Netgear STM150 User manual

350 East Plumeria Drive

San Jose, CA 95134

USA

October 2012

202-10780-03

v1.0

ProSecure Unified Threat

Management (UTM)

Appliance

Reference Manual

2

ProSecure Unified Threat Management (UTM) Appliance

Support

Thank you for choosing NETGEAR.

After installing your device, locate the serial number on the label of your product and use it to register your product

at https://my.netgear.com. You must register your product before you can use NETGEAR telephone support.

NETGEAR recommends registering your product through the UTM’s Registration screen (see Register the UTM

with NETGEAR on page 65). You can also register your product through the NETGEAR website. For product

updates and web support, visit http://support.netgear.com.

Phone (US & Canada only): 1-888-NETGEAR.

Phone (Other Countries): Check the list of phone numbers at

http://support.netgear.com/general/contact/default.aspx.

NETGEAR recommends that you use only the official NETGEAR support resources.

Trademarks

NETGEAR, the NETGEAR logo, and Connect with Innovation are trademarks and/or registered trademarks of

NETGEAR, Inc. and/or its subsidiaries in the United States and/or other countries. Information is subject to change

without notice. Other brand and product names are registered trademarks or trademarks of their respective

ProSecure Product Updates

Product updates are available on the NETGEAR website at http://prosecure.netgear.com or

http://support.netgear.com.

ProSecure Forum

Visit http://prosecure.netgear.com/community/forum.php for information about the ProSecure forum and to

become part of the ProSecure community.

Revision History

Publication

Part Number

Version Publish Date Comments

202-10780-03 1.0 October 2012 • Added the UTM25S, which supports the same features as

the UTM9S.

• Stated support for the NETGEAR Network Management

System NMS200.

• Updated the figures and menu paths in Chapter 6, Content

Filtering and Optimizing Scans, because the Application

Security configuration menu of the web management

interface was revised and several minor features were

added.

• Added Configure HTTPS Smart Block.

•Revised Use a Simple Network Management Protocol

Manager because new SNMP features, including support

for SNMPv3, were added.

•Revised Chapter 11, Monitor System Access and

Performance because several minor features were added.

• Updated Appendix B, Wireless Network Module for the

UTM9S and UTM25S, because the wireless network

module now supports four wireless security profiles and

the Wireless Settings configuration menu of the web

management interface was revised.

3

ProSecure Unified Threat Management (UTM) Appliance

202-10780-03

(continued)

1.0

(continued)

October 2012

(continued)

• Added Appendix C, 3G/4G Dongles for the UTM9S and

UTM25S.

• Added many more default values to Appendix H, Default

Settings and Technical Specifications.

202-10780-02 2.0 May 2012 • Updated the main navigation menus and configuration

menus for many figures in the manual to show consistency

in the presentation of the web management interface

(GUI).

• Updated the outbound rules overview (see Table 27) and

inbound rules overview (Table 28).

• Updated Features That Reduce Traffic and Features That

Increase Traffic.

202-10780-02 1.0 April 2012 • Added new features for all UTM models:

- Application control (see Configure Application Control)

- Traffic metering for LAN usage (see Create Traffic

Meter Profiles)

- The use of custom user groups in firewall rules (see

Overview of Rules to Block or Allow Specific Kinds of

Traffic and VLAN Rules)

Application control and traffic metering also affect the way

that firewall rules are implemented (see Overview of Rules

to Block or Allow Specific Kinds of Traffic)

• Added support of the following features for all UTM models

(these features were previously supported on the UTM9S

only):

- ReadyNAS integration, quarantine options, and

quarantine logs (see Connect to a ReadyNAS and

Configure Quarantine Settings, Query and Manage the

Quarantine Logs, and Appendix E, ReadyNAS

Integration)

- PPTP server (see Configure the PPTP Server)

- L2TP server (see Configure the L2TP Server)

• Revised the following existing features:

- Firewall scheduling (see Set a Schedule to Block or

Allow Specific Traffic and Overview of Rules to Block or

Allow Specific Kinds of Traffic)

- IPS (see Enable and Configure the Intrusion

Prevention System)

- System status, dashboard, and report functions (see

Chapter 11, Monitor System Access and Performance)

- Diagnostics (see Use Diagnostics Utilities)

• Reorganized the web management interface (GUI) menus

(for example, the Email Notification configuration menu

link has been moved to the Monitoring main menu; the

Custom Groups configuration menu link has been moved

to the Users main menu)

4

ProSecure Unified Threat Management (UTM) Appliance

202-10780-01 1.0 September 2011 • Added the UTM9S with the following major new features:

- xDSL module (see Chapter 1, Introduction and Chapter

3, Manually Configure Internet and WAN Settings)

- Wireless module (see Chapter 1, Introduction and

Appendix B, Wireless Network Module for the UTM9S

and UTM25S)

- ReadyNAS integration, quarantine options, and

quarantine logs (see Connect to a ReadyNAS and

Configure Quarantine Settings, Query and Manage the

Quarantine Logs, and Appendix E, ReadyNAS

Integration)

- PPTP server (see Configure the PPTP Server)

- L2TP server (see Configure the L2TP Server)

• Updated the VPN client sections with the new VPN client

(see Chapter 7, Virtual Private Networking

Using IPSec, PPTP, or L2TP Connections)

202-10674-02 1.0 March 2011 • Added the UTM150.

• Removed the platform-specific chapters and sections

because the UTM5, UTM10, and UTM25 now support the

same web management interface menu layout that was

already supported on the UTM50. The major changes for

the UTM5, UTM10, and UTM25 are documented in

Chapter 3, Manually Configure Internet and WAN Settings,

and in the following sections:

- Set Exception Rules for Web and Application Access

- Configure Authentication Domains, Groups, and Users

• Added new features (for all UTM models). The major new

features are documented in the following sections:

- Electronic Licensing

- VLAN Rules

- Create Service Groups

- Create IP Groups

- Manage SSL Certificates for HTTPS Scanning

- Update the Firmware

- View, Schedule, and Generate Reports

202-10674-01 1.0 September 2010 • Added the UTM50 and UTM50-specific chapters and

sections.

• Revised the DMZ WAN and LAN DMZ default policies.

202-10482-03 1.0 May 2010 • Applied numerous nontechnical edits.

• Added the Requirements for Entering IP Addresses

section.

• Added a note about the processing of normal email traffic

in the Configure Distributed Spam Analysis section.

• Updated the NTP section.

202-10482-02 1.0 January 2010 Updated the web management interface screens, made the

manual platform-independent, added a model comparison

table, and removed performance specifications (see marketing

documentation for such specifications).

202-10482-01 1.0 September 2009 Initial publication of this reference manual.

5

Contents

Chapter 1 Introduction

What Is the ProSecure Unified Threat Management (UTM) Appliance? . .15

Key Features and Capabilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .16

Multiple WAN Port Models for Increased Reliability or

Outbound Load Balancing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .17

Wireless Features. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .18

DSL Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .18

Advanced VPN Support for Both IPSec and SSL. . . . . . . . . . . . . . . . . .18

A Powerful, True Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .19

Stream Scanning for Content Filtering . . . . . . . . . . . . . . . . . . . . . . . . . .19

Security Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .20

Autosensing Ethernet Connections with Auto Uplink . . . . . . . . . . . . . . .20

Extensive Protocol Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .21

Easy Installation and Management . . . . . . . . . . . . . . . . . . . . . . . . . . . .21

Maintenance and Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .22

Model Comparison . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .22

Service Registration Card with License Keys. . . . . . . . . . . . . . . . . . . . . . .23

Package Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .24

Hardware Features. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .24

Front Panel UTM5 and UTM10 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .25

Front Panel UTM25 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .26

Front Panel UTM50 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .26

Front Panel UTM150 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .27

Front Panel UTM9S and UTM25S and Network Modules . . . . . . . . . . .28

LED Descriptions, UTM5, UTM10, UTM25, UTM50, and UTM150 . . . .30

LED Descriptions, UTM9S, UTM25S, and their Network Modules. . . . .32

Rear Panel UTM5, UTM10, and UTM25 . . . . . . . . . . . . . . . . . . . . . . . .33

Rear Panel UTM50 and UTM150. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .34

Rear Panel UTM9S and UTM25S . . . . . . . . . . . . . . . . . . . . . . . . . . . . .35

Bottom Panels with Product Labels . . . . . . . . . . . . . . . . . . . . . . . . . . . .36

Choose a Location for the UTM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .39

Use the Rack-Mounting Kit. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .40

Chapter 2 Use the Setup Wizard to Provision the UTM in Your

Network

Steps for Initial Connection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .41

Qualified Web Browsers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .42

Requirements for Entering IP Addresses. . . . . . . . . . . . . . . . . . . . . . . .42

Log In to the UTM. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .42

6

ProSecure Unified Threat Management (UTM) Appliance

Web Management Interface Menu Layout. . . . . . . . . . . . . . . . . . . . . . . . .44

Use the Setup Wizard to Perform the Initial Configuration. . . . . . . . . . . . .47

Setup Wizard Step 1 of 10: LAN Settings. . . . . . . . . . . . . . . . . . . . . . . .48

Setup Wizard Step 2 of 10: WAN Settings. . . . . . . . . . . . . . . . . . . . . . .51

Setup Wizard Step 3 of 10: System Date and Time. . . . . . . . . . . . . . . .54

Setup Wizard Step 4 of 10: Services . . . . . . . . . . . . . . . . . . . . . . . . . . .55

Setup Wizard Step 5 of 10: Email Security. . . . . . . . . . . . . . . . . . . . . . .57

Setup Wizard Step 6 of 10: Web Security . . . . . . . . . . . . . . . . . . . . . . .58

Setup Wizard Step 7 of 10: Web Categories to Be Blocked. . . . . . . . . .60

Setup Wizard Step 8 of 10: Email Notification . . . . . . . . . . . . . . . . . . . .62

Setup Wizard Step 9 of 10: Signatures & Engine. . . . . . . . . . . . . . . . . .63

Setup Wizard Step 10 of 10: Saving the Configuration . . . . . . . . . . . . .64

Register the UTM with NETGEAR . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .65

Use the Web Management Interface to Activate Licenses. . . . . . . . . . .65

Electronic Licensing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .67

Automatic Retrieval of Licenses after a Factory Default Reset . . . . . . .67

Verify Correct Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .68

Test Connectivity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .68

Test HTTP Scanning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .68

What to Do Next. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .68

Chapter 3 Manually Configure Internet and WAN Settings

Internet and WAN Configuration Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . .71

Automatically Detecting and Connecting the Internet Connections . . . . . .71

Manually Configure the Internet Connection . . . . . . . . . . . . . . . . . . . . . . .75

Configure the WAN Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .80

Overview of the WAN Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .80

Configure Network Address Translation (All Models). . . . . . . . . . . . . . .81

Configure Classical Routing (All Models). . . . . . . . . . . . . . . . . . . . . . . .82

Configure Auto-Rollover Mode and the Failure Detection

Method (Multiple WAN Port Models) . . . . . . . . . . . . . . . . . . . . . . . . . . .82

Configure Load Balancing and Optional Protocol Binding

(Multiple WAN Port Models). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .85

Configure Secondary WAN Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . .89

Configure Dynamic DNS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .91

Set the UTM’s MAC Address and Configure Advanced WAN Options . . .94

Additional WAN-Related Configuration Tasks . . . . . . . . . . . . . . . . . . . . . .97

Chapter 4 LAN Configuration

Manage Virtual LANs and DHCP Options . . . . . . . . . . . . . . . . . . . . . . . . .98

Port-Based VLANs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .99

Assign and Manage VLAN Profiles . . . . . . . . . . . . . . . . . . . . . . . . . . .100

VLAN DHCP Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .101

Configure a VLAN Profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .103

Configure VLAN MAC Addresses and Advanced LAN Settings. . . . . .108

Configure Multihome LAN IP Addresses on the Default VLAN . . . . . . . .109

Manage Groups and Hosts (LAN Groups). . . . . . . . . . . . . . . . . . . . . . . .111

7

ProSecure Unified Threat Management (UTM) Appliance

Manage the Network Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .112

Change Group Names in the Network Database . . . . . . . . . . . . . . . . .115

Set Up Address Reservation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .116

Configure and Enable the DMZ Port . . . . . . . . . . . . . . . . . . . . . . . . . . . .117

Manage Routing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .121

Configure Static Routes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .121

Configure Routing Information Protocol . . . . . . . . . . . . . . . . . . . . . . . .123

Static Route Example. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .126

Chapter 5 Firewall Protection

About Firewall Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .127

Administrator Tips. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .128

Overview of Rules to Block or Allow Specific Kinds of Traffic . . . . . . . . .128

Outbound Rules (Service Blocking) . . . . . . . . . . . . . . . . . . . . . . . . . . .129

Inbound Rules (Port Forwarding) . . . . . . . . . . . . . . . . . . . . . . . . . . . . .133

Order of Precedence for Rules. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .138

Configure LAN WAN Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .139

Create LAN WAN Outbound Service Rules . . . . . . . . . . . . . . . . . . . . .140

Create LAN WAN Inbound Service Rules . . . . . . . . . . . . . . . . . . . . . .141

Configure DMZ WAN Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .142

Create DMZ WAN Outbound Service Rules. . . . . . . . . . . . . . . . . . . . .144

Create DMZ WAN Inbound Service Rules . . . . . . . . . . . . . . . . . . . . . .144

Configure LAN DMZ Rules. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .145

Create LAN DMZ Outbound Service Rules . . . . . . . . . . . . . . . . . . . . .147

Create LAN DMZ Inbound Service Rules. . . . . . . . . . . . . . . . . . . . . . .147

Examples of Firewall Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .148

Inbound Rule Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .148

Outbound Rule Example. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .153

Configure Other Firewall Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .154

VLAN Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .154

Attack Checks, VPN Pass-through, and Multicast Pass-through . . . . .157

Set Session Limits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .160

Manage the Application Level Gateway for SIP Sessions and

VPN Scanning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .161

Create Services, QoS Profiles, Bandwidth Profiles, and

Traffic Meter Profiles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .162

Add Customized Services. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .163

Create Service Groups. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .165

Create IP Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .167

Create Quality of Service Profiles. . . . . . . . . . . . . . . . . . . . . . . . . . . . .169

Create Bandwidth Profiles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .171

Create Traffic Meter Profiles. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .174

Set a Schedule to Block or Allow Specific Traffic. . . . . . . . . . . . . . . . . . .177

Enable Source MAC Filtering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .179

Set Up IP/MAC Bindings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .181

Configure Port Triggering. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .183

Configure Universal Plug and Play. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .186

Enable and Configure the Intrusion Prevention System. . . . . . . . . . . . . .187

8

ProSecure Unified Threat Management (UTM) Appliance

Chapter 6 Content Filtering and Optimizing Scans

About Content Filtering and Scans. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .192

Default Email and Web Scan Settings . . . . . . . . . . . . . . . . . . . . . . . . .193

Configure Email Protection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .194

Customize Email Protocol Scan Settings. . . . . . . . . . . . . . . . . . . . . . .194

Customize Email Antivirus and Notification Settings . . . . . . . . . . . . . .196

Email Content Filtering. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .199

Protect Against Email Spam. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .202

Configure Web and Services Protection . . . . . . . . . . . . . . . . . . . . . . . . .210

Customize Web Protocol Scan Settings. . . . . . . . . . . . . . . . . . . . . . . .210

Configure HTTPS Smart Block. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .212

Configure Web Malware or Antivirus Scans. . . . . . . . . . . . . . . . . . . . .216

Configure Web Content Filtering . . . . . . . . . . . . . . . . . . . . . . . . . . . . .218

Configure Web URL Filtering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .224

Configure HTTPS Scanning and SSL Certificates. . . . . . . . . . . . . . . . . .228

How HTTPS Scanning Works . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .228

Configure the HTTPS Scan Settings . . . . . . . . . . . . . . . . . . . . . . . . . .230

Manage SSL Certificates for HTTPS Scanning . . . . . . . . . . . . . . . . . .231

Specify Trusted Hosts for HTTPS Scanning . . . . . . . . . . . . . . . . . . . .235

Configure the SSL Settings for HTTPS Scanning . . . . . . . . . . . . . . . .237

Configure FTP Scanning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .238

Customize FTP Antivirus Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . .238

Configure FTP Content Filtering. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .239

Configure Application Control. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .240

Set Exception Rules for Web and Application Access. . . . . . . . . . . . . . .248

Create Custom Categories for Exceptions for Web and

Application Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .258

Set Scanning Exclusions for IP Addresses and Ports . . . . . . . . . . . . . . .262

Chapter 7 Virtual Private Networking

Using IPSec, PPTP, or L2TP Connections

Considerations for Dual WAN Port Systems

(Multiple WAN Port Models Only). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .264

Use the IPSec VPN Wizard for Client and Gateway Configurations . . . .266

Create Gateway-to-Gateway VPN Tunnels with the Wizard . . . . . . . .266

Create a Client-to-Gateway VPN Tunnel . . . . . . . . . . . . . . . . . . . . . . .271

Test the Connection and View Connection and Status Information. . . . .287

Test the NETGEAR VPN Client Connection . . . . . . . . . . . . . . . . . . . .287

NETGEAR VPN Client Status and Log Information . . . . . . . . . . . . . . .289

View the UTM IPSec VPN Connection Status . . . . . . . . . . . . . . . . . . .289

View the UTM IPSec VPN Log. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .290

Manage IPSec VPN and IKE Policies . . . . . . . . . . . . . . . . . . . . . . . . . . .291

Manage IKE Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .292

Manage VPN Policies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .300

Configure Extended Authentication (XAUTH) . . . . . . . . . . . . . . . . . . . . .308

Configure XAUTH for VPN Clients. . . . . . . . . . . . . . . . . . . . . . . . . . . .309

User Database Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .310

9

ProSecure Unified Threat Management (UTM) Appliance

RADIUS Client and Server Configuration. . . . . . . . . . . . . . . . . . . . . . .310

Assign IP Addresses to Remote Users (Mode Config). . . . . . . . . . . . . . .312

Mode Config Operation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .312

Configure Mode Config Operation on the UTM . . . . . . . . . . . . . . . . . .312

Configure the ProSafe VPN Client for Mode Config Operation . . . . . .319

Test the Mode Config Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . .326

Modify or Delete a Mode Config Record. . . . . . . . . . . . . . . . . . . . . . . .327

Configure Keep-Alives and Dead Peer Detection . . . . . . . . . . . . . . . . . .328

Configure Keep-Alives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .328

Configure Dead Peer Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .329

Configure NetBIOS Bridging with IPSec VPN . . . . . . . . . . . . . . . . . . . . .330

Configure the PPTP Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .331

View the Active PPTP Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .333

Configure the L2TP Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .334

View the Active L2TP Users. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .336

For More IPSec VPN Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .336

Chapter 8 Virtual Private Networking

Using SSL Connections

SSL VPN Portal Options. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .337

Build a Portal Using the SSL VPN Wizard . . . . . . . . . . . . . . . . . . . . . . . .338

SSL VPN Wizard Step 1 of 6 (Portal Settings). . . . . . . . . . . . . . . . . . .339

SSL VPN Wizard Step 2 of 6 (Domain Settings) . . . . . . . . . . . . . . . . .342

SSL VPN Wizard Step 3 of 6 (User Settings). . . . . . . . . . . . . . . . . . . .347

SSL VPN Wizard Step 4 of 6 (Client IP Addresses and Routes) . . . . .348

SSL VPN Wizard Step 5 of 6 (Port Forwarding). . . . . . . . . . . . . . . . . .350

SSL VPN Wizard Step 6 of 6 (Verify and Save Your Settings). . . . . . .351

Access the New SSL VPN Portal . . . . . . . . . . . . . . . . . . . . . . . . . . . . .353

View the UTM SSL VPN Connection Status. . . . . . . . . . . . . . . . . . . . .356

View the UTM SSL VPN Log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .357

Manually Configure and Modify SSL Portals . . . . . . . . . . . . . . . . . . . . . .357

Manually Create or Modify the Portal Layout . . . . . . . . . . . . . . . . . . . .359

Configure Domains, Groups, and Users. . . . . . . . . . . . . . . . . . . . . . . .362

Configure Applications for Port Forwarding . . . . . . . . . . . . . . . . . . . . .363

Configure the SSL VPN Client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .365

Use Network Resource Objects to Simplify Policies. . . . . . . . . . . . . . .369

Configure User, Group, and Global Policies. . . . . . . . . . . . . . . . . . . . .371

For More SSL VPN Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .377

Chapter 9 Manage Users, Authentication, and VPN Certificates

Authentication Process and Options . . . . . . . . . . . . . . . . . . . . . . . . . . . .378

Configure Authentication Domains, Groups, and Users. . . . . . . . . . . . . .380

Login Portals. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .380

Active Directories and LDAP Configurations . . . . . . . . . . . . . . . . . . . .384

Configure Domains. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .388

Configure Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .394

Configure Custom Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .397

10

ProSecure Unified Threat Management (UTM) Appliance

Configure User Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .401

Set User Login Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .404

Change Passwords and Other User Settings. . . . . . . . . . . . . . . . . . . .408

DC Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .409

Configure RADIUS VLANs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .415

Configure Global User Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .416

View and Log Out Active Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .417

Manage Digital Certificates for VPN Connections . . . . . . . . . . . . . . . . . .419

VPN Certificates Screen. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .420

Manage CA Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .421

Manage Self-Signed Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . .422

Manage the Certificate Revocation List . . . . . . . . . . . . . . . . . . . . . . . .426

Chapter 10 Network and System Management

Performance Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .428

Bandwidth Capacity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .428

Features That Reduce Traffic. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .429

Features That Increase Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .432

Use QoS and Bandwidth Assignments to Shift the Traffic Mix. . . . . . .435

Monitoring Tools for Traffic Management. . . . . . . . . . . . . . . . . . . . . . .436

System Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .436

Change Passwords and Administrator and Guest Settings . . . . . . . . .436

Configure Remote Management Access . . . . . . . . . . . . . . . . . . . . . . .438

Use a Simple Network Management Protocol Manager. . . . . . . . . . . .440

Manage the Configuration File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .445

Update the Firmware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .448

Update the Scan Signatures and Scan Engine Firmware . . . . . . . . . .454

Configure Date and Time Service . . . . . . . . . . . . . . . . . . . . . . . . . . . .456

Connect to a ReadyNAS and Configure Quarantine Settings . . . . . . . . .458

Log Storage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .459

Connect to a ReadyNAS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .459

Configure the Quarantine Settings. . . . . . . . . . . . . . . . . . . . . . . . . . . .460

Chapter 11 Monitor System Access and Performance

Enable the WAN Traffic Meter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .462

Configure Logging, Alerts, and Event Notifications . . . . . . . . . . . . . . . . .466

Configure the Email Notification Server . . . . . . . . . . . . . . . . . . . . . . . .466

Configure and Activate System, Email, and Syslog Logs. . . . . . . . . . .467

How to Send Syslogs over a VPN Tunnel between Sites . . . . . . . . . .471

Configure and Activate Update Failure and Attack Alerts . . . . . . . . . .473

Configure and Activate Firewall Logs. . . . . . . . . . . . . . . . . . . . . . . . . .476

Monitor Real-Time Traffic, Security, and Statistics . . . . . . . . . . . . . . . . .477

Monitor Application Use in Real Time . . . . . . . . . . . . . . . . . . . . . . . . . . .483

View Status Screens . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .486

View the System Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .486

View the Active VPN Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .499

View the VPN Tunnel Connection Status. . . . . . . . . . . . . . . . . . . . . . .500

11

ProSecure Unified Threat Management (UTM) Appliance

View the Active PPTP and L2TP Users . . . . . . . . . . . . . . . . . . . . . . . .501

View the Port Triggering Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .502

View the WAN, xDSL, or USB Port Status . . . . . . . . . . . . . . . . . . . . . .504

View Attached Devices and the DHCP Leases . . . . . . . . . . . . . . . . . .505

Query and Manage the Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .507

Overview of the Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .508

Query and Download Logs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .509

Example: Use the Logs to Identify Infected Clients . . . . . . . . . . . . . . .513

Log Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .514

Query and Manage the Quarantine Logs . . . . . . . . . . . . . . . . . . . . . . . . .514

Query the Quarantined Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .515

View and Manage the Quarantined Spam Table . . . . . . . . . . . . . . . . .517

View and Manage the Quarantined Infected Files Table . . . . . . . . . . .518

Spam Reports for End Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .519

View, Schedule, and Generate Reports. . . . . . . . . . . . . . . . . . . . . . . . . .520

Enable Application Session Monitoring . . . . . . . . . . . . . . . . . . . . . . . .521

Report Filtering Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .522

Use Report Templates and View Reports Onscreen . . . . . . . . . . . . . .524

Schedule, Email, and Manage Reports . . . . . . . . . . . . . . . . . . . . . . . .529

Use Diagnostics Utilities. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .531

Use the Network Diagnostic Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . .532

Use the Real-Time Traffic Diagnostics Tool. . . . . . . . . . . . . . . . . . . . .533

Gather Important Log Information and Generate a

Network Statistics Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .534

Perform Maintenance on the USB Device, Reboot the UTM,

or Shut Down the UTM. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .536

Chapter 12 Troubleshoot and Use Online Support

Basic Functioning. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .539

Verify the Correct Sequence of Events at Startup . . . . . . . . . . . . . . . .539

Power LED Not On. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .539

Test LED Never Turns Off . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .539

LAN or WAN Port LEDs Not On . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .540

Troubleshoot the Web Management Interface. . . . . . . . . . . . . . . . . . . . .540

When You Enter a URL or IP Address, a Time-Out Error Occurs . . . . . .541

Troubleshoot the ISP Connection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .541

Troubleshoot a TCP/IP Network Using a Ping Utility . . . . . . . . . . . . . . . .543

Test the LAN Path to Your UTM. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .543

Test the Path from Your Computer to a Remote Device . . . . . . . . . . .544

Restore the Default Configuration and Password . . . . . . . . . . . . . . . . . .545

Problems with Date and Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .546

Use Online Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .546

Enable Remote Troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . . . . . .546

Send Suspicious Files to NETGEAR for Analysis . . . . . . . . . . . . . . . .547

Access the Knowledge Base and Documentation . . . . . . . . . . . . . . . .548

12

ProSecure Unified Threat Management (UTM) Appliance

Appendix A xDSL Network Module for the UTM9S and UTM25S

xDSL Network Module Configuration Tasks. . . . . . . . . . . . . . . . . . . . . . .550

Configure the xDSL Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .550

Automatically Detecting and Connecting the xDSL Internet Connection .553

Manually Configure the xDSL Internet Connection . . . . . . . . . . . . . . . . .556

Configure the WAN Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .561

Overview of the WAN Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .561

Configure Network Address Translation. . . . . . . . . . . . . . . . . . . . . . . .562

Configure Classical Routing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .563

Configure Auto-Rollover Mode and the Failure Detection Method. . . .563

Configure Load Balancing and Optional Protocol Binding . . . . . . . . . .566

Configure Secondary WAN Addresses . . . . . . . . . . . . . . . . . . . . . . . . . .570

Configure Dynamic DNS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .572

Set the UTM’s MAC Address and Configure Advanced WAN Options . .574

Additional WAN-Related Configuration Tasks . . . . . . . . . . . . . . . . . . . . .577

Appendix B Wireless Network Module for the UTM9S and UTM25S

Overview of the Wireless Network Module. . . . . . . . . . . . . . . . . . . . . . . .579

Configuration Order . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .579

Wireless Equipment Placement and Range Guidelines. . . . . . . . . . . .579

Configure the Basic Radio Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . .580

Operating Frequency (Channel) Guidelines. . . . . . . . . . . . . . . . . . . . .583

Wireless Data Security Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .584

Wireless Security Profiles. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .585

Before You Change the SSID, WEP, and WPA Settings. . . . . . . . . . .587

Configure and Enable Wireless Profiles. . . . . . . . . . . . . . . . . . . . . . . .588

Restrict Wireless Access by MAC Address . . . . . . . . . . . . . . . . . . . . .593

View the Access Point Status and Connected Clients

for a Wireless Profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .595

Configure a Wireless Distribution System . . . . . . . . . . . . . . . . . . . . . . . .596

Configure Advanced Radio Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . .598

Configure WMM QoS Priority Settings. . . . . . . . . . . . . . . . . . . . . . . . . . .600

Test Basic Wireless Connectivity. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .602

For More Information About Wireless Configurations . . . . . . . . . . . . . . .602

Appendix C 3G/4G Dongles for the UTM9S and UTM25S

3G/4G Dongle Configuration Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . .603

Manually Configure the USB Internet Connection . . . . . . . . . . . . . . . . . .604

Configure the 3G/4G Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .608

Configure the WAN Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .610

Overview of the WAN Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .611

Configure Network Address Translation. . . . . . . . . . . . . . . . . . . . . . . .612

Configure Classical Routing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .613

Configure Load Balancing and Optional Protocol Binding . . . . . . . . . .614

Configure Dynamic DNS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .618

Additional WAN-Related Configuration Tasks . . . . . . . . . . . . . . . . . . . . .621

13

ProSecure Unified Threat Management (UTM) Appliance

Appendix D Network Planning for Dual WAN Ports

(Multiple WAN Port Models Only)

What to Consider Before You Begin. . . . . . . . . . . . . . . . . . . . . . . . . . . . .622

Plan Your Network and Network Management and Set Up Accounts .622

Cabling and Computer Hardware Requirements . . . . . . . . . . . . . . . . .624

Computer Network Configuration Requirements . . . . . . . . . . . . . . . . .624

Internet Configuration Requirements . . . . . . . . . . . . . . . . . . . . . . . . . .624

Overview of the Planning Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .626

Inbound Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .627

Inbound Traffic to a Single WAN Port System . . . . . . . . . . . . . . . . . . .628

Inbound Traffic to a Dual WAN Port System . . . . . . . . . . . . . . . . . . . .628

Virtual Private Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .629

VPN Road Warrior (Client-to-Gateway) . . . . . . . . . . . . . . . . . . . . . . . .630

VPN Gateway-to-Gateway . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .633

VPN Telecommuter (Client-to-Gateway through a NAT Router) . . . . .635

Appendix E ReadyNAS Integration

Supported ReadyNAS Models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .638

Install the UTM Add-On on the ReadyNAS . . . . . . . . . . . . . . . . . . . . . . .639

Connect to the ReadyNAS on the UTM . . . . . . . . . . . . . . . . . . . . . . . . . .641

Appendix F Two-Factor Authentication

Why Do I Need Two-Factor Authentication? . . . . . . . . . . . . . . . . . . . . . .644

What Are the Benefits of Two-Factor Authentication? . . . . . . . . . . . . .644

What Is Two-Factor Authentication?. . . . . . . . . . . . . . . . . . . . . . . . . . .645

NETGEAR Two-Factor Authentication Solutions . . . . . . . . . . . . . . . . . . .645

Appendix G System Logs and Error Messages

System Log Messages. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .649

System Startup. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .649

Reboot . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .649

NTP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .650

Login/Logout. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .650

Firewall Restart. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .651

IPSec Restart . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .651

WAN Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .651

Traffic Metering Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .655

Unicast, Multicast, and Broadcast Logs . . . . . . . . . . . . . . . . . . . . . . . .655

Invalid Packet Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .656

Service Logs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .658

Content-Filtering and Security Logs. . . . . . . . . . . . . . . . . . . . . . . . . . . . .658

Web Filtering and Content-Filtering Logs. . . . . . . . . . . . . . . . . . . . . . .659

Spam Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .660

Traffic Logs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .661

Malware Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .661

14

ProSecure Unified Threat Management (UTM) Appliance

Email Filter Logs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .661

IPS Logs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .662

Anomaly Behavior Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .662

Application Logs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .663

Routing Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .663

LAN-to-WAN Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .663

LAN-to-DMZ Logs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .664

DMZ-to-WAN Logs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .664

WAN-to-LAN Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .664

DMZ-to-LAN Logs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .665

WAN-to-DMZ Logs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .665

Appendix H Default Settings and Technical Specifications

Default Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .666

Physical and Technical Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . .673

Appendix I Notification of Compliance (Wired)

Appendix J Notification of Compliance (Wireless)

Index

15

1

1. Introduction

This chapter provides an overview of the features and capabilities of the NETGEAR ProSecure®

Unified Threat Management (UTM) Appliance. This chapter contains the following sections:

• What Is the ProSecure Unified Threat Management (UTM) Appliance?

• Key Features and Capabilities

• Service Registration Card with License Keys

• Package Contents

• Hardware Features

• Choose a Location for the UTM

Note: For more information about the topics covered in this manual, visit the

Support website at http://support.netgear.com.

Note: Firmware updates with new features and bug fixes are made

available from time to time at downloadcenter.netgear.com. Some

products can regularly check the site and download new firmware,

or you can check for and download new firmware manually. If the

features or behavior of your product do not match what is described

in this guide, you might need to update your firmware.

What Is the ProSecure Unified Threat Management (UTM)

Appliance?

The ProSecure Unified Threat Management (UTM) Appliance, hereafter referred to as the

UTM, connects your local area network (LAN) to the Internet through one or two external

broadband access devices such as cable modems, DSL modems, satellite dishes, or

wireless ISP radio antennas, or a combination of those. Dual wide area network (WAN) ports

allow you to increase the effective data rate to the Internet by utilizing both WAN ports to

Introduction

16

ProSecure Unified Threat Management (UTM) Appliance

carry session traffic, or to maintain a backup connection in case of failure of your primary

Internet connection.

As a complete security solution, the UTM combines a powerful, flexible firewall with a content

scan engine that uses NETGEAR Stream Scanning technology to protect your network from

denial of service (DoS) attacks or distributed DoS (DDoS) attacks, unwanted traffic, traffic

with objectionable content, spam, phishing, and web-borne threats such as spyware, viruses,

and other malware threats.

The UTM provides advanced IPSec and SSL VPN technologies for secure and simple

remote connections. The use of Gigabit Ethernet LAN and WAN ports ensures high data

transfer speeds.

The UTM is a plug-and-play device that can be installed and configured within minutes.

Key Features and Capabilities

• Multiple WAN Port Models for Increased Reliability or Outbound Load Balancing

• Wireless Features

• DSL Features

• Advanced VPN Support for Both IPSec and SSL

• A Powerful, True Firewall

• Stream Scanning for Content Filtering

• Security Features

• Autosensing Ethernet Connections with Auto Uplink

• Extensive Protocol Support

• Easy Installation and Management

• Maintenance and Support

• Model Comparison

The UTM provides the following key features and capabilities:

• For the single WAN port models, a single 10/100/1000 Mbps Gigabit Ethernet WAN port.

For the multiple WAN port models, dual or quad 10/100/1000 Mbps Gigabit Ethernet

WAN ports for load balancing or failover protection of your Internet connection, providing

increased system reliability or increased data rate.

• Built-in four- or six-port 10/100/1000 Mbps Gigabit Ethernet LAN switch for fast data

transfer between local network resources.

• Wireless network module (UTM9S and UTM25S only) for either 2.4-GHz or 5-GHz

wireless modes.

• xDSL network module (UTM9S and UTM25S only) for ADSL and VDSL.

• 3G/4G dongle (UTM9S and UTM25S only) for wireless connection to an ISP.

• Advanced IPSec VPN and SSL VPN support.

Introduction

17

ProSecure Unified Threat Management (UTM) Appliance

• Depending on the model, bundled with a one-user license of the NETGEAR ProSafe

VPN Client software (VPN01L).

• Advanced stateful packet inspection (SPI) firewall with multi-NAT support.

• Patent-pending Stream Scanning technology that enables scanning of real-time protocols

such as HTTP.

• Comprehensive web and email security, covering six major network protocols: HTTP,

HTTPS, FTP, SMTP, POP3, and IMAP.

• Malware database containing hundreds of thousands of signatures of spyware, viruses,

and other malware threats.

• Very frequently updated malware signatures, hourly if necessary. The UTM can

automatically check for new malware signatures as frequently as every 15 minutes.

• Multiple antispam technologies to provide extensive protection against unwanted mail.

• Application control for multiple categories of applications and individual applications to

safeguard data, protect users, and enhance productivity.

• Easy, web-based wizard setup for installation and management.

• SNMP manageable with support for SNMPv1, SNMPv2, and SNMPv3.

• Support for the NETGEAR Network Management System NMS200.

• Front panel LEDs for easy monitoring of status and activity.

• Flash memory for firmware upgrade.

• Internal universal switching power supply.

Multiple WAN Port Models for Increased Reliability or

Outbound Load Balancing

The UTM product line offers models with two broadband WAN ports. The second WAN port

allows you to connect a second broadband Internet line that can be configured on a mutually

exclusive basis to:

• Provide backup and rollover if one line is inoperable, ensuring that you are never

disconnected.

• Load balance, or use both Internet lines simultaneously for outgoing traffic. A UTM with

dual WAN ports balances users between the two lines for maximum bandwidth efficiency.

See Appendix D, Network Planning for Dual WAN Ports (Multiple WAN Port Models Only) for

the planning factors to consider when implementing the following capabilities with dual WAN

port gateways:

• Single or multiple exposed hosts

• Virtual private networks

Introduction

18

ProSecure Unified Threat Management (UTM) Appliance

Wireless Features

Wireless client connections are supported on the UTM9S and UTM25S with an NMWLSN

wireless network module installed. The UTM9S and UTM25S support the following wireless

features:

• 2.4-GHz radio and 5-GHz radio. Either 2.4-GHz band support with 802.11b/g/n/ wireless

modes or 5-GHz band support with 802.11a/n wireless modes.

• Wireless security profiles. Support for up to four wireless security profiles, each with its

own SSID.

• WMM QoS priority. Wi-Fi Multimedia (WMM) Quality of Service (QoS) priority settings to

map one of four queues to each Differentiated Services Code Point (DSCP) value.

• Wireless Distribution System (WDS). WDS enables expansion of a wireless network

through two or more access points that are interconnected.

• Access control. The Media Access Control (MAC) address filtering feature can ensure

that only trusted wireless stations can use the UTM to gain access to your LAN.

• Hidden mode. The SSID is not broadcast, assuring that only clients configured with the

correct SSID can connect.

• Secure and economical operation. Adjustable power output allows more secure or

economical operation.

• 3G/4G dongle. Mobile broadband USB adapter for a wireless connection to an ISP.

DSL Features

DSL is supported on the UTM9S and UTM25S with an NMVDSLA or NMVDSLB DSL

network module installed. The UTM9S and UTM25S support the following types of DSL

connections:

• ADSL, ADSL2, and ADSL2+

• VDSL and VDSL2

Annex A, Annex B, and Annex M are supported to accommodate PPPoE, PPPoA, and IPoA

ISP connections.

Advanced VPN Support for Both IPSec and SSL

The UTM supports IPSec and SSL virtual private network (VPN) connections.

• IPSec VPN delivers full network access between a central office and branch offices, or

between a central office and telecommuters. Remote access by telecommuters requires

the installation of VPN client software on the remote computer.

- IPSec VPN with broad protocol support for secure connection to other IPSec

gateways and clients.

- Depending on the model, bundled with a one-user license of the NETGEAR ProSafe

VPN Client software (VPN01L).

Introduction

19

ProSecure Unified Threat Management (UTM) Appliance

• SSL VPN provides remote access for mobile users to selected corporate resources

without requiring a preinstalled VPN client on their computers.

- Uses the familiar Secure Sockets Layer (SSL) protocol, commonly used for

e-commerce transactions, to provide client-free access with customizable user

portals and support for a wide variety of user repositories.

- Allows browser-based, platform-independent remote access through a number of

popular browsers, such as Microsoft Internet Explorer, Mozilla Firefox, and Apple

Safari.

- Provides granular access to corporate resources based on user type or group

membership.

A Powerful, True Firewall

Unlike simple NAT routers, the UTM is a true firewall, using stateful packet inspection (SPI) to

defend against hacker attacks. Its firewall features have the following capabilities:

• DoS protection. Automatically detects and thwarts (distributed) denial of service (DoS)

attacks such as Ping of Death and SYN flood.

• Secure firewall. Blocks unwanted traffic from the Internet to your LAN.

• Schedule policies. Permits scheduling of firewall policies by day and time.

• Logs security incidents. Logs security events such as blocked incoming traffic, port

scans, attacks, and administrator logins. You can configure the firewall to email the log to

you at specified intervals. You can also configure the firewall to send immediate alert

messages to your email address or email pager whenever a significant event occurs.

Stream Scanning for Content Filtering

Stream Scanning is based on the simple observation that network traffic travels in streams.

The UTM scan engine starts receiving and analyzing traffic as the stream enters the network.

As soon as a number of bytes are available, scanning starts. The scan engine continues to

scan more bytes as they become available, while at the same time another thread starts to

deliver the bytes that have been scanned.

This multithreaded approach, in which the receiving, scanning, and delivering processes

occur concurrently, ensures that network performance remains unimpeded. The result is that

file scanning is up to five times faster than with traditional antivirus solutions—a performance

advantage that you really notice.

Stream Scanning also enables organizations to withstand massive spikes in traffic, as in the

event of a malware outbreak. The scan engine has the following capabilities:

• Real-time protection. The patent-pending Stream Scanning technology enables

scanning of previously undefended real-time protocols, such as HTTP. Network activities

susceptible to latency (for example, web browsing) are no longer brought to a standstill.

• Comprehensive protection. Provides both web and email security, covering six major

network protocols: HTTP, HTTPS, FTP, SMTP, POP3, and IMAP. The UTM uses

enterprise-class scan engines employing both signature-based and distributed spam

Introduction

20

ProSecure Unified Threat Management (UTM) Appliance

analysis to stop both known and unknown threats. The malware database contains

hundreds of thousands of signatures of spyware, viruses, and other malware.

• Objectionable traffic protection. The UTM prevents objectionable content from

reaching your computers. You can control access to the Internet content by screening for

web services, web addresses, and keywords within web addresses. You can log and

report attempts to access objectionable Internet sites.

• Application control. The UTM provides application control for entire categories of

applications, individual applications, or a combination of both. You can either globally

allow or block applications or configure custom application control profiles for groups of

users, individual users, or a combination of both. The UTM supports multiple applications.

• Automatic signature updates. Malware signatures are updated as frequently as every

hour, and the UTM can check automatically for new signatures as frequently as every 15

minutes.

Security Features

The UTM is equipped with several features designed to maintain security:

• Computers hidden by NAT. NAT opens a temporary path to the Internet for requests

originating from the local network. Requests originating from outside the LAN are

discarded, preventing users outside the LAN from finding and directly accessing the

computers on the LAN.

• Port forwarding with NAT. Although NAT prevents Internet locations from directly

accessing the computers on the LAN, the UTM allows you to direct incoming traffic to

specific computers based on the service port number of the incoming request. You can

specify forwarding of single ports or ranges of ports.

• DMZ port. Incoming traffic from the Internet is usually discarded by the UTM unless the

traffic is a response to one of your local computers or a service for which you have

configured an inbound rule. Instead of discarding this traffic, you can use the dedicated

demilitarized zone (DMZ) port to forward the traffic to one computer on your network.

Autosensing Ethernet Connections with Auto Uplink

With its internal four- or six-port 10/100/1000 Mbps switch and single or dual

(model-dependant) 10/100/1000 WAN ports, the UTM can connect to either a 10-Mbps

standard Ethernet network, a 100-Mbps Fast Ethernet network, or a 1000-Mbps Gigabit

Ethernet network. The four LAN and one or two WAN interfaces are autosensing and capable

of full-duplex or half-duplex operation.

The UTM incorporates Auto Uplink

TM

technology. Each Ethernet port automatically senses

whether the Ethernet cable plugged into the port should have a normal connection such as to

a computer or an uplink connection such as to a switch or hub. That port then configures itself

correctly. This feature eliminates the need for you to think about crossover cables, as Auto

Uplink accommodates either type of cable to make the right connection.

Page is loading ...

Netgear STM150, STM150EW-100NAS, UTM5EW-100NAS User manual

Related papers

Other documents