NETGEAR RS200 - NETGEAR PROTECTION ENGINE authentication problems

[fbeinfo]

HI all

I'm encountering another PROB with my RS200.

There seems to be a problem with the "protection engine"

as soon as this box is checked means the protection engine "turned on"

it always kicks out my desktop workstation from the network. The computer doesn't get an IP anymore.

For all others in the network (laptops etc.. ) everything works fine.

As soon as i uncheck the box i get an IP and an browse the internet without any problems

When i turn it on again it takes about 20 mins till the Desktop PC looses his IP.

and no matter if i give a fixed IP to my PC or a DHCP.

Anyone an idea?

Software on the RS 200 currently as follows 

Hardware Version	RS200
Firmware Version	V1.0.1.60
GUI Language Version	V1.0.0.449
Protection Engine Version	2.2.214.4/1.0.0.2061
Operation Mode	Router
CPU Load	CPU1: 17.20% CPU2: 17.85% CPU3: 17.17% CPU4: 16.87%
Memory Usage (Used/Total)	607MB/2018MB
Flash Usage (Used/Total)	429MB/512MB

[michaelkenward]

@fbeinfo

it always kicks out my desktop workstation from the network. The computer doesn't get an IP anymore.

For all others in the network (laptops etc.. ) everything works fine.

---

One interpretation of that is that the issue is with the desktop PC rather than the router. Why would the RS200 discriminate against just one device?

Is this a wired or WiFi connection?

Have you run the Network troubleshooter?

Windows likes to protect us from new networks that might be evil. In  reality, it often shuts us out of safe networks.

One thought is that you could tell Windows that you are on a "private network".

• Network and Internet settings
• Network Status
• Change Connection Properties
• Network Profile
• Private

In Windows 11:

Look at the Properties settings

---

Just another user with time on their hands.

[fbeinfo]

The connection s wired, via a lancable coming from the RS200 and goes to a 16 port Netgear switch GS116. From the switch it goes to my PC

[plemans]

I've never seen a great explanation of what the protection engine does. Its KB article just references protecting against specific attacks. 

https://kb.netgear.com/000065906/How-do-I-check-the-Protection-Engine-version-on-my-NETGEAR-router

could be that desktop has something compromised on it or that mimics one of these attacks. Again, not sure what as they aren't specific. 

[michaelkenward]

---

@plemans wrote:

I've never seen a great explanation of what the protection engine does.

---

Me neither. Something to do with Armor?

---

Just another user with time on their hands.

[AJinReno]

I'm having a similar problem with a nighthawk rs500. In my case my ethernet connected  desk computer is fine but my 2 HP laptops (mine and my husband's) can't access the internet when the protection engine is on. With it off they both connect fine. Just looking for some enlightenment as to what the protection engine is and do I need it or how to get it to run and be able to use my laptops. 

[FURRYe38]

What FW is loaded on your RS? 

https://community.netgear.com/t5/Nighthawk-with-WiFi-7-BE/NETGEAR-Nighthawk-Protection-Engine-Featur...

How are your devices connected, ethernet, wirelss or both? 
Brand and model# of devices.

Something NG may need to look into to help ensure PE doesn't affect connected devices and getting full internet access. 

So you may need to leave it OFF if your experiencing problems until NG can check into it.

@BH-C 

[AJinReno]

The firmware version shows as follows. Router Firmware Version V1.0.1.60

I did run the check for updates on the firmware and it said I was up to date.

This is my first Netgear product and honestly, my old router was a Linksys and it was/is 7 years old so I'm in uncharted waters here without a map or knowledge. 

Both of the computers that will not connect to the internet via wifi with the "protection engine" running are HP laptops one is a Specter the other is just a regular old HP - both were trying to use wifi.  With the protection engine on, they simply won't connect and with it off they do.  Simple as that.

I'm really not all that knowledgeable regarding routers and stuff. I'm just an old retired accountant who'd really rather not have to fight with this thing.  Thanks for any insight you can offer. If needed I'll contact Netgear support after the holiday rush has passed but I'd rather know that I haven't disabled something important in order to get online with my laptop.

[BH-C]

Hi @fbeinfo @AJinReno 

Please see the description below for the Router Protection function. When the router detects some malicous behaviors from a connected device, it blocks the traffic from the connected device destined to the router. If a device cannot access the internet because of this, there are two ways to work around the problem:
(1) disable the Router Proteciton function from the router's Web GUI.

(2) on the connected device, set its DNS (Domain Name System) servers to static ones, by default it's set to the router. For Windows devices, you can refer to the article below to change the settings.

https://www.zdnet.com/article/how-to-change-the-dns-settings-on-your-windows-pc-and-why-youd-want-to...

you can use the DNS servers provided from your internet service provider, or you can set to some well-known public DNS servers, for example, 8.8.8.8 from Google as described in the article below (free ones are good enough):

https://www.techradar.com/news/best-dns-server

If a connected device is determined to be a malicious device by the router, it's basically because the connected device is doing someting that looks malicious. We still work to get to the bottom of this.

@fbeinfo, I'm not sure about the symnptoms you mentioned: "doesn't get an IP" or "looses his IP". I will send you a PM to understand more on this.

==================

Router Protection

It protects the router itself from the attacks from the WAN (Internet) side as well as from the LAN side. It blocks malicious probes like port scans  (to the router) and the attacks specifically targeting known vulnerabilities, if there is any, on the router. When a new volnuerability discovered on the router, we will update the protection engine automatically and quickly to prevent the vulnerability from being explored.

[FURRYe38]

@fbeinfo @AJinReno 

Any progress on this?