPN - Netgear FWG114P | FWG114P Reference Manual - Page 109
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Table 8-1. VPN Auto Policy Configuration Fields Field Description Enable Encryption Use this checkbox to enable or disable ESP Encryption. Encryption Algorithm If you enable ESP encryption, then select the - Netgear FWG114P | FWG114P Reference Manual - Page 110
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Figure 8-4: VPN - Manual Policy Menu 8-10 March 2004, 202-10027-01 Virtual Private Networking - Netgear FWG114P | FWG114P Reference Manual - Page 111
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P The VPN Manual Policy fields are defined in the following table. Table 8-1. VPN Manual Policy Configuration Fields Field Description General These settings identify this policy and determine its major - Netgear FWG114P | FWG114P Reference Manual - Page 112
Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Table 8-1. VPN Manual Policy Configuration Fields Field Description Authenticating Header (AH) Configuration AH specifies the authentication protocol for the VPN header. These settings must match the remote VPN - Netgear FWG114P | FWG114P Reference Manual - Page 113
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Table 8-1. VPN Manual Policy Configuration Fields Field Description SPI - Outgoing Enter a Hex value (3 - 8 chars). Any value is acceptable, provided the remote VPN endpoint has the same value in its " - Netgear FWG114P | FWG114P Reference Manual - Page 114
Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Table 8-1. VPN Manual forwarded over the VPN tunnel. The NETBIOS protocol is used by Microsoft Networking for such features as Network Neighborhood. Using The FWG114P is able to use certificates to authenticate users at - Netgear FWG114P | FWG114P Reference Manual - Page 115
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Whenever an IKE policy receives the certificate from a peer, it checks for this certificate in the CRL on the FWG114P obtained from the corresponding CA. If the certificate is not present in the CRL it means that - Netgear FWG114P | FWG114P Reference Manual - Page 116
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Follow this procedure to configure a VPN tunnel using the VPN Wizard. Note: The LAN IP address ranges of each VPN endpoint must be different. The connection will fail if both are using the NETGEAR default address - Netgear FWG114P | FWG114P Reference Manual - Page 117
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P 3. Fill in the IP Address or FQDN for the target VPN endpoint WAN connection and click Next. Figure 8-7: Remote IP 4. Identify the IP addresses at the target endpoint which can use this tunnel, and click Next. - Netgear FWG114P | FWG114P Reference Manual - Page 118
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Figure 8-9: VPN Wizard Summary To view the VPNC recommended authentication and encryption Phase 1 and Phase 2 settings the VPN Wizard used, click the "here" link. 5. Click Done to complete the configuration - Netgear FWG114P | FWG114P Reference Manual - Page 119
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P VPNC Scenario 1: Gateway to Gateway with Preshared Secrets The following is a typical gateway-to-gateway VPN that uses a preshared secret for authentication. 10.5.6.0/24 172.23.9.0/24 Gateway A Internet - Netgear FWG114P | FWG114P Reference Manual - Page 120
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Scenario 1: FWG114P to FWG114P with Preshared Secrets Note: This scenario assumes all ports are open on the FWG114P. You can verify this by reviewing the security settings as seen in the "Rules menu" on page 6-5. - Netgear FWG114P | FWG114P Reference Manual - Page 121
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P c. From the main menu Advanced section, click on the LAN IP Setup link. Figure 8-13: LAN IP configuration menu d. Configure the LAN IP address according to the settings above and click Apply to save your settings. - Netgear FWG114P | FWG114P Reference Manual - Page 122
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P 3. Set up the IKE Policy illustrated below on the FWG114P. a. From the main menu VPN section, click on the IKE Policies link, and then click the Add button to display the screen below. Figure 8-14: Scenario 1 IKE - Netgear FWG114P | FWG114P Reference Manual - Page 123
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P 4. Set up the FWG114P VPN -Auto Policy illustrated below. a. From the main menu VPN section, click on the VPN Policies link, and then click on the Add Auto Policy button. WAN IP address LAN IP addresses Figure 8- - Netgear FWG114P | FWG114P Reference Manual - Page 124
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P How to Check VPN Connections You can test connectivity and view VPN status information on the FWG114P. 1. To test connectivity between the Gateway A FWG114P LAN and the Gateway B LAN, follow these steps: a. Using - Netgear FWG114P | FWG114P Reference Manual - Page 125
Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P VPNC Scenario 2: Gateway-to-Gateway with Certificates The following is a typical gateway-to-gateway VPN that uses used in Scenario 2 are: • TripleDES • SHA-1 • ESP tunnel mode • MODP group 2 (1024 bits) • Perfect forward - Netgear FWG114P | FWG114P Reference Manual - Page 126
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P • Selectors for all IP protocols, all ports, between 10.5.6.0/24 and 172.23.9.0/24, using IPv4 subnets Scenario 2: FWG114P to FWG114P with Certificates The following is a typical gateway-to-gateway VPN that uses - Netgear FWG114P | FWG114P Reference Manual - Page 127
Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P b. Click the Generate Request button to display the screen illustrated in Figure 8-17 below. . FWG114P . • Optional - IP Address. If you use "IP type" in the IKE policy, you should input the IP Address here. Otherwise, you - Netgear FWG114P | FWG114P Reference Manual - Page 128
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P - E-mail Address. You can enter your e-mail address here. d. Click the Next button to continue. The FWG114P generates a Self Certificate Request as shown below. Highlight, copy and paste this data into a text file. - Netgear FWG114P | FWG114P Reference Manual - Page 129
Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P c. When you have finished gathering the Self Certificate Request data, click the Done button. You will return to the Certificates screen where your pending "FWG114P a. From the main menu VPN section, click on the Certificates - Netgear FWG114P | FWG114P Reference Manual - Page 130
Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P f. You will now see the "FWG114P" entry in the Active Self Certificates table and the pending "FWG114P use the RSA Signature instead of the shared key. Figure 8-21: IKE policy using RSA Signature b. Create a new VPN Auto - Netgear FWG114P | FWG114P Reference Manual - Page 131
Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Now, the traffic from devices within the range of the LAN subnet addresses on FWG114P A and Gateway B will be authenticated using to use the VPN tunnels managed by IKE policies which use this CA. Note: You must update the - Netgear FWG114P | FWG114P Reference Manual - Page 132
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Netgear VPN Client to FWG114P Follow these procedures to configure a VPN tunnel from a NETGEAR ProSafe VPN Client to an FWG114P. This case study follows the Virtual Private Network Consortium (VPNC) - Netgear FWG114P | FWG114P Reference Manual - Page 133
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P /$1,3 1HWZRUN$GGUHVVHV *DWHZD\ Á?aM?™a +Á.?wjËo 8‰ÁjjÄÄˉÁj jÁÜjÁ 3:5 $&7 7(67 $/(57 02).4%2 $&7 $/(57 -/$%- /1.$&7 ).4%2.%4 ,/#!, # 8¤¤|+ /1.$&7 7,!. - Netgear FWG114P | FWG114P Reference Manual - Page 134
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P 2. Click IKE Policies under the VPN menu and click Add on the IKE Policies Menu. Figure 8-23: NETGEAR FWG114P IKE Policy Configuration - Enter a descriptive name for the policy in the Policy Name field. This name - Netgear FWG114P | FWG114P Reference Manual - Page 135
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P - From the Remote Identity drop-down box, select Fully Qualified Domain Name. - Type VPNclient in the Remote Identity Data. This will also be entered in the VPN Client My Identity ID Type fields, as seen in "My - Netgear FWG114P | FWG114P Reference Manual - Page 136
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P 3. Click the VPN Policies link under the VPN category on the left side of the main menu. This will take you to the VPN Policies Menu page. Click Add Auto Policy. This will open a new screen titled VPN - Auto Policy - Netgear FWG114P | FWG114P Reference Manual - Page 137
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P - From the Remote VPN Endpoint Address Type drop-down box, select IP Address. - Type 0.0.0.0 as the Address Data of the client because we are assuming the remote PC will have a dynamically assigned IP address. - Netgear FWG114P | FWG114P Reference Manual - Page 138
of the Netgear VPN Client Note: The Netgear ProSafe VPN Client has the ability to "Import" a predefined configuration profile. The FWG114P.SPD file on the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Resource CD for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P (SW - Netgear FWG114P | FWG114P Reference Manual - Page 139
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P 1. Install the Netgear VPN Client Software on the PC. Note: Before installing the Netgear VPN Client software, be sure to turn off any virus protection or firewall software you may be running on your PC. • You may - Netgear FWG114P | FWG114P Reference Manual - Page 140
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Note: If the configuration IP Address. Enter FWG114P in the Domain Name field. In this example, 66.120.188.153 would be used for the Gateway IP Address, which is the static IP address for the FWG114P WAN port - Netgear FWG114P | FWG114P Reference Manual - Page 141
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P b. Click Pre-Shared Key. In this settings are configured: - In the Select Phase 1 Negotiation Mode menu, select Aggressive Mode. - Select the Enable Perfect Forward Secrecy (PFS) check box. - In the PFS Key - Netgear FWG114P | FWG114P Reference Manual - Page 142
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P 5. Configure the Connection Security Policy In this step, you will provide the authentication (IKE Phase 1) settings, and the key exchange (Phase 2) settings. The setting choices - Netgear FWG114P | FWG114P Reference Manual - Page 143
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Figure 8-32: Connection Security Policy Key Exchange (Phase 2) b. Configure the Key Exchange (Phase 2). • Expand the Key Exchange (Phase 2) heading, and click on Proposal 1. • For this - Netgear FWG114P | FWG114P Reference Manual - Page 144
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P 6. Configure the Global Policy Settings. a. From the Options menu at the top of the Security Policy Editor window, select Global Policy Settings. Figure 8-33: Security Policy Editor Global Policy Options b. - Netgear FWG114P | FWG114P Reference Manual - Page 145
Wireless Firewall/Print Server will report the results of the attempt to connect. Once the connection is established, you can access resources of the network connected to the FWG114P. Another method is to ping from the remote PC to the LAN IP address of the FWG114P. To perform a ping test using - Netgear FWG114P | FWG114P Reference Manual - Page 146
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P To test the connection to a computer connected to the FWG114P, simply ping the IP address of that computer. Once connected, you can open a browser on the remote PC and enter the LAN IP Address of the FWG114P, which - Netgear FWG114P | FWG114P Reference Manual - Page 147
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P A sample Connection Monitor screen for a different connection is shown below: Figure 8-35: Connection Monitor screen In this example the following connection options apply: • The FWG114P has a public IP WAN address - Netgear FWG114P | FWG114P Reference Manual - Page 148
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P The FWG114P VPN Status screen for a successful connection is shown below: Figure 8-36: FWG114P VPN Status screen 8-48 March 2004, 202-10027-01 Virtual Private Networking - Netgear FWG114P | FWG114P Reference Manual - Page 149
This chapter describes how to use the maintenance features of your ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P. These features are accessed via the Main Menu Maintenance heading. Viewing Wireless Firewall/Print Server Status Information The Router Status menu provides status and - Netgear FWG114P | FWG114P Reference Manual - Page 150
ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P The Router Status screen shows the following parameters: Table 9-1. Status Fields Field System Name Firmware Version Printer Status WAN Port MAC Address IP Address DHCP IP Subnet Mask Domain Name Server LAN Port MAC Address IP Address - Netgear FWG114P | FWG114P Reference Manual - Page 151
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Table 9-1. Status Fields Field Broadcast Name Serial Port Status Modem Dial-In Internet Access Lan-to-LAN Description Identifies if the Name (SSID) is being broadcast. The status of the serial port. Click the - Netgear FWG114P | FWG114P Reference Manual - Page 152
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Table 9-1. Connection Status Fields (continued) Field Network Mask Default Gateway Description The WAN (Internet) Subnet Mask assigned to the router. The WAN (Internet) default gateway the router communicates - Netgear FWG114P | FWG114P Reference Manual - Page 153
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Table 9-1. Router Statistics Fields (continued) Field Collisions Tx B/s Rx B/s Up Time Serial Up Time Poll Interval Description The number of collisions on this interface since reset or manual clear. The - Netgear FWG114P | FWG114P Reference Manual - Page 154
file before sending it to the router. The upgrade file can be sent to the router using your browser. Note: The Web browser used to upload new firmware into the FWG114P Wireless Firewall/Print Server must support HTTP uploads. NETGEAR recommends using Microsoft Internet Explorer or Netscape Navigator - Netgear FWG114P | FWG114P Reference Manual - Page 155
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P From the Main Menu of the browser interface, Settings Backup menu allow you to save and retrieve a file containing your router's configuration settings. To save your settings, click Backup. Your browser will extract - Netgear FWG114P | FWG114P Reference Manual - Page 156
Firewall/Print Server Model FWG114P Erasing the Configuration It is sometimes desirable to restore the router to a known blank condition. This can be done by using the Erase function, which will restore all factory settings. After an erase, the router's password will be password, the LAN IP address - Netgear FWG114P | FWG114P Reference Manual - Page 157
describes how to configure the advanced features of your ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P. These features can be found under the Advanced heading in the Main Menu of the browser interface. Using the WAN Setup Options The first feature category under the Advanced heading - Netgear FWG114P | FWG114P Reference Manual - Page 158
these steps: 1. Click WAN Setup link on the Advanced section of the main menu. 2. Type the IP address for that server. To remove the default DMZ server, replace the IP address numbers with all zeros. 3. Click Apply. • Respond to Ping on Internet WAN Port If you want the router to respond to a 'ping - Netgear FWG114P | FWG114P Reference Manual - Page 159
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P • Setting the MTU Size The default MTU size is usually fine. The normal MTU (Maximum Transmit Unit) value for most Ethernet networks is 1500 Bytes. For some ISPs, particularly those using PPPoE, you may need to - Netgear FWG114P | FWG114P Reference Manual - Page 160
Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P 3. Access the website of one of the dynamic DNS service providers whose names appear in the 'Select Service Provider' box, and register for an account. For example, for dyndns.org, go to www.dyndns.org. 4. Select the "Use - Netgear FWG114P | FWG114P Reference Manual - Page 161
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Using the LAN IP Setup Options The second feature category under the Advanced heading is LAN IP Setup. This menu allows configuration of LAN IP services, such as DHCP and RIP. From the Main Menu of the browser - Netgear FWG114P | FWG114P Reference Manual - Page 162
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P These addresses are part of the IETF-designated private address range for use in private networks, and should be suitable in most applications. If your network has a requirement to use a different IP addressing - Netgear FWG114P | FWG114P Reference Manual - Page 163
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Using the Router as a DHCP server By default, the router will function as a DHCP (Dynamic Host Configuration Protocol) server, allowing it to assign IP, DNS server, and default gateway addresses to all computers - Netgear FWG114P | FWG114P Reference Manual - Page 164
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P 2. In the IP Address box, type the IP address to assign to the computer or server. (choose an IP address from the router's LAN subnet, such as 192.168.0.X) 3. Type the MAC Address of the computer or server. (Tip: - Netgear FWG114P | FWG114P Reference Manual - Page 165
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Figure 10-3. Static Route Entry and Edit to an ISP. • You have an ISDN router on your home network for connecting to the company where you are employed. This router's address on your LAN is 192.168.0.100. Advanced - Netgear FWG114P | FWG114P Reference Manual - Page 166
Access Using the Remote Management page, you can allow a user or users on the Internet to configure, upgrade and check the status of your FWG114P Wireless Firewall/Print Server. Note: Be sure to change the router's default configuration password to a very secure password. The ideal password should - Netgear FWG114P | FWG114P Reference Manual - Page 167
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P b. To allow access from a range of IP addresses on the Internet, select IP address range. Enter a beginning and ending IP address to define the allowed range. c. To allow access from a single IP address on the - Netgear FWG114P | FWG114P Reference Manual - Page 168
ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Turn UPnP On: UPnP can be enabled or disabled for automatic device configuration. The default setting for UPnP is enabled. If disabled, the router will not allow any device to automatically control the resources, such as port forwarding - Netgear FWG114P | FWG114P Reference Manual - Page 169
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P • Beacon Interval Specifies the data beacon rate between 20 and 1000. • DTIM The Delivery Traffic Indication Message. Specifies the data beacon rate between 1 and 255. • - Netgear FWG114P | FWG114P Reference Manual - Page 170
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P 10-14 March 2004, 202-10027-01 Advanced Configuration - Netgear FWG114P | FWG114P Reference Manual - Page 171
chapter gives information about troubleshooting your ProSafe Wireless 802.11g Firewall/ Print Server Model FWG114P. After each problem description, instructions are provided to help you diagnose and solve the problem. Basic Functioning After you turn on power to the router, the following sequence of - Netgear FWG114P | FWG114P Reference Manual - Page 172
to the factory defaults. This will set the router's IP address to 192.168.0.1. This procedure is explained in "Restoring the Default Configuration and Password" on page 11-7. If the error persists, you might have a hardware problem and should contact technical support. LAN or Internet Port LEDs Not - Netgear FWG114P | FWG114P Reference Manual - Page 173
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Troubleshooting the Web Configuration Interface If you are unable to access the router's Web Configuration interface from a computer on your local network, check the following: • Check the Ethernet connection - Netgear FWG114P | FWG114P Reference Manual - Page 174
the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Troubleshooting the ISP Connection If your router is unable to access the Internet, you should first determine whether the router is able to obtain a WAN IP address from the ISP. Unless you have been assigned a static IP address, your - Netgear FWG114P | FWG114P Reference Manual - Page 175
Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P OR Configure your router to spoof your computer's MAC address. This can be done in the Basic Settings menu. Refer to "Manually Configuring Your Internet Connection" on page 3-17. If your router can obtain an IP address - Netgear FWG114P | FWG114P Reference Manual - Page 176
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Pinging with 32 bytes of data If the path is working, you see this message: Reply from < IP address >: bytes=32 time=NN ms TTL=xxx If the path is not working, you see this message: Request timed out If - Netgear FWG114P | FWG114P Reference Manual - Page 177
on (about 10 seconds). 2. Release the Default Reset button and wait for the router to reboot. Problems with Date and Time The E-Mail menu in the Content Filtering section displays the current date and time of day. The FWG114P Wireless Firewall/Print Server uses the Network Time Protocol (NTP) to - Netgear FWG114P | FWG114P Reference Manual - Page 178
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P 11-8 March 2004, 202-10027-01 Troubleshooting - Netgear FWG114P | FWG114P Reference Manual - Page 179
This appendix provides technical specifications for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P. Network Protocol and Standards Compatibility Data and Routing Protocols: TCP/IP, RIP-1, RIP-2, DHCP PPP over Ethernet (PPPoE) VPN Protocols: IPSec, SHA-1, MD5, DES - Netgear FWG114P | FWG114P Reference Manual - Page 180
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Electromagnetic Emissions For North America and Australia For Japan For Europe Interface Specifications LAN: WAN: Printer: Serial: Wireless Data Encoding: FCC Part 15 Class B VCCI Class B EN 300 328, EN 301 489- - Netgear FWG114P | FWG114P Reference Manual - Page 181
Basics This appendix provides an overview of IP networks, routing, and firewalls. Related Publications routers in the network. Using this information, the router chooses the best path for forwarding network traffic. Routers vary in performance and scale, number of routing protocols supported - Netgear FWG114P | FWG114P Reference Manual - Page 182
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Routing Information Protocol One of the protocols used by a router to build and maintain a picture of the network is the Routing Information Protocol (RIP). Using RIP, routers periodically update one another and - Netgear FWG114P | FWG114P Reference Manual - Page 183
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Class A Network Class B Node Network Class C Node Network Node Figure 11-1: Three Main Address Classes The five address classes are: • Class A Class A addresses can have up to 16,777,214 hosts on a single - Netgear FWG114P | FWG114P Reference Manual - Page 184
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P This addressing structure allows IP addresses to uniquely identify each physical network and each node on each physical network. For each unique value of the network portion of the address, the base address of the - Netgear FWG114P | FWG114P Reference Manual - Page 185
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Subnet addressing allows us to split one IP network address into smaller multiple physical networks known as subnetworks. Some of the node numbers are used as a subnet number instead. A Class B address gives us 16 - Netgear FWG114P | FWG114P Reference Manual - Page 186
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P The following table lists the additional subnet mask bits in dotted-decimal notation. To use the table, write down the original class netmask and replace the 0 value octets with the dotted-decimal value of the - Netgear FWG114P | FWG114P Reference Manual - Page 187
a range of IP addresses from the ISP. This type of Internet account is more costly than a single-address account typically used by a single user with a modem, rather than a router. The FWG114P Wireless Firewall/Print Server employs an address-sharing method called Network Address Translation (NAT - Netgear FWG114P | FWG114P Reference Manual - Page 188
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P The router accomplishes this address sharing by translating the internal LAN IP addresses to a single address that is globally unique on the Internet. The internal LAN IP addresses can be either private addresses - Netgear FWG114P | FWG114P Reference Manual - Page 189
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P MAC Addresses and Address Resolution Protocol An IP address alone cannot be used to deliver data from one LAN device to another. To send data between LAN devices, you must convert the IP address of the destination - Netgear FWG114P | FWG114P Reference Manual - Page 190
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P When a PC accesses a resource by its descriptive name, it first contacts a DNS server to obtain the IP address of the resource. The PC sends the desired message using the IP address. Many large organizations, such - Netgear FWG114P | FWG114P Reference Manual - Page 191
Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P What is a Firewall? A firewall is a device that protects one network from another, while allowing communication between the two. A firewall incorporates the functions of the NAT router Service (DoS) attack. The method used - Netgear FWG114P | FWG114P Reference Manual - Page 192
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P . Table B-1. UTP Ethernet cable wiring, straight-through Pin Wire divided as follows: 20 ft. (6 m) between the hub and the patch panel (if used) 295 ft. (90 m) from the wiring closet to the wall outlet 10 ft. (3 - Netgear FWG114P | FWG114P Reference Manual - Page 193
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Inside Twisted Pair Cables For two devices ports, called MDI or uplink ports. Most repeaters and switch ports are configured as media-dependent interfaces with built-in crossover ports, called MDI-X or normal ports - Netgear FWG114P | FWG114P Reference Manual - Page 194
for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Figure B-3: Category 5 UTP Cable with Male RJ-45 Plug at Each End Note: Flat "silver satin" telephone cable may have the same RJ-45 plug. However, using telephone cable results in excessive collisions, causing the attached port to - Netgear FWG114P | FWG114P Reference Manual - Page 195
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P The FWG114P Wireless Firewall/Print Server incorporates Auto UplinkTM technology (also called MDI/MDIX). Each LOCAL Ethernet port will automatically sense whether the Ethernet cable plugged into the port should - Netgear FWG114P | FWG114P Reference Manual - Page 196
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P B-16 Networks, Routing, and Firewall Basics March 2004, 202-10027-01 - Netgear FWG114P | FWG114P Reference Manual - Page 197
Wireless 802.11g Firewall/Print Server Model FWG114P and how to verify the readiness of broadband Internet service from an Internet service provider (ISP). Note: If an ISP technician configured your computer during the installation of a broadband modem, or if you configured it using instructions - Netgear FWG114P | FWG114P Reference Manual - Page 198
the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P In your IP network, each PC and the firewall must be assigned unique IP addresses. Each PC must also have certain other IP configuration information, such as a subnet mask (netmask), a domain name server (DNS) address, and a default - Netgear FWG114P | FWG114P Reference Manual - Page 199
for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P You must have an Ethernet adapter, the TCP/IP protocol, and Client for Microsoft Networks. Note: It is not necessary to remove any other network components shown in the Network window in order to install the adapter, TCP/IP, or - Netgear FWG114P | FWG114P Reference Manual - Page 200
about itself and resources that are available on its network. The simplest way to configure this information is to allow the PC to obtain the information from the internal DHCP server of the FWG114P Wireless Firewall/Print Server. To use DHCP with the recommended default addresses, follow these - Netgear FWG114P | FWG114P Reference Manual - Page 201
the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P 5. Uncheck all boxes in the LAN Internet Configuration screen and click Next. 6. Proceed to the end of the Wizard. Verifying TCP/IP Properties After your PC is configured and has rebooted, you can check the TCP/IP configuration using - Netgear FWG114P | FWG114P Reference Manual - Page 202
for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P 5. Verify that 'Client for Microsoft Networks' and 'Internet Protocol (TCP/IP)' are present. If not, select Install and add them. 6. Select 'Internet Protocol (TCP/IP)', click Properties, and verify that "Obtain an IP address - Netgear FWG114P | FWG114P Reference Manual - Page 203
the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P The TCP/IP Control Panel opens: 2. From the "Connect via" box, select your Macintosh's Ethernet interface. 3. From the "Configure" box, select Using DHCP Server. You can leave the DHCP Client ID box empty. 4. Close the TCP/IP Control - Netgear FWG114P | FWG114P Reference Manual - Page 204
Panels, then TCP/IP. The panel is updated to show your settings, which should match the values below if you are using the default TCP/IP settings that NETGEAR recommends: • The IP Address is between 192.168.0.2 and 192.168.0.254 • The Subnet mask is 255.255.255.0 • The Router address is 192.168 - Netgear FWG114P | FWG114P Reference Manual - Page 205
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Verifying the Readiness of Your Internet Account For broadband access to the Internet, you need to contract with an Internet service provider (ISP) for a single-user Internet access account using a cable modem or - Netgear FWG114P | FWG114P Reference Manual - Page 206
Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P • An IP address and subnet mask • A gateway IP address, which is the address of the ISP's router • One or more domain name server (DNS) IP addresses • Host name and domain suffix For example, your account's full server - Netgear FWG114P | FWG114P Reference Manual - Page 207
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P If an IP address appears under Installed Gateways, write down the address. This is the ISP's gateway address. Select the address and then click Remove to remove the gateway address. 6. Select the DNS Configuration - Netgear FWG114P | FWG114P Reference Manual - Page 208
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Restarting the Network Once you have set up your computers to work with the firewall, you must reset the network for the devices to be able to communicate correctly. Restart any computer that is connected to the - Netgear FWG114P | FWG114P Reference Manual - Page 209
prior to being forwarded and/or replied to. : Log's date and time : Event is that access the device or access other host via the device : Packet type pass Firewall : IP address in the packet : Port in the packet - Netgear FWG114P | FWG114P Reference Manual - Page 210
the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P The format is: [Fri, 2003-12-05 22:19:42] - UDP Packet - Source:172.31.12.233,138 ,WAN Destination:172.31.12.255,138 ,LAN [Drop] - [Inbound Default - Netgear FWG114P | FWG114P Reference Manual - Page 211
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P The format is: < SRC_IP = "VPN Packet" PKT_TYPE = "GRE", "AH", "ESP", "IP packet [Type Field: Num]", "IPSEC" ACTION = "Forward", "Drop" Router Operation Operations that the router initiates are - Netgear FWG114P | FWG114P Reference Manual - Page 212
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Other Connections and Traffic to this Router The format Destination: 10.10.10.4,1765 LAN - [Receive] [Fri, 2003-12-05 22:07:11] - IP Packet [Type Field:8], from 20.97.173.18 to 172.31.12.157 - [Drop] Notes: ACTION - Netgear FWG114P | FWG114P Reference Manual - Page 213
Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P 54.148.179.175,58595 ,LAN Destination:192.168.0.1,20[FTP Data] ,WAN [Reset] - [SYN Flood] [Fri, 2003-12-05 19:21:22] - UDP 201- Destination: 10.10.10.4 - [Forward] Notes: PKT_TYPE = "TCP", "UDP", "ICMP", "Proto: Number" - Netgear FWG114P | FWG114P Reference Manual - Page 214
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Access Block Forward] Notes: EVENT = Attempt to access blocked sites SRC_INF = LAN or WAN DST_INF = WAN or LAN System Admin Sessions Administrator session logins and failed attempts are logged, as well as manual - Netgear FWG114P | FWG114P Reference Manual - Page 215
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P The format is: [Fri, 2003-12-05 21:07:43] - Administrator login successful - IP:192.168.0.10 [Fri, 2003-12-05 21:09:16] - Netgear FWG114P | FWG114P Reference Manual - Page 216
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P D-8 Firewall Log Formats March 2004, 202-10027-01 - Netgear FWG114P | FWG114P Reference Manual - Page 217
of Wireless networking. Wireless Networking Overview The FWG114P Wireless Firewall/Print Server conforms to the Institute of Electrical and Electronics Engineers (IEEE) 802.11b and 802.11g standards for wireless LANs (WLANs). On an 802.11b or g wireless link, data is encoded using direct-sequence - Netgear FWG114P | FWG114P Reference Manual - Page 218
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Ad Hoc Mode (Peer-to-Peer mode enables you to quickly set up a small wireless workgroup and allows workgroup members to exchange data or share printers as supported by Microsoft networking in the various Windows - Netgear FWG114P | FWG114P Reference Manual - Page 219
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P • Shared Key. With Shared Key authentication, only those PCs that possess the correct authentication key can join the network. By default, IEEE 802.11 wireless devices operate in an Open System network. Wired - Netgear FWG114P | FWG114P Reference Manual - Page 220
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P 2. The access point authenticates the station. 3. The station associates with the access point and joins the network. This process is illustrated below. 2SHQ6\VWHP $XWKHQWLFDWLRQ6WHSV - Netgear FWG114P | FWG114P Reference Manual - Page 221
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P 6KDUHG.H XWKHQWLFDWLRQ6WHSV - Netgear FWG114P | FWG114P Reference Manual - Page 222
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Key Size The IEEE 802.11 standard supports two types of WEP encryption: 40-bit and 128-bit. The 64-bit WEP data encryption method allows for a five-character (40-bit) input. Additionally, 24 factory-set bits are - Netgear FWG114P | FWG114P Reference Manual - Page 223
Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P WEP Configuration Options The WEP settings must match on all 802.11 devices that are within the same wireless AP can use WEP key 2 as its default key to transmit while a client adapter can use WEP key 3 as its default key to - Netgear FWG114P | FWG114P Reference Manual - Page 224
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Table E-2: 802.11b/g Radio Frequency using channel 1 and grow to use channel 6, and 11 when necessary, as these three channels do not overlap. WPA Wireless Security Wi-Fi Protected Access (WPA) is a specification - Netgear FWG114P | FWG114P Reference Manual - Page 225
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P WPA offers the following benefits: • Enhanced data privacy • Robust key management • Data origin authentication • Data integrity protection The Wi-Fi Alliance is now performing interoperability - Netgear FWG114P | FWG114P Reference Manual - Page 226
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P How Does WPA Compare to IEEE 802.11i? WPA will be forward compatible with the IEEE 802.11i security specification currently under development. WPA is a subset of the current 802.11i draft and uses certain pieces of - Netgear FWG114P | FWG114P Reference Manual - Page 227
Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P The primary information conveyed in the Beacon frames is the authentication method and the cipher suite. Possible authentication methods include 802.1X and Pre-shared key. Pre-shared key is an authentication method that uses - Netgear FWG114P | FWG114P Reference Manual - Page 228
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P WPA Authentication: Enterprise-level User Authentication via 802.1x/EAP and RADIUS Wireless LAN WPA enabled wireless client with "supplicant" WPA enabled Access Point using pre-shared key or 802.1x Figure E-3: - Netgear FWG114P | FWG114P Reference Manual - Page 229
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Client with a WPAenabled wireless adapter and supplicant (Win XP, Funk, Meetinghouse) For example, a WPA-enabled AP For example, a RADIUS server 1 2 3 4 6 5 7 Figure E-4: 802.1x Authentication Sequence The - Netgear FWG114P | FWG114P Reference Manual - Page 230
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P 3. The client sends an EAP-response packet containing the identity to the authentication server. The access point responds by enabling a port for passing only EAP packets from the client to an authentication server - Netgear FWG114P | FWG114P Reference Manual - Page 231
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Temporal Key Integrity Protocol (TKIP) WPA uses TKIP AES support will not be required initially for Wi-Fi certification. This is viewed as the optimal choice for security conscience organizations, but the problem - Netgear FWG114P | FWG114P Reference Manual - Page 232
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Is WPA Perfect? WPA is not without its vulnerabilities. Specifically, it is susceptible to denial of service (DoS) attacks. If the access point receives two data packets that fail the message integrity code (MIC) - Netgear FWG114P | FWG114P Reference Manual - Page 233
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Changes to Wireless Access Points Wireless access points must have their firmware updated to support the following: • The new WPA information element To advertise their support of WPA, wireless APs send the beacon - Netgear FWG114P | FWG114P Reference Manual - Page 234
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Microsoft has worked with many wireless vendors to embed the WPA firmware update in the wireless adapter driver. So, to update your Microsoft Windows wireless client, all you have to do is obtain the new WPA- - Netgear FWG114P | FWG114P Reference Manual - Page 235
to tap directly into the network and read the data. IPSec-based VPNs use encryption to provide data security, which increases the network's resistance to data tampering or theft. IPSec-based VPNs can be created over any type of IP network, including the Internet, Frame Relay, ATM, and MPLS, but only - Netgear FWG114P | FWG114P Reference Manual - Page 236
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P • Remote Access: Remote access enables telecommuters services. These undertakings can be difficult using legacy network technologies due to connection costs, time delays, and access availability. IPSec-based VPNs - Netgear FWG114P | FWG114P Reference Manual - Page 237
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P • such as SHA and MD5. The algorithms IPSec uses produce a unique and unforgeable identifier for each intended receiver. ESP also provides all encryption services in IPSec. Encryption translates a readable message - Netgear FWG114P | FWG114P Reference Manual - Page 238
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P The ESP header is inserted into the packet between the IP header and any subsequent packet contents. However, because ESP encrypts the data, the payload is changed. ESP does not encrypt the ESP header, nor does - Netgear FWG114P | FWG114P Reference Manual - Page 239
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Mode SAs operate using modes. A mode is the method in which the IPSec protocol is applied to the packet. IPSec can be used in tunnel mode or transport mode. Typically, the tunnel mode is used for gateway-to-gateway - Netgear FWG114P | FWG114P Reference Manual - Page 240
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Key Management IPSec uses the Internet Key Exchange (IKE) protocol to facilitate and automate the SA setup and the exchange of keys between parties transferring data. Using keys ensures that only the sender and - Netgear FWG114P | FWG114P Reference Manual - Page 241
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P VPN Process Overview Even though IPSec is standards-based, each vendor has its own set of terms and procedures for implementing the standard. Because of these differences, it may be a good idea to review some of - Netgear FWG114P | FWG114P Reference Manual - Page 242
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Table 5-3. WAN (Internet/Public) and LAN (Internal/Private) Addressing Gateway Gateway A Gateway A Gateway B Gateway B LAN or WAN LAN (Private) WAN (Public) LAN (Private) WAN (Public) VPNC Example Address 10 - Netgear FWG114P | FWG114P Reference Manual - Page 243
Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P A B Figure F-5: VPN using VPN Gateway 2) IKE Phase I authentication VPN Gateway 3) IKE Phase II negotiation 4) Secure data transfer 5) IPSec tunnel termination Figure F-6: IPSec SA negotiation 1. The IPSec software - Netgear FWG114P | FWG114P Reference Manual - Page 244
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P 2. IKE Phase I. a. The two parties negotiate the encryption and authentication algorithms to use in the IKE SAs. b. The two parties authenticate each other using a predetermined mechanism, such as preshared keys or - Netgear FWG114P | FWG114P Reference Manual - Page 245
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P VPNC IKE Phase II Parameters The IKE Phase 2 parameters used in Scenario 1 are: • TripleDES • SHA-1 • ESP tunnel mode • MODP group 1 • Perfect forward secrecy for rekeying • SA lifetime of 28800 - Netgear FWG114P | FWG114P Reference Manual - Page 246
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P • [RFC 791] Internet Protocol DARPA Internet Program Protocol Specification, Information Sciences Institute, USC, September 1981. • [RFC 1058] Routing Information Protocol, C Hedrick, Rutgers University, June 1988. - Netgear FWG114P | FWG114P Reference Manual - Page 247
2003 Model/Firmware Tested: NETGEAR-Gateway A FVS318 firmware version A1.4 or 2.0; FVM318 firmware version 1.1 NETGEAR-Gateway B FWG114P with firmware version 2 Release 2 IP Addressing: NETGEAR-Gateway A Static IP address NETGEAR-Gateway B Static IP address NETGEAR VPN Configuration FVS318 - Netgear FWG114P | FWG114P Reference Manual - Page 248
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P 10.5.6.0/24 VPNC Example Network Interface Addressing 172.23.9.0/24 LAN IP 10.5.6.1 Gateway A 14.15.16.17 WAN IP 22.23.24.25 WAN IP Gateway B LAN IP 172.23.9.1 Figure G-1: Addressing and Subnet Used for - Netgear FWG114P | FWG114P Reference Manual - Page 249
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P 2. Click the VPN Settings link on the left side of the Settings management GUI. Click the radio button of the first available VPN leg (all 8 links are available in the example). Click the Edit button below. This - Netgear FWG114P | FWG114P Reference Manual - Page 250
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P - Choose a subnet from local address from the "Tunnel can access" pull-down menu. - Type the starting LAN IP Address of Gateway B (172.23.9.1 in our example) in the Local IP Remote LAN Start IP Address field. - - Netgear FWG114P | FWG114P Reference Manual - Page 251
Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Step-By-Step Configuration of FWG114P Gateway B 1. Log in to the NETGEAR FVS328 labeled Gateway B as in the illustration. Out of the box, the FVS328 is set for its default LAN address of http://192.168.0.1, with its default - Netgear FWG114P | FWG114P Reference Manual - Page 252
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Figure G-6: NETGEAR FVS328 IKE Policy Configuration - NETGEAR FVS328 IKE Policies (Post Configuration) The FVS318 IKE Policy is now displayed in the IKE Policies page. 4. Click the VPN Policies link under the VPN - Netgear FWG114P | FWG114P Reference Manual - Page 253
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Figure G-8: NETGEAR FVS328 VPN - Auto Policy (part 1) - Enter a unique name to identify this policy. This name is not supplied to the remote VPN endpoint. In our example we have used to318 as the Policy Name. In - Netgear FWG114P | FWG114P Reference Manual - Page 254
ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P - Type the LAN Subnet Mask of Gateway B (255.255.255.0 in our example) in the Local IP Subnet Mask field. Figure G-9: NETGEAR FWG114P VPN - Auto Policy (part 2) - From the Traffic Selector Remote IP drop-down box, select Subnet address - Netgear FWG114P | FWG114P Reference Manual - Page 255
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Figure G-10: NETGEAR FWG114P VPN Policies Menu (Post Configuration) 6. When the screen returns to the VPN Policies, make sure the Enable check box is selected. Click the Apply button. Test the VPN Connection 1. - Netgear FWG114P | FWG114P Reference Manual - Page 256
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P G-10 NETGEAR VPN Configuration FVS318 or FVM318 to FWG114P March 2004, 202-10027-01 - Netgear FWG114P | FWG114P Reference Manual - Page 257
to FVS328 This appendix provides a case study on how to configure a VPN tunnel between a NETGEAR FVS318 or FVM318 to a FWG114P using a Fully Qualified Domain Name (FQDN) to resolve the public address of one or both routers. The configurations screens and settings for the FVS318 and FVM318 are the - Netgear FWG114P | FWG114P Reference Manual - Page 258
ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P 10.5.6.0/24 VPNC Example Network Interface Addressing 172.23.9.0/24 LAN IP 10.5.6.1 Gateway A WAN IP FQDN netgear.dydns.org WAN IP 22.23.24.25 Gateway B LAN IP 172.23.9.1 Figure H-1: Addressing and Subnet Used for Examples Using - Netgear FWG114P | FWG114P Reference Manual - Page 259
Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P DynDNS service. Gateway B will use the DDNS Service Provider when establishing a VPN tunnel. In order to establish VPN connectivity Gateway A must be configured to use Dynamic DNS, and Gateway B must be configured to use - Netgear FWG114P | FWG114P Reference Manual - Page 260
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P 4. Select the Use a dynamic DNS service radio button for the service you are using. In this example we are using www.DynDNS.org as the service provider. - Type the Host Name that your dynamic DNS service provider - Netgear FWG114P | FWG114P Reference Manual - Page 261
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Figure H-4: NETGEAR FVS318 VPN Settings (part 1) - Main Mode - In the Connection Name box, enter in a unique name for the VPN tunnel to be configured between the NETGEAR devices. For this example we have used - Netgear FWG114P | FWG114P Reference Manual - Page 262
Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P - Type the finishing LAN IP Address of Gateway B (0.0.0.0 in our example) in the Local IP Remote LAN Finish IP Address field. - Type the LAN Subnet Mask of Gateway B (255.255.255.0 in our example) in the Remote LAN IP - Netgear FWG114P | FWG114P Reference Manual - Page 263
Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Step-By-Step Configuration of FVS328 Gateway B 1. Log in to the NETGEAR FVS328, labeled Gateway B in the illustration. Out of the box, the FVS328 is set for its default LAN address of http://192.168.0.1, with its default - Netgear FWG114P | FWG114P Reference Manual - Page 264
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Figure H-7: NETGEAR FVS328 IKE Policy Configuration - NETGEAR FWG114P IKE Policies (Post Configuration) The FVS318 IKE Policy is now displayed in the IKE Policies page. 4. Click the VPN Policies link under the VPN - Netgear FWG114P | FWG114P Reference Manual - Page 265
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Figure H-9: NETGEAR FVS328 VPN - Auto Policy (part 1) - Enter a unique name to identify this policy. This name is not supplied to the remote VPN endpoint. In our example we have used to318 as the Policy Name. In - Netgear FWG114P | FWG114P Reference Manual - Page 266
ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Figure H-10: NETGEAR FVS328 VPN - Auto Policy (part 2) - From the Traffic Selector Remote IP drop-down box, select Subnet address. - Type the starting LAN IP Address of Gateway A (10.5.6.1 in our example) in the Remote IP Start IP Address - Netgear FWG114P | FWG114P Reference Manual - Page 267
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Figure H-11: NETGEAR FVS328 VPN Policies Menu (Post Configuration) 6. When the screen returns to the VPN Policies, make sure the Enable check box is selected. Click the Apply button. Test the VPN Connection 1. - Netgear FWG114P | FWG114P Reference Manual - Page 268
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P H-12 NETGEAR VPN Configuration FVS318 or FVM318 with FQDN to FVS328 March 2004, 202-10027-01 - Netgear FWG114P | FWG114P Reference Manual - Page 269
Protocol) and supports multiple authentication methods, such as token cards, Kerberos, one-time passwords, certificates, and public key authentication. For details on EAP specifically, refer to IETF's RFC 2284. 802.11b IEEE specification for wireless networking at 11 Mbps using direct-sequence - Netgear FWG114P | FWG114P Reference Manual - Page 270
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P ADSL Short for asymmetric digital subscriber line, a technology that allows data to be sent over existing copper telephone lines at data rates of from 1.5 to 9 - Netgear FWG114P | FWG114P Reference Manual - Page 271
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Certificate Authority A Certificate Authority is a trusted third-party organization or company that issues digital certificates used to create digital signatures and public-private key pairs. The role of the CA in - Netgear FWG114P | FWG114P Reference Manual - Page 272
Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Dynamic Host Configuration Protocol DHCP. An Ethernet protocol specifying how a centralized DHCP server can assign network configuration information to multiple DHCP clients. The assigned information includes IP addresses - Netgear FWG114P | FWG114P Reference Manual - Page 273
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P Internet Protocol The main internetworking protocol used in the Internet. Used in conjunction with the Transfer Control Protocol (TCP) to form TCP/IP. LAN A communications network serving users within a limited - Netgear FWG114P | FWG114P Reference Manual - Page 274
ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P netmask Combined with the IP address, the IP Subnet Mask allows a device to know which other addresses are local to it, and which must be reached through a gateway or router. A number that explains which part of an IP address network (VPN) - Netgear FWG114P | FWG114P Reference Manual - Page 275
Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P RADIUS Short for Remote Authentication Dial-In User Service, RADIUS is an authentication system. Using RADIUS, you must enter your user name and password before gaining access to a network. This information is - Netgear FWG114P | FWG114P Reference Manual - Page 276
Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P WAN A long distance link used to extend or connect remotely located local area networks. The Internet is a large WAN. WEP Wired Equivalent Privacy is a data encryption protocol for 802.11b wireless networks. All wireless - Netgear FWG114P | FWG114P Reference Manual - Page 277
9-7 erasing 9-8 restore 9-6 router, initial 3-1 Connection Monitor 8-46 Index Index content filtering 2-3, 6-1 crossover cable 2-4, 11-2, B-14, B-15, G-2 D date and time 11-7 Daylight Savings Time 11-7 daylight savings time 6-13 Default DMZ Server 10-2 Denial of Service (DoS) protection 2-3 denial - Netgear FWG114P | FWG114P Reference Manual - Page 278
for Macintosh C-6 for Windows C-2, C-5 IPSec F-1 IPSec Components F-2 IPSec SA negotiation F-9 IPSec Security Features F-2 ISP 3-1 L LAN IP Setup Menu 10-5 LEDs description 2-7 troubleshooting 11-2 log sending 6-13 Log Viewer 8-46 LPD/LPR Printing 7-1 M MAC address 11-7, B-9 spoofing 3-12 - Netgear FWG114P | FWG114P Reference Manual - Page 279
4-11 passphrase 2-2 password restoring 11-7 PC, using to configure C-12 ping 10-2 PKIX 8-26 port filtering 6-9 port forwarding behind NAT B-8 port numbers 6-3 PPP over Ethernet 2-5, C-9 PPPoE 2-5, 3-10, C-9 PPTP 3-18 Primary DNS Server 3-11, 3-12, 3-14, 3-18 protocols Address Resolution B-9 DHCP - Netgear FWG114P | FWG114P Reference Manual - Page 280
for Windows C-5, C-6 Telstra 3-18 Testing and Troubleshooting F-11 time of day 11-7 time zone 6-13 time-stamping 6-13 Transport Mode F-5 troubleshooting 11-1 Trusted Host 6-3 Tunnel Mode F-5 U Universal Plug and Play 10-11 Uplink switch B-14 UPnP 10-11 USB C-9 USB 2.0 2-8 V VPN F-1 VPN Consortium
-
1 -
2 -
3 -
4 -
5 -
6 -
7 -
8
-
9
-
10
-
11
-
12
-
13
-
14
-
15
-
16
-
17
-
18
-
19
-
20
-
21
-
22
-
23
-
24
-
25
-
26
-
27
-
28
-
29
-
30
-
31
-
32
-
33
-
34
-
35
-
36
-
37
-
38
-
39
-
40
-
41
-
42
-
43
-
44
-
45
-
46
-
47
-
48
-
49
-
50
-
51
-
52
-
53
-
54
-
55
-
56
-
57
-
58
-
59
-
60
-
61
-
62
-
63
-
64
-
65
-
66
-
67
-
68
-
69
-
70
-
71
-
72
-
73
-
74
-
75
-
76
-
77
-
78
-
79
-
80
-
81
-
82
-
83
-
84
-
85
-
86
-
87
-
88
-
89
-
90
-
91
-
92
-
93
-
94
-
95
-
96
-
97
-
98
-
99
-
100
-
101
-
102
-
103
-
104
-
105
-
106
-
107
-
108
-
109
-
110
-
111
-
112
-
113
-
114
-
115
-
116
-
117
-
118
-
119
-
120
-
121
-
122
-
123
-
124
-
125
-
126
-
127
-
128
-
129
-
130
-
131
-
132
-
133
-
134
-
135
-
136
-
137
-
138
-
139
-
140
-
141
-
142
-
143
-
144
-
145
-
146
-
147
-
148
-
149
-
150
-
151
-
152
-
153
-
154
-
155
-
156
-
157
-
158
-
159
-
160
-
161
-
162
-
163
-
164
-
165
-
166
-
167
-
168
-
169
-
170
-
171
-
172
-
173
-
174
-
175
-
176
-
177
-
178
-
179
-
180
-
181
-
182
-
183
-
184
-
185
-
186
-
187
-
188
-
189
-
190
-
191
-
192
-
193
-
194
-
195
-
196
-
197
-
198
-
199
-
200
-
201
-
202
-
203
-
204
-
205
-
206
-
207
-
208
-
209
-
210
-
211
-
212
-
213
-
214
-
215
-
216
-
217
-
218
-
219
-
220
-
221
-
222
-
223
-
224
-
225
-
226
-
227
-
228
-
229
-
230
-
231
-
232
-
233
-
234
-
235
-
236
-
237
-
238
-
239
-
240
-
241
-
242
-
243
-
244
-
245
-
246
-
247
-
248
-
249
-
250
-
251
-
252
-
253
-
254
-
255
-
256
-
257
-
258
-
259
-
260
-
261
-
262
-
263
-
264
-
265
-
266
-
267
-
268
-
269
-
270
-
271
-
272
-
273
-
274
-
275
-
276
-
277
-
278
-
279
-
280
 |
 |
March 2004, 202-10027-01
202-10027-01
Version 2.0
March 2004
NETGEAR
, Inc.
4500 Great America Parkway
Santa Clara, CA 95054 USA
Reference Manual for the
ProSafe Wireless 802.11g
Firewall/Print Server
Model FWG114P