Chapter 2 Introduction
This chapter describes the features of the NETGEAR FVX538 ProSafe VPN Firewall 200.
Key Features of the VPN Firewall
The FVX538 ProSafe VPN Firewall 200 with 8+1 port switch connects your local area network (LAN) to the Internet through an external access device such as a cable modem or DSL modem. The FVX538 is a complete security solution that protects your network from attacks and intrusions. Unlike simple Internet sharing firewalls that rely on Network Address Translation for security, the FVX538 uses Stateful Packet Inspection for Denial of Service (DoS) attack protection and intrusion detection. The FVX538 VPN firewall provides you with multiple Web content filtering options, plus browsing activity reporting and instant alerts -- both via e-mail. Network administrators can establish restricted access policies based on time-of-day, Website addresses and address keywords. With minimum setup, you can install and use the firewall within minutes. The FVX538 VPN firewall provides the following features: 2 10/100 Mbps ports for an Ethernet connection to a WAN device, such as a cable modem or DSL modem. Dual WAN ports provide for increased system reliability and provide load balancing and link aggregation. Support for up to 200 VPN tunnels. Easy, web-based setup for installation and management. URL keyword Content Filtering and Site Blocking Security. Quality of Service (QoS) support for traffic prioritization. Built in 8-port 10/100 Mbps switch plus 1 Gigabit Switch port. One console port for local management. Extensive Protocol Support. Login capability.

2-1 January 2005

Introduction
Reference Manual for the ProSafe VPN Firewall 200 FVX538
Front panel LEDs for easy monitoring of status and activity. Flash memory for firmware upgrade. 1 U Rack mountable.
Dual WAN Ports for Increased Reliability or Outbound Load Balancing
The FVX538 VPN firewall has two broadband WAN ports, WAN1 and WAN2, each capable of operating independently at speeds of either 10 Mbps or 100 Mbps. The two WAN ports let you connect a second broadband Internet line that can be configured on a mutually-exclusive basis to: Provide backup and rollover if one line is inoperable, ensuring you are never disconnected. Load balance, or use both Internet lines simultaneously for the outgoing traffic. The firewall balances users between the two lines for maximum bandwidth efficiency.
See Network Planning on page 3-1 for the planning factors to consider when implementing the following capabilities with dual WAN port gateways: Single or multiple exposed hosts Virtual private networks
A Powerful, True Firewall with Content Filtering
Unlike simple Internet sharing NAT routers, the FVX538 is a true firewall, using stateful packet inspection to defend against hacker attacks. Its firewall features include: DoS protection. Automatically detects and thwarts DoS attacks such as Ping of Death, SYN Flood, LAND Attack, and IP Spoofing. Blocks unwanted traffic from the Internet to your LAN. Blocks access from your LAN to Internet locations or services that you specify as off-limits. Logs security incidents. The FVX538 will log security events such as blocked incoming traffic, port scans, attacks, and administrator logins. You can configure the firewall to email the log to you at specified intervals. You can also configure the firewall to send immediate alert messages to your email address or email pager whenever a significant event occurs.

2-2 January 2005

With its URL keyword filtering feature, the FVX538 prevents objectionable content from reaching your PCs. The firewall allows you to control access to Internet content by screening for keywords within Web addresses. You can configure the firewall to log and report attempts to access objectionable Internet sites.

Security

The FVX538 VPN firewall is equipped with several features designed to maintain security, as described in this section. PCs Hidden by NAT NAT opens a temporary path to the Internet for requests originating from the local network. Requests originating from outside the LAN are discarded, preventing users outside the LAN from finding and directly accessing the PCs on the LAN. Port Forwarding with NAT Although NAT prevents Internet locations from directly accessing the PCs on the LAN, the firewall allows you to direct incoming traffic to specific PCs based on the service port number of the incoming request. You can specify forwarding of single ports or ranges of ports. DMZ port Incoming traffic from the Internet is normally discarded by the firewall unless the traffic is a response to one of your local computers or a service for which you have configured an inbound rule. Instead of discarding this traffic, you can have it forwarded to one computer on your network.

Autosensing Ethernet Connections with Auto Uplink
With its internal 8-port 10/100 switch, the FVX538 can connect to either a 10 Mbps standard Ethernet network or a 100 Mbps Fast Ethernet network. Both the LAN and WAN interfaces are autosensing and capable of full-duplex or half-duplex operation. The firewall incorporates Auto UplinkTM technology. Each Ethernet port will automatically sense whether the Ethernet cable plugged into the port should have a normal connection such as to a PC or an uplink connection such as to a switch or hub. That port will then configure itself to the correct configuration. This feature also eliminates the need to worry about crossover cables, as Auto Uplink will accommodate either type of cable to make the right connection.
Introduction January 2005
Extensive Protocol Support
The FVX538 VPN firewall supports the Transmission Control Protocol/Internet Protocol (TCP/IP) and Routing Information Protocol (RIP). For further information about TCP/IP, refer to Appendix B, Network, Routing, Firewall, and Basics. IP Address Sharing by NAT The FVX538 VPN firewall allows several networked PCs to share an Internet account using only a single IP address, which may be statically or dynamically assigned by your Internet service provider (ISP). This technique, known as NAT, allows the use of an inexpensive single-user ISP account. Automatic Configuration of Attached PCs by DHCP The FVX538 VPN firewall dynamically assigns network configuration information, including IP, gateway, and domain name server (DNS) addresses, to attached PCs on the LAN using the Dynamic Host Configuration Protocol (DHCP). This feature greatly simplifies configuration of PCs on your local network. DNS Proxy When DHCP is enabled and no DNS addresses are specified, the firewall provides its own address as a DNS server to the attached PCs. The firewall obtains actual DNS addresses from the ISP during connection setup and forwards DNS requests from the LAN. PPP over Ethernet (PPPoE) PPPoE is a protocol for connecting remote hosts to the Internet over a DSL connection by simulating a dial-up connection. This feature eliminates the need to run a login program such as EnterNet or WinPOET on your PC.
Easy Installation and Management
You can install, configure, and operate the FVX538 ProSafe VPN Firewall 200 within minutes after connecting it to the network. The following features simplify installation and management tasks: Browser-based management Browser-based configuration allows you to easily configure your firewall from almost any type of personal computer, such as Windows, Macintosh, or Linux. A user-friendly Setup Wizard is provided and online help documentation is built into the browser-based Web Management Interface. Smart Wizard The FVX538 VPN firewall automatically senses the type of Internet connection, asking you only for the information required for your type of ISP account.

VPN Wizard The FVX538 VPN firewall includes the NETGEAR VPN Wizard to easily configure VPN tunnels according to the recommendations of the Virtual Private Network Consortium (VPNC) to ensure the VPN tunnels are interoperable with other VPNC-compliant VPN routers and clients. SNMP The FVX538 VPN firewall supports the Simple Network Management Protocol (SNMP) to let you monitor and manage log resources from an SNMP-compliant system manager. The SNMP system configuration lets you change the system variables for MIB2. Diagnostic functions The firewall incorporates built-in diagnostic functions such as Ping, Trace Route, DNS lookup, and remote reboot. Remote management The firewall allows you to login to the Web Management Interface from a remote location on the Internet. For security, you can limit remote management access to a specified remote IP address or range of addresses, and you can choose a nonstandard port number. Visual monitoring The FVX538 VPN firewalls front panel LEDs provide an easy way to monitor its status and activity.

Maintenance and Support

NETGEAR offers the following features to help you maximize your use of the FVX538 VPN firewall: Flash memory for firmware upgrade Free technical support seven days a week, twenty-four hours a day

Package Contents

The product package should contain the following items: FVX538 ProSafe VPN Firewall 200. AC power cable. 19-inch rack mounting hardware and rubber feet. Category 5 (Cat 5) Ethernet cable.

2-5 January 2005

Resource CD for ProSafe VPN Firewall, including: This guide. Application Notes and other helpful information. ProSafe VPN Client Software - five user license.
Warranty and Support Information Card.
If any of the parts are incorrect, missing, or damaged, contact your NETGEAR dealer. Keep the carton, including the original packing materials, in case you need to return the firewall for repair.

The Routers Front Panel

The FVX538 ProSafe VPN Firewall 200 front panel shown below contains the port connections, status LEDs, and the factory defaults reset button.

ProSafe VPN Firewall

Link/Act Power 100 Link/Act 100 Link/Act Link/Act 100

FVX538

Gigabit Speed
Test Active WAN1 WAN2 Active LAN
DMZ CONSOLE Factory Defaults

Power LED

Test LED WAN1 Port and LEDs WAN2 Port and LEDs
Gigabit Port Factory LAN Ports and LEDs Defaults and LEDs Console Button DMZ Port Port and LEDs
Figure 2-1: FVX538 Front Panel
You can use the LEDs to verify various conditions. Table 2-1 lists and describes each object on the front panel of the firewall and its operation.

Table 2-1.

Object Power LED Test LED

Object Descriptions

Activity On (Green) Off On (Amber) Blinking (Amber) Off Description Power is supplied to the firewall. Power is not supplied to the firewall. Test mode: The system is initializing or the initialization has failed. Writing to Flash memory (during upgrading or resetting to defaults). The system has booted successfully.

2-6 January 2005

Reference Manual for the ProSafe VPN Firewall 200 FVX538 Table 2-1.
Object WAN Ports and LEDs
Object Descriptions (continued)

Activity Description

Two RJ-45 WAN ports N-way automatic speed negotiation, Auto MDI/MDIX. Link/Act LED On (Green) Blinking (Green) Off 100 LED On (Green) Off Active LED On (Green) On (Amber) Off The WAN port has detected a link with a connected Ethernet device. Data is being transmitted or received by the WAN port. The WAN port has no link. The WAN port is operating at 100 Mbps. The WAN port is operating at 10 Mbps. The WAN port has a valid Internet connection. The Internet connection is down or not being used. The WAN port is either not enabled or has no link. N-way automatic speed negotiation, auto MDI/MDIX.

LAN Ports and LEDs

8-port RJ-45 10/100 Mbps Fast Ethernet Switch Link/Act LED On (Green) Blinking (Green) Off 100 LED On (Green) Off DMZ (port 8) On (Green) Off
The LAN port has detected a link with a connected Ethernet device. Data is being transmitted or received by the LAN port. The LAN port has no link. The LAN port is operating at 100 Mbps. The LAN port is operating at 10 Mbps. Port 8 is operating as a dedicated hardware DMZ port. Port 8 is operating as a normal LAN port. Port for connecting to a gigabit Ethernet device. The LAN port has detected a link with a connected Ethernet device. Data is being transmitted or received by the LAN port. The LAN port has no link. The LAN port is operating at 1,000 Mbps. The LAN port is operating at 100 Mbps. The LAN port is operating at 10 Mbps. Port for connecting to an optional console terminal. Default baud rate is 115.2K; pinouts: (2) Tx, (3) Rx, (5) and (7) Gnd. Factory Defaults reset push button (see Default Factory Settings on page 2-10 for the factory defaults).

Gigabit Port and LEDs

Gbit RJ-45 connector Link/Act LED On (Green) Blinking (Green) Off Speed LED On (Green) On (Amber) Off
Console Port Factory Defaults

DB9 male connector

The Routers Rear Panel
The rear panel of the FVX538 ProSafe VPN Firewall 200 (Figure 2-2) contains the On/Off switch and AC power connection.
100-240 VAC, 50-60Hz, 0.7A max.

AC Power Connection

On/Off Switch
Figure 2-2: FVX538 Rear Panel
Viewed from left to right, the rear panel contains the following elements: AC power in On/Off switch

Rack Mounting the Router

The FVX538 can be mounted either on a desktop (using included rubber feet) or in a 19-inch rack (using the included rack mounting hardware illustrated in Figure 2-3).
Figure 2-3: Attaching Mounting Brackets

2-8 January 2005

The Routers IP Address, Login Name, and Password
Check the label on the bottom of the FVX538s enclosure if you forget the following factory default information: IP Address: http://192.168.1.1 to reach the Web-based GUI from the LAN User name: admin Password: password
ProSafe VPN Firewall FVX538

DEFAULT ACCESS

LAN IP Address User Name Password

N10947

E-E011-02-4749 (B)
http://192.168.1.1 user name: admin password: password
MAC (internet) MAC (local)

MAC (internet) SERIAL

272-10134-01
Figure 2-4: FVX538 Bottom Label

Logging into the Router

To log into the FVX538 once it is connected,

1. 2. 3.

Open a Web browser. Enter http://192.168.1.1 as the URL. Once you get the login screen (Figure 2-5), enter the following information: admin for User Name password for Password
Figure 2-5: Login screen on the Web browser

Default Factory Settings

When you first receive your FVX538, the default factory settings will be set as shown in Table 2-1 below. You can restore these defaults with the Factory Defaults restore switch on the front panel see The Routers Front Panel on page 2-6. Pressing this switch until the TEST LED blinks (approximately 10 seconds) causes the firewall to restore all factory default settings and reboot. A shorter press and release causes the firewall to merely reboot.

Factory Default Settings

Feature User Name (case sensitive) Password (case sensitive) Built-in DHCP server IP Configuration Default admin password DHCP server is enabled, issues addresses in the default subnet IP Address: 192.168.1.1 Subnet Mask: 255.255.255.0 Gateway: 0.0.0.0 GMT Enabled Disabled

Time Zone Time Zone Adjust for Daylight Saving TIme SNMP

2-10 January 2005

NETGEAR Related Products
NETGEAR products related to the FVX538 ProSafe VPN Firewall 200 are as follows: FA311 10/100 PCI Adapter FA511 10/100 32-bit CardBus Adapter GA311 10/100/1000 PCI Adapter FVL328 ProSafe VPN Firewall FVS318 ProSafe VPN Firewall 8 FVS338 ProSafe VPN Firewall 50 FWG114P ProSafe 802.11g Wireless Firewall with USB Print Server NMS100 ProSafe Network Management System VPN01L and VPN05L ProSafe VPN Client Software WG302 ProSafe 802.11g Access Point

2-12 January 2005

Chapter 4 Connecting the FVX538 to the Internet
This chapter describes how to connect the WAN ports of the FVX538 VPN firewall to the Internet.
What You Will Need to Do Before You Begin
The FVX538 ProSafe VPN Firewall 200 is a powerful and versatile solution for your networking needs. But to make the configuration process easier and to understand all of the choices available to you, you need to think through the following items before you begin:

Plan your network

Determine whether you are going to use one or both WAN ports. For one WAN port, you may need a fully qualified domain name either for convenience or if you have a dynamic IP address. If you are going to use both WAN ports, determine whether you are going to use them in rollover mode for increased system reliability or load balancing mode for maximum bandwidth efficiency. See Chapter 3, Network Planning for more information. Your decision has the following implications: Fully qualified domain name For rollover mode, you are going to need a fully qualified domain name to implement features such as exposed hosts and virtual private networks. For load balancing mode, you may still need a fully qualified domain name either for convenience or if you have a dynamic IP address.
Protocol binding For rollover mode, protocol binding does not apply. For load balancing mode, you need to decide which protocols you want to bind to a specific WAN port if you are going to take advantage of this option (you will make these selections in Step 4: Configure the WAN Mode (Required for Dual WAN) on page 4-15). You can also add your own service protocols to the list (see Services-Based Rules on page 6-4 for information on how to do this).

4-1 January 2005

Connecting the FVX538 to the Internet
Reference Manual for the ProSafe VPN Firewall 200 FVX538 2.

Set up your accounts

Have active Internet services such as that provided by cable or DSL broadband accounts and locate the Internet Service Provider (ISP) configuration information. In this document, the WAN side of the network is presumed to be provisioned as shown in Figure 4-1 with two ISPs connected to the FVX538 VPN firewall through separate physical facilities. Each FVX538 WAN port must be configured separately, however, whether you are using a separate ISP for each WAN port or are having the traffic of both WAN ports routed through the same ISP. You will need your ISP information for Step 3: Configure the Internet Connections to Your ISPs (Required) on page 4-8.
customer premises WAN port 1 FVX538 firewall route diversity physical facility 1 ISP 1 Internet WAN port 2 physical facility 2 ISP 2
Figure 4-1: Postulated WAN provisioning used in this document
If your ISPs charge by the amount of bandwidth you use each month, you may want to consider setting up a traffic meter to keep track of your traffic (see Programming the Traffic Meter (if Desired) on page 4-13 if you want to do this).
Contact a Dynamic DNS Service and set up your fully qualified domain names if you need or want them. You will need your fully qualified domain names for Step 5: Configure Dynamic DNS (If Needed) on page 4-20.
Plan your network management approach The FVX538 VPN firewall is capable of being managed remotely, but this feature must be enabled locally after each factory default reset. You are strongly advised to change the default password password to something that is more secure at the time you enable remote management. You make these selections during Step 2: Log in to the VPN Firewall (Required) on page 4-7.

4-2 January 2005

Reference Manual for the ProSafe VPN Firewall 200 FVX538
There are a variety of WAN options you can choose when the factory default settings are not applicable to your installation. These include enabling a WAN port to respond to a ping and setting MTU size, port speed, and upload bandwidth. You will make these choices in Step 6: Configure the WAN Options (If Needed) on page 4-23.
Prepare to physically connect the firewall to cable or DSL modems and a computer. You will do this in Step 1: Physically Connect the VPN Firewall to Your Network (Required) on page 4-7.
Cabling and Computer Hardware Requirements
To use the FVX538 VPN firewall on your network, each computer must have an installed Ethernet Network Interface Card (NIC) and an Ethernet cable. If the computer will connect to your network at 100 Mbps, you must use a Category 5 (CAT5) cable such as the one provided with your firewall.
Computer Network Configuration Requirements
The FVX538 includes a built-in Web Configuration Manager. To access the configuration menus on the FVX538, your must use a Java-enabled web browser program that supports HTTP uploads such as Microsoft Internet Explorer or Netscape Navigator. NETGEAR recommends using Internet Explorer or Netscape Navigator 4.0 or above. Free browser programs are readily available for Windows, Macintosh, or UNIX/Linux. For the initial connection to the Internet and configuration of your firewall, you will need to connect a computer to the firewall that is set to automatically get its TCP/IP configuration from the firewall via DHCP.

Note: For help with DHCP configuration, please refer to Appendix C, Preparing Your Network.
The cable or DSL modem broadband access device must provide a standard 10 Mbps (10BASE-T) Ethernet interface.
Internet Configuration Requirements
Depending on how your ISPs set up your Internet accounts, you will need one or more of these configuration parameters to connect your firewall to the Internet: Host and Domain Names ISP Login Name and Password ISP Domain Name Server (DNS) Addresses

4-3 January 2005

Fixed IP Address which is also known as Static IP Address
Where Do I Get the Internet Configuration Parameters?
There are several ways you can gather the required Internet connection information. Your ISPs provide all the information needed to connect to the Internet. If you cannot locate this information, you can ask your ISPs to provide it or you can try one of the options below. If you have a computer already connected using the active Internet access account, you can gather the configuration information from that computer. For Windows 95/98/ME, open the Network control panel, select the TCP/IP entry for the Ethernet adapter, and click Properties. Record all the settings for each tab page. For Windows 2000/XP, open the Local Area Network Connection, select the TCP/IP entry for the Ethernet adapter, and click Properties. Record all the settings for each tab page. For Macintosh computers, open the TCP/IP or Network control panel. Record all the settings for each section. You may also refer to the FVX538 Resource CD for the NETGEAR Router ISP Guide which provides Internet connection information for many ISPs.
Once you locate your Internet configuration parameters, you may want to record them on the page below.

4-4 January 2005

Record Your Internet Connection Information
Print this page. Fill in the configuration parameters from your Internet Service Provider (ISP). ISP Login Name: The login name and password are case sensitive and must be entered exactly as given by your ISP. For AOL customers, the login name is their primary screen name. Some ISPs use your full e-mail address as the login name. The Service Name is not required by all ISPs. If you connect using a login name and password, then fill in the following: Login Name: ______________________________ Password: ____________________________ Service Name: _____________________________ Fixed or Static IP Address: If you have a static IP address, record the following information. For example, 169.254.141.148 could be a valid IP address. Fixed or Static Internet IP Address: ______.______.______.______ Gateway IP Address: ______.______.______.______ Subnet Mask: ______.______.______.______ ISP DNS Server Addresses: If you were given DNS server addresses, fill in the following: Primary DNS Server IP Address: ______.______.______.______ Secondary DNS Server IP Address: ______.______.______.______ Host and Domain Names: Some ISPs use a specific host or domain name like CCA7324-A or home. If you havent been given host or domain names, you can use the following examples as a guide: If your main e-mail account with your ISP is aaa@yyy.com, then use aaa as your host name. Your ISP might call this your account, user, host, computer, or system name. If your ISPs mail server is mail.xxx.yyy.com, then use xxx.yyy.com as the domain name.

ISP Host Name: _________________________ ISP Domain Name: _______________________ Fully Qualified Domain Name: Some organizations use a fully qualified domain name (FQDN) from a dynamic DNS service provider for their IP addresses. Dynamic DSN Service Provider: ______________________ FQDN: _______________________
Connecting the FVX538 to the Internet January 2005
Connecting the FVX538 ProSafe VPN Firewall 200
This section provides instructions for connecting the FVX538 VPN firewall. Also, the Resource CD for ProSafe VPN Firewall included with your firewall contains an animated Installation Assistant to help you through this procedure. There are six major steps to connecting your firewall:
Connect the firewall physically to your network (required) You physically connect the cables during this step and then make sure the test lights are working OK.
Log in to the firewall (required) You log in to the firewall to enter the information needed in the remaining steps. You can also change your password and enable remote management at this time if you want.
Configure the Internet connections to your ISPs (required) You connect to your ISPs during this step. You can program the WAN traffic meters at this time if you want also.
Configure the WAN mode (required for dual WAN) You select either rollover mode or load balancing (on a mutually exclusive basis) during this step. For load balancing, you can also select the protocol bindings if you want.
Configure dynamic DNS on the WAN ports (if needed) You set up your fully qualified domain names during this step.
Configure the WAN options (if needed) You can optionally enable each WAN port to respond to a ping during this step. You can also optionally change the factory default MTU size, port speed, and uplink bandwidth.
Follow the steps below to connect your firewall to your network. You can also refer to the Resource CD included with your firewall which contains an animated Installation Assistant to help you through this procedure.

4-6 January 2005

Step 1: Physically Connect the VPN Firewall to Your Network (Required)

1. 2. 3. 4.

Turn off your computer and Cable or DSL Modem. Disconnect the Ethernet cable from your computer which connects to your cable or DSL modem. Connect the Ethernet cables from your cable or DSL modems to the WAN1 and WAN2 Internet ports on the FVX538. Connect the Ethernet cable which came with the firewall from a Local port on the firewall to your computer. Note: The FVX538 VPN firewall incorporates Auto UplinkTM technology. Each LOCAL Ethernet port will automatically sense if the cable should have a normal connection or an uplink connection. This feature eliminates the need to worry about crossover cables because Auto Uplink will make the right connection either type of cable.

Now, turn on your computer. If software usually logs you in to your Internet connection, do not run that software or cancel it if it starts automatically. Verify the following: When your turn the firewall on, the power light goes on. The firewalls local lights are lit for any computers that are connected to it. The firewalls Internet light is lit, indicating a link has been established to the cable or DSL modem.
See The Routers Front Panel on page 2-6 for a description of lights on the front panel and their meaning.
Step 2: Log in to the VPN Firewall (Required)
Note: To connect to the firewall, your computer needs to be configured to obtain an IP address automatically via DHCP. If you need instructions on how to do this, please refer to Appendix C, Preparing Your Network.
Connect to the firewall by typing http://192.168.1.1 in the address field of Internet Explorer or Netscape Navigator.
Figure 4-2: Login screen on the Web browser 2.
For security reasons, the firewall has its own user name and password. When prompted, enter admin for the firewall user name and password for the firewall password, both in lower case letters.The firewall user name and password are not the same as any user name or password you may use to log in to your Internet connection.
Note: You might want to enable remote management at this time so that you can log in remotely in the future to manage the firewall. See Enabling Remote Management Access on page 8-9 for more information. Remote management enable is cleared with a factory default reset.
Whenever you enable remote management, you are strongly advised to change your password. See Changing the Passwords and Login Timeout on page 8-9 for the procedure on how to do this.
Step 3: Configure the Internet Connections to Your ISPs (Required)
The steps to configure the Internet connections to your ISPs are to configure WAN port 1 first and then configure WAN port 2 second.
The steps to configure WAN port 1 are as follows:
You should now be connected to the firewall. If you do not see the WAN1 ISP Settings screen shown in Figure 4-3, click the WAN1 ISP link directly under WAN Setup on the upper left of the main menu.

WAN1 screens

WAN2 screens
Figure 4-3: WAN1 and WAN2 Basic Settings and Setup Wizard Screens
Reference Manual for the ProSafe VPN Firewall 200 FVX538 b. c.
Click Setup Wizard on the WAN1 ISP Settings screen to get the Setup Wizard (WAN1) screen. Click Next and follow the steps in the WAN1 Setup Wizard for inputting the configuration parameters from your ISP1 to connect to the Internet. Note: If you choose not to use the Setup Wizard, you can manually configure your Internet connection settings by following the procedure Manually Configuring Your Internet Connection on page 4-12. Unless your ISP automatically assigns your configuration automatically via DHCP, you will need the configuration parameters from your ISP as you recorded them previously in Record Your Internet Connection Information on page 4-5.

When the firewall successfully detects an active Internet service, the firewalls Internet LED goes on. The Setup Wizard reports which connection type it discovered, and displays the appropriate configuration menu. If the Setup Wizard finds no connection, you will be prompted to check the physical connection between your firewall and the cable or DSL line. The options are:
Internet connection methods
Data Required Login (Username, Password). Login (Username, Password), Local IP, and PPTP Server IP. No data is required. IP address and related data supplied by your ISP.

Table 4-1.

Connection Method PPPoE PPTP DHCP (Dynamic IP) Fixed IP
Set up the traffic meter for ISP1 if desired. See Programming the Traffic Meter (if Desired) on page 4-13.
Note: At this point of the configuration process, you are now connected to the Internet through WAN port 1. But you must complete the configuration process outlined in this chapter to get the complete functionality of the dual WAN interface.

4-10 January 2005

The steps to configure WAN port 2 are as follows:
Repeat the above steps to set up the parameters for ISP2. Start by clicking the WAN2 ISP link directly under WAN Setup on the upper left of the main menu to get the WAN2 ISP Settings screen shown in Figure 4-3. Next click Setup Wizard on the WAN2 ISP Settings screen to get the Setup Wizard (WAN2) screen. Then click Next and follow the steps in the WAN2 Setup Wizard for inputting the configuration parameters from your ISP2 to connect to the Internet. Set up the traffic meter for ISP2 if desired. See Programming the Traffic Meter (if Desired) on page 4-13.
Manually Configuring Your Internet Connection You can manually configure your firewall using the menu below if you do not want to allow the Setup Wizard to determine your configuration as described in the previous sections. ISP Does Not Require Login ISP Does Require Login
Figure 4-4: Browser-based configuration WAN ISP Settings menus (WAN1 ISP shown)

4-12 January 2005

Programming the Traffic Meter (if Desired) From the Main Menu of the browser interface, under WAN Setup, click Traffic Meter. You will get the screens shown in Figure 4-5. Fill out the information described in Table 4-1.
Figure 4-5: Traffic Meter screens Connecting the FVX538 to the Internet January 2005 4-13

Parameter

Traffic meter
Description Check this if you wish to record the volume of Internet traffic passing through the Router's WAN1 or WAN2 port.WAN1 or WAN2 can be selected through the drop down menu, the entire configuration is specific to each wan interface. No Limit - If this is selected specified restriction will not be applied when traffic limit is reached. Download only - If this is selected the specified restriction will be applied to the incoming traffic only Both Directions - If this is selected the specified restriction will be applied to both incoming and outgoing traffic only

Enable Traffic Meter

Enable Monthly Limit Use this if your ISP charges for additional traffic. If enabled, enter the monthly volume limit and select the desired behavior when the limit is reached. Note: Both incoming and outgoing traffic are included in the limit. Increase this month's limit Use this to temporarily increase the Traffic Limit if you have reached the monthly limit, but need to continue accessing the Internet. Check the checkbox and enter the desired increase. (The checkbox will automatically be cleared when saved so the increase is only applied once.) This displays the limit for the current month. This determines when the traffic counter restarts. Choose the desired time and day of the month.
This month's limit Restart traffic counter
Restart Counter Now Click this button to restart the Traffic Counter immediately. Send E-mail Report before restarting counter When limit is reached If checked, an E-mail report will be sent immediately before restarting the counter. You must configure the E-mail screen in order for this function to work (see Getting E-Mail Notifications of Event Logs and Alerts on page 6-30). Select the desired option: Block all traffic - all access to and from the Internet will be blocked. Block all traffic except E-mail - Only E-mail traffic will be allowed. All other traffic will be blocked. If using this option, you may also select the Send E-mail alert option. You must configure the E-mail screen in order for this function to work. This displays statistics on Internet Traffic via the WAN port. If you have not enabled the Traffic Meter, these statistics are not available. Click this button if you want to know more details of the Internet Traffic. The volume of traffic for each protocol will be displayed in a sub-window.Traffic counters are updated in MBytes scale, counter starts only when traffic passed is at least 1MB.

Internet Traffic Statistics Traffic by Protocol

4-14 January 2005

Step 4: Configure the WAN Mode (Required for Dual WAN)
The dual WAN ports of the FVX538 ProSafe VPN Firewall 200 can be configured on a mutually exclusive basis for either rollover for increased system reliability or load balancing for maximum bandwidth efficiency. Rollover (Auto-Rollover) ModeIn this mode, the selected WAN interface is made primary and the other is the rollover link. As long as the primary link is up, all traffic is sent over the primary link. Once the primary WAN interface goes down, the rollover link is brought up to send the traffic. Traffic will automatically roll back to the original primary link once the original primary link is back up and running again. Load Balancing ModeIn this mode the router distributes the outbound traffic equally among the WAN interfaces that are functional.
Note: Scenarios could arise when load balancing needs to be bypassed for certain traffic or applications. Here the traffic needs to go on a specific WAN interface. This is done with the protocol binding rules of that WAN interface. The rule should match the desired traffic.
For both alternatives, you must also set up Network Address Translation (NAT): NATNAT is the technology which allows all PCs on your LAN to share a single Internet IP address. From the Internet, there is only a single device (the Router) and a single IP address. PCs on your LAN can use any "private" IP address range, and these IP addresses are not visible from the Internet. The Router uses NAT to select the correct PC (on your LAN) to receive any incoming data. If you only have a single Internet IP address, you MUST use NAT.
Classical RoutingIn this mode, the Router performs Routing, but without NAT. To gain Internet access, each PC on your LAN must have a valid Internet IP address. If your ISP has allocated many IP addresses to you, and you have assigned one of these addresses to each PC, you can choose Classical Routing. Otherwise, selecting this method will not allow Internet access through this Router.
To learn the status of the WAN ports, you can view the Router Status page (see Firewall Status on page 8-15) or look at the LEDs on the front panel (see The Routers Front Panel on page 2-6).
Rollover Setup Perform the following steps to configure the dual WAN ports for rollover:
Click the WAN Mode link directly under Setup on the upper left of the main menu to invoke the WAN Mode Auto-Rollover screen shown in Figure 4-6.
Figure 4-6: WAN Mode screen for auto-rollover
Fill out the screen using the following parameter definitions: Detection of WAN failureWAN failure is detected using DNS queries to the DNS server. For each WAN interface, DNS queries are sent to the configured DNS server. If the DNS replies are not received, the corresponding WAN interface is considered down. ISP DNS ServerIn this case, DNS queries are sent to the DNS server configured on the WAN ISP pages (see Step 3: Configure the Internet Connections to Your ISPs (Required) on page 4-8). Public DNS ServerThe user is also given an option, to enter any Public DNS server.DNS queries are sent to this server through the WAN interface being monitored.

Test PeriodDNS query is sent periodically after every test period. The minimum test period is 30 seconds. Maximum FailuresThe WAN interface is considered down after the configured number of DNS queries have failed to elicit a DNS reply from the configured DNS server. The minimum number of failed DNS queries is four. The rollover link is brought up after this.
The minimum time to roll over after the primary WAN interface fails is two minutes (i.e., 30 second minimum test period times a minimum of four tests).
Once a rollover occurs, an alert will be generated (see Getting E-Mail Notifications of Event Logs and Alerts on page 6-30). You should then get the failed WAN interface restored and then force traffic back on the original primary WAN interface by reapplying the WAN Mode menu shown in Figure 4-6.
Load Balancing (and Protocol Binding) Setup Perform the following steps to configure the dual WAN ports for load balancing and protocol binding on outbound traffic:
Select Load Balancing on the screen shown in Figure 4-6 to invoke the WAN Mode Load Balancing screen shown in Figure 4-7.
Figure 4-7: WAN Mode screen for load balancing and protocol binding
Fill out the screen using the following parameter definitions: Detection of WAN failureWAN failure is detected using DNS queries to the DNS server. For each WAN interface, DNS queries are sent to the configured DNS server. If the DNS replies are not received, the corresponding WAN interface is considered down. ISP DNS ServerIn this case, DNS queries are sent to the DNS server configured on the WAN ISP pages (see Step 3: Configure the Internet Connections to Your ISPs (Required) on page 4-8). Public DNS ServerThe user is also given an option to enter any Public DNS server. DNS queries are sent to this server through the WAN interface being monitored.
Test PeriodDNS query is sent periodically after every test period. The minimum test period is 30 seconds. Maximum FailuresThe WAN interface is considered down after the configured number of DNS queries have failed to elicit a DNS reply from the configured DNS server. The minimum number of failed DNS queries is four.
The minimum time for a WAN interface to be classified as having failed is two minutes (i.e., 30 second minimum test period times a minimum of four tests). All traffic then stops on that WAN port. Traffic that is not bound by protocol to the failed WAN port is then sent to the working WAN port. If the total traffic on the working WAN port exceeds its bandwidth, then congestion occurs. Once a WAN interface fails, an alert will be generated (see Getting E-Mail Notifications of Event Logs and Alerts on page 6-30). You must then get the failed WAN interface restored before it can carry traffic again by reapplying the WAN Mode menu shown in Figure 4-10.

Click Add in the appropriate WAN interface section of the WAN Mode Load Balancing screen to invoke the WAN Mode Protocol Bonding screen (if protocol binding is needed). Fill out the screen using the following parameter definitions: ServiceSelect the desired Services or applications to be covered by this rule. If the desired service or application does not appear in the list, you must define it using the Services menu (see Services-Based Rules on page 6-4). Source NetworkThese settings determine which computers on your network are affected by this rule. Select the desired options: AnyAll PCs and devices on your LAN. Single addressEnter the required address and the rule will be applied to that particular PC. Address range If this option is selected, you must enter the start and finish fields. GroupsSelect the Group you wish this rule to apply to. You can use the Network Database screen to assign PCs to Groups.
Destination NetworkThese settings determine which Internet locations are covered by the rule, based on their IP address. Select the desired option: AnyAll Internet IP address are covered by this rule. Single addressEnter the required address in the start fields. Address rangeIf this option is selected, you must enter the start and finish fields.
Step 5: Configure Dynamic DNS (If Needed)
If your network has a permanently assigned IP address, you can register a domain name and have that name linked with your IP address by public Domain Name Servers (DNS). However, if your Internet account uses a dynamically assigned IP address, you will not know in advance what your IP address will be, and the address can change frequently. In this case, you can use a commercial dynamic DNS service, which allows you to register an extension to its domain, and restores DNS requests for the resulting FQDN to your frequently-changing IP address. which will allow you to register your domain to their IP address, and will forward traffic directed to your domain to your frequently-changing IP address. For rollover mode, you are going to need a fully qualified domain name to implement features such as exposed hosts and virtual private networks regardless of whether you have a fixed or dynamic IP address. For load balancing mode, you may still need a fully qualified domain name either for convenience or if you have a dynamic IP address.

The firewall contains a client that can connect to a dynamic DNS service provider. To use this feature, you must select a service provider and obtain an account with them. After you have configured your account information in the firewall, whenever your ISP-assigned IP address changes, your firewall will automatically contact your dynamic DNS service provider, log in to your account, and register your new IP address. Perform the following steps to configure Dynamic DNS:
If you havent already, log in to the firewall at its default LAN address of http://192.168.1.1 with its default user name of admin, default password of password, or using whatever password and LAN address you have chosen for the firewall. From the Main Menu of the browser interface, under WAN Setup, click on Dynamic DNS.
Rollover Mode: You will get the screen shown in Figure 4-8 with AUTO_ROLLOVER shown in the pulldown. Load Balancing Mode: Select WAN1 or WAN2 in the pulldown shown in Figure 4-8 to invoke the appropriate WAN interface to program.

4-20 January 2005

Dynamic DNS screen for rollover mode
Dynamic DNS screens for load balancing mode
Figure 4-8: Dynamic DNS screens
Each DNS service provider requires its own parameters (Figure 4-9).
DynDNS Service Screen TZO Service Screen Oray Service Screen
Figure 4-9: Dynamic DNS service provider screens 3.
Access the website of one of the dynamic DNS service providers whose names appear in the Select Service Provider box, and register for an account. For example, for dyndns.org, go to www.dyndns.org. Select the Use a dynamic DNS service check box. Select the name of your dynamic DNS Service Provider. Type the entire FQDN name that your dynamic DNS service provider gave you, such as myName.dyndns.org. Type the user name for logging into your dynamic DNS account. Type the password (or key) for your dynamic DNS account. If your dynamic DNS provider allows the use of wildcards in resolving your URL, you may select the Use wildcards check box to activate this feature. For example, the wildcard feature will cause *.yourhost.dyndns.org to be aliased to the same IP address as yourhost.dyndns.org

4. 5. 6. 7. 8. 9.

10. Click Apply to save your configuration.

4-22 January 2005

Note: If your ISP assigns a private WAN IP address such as 192.168.x.x or 10.x.x.x, the dynamic DNS service will not work because private addresses will not be routed on the Internet.

Step 6: Configure the WAN Options (If Needed)
Perform the following steps to configure the WAN options:
If you havent already, log in to the firewall at its default LAN address of http://192.168.1.1 with its default user name of admin, default password of password, or using whatever password and LAN address you have chosen for the firewall. From the Main Menu of the browser interface, under WAN Setup, click on Options. You will get the WAN1 screen shown in Figure 4-10 and can get the WAN2 screen from there using the pulldown.
Figure 4-10: WAN Options Screens 3.
Edit the default information you want to change. MTU SizeThe normal MTU (Maximum Transmit Unit) value for most Ethernet networks is 1500 Bytes, or 1492 Bytes for PPPoE connections. For some ISPs you may need to reduce the MTU. But this is rarely required, and should not be done unless you are sure it is necessary for your ISP connection.

4-23 January 2005

Port SpeedIn most cases, your router can automatically determine the connection speed of the Internet (WAN) port. If you cannot establish an Internet connection and the Internet LED blinks continuously, you may need to manually select the port speed. If you know that the Ethernet port on your broadband modem supports 100BaseT, select 100M; otherwise, select 10M. Use the half-duplex settings unless you are sure you need full duplex.
Uplink BandwidthSet Uplink Bandwidth as per your requirements. You need to select a value between 28 kbps to 100 Mbps that represents the maximum speed of your upstream (outbound) connection. If you are unsure, leave it at the default value of 102,400 kbps. It will depend on your WAN connection type and ISP. Router's MAC AddressEach computer or router on your network has a unique 32-bit local Ethernet address. This is also referred to as the computer's MAC (Media Access Control) address. Usually, select Use default address. If your ISP requires MAC authentication, then select either Use this Computer's MAC address to have the router use the MAC address of the computer you are now using or Use This MAC Address to manually type in the MAC address that your ISP expects. The format for the MAC address is XX:XX:XX:XX:XX:XX. If you select Use This MAC Address and type in a MAC address, do not then select Use this Computer's MAC address or your entry will be overwritten.
Note: Respond To Ping On Internet PortIf you want the router to respond to a 'Ping' from the Internet, see the Respond To Ping On Internet Port checkbox on the Rules menu (Figure 6-1 on page 6-2).

4-24 January 2005