NETGEAR DGFV338 - ProSafe Wireless ADSL Modem VPN Firewall... Handbuch

Version 1.0

Hub and Spoke VPN using the VPN Prosafe Client

This document describes the steps to undertake in configuring a Hub-and-Spoke network over

the Internet using VPNs (box-to-box and client-to-box).

In particular it describes how to allow VPN clients (Spoke) to access Remote LANs (Spokes) via

a single VPN connection to a central (Hub) Firewall/Router.

The configuration can apply to any of the VPN Firewall/Router from firmware version 3.5.0.24 and

above, and VPN clients from version 10.8.3 and above.

The diagram below shows a typical scenario.

Internet

Spoke 2

192.168.0.x/24

VPN Box to Box connection

VPN Client to Box connection (mode config)

LAN2

LAN1

Client connection to LAN 2 via VPN Client connection to LAN1

FVS338 (Spoke 1)

Public IP: 83.71.251.20

LAN IP : 172.22.102.102

VPN Information:

BoxToBox (To FVX538)

LAN2toClient (FVS338 To VPN clients via FVX538)

FVX538

Public IP: 83.71.251.19

LAN IP: 172.22.101.101

VPN Information:

BoxToBox (To FVS338)

LAN1toVPN (FVX538 To VPN clients)

LAN2toClient (VPN Clients to FVS338 via FVX538)

LAN1

Version 1.0

Table of Contents

NETWORK SETUP.......................................................................................................... 3

Physical setup............................................................................................................... 3

Logical setup................................................................................................................. 3

Configuration of VPN policies on the Firewall/Routers.............................................. 4

FVX538 VPN Config (Policy name: BoxtoBox)....................................................... 4

FVS338 VPN Config (Policy name: BoxtoBox)....................................................... 4

FVX538 VPN Config (Policy name: LAN1toVPN)................................................... 5

FVX538 VPN Config (Policy name: LAN2Client).................................................... 6

FVS338 VPN Config (Policy name: LAN2Client).................................................... 6

VPN client configuration.................................................................................................. 7

Testing the connection.................................................................................................... 8

Version 1.0

NETWORK SETUP

Physical setup

FVX538 connected to the Internet via a modem or modem/router

FVS338 connected to the Internet via a modem or modem/router

VPN Client PCs connected Wireless/Wired to the Internet (via a LAN allowing IPSEC

traffic)

Logical setup

FVX538

LAN IP: 172.22.101.101/24

DHCP: 172.22.101.0/24

Mode Config DHCP: 192.168.0.0/24

Firmware version: 3.5.0.24

FVS338

LAN IP: 172.22.102.102/24

DHCP: 172.22.102.0/24

Firmware version: 3.5.0.24

VPN Client

Version: 10.8.3

NIC IP: 192.168.0.x/24

VPN configuration

The setup will require the creation of multiple VPN policies:

FVX538

- 1x Box-to-box policy from the FVX538 to the FVS338 (Policy name: BoxtoBox)

- 1x Client-to-Box policy on the FVX538 to connect to the VPN clients (Policy name:

LAN1toVPN)

- 1x Manual VPN policy using the IKE policy used for the box-to-box connection to

allow the VPN clients to connect to the LAN behind the FVS338 (Policy name:

LAN2toClient)

FVS338

- 1x Box-to-box policy from the FVS338 to the FVX538 (Policy name: BoxtoBox)

- 1x Manual VPN policy using the IKE policy used for the box-to-box connection to

allow the FVS338 to connect to the VPN clients (Policy name: LAN2toClient)

VPN Client

- 1x Policy connecting to the Public address of the FVS338 specifying as the IP range

for the Remote party 172.22.0.0 mask 255.255.0.0 (class full only mask accepted)

Version 1.0

Configuration of VPN policies on the Firewall/Routers

FVX538 VPN Config (Policy name: BoxtoBox)

Access the VPN Wizard via the VPN

configuration page.

Configure the Connection name (for

admin reasons this will match the

FVS338 box as BoxtoBox).

❶Input the pre-shared key.

Configure the Public or DNS address of

the Remote location, and the LAN details

(the Remote LAN IP address is intended

as the subnet address).

Click on Apply

FVS338 VPN Config (Policy name: BoxtoBox)

Access the VPN Wizard via the VPN

configuration page.

Configure the Connection name (for

admin reasons this will match the other

box as BoxtoBox).

Input the pre-shared key as at point ❶

Configure the Public or DNS address of

the Remote location, and the LAN details

(the Remote LAN IP address is intended

as the subnet address).

Click on Apply

❶

Version 1.0

FVX538 VPN Config (Policy name: LAN1toVPN)

Access the VPN Wizard via the VPN

configuration page.

Create a new VPN client policy named

LAN1toVPN (with any pre-shared key)

Take note of the Remote and Local

identifier whether using the default ones

or new ones.

Click on Apply

Edit the LAN1toVPN.

Change the Local IP setting to any and

the Remote IP to subnet, modifying the

Start IP address to 192.168.0.0 with

subnet mask 255.255.255.0

Click on Apply

Version 1.0

FVX538 VPN Config (Policy name: LAN2Client)

Access the VPN Wizard via the VPN

configuration page.

In the VPN Policy section click on Add

(this will create a new manual VPN policy

which will use an existing IKE policy)

Create a new VPN client policy named

LAN2toClient

Specify the Remote Endpoint IP address

to be the Public address of the FVS338

Specify the Local IP subnet to be the one

of the VPN clients as 192.168.0.0/24 and

the Remote IP subnet to be the LAN of

the FVS338 as 172.22.102.0/24

Ensure that the Select IKE Policy is set to

BoxtoBox

Click on Apply

FVS338 VPN Config (Policy name: LAN2Client)

Access the VPN Wizard via the VPN

configuration page.

In the VPN Policy section click on Add

(this will create a new manual VPN policy

which will use an existing IKE policy)

Create a new VPN client policy named

LAN2toClient

Specify the Remote Endpoint IP address

to be the Public address of the FVX538

Specify the Local IP subnet to be the one

of the FVS338 172.22.102.0/24 and the

Remote IP subnet to be the VPN clients

one 192.168.0.0/24

Ensure that the Select IKE Policy is set to

BoxtoBox

Click on Apply

Version 1.0

VPN client configuration

This configuration requires advanced IP address planning. The VPN client policy needs to be

able to address both Local Area Network #1 and Local Area Network #2 in the same client policy

profile, therefore, the two networks must be presentable as one subnet or one address range.

This has been considered in our scenario.

Create a new VPN client policy

Specify the Remote Party ID type as IP

Subnet and the subnet and mask as

172.22.0.0 255.255.255.0 (this will

address both LAN1 and LAN2)

The gateway IP address will be specified

at the WAN address of the FVX538 in our

case

In My identity change the pre-shared key

to match the VPN policy LAN1toVPN

created on the FVX538 (12345678)

Set the Virtual adapter as Required as

specify a unique value for the Internal

network IP address (this will be different

on each PC running the VPN client

In the Security policy section ensure the

Phase 1 negotiation mode is set to

aggressive , PFS is enabled and Enable

Replay Detection is ticked

Version 1.0

Testing the connection

VPN Client

From the VPN client run ipconfig to

confirm once the VPN is established that

the Virtual adapter interface is assigned

with the IP address specified in the policy

(in this case 192.168.0.1 )

Test the VPN connection to both the

FVX538 and FVS338 by pinging each

box LAN IP address

FVS338

From Monitoring, Diagnostic on the

FVS338 ping the VPN client IP address

1902.168.0.1

Andere Handbücher für DGFV338 - ProSafe Wireless ADSL Modem VPN Firewall...

Dieses Handbuch passt für folgende Modelle

Inhaltsverzeichnis

Andere NETGEAR Netzwerk-Router Handbücher

NETGEAR

NETGEAR RP614 v2 Bedienungsanleitung

NETGEAR

NETGEAR DGN2200 - Wireless-N 300 Router Bedienungsanleitung

NETGEAR

NETGEAR RP614 - Web Safe Router Bedienungsanleitung

NETGEAR

NETGEAR DM111PSP - ADSL2+ Ethernet Modem Bedienungsanleitung

NETGEAR

NETGEAR WNDR3800 - N600 WIRELESS DUAL BAND GIGABIT ROUTER-Premium... Bedienungsanleitung

NETGEAR

NETGEAR Nighthawk AC2600 Bedienungsanleitung

NETGEAR

NETGEAR JFS516GE Bedienungsanleitung

NETGEAR

NETGEAR DGN2000 - Wireless Router Bedienungsanleitung

NETGEAR

NETGEAR Nighthawk X4S AC2600 Bedienungsanleitung

NETGEAR

NETGEAR Wireless-N 150 Bedienungsanleitung

NETGEAR

NETGEAR MCA1001v2 Bedienungsanleitung

NETGEAR

NETGEAR WNR2000v2 - Wireless- N 300 Router Bedienungsanleitung

NETGEAR

NETGEAR Orbi RBR20 Bedienungsanleitung

NETGEAR

NETGEAR RAXE500 Bedienungsanleitung

NETGEAR

NETGEAR Nighthawk R7450 Bedienungsanleitung

NETGEAR

NETGEAR WNDR4500 Bedienungsanleitung

NETGEAR

NETGEAR WGE101 Bedienungsanleitung

NETGEAR

NETGEAR 208-10026-01 Benutzerhandbuch

NETGEAR

NETGEAR WNR3500L - RangeMax Wireless-N Gigabit... Bedienungsanleitung

NETGEAR

NETGEAR RP614 v4 Referenzhandbuch

NETGEAR

NETGEAR RT338 RT338 RT338 Bedienungsanleitung

NETGEAR

NETGEAR GS908 Bedienungsanleitung

NETGEAR

NETGEAR ProSafe GS108v3 Bedienungsanleitung

NETGEAR

NETGEAR MR814 v3 Bedienungsanleitung

Beliebte Netzwerk-Router Handbücher anderer Marken

Allnet

Allnet ALL0333AU Bedienungsanleitung

HomeSeer

HomeSeer HT-SEL Bedienungsanleitung

Sercomm

Sercomm Genesis OC3505D Bedienungsanleitung

Billion

Billion BIPAC 5102 Series Bedienungsanleitung

TP-Link

TP-Link TD-8817 Bedienungsanleitung

Motorola

Motorola MR1900 Bedienungsanleitung

Digi

Digi IX14 Bedienungsanleitung

Cisco

Cisco NCS 540 Handbuch

XAVi

XAVi X8821e Bedienungsanleitung

BEC

BEC 6200WZL Bedienungsanleitung

MikroTik

MikroTik hAP ac3 Series Bedienungsanleitung

Korenix

Korenix JetNet 5428G Series Bedienungsanleitung

Automated Logic

Automated Logic ZN551 Betriebsanleitung

Cisco

Cisco ASR 1000 Series Bedienerhandbuch

EnGenius

EnGenius ESR-9710 Bedienungsanleitung

Cisco

Cisco 805 Series Bedienungs- und Sicherheitshinweise

LevelOne

LevelOne FBR-1416 Bedienungsanleitung

Dynacord

Dynacord Promatrix 6000 Bedienungsanleitung