Netgear Srxn3205 Quick Reference Guide FullManual

2014-07-06

: Netgear Netgear-Srxn3205-Quick-Reference-Guide netgear-srxn3205-quick-reference-guide netgear pdf

Open the PDF directly: View PDF .
Page Count: 258 [warning: Documents this large are best viewed by clicking the View PDF Link!]

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

202-10416-02

v1.0

January 2010

NETGEAR, Inc.

350 East Plumeria Drive

San Jose, CA 95134

ProSafe Wireless-N VPN

Firewall SRXN3205

Reference Manual

v1.0, January 2010

Technical Support

Please refer to the support information card that shipped with your product. By registering your product at

http://www.netgear.com/register, we can provide you with faster expert technical support and timely notices of

product and software upgrades.

NETGEAR, INC. Support Information

Phone: 1-888-NETGEAR, for US & Canada only. For other countries, see your Support information card.

E-mail: support@netgear.com

North American NETGEAR website: http://www.netgear.com

Trademarks

NETGEAR and the NETGEAR logo are registered trademarks and ProSafe is a trademark of NETGEAR, Inc.

Microsoft, Windows, and Windows NT are registered trademarks of Microsoft Corporation. Other brand and product

names are registered trademarks or trademarks of their respective holders.

Statement of Conditions

In the interest of improving internal design, operational function, and/or reliability, NETGEAR reserves the right to

make changes to the products described in this document without notice.

NETGEAR does not assume any liability that may occur due to the use or application of the product(s) or circuit

layout(s) described herein.

Federal Communications Commission (FCC) Compliance Notice: Radio Frequency

Notice

This equipment has been tested and found to comply with the limits for a Class B digital device, pursuant to

part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a

residential installation. This equipment generates, uses, and can radiate radio frequency energy and, if not installed and

used in accordance with the instructions, may cause harmful interference to radio communications. However, there is no

guarantee that interference will not occur in a particular installation. If this equipment does cause harmful interference to

radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try

to correct the interference by one or more of the following measures:

• Reorient or relocate the receiving antenna.

• Increase the separation between the equipment and receiver.

• Connect the equipment into an outlet on a circuit different from that to which the receiver is connected.

• Consult the dealer or an experienced radio/TV technician for help.

EU Regulatory Compliance Statement

The ProSafe Wireless-N VPN Firewall is compliant with the following EU Council Directives: 89/336/EEC and LVD

73/23/EEC. Compliance is verified by testing to the following standards: EN55022 Class B, EN55024 and EN60950-1.

For EU Declaration of Conformity please visit: http://kb.netgear.com/app/answers/detail/a_id/11621/sno/0.

v1.0, January 2010

iii

Bestätigung des Herstellers/Importeurs

Es wird hiermit bestätigt, daß das ProSafe Wireless-N VPN Firewall gemäß der im BMPT-AmtsblVfg 243/1991 und Vfg

46/1992 aufgeführten Bestimmungen entstört ist. Das vorschriftsmäßige Betreiben einiger Geräte (z.B. Testsender) kann

jedoch gewissen Beschränkungen unterliegen. Lesen Sie dazu bitte die Anmerkungen in der Betriebsanleitung.

Das Bundesamt für Zulassungen in der Telekommunikation wurde davon unterrichtet, daß dieses Gerät auf den Markt

gebracht wurde und es ist berechtigt, die Serie auf die Erfüllung der Vorschriften hin zu überprüfen.

Certificate of the Manufacturer/Importer

It is hereby certified that the ProSafe Wireless-N VPN Firewall has been suppressed in accordance with the conditions

set out in the BMPT-AmtsblVfg 243/1991 and Vfg 46/1992. The operation of some equipment (for example, test

transmitters) in accordance with the regulations may, however, be subject to certain restrictions. Please refer to the notes

in the operating instructions.

Federal Office for Telecommunications Approvals has been notified of the placing of this equipment on the market

and has been granted the right to test the series for compliance with the regulations.

Voluntary Control Council for Interference (VCCI) Statement

This equipment is in the second category (information equipment to be used in a residential area or an adjacent area

thereto) and conforms to the standards set by the Voluntary Control Council for Interference by Data Processing

Equipment and Electronic Office Machines aimed at preventing radio interference in such residential areas.

When used near a radio or TV receiver, it may become the cause of radio interference.

Read instructions for correct handling.

Additional Copyrights

TERMS

Redistribution and use in source and binary forms, with or without modification, are permitted

subject to the following conditions:

1. Redistributions of source code must retain the above copyright notice, this list of

conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice, this list of

conditions and the following disclaimer in the documentation and/or other materials

provided with the distribution.

3. The copyright holder's name must not be used to endorse or promote any products

derived from this software without his specific prior written permission.

This software is provided 'as is' with no express or implied warranties of correctness or fitness

for purpose.

v1.0, January 2010

Redistribution and use in source and binary forms, with or without modification, are permitted

provided that the following conditions * are met:

1. Redistributions of source code must retain the above copyright notice, this list of conditions

and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice, this list of

conditions and the following disclaimer in the documentation and/or other materials

provided with the distribution.

3. All advertising materials mentioning features or use of this software must display the

following acknowledgment: “This product includes software developed by the OpenSSL

Project for use in the OpenSSL Toolkit. (http://www.openssl.org/)”

4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to endorse or

promote products derived from this software without prior written permission. For written

permission, please contact openssl-core@openssl.org.

5. Products derived from this software may not be called "OpenSSL" nor may "OpenSSL"

appear in their names without prior written permission of the OpenSSL Project.

6. Redistributions of any form whatsoever must retain the following acknowledgment: "This

product includes software developed by the OpenSSL Project for use in the OpenSSL

Toolkit (http://www.openssl.org/)"

THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY

EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR ITS

CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,

EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,

PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR

PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY

OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING

NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS

SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

This product includes cryptographic software written by Eric Young (eay@cryptsoft.com). This

product includes software written by Tim Hudson (tjh@cryptsoft.com).

License to copy and use this software is granted provided that it is identified as the "RSA Data

Security, Inc. MD5 Message-Digest Algorithm" in all material mentioning or referencing this

software or this function. License is also granted to make and use derivative works provided

that such works are identified as "derived from the RSA Data Security, Inc. MD5 Message-

Digest Algorithm" in all material mentioning or referencing the derived work.

RSA Data Security, Inc. makes no representations concerning either the merchantability of

this software or the suitability of this software for any particular purpose. It is provided "as is"

without express or implied warranty of any kind.

These notices must be retained in any copies of any part of this documentation and/or

software.

v1.0, January 2010

Product and Publication Details

Redistribution and use in source and binary forms are permitted provided that the above

documentation, advertising materials, and other materials related to such distribution and use

acknowledge that the software was developed by Carnegie Mellon University. The name of

the University may not be used to endorse or promote products derived from this software

without specific prior written permission.

THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED

WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF

MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.

Zlib zlib.h -- interface of the 'zlib' general purpose compression library version 1.1.4, March 11th,

This software is provided 'as-is', without any express or implied warranty. In no event will the

authors be held liable for any damages arising from the use of this software. Permission is

granted to anyone to use this software for any purpose, including commercial applications,

and to alter it and redistribute it freely, subject to the following restrictions:

1. The origin of this software must not be misrepresented; you must not claim that you wrote

the original software. If you use this software in a product, an acknowledgment in the

product documentation would be appreciated but is not required.

2. Altered source versions must be plainly marked as such, and must not be misrepresented

as being the original software.

3. This notice may not be removed or altered from any source distribution.

Jean-loup Gailly: jloup@gzip.org; Mark Adler: madler@alumni.caltech.edu

The data format used by the zlib library is described by RFCs (Request for Comments) 1950

to 1952 in the files ftp://ds.internic.net/rfc/rfc1950.txt (zlib format), rfc1951.txt (deflate format)

and rfc1952.txt (gzip format)

Model Number: SRXN3205

Publication Date: January 2010

Product Family: VPN Firewall

Product Name: ProSafe Wireless-N VPN Firewall

Home or Business Product: Business

Language: English

Publication Part Number: 202-10416-02

Publication Version Number 1.0

v1.0, January 2010

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

vii

v1.0, January 2010

Contents

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

About This Manual

Conventions, Formats, and Scope ..................................................................................xiii

How to Print this Manual ..................................................................................................xiv

Revision History ...............................................................................................................xiv

Chapter 1

Introduction

Key Features ..................................................................................................................1-1

A Powerful, True Firewall with Content Filtering ......................................................1-2

Autosensing Ethernet Connections with Auto Uplink ...............................................1-2

Extensive Protocol Support ......................................................................................1-3

Advanced VPN Support for Both IPsec and SSL .....................................................1-3

Wireless Networking Features ........................................................................................1-4

Easy Installation and Management ................................................................................1-5

System Requirements ..............................................................................................1-5

Package Contents ..........................................................................................................1-6

Front Panel Features ......................................................................................................1-6

Rear Panel Features ......................................................................................................1-8

Default IP Address, Login Name, and Password Location .............................................1-9

Qualified Web Browsers .................................................................................................1-9

Chapter 2

Connecting to the Internet (WAN)

Understanding the Connection Steps .............................................................................2-1

Logging into the VPN Firewall ........................................................................................2-2

Navigating the Menus .....................................................................................................2-3

Configuring the Internet Connection (WAN) ...................................................................2-4

Automatically Detecting and Connecting .................................................................2-4

Manually Configuring the Internet Connection .........................................................2-7

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

viii

v1.0, January 2010

Configuring the WAN Mode ................................................................................... 2-11

Configuring Dynamic DNS ...........................................................................................2-12

Configuring the Advanced WAN Options (Optional) .....................................................2-14

Additional WAN Related Configuration ..................................................................2-15

Chapter 3

LAN Configuration

Using the VPN Firewall as a DHCP Server ....................................................................3-1

Configuring the LAN Setup Options ...............................................................................3-2

Managing Groups and Hosts (LAN Groups) ...................................................................3-5

Viewing the LAN Groups Database .........................................................................3-7

Adding Devices to the LAN Groups Database .........................................................3-8

Changing Group Names in the LAN Groups Database ...........................................3-9

Configuring DHCP Address Reservation .................................................................3-9

Configuring Multi Home LAN IP Addresses ..................................................................3-10

Configuring Static Routes .............................................................................................3-11

Configuring Routing Information Protocol (RIP) ...........................................................3-13

Chapter 4

Wireless Configuration

Wireless Equipment Placement and Range Guidelines .................................................4-2

Understanding the VPN Firewall Wireless Security Options ..........................................4-2

Configuring Basic Wireless Setup (Without Security) .....................................................4-4

Testing and Completing Wireless Setup (Without Security) ...........................................4-6

Testing Wireless Connectivity (Without Security) .....................................................4-6

Configuring the Wireless Channel Settings (Without Security) ................................4-7

Wireless Security Types and Settings ............................................................................4-8

SSID and WEP/WPA Settings Setup Form ..............................................................4-9

Configuring WEP Security ...................................................................................... 4-11

Configuring WPA Security Without RADIUS ..........................................................4-12

Configuring WPA Security with RADIUS ................................................................4-13

Verifying Wireless Connectivity (With Security) .....................................................4-16

Deploying the VPN Firewall ...................................................................................4-16

Configuring Advanced Wireless Settings .....................................................................4-17

Restricting Wireless Access by MAC Address .............................................................4-18

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

v1.0, January 2010

Chapter 5

Firewall Security and Content Filtering

About Firewall Security and Content Filtering ................................................................5-1

Using Rules & Services to Block or Allow Traffic ............................................................5-2

Services-Based Rules ..............................................................................................5-2

Viewing the Firewall Rules .......................................................................................5-7

Order of Precedence for Rules ................................................................................5-7

Setting the Outbound Policy .....................................................................................5-7

Creating a LAN WAN Outbound Services Rule .......................................................5-8

Creating a LAN WAN Inbound Services Rule ..........................................................5-9

Modifying Rules ......................................................................................................5-10

Inbound Rules Examples .......................................................................................5-11

Outbound Rules Example ......................................................................................5-14

Configuring Other Firewall Features .............................................................................5-14

Attack Checks ........................................................................................................5-14

Configuring Session Limits .....................................................................................5-17

Managing the Application Level Gateway for SIP Sessions ..................................5-18

Creating Services, QoS Profiles, and Bandwidth Profiles ............................................5-19

Adding Customized Services .................................................................................5-19

Setting Quality of Service (QoS) Priorities .............................................................5-21

Creating Bandwidth Profiles ...................................................................................5-21

Setting Schedules to Block or Allow Specific Traffic .....................................................5-24

Blocking Internet Sites (Content Filtering) ....................................................................5-25

Enabling Source MAC Filtering (Address Filtering) ......................................................5-28

Configuring IP/MAC Address Binding ...........................................................................5-29

Configuring Port Triggering ...........................................................................................5-31

Configuring UPnP (Universal Plug and Play) ...............................................................5-34

E-Mail Notifications of Event Logs and Alerts ...............................................................5-35

Administrator Tips .........................................................................................................5-36

Chapter 6

Virtual Private Networking Using IPsec

Using the VPN Wizard for Client and Gateway Configurations ......................................6-1

Creating Gateway to Gateway VPN Tunnels with the Wizard ........................................6-2

Creating a Client to Gateway VPN Tunnel with the Wizard ............................................6-5

Creating a VPN Client to VPN Firewall Connection .......................................................6-6

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

v1.0, January 2010

Configuring the VPN Firewall ...................................................................................6-7

Configuring the VPN Client ......................................................................................6-7

Testing the Connection ...........................................................................................6-10

Viewing VPN Firewall VPN Connection Status and Logs ............................................. 6-11

Managing IPsec VPN Policies ......................................................................................6-12

Managing IKE Polices ............................................................................................6-12

Configuring VPN Policies .......................................................................................6-20

Assigning IP Addresses to Remote Users (Mode Config) ............................................6-27

Mode Config Operation ..........................................................................................6-28

Configuring Mode Config Operation on the VPN Firewall ......................................6-28

Configuring Mode Config Operation on the VPN Client .........................................6-32

Configuring Extended Authentication (XAUTH) ............................................................6-33

Configuring XAUTH for VPN Clients ......................................................................6-34

User Database Configuration .................................................................................6-35

RADIUS Client Configuration .................................................................................6-35

Configuring Keepalives and Dead Peer Detection .......................................................6-37

Configuring Keepalives ..........................................................................................6-38

Configuring Dead Peer Detection ..........................................................................6-39

Configuring NetBIOS Bridging with VPN ......................................................................6-40

Chapter 7

Virtual Private Networking Using SSL

Understanding the Portal Options ...................................................................................7-1

Planning for SSL VPN ....................................................................................................7-2

Creating the Portal Layout ..............................................................................................7-3

Configuring Domains, Groups, and Users ......................................................................7-7

Configuring Applications for Port Forwarding .................................................................7-8

Adding Servers .........................................................................................................7-8

Adding A New Host Name .......................................................................................7-9

Configuring the SSL VPN Client ...................................................................................7-10

Configuring the Client IP Address Range .............................................................. 7-11

Adding Routes for VPN Tunnel Clients ..................................................................7-12

Using Network Resource Objects to Simplify Policies ..................................................7-13

Adding New Network Resources ..........................................................................7-13

Configuring User, Group, and Global Policies ..............................................................7-15

Viewing Policies .....................................................................................................7-17

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

v1.0, January 2010

Adding a Policy ......................................................................................................7-18

Chapter 8

Managing Users, Authentication, and Certificates

Adding Authentication Domains, Groups, and Users .....................................................8-1

Creating a Domain ...................................................................................................8-1

Creating a Group ......................................................................................................8-5

Creating a New User Account ..................................................................................8-6

Setting User Login Policies ......................................................................................8-7

Changing Passwords and Other User Settings ........................................................8-9

Managing Certificates ...................................................................................................8-11

Viewing and Loading CA Certificates .....................................................................8-12

Viewing Active Self Certificates ..............................................................................8-13

Obtaining a Self Certificate from a Certificate Authority .........................................8-14

Managing your Certificate Revocation List (CRL) ..................................................8-17

Chapter 9

VPN Firewall and Network Management

Performance Management .............................................................................................9-1

Bandwidth Capacity .................................................................................................9-1

Features that Reduce Traffic ....................................................................................9-2

Features that Increase Traffic ..................................................................................9-4

Using QoS to Shift the Traffic Mix ............................................................................9-7

Tools for Traffic Management ...................................................................................9-7

Changing Passwords and Administrator Settings ..........................................................9-8

Enabling Remote Management Access .........................................................................9-9

Using an SNMP Manager .............................................................................................9-12

Managing the Configuration File ...................................................................................9-14

Configuring Date and Time Service ..............................................................................9-17

Chapter 10

Monitoring System Performance

Activating Notification of Events and Alerts ..................................................................10-1

Viewing the Logs ..........................................................................................................10-4

Enabling the Traffic Meter .............................................................................................10-5

Viewing VPN Firewall Configuration and System Status ..............................................10-8

Monitoring VPN Firewall Statistics ..............................................................................10-10

Monitoring the WAN Port Status .................................................................................10-10

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

xii

v1.0, January 2010

Monitoring Attached Devices ...................................................................................... 10-11

Viewing the DHCP Log ...............................................................................................10-13

Monitoring Active Users ..............................................................................................10-14

Viewing the Port Triggering Status .............................................................................10-14

Monitoring the VPN Tunnel Connection Status ..........................................................10-15

Viewing the VPN Logs ................................................................................................10-17

Chapter 11

Troubleshooting

Basic Functions ............................................................................................................11-1

Power LED Not On ................................................................................................. 11-2

LEDs Never Turn Off ..............................................................................................11-2

LAN or WAN Port LEDs Not On ............................................................................. 11-2

Troubleshooting the Web Configuration Interface ........................................................ 11-3

Troubleshooting the ISP Connection ............................................................................11-4

Troubleshooting a TCP/IP Network Using a Ping Utility ...............................................11-5

Testing the LAN Path to Your VPN Firewall ........................................................... 11-5

Testing the Path from Your PC to a Remote Device .............................................. 11-6

Restoring the Default Configuration and Password ......................................................11-7

Problems with Date and Time ....................................................................................... 11-7

Using the Diagnostics Utilities ...................................................................................... 11-8

Appendix A

Default Settings and Technical Specifications

Default Settings ............................................................................................................. A-1

Technical Specifications ................................................................................................. A-3

Appendix B

Two Factor Authentication

Why do I need Two-Factor Authentication? ................................................................... B-1

What are the benefits of Two-Factor Authentication? ............................................. B-1

What is Two-Factor Authentication ......................................................................... B-2

NETGEAR Two-Factor Authentication Solutions ........................................................... B-2

Appendix C

Related Documents

Index

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

xiii

v1.0, January 2010

About This Manual

The NETGEAR® ProSafe™ Wireless-N VPN FirewallReference Manual describes how to

configure and troubleshoot a ProSafe Wireless-N VPN Firewall. The information in this manual is

intended for readers with intermediate computer and networking skills.

Conventions, Formats, and Scope

The conventions, formats, and scope of this manual are described in the following paragraphs:

•Typographical Conventions. This manual uses the following typographical conventions:

•Formats. This manual uses the following formats to highlight special messages:

Italic Emphasis, books, CDs, file and server names, extensions

Bold User input, IP addresses, GUI screen text

Fixed Command prompt, CLI text, code

italic URL links

Note: This format is used to highlight information of importance or special interest.

Tip: This format is used to highlight a procedure that will save time or resources.

Warning: Ignoring this type of note may result in a malfunction or damage to the

equipment.

Danger: This is a safety warning. Failure to take heed of this notice may result in

personal injury or death.

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

xiv

v1.0, January 2010

•Scope. This manual is written for the VPN firewall according to these specifications:

For more information about network, Internet, firewall, and VPN technologies, see the links to the

NETGEAR website in Appendix C, “Related Documents.”.

How to Print this Manual

To print this manual, your computer must have the free Adobe Acrobat reader installed in order to

view and print PDF files. The Acrobat reader is available on the Adobe website at

http://www.adobe.com.

Revision History

Product ProSafe Wireless-N VPN Firewall

Manual Publication Date January 2010

Note: Product updates are available on the NETGEAR, Inc. website at

http://kbserver.netgear.com/products/SRXN3205.asp.

Tip: If your printer supports printing two pages on a single sheet of paper, you can save

paper and printer ink by selecting this feature.

Manual Part

Number

Manual

Version

Number

Publication

Date Description

202-10416-01 1.0 October 2008 First publication

202-10416-02 1.0 January 2009 Added the following new features for the January 2010 firmware

maintenance release:

• Connection reset and delay options on the WAN ISP Settings

screen (see “Manually Configuring the Internet Connection”).

• Support for DNS 3322 in the Dynamic DNS submenu (see

“Configuring Dynamic DNS”).

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

v1.0, January 2010

202-10416-02

(continued) 1.0 January 2009 (continued)

• Support for an address range for inbound LAN rules on the Add

LAN WAN Inbound Service screen (see “Inbound Rules (Port

Forwarding)” and “Creating a LAN WAN Inbound Services Rule”).

• Support for new log options such as Resolved DNS Names and

VPN on the Firewall Logs & E-mail screen (see “Activating

Notification of Events and Alerts”).

In addition, made the following substantial changes to the book:

• Provided new captures for most screens and resized the existing

screen captures for better viewing.

• Made global stylistic changes for consistency and clarity.

• Revised the following sections in Chapter 2, “Connecting to the

Internet (WAN)”:

*“Configuring the Internet Connection (WAN)”

*“Configuring Dynamic DNS”

• Revised the following sections in Chapter 3, “LAN Configuration”:

*“Using the VPN Firewall as a DHCP Server”

*“Configuring the LAN Setup Options”

• Reorganized Chapter 4, “Wireless Configuration,” and revised

the following sections in this chapter:

*“Understanding the VPN Firewall Wireless Security Options”

*“Configuring Basic Wireless Setup (Without Security)”

*“Wireless Security Types and Settings”

*“Configuring Advanced Wireless Settings”

*“Restricting Wireless Access by MAC Address”

• Added the “Configuring Other Firewall Features” section to

Chapter 5, “Firewall Security and Content Filtering,” and revised

the following sections in this chapter:

*“Using Rules & Services to Block or Allow Traffic”

*“Creating Services, QoS Profiles, and Bandwidth Profiles”

*“Setting Schedules to Block or Allow Specific Traffic”

*“Blocking Internet Sites (Content Filtering)”

*“Enabling Source MAC Filtering (Address Filtering)”

*“Configuring IP/MAC Address Binding”

*“Configuring Port Triggering”

*“E-Mail Notifications of Event Logs and Alerts”

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

xvi

v1.0, January 2010

202-10416-02

(continued) 1.0 January 2009 (continued)

• Reorganized Chapter 6, “Virtual Private Networking Using IPsec,

added the “Viewing VPN Firewall VPN Connection Status and

Logs,” “Configuring Keepalives and Dead Peer Detection,” and

“Configuring NetBIOS Bridging with VPN” sections, and revised

the following sections in this chapter:

*“Using the VPN Wizard for Client and Gateway

Configurations”

*“Creating Gateway to Gateway VPN Tunnels with the Wizard”

*“Managing IPsec VPN Policies”

*“Assigning IP Addresses to Remote Users (Mode Config)”

*“Configuring Extended Authentication (XAUTH)”

• Made minor changes in Chapter 7, “Virtual Private Networking

Using SSL.”

• Revised the following sections in Chapter 8, “Managing Users,

Authentication, and Certificates:

*“Adding Authentication Domains, Groups, and Users”

*“Managing Certificates”

• Revised the following sections in Chapter 9, “VPN Firewall and

Network Management”:

*“Enabling Remote Management Access”

*“Managing the Configuration File”

• Revised the following sections in Chapter 10, “Monitoring System

Performance”:

*“Activating Notification of Events and Alerts”

*“Viewing the Logs”

*“Viewing VPN Firewall Configuration and System Status”

*“Monitoring the WAN Port Status”

*“Monitoring Attached Devices”

*“Viewing the VPN Logs”

• Revised the following sections in Chapter 11, “Troubleshooting

*“Troubleshooting the ISP Connection”

*“Troubleshooting a TCP/IP Network Using a Ping Utility”

*“Restoring the Default Configuration and Password”

• Added Appendix B, “Two Factor Authentication”

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

Introduction 1-1

v1.0, January 2010

Chapter 1

Introduction

The ProSafe Wireless-N VPN Firewall SRXN3205 provides Internet connectivity to your local

Ethernet and wireless networks via a broadband cable or DSL modem. The SRXN3205 is a

complete security solution with a powerful and flexible firewall to safeguard your networks along

with advanced IPsec and SSL VPN technologies for secure wired and wireless connections.

Moreover, the ProSafe Wireless-N VPN Firewall supports wireless connections over the wider

range and more robust connections afforded by 802.11N and 802.11a wireless networks. The

SRXN3205 also supports wireless bridging.

The Gigabit Ethernet LAN ports and WAN port ensure extremely high data transfer speeds.

The SRXN3205 is a plug-and-play device that can be installed and configured within minutes.

This chapter contains the following sections:

•“Key Features” on this page

•“Wireless Networking Features” on page 1-4

•“System Requirements” on page 1-5

•“Package Contents” on page 1-6

•“Front Panel Features” on page 1-6

•“Rear Panel Features” on page 1-8

•“Default IP Address, Login Name, and Password Location” on page 1-9

•“Qualified Web Browsers” on page 1-9

Key Features

The SRXN3205 provides the following key features:

• A single 10/100/1000 Mbps Gigabit Ethernet WAN port for your Internet connection.

• Built-in four-port 10/100/1000 Mbps Gigabit Ethernet LAN switch for extremely fast data

transfer between local network resources and all of the wireless clients.

• Advanced IPsec and SSL VPN support

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

1-2 Introduction

v1.0, January 2010

• Advanced stateful packet inspection (SPI) firewall with multi-NAT support

• Easy, web-based setup for installation and management

• Front panel LEDs for easy monitoring of status and activity

• Flash memory for firmware upgrade

• AC-DC power adapter for low current draw

A Powerful, True Firewall with Content Filtering

Unlike simple Internet sharing NAT routers, the SRXN3205 is a true firewall, using stateful packet

inspection (SPI) to defend against hacker attacks. Its firewall features include:

• Automatically detects and thwarts denial of service (DoS) attacks such as Ping of Death and

SYN Flood.

• Blocks unwanted traffic from the Internet to your LAN.

• Blocks access from your LAN to Internet locations or services that you specify as off-limits.

• Prevents objectionable content from reaching your PCs. You can control access to Internet

content by screening for Web services, Web addresses, and keywords within Web addresses.

You can configure the firewall to log and report attempts to access objectionable Internet sites.

• Permits scheduling of firewall policies by day and time.

• Logs security events such as blocked incoming traffic, port scans, attacks, and administrator

logins. You can configure the firewall to e-mail the log to you at specified intervals. You can

also configure the firewall to send immediate alert messages to your e-mail address or e-mail

pager whenever a significant event occurs.

Autosensing Ethernet Connections with Auto Uplink

With its internal 5-port 10/100/1000 Mbps switch and 10/100/1000 WAN port, the SRXN3205 can

connect to either a 10 Mbps standard Ethernet network, a 100 Mbps Fast Ethernet network, or a

1000 Mbps Gigabit Ethernet network. The five LAN and WAN interfaces are autosensing and

capable of full-duplex or half-duplex operation.

The SRXN3205 incorporates Auto UplinkTM technology. Each Ethernet port will automatically

sense whether the Ethernet cable plugged into the port should have a “normal” connection such as

to a PC or an “uplink” connection such as to a switch or hub. That port will then configure itself to

the correct configuration. This feature eliminates the need to worry about crossover cables, as

Auto Uplink will accommodate either type of cable to make the right connection.

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

Introduction 1-3

v1.0, January 2010

Extensive Protocol Support

The SRXN3205 supports the Transmission Control Protocol/Internet Protocol (TCP/IP) and

Routing Information Protocol (RIP). For further information about TCP/IP, see the document that

you can access from “TCP/IP Networking Basics” in Appendix C.

•IP Address Sharing by NAT. The SRXN3205 allows many networked PCs to share an

Internet account using only a single IP address, which may be statically or dynamically

assigned by your Internet service provider (ISP). This technique, known as NAT, allows the

use of an inexpensive single-user ISP account.

•Automatic Configuration of (Wired & Wireless) PCs by DHCP. The SRXN3205

dynamically assigns network configuration information, including IP, gateway, and domain

name server (DNS) addresses, to PCs on the LAN and Wireless LAN using the Dynamic Host

Configuration Protocol (DHCP). This feature greatly simplifies configuration of PCs on your

local network.

•DNS Proxy. When DHCP is enabled and no DNS addresses are specified, the SRXN3205

provides its own address as a DNS server to the attached PCs. The SRXN3205 obtains actual

DNS addresses from the ISP during connection setup and forwards DNS requests from the

LAN.

•PPP over Ethernet (PPPoE). PPPoE is a protocol for connecting remote hosts to the Internet

over a DSL connection by simulating a dial-up connection. This feature eliminates the need to

run a login program such as EnterNet or WinPOET on your PC.

•Quality of Service (QoS). Support for traffic prioritization.

Advanced VPN Support for Both IPsec and SSL

The SRXN3205 supports IPsec and SSL virtual private network (VPN) connections.

• IPsec VPN delivers full network access between a central office and branch offices, or

between a central office and telecommuters. Remote access by telecommuters requires the

installation of VPN client software on the remote computer.

– IPsec VPN with broad protocol support for secure connection to other IPsec gateways and

clients.

– Bundled with the single-user license of the NETGEAR ProSafe VPN Client software

(VPN01L)

– Supports up to 5 (max) IPsec VPN tunnels (alternately, 4 IPsec VPN tunnels concurrently

with 4 SSL VPN sessions, or 5 IPsec VPN tunnels concurrently with 3 SSL VPN

sessions). The total number of concurrent tunnels and sessions is not to exceed eight.

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

1-4 Introduction

v1.0, January 2010

• SSL VPN provides remote access for mobile users to selected corporate resources without

requiring a pre-installed VPN client on their computers.

– Uses the familiar Secure Sockets Layer (SSL) protocol, commonly used for e-commerce

transactions, to provide client-free access with customizable user portals and support for a

wide variety of user repositories.

– Browser based, platform-independent, remote access through a number of popular

browsers, such as Microsoft Internet Explorer or Apple Safari.

– Provides granular access to corporate resources based upon user type or group

membership.

– Supports up to 5 IPse VPN sessions and up to 5 SSL and VPN sessions.

Wireless Networking Features

•Dual Band Selection. The SRXN3205 allows you to configure the 802.11 wireless options for

the 2.4 GHz band or the 5 GHz bands.

•Upgradeable Firmware. Firmware is stored in a flash memory and can be upgraded easily,

using only your Web browser, and can be also upgraded remotely. In addition to using Web

browser to do so, command-line interface can also be used.

•Access Control. The Access Control MAC address filtering feature can ensure that only

trusted wireless stations can use the SRXN3205 to gain access to your LAN.

•Hidden Mode. The SSID is not broadcast, assuring only clients configured with the correct

SSID can connect.

•Configuration Backup. Configuration settings can be backed up to a file and restored.

•Secure and Economical Operation. Adjustable power output allows more secure or

economical operation.

•Autosensing Ethernet Connection with Auto Uplink Interface. Connects to 10/100/1000

Mbps IEEE 802.3 Ethernet networks.

•LED Indicators. Power, test, LAN speed, LAN activity, and wireless activity for each radio

mode are easily identified.

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

Introduction 1-5

v1.0, January 2010

Easy Installation and Management

You can install, configure, and operate the SRXN3205 within minutes after connecting it to the

network. The following features simplify installation and management tasks:

•Browser-Based Management. Browser-based configuration allows you to easily configure

your SRXN3205 and Wireless access from almost any type of personal computer, such as

Windows, Macintosh, or Linux. A user-friendly Setup Wizard is provided and online help

documentation is built into the browser-based Web Management Interface.

•Auto Detection of ISP. The SRXN3205 automatically senses the type of Internet connection,

asking you only for the information required for your type of ISP account.

•VPN Wizard. The SRXN3205 includes the NETGEAR VPN Wizard to easily configure IPsec

VPN tunnels according to the recommendations of the Virtual Private Network Consortium

(VPNC) to ensure the IPsec VPN tunnels are interoperable with other VPNC-compliant VPN

firewalls and clients.

•SNMP. The SRXN3205 supports the Simple Network Management Protocol (SNMP) to let

you monitor and manage log resources from an SNMP-compliant system manager. The SNMP

system configuration lets you change the system variables for MIB2.

•Diagnostic Functions. The SRXN3205 incorporates built-in diagnostic functions such as

Ping, Trace Route, DNS lookup, and remote reboot.

•Remote Management. The SRXN3205 allows you to login to the Web Management Interface

from a remote location on the Internet. For security, you can limit remote management access

to a specified remote IP address or range of addresses.

•Visual monitoring. The SRXN3205’s front panel LEDs provide an easy way to monitor its

status and activity.

System Requirements

Before installing the SRXN3205, ensure your system meets the following requirements:

• Category 5 UTP straight through Ethernet cable with RJ-45 connectors, like the one included

in the package

• A 100-240 V, 50-60 Hz AC power source

• A Web browser for configuration, such as, Microsoft Internet Explorer 5.0 or above, or

Mozilla 3.0 or above

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

1-6 Introduction

v1.0, January 2010

Package Contents

The SRXN3205 product package contains the following items:

• ProSafe Wireless-N VPN Firewall SRXN3205

• Rubber feet (4) with adhesive backing

• One AC-DC power adapter (12V, 1.5A) with cord (approximately 6 ft, or 183 cm)

• Three dual-band antennas (SMA connectors): 2 dipole (long); 1 patch (square)

• One Straight through Category 5 (Cat5) Ethernet cable.

•Installation Guide, SRXN3205 ProSafe Wireless-N VPN Firewall .

•Resource CD, including:

– Application Notes and other helpful information.

– ProSafe VPN Client Software – one user license.

• Warranty and Support Information Card.

If any of the parts are incorrect, missing, or damaged, contact your NETGEAR dealer. Keep the

carton, including the original packing materials, in case you need to return the firewall for repair.

Front Panel Features

The SRXN3205’s front panel is shown below:

Figure 1-1

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

Introduction 1-7

v1.0, January 2010

Table 1-1. Description of Front Panel Items

Item Activity Description

PWR

(Power)

On Green

Off Power is supplied to the SRXN3205.

Power is not supplied to the SRXN3205.

TEST

On Amber

Blinking Amber

Off

Test mode: The system is initializing (On) or the initialization has

failed (Blinking).

Writing to Flash memory (during upgrading or resetting to defaults).

The system has booted successfully.

n/a 5 GHz Off WLAN 802.11n/a (5GHz) mode is disabled.

Blink (Green) Wireless data traffic in 5GHz modes.

n/g 2.4 GHz Off WLAN 802.11b/g/n (2.4 GHz) mode is disabled.

Blink (Green) Wireless data traffic in 2.4 GHz modes

Reset

button

(Press with

a sharp

object)

Reboot Press once to reboot the unit.

Factory Defaults Hold in for 15 seconds (until the TEST light flashes). This resets

the unit to factory default settings, erasing all configuration settings

and restores the default password.

3LAN Ports LAN connections Four Auto MDI/MDIX, Gigabit Ethernet ports.

Left LED (status): On = Link; Blink = ACT

Right LED (speed): Off = 10M; Amber = 100M; Green = 1000M

4WAN Port WAN connection One Auto MDI/MDIX, Gigabit Ethernet port.

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

1-8 Introduction

v1.0, January 2010

Rear Panel Features

The rear panel of the SRXN3205 is shown below.

1. Detachable (SMA) Antennas: The SRXN3205 provides three SMA connectors for the

detachable antennas (two dipole and one patch). For the best performance, attach the patch

antenna to the middle connector and attach the dipole antennas to the two connectors on both

corners. The three antennas can be positioned horizontally or vertically for the best coverage.

2. DC Power Jack: This jack connects to the SRXN3205 12V 1.5A AC-DC power adapter.

Figure 1-2

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

Introduction 1-9

v1.0, January 2010

Default IP Address, Login Name, and Password Location

Check the label on the bottom of the SRXN3205’s enclosure if you need a reminder of the

following factory default information:

Qualified Web Browsers

To configure the SRXN3205, an administrator must use Internet Explorer 5.1 or higher, Apple

Safari 1.2 or higher, or Mozilla Firefox l.x Web browser with JavaScript, cookies, and SSL

enabled.

Although these web browsers are qualified for use with the SRXN3205’s Web Management

Interface for configuring the SRXN3205, SSL VPN users should choose a browser that supports

JavaScript, Java, cookies, SSL, and ActiveX to take advantage of the full suite of applications.

Note that Java is only required for the SSL VPN portal, not the Web Management Interface.

Figure 1-3

IP Address

User Name

Password

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

1-10 Introduction

v1.0, January 2010

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

Connecting to the Internet (WAN) 2-1

v1.0, January 2010

Chapter 2

Connecting to the Internet (WAN)

The initial Internet configuration of the ProSafe Wireless-N VPN Firewall SRXN3205 is described

in this chapter.

This chapter contains the following sections:

•“Understanding the Connection Steps” on this page

•“Logging into the VPN Firewall” on page 2-2

•“Navigating the Menus” on page 2-3

•“Configuring the Internet Connection (WAN)” on page 2-4

•“Configuring Dynamic DNS” on page 2-12

•“Configuring the Advanced WAN Options (Optional)” on page 2-14

Understanding the Connection Steps

Typically, six steps are required to complete the basic Internet connection of your VPN firewall.

1. Connect the firewall to your network. Connect the cables and restart your network

according to the instructions in the printed installation guide included in the product package.

A PDF of the FVX338 ProSafe VPN Firewall 200 Installation Guide is on the product CD and

on the NETGEAR website at http://kbserver.netgear.com.

2. Log in to the VPN firewall. After logging in, you are ready to set up and configure your VPN

firewall. You can also change your password and enable remote management at this time. See

“Logging into the VPN Firewall” on page 2-2.

3. Configure the Internet connection to your ISP. During this phase, you will connect to your

ISP. See “Configuring the Internet Connection (WAN)” on page 2-4.

4. Configure the WAN mode. Select either Network Address Translation (NAT) or Classical

Routing. See “Configuring the WAN Mode” on page 2-11.

5. Configure dynamic DNS on the WAN port (optional). Configure your fully qualified

domain name (FQDN) during this phase (if required). See “Configuring Dynamic DNS” on

page 2-12.

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

2-2 Connecting to the Internet (WAN)

v1.0, January 2010

6. Configure the WAN options (optional). Optionally, you can enable each WAN port to

respond to a ping, and you can change the factory default MTU size and port speed. However,

these are advanced features and changing them is not usually required. See “Configuring the

Advanced WAN Options (Optional)” on page 2-14.

Each of these tasks is detailed separately in this chapter. The configuration of wireless, firewall,

and VPN features are described in later chapters.

Logging into the VPN Firewall

To connect to the VPN firewall, your computer needs to be configured to get an IP address

automatically from the VPN firewall by DHCP. For instructions on how to configure your

computer for DHCP, see the “Preparing Your Network” document that you can access from

Appendix C, “Related Documents.”

To log in to the VPN firewall, follow these steps:

1. Open a browser, and enter https://192.168.1.1 in the address field.

The login window displays in the browser.

2. Enter admin in lower case for the User Name and password for the Password.

3. Click Login. The Web Configuration Manager appears, displaying the Router Status screen as

the default screen (see Figure 2-2 on page 2-3).

Figure 2-1

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

Connecting to the Internet (WAN) 2-3

v1.0, January 2010

Navigating the Menus

The Web Configuration Manager menus are organized in a layered structure of main categories

and submenus:

•Main menu. The horizontal orange bar near the top of the screen is the main menu, containing

the primary configuration categories. Clicking on a primary category changes the contents of

the submenu bar.

•Submenu. The horizontal grey bar immediately below the main menu is the submenu,

containing subcategories of the currently selected primary category.

Figure 2-2

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

2-4 Connecting to the Internet (WAN)

v1.0, January 2010

•Tab. Immediately below the submenu bar, at the top of the menu active window, are one or

more tabs, further subdividing the currently selected subcategory if necessary.

•Option arrow. To the right of the tabs on some menus are one or more blue dots with an arrow

in the center. Clicking an option arrow brings up either a popup window or an advanced option

menu.

You can now proceed to the first configuration task, configuring the VPN firewall’s Internet

connections.

Configuring the Internet Connection (WAN)

To set up your VPN firewall for secure Internet connections, you configure the WAN port. The

Web Configuration Manager offers two connection configuration options:

• Automatic detection and configuration of the network connection.

• Manual configuration of the network connection.

Each option is detailed in the following sections.

Automatically Detecting and Connecting

To automatically configure the WAN port for connection to the Internet:

1. Select Network Configuration > WAN Settings from the menu/submenu.

The WAN tabs appear on screen with the WAN ISP Settings screen in view (see Figure 2-3 on

page 2-5).

Tip: In the instructions in this guide, we may refer to a menu using the notation

primary > subcategory, such as Network Configuration > WAN Settings. In

this example, Network Configuration is the selected primary category (in the

main menu) and WAN Settings is the selected subcategory (in the submenu).

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

Connecting to the Internet (WAN) 2-5

v1.0, January 2010

2. Click Auto Detect at the bottom of the screen.

Figure 2-3

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

2-6 Connecting to the Internet (WAN)

v1.0, January 2010

Auto Detect will probe the WAN port for a range of connection methods and suggest one that

your ISP appears to support.

a. If Auto Detect is successful, a status bar at the top of the screen will display the results:.

b. If Auto Detect senses a connection method that requires input from you, it will prompt you

for the information. All methods with the required settings are detailed in the following

table.

c. If Auto Detect does not find a connection, you will be prompted to (1) check the physical

connection between your VPN firewall and the cable or DSL line, or to (2) check your

VPN firewall’s MAC address (For more information, see “Troubleshooting the ISP

Connection” on page 11-4).

3. To verify the connection, click the WAN Status option arrow at the top right of the screen.

A popup window appears, displaying the connection status of the WAN port (see Figure 2-5

on page 2-7).

Figure 2-4

Table 2-1. Internet connection methods

Connection Method Data Required

DHCP (Dynamic IP) No data is required.

PPPoE Login (Username, Password);

Account Name, Domain Name (sometimes required).

PPTP Login (Username, Password),

Local IP address, and PPTP Server IP address;

Account Name (sometimes required).

Fixed (Static) IP Static IP address, Subnet, and Gateway IP; DNS Server IP addresses.

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

Connecting to the Internet (WAN) 2-7

v1.0, January 2010

The WAN Status window should show a valid IP address and gateway. If the configuration

was not successful, go to “Manually Configuring the Internet Connection” following this

section, or see “Troubleshooting the ISP Connection” on page 11-4.

4. Click Test to evaluate your entries.

The VPN firewall will attempt to connect to the NETGEAR website. If a successful

connection is made, NETGEAR’s website appears.

If the automatic WAN ISP configurations failed, you can attempt a manual configuration as

described in the following section, or see “Troubleshooting the ISP Connection” on page 11-4.

Manually Configuring the Internet Connection

Unless your ISP automatically assigns your configuration automatically via DHCP, you will need

to obtain configuration parameters from your ISP in order to manually establish an Internet

connection. The necessary parameters for various connection types are listed in Table 2-1 on

page 2-6.

Figure 2-5

Note: If the configuration process was successful, you are connected to the Internet

through the WAN port.

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

2-8 Connecting to the Internet (WAN)

v1.0, January 2010

To manually configure your WAN ISP Settings:

1. Select Network Configuration > WAN ISP Settings. The WAN ISP Settings screen is

displayed (see Figure 2-3 on page 2-5 for the entire screen).

2. In the ISP Login section, choose one of these options:

• If your ISP requires an initial login to establish an Internet connection, click Yes (this is

the default).

• If a login is not required, click No and ignore the Login and Password fields.

3. If you clicked Yes, enter the ISP-provided Login and Password information.

4. In the ISP Type section, select the type of ISP connection you use from the two listed options.

(By default, “Other (PPPoE)” is selected.)

•Other (PPPoE). If you have installed login software such as WinPoET or Ethernet, then

your connection type is PPPoE. Configure the following fields:

–Account Name. Valid account name for the PPPoE connection.

–Domain Name. Name of your ISP’s domain or your domain name if your ISP has

assigned one. In most cases, you may leave this field blank.

Figure 2-6

Figure 2-7

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

Connecting to the Internet (WAN) 2-9

v1.0, January 2010

–Idle Timeout. Select Keep Connected, to keep the connection always on. To logout

after the connection is idle for a period of time, click Idle Time and in the timeout

field enter the number of minutes to wait before disconnecting.

–Connection Reset. Select this checkbox to to specify a time when the PPPoE WAN

connection is reset, that is, the connection is disconnected momentarily and then re-

established. Enter the hour and minutes in the Disconnect Time fields to specify when

the connection should be disconnected. Enter the seconds in the Delay field to specify

the period after which the connection should be re-established.

•PPTP. Select this option if your ISP is Austria Telecom or any other ISP that uses PPTP as

a login protocol. Configure the following fields:

–Account Name. (Also known as Host Name or System Name.) Enter the valid

account name for the PPTP connection (usually your e-mail name as assigned by your

ISP). Some ISPs require entering your full e-mail address here.

–Domain Name. Your domain name or workgroup name assigned by your ISP, or your

ISPs domain name. You may leave this field blank.

–Idle Timeout. Check the Keep Connected radio box to keep the connection always

on. To logout after the connection is idle for a period of time, click Idle Time and

enter the number of minutes to wait before disconnecting in the timeout field. This is

useful if your ISP charges you based on the amount of time you have logged in.

–My IP Address. IP address assigned by the ISP to make the connection with the ISP

server.

–Server IP Address. IP address of the PPTP server.

5. Review the Internet (IP) Address options.

Figure 2-8

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

2-10 Connecting to the Internet (WAN)

v1.0, January 2010

•Get Dynamically from ISP. If your ISP has not assigned a static IP address, select this

radio button. The ISP will automatically assign an IP address to the VPN firewall using

DHCP network protocol. The IP address and subnet mask fields will be inactivated. As an

option, you can select the following checkboxes:

–Client Identifier. Select this checkbox if your ISP requires the Client Identifier

information to assign an IP address using DHCP.

–Vendor Class Identifier. Select this checkbox if your ISP requires the Vendor Class

Identifier information to assign an IP address using DHCP.

•Use Static IP Address. If your ISP has assigned a fixed (static) IP address, select this

radio button, and configure the following fields:

–IP Address. Enter the Static IP address assigned to you, that identifies the VPN

firewall to your ISP.

–Subnet Mask. Enter the mask provided by the ISP or your network administrator.

–Gateway IP Address. Enter the IP address of the ISP’s gateway, provided by the ISP

or your network administrator.

6. Review the Domain Name Server (DNS) server options.

• If your ISP has not assigned any Domain Name Servers (DNS) addresses, click Get

Dynamically from ISP.

• If your ISP (or your IT department) has assigned DNS addresses, click Use These DNS

Servers and enter the DNS server IP addresses provided to you in the fields.

7. Click Apply to save any changes to the WAN ISP Settings. (Or click Reset to discard any

changes and revert to the previous settings.)

8. Click Test to evaluate your entries.

The VPN firewall will attempt to connect to the NETGEAR website. If a successful

connection is made, NETGEAR’s website appears.

Figure 2-9

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

Connecting to the Internet (WAN) 2-11

v1.0, January 2010

Configuring the WAN Mode

To access the WAN Mode, click on Network Configuration > WAN Settings and select the WAN

Mode tab. The WAN Mode screen displays.

The WAN Mode screen allows you to configure how your firewall uses the external Internet

connection. This screen gives you two choices for accessing the external Internet connection.

•Network Address Translation (NAT). This technique allows several computers on a LAN to

share the same Internet connection (IP address) while using private IP address on the LAN,

which are hidden from the Internet.

•Classical Routing. This method allows the firewall to perform the routing, but requires

separate valid static Internet IP address for each PC on your LAN.

Network Address Translation

Network Address Translation (NAT) allows all PCs on your LAN to share a single public Internet

IP address. From the Internet, there is only a single device (the VPN firewall) and a single IP

address. PCs on your LAN can use any private IP address range, and these IP addresses are not

visible from the Internet.

• The VPN firewall uses NAT to select the correct PC (on your LAN) to receive any incoming

data.

• If you only have a single public Internet IP address, you MUST use NAT. (the default setting).

• If your ISP has provided you with multiple public IP addresses, you can use one address as the

primary shared address for Internet access by your PCs, and you can map incoming traffic on

the other public IP addresses to specific PCs on your LAN. This one-to-one inbound mapping

is configured using an inbound firewall rule.

Figure 2-10

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

2-12 Connecting to the Internet (WAN)

v1.0, January 2010

Classical Routing

In classical routing mode, the VPN firewall performs routing, but without NAT. To gain Internet

access, each PC on your LAN must have a valid static Internet IP address.

If your ISP has allocated a number of static IP addresses to you, and you have assigned one of

these addresses to each PC, you can choose classical routing. Or, you can use classical routing for

routing private IP addresses within a campus environment.

To learn the status of the WAN port, you can view the Router Status screen (see “Monitoring the

VPN Tunnel Connection Status” on page 10-15) or look at the LEDs on the front panel (see “Front

Panel Features” on page 1-6).

Configuring Dynamic DNS

Dynamic DNS (DDNS) is an Internet service that allows routers with varying public IP addresses

to be located using Internet domain names. To use DDNS, you must setup an account with a

DDNS provider such as DynDNS.org, TZO.com, Oray.net, or 3322.org. Links to DynDNS, TZO,

Oray, and 3322 are provided for your convenience on the Dynamic DNS Configuration screen.

The VPN firewall firmware includes software that notifies dynamic DNS servers of changes in the

WAN IP address, so that the services running on this network can be accessed by others on the

Internet.

If your network has a permanently assigned IP address, you can register a domain name and have

that name linked with your IP address by public Domain Name Servers (DNS). However, if your

Internet account uses a dynamically assigned IP address, you will not know in advance what your

IP address will be, and the address can change frequently—hence, the need for a commercial

DDNS service, which allows you to register an extension to its domain, and restores DNS requests

for the resulting FQDN to your frequently-changing IP address.

After you have configured your account information in the firewall, whenever your ISP-assigned

IP address changes, your firewall will automatically contact your DDNS service provider, log in to

your account, and register your new IP address.

• For auto-rollover mode, you will need a fully qualified domain name (FQDN) to implement

features such as exposed hosts and virtual private networks regardless of whether you have a

fixed or dynamic IP address.

Note: Dynamic DNS enables you to employ some VPN configurations that require using

an FQDN instead of the WAN IP address.

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

Connecting to the Internet (WAN) 2-13

v1.0, January 2010

• For load balancing mode, you may still need a fully qualified domain name (FQDN) either for

convenience or if you have a dynamic IP address.

To configure dynamic DNS:

1. Select Network Configuration > Dynamic DNS from the main/submenu. The Dynamic DNS

screen is displayed.

2. Select the dynamic DNS service that you will use.

The fields corresponding to the selection you have chosen will be activated. Each DDNS

service provider requires its own parameters.

3. Access the website of one of the DDNS service providers and set up an account. Links to three

DDNS providers are in the tab header.

4. After registering for your account, return to the Dynamic DNS screen and enter the required

fields for the DDNS service you selected:

a. In the Host and Domain Name field, enter the entire FQDN name that your dynamic DNS

service provider gave you (for example: <yourname>.dyndns.org).

b. Enter the user name, user e-mail Address, or account name requested by the DDNS

Service to identify you when logging into your DDNS account.

c. Enter the password, or user key, for your DDNS account.

Note: If your ISP assigns a private WAN IP address such as 192.168.x.x or 10.x.x.x, the

dynamic DNS service will not work because private addresses will not be routed

on the Internet.

Figure 2-11

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

2-14 Connecting to the Internet (WAN)

v1.0, January 2010

d. If your dynamic DNS provider allows the use of wildcards in resolving your URL, check

Use wildcards to activate this feature.

For example, the wildcard feature will cause anything.yourhost.dyndns.org to be aliased

to the same IP address as yourhost.dyndns.org

e. If your dynamic DNS provider requires you to renew your account monthly, check

Update every 30 days to have the VPN firewall renew the account automatically.

5. Click Apply to save your configuration.

Configuring the Advanced WAN Options (Optional)

To configure the Advanced WAN options:

1. Select Network Configuration > WAN Settings from the main/submenu. The WAN ISP

Settings screen displays.

2. Click the Advanced link to the right of the tabs. The WAN Advanced Options screen is

displayed.

3. Edit the default information you want to change.

a. MTU Size. The normal MTU (Maximum Transmit Unit) value for most Ethernet

networks is 1500 Bytes, or 1492 Bytes for PPPoE connections. For some ISPs, you may

need to reduce the MTU. This is rarely required, and should not be done unless you are

sure it is necessary for your ISP connection.

Figure 2-12

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

Connecting to the Internet (WAN) 2-15

v1.0, January 2010

b. Port Speed. In most cases, your VPN firewall can automatically determine the connection

speed of the WAN port. If you cannot establish an Internet connection and the WAN Link

or Speed LED blinks continuously, you may need to manually select the port speed.

AutoSense is the default.

If you know the Ethernet port speed that your broadband modem supports, select it;

otherwise, select 10M. Use the half-duplex settings unless you are sure your broadband

modem supports full duplex.

c. Router’s MAC Address. Each computer or router on your network has a unique 32-bit

local Ethernet address. This is also referred to as the computer’s MAC (Media Access

Control) address. The default is Use Default Address. However, if your ISP requires

MAC authentication, then select either of these options:

• Select the Use this computer’s MAC radio button to enable the VPN firewall to use

the MAC address of the computer you are now using, or

• Select the Use this MAC Address radio button to manually type in the MAC address

that your ISP expects.

The format for the MAC address is 01:23:45:67:89:AB (numbers 0-9 and either uppercase

or lowercase letters A-F). If you select Use this MAC Address and then type in a MAC

address, your entry will be overwritten.

4. Click Apply to save your changes.

Additional WAN Related Configuration

• If you want the ability to manage the VPN firewall remotely, enable remote management at

this time (see “Enabling Remote Management Access” on page 9-9). If you enable remote

management, we strongly recommend that you change your password (see “Changing

Passwords and Administrator Settings” on page 9-8).

• At this point, you can set up the traffic meter for the WAN, if desired. See “Enabling the

Traffic Meter” on page 10-5.

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

2-16 Connecting to the Internet (WAN)

v1.0, January 2010

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

LAN Configuration 3-1

v1.0, January 2010

Chapter 3

LAN Configuration

This chapter describes how to configure the advanced LAN features of your ProSafe Wireless-N

VPN Firewall SRXN3205.

This chapter contains the following sections:

•“Using the VPN Firewall as a DHCP Server” on this page

•“Configuring the LAN Setup Options” on page 3-2”

•“Managing Groups and Hosts (LAN Groups)” on page 3-5

•“Configuring Multi Home LAN IP Addresses” on page 3-10

•“Configuring Static Routes” on page 3-11

•“Configuring Routing Information Protocol (RIP)” on page 3-13

Using the VPN Firewall as a DHCP Server

By default, the VPN firewall will function as a DHCP (Dynamic Host Configuration Protocol)

server, allowing it to assign IP, DNS server, WINS Server, and default gateway addresses to all

computers connected to the LAN. The assigned default gateway address is the LAN address of the

VPN firewall. IP addresses will be assigned to the attached PCs from a pool of addresses that you

must specify. Each pool address is tested before it is assigned to avoid duplicate addresses on the

LAN.

For most applications, the default DHCP and TCP/IP settings of the firewall are satisfactory. See

the link to “TCP/IP Networking Basics” in Appendix C, “Related Documents” for an explanation

of DHCP and information about how to assign IP addresses for your network.

If another device on your network will be the DHCP server, or if you will manually configure the

network settings of all of your computers, clear the Enable DHCP server radio box by selecting

the Disable DHCP Server radio box. Otherwise, leave it checked.

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

3-2 LAN Configuration

v1.0, January 2010

Specify the pool of IP addresses to be assigned by setting the starting IP address and ending IP

address. These addresses should be part of the same IP address subnet as the VPN firewall’s LAN

IP address. Using the default addressing scheme, you would define a range between 192.168.1.2

and 192.168.1.100, although you may wish to save part of the range for devices with fixed

addresses.

The VPN firewall will deliver the following settings to any LAN device that requests DHCP:

• An IP address from the range you have defined.

• Subnet mask.

• Gateway IP address (the VPN firewall’s LAN IP address).

• Primary DNS server (the VPN firewall’s LAN IP address).

• WINS server (if you entered a WINS server address in the DHCP section of the LAN Setup

screen).

• Lease time (date obtained and duration of lease).

DHCP Relay options allow you to make the VPN firewall a DHCP relay agent. The DHCP Relay

Agent makes it possible for DHCP broadcast messages to be sent over routers that do not support

forwarding of these types of messages. The DHCP Relay Agent is therefore the routing protocol

that enables DHCP clients to obtain IP addresses from a DHCP server on a remote subnet, or

which is not located on the local subnet. If you have no configured DHCP Relay Agent, your

clients would only be able to obtain IP addresses from the DHCP server which is on the same

subnet. To enable clients to obtain IP addresses from a DHCP server on a remote subnet, you have

to configure the DHCP Relay Agent on the subnet that contains the remote clients, so that it can

relay DHCP broadcast messages to your DHCP server.

When the DNS Proxy option is enabled, the VPN firewallwill act as a proxy for all DNS requests

and communicate with the ISP’s DNS servers (as configured in the WAN settings page). All

DHCP clients will receive the Primary/Secondary DNS IP along with the IP address where the

DNS proxy is running, that is, the VPN firewall’s LAN IP address. When disabled, all DHCP

clients will receive the DNS IP addresses of the ISP excluding the DNS proxy IP address.

Configuring the LAN Setup Options

The LAN Setup screen allows configuration of LAN IP services such as DHCP and allows you to

configure a secondary or “multi-home” LAN IP setup on the LAN. The default values are suitable

for most users and situations. These are advanced settings usually configured by a network

administrator.

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

LAN Configuration 3-3

v1.0, January 2010

To modify your LAN setup, follow these steps:

1. Select Network Configuration > LAN Settings from the main/submenu.

The LAN Settings tabs (LAN Setup, LAN Groups, and LAN Multi-homing) are displayed

with the LAN Setup screen in view..

2. In the LAN TCP/IP Setup section, configure the following settings:

•IP Address. The LAN address of your VPN firewall (factory default: 192.168.1.1).

Figure 3-1

Note: If you change the LAN IP address of the VPN firewall while connected

through the browser, you will be disconnected. You must then open a new

connection to the new IP address and log in again. For example, if you

change the default IP address 192.168.1.1 to 10.0.0.1, you must now enter

https://10.0.0.1 in your browser to reconnect to the Web Configuration

Manager.

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

3-4 LAN Configuration

v1.0, January 2010

•IP Subnet Mask. The subnet mask specifies the network number portion of an IP address.

Your VPN firewall will automatically calculate the subnet mask based on the IP address

that you assign. Unless you are implementing subnetting, use 255.255.255.0 as the subnet

mask.

3. In the DHCP section, select Disable DHCP Server, Enable DHCP Server, or DHCP Relay.

By default, the VPN firewall will function as a DHCP server, providing TCP/IP configuration

settings for all computers connected to the VPN firewall’s LAN. If another device on your

network will be the DHCP server, or if you will manually configure all devices, click Disable

DHCP Server. If the VPN firewall will function as a DHCP relay agent, select DHCP Relay

and enter the IP address of the DHCP relay gateway in the Relay Gateway field.

If the DHCP server is enabled, enter the following settings:

•Domain Name. (Optional) The DHCP will assign the entered domain to its DHCP clients.

•Starting IP Address. Specifies the first of the contiguous addresses in the IP address pool.

Any new DHCP client joining the LAN will be assigned an IP address between this

address and the Ending IP Address. The IP address 192.168.1.2 is the default start address.

•Ending IP Address. Specifies the last of the contiguous addresses in the IP address pool.

The IP address 192.168.1.100 is the default ending address.

•Primary DNS Server. (Optional) If an IP address is specified, the VPN firewall will

provide this address as the primary DNS server IP address. If no address is specified, the

VPN firewall will provide its own LAN IP address as the primary DNS server IP address.

•Secondary DNS Server. (Optional) If an IP address is specified, the VPN firewall will

provide this address as the secondary DNS server IP address.

•WINS Server. (Optional) Specifies the IP address of a local Windows NetBios Server if

one is present in your network.

•Lease Time. Specifies the duration for which a DHCP-provided IP address will be leased

to a client.

•Enable DNS Proxy. When DNS proxy is enabled (default), the DHCP server will provide

the VPN firewall LAN IP address as the DNS server for address name resolution. If this

box is unchecked, the DHCP server will provide the ISP’s DNS server IP addresses. The

VPN firewall will still service DNS requests sent to its LAN IP address unless you disable

DNS Proxy in the DHCP settings (see “Attack Checks” on page 5-14).

Note: The Starting and Ending DHCP addresses should be in the same subnet as

the LAN IP address of the VPN firewall (the IP Address configured in the

LAN TCP/IP Setup section).

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

LAN Configuration 3-5

v1.0, January 2010

If you will use a Lightweight Directory Access Protocol (LDAP) authentication server for

network-validated domain-based authentication, select Enable LDAP Information to enable

the DHCP server to provide LDAP server information.

Enter the following settings:

•LDAP Server. Specifies the name or the IP address of the device that hosts the LDAP

server.

•Search Base. Specifies the distinguished name (dn) at which to start the search, specified

as a sequence of relative distinguished names (rdn), connected with commas and without

any blank spaces. For most users, the search base is a variation of the domain name. For

example, if your domain is yourcompany.com, your search base dn might be as follows:

dc=yourcompany,dc=com.

•port. Specifies the port number that the LDAP server is using. Leave this field blank for

the default port.

4. In the Advanced Settings section, enter the following settings, which are optional:

•Enable DNS Proxy. If the DNS proxy is enabled (which is the default setting), the DHCP

server will provide the VPN firewall’s LAN IP address as the DNS server for address

name resolution. If this box is unchecked, the DHCP server will provide the ISP’s DNS

server IP addresses. The VPN firewall will still service DNS requests sent to its LAN IP

address unless you disable DNS Proxy in the firewall settings (see “Attack Checks” on

page 5-14).

•Enable ARP Broadcast. If ARP broadcast is enabled (which is the default setting), the

Address Resolution Protocol (ARP) is broadcasted on the LAN so that IP addresses can be

mapped to physical addresses (that is, MAC addresses).

5. Click Apply to save your settings.

Managing Groups and Hosts (LAN Groups)

The Known PCs and Devices table on the LAN Groups screen contains a list of all known PCs

and network devices that are assigned dynamic IP addresses by the VPN firewall, or have been

discovered by other means. Collectively, these entries make up the LAN Groups Database.

Note: Once you have completed the LAN setup, all outbound traffic is allowed and

all inbound traffic is discarded. To change these default traffic rules, refer to

Chapter 5, “Firewall Security and Content Filtering.”

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

3-6 LAN Configuration

v1.0, January 2010

The LAN Groups Database is updated by these methods:

•DHCP Client Requests. By default, the DHCP server in this VPN firewall is enabled, and

will accept and respond to DHCP client requests from PCs and other network devices. These

requests also generate an entry in the LAN Groups Database. Because of this, leaving the

DHCP server feature (LAN Setup screen) enabled is strongly recommended.

•Scanning the Network. The local network is scanned using ARP requests. The ARP scan will

detect active devices that are not DHCP clients. However, sometimes the name of the PC or

device cannot be accurately determined, and will appear in the database as unknown.

•Manual Entry. You can manually enter information about a network device.

Some advantages of the LAN Groups Database are:

• Generally, you do not need to enter IP addresses or MAC addresses. Instead, you can just

select the desired PC or device.

• No need to reserve an IP address for a PC in the DHCP server. All IP address assignments

made by the DHCP server will be maintained until the PC or device is removed from the

database, either by expiry (inactive for a long time) or by you.

• No need to use a fixed IP on PCs. Because the address allocated by the DHCP server will

never change, you don't need to assign a fixed IP to a PC to ensure it always has the same IP

address.

• MAC level control over PCs. The LAN Groups Database uses the MAC address to identify

each PC or device. So changing a PC’s IP address does not affect any restrictions on that PC.

• Group and individual control over PCs.

– You can assign PCs to Groups and apply restrictions to each Group using the Firewall

Rules screen (see “Using Rules & Services to Block or Allow Traffic” on page 5-2).

– You can also select the Groups to be covered by the Block Sites feature (see “Blocking

Internet Sites (Content Filtering)” on page 5-25).

– If necessary, you can also create Firewall Rules to apply to a single PC (see “Enabling

Source MAC Filtering (Address Filtering)” on page 5-28). Because the MAC address is

used to identify each PC, users cannot avoid these restrictions by changing the IP address.

• A computer is identified by its MAC address—not its IP address. Hence, changing a

computer’s IP address does not affect any restrictions applied to that PC.

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

LAN Configuration 3-7

v1.0, January 2010

Viewing the LAN Groups Database

To view the LAN Groups Database, follow these steps:

1. Select Network Configuration > LAN Settings from the main/submenu. The LAN Setup

screen displays (see Figure 3-1 on page 3-3).

2. Click the LAN Groups tab. The LAN Groups screen is displayed.

The Known PCs and Devices table lists the entries in the LAN Groups Database. For each

computer or device, the following fields are displayed:

•Name. The name of the PC or device. For computers that do not support the NetBIOS

protocol, this will be listed as “Unknown” (you can edit the entry manually to add a

meaningful name). If the computer was assigned an IP address by the DHCP server, then the

Name will be appended by an asterisk.

•IP Address. The current IP address of the computer. For DHCP clients of the VPN firewall,

this IP address will not change. If a computer is assigned a static IP addresses, you will need to

update this entry manually if the IP address on the computer has been changed.

•MAC Address. The MAC address of the PC’s network interface.

•Group. Each PC or device can be assigned to a single group. By default, a computer is

assigned to Group 1, unless a different group is chosen from the Group pull-down menu.

Figure 3-2

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

3-8 LAN Configuration

v1.0, January 2010

•Action. Allows modification of the selected entry by clicking edit.

Adding Devices to the LAN Groups Database

To add devices manually to the LAN Groups Database, follow these steps:

1. In the Add Known PCs and Devices section, make the following entries:

•Name. Enter the name of the PC or device.

•IP Address Type. From the pull-down menu, choose how this device receives its IP

address. The choices are:

–Fixed (Set on PC). The IP address is statically assigned on the computer.

–Reserved (DHCP Client). Directs the VPN firewall’s DHCP server to always assign

the specified IP address to this client during the DHCP negotiation.

•IP Address. Enter the IP address that this computer or device is assigned in the IP

Address field. If the IP Address Type is Reserved (DHCP Client), the VPN firewall will

reserve the IP address for the associated MAC address.

•MAC Address. Enter the MAC address of the computer’s network interface in the MAC

Address field. The MAC address format is six colon-separated pairs of hexadecimal

characters (0-9 and A-F), such as 01:23:45:67:89:AB.

•Group. From the pull-down menu, select the LAN Group to which the computer will be

assigned. (Group 1 is the default group.)

2. Click Add. The device will be added to the Known PCs and Devices table.

3. As an optional step: To enable DHCP address reservation for the entry that you just added to

the Known PCs and Devices table, select the checkbox for the table entry and click Save

Binding to bind the IP address to the MAC address for DHCP assignment.

Note: If the VPN firewall is rebooted, the table data is lost until the VPN firewall

rediscovers the devices.

Note: When assigning a Reserved IP address to a client, the IP address selected

must be outside the range of addresses allocated to the DHCP server pool.

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

LAN Configuration 3-9

v1.0, January 2010

Changing Group Names in the LAN Groups Database

By default, the LAN Groups are named Group1 through Group8. You can rename these group

names to be more descriptive, such as Engineering or Marketing.

To edit the names of any of the eight available groups:

1. From the LAN Groups tab, click the Edit Group Names link to the right of the tabs. The

Network Database Group Names screen appears.

2. Select the radio button next to any group name to make that name active for editing.

3. Type a new name in the field.

4. Click Apply to save your setting, each time you change a name in the field.

5. Select and edit other group names if desired.

6. Click Apply to save each field change.

Configuring DHCP Address Reservation

A computer (or device) will always receive the same IP address, if you specify a reserved IP

address for the computer (or device) on the LAN (based on the MAC address of the device), each

time it accesses the VPN firewall’s DHCP server. Reserved IP addresses should be assigned to

servers or access points that require permanent IP address settings. The reserved IP address that

you select must be outside of the DHCP Server pool.

To reserve an IP address, manually enter the device in the LAN Groups screen, specifying

Reserved (DHCP Client), as described in “Adding Devices to the LAN Groups Database” on

page 3-8.

Figure 3-3

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

3-10 LAN Configuration

v1.0, January 2010

Configuring Multi Home LAN IP Addresses

If you have computers on your LAN using different IP address ranges (for example, 172.16.2.0 or

10.0.0.0), you can add “aliases” to the LAN port, giving computers on those networks access to the

Internet through the VPN firewall. This allows the VPN firewall to act as a gateway to additional

logical subnets on your LAN. You can assign the VPN firewall an IP address on each additional

logical subnet.

To add a secondary LAN IP address, follow these steps:

1. Select Network Configuration > LAN Settings from the main/submenu.

2. Click the LAN Multi-homing tab and the LAN Multi-homing screen displays.

The Available Secondary LAN IPs table lists the secondary LAN IP addresses added to the

VPN firewall.

•IP Address. The “alias,” an additional IP address hosted by the LAN port of the VPN

firewall. This address will be the gateway for computers on the secondary subnet.

•Subnet Mask. The IPv4 subnet mask that defines the range of the secondary subnet.

Note: The reserved address will not be assigned until the next time the PC contacts the

VPN firewall’s DHCP server. Reboot the PC or access its IP configuration and

force a DHCP release and renew.

Figure 3-4

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

LAN Configuration 3-11

v1.0, January 2010

3. In the Add Secondary LAN IP Address section, enter the additional IP address and subnet

mask to be assigned to the LAN port of the VPN firewall.

4. Click Add. The new Secondary LAN IP address will appear in the Available Secondary LAN

IPs table.

Configuring Static Routes

Static Routes provide additional routing information to your VPN firewall. Under normal

circumstances, the VPN firewall has adequate routing information after it has been configured for

Internet access, and you do not need to configure additional static routes. You should configure

static routes only for unusual cases such as multiple firewalls or multiple IP subnets located on

your network.

To add or edit a static route:

1. Select Network Configuration > Routing from the main/submenu. The Routing screen is

displayed.

Note: IP addresses on these secondary subnets cannot be configured in the DHCP

server. The hosts on the secondary subnets must be manually configured with

IP addresses, gateway IP addresses, and DNS server IP addresses.

Tip: The secondary LAN IP address will be assigned to the LAN interface of the

VPN firewall and can be used as a gateway by computers on the secondary

subnet.

Figure 3-5

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

3-12 LAN Configuration

v1.0, January 2010

2. Click add. The Add Static Route screen is displayed.

3. Enter a route name for this static route in the Route Name field (for identification and

management).

4. Select Active to make this route effective.

5. Select Private if you want to limit access to the LAN only.

The static route will not be advertised in RIP.

6. Enter the Destination IP Address to the host or network where the route leads.

7. Enter the IP Subnet Mask for this destination.

If the destination is a single host, enter 255.255.255.255.

8. Enter the Interface which is the physical network interface (WAN or LAN) through which

this route is accessible.

9. Enter the Gateway IP Address through which the destination host or network can be reached.

This must be a firewall on the same LAN segment as the VPN firewall.

10. Enter the Metric priority for this route.

If multiple routes to the same destination exits, the route with the lowest metric is chosen

(value must be between 1 and 15).

11. Click Apply to save your settings.

The new static route will be added to the Static Route table.

You can edit the route’s settings by clicking edit in the Action column adjacent to the route.

Figure 3-6

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

LAN Configuration 3-13

v1.0, January 2010

Configuring Routing Information Protocol (RIP)

RIP (Routing Information Protocol, RFC 2453) is an Interior Gateway Protocol (IGP) that is

commonly used in internal networks (LANs). It allows a router to exchange its routing information

automatically with other routers, and allows it to dynamically adjust its routing tables and adapt to

changes in the network. RIP is disabled by default.

To configure RIP:

1. Select Network Configuration > Routing from the main/submenu.

2. Click the RIP Configuration link to the right of the Routing tab. The RIP Configuration

screen is displayed.

3. From the RIP Direction pull-down menu, choose the direction in which the VPN firewall will

send and receive RIP packets. The choices are:

•None. The VPN firewall neither broadcasts its route table nor does it accept any RIP

packets from other routers. This effectively disables RIP.

Figure 3-7

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

3-14 LAN Configuration

v1.0, January 2010

•In Only. The VPN firewall accepts RIP information from other routers, but does not

broadcast its routing table.

•Out Only. The VPN firewall broadcasts its routing table periodically but does not accept

RIP information from other routers.

•Both. The VPN firewall broadcasts its routing table and also processes RIP information

received from other routers.

4. From the RIP Version pull-down menu, choose the version from the following options:

•Disabled. The default section disables RIP versions.

•RIP-1. A class-based routing that does not include subnet information. This is the most

commonly supported version.

•RIP-2. This includes all the functionality of RIPv1 plus it supports subnet information.

Though the data is sent in RIP-2 format for both RIP-2B and RIP-2M, the modes in which

packets are sent are different.

–RIP-2B. Sends the routing data in RIP-2 format and uses subnet broadcasting.

–RIP-2M. Sends the routing data in RIP-2 format and uses multicasting.

5. Authentication for RIP2B/2M required? If you selected RIP-2B or RIP-2M, check the Yes

radio box to enable authentication, and enter the MD-5 keys to authenticate between devices in

the First Key Parameters and Second Key Parameters sections on the screen.

6. Click Apply to save your settings.

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

Wireless Configuration 4-1

v1.0, January 2010

Chapter 4

Wireless Configuration

This chapter describes how to set up your ProSafe Wireless-N VPN Firewall SRXN3205 for

wireless connectivity to your LAN. This basic configuration will enable computers with 802.11b/

g/n or 802.11a/n wireless adapters to do such things as connect to the Internet, or access printers

and files on your LAN.

You need to prepare these four things before you can establish a connection through your wireless

VPN firewall:

• The VPN firewall connected to your LAN through the WAN port to a device such as a hub,

switch, router, or Cable/DSL gateway.

• A correctly set up ProSafe Wireless-N VPN Firewall for wireless access.

• One or more computers with properly configured 802.11b/g/n or 802.11a/n wireless adapters.

• A location for the VPN firewall that conforms to the “Wireless Equipment Placement and

Range Guidelines.

Use the following topics to set up your SRXN3205 for use as a wireless VPN firewall:

•“Wireless Equipment Placement and Range Guidelines” on page 4-2

•“Understanding the VPN Firewall Wireless Security Options” on page 4-2

•“Configuring Basic Wireless Setup (Without Security)” on page 4-4

•“Testing and Completing Wireless Setup (Without Security)” on page 4-6

•“Wireless Security Types and Settings” on page 4-8

•“Configuring Advanced Wireless Settings” on page 4-17

•“Restricting Wireless Access by MAC Address” on page 4-18

Note: Indoors, computers can connect over 802.11b/g/n or 802.11a/g/n wireless networks

at ranges of several hundred feet or more. This distance can allow for others

outside your area to access your network. It is important to take appropriate steps

to secure your network from unauthorized access. The VPN firewall provides

highly effective security features which are covered in detail in “SSID and WEP/

WPA Settings Setup Form” on page 4-9. Deploy the security features appropriate

to your needs.

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

4-2 Wireless Configuration

v1.0, January 2010

Wireless Equipment Placement and Range Guidelines

The operating distance or range of your wireless connection can vary significantly based on the

physical placement of the VPN firewall. The latency, data throughput performance, and notebook

power consumption of wireless adapters also vary depending on your configuration choices.

For best results, place your VPN firewall:

• Near the center of the area in which your PCs will operate.

• In an elevated location such as a high shelf where the wirelessly connected PCs have line-of-

sight access (even if through walls).

• Away from sources of interference, such as PCs, microwaves, and 2.4 GHz cordless phones.

• Away from large metal surfaces.

Placing the antenna in a vertical position provides best side-to-side coverage. Placing the antenna

in a horizontal position provides best up-and-down coverage.

If you are using multiple access points for 11b/bg/ng, it is better if adjacent access points use

different radio frequency Channels to reduce interference. The recommended Channel spacing

between adjacent access points is 5 Channels (for example, use Channels 1 and 6, or 6 and 11). For

11a/na, the 6 Channel spacing is not needed.

The time it takes to establish a wireless connection can vary depending on both your security

settings and placement. Some types of security connections can take slightly longer to establish

and can consume more battery power on a notebook computer.

Understanding the VPN Firewall Wireless Security Options

Your wireless data transmissions can be received well beyond your walls by anyone with a

compatible adapter. For this reason, use the security features of your wireless equipment. The VPN

firewall provides highly effective security features which are covered in detail in this chapter.

Deploy the security features appropriate to your needs.

Note: Failure to follow these guidelines can result in significant performance degradation

or inability to wirelessly connect to the VPN firewall. For complete performance

specifications, see Appendix A, “Default Settings and Technical Specifications.”

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

Wireless Configuration 4-3

v1.0, January 2010

There are several ways you can enhance the security of your wireless network:

•Restrict Access Based on MAC address. You can restrict access to only trusted PCs so that

unknown PCs cannot wirelessly connect to the VPN firewall. MAC address filtering adds an

obstacle against unwanted access to your network, but the data broadcast over the wireless link

is fully exposed.

•Turn Off the Broadcast of the Wireless Network Name (SSID). If you disable broadcast of

the SSID, only devices that have the correct SSID can connect. This nullifies the wireless

network “discovery” feature of some products such as Windows XP, but the data is still fully

exposed to a determined snoop using specialized test equipment like wireless sniffers.

•Use WEP. Wired Equivalent Privacy (WEP) data encryption provides data security. WEP

open authentication and WEP data encryption will block all but the most determined

eavesdropper. This data encryption mode has been superseded by WPA-PSK and WPA2-PSK

•Use WPA, WPA-PSK, WPA2, or WPA2-PSK (with or without RADIUS). Wi-Fi Protected

Access (WPA) data encryption provides data security. The very strong authentication along

with dynamic per frame rekeying of WPA make it virtually impossible to compromise. WPA

functions with TKIP (Temporal Key Integrity Protocol ) or (Advanced Encryption Standard)

encryption, WPA2 functions with AES only, and WPA+WPA2 functions with a combination

of TKIP and AES encryption.

Figure 4-1

Note: WEP and TKIP support only legacy rates of operation. So, AES is the

recommended encryption for use with 11n rates and speed.

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

4-4 Wireless Configuration

v1.0, January 2010

Configuring Basic Wireless Setup (Without Security)

Test wireless connectivity in your environment by setting up the unit without wireless security. To

configure the VPN firewall for basic Wireless access, follow these simple steps:

1. Select Network Configuration > Wireless Settings from the main/submenu. The Wireless

Settings screen is displayed. Use this screen to set up your wireless connectivity requirements.

Figure 4-2

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

Wireless Configuration 4-5

v1.0, January 2010

2. In the Wireless Access Point section of the screen, configure the following settings:

•Enable Wireless Access Point. Select this checkbox to allow multiple devices in the

wireless network to access the WAN network and other LAN devices through the wireless

VPN firewall. This checkbox is deselected by default.

•Allow Broadcast of Name (SSID). If you want your SSID (network name) to be

broadcasted, leave this checkbox selected, which is the default setting. If you deselect this

checkbox, only devices that have the correct SSID can connect. This nullifies the wireless

network “discovery” feature of some products such as Windows XP, but the data is still

fully exposed to a determined snoop using specialized test equipment like wireless

sniffers.

•Enable 802.11d Country Code. Select this checkbox to enable the VPN firewall to

comply with the IEEE 802.11d standard (also referred to as global harmonization) in order

to satisfy regulatory wireless requirements in your country. This checkbox is deselected by

default.

3. In the Wireless Network section of the screen, configure the following settings:

•Name (SSID). Enter your network name.

•Region. From the pull-down menu, select the region where the VPN firewall will be used

(the default Region is North America).

•Mode. Select a wireless mode from the pulldown menu or accept the default (11ng)

setting. The 802.11 selections are: a only, b only, g only, g and b, 11ng, or 11na. Select an

“only” option if all devices in the wireless network can support. Select ng mode if there

are clients in the network that support 802.11n; this mode also supports legacy 802.11b

and 802.11g clients. To support 802.11a and 802.11n clients concurrently, select na mode;

this mode will not support 802.11b or 802.11g clients.

• Leave all channel settings at the defaults.

4. In the other sections of the screen, leave all other settings at the defaults, including None as the

Wireless Security Type.

5. Click Apply at the bottom of the Wireless Settings screen.

If the settings were accepted, a message appears in the center of the screen: Operation

succeeded.

Note: If your country or region is not listed, contact NETGEAR Support.

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

4-6 Wireless Configuration

v1.0, January 2010

6. Prepare a PC as the wireless PC Client with a wireless Ethernet adapter installed. Verify that

you can wirelessly access a file or a printer on the LAN connected to the VPN firewall.

Testing and Completing Wireless Setup (Without Security)

The purpose of setting your wireless settings in stages, without the security settings, is to eliminate

any possible errors in setting up your wireless settings before adding the more complicated

security settings. This method will greatly aid you in discovering where the errors in your security

settings are by removing doubts about your wireless settings.

Testing Wireless Connectivity (Without Security)

Follow the instructions below to test wireless connectivity. Once you have established wireless

connectivity, you can enable security settings appropriate to your needs.

1. Select Network Configuration > Wireless Settings from main/submenu.

2. In the Wireless Network section of the screen, ensure that Auto is selected from the Channel

pull-down menu. (Auto is the default setting.)

The Auto setting selects a channel that has the least interference. It should not be necessary to

change the wireless channel unless you notice interference problems or are near another

wireless access point. Select a channel that is not being used by any other wireless networks

within several hundred feet of your VPN firewall.

3. From the Wireless Network section of the screen, record the name used for SSID.

4. In the Wireless Access Point section of the screen, deselect the Allow Broadcast of Name

(SSID) checkbox.

5. Click Apply to save any changes.

Note: The SSID of a client computer must match what you configured in the VPN

firewall. If these do not match, you will not get a wireless connection to the

VPN firewall.

Note: If you are configuring the VPN firewall from a wireless computer, you will

lose your wireless connection when you click Apply to update settings. You

will then need to update the wireless settings of your computer accordingly.

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

Wireless Configuration 4-7

v1.0, January 2010

6. Prepare PC(s) as the wireless PC Client(s) with wireless Ethernet adapters installed.

7. Configure the Client PCs to obtain the IP and DNS addresses automatically using the internal

DHCP server (DHCP is the default firewall setting).

8. Configure the wireless adapters of your Client PCs to have the same SSID that you configured

on the VPN firewall.

9. Using this Client PCs, verify these PCs have a wireless link by trying to access a file or a

printer on the LAN connected to the VPN firewall.

10. Once you have verified wireless connectivity to the VPN firewall, you can configure the

wireless channel and security functions. See the “Configuring the Wireless Channel Settings

(Without Security)” on this page and the “Wireless Security Types and Settings” on page 4-8.

Configuring the Wireless Channel Settings (Without Security)

To configure the wireless channel settings of your VPN firewall:

1. Select Network Configuration > Wireless Settings from the main/submenu. The Wireless

Settings screen is displayed (see Figure 4-1 on page 4-3).

2. In the Wireless Network section of the screen, configure the following settings:

•Channel. The default setting is Auto. Use the default setting or select a channel and

frequency from the pull-down menu to use on your wireless LAN.

The Auto option intelligently picks a channel and frequency with least interference. The

wireless channel in use are between 1 to 11 for the US and Canada, and 1 to 13 for Europe

and Australia.

It is not necessary to change the wireless channel unless you experience interference

(shown by lost connections, slow data transfers, or both). If this happens, you may need to

experiment with different channels to see which is the best. See the article on “Wireless

Channels” available on the NETGEAR website. A link to this article and other articles of

interest can be found in Appendix C, “Related Documents.”

•Channel Spacing. For 11ng and 11na modes only, from the pull-down menu, select the

desired channel spacing:

–20 MHz . The static, legacy mode, which provides the least throughput. This is the

default setting.

Note: The Current Channel No shows the currently configured channel.

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

4-8 Wireless Configuration

v1.0, January 2010

–20/40 MHz. The dynamic, compatibility mode. Legacy clients can connect to 20 MHz

and 11n clients can connect to 40 MHz.

–40 MHz. The static, high-throughput mode. Legacy clients will not be able to connect

in this mode.

3. Click Apply to save your wireless settings.

Wireless Security Types and Settings

Configure the Wireless Security type based on the level of security that you need using one of the

following methods and print out the form provided to aid you in making your selection:

• Print out the “SSID and WEP/WPA Settings Setup Form” on page 4-9.

• To configure WEP encryption for open systems or shared key systems, see “Configuring

WEP Security” on page 4-11.

• To configure WPA-PSK, see “Configuring WPA-PSK” on page 4-12.

• To configure WPA2-PSK, see “Configuring WPA2-PSK” on page 4-12.

• To configure WPA-PSK and WPA2-PSK, see “Configuring WPA-PSK and WPA2-PSK”

on page 4-13.

• To configure WPA with RADIUS, see “Configuring WPA with RADIUS” on page 4-14.

• To configure WPA2 with RADIUS, see “Configuring WPA2 with RADIUS” on

page 4-14.

• To configure WPA and WPA2 with RADIUS, see “Configuring WPA and WPA2 with

RADIUS” on page 4-15.

Use the Wireless Security Type section on the Wireless Settings screen (see Figure 4-1 on page

4-3) to select the desired wireless security method. Other security settings are discussed in the

following chapters and sections:

•Go to “Firewall Security and Content Filtering” in Chapter 5 for firewall security settings.

•Go to “Virtual Private Networking Using IPsec” in Chapter 6 for VPN IPsec tunnel settings.

•Go to “Virtual Private Networking Using SSL” in Chapter 7 for VPN SSL tunnel settings.

•Go to “Managing Users, Authentication, and Certificates” in Chapter 8 for users settings.

•Go to “VPN Firewall and Network Management” in Chapter 9 for the administration settings.

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

Wireless Configuration 4-9

v1.0, January 2010

SSID and WEP/WPA Settings Setup Form

802.11b/g/n Configuration

For a new wireless network, print or copy this form and fill in the configuration parameters. For an

existing wireless network, the person who set it up or is responsible for the network will be able to

provide this information. Be sure to set the Regulatory Domain correctly as the first step.

•SSID: The Service Set Identification (SSID) requires the identity or name of the wireless local

area network. NETGEAR is the default VPN firewall SSID. However, you may customize it

by using up to 32 alphanumeric characters. Write your customized SSID on the line below.

___________________________________

Note: The SSID in the VPN firewall is the SSID you configure in the wireless adapter card.

All wireless nodes in the same network must be configured with the same SSID:

• Authentication:

Circle one: Automatic, Open System, or Shared Key. (Choose Shared Key for more security.)

Note: If you select shared key, the other devices in the network will not connect unless they

are set to Shared Key as well and have the same keys in the same positions as those in the VPN

firewall.

• WEP Encryption Keys.

Circle one: 64, 128, or 152 bits. (Enter all four 802.11a/n keys for the Key Size chosen.)

Key 1: ___________________________________

Key 2: ___________________________________

Key 3: ___________________________________

Key 4: ___________________________________

• WPA-PSK (Preshared Key)

Record the WPA-PSK key. Key: ___________________________________

• WPA RADIUS Settings. For WPA, record the following settings for the primary and

secondary RADIUS servers:

Server Name/IP Address: Primary _________________ (Secondary __________________ ?)

RADIUS Port: ___________________________________

Shared Key: ___________________________________

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

4-10 Wireless Configuration

v1.0, January 2010

802.11a/n Configuration

For a new wireless network, print or copy this form and fill in the configuration parameters. For an

existing wireless network, the person who set up or is responsible for the network will be able to

provide this information. Be sure to set the Regulatory Domain correctly as the first step.

•SSID: The Service Set Identification (SSID) requires the identity or name of the wireless local

area network. NETGEAR is the default VPN firewall SSID. However, you may customize it

by using up to 32 alphanumeric characters. Write your customized SSID on the line below.

___________________________________

Note: The SSID in the VPN firewall is the SSID you configure in the wireless adapter card.

All wireless nodes in the same network must be configured with the same SSID:

• Authentication

Circle one: Automatic, Open System, or Shared Key. Choose Shared Key for more security.

Note: If you select shared key, the other devices in the network will not connect unless they

are set to Shared Key as well and have the same keys in the same positions as those in the VPN

firewall.

• WEP Encryption Keys

Circle one: 64, 128, or 152 bits. (Enter all four 802.11b/g/n keys for the Key Size chosen.)

Key 1: ___________________________________

Key 2: ___________________________________

Key 3: ___________________________________

Key 4: ___________________________________

• WPA-PSK (Preshared Key)

Record the WPA-PSK key. Key: ___________________________________

• WPA RADIUS Settings. For WPA, record the following settings for the primary and

secondary RADIUS servers:

Server Name/IP Address: Primary _________________ (Secondary __________________ ?)

RADIUS Port: ___________________________________

Shared Key: ___________________________________

Use the procedures described in the following sections to configure the VPN firewall. Store this

information in a safe place.

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

Wireless Configuration 4-11

v1.0, January 2010

Configuring WEP Security

To configure WEP data encryption on the Wireless Settings screen:

1. Click the WEP radio button in the Wireless Security Type section of the screen to enable

WEP data encryption.

When you select WEP data encryption, the WEP fields in the WEP section of the screen are

made active:

2. From the Authentication pull-down menu, select Automatic, Open System, or Shared Key

authentication.

3. From the Encryption pull-down menu, select the encryption strength: 64 bit WEP,

128 bit WEP, or 152 bit WEP.

4. Enter a word or group in any combination of 0-9, a-f, and A-F characters in the WEP

Passphrase field to automatically program the four data encryption keys. These values must

be identical on all PCs and VPN firewalls in your network.

a. Select which of the four keys will be the default by clicking on the radio button next to the

WEP Key. Data transmissions are always encrypted using the default key.

b. When done, click the generate key button. The four key boxes will be automatically

populated with key values.

You can also program the four keys manually:

a. In each of the WEP Key fields, enter the number of hexadecimal characters appropriate to

the encryption strength for the key: The number of characters should be 10 for 64-bit, 26

for 128-bit, and 32 for 152-bit, in any combination of 0-9, a-f, and A-F characters.

b. Select which of the four keys will be the default by clicking on the radio button next to the

WEP Key. Data transmissions are always encrypted using the default key.

5. Click Apply to save your settings.

Note: Your wireless connection will drop when you click Apply. Reconfigure your

wireless adapter to match the new settings or access the VPN firewall from a

wired computer to make any further changes.

Note: For more information about WEP, see the “Wireless Networking Basics”

document that you can access from the link that is provided in Appendix C,

“Related Documents.”

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

4-12 Wireless Configuration

v1.0, January 2010

Configuring WPA Security Without RADIUS

Not all wireless adapters support WPA and WPA2. Client software is required on the client:

• Windows XP and Windows 2000 with Service Pack 3 or above do include the client software

that supports WPA. The wireless adapter hardware and driver must also support WPA.

• Service Pack 3 does not include the client software that supports WPA2. Make sure your client

card supports WPA2. The wireless adapter hardware and driver must also support WPA2.

Consult the product documentation for your wireless adapter; WPA client software for instructions

on configuring WPA settings; WPA2 client software for instructions on configuring WPA2

settings.

Configuring WPA-PSK

To configure WPA-PSK on the Wireless Settings screen:

1. In the Wireless Security Type section of the screen, configure the following:

a. Click the WPA radio button to enable WPA data encryption. The WPA fields in the PSK

Settings section of the screen are made active.

b. From the WPA with pull-down menu, select PSK.

c. For Encryption, select the TKIP radio button.

2. In the PSK Settings section of the screen, configure the following:

a. In the Passphrase field, enter a phrase consisting of 8-63 characters.

b. In the the Key Lifetime field, enter a value in minutes. This setting determines how often

the encryption key is changed; shorter periods are more secure but may slow down the

overall authentication times. The default setting is 1440 minutes (24 hours).

3. Click Apply to save your settings.

Configuring WPA2-PSK

To configure WPA2-PSK on the Wireless Settings screen:

1. In the Wireless Security Type section of the screen, configure the following:

a. Click the WPA2 radio button to enable WPA data encryption. The WPA fields in the PSK

Settings section of the screen are made active.

b. From the WPA with pull-down menu, select PSK.

For Encryption, the AES radio button is preselected.

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

Wireless Configuration 4-13

v1.0, January 2010

2. In the PSK Settings section of the screen, configure the following:

a. In the Passphrase field, enter a phrase consisting of 8-63 characters.

b. In the the Key Lifetime field, enter a value in minutes. This setting determines how often

the encryption key is changed; shorter periods are more secure but may slow down the

overall authentication times. The default setting is 1440 minutes (24 hours).

3. Click Apply to save your settings.

Configuring WPA-PSK and WPA2-PSK

To configure WPA-PSK and WPA2-PSK on the Wireless Settings screen, configure the following:

1. In the Wireless Security Type section of the screen, configure the following:

a. Click the WPA and WPA2 radio button to enable WPA data encryption. The WPA fields

in the PSK Settings section of the screen are made active.

b. From the WPA with pull-down menu, select PSK.

For Encryption, the TKIP + AES radio button is preselected.

2. In the PSK Settings section of the screen, configure the following:

a. In the Passphrase field, enter a phrase consisting of 8-63 characters.

b. In the the Key Lifetime field, enter a value in minutes. This setting determines how often

the encryption key is changed; shorter periods are more secure but may slow down the

overall authentication times. The default setting is 1440 minutes (24 hours).

3. Click Apply to save your settings.

Configuring WPA Security with RADIUS

Not all wireless adapters support WPA and WPA2. Client software is required on the client:

• Windows XP and Windows 2000 with Service Pack 3 or above do include the client software

that supports WPA. The wireless adapter hardware and driver must also support WPA.

• Service Pack 3 does not include the client software that supports WPA2. Make sure your client

card supports WPA2. The wireless adapter hardware and driver must also support WPA2.

Consult the product documentation for your wireless adapter; WPA client software for instructions

on configuring WPA settings; WPA2 client software for instructions on configuring WPA2

settings.

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

4-14 Wireless Configuration

v1.0, January 2010

Configuring WPA with RADIUS

To configure WPA with RADIUS on the Wireless Settings screen:

1. In the Wireless Security Type section of the screen, configure the following:

a. Click the WPA radio button to enable WPA data encryption. The WPA fields in the PSK

Settings section of the screen are made active.

b. From the WPA with pull-down menu, select RADIUS. The RADIUS fields in the Radius

Server Settings section of the screen are made active.

For Encryption, the TKIP radio button is preselected.

2. In the PSK Settings section of the screen, configure the following:

a. In the Passphrase field, enter a phrase consisting of 8-63 characters.

b. In the the Key Lifetime field, enter a value in minutes. This setting determines how often

the encryption key is changed; shorter periods are more secure but may slow down the

overall authentication times. The default setting is 1440 minutes (24 hours).

1. In the Radius Server Settings section of the screen, configure the following:

a. Server Name / IP Address. The name or IP address of the RADIUS server.

b. Radius Port. The port number of the RADIUS Server. The default is 0.

c. Shared Key. This is they phrase that is shared between the VPN firewall and the RADIUS

server while authenticating the supplicant (wireless client).

2. Click Apply to save your settings.

Configuring WPA2 with RADIUS

To configure WPA2 with RADIUS on the Wireless Settings screen:

1. In the Wireless Security Type section of the screen, configure the following:

a. Click the WPA2 radio button to enable WPA data encryption. The WPA fields in the PSK

Settings section of the screen are made active.

b. From the WPA with pull-down menu, select RADIUS. The RADIUS fields in the Radius

Server Settings section of the screen are made active.

For Encryption, the AES radio button is preselected.

2. In the PSK Settings section of the screen, configure the following:

a. In the Passphrase field, enter a phrase consisting of 8-63 characters.

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual

Wireless Configuration 4-15