V1.0, September | NETGEAR UTM10EW-100NAS, UTM25-100NAS manual

ProSecure Unified Threat Management UTM10 or UTM25 Reference Manual

.

Figure 7-21

Virtual Private Networking Using IPsec Connections	7-25
v1.0, September 2009

Image 235

NETGEAR UTM10EW-100NAS, UTM25-100NAS, UTM25EW-100NAS manual V1.0, September

Contents

NETGEAR, Inc Bestätigung des Herstellers/Importeurs TrademarksStatement of Conditions EU Regulatory Compliance Statement Terms Voluntary Control Council for Interference Vcci StatementAdditional Copyrights AES MD5 Product Name Product and Publication DetailsModel Number Publication Date September Product Family V1.0, September Contents Classical Routing UTM10 and UTM25 Configuring Secondary WAN Addresses Chapter LAN Configuration Chapter Content Filtering and Optimizing Scans Chapter Virtual Private Networking Using SSL Connections Changing Passwords and Administrator Settings Features That Reduce TrafficFeatures That Increase Traffic Using QoS and Bandwidth Assignment to Shift the Traffic Mix Configuring and Activating Firewall Logs Configuring Logging, Alerts, and Event NotificationsConfiguring the E-mail Notification Server Configuring and Activating System, E-mail, and Syslog Logs Problems with Date and Time Testing the LAN Path to Your UTMTesting the Path from Your PC to a Remote Device Restoring the Default Configuration and Password Appendix D Two Factor Authentication Xvi Conventions, Formats, and Scope About This Manual Revision History How to Print This Manual Chapter Introduction Key Features and Capabilities Advanced VPN Support for Both IPsec and SSL Stream Scanning for Content Filtering Powerful, True Firewall Autosensing Ethernet Connections with Auto Uplink Security Features Extensive Protocol Support Easy Installation and Management Maintenance and Support Service Registration Card with License Keys Hardware Features Package Contents Right WAN LEDs LEDs Power LEDUSB port Left LAN LEDs Active DMZ LED Object Activity Description LAN PortsWAN Ports Receptacle Security lock Console port Reset button AC power ReceptacleRear Panel Bottom Panel With Product Label 4shows the product label for the UTM10 Choosing a Location for the UTM Using the Rack-Mounting Kit Understanding the Steps for Initial Connection Using the Setup Wizard to Provision the UTM in Your Network Qualified Web Browsers Logging In to the UTM V1.0, September V1.0, September Understanding the Web Management Interface Menu Layout V1.0, September Using the Setup Wizard to Perform the Initial Configuration Setup Wizard of 10 LAN Settings Dhcp Setup Wizard LAN Settings Setting Description or Subfield and Description Setting Description or Subfield and Description DNS Proxy Setup Wizard of 10 WAN Settings Setting Description or Subfield and Description ISP Login Setup Wizard WAN SettingsISP Type Get Automatically from ISP radio button Internet IP AddressISP Domain Name Server DNS Servers Setup Wizard of 10 System Date and Time Adjust for Daylight Savings Time checkbox Setup Wizard System Date and Time Settings Setup Wizard of 10 Security Services Peer-to-Peer P2P Setup Wizard Security Services SettingsWeb Instant Messaging Setup Wizard Email Security Settings Setup Wizard of 10 Email SecuritySetting Description or Subfield and Description Action Scan Exceptions Setup Wizard of 10 Web Security See Performance Management on Setup Wizard Web Security Settings Setup Wizard of 10 Web Categories to Be Blocked Blocked Categories Scheduled Days Setup Wizard Content Filtering SettingsBlocked Categories Time of Day Administrator Email Notification Settings Setup Wizard Administrator Email Notification Settings Setup Wizard of 10 Security Subscription Update Settings Https Proxy Settings Setup Wizard Security Subscription Update SettingsUpdate Settings Update Frequency Testing Http Scanning Verifying Proper InstallationSetup Wizard of 10 Saving the Configuration Testing Connectivity Registering the UTM with Netgear Click Register What to Do Next V1.0, September Understanding the Internet and WAN Configuration Tasks Manually Configuring Internet and WAN Settings Automatically Detecting and Connecting Configuring the Internet Connections V1.0, September Connection Method Data Required Internet connection methodsPptp Manually Configuring the Internet Connection Setting the UTM’s MAC Address V1.0, September Pptp and PPPoE Settings Internet IP Address Settings DNS Server Settings Classical Routing UTM10 and UTM25 Network Address Translation UTM10 and UTM25 Configuring Auto-Rollover Mode UTM25 Only Setting Description or Subfield and Description Port Mode Auto-Rollover Mode Settings UTM25 Only WAN1 Configuring the Internet Connections onWAN2 V1.0, September Using the Services menu see Services-Based Rules on Protocol Binding Settings UTM25 Only Destination Configuring Secondary WAN Addresses V1.0, September Select Network Config Dynamic DNS from the menu Configuring Dynamic DNS V1.0, September WAN2 Dynamic DNS Status DNS Service Settings Configuring Advanced WAN Options Port Speed Advanced WAN SettingsSetting Description or Subfield and Description MTU Size Use Default Address radio button Upload/Download Settings Additional WAN-Related Configuration Tasks Managing Virtual LANs and Dhcp Options Chapter LAN Configuration Managing the UTM’s Port-Based VLANs V1.0, September Dhcp Server Vlan Dhcp Options DNS Proxy Dhcp Relay Ldap Server Configuring a Vlan ProfileEdit Add V1.0, September Vlan Vlan Profile SettingsVlan ID Port Membership Address Contiguous addresses in the IP address pool. Any Settings below Configuring Multi-Home LAN IPs on the Default Vlan Managing Groups and Hosts LAN Groups Managing the Network Database V1.0, September Setting Up Address Reservation on Add Known PCs and Devices SettingsAdding PCs or Devices to the Network Database Editing PCs or Devices in the Network Database Changing Group Names in the Network Database Setting Up Address Reservation Configuring and Enabling the DMZ Port V1.0, September DMZ Setup Settings Own LAN IP address as the primary DNS server IP address Managing Routing Configuring Static Routes Static Route Settings Configuring Routing Information Protocol RIP Select Network Configuration Routing from the menu Authentication for RIP-2B/2M RIP Configuration SettingsOut Only . Static Route Example V1.0, September About Firewall Protection Chapter Firewall Protection Administrator Tips Services-Based Rules Using Rules to Block or Allow Specific Kinds of TrafficNumber of Supported Firewall Rule Configurations Outbound Rules Service Blocking Hosts LAN Groups on Customized Services onOutbound Rules Overview To Block or Allow Specific Traffic on NAT IP Inbound Rules Port Forwarding V1.0, September Inbound Rules Overview By this rule. The options are Order of Precedence for Rules Setting LAN WAN Rules LAN WAN Outbound Services Rules LAN WAN Inbound Services Rules Setting DMZ WAN Rules V1.0, September DMZ WAN Outbound Services Rules DMZ WAN Inbound Services Rules Setting LAN DMZ Rules LAN DMZ Outbound Services Rules Attack Checks LAN DMZ Inbound Services Rules Attack Checks Settings L2TP VPN Pass through Setting Session Limits Session Timeout Session Limit SettingsManaging the Application Level Gateway for SIP Sessions LAN WAN Inbound Rule Hosting a Local Public Web Server Inbound Rules Examples V1.0, September V1.0, September LAN WAN or DMZ WAN Inbound Rule Specifying an Exposed Host LAN WAN Outbound Rule Blocking Instant Messenger Outbound Rules Example Adding Customized Services Creating Services, QoS Profiles, and Bandwidth Profiles V1.0, September TCP Services Settings Creating Quality of Service QoS Profiles V1.0, September Default High Medium High Low QoS Profile Settings Creating Bandwidth Profiles V1.0, September Bandwidth Profile Settings Setting a Schedule to Block or Allow Specific Traffic Enabling Source MAC Filtering V1.0, September Setting up IP/MAC Bindings Event Notifications on IP/MAC Binding SettingsIP/MAC Bindings Configuring Port Triggering V1.0, September 10. Port Triggering Settings Using the Intrusion Prevention System V1.0, September V1.0, September Attack Name Description or Subfield and Description Web 11. IPS Less Familiar Attack NamesMisc About Content Filtering and Scans Content Filtering and Optimizing Scans Default E-mail and Web Scan Settings Default E-mail and Web Scan Settings Scan Type Default Scan Setting Default Action if applicable Configuring E-mail Protection Customizing E-mail Protocol Scan Settings Customizing E-mail Anti-Virus and Notification Settings Notification Settings E-mail Anti-Virus and Notification SettingsPerformance see Performance Management on Mail Email Alert Settings TIME%, %PROTOCOL%, %FROM%, %TO%, %SUBJECT% Mail Content FilteringFILENAME%, %ACTION%, %VIRUSNAME% V1.0, September Filter by Password-Protected Attachments ZIP, RAR, etc E-mail Filter Settings Protected Attachments ZIP, RAR, etc. section above Password-Protected Attachments ZIP, RAR, etc. section aboveProtecting Against E-mail Spam Filter by File Name Setting Up the Whitelist and Blacklist V1.0, September Whitelist/Blacklist Settings Configuring the Real-time Blacklist V1.0, September Configuring Distributed Spam Analysis Distributed Spam Analysis Settings Low Medium-Low Anti-Spam Engine SettingsBlock spam email Customizing Web Protocol Scan Settings and Services Configuring Web and Services Protection Setting Description or Subfield and Description Web Web Protocol, Instant Messaging, and Peer-to-Peer Settings Configuring Web Malware Scans Malware Scan Settings Html Scan Configuring Web Content Filtering V1.0, September Content Filtering, screen 1 10 Content Filtering, screen 2 11 Content Filtering, screen 3 Block Web Objects Content Filtering SettingsPerformance Management on Full-Text Search Blocked Categories Scheduled Days URL Configuring Web URL FilteringNetgear V1.0, September Setting Description or Subfield and Description Whitelist URL Filtering SettingsBlacklist URL% Https Scan Settings V1.0, September V1.0, September Specifying Trusted Hosts 10. Https Settings 11. Trusted Hosts Settings Hosts Configuring FTP Scans 12. FTP Scan Settings Setting Web Access Exception Rules Setting Web Access Exceptions and Scanning ExclusionsBlock Files with the Following Extensions To set Web access exception rules Groups and Hosts LAN Groups on 13. Add and Edit Block Scanning Exception Settings Setting Scanning Exclusions 14. Add Scanning Exclusion Settings V1.0, September Considerations for Dual WAN Port Systems UTM25 Only Chapter Virtual Private Networking Using IPsec Connections IP Addressing for VPNs in Dual WAN Port Systems Creating Gateway-to-Gateway VPN Tunnels with the Wizard V1.0, September Connection Name and Remote IP Type IPsec VPN Wizard Settings for a Gateway-to-Gateway Tunnel Adding or Editing a VPN Policy on Secure Connection Remote AccessibilityEnd Point Information a V1.0, September Creating a Client to Gateway VPN Tunnel V1.0, September Fqdn IPsec VPN Wizard Settings for a Client-to-Gateway Tunnel V1.0, September V1.0, September Status on Security Policy Editor Remote Party SettingsOnly Connect Manually checkbox Gateway Tunnel Security Policy Editor My Identity Settings On page 7-9. In this example, the domain name is Detection checkbox Testing the Connections and Viewing Status InformationTesting the VPN Connection Security Policy Editor Security Policy Settings Netgear VPN Client Status and Log Information V1.0, September System Tray Icon Status Client policy is deactivated Viewing the UTM IPsec VPN Connection Status IPsec VPN Connection Status Information Viewing the UTM IPsec VPN Log Managing IPsec VPN Policies IKE Policies Screen Managing IKE Policies List of IKE Policies Information Manually Adding or Editing an IKE Policy V1.0, September Mode Config Record 10. Add IKE Policy SettingsGeneral Remote LocalIKE SA Parameters Dead Peer Configuring KeepalivesGroup 1 768 bit Group 5 1536 bit Extended Authentication VPN Policies Screen Managing VPN Policies Remote 11. List of VPN Policies Information Manually Adding or Editing a VPN Policy V1.0, September 12. Add VPN Policy Settings Manual Policy Parameters Description or Subfield and Description Traffic Selection Auto Policy Parameters Group 768 bit Configuring Extended Authentication XauthGroup 1536 bit Configuring Xauth for VPN Clients Radius Client Configuration User Database ConfigurationInformation, see Radius Client Configuration on V1.0, September Primary Radius Server 14. Radius Client SettingsBackup Radius Server Connection Configuration Mode Config Operation Assigning IP Addresses to Remote Users Mode ConfigConfiguring Mode Config Operation on the UTM V1.0, September Client Pool 15. Add Mode Config Record Settings Traffic Tunnel Security Level V1.0, September 16. Add IKE Policy Settings for a Mode Config Configuration Peer Detection on ConfiguringMenu, select Group 2 1024 bit Keepalives and Dead Configuring the ProSafe VPN Client for Mode Config Operation 192.168.1.0 Gateway Tunnel 18. Security Policy Editor My Identity, Mode Config Settings Menu Testing the Mode Config Connection Configuring Keepalives and Dead Peer Detection Configuring Keepalives 20. Keepalive Settings Configuring Dead Peer Connection 21. Dead Peer Detection Settings Configuring NetBIOS Bridging with IPsec VPN Understanding the SSL VPN Portal Options Chapter Virtual Private Networking Using SSL Connections Using the SSL VPN Wizard for Client Configurations SSL VPN Wizard of 6 Portal Settings Portal Layout and Theme Name SSL VPN Wizard Portal SettingsScreen as shown in -8 on SSL VPN Portal Pages to Display SSL VPN Wizard of 6 Domain Settings Domain Name SSL VPN Wizard Domain SettingsRadius Client SSL VPN Wizard of 6 User Settings SSL VPN Wizard User Settings SSL VPN Wizard of 6 Client IP Address Range and Routes Client IP Address Range SSL VPN Wizard Client IP Address Range and Routes SettingsAdd Routes for VPN Tunnel Clients SSL VPN Wizard of 6 Port Forwarding SSL VPN Wizard Port Forwarding Settings Add New Host Name for Port Forwarding SSH SSL VPN Wizard of 6 Verify and Save Your Settings Accessing the New SSL Portal Login Screen V1.0, September Viewing the UTM SSL VPN Log Viewing the UTM SSL VPN Connection Status Manually Configuring and Editing SSL Connections Creating the Portal Layout V1.0, September V1.0, September Add Portal Layout Settings Configuring Applications for Port Forwarding Configuring Domains, Groups, and Users Adding Servers and Port Numbers Port Forwarding Applications/TCP Port Numbers Adding a New Host NameTCP Application Port Number Fully Qualified Domain Name. The full server name Configuring the SSL VPN Client Configuring the Client IP Address Range Tunnel Clients on Adding Routes for VPN Tunnel Clients Using Network Resource Objects to Simplify Policies Adding New Network Resources Editing Network Resources to Specify Addresses Add Resource Addresses Settings Configuring User, Group, and Global Policies Viewing Policies Adding a Policy Policy For 10. Add Policy Settings Network Resource Objects to Simplify Policies on Description or Subfield and Description Add SSL VPN Policies 10. Add Policy Settings V1.0, September V1.0, September Configuring VPN Authentication Domains, Groups, and Users Managing Users, Authentication, and Certificates Authentication Protocols and Methods Configuring Domains Ldap Add Domain Settings Creating the Portal Layout on Configuring Groups for VPN Policies Creating and Deleting Groups Editing Groups VPN Group Settings Configuring User Accounts V1.0, September See Configuring Extended Authentication Xauth on Add User SettingsPolicies on Configuring Login Policies Setting User Login Policies Configuring Login Restrictions Based on IP Address Add Defined Addresses Settings Configuring Login Restrictions Based on Web Browser Internet Explorer Opera Netscape Navigator Changing Passwords and Other User Settings Enabled see Configuring Extended Authentication Xauth on Edit User SettingsManaging Digital Certificates V1.0, September 11 Certificates, screen 1 Managing CA Certificates Managing Self Certificates Generating a CSR and Obtaining a Self Certificate from a CA 13 Certificates, screen 2 Setting 512 1024 2048 V1.0, September Viewing and Managing Self Certificates Managing the Certificate Revocation List 15Certificates, screen 3 Bandwidth Capacity Performance Management Features That Reduce Traffic Network and System Management 10-3 Content Filtering Source MAC Filtering Features That Increase Traffic 10-6 Network and System Management Port Triggering Configuring the DMZ Port Assigning QoS Profiles Using QoS and Bandwidth Assignment to Shift the Traffic MixConfiguring Exposed Hosts Configuring VPN Tunnels Assigning Bandwidth Profiles Changing Passwords and Administrator SettingsSystem Management Monitoring Tools for Traffic Management 10-10 Network and System Management Network and System Management 10-11 Configuring Remote Management Access Https//IPaddress or https//FullyQualifiedDomainName Using an Snmp Manager Trusted Snmp Hosts Managing the Configuration FileSnmp Settings Setting Description or Subfield and Description Settings Backup Settings Restore Settings Updating the Firmware Reverting to Factory Default Settings Viewing the Available Firmware Versions Upgrading the Firmware and Rebooting the UTM Updating the Scan Signatures and Scan Engine Firmware Rebooting Without Changing the Firmware 10-22 Network and System Management Signatures & Scan Engine Settings Configuring Automatic Update and Frequency Settings System Date & Time Settings Configuring Date and Time Service Network and System Management 10-25 10-26 Network and System Management Enabling the WAN Traffic Meter Monitoring System Access and Performance 11-2 Monitoring System Access and Performance Traffic Counter WAN Traffic Meter SettingsLogging, Alerts, and Event Notifications on Mail, and Syslog Logs on Configuring the E-mail Notification Server Configuring Logging, Alerts, and Event Notifications E-mail Notification Settings Configuring and Activating System, E-mail, and Syslog LogsServer requires authentication checkbox and enter Monitoring System Access and Performance 11-7 Email Logs to Administrator E-mail and Syslog Settings Send Logs via Syslog Configuring and Activating Update Failure and Attack Alerts Alerts Settings ACTION%, %VIRUSNAME% PROTOCOL%, %FROM%, %TO%, %SUBJECT%, %FILENAME% Configuring and Activating Firewall Logs Monitoring Real-Time Traffic, Security, and Statistics Firewall Logs Settings Dashboard, screen 1 System on Settings onSpam to configure, see Protecting Against E-mail Spam on Total Threats Total Traffic Bytes Threats Counts Prevention System on Categories, see Using the IntrusionDashboard Most Recent 5 and Top 5 Information Category Most Recent 5 Description Top 5 Description Dashboard, screen 3 Dashboard Service Statistics Information Viewing System Status Viewing Status Screens System Status Status and System Information Setting Status 11 System Status, screen 2 LAN Port NATDhcp Viewing VPN Tunnel Connection Status Viewing Active VPN Users11. System Status Interface Statistics 12. IPsec VPN Connection Status Information Viewing Port Triggering Status To view the status of the Port Triggering feature 13. Port Triggering Status Information Viewing the WAN Ports Status 11-28 Monitoring System Access and Performance Viewing Attached Devices Configuring the Internet Connection onEdit Vlan Profile screen see Configuring a Vlan Profile on Viewing Attached Devices and the Dhcp Log 11-30 Monitoring System Access and Performance Viewing the Dhcp Log Querying the Logs Querying Logs and Generating Reports Monitoring System Access and Performance 11-33 15. Logs Query Settings This field is available for the following logs See Configuring and Activating Firewall Logs onFollowing protocols can be selected This field is available only for the Malware log Following categories can be selectedFollowing reasons can be selected This field is available only for the Spam log This field is available only for the Service log EMERG, ALERT, CRITICAL, ERROR, WARNING, NoticeThis field is available only for the Content filters log Log Management Example Using Logs to Identify Infected Clients Scheduling and Generating Reports Generating Reports System Reports 16. Generate Report SettingsEmail Reports Web Reports Scheduling Reports 17. Schedule Report Settings Email Reports Web Reports System Reports Using Diagnostics UtilitiesReport List Sending a Ping Packet Using the Network Diagnostic Tools Displaying the Routing Table Tracing a RouteLooking up a DNS Address 27 Diagnostics, screen 2 Using the Realtime Traffic Diagnostics Tool Generating Network Statistics Gathering Important Log Information Rebooting and Shutting Down the UTM Troubleshooting and Using Online Support Basic Functioning Power LED Not OnTest LED Never Turns Off LAN or WAN Port LEDs Not On Troubleshooting the Web Management Interface When You Enter a URL or IP Address a Time-out Error Occurs Troubleshooting the ISP Connection Troubleshooting a TCP/IP Network Using a Ping Utility Testing the Path from Your PC to a Remote Device Testing the LAN Path to Your UTM Restoring the Default Configuration and Password Problems with Date and Time Enabling Remote Troubleshooting Using Online Support Sending Suspicious Files to Netgear for Analysis Malware Analysis Settings Accessing the Knowledge Base and Documentation Local Network LAN Table A-1. UTM Default Configuration SettingsFeature Default behavior Router Login Internet Connection Table A-2. UTM Physical and Technical Specifications Setting Specification Table A-3. UTM IPsec VPN SpecificationsFeature Specification Environmental Specifications Interface Specifications MD5, SHA-1, MAC-MD5/SHA-1, HMAC-MD5/SHA-1 Table A-4. UTM SSL VPN Specifications What to Consider Before You Begin Appendix B Network Planning for Dual WAN Ports UTM25 Only Internet WAN port Physical facility Internet Configuration Requirements Computer Network Configuration RequirementsCabling and Computer Hardware Requirements Internet Connection Information Where Do I Get The Internet Configuration Information? Overview of the Planning Process Figure B-2 Inbound Traffic to a Single WAN Port System Inbound Traffic Inbound Traffic Dual WAN Ports for Improved Reliability Inbound Traffic to a Dual WAN Port SystemInbound Traffic Dual WAN Ports for Load Balancing To-Gateway Through a NAT Virtual Private Networks VPNsVPN Road Warrior Client To-Gateway Figure B-7 VPN Road Warrior Single Gateway WAN Port Reference Case VPN Road Warrior Client-to-Gateway Figure B-10 VPN Road Warrior Dual Gateway WAN Ports for Load Balancing VPN Gateway-to-Gateway Figure B-13 Figure B-15 VPN Telecommuter Single Gateway WAN Port Reference Case VPN Telecommuter Client-to-Gateway Through a NAT Router Figure B-18 Figure B-20 VPN Telecommuter Dual Gateway WAN Ports for Load Balancing Term Description or Subfield and Description Table C-1. Log Message Terms System Startup RebootTable C-3. System Logs Reboot System Log Messages Table C-4. System Logs Service Service LogsTable C-5. System Logs NTP Firewall Restart Login/LogoutIPsec Restart ACTIVEWAN2 Auto-Rollover ModeWAN Status System Logs WAN Status, Auto Rollover Table C-9. System Logs WAN Status, Load Balancing Load-Balancing Mode PPP Logs Table C-10. System Logs WAN Status, PPPoE Idle-Timeout Table C-12. System Logs WAN Status, PPP Authentication Table C-11. System Logs WAN Status, Pptp Idle-Timeout Unicast Logs Traffic Metering LogsIcmp Redirect Logs Table C-17. System Logs Invalid Packets Invalid Packet LoggingMulticast/Broadcast Logs Table C-16. System Logs Multicast/Broadcast Invalidshortpacketdrop SRC=192.168.20.10 Invalidbadchecksumdrop SRC=192.168.20.10Invalidbadhwchecksumdrop SRC=192.168.20.10 Invalidmalformedpacketdrop SRC=192.168.20.10 Web Filtering and Content Filtering Logs Content Filtering and Security Logs Spam Logs Table C-19. Content Filtering and Security Logs Spam Virus Logs Table C-20. Content Filtering and Security Logs TrafficTable C-21. Content Filtering and Security Logs Virus Traffic Logs Port Scan Logs Table C-23. Content Filtering and Security Logs IPSTable C-24. Content Filtering and Security Logs Port Scan IPS Logs DMZ to WAN Logs Routing LogsLAN to WAN Logs LAN to DMZ Logs DMZ to LAN Logs WAN to LAN LogsWAN to DMZ Logs V1.0, September What are the benefits of Two-Factor Authentication? Why do I need Two-Factor Authentication? What is Two-Factor Authentication Netgear Two-Factor Authentication Solutions Figure D-1 Figure D-3 Document Link Appendix E Related Documents V1.0, September Numerics Index Index-2 Index-3 Index-4 Index-5 Index-6 Index-7 Index-8 Index-9 Index-10 Index-11 Index-12 Index-13 Index-14 Index-15 Index-16