NETGEAR SRX5308 - ProSafe® Quad WAN Gigabit SSL VPN... Bedienungsanleitung

202-10536-01

April 2010

v1.0

NETGEAR, Inc.

350 East Plumeria Drive

San Jose, CA 95134

ProSafe Gigabit Quad WAN

SSL VPN Firewall SRX5308

Reference Manual

v1.0, April 2010

No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into

any language in any form or by any means without the written permission of NETGEAR, Inc.

Technical Support

Please refer to the support information card that shipped with your product. By registering your product at

http://www.netgear.com/register, we can provide you with faster expert technical support and timely notices of

product and software upgrades.

NETGEAR, INC. Support Information

Phone: 1-888-NETGEAR, for US & Canada only. For other countries, see your Support information card.

Email: support@netgear.com

North American NETGEAR website: http://www.netgear.com

Trademarks

NETGEAR and the NETGEAR logo are registered trademarks and ProSecure and ProSafe are trademarks of

NETGEAR, Inc. Microsoft, Windows, and Windows NT are registered trademarks of Microsoft Corporation. Other

brand and product names are registered trademarks or trademarks of their respective holders.

Statement of Conditions

In the interest of improving internal design, operational function, and/or reliability, NETGEAR reserves the right to

make changes to the products described in this document without notice.

NETGEAR does not assume any liability that may occur due to the use or application of the product(s) or circuit

layout(s) described herein.

The NETGEAR®ProSafe™ Gigabit Quad WAN SSL VPN Firewall SRX5308 Reference Manual describes how to

install, configure, and troubleshoot a ProSafe Gigabit Quad WAN SSL VPN Firewall. The information in this manual is

intended for readers with intermediate computer and networking skills.

iii

v1.0, April 2010

Contents

ProSafe Gigabit Quad WAN SSL VPN Firewall SRX5308 Reference Manual

About This Manual

Conventions, Formats, and Scope ................................................................................... xi

How to Print This Manual .................................................................................................xii

Revision History ................................................................................................................xii

Chapter 1

Introduction

What Is the ProSafe Gigabit Quad WAN SSL VPN Firewall? ........................................1-1

Key Features and Capabilities ........................................................................................1-2

Quad-WAN Ports for Increased Reliability and

Outbound Load Balancing ........................................................................................1-3

Advanced VPN Support for Both IPsec and SSL .....................................................1-3

A Powerful, True Firewall with Content Filtering ......................................................1-4

Security Features .....................................................................................................1-4

Autosensing Ethernet Connections with Auto Uplink ...............................................1-5

Extensive Protocol Support ......................................................................................1-5

Easy Installation and Management ..........................................................................1-6

Maintenance and Support ........................................................................................1-6

Package Contents ..........................................................................................................1-7

Hardware Features .........................................................................................................1-7

Front Panel ...............................................................................................................1-7

Rear Panel ...............................................................................................................1-9

Bottom Panel with Product Label ...........................................................................1-10

Choosing a Location for the SRX5308 .........................................................................1-11

Using the Rack-Mounting Kit ..................................................................................1-11

Chapter 2

Connecting the VPN Firewall to the Internet

Understanding the Internet and WAN Configuration Tasks ............................................2-1

Qualified Web Browsers ...........................................................................................2-2

ProSafe Gigabit Quad WAN SSL VPN Firewall SRX5308 Reference Manual

v1.0, April 2010

Logging In to the VPN Firewall .......................................................................................2-3

Understanding the Web Management Interface Menu Layout .................................2-5

Configuring the Internet Connections .............................................................................2-7

Automatically Detecting and Connecting .................................................................2-7

Setting the VPN Firewall’s MAC Address ..............................................................2-11

Manually Configuring the Internet Connection .......................................................2-11

Configuring the WAN Mode ..........................................................................................2-16

Configuring Network Address Translation ..............................................................2-16

Configuring Classical Routing ................................................................................2-17

Configuring the Auto-Rollover Mode and Failure Detection Method ......................2-18

Configuring Load Balancing and Optional Protocol Binding ..................................2-21

Configuring Secondary WAN Addresses ......................................................................2-25

Configuring Dynamic DNS ............................................................................................2-27

Configuring Advanced WAN Options ............................................................................2-31

Additional WAN-Related Configuration Tasks ........................................................2-34

What to Do Next ...........................................................................................................2-35

Chapter 3

LAN Configuration

Managing Virtual LANs and DHCP Options ...................................................................3-1

Understanding the VPN Firewall’s Port-Based VLANs ............................................3-2

Assigning and Managing VLAN Profiles ..................................................................3-3

VLAN DHCP Options ...............................................................................................3-4

Configuring a VLAN Profile ......................................................................................3-6

Configuring VLAN MAC Addresses and LAN Advanced Settings .........................3-11

Configuring Multi-Home LAN IP Addresses on the Default VLAN ................................3-12

Managing Groups and Hosts (LAN Groups) .................................................................3-14

Managing the Network Database ...........................................................................3-15

Changing Group Names in the Network Database ................................................3-18

Setting Up Address Reservation ............................................................................3-19

Configuring and Enabling the DMZ Port .......................................................................3-20

Managing Routing ........................................................................................................3-24

Configuring Static Routes .......................................................................................3-25

Configuring Routing Information Protocol ..............................................................3-27

Static Route Example .............................................................................................3-29

ProSafe Gigabit Quad WAN SSL VPN Firewall SRX5308 Reference Manual

v1.0, April 2010

Chapter 4

Firewall Protection

About Firewall Protection ................................................................................................4-1

Administrator Tips ....................................................................................................4-2

Using Rules to Block or Allow Specific Kinds of Traffic ..................................................4-2

Services-Based Rules ..............................................................................................4-3

Order of Precedence for Rules ..............................................................................4-10

Setting LAN WAN Rules ........................................................................................4-11

Setting DMZ WAN Rules ........................................................................................4-14

Setting LAN DMZ Rules .........................................................................................4-18

Inbound Rules Examples .......................................................................................4-21

Outbound Rules Example ......................................................................................4-25

Configuring Other Firewall Features .............................................................................4-26

Attack Checks ........................................................................................................4-26

Setting Session Limits ............................................................................................4-29

Managing the Application Level Gateway for SIP Sessions ..................................4-30

Creating Services, QoS Profiles, and Bandwidth Profiles ............................................4-31

Adding Customized Services .................................................................................4-31

Creating Quality of Service (QoS) Profiles .............................................................4-34

Creating Bandwidth Profiles ...................................................................................4-37

Setting a Schedule to Block or Allow Specific Traffic ....................................................4-40

Content Filtering (Blocking Internet Sites) ....................................................................4-41

Understanding the VPN Firewall’s Content Filtering ..............................................4-41

Enabling and Configuring Content Filtering ...........................................................4-42

Enabling Source MAC Filtering ....................................................................................4-44

Setting Up IP/MAC Bindings .........................................................................................4-46

Configuring Port Triggering ...........................................................................................4-48

Configuring Universal Plug and Play ............................................................................4-51

Chapter 5

Virtual Private Networking

Using IPsec Connections

Considerations for Multi-WAN Port Systems ..................................................................5-1

Using the IPsec VPN Wizard for Client and Gateway Configurations ............................5-3

Creating Gateway-to-Gateway VPN Tunnels with the Wizard .................................5-3

Creating a Client to Gateway VPN Tunnel ...............................................................5-8

ProSafe Gigabit Quad WAN SSL VPN Firewall SRX5308 Reference Manual

v1.0, April 2010

Testing the Connections and Viewing Status Information .............................................5-16

Testing the VPN Connection ..................................................................................5-16

NETGEAR VPN Client Status and Log Information ...............................................5-17

Viewing the VPN Firewall IPsec VPN Connection Status ......................................5-19

Viewing the VPN Firewall IPSec VPN Logs ...........................................................5-20

Managing IPsec VPN Policies ......................................................................................5-20

Configuring IKE Policies .........................................................................................5-21

Configuring VPN Policies .......................................................................................5-29

Configuring Extended Authentication (XAUTH) ............................................................5-37

Configuring XAUTH for VPN Clients ......................................................................5-38

User Database Configuration .................................................................................5-39

RADIUS Client Configuration .................................................................................5-39

Assigning IP Addresses to Remote Users (Mode Config) ............................................5-42

Mode Config Operation ..........................................................................................5-42

Configuring Mode Config Operation on the VPN Firewall ......................................5-42

Configuring the ProSafe VPN Client for Mode Config Operation ...........................5-50

Testing the Mode Config Connection .....................................................................5-55

Configuring Keepalives and Dead Peer Detection .......................................................5-55

Configuring Keepalives ..........................................................................................5-56

Configuring Dead Peer Detection ..........................................................................5-57

Configuring NetBIOS Bridging with IPsec VPN ............................................................5-59

Chapter 6

Virtual Private Networking

Using SSL Connections

Understanding the SSL VPN Portal Options ..................................................................6-1

Planning for an SSL VPN ...............................................................................................6-2

Creating the Portal Layout ..............................................................................................6-4

Configuring Domains, Groups, and Users ......................................................................6-7

Configuring Applications for Port Forwarding .................................................................6-8

Adding Servers and Port Numbers ..........................................................................6-8

Adding a New Host Name ......................................................................................6-10

Configuring the SSL VPN Client ...................................................................................6-10

Configuring the Client IP Address Range ..............................................................6-11

Adding Routes for VPN Tunnel Clients ..................................................................6-13

Using Network Resource Objects to Simplify Policies ..................................................6-14

ProSafe Gigabit Quad WAN SSL VPN Firewall SRX5308 Reference Manual

vii

v1.0, April 2010

Adding New Network Resources ..........................................................................6-14

Editing Network Resources to Specify Addresses .................................................6-15

Configuring User, Group, and Global Policies ..............................................................6-17

Viewing Policies .....................................................................................................6-18

Adding a Policy ......................................................................................................6-19

Accessing the SSL Portal Login Screen .......................................................................6-23

Viewing the SSL VPN Connection Status and SSL VPN Logs .....................................6-25

Chapter 7

Managing Users, Authentication, and Certificates

Configuring VPN Authentication Domains, Groups, and Users ......................................7-1

Configuring Domains ................................................................................................7-2

Configuring Groups for VPN Policies .......................................................................7-6

Configuring User Accounts ......................................................................................7-9

Setting User Login Policies ....................................................................................7-11

Changing Passwords and Other User Settings ......................................................7-15

Managing Digital Certificates ........................................................................................7-17

Understanding the Certificates Screen ..................................................................7-18

Managing CA Certificates ......................................................................................7-19

Managing Self Certificates .....................................................................................7-20

Managing the Certificate Revocation List ...............................................................7-24

Chapter 8

Network and System Management

Performance Management .............................................................................................8-1

Bandwidth Capacity .................................................................................................8-1

Features That Reduce Traffic ...................................................................................8-2

Features That Increase Traffic .................................................................................8-4

Using QoS and Bandwidth Assignment to Shift the Traffic Mix ................................8-7

Monitoring Tools for Traffic Management .................................................................8-8

System Management ......................................................................................................8-8

Changing Passwords and Administrator Settings ....................................................8-8

Configuring Remote Management Access .............................................................8-10

Using the Command-Line Interface .......................................................................8-14

Using a Simple Network Management Protocol Manager .....................................8-14

Managing the Configuration File ............................................................................8-17

Configuring Date and Time Service .......................................................................8-21

ProSafe Gigabit Quad WAN SSL VPN Firewall SRX5308 Reference Manual

viii

v1.0, April 2010

Chapter 9

Monitoring System Access and Performance

Enabling the WAN Traffic Meter .....................................................................................9-1

Activating Notification of Events, Alerts, and Syslogs .....................................................9-5

Viewing Status and Log Screens ....................................................................................9-9

Viewing the System (Router) Status and Statistics ................................................9-10

Viewing the VLAN Status .......................................................................................9-16

Viewing and Disconnecting Active Users ...............................................................9-17

Viewing the VPN Tunnel Connection Status ..........................................................9-18

Viewing the VPN Logs ...........................................................................................9-19

Viewing the Port Triggering Status .........................................................................9-21

Viewing the WAN Port Connection Status ..............................................................9-21

Viewing the Attached Devices and DHCP Log ......................................................9-23

Using the Diagnostics Utilities ......................................................................................9-25

Sending a Ping Packet or Tracing a Route ............................................................9-26

Looking Up a DNS Address ...................................................................................9-27

Displaying the Routing Table ..................................................................................9-28

Rebooting the VPN Firewall ...................................................................................9-28

Capturing Packets ..................................................................................................9-28

Chapter 10

Troubleshooting and Using Online Support

Basic Functioning .........................................................................................................10-2

Power LED Not On .................................................................................................10-2

Test LED Never Turns Off ......................................................................................10-2

LAN or WAN Port LEDs Not On .............................................................................10-3

Troubleshooting the Web Management Interface .........................................................10-3

When You Enter a URL or IP Address a Time-Out Error Occurs .................................10-4

Troubleshooting the ISP Connection ............................................................................10-5

Troubleshooting a TCP/IP Network Using the Ping Utility ............................................10-6

Testing the LAN Path to Your VPN Firewall ...........................................................10-7

Testing the Path from Your PC to a Remote Device ..............................................10-7

Restoring the Default Configuration and Password ......................................................10-8

Problems with Date and Time .....................................................................................10-10

Accessing the Knowledge Base and Documentation .................................................10-10

ProSafe Gigabit Quad WAN SSL VPN Firewall SRX5308 Reference Manual

v1.0, April 2010

Appendix A

Default Settings and Technical Specifications

Appendix B

Network Planning for Multiple WAN Ports

What to Consider Before You Begin .............................................................................. B-1

Cabling and Computer Hardware Requirements .................................................... B-3

Computer Network Configuration Requirements .................................................... B-3

Internet Configuration Requirements ...................................................................... B-3

Overview of the Planning Process ................................................................................. B-5

Inbound Traffic ............................................................................................................... B-7

Inbound Traffic to a Single WAN Port System ........................................................ B-7

Inbound Traffic to a Dual WAN Port System ........................................................... B-8

Virtual Private Networks ................................................................................................ B-9

VPN Road Warrior (Client-to-Gateway) .................................................................B-11

VPN Gateway-to-Gateway .................................................................................... B-13

VPN Telecommuter (Client-to-Gateway through a NAT Router) ........................... B-16

Appendix C

System Logs and Error Messages

System Log Messages ..................................................................................................C-2

NTP .........................................................................................................................C-2

Login/Logout ...........................................................................................................C-3

System Startup ........................................................................................................C-3

Reboot .....................................................................................................................C-3

Firewall Restart .......................................................................................................C-4

IPsec Restart ...........................................................................................................C-4

Unicast, Multicast, and Broadcast Logs ..................................................................C-4

WAN Status .............................................................................................................C-5

Resolved DNS Names ............................................................................................C-9

VPN Log Messages ................................................................................................C-9

Traffic Meter Logs .................................................................................................C-17

Routing Logs ...............................................................................................................C-18

LAN to WAN Logs .................................................................................................C-18

LAN to DMZ Logs ..................................................................................................C-18

DMZ to WAN Logs ................................................................................................C-18

WAN to LAN Logs .................................................................................................C-19

ProSafe Gigabit Quad WAN SSL VPN Firewall SRX5308 Reference Manual

v1.0, April 2010

DMZ to LAN Logs ..................................................................................................C-19

WAN to DMZ Logs ................................................................................................C-19

Other Event Logs .........................................................................................................C-20

Session Limit Logs ................................................................................................C-20

Source MAC Filter Logs ........................................................................................C-20

Bandwidth Limit Logs ............................................................................................C-20

DHCP Logs ..................................................................................................................C-21

Appendix D

Two-Factor Authentication

Why Do I Need Two-Factor Authentication? .................................................................D-1

What Are the Benefits of Two-Factor Authentication? ............................................D-1

What Is Two-Factor Authentication .........................................................................D-2

NETGEAR Two-Factor Authentication Solutions ...........................................................D-2

Appendix E

Beliebte Firewall Handbücher anderer Marken

Cisco

Cisco S190 Bedienungsanleitung

Fortinet

Fortinet FortiGate Voice Series Bedienungsanleitung

ADTRAN

ADTRAN NetVanta 2300 Bedienungsanleitung

SecureLogix

SecureLogix ETM System Bedienungsanleitung

Lanner

Lanner FW-8877 Bedienungsanleitung

Huawei

Huawei USG6000 Series Installations- und Betriebshandbuch

H3C

H3C SecPath F5000-AI-15 Bedienungsanleitung

Nexcom

Nexcom DNA 1150 Bedienungsanleitung

Fortinet

Fortinet FortiGate-60 series Bedienungsanleitung

Cisco

Cisco 3110 Handbuch

Draytek

Draytek Vigor2860 Series Bedienungsanleitung

Lanner electronics

Lanner electronics FW-7650 Series Bedienungsanleitung

Swisscom

Swisscom Internet Backup Bedienungsanleitung

SonicWALL

SonicWALL NSa 5700 Bedienungsanleitung

DPtech

DPtech FW1000 SERIES Bedienungsanleitung

FEITIAN

FEITIAN MultiPass FIDO Bedienungsanleitung

EBLOCKER

EBLOCKER PRO Bedienungsanleitung

GTA

GTA GB-200 Bedienungsanleitung