NETGEAR VPN Client to NETGEAR FVL328 or FWAG114 VPN Router
Follow these procedures to configure a VPN tunnel from a NETGEAR ProSafe VPN Client to an FVL328. This case study follows the VPN Consortium interoperability profile guidelines. The configuration options for the FVS328 and FWAG114 are the same.

Configuration Profile

The configuration in this document follows the addressing and configuration mechanics defined by the VPN Consortium. Gather all the necessary information before you begin the configuration process. Verify whether the firmware is up to date, all of the addresses that will be necessary, and all of the parameters that need to be set on both sides. Check that there are no firewall restrictions.
Table D-1. Summary Scenario 1 PC/Client-to-Gateway IKE with Preshared Secret/Key (not Certificate-based) November 2003
VPN Consortium Scenario: Type of VPN Security Scheme: Date Tested: Model/Firmware Tested: Gateway Client IP Addressing: Gateway Client
NETGEAR FVL328 firmware v 1.4 or FWAG114 firmware v 2.1 NETGEAR ProSafe VPN Client v10.1
Static IP address Dynamic
NETGEAR VPN Client to NETGEAR FVL328 or FWAG114 VPN Router 202-10015-01
Reference Manual for the NETGEAR ProSafe VPN Client

Network Addresses

Gateway LAN IP

192.168.0.0

WAN IP

66.120.188.153

Client WAN IP
0.0.0.0 PC with Netgear ProSafe VPN client

FVL328

Figure D-1: Addressing and Subnet Used for Examples
Note: Product updates are available on the NETGEAR Web site at www.netgear.com/support/main.asp. VPNC Interoperability guidelines can be found at http://www.vpnc.org/InteropProfiles/Interop-01.html.
Step-By-Step Configuration of FVL328 or FWAG114 Gateway
Log in to the FVL328 gateway as in the illustration. Out of the box, the FVL328 is set for its default LAN address of http://192.168.0.1 with its default user name of admin and default password of password. Even though the remainder of this document will refer to the FVL328, the login procedures and configuration menu screens are the same for the FVL328 and the FWAG114.
Click IKE Policies under the VPN menu and click Add on the IKE Policies Menu.
Figure D-2: NETGEAR FVL328 IKE Policy Configuration
Enter a descriptive name for the policy in the Policy Name field. This name is not supplied to the remote VPN Endpoint. It is used to help you manage the IKE policies. In our example, we used VPNclient as the Policy Name. From the Direction/Type drop-down box, select Remote Access From the Exchange Mode drop-down box, select Aggressive Mode. This will also be selected in the NETGEAR ProSafe VPN Client My Identity ID Type fields, as seen in Security Policy on page D-11. From the Local Identity drop-down box, select Fully Qualified Domain Name (the actual WAN IP address of the FVL328 will also be used in the Connection ID Type fields of the NETGEAR ProSafe VPN Client as seen in Security Policy Editor New Connection on page D-9). For this example we typed FVL328 in the Local Identity Data field. From the Remote Identity drop-down box, select Fully Qualified Domain Name. Type VPNclient in the Remote Identity Data. This will also be entered in the NETGEAR ProSafe VPN Client My Identity ID Type fields, as seen in My Identity on page D-10.

Figure D-3: NETGEAR FVL328 IKE Policy Configuration
From the Encryption Algorithm drop-down box, select 3DES. This will also be selected in the NETGEAR ProSafe VPN Client Security Policy Authentication Phase 1 Proposal 1 Encrypt Alg field, as seen in Connection Security Policy Authentication (Phase 1) on page D-12. From the Authentication Algorithm drop-down box, select SHA-1.This will also be selected in the NETGEAR ProSafe VPN Client Security Policy Authentication Phase 1 Proposal 1 Hash Alg field, as seen in Connection Security Policy Authentication (Phase 1) on page D-12. From the Authentication Method radio button, select Pre-shared Key. This will also be selected in the NETGEAR ProSafe VPN Client Security Policy Authentication Phase 1 Proposal 1 Authentication Method field, as seen in Connection Security Policy Authentication (Phase 1) on page D-12. In the Pre-Shared Key field, type hr5xb84l6aa9r6. You must make sure the key is the same for both the FVL328 and the NETGEAR VPN Client. This will also be selected in the NETGEAR ProSafe VPN Client Security Policy Authentication Phase 1 Proposal 1 Encrypt Alg field, as seen in Connection Identity Pre-Shared Key on page D-11. From the Diffie-Hellman (DH) Group drop-down box, select Group 2 (1024 Bit). This will also be selected in the NETGEAR ProSafe VPN Client Security Policy Authentication Phase 1 Proposal 1 Key Group field, as seen in Connection Security Policy Authentication (Phase 1) on page D-12. In the SA Life Time field, type 86400.
Click Apply. This will bring you back to the IKE Policies Menu.The FVL328 IKE Policy is now displayed in the IKE Policies page.
Reference Manual for the NETGEAR ProSafe VPN Client 3.
Click the VPN Policies link under the VPN category on the left side of the main menu. This will take you to the VPN Policies Menu page. Click Add Auto Policy. This will open a new screen titled VPN Auto Policy.
Figure D-4: NETGEAR FVL328 VPN Auto Policy General settings
Enter a unique name to identify this policy. This name is not supplied to the remote VPN endpoint. In our example we have used to318 as the Policy Name. In the Policy Name field type VPNclient. From the IKE policy drop-down box, select VPNclient which is the IKE Policy that was set up in the earlier step. From the Remote VPN Endpoint Address Type drop-down box, select IP Address. Type 0.0.0.0 as the Address Data of the client because we are assuming the remote PC will have a dynamically assigned IP address. This will also be entered in the NETGEAR ProSafe VPN Client Internal Network IP Address field, as seen in My Identity on page D-10. Type 86400 in the SA Life Time (Seconds) field. Type 0 in the SA Life Time (Kbytes) field. Check the IPSec PFS checkbox to enable Perfect Forward Secrecy. This will also be entered in the NETGEAR ProSafe VPN Client Security Policy Enable Perfect Forward Secrecy checkbox, as seen in Security Policy on page D-11. From the PFS Key Group drop-down box, select Group 2 (1024 Bit). This will also be entered in the NETGEAR ProSafe VPN Client Security Policy PFS Key Group drop-down selection box, as seen in Security Policy on page D-11.

Figure D-5: NETGEAR FVL328 VPN Auto Policy Traffic Selector
From the Traffic Selector Local IP drop-down box, select Subnet addresses. This will also be entered in the NETGEAR ProSafe VPN Client Connection Remote Party Identity and Addressing ID Type field, as seen in Security Policy Editor New Connection on page D-9. Type the starting LAN IP Address of the FVL328 in the Local IP Start IP Address field. For this example, we used 192.168.0.0 which is the default LAN IP address of the FVL328. This will also be entered in the NETGEAR ProSafe VPN Client Connection Remote Party Identity and Addressing Subnet field, as seen in Security Policy Editor New Connection on page D-9. Type the LAN Subnet Mask of the FVL328 (255.255.255.0 in our example) in the Local IP Subnet Mask field. This will also be entered in the NETGEAR ProSafe VPN Client Connection Remote Party Identity and Addressing Mask field, as seen in Security Policy Editor New Connection on page D-9. From the Traffic Selector Remote IP drop-down box, select Single addresses. Type 0.0.0.0 as the start IP Address of the in the Remote IP Start IP Address field because we are assuming the remote PC will have a dynamically assigned IP address. This will also be entered in the NETGEAR ProSafe VPN Client My Identity Internal Network IP Address field, as seen in My Identity on page D-10.
Figure D-6: NETGEAR FVL328 VPN Auto Policy ESP Configuration
Select Enable Encryption in the ESP Configuration Enable Encryption checkbox. This will also be entered in the NETGEAR ProSafe VPN Client Security Policy Key Exchange (Phase 2) Encapsulation Protocol (ESP) checkbox, as seen in Connection Security Policy Key Exchange (Phase 2) on page D-13. From the ESP Configuration Encryption Algorithm drop-down box, select 3DES. This will also be entered in the NETGEAR ProSafe VPN Client Security Policy Key Exchange (Phase 2) Encrypt Alg field, as seen in Connection Security Policy Key Exchange (Phase 2) on page D-13. Select Enable Authentication in the ESP Configuration Enable Authentication checkbox. Note: Do not confuse this with the Authentication Protocol (AH) option. Using the AH option will prevent clients behind a home NAT router from connecting. From the ESP Configuration Authentication Algorithm drop-down box, select SHA-1. This will also be entered in the NETGEAR ProSafe VPN Client Security Policy Key Exchange (Phase 2) Hash Alg field, as seen in Connection Security Policy Key Exchange (Phase 2) on page D-13. Select NETBIOS Enable in the NETBIOS Enable checkbox to enable networking features like Windows Network Neighborhood.
Click Apply to save your changes. You will be taken back to the VPN Policies Menu page.
When the screen returns to the VPN Policies, make sure the Enable checkbox is selected. Click Apply to save your changes.
Step-By-Step Configuration of the NETGEAR VPN Client B

Note: The NETGEAR ProSafe VPN Client has the ability to Import a predefined configuration profile. The FVL328.SPD file on the NETGEAR ProSafe VPN Client Resource CD (230-10007-01) includes all the settings identified in this procedure.
Whenever importing policy settings, you should first export any existing settings you may have configured to prevent the new imported settings from replacing an existing working configuration. To import this policy, use the Security Policy Editor File menu to select Import Policy, and select the FVL328.SPD file at D:\Software\Policies where D is the drive letter of your CD-ROM drive. This procedure describes linking a remote PC and a LAN. The LAN will connect to the Internet using an FVL328 with a static IP address. The PC can be directly connected to the Internet through dialup, cable or DSL modem, or other means, and we will assume it has a dynamically assigned IP address.
Install the NETGEAR VPN Client Software on the PC.
Note: Before installing the NETGEAR ProSafe VPN Client software, be sure to turn off any virus protection or firewall software you may be running on your PC.
You may need to insert your Windows CD to complete the installation. Reboot your PC after installing the client software.
Reference Manual for the NETGEAR ProSafe VPN Client 2.
Configure the Connection Network Settings.
Figure D-7: Security Policy Editor New Connection a.
Run the Security Policy Editor program and create a VPN Connection.
Figure D-8: Security Policy Editor Options menu
Note: If the configuration settings on this screen are not available for editing, go to the Options menu, select Secure, and Specified Options to enable editing of these settings. From the Edit menu of the Security Policy Editor, click Add, then Connection. A New Connection listing appears. Rename the New Connection to FVL328.
Assure that the following settings are configured: In the Connection Security box, Secure is selected
In the Protocol menu, All is selected The Connect using Secure Gateway Tunnel checkbox is checked
In this example, select IP Subnet as the ID Type, 192.168.0.0 in the Subnet field (the Subnet address is the LAN IP Address of the FVL328 with 0 as the last number), and 255.255.255.0 in the Mask field, which is the LAN Subnet Mask of the FVL328 In the ID Type menus, select Domain Name and Gateway IP Address. Enter FVL328 in the Domain Name field. In this example, 66.120.188.153 would be used for the Gateway IP Address, which is the static IP address for the FVL328 WAN port.

Configure the Connection Identity Settings.
In the Network Security Policy list, click the My Identity subheading.

Figure D-9: My Identity

In this example, select Domain Name as the ID Type, and enter VPNclient. Also, accept the default Internal Network IP Address of 0.0.0.0.
Figure D-10: My Identity Pre-Shared Key b.

Click Pre-Shared Key.

In this example, enter this pre-shared key in this field: hr5xb84l6aa9r6
Figure D-11: Connection Identity Pre-Shared Key c. d. 4.
Enter hr5xb84l6aa9r6 which is the same Pre-Shared Key entered in the FVL328. Click OK.
In the Network Security Policy list, click the Security Policy subheading.
Figure D-12: Security Policy b.
For this example, assure that the following settings are configured: In the Select Phase 1 Negotiation Mode menu, select Aggressive Mode. Check the Enable Perfect Forward Secrecy (PFS) checkbox. In the PFS Key Group drop-down list, Diffie-Hellman Group 2. Check the Enable Replay Detection checkbox.
Reference Manual for the NETGEAR ProSafe VPN Client 5.
Configure the Connection Security Policy In this step, you will provide the authentication (IKE Phase 1) settings, and the key exchange (Phase 2) settings. The setting choices in this procedure follow the VPNC guidelines.
Figure D-13: Connection Security Policy Authentication (Phase 1) a.
Configure the Authentication (Phase 1) Settings. Expand the Security Policy heading, then expand the Authentication (Phase 1) heading, and click on Proposal 1. For this example, assure that the following settings are configured: In the Encrypt Alg menu, select Triple DES. In the Hash Alg, select SHA-1. In the SA Life, select Unspecified. In the Key Group menu, select Diffie-Hellman Group 2.
Figure D-14: Connection Security Policy Key Exchange (Phase 2) b.
Configure the Key Exchange (Phase 2). Expand the Key Exchange (Phase 2) heading, and click on Proposal 1. For this example, assure that the following settings are configured: In the SA Life menu, select Unspecified. In the Compression menu, select None. Check the Encapsulation Protocol (ESP) checkbox. In the Encrypt Alg menu, select Triple DES. In the Hash Alg, select SHA-1. In the Encapsulation menu, select Tunnel.

Reference Manual for the NETGEAR ProSafe VPN Client 6.
Configure the Global Policy Settings.
From the Options menu at the top of the Security Policy Editor window, select Global Policy Settings.
Figure D-15: Security Policy Editor Global Policy Options b. c. 7.
Increase the Retransmit Interval period to 45 seconds. Check the Allow to Specify Internal Network Address checkbox and click OK.
Save the VPN Client Settings. From the File menu at the top of the Security Policy Editor window, select Save. After you have configured and saved the VPN client information, your PC will automatically open the VPN connection when you attempt to access any IP addresses in the range of the remote VPN routers LAN.
Note: Whenever you make changes to a Security Policy, save them first, then deactivate the security policy, reload the security policy, and finally activate the security policy. This assures that your new settings will take effect.
Testing the VPN Connection
You can test the VPN connection in several ways: From the client PC to the FVL328 From the FVL328 to the client PC
These procedures are explained below.
Note: Virus protection or firewall software can interfere with VPN communications. Be sure such software is not running on the remote PC with the NETGEAR VPN Client and that the firewall features of the FVL328 is not set in such a way as to prevent VPN communications.
From the Client PC to the FVL328
To check the VPN Connection, you can initiate a request from the remote PC to the FVL328 by using the Connect option of the NETGEAR VPN Client popup menu.
Right-mouse-click on the system tray icon to open the popup menu.
Figure D-16: Connecting the PC to the FVL328 over the VPN tunnel 1. 2. 3.
Open the popup menu by right-clicking on the system tray icon. Select Connect to open the My Connections list. Choose FVL328. The NETGEAR VPN Client will report the results of the attempt to connect.
Once the connection is established, you can access resources of the network connected to the FVL328. Another method is to ping from the remote PC to the LAN IP address of the FVL328. To perform a ping test using our example, start from the remote PC:

1. 2. 3.

Establish an Internet connection from the PC. On the Windows taskbar, click the Start button, and then click Run. Type ping -t 192.168.0.1, and then click OK. This will cause a continuous ping to be sent to the first FVL328. After a period of up to two minutes, the ping response should change from timed out to reply. To test the connection to a computer connected to the FVL328, simply ping the IP address of that computer.
Once connected, you can open a browser on the remote PC and enter the LAN IP Address of the FVL328, which is http://192.168.0.1 in this example. After a short wait, you should see the login screen of the FVL328.
From the FVL328 to the Client PC
You can use the FVL328 Diagnostic utilities to test the VPN connection from the FVL328 to the client PC. Run ping tests from the Diagnostics link of the FVL328 main menu.
Monitoring the PC VPN Connection
Information on the progress and status of the VPN client connection can be viewed by opening the NETGEAR VPN Client Connection Monitor or Log Viewer. To launch these functions, click on the Windows Start button, then select Programs, then NETGEAR ProSafe VPN Client, then either the Connection Monitor or Log Viewer. The Log Viewer screen for a successful connection is shown below:
Figure D-17: Log Viewer screen
A sample Connection Monitor screen for a different connection is shown below:
Figure D-18: Connection Monitor screen
In this example you can see the following: The FVL328 has a public IP WAN address of 66.120.188.153 The FVL328 has a LAN IP address of 192.168.0.1 The VPN client PC is behind a home NAT router and has a dynamically assigned address of 192.168.0.3
While the connection is being established, the Connection Name field in this menu will say SA before the name of the connection. When the connection is successful, the SA will change to the yellow key symbol shown in the illustration above.
Viewing the FVL328 VPN Status and Log Information
Information on the status of the VPN client connection can be viewed by opening the FVL328 VPN Status screen. To view this screen, click the VPN Status link of the FVL328 main menu. The FVL328 VPN Status screen for a successful connection is shown below:
Figure D-19: FVL328 VPN Status screen
To view the FVL328 VPN log, click on the VPN Status link on the left side of the main menu. The log information should be similar to the example below:

F W A G 114

ProSafe Dual Band Wireless VPN Firewall
with 802.11a/g access points and 4-port 10/100 Mbps switch
T r i - m o d e W i r e l e s s O p e r a b i l i t y, H i g h B a n d w i d t h , and Business-class VPN Security
Help is there when you need it! NETGEAR provides 24x7 telephone and e-mail technical support*** in English with selected local language support during office hours.
For an invaluable asset to your wireless network architecture, look to NETGEAR's ProSafe Dual Band Wireless VPN Firewall. Equipped with an IEEE standard 802.11a and an 802.11g* access point, it gives your wireless LAN 802.11a/b/g functionality. This high-test firewall uses business-class 11a, is backward compatible with 11b, and delivers future-forward, 54 Mbps 11g compliance while it capitalizes on your current 11b investment. It features four auto-sensing, Auto Uplink 10/100 Mbps switched LAN ports, as well as Network Address Translation (NAT) routing for IP address conservation and network shielding. True Firewall provides total business-class security with Denial of Service (DoS) protection and Intrusion Detection using Stateful Packet Inspection (SPI), URL access and content filtering, logging, reporting, and real-time alerts. IPSec-based VPN end-point support reduces remote access costs by providing two (2) 3DES-encrypted tunnels for secure WAN connections. Web browser-based settings and on-screen help make setup a breeze, and Smart Wizard and Install Assistant get your network up and running in minutes.

Future

Two (2) built-in 802.11a/g-based antennas afford powerful tri-mode wireless signal reception and prolong network life beyond 802.11b. Extends your network to support up to 108 Mbps wireless throughput (802.11a in turbo mode**) without the need for any new cabling. Upgradable with new features and enhancements via downloads from www.NETGEAR.com. Protects your investment with a 3-year warranty. Integrated four (4) 10/100 Mbps switched LAN ports with auto-sensing and Auto Uplink. High bandwidth WLAN access and single IP address-sharing with up to 253 users, with up to 96 users on the WLAN. MAC Address cloning/spoofing, Import/ Export router settings, and LAN DHCP server controls. Advanced settings offer users additional control. Full network protection from a True Firewall with Denial of Service (DoS) attack protection and Intrusion Detection using Stateful Packet Inspection (SPI), logging, reporting and real-time alerts; web page URL keyword filtering and blocking. Support for two IPSec-based VPN end-point tunnels for secure remote connections; 168-bit IPSec-based 3DES encryption capability. NAT routing and VPN pass-through (L2TP, PPTP, IPSec) safely share your broadband connection with multiple computers. FREE complete anti-virus software for 8 PCs that blocks, scans and destroys virus, worm and Trojan attacks. Free Ad Blocker, Keyword Alert, Password Manager, Form-filler and Cookie Manager PC software speed up browsing and protect your personal data. Kensington Lock slot included for theft protection. Auto Uplink on LAN ports eliminates the need for crossover cables. Secure Sockets Layer (SSL) remote management capability provides ease of deployment and administration for multiple sites. NETGEAR's Install Assistant guides you through each step, while NETGEAR's Smart Wizard automatically detects your ISP connection type, saving time and reducing setup errors.
*This product has been designed and developed to the draft IEEE specification for the 802.11g standard. Final ratification is expected in the second half of 2003. Specification is subject to change without notice. ** Region specific

Dynamic

Business

Class Secure

Hassle

Ty p i c a l

Network Setup
FWAG114 ProSafe Dual Band Wireless VPN Firewall Notebook PCs with MA521 802.11b Wireless PC Card

Internet

FVS318 VPN Firewall

Cable/DSL modem

VPN Tunnel encrypts your data on the WAN
Notebook PC with WAG511 802.11a/b/g Dual Band Wireless PC Card

Everybodys Connecting.

Desktop PC with FA311 network card installed
Desktop PCs with FA311 network card installed
Notebook PC with HA501 802.11a Wireless PC Card

Technical Specifications

Physical Interfaces: - LAN Ports: Four (4) 10/100 Mbps auto-sensing, Auto Uplink RJ-45 ports (one Cat 5 UTP cable included) - WAN Port: 10/100BASE-T Ethernet RJ-45 port to connect to any broadband modem that has an ethernet LAN connection Security Features: - Firewall: Stateful Packet Inspection (SPI) to prevent notorious Denial of Service (DoS) attacks, Intrusion Detection System (IDS) including logging, report ing, and e-mail alerts (address, service and protocol), Web URL content filtering, prevent replay attack (reassembly attack). Advanced features include block Java/URL/ActiveX based on extension, FTP/SMTP/RPC program filtering - VPN Functionality: Two (2) dedicated VPN tunnels, Manual key and IKE Security Association (SA) assignment with pre-shared key and RSA/DSA signatures, PKI features with X.509 v.3 certificate support, key life and IKE lifetime time settings, perfect forward secrecy (Diffie-Hellman groups 1 and 2 and Oakley support), operating modes (Main, Aggressive, Quick) - IPSec support: IPSec-based 56-bit (DES) or 168-bit (3DES) encryption algorithm, MD5 or SHA-1 hashing algorithm, AH/AH-ESP support, remote access VPN (client-to-site), site-to-site VPN, IPSec NAT traversal (VPN pass-through), tunnel or transport operating mode - Wireless Encryption: IEEE 802.11b/g Access Point, up to 128-bit WEP (152-bit for 802.11g) encryption IEEE 802.11a Access Point, up to 152-bit WEP encryption - Mode of Operation: Network Address Translation (NAT), static routing, unrestricted users per port - IP Address Assignment: Static IP address assign ment, internal DHCP server on LAN, DHCP client on WAN, PPPoE client support Performance Features: - Throughput: 20+ Mbps WAN-to-LAN throughput Management Features: - Administration interface: Web graphic user interface, user name and password protected; Smart Wizard and Auto Detect for basic parameter settings; remote management support authenticated through IP address or IP address range, and password; secure sockets layer (SSL) support for remote management; config changes/upgrades through web GUI - Configuration and upgrades: Upload and download configuration settings, firmware upgradable flash memory, and DRAM - Logging:WELF-based logging format, SYSLOG, e-mail alerts Protocol Support: - Network: IP routing, TCP/IP, UDP, ICMP, PPPoE - IP Addressing: DHCP (client and server) - Routing: RIP v1, RIPv2 (Static Routing, Dynamic Routing) - VPN Security: IPSec (ESP, AH), MD5, SHA-1, DES, 3DES, IKE, PKI Application Support: - IPSec pass-through, H.323, Quake, Half-Life, StarCraft Unreal Tournament, PPTP, MIRC, ICQ, AOL Instant Messenger, RealPlayer, VDOLive, QuickTime, Dialpad

FWAG114 ProSafe Dual Band Wireless VPN Firewall
User Support: - LAN: Up to 253 total users (96 users on WLAN) RFC Support: PPTP client and server (RFC 2637) IPSec tunnel mode (RFC 2401) Authentication Header Protocol (RFC 2402) HMAC-MD5-96 (RFC 2403) HMAC-SHA1-96 (RFC 2404) DES-CBC Cipher algorithm (RFC 2405) Encapsulation Security Payload Protocol (RFC 2406) Domain of Interpretation (RFC 2407) Internet Security Association and Key Management Protocol (ISAKMP) (RFC 2408) Oakley (RFC 2412) DHCP server (RFC 2131) DHCP client (RFC 2131) IP routing (RIP1, RIP2) (RFC 2453) NAT (many-to-one) (RFC 1631) Compression Control Protocol (RFC 1974) IP Control Protocol (RFC 1332) Certificate Request Message Format (RFC 2511) PPPoE (RFC 2511) Functions: Smart Wizard to automatically detect ISP Address type (static, dynamic, PPPoE), Port Range Forwarding, Exposed Host (DMZ), Enable/Disable WAN Ping, DNS Proxy, MAC Address Cloning/spoofing, NTP support, URL Content Filtering, E-mail Alerts, DHCP Server (Info and display table), PPPoE login client support, Telstra BigPond Cable login support, WAN DHCP Client, Diagnostic tools (ping, trace route, other), Port/service blocking, Auto Uplink on switch ports Maintenance: Save/Restore Configuration, Restore Defaults, Upgrades via Web Browser, Display Statistics, Logging, SYSLOG Hardware Specifications: - Processor: Broadcom BCM MHz MIPS32 - Wireless card: 802.11a and 802.11g - Atheros 5212 - Memory: 4 Mb Flash, 8 Mb DRAM - Power requirements: 12VDC, 1.2A - Dimensions: H: 2.8 cm (1.2"); W: 19 cm (7.5"); D: 13 cm (5.1") - Weight:.73 kg (1.61 lb.) Environmental Specifications: - Operating temperature: 0 to 40C (32 to 104F) - Operating humidity: 90% maximum relative humidity, noncondensing Operating Range^: 802.11b/g Indoor @11 Mbps 30m (100 ft) @5.5 Mbps 50m (165 ft) @2 Mbps 70m (230 ft) @1 Mbps 91m (300 ft) 802.11a Indoor @54 Mbps 18m (60 ft) @6 Mbps 91.4m (300 ft) Warranty: - NETGEAR 3-year warranty ^Actual results will vary depending upon operating environment.

Package Contents

- FWAG114 ProSafe Dual Band Wireless Firewall - Power adapter - 3m (10-ft.) Ethernet cable - Installation guide - Resource CD with FREE anti-virus PC software - Warranty card - Support information card Power Adapter Plug is localized to country of sale
in North America, Australia, Europe, United Kingdom, Japan

System Requirements

- Cable, DSL, satellite or wireless broadband modem and Internet service - Ethernet connectivity from broadband modem - Network card for each connected PC - 802.11a, b, or g wireless network card on each portable PC - Network software (i.e. Windows) - Internet Explorer 5.0 or higher OR - Netscape Navigator 4.7 or higher
4500 Great America Parkway Santa Clara, CA 95054 USA Phone: 1-888-NETGEAR E-mail: info@NETGEAR.com www.NETGEAR.com

2003 NETGEAR, Inc. NETGEAR, the Netgear Logo, the Gear Guy, Auto Uplink, and Everybodys connecting are trademarks or registered trademarks of Netgear, Inc. in the United States and/or other countries. Microsoft, Windows, and the Windows logo are trademarks or registered trademarks of Microsoft Corporation in the United States and/or other countries. Other brand and product names are trademarks or registered trademarks of their respective holders. Information is subject to change without notice. All rights reserved. ***Free basic installation support provided for 90 days from date of purchase; optional premium support available.
Outdoor 152m (500 ft) 270m (885 ft) 396m (1300 ft) 457m (1500 ft) Outdoor 30m (100 ft) 366m (1200 ft)

D-FWAG114-0