NETGEAR DGFV338 - ProSafe Wireless ADSL Modem VPN Firewall... Betriebsanleitung

Version 2.0

Using certificates as authentication method for VPN connections between

Netgear ProSafe Routers and the ProSafe VPN Client

This document describes how to use certificates as an authentication method when establishing a

VPN Client-to-Box connection.

Version 2.0

Preliminary notes:

If for your particular deployment you are not using an external CA (Certificate Authority) you will

need to create your own CA. Some alternatives on how to achieve this are outlined below, but

they are not exclusive to other methods:

1- OpenSSL: http://www.openssl.org,

2- SimpleCA: http://www.vpnc.org/SimpleCA/

3- Microsoft’s IIS

For purpose of this document we used:

1- OpenSSL which could be downloaded from the following link:

http://www.slproweb.com/products/Win32OpenSSL.html

2- Additionally you will need to install the Perl interpreter. We used ActivePerl which can be

downloaded from here: http://www.activestate.com/Products/activeperl/index.mhtml

Version 2.0

Creating your own Certificate Authority with OpenSSL

1- In first step you need to create your own CA. To do that, follow the instructions

documented in here: http://sandbox.rulemaker.net/ngps/m2/howto.ca.html

2- Netgear doesn’t support ST relative distinguish name so please edit the openssl.cfg (in

the original location and in your new CA folder) to avoid using this parameter.

3- From the guide linked above, you need only to execute all the commands up to step 4.

The certificate request step and beyond will be handled by the router.

4- Next – please generate Self Certificate Request specifying the following parameters:

1- Name: first

2- Subject: CN=router1

3- Hash Algorithm: MD5

4- Signature Algorithm: RSA

5- Signature Key Length: 1024

6- Click on Generate

5- Click on: “View” for generated certificate request to check its values:

Copy all the information from

the Data to supply to CA field

to the text file router1.csr

Version 2.0

6- Sign your certificate request using your newly created CA:

Openssl x509 -req -days 365 -in router1.csr -CA cacert.crt -CAkey cakey.pem -CAcreateserial -

out router1.crt

router1.csr – generated self certificate request (router),

cacert.crt – CA certification,

cakey.pem – CA keys,

router1.crt – signed certificate (router).

7- Load CA certificate: “cacert.crt” and your signed certificate: “router1.crt” on your

device. They now should display like this:

8- Reboot your router.

Version 2.0

9- Next – generate certificate request using Certificate Manager which is built-in

functionality of Netgear’s ProSafe VPN Client following these steps:

First, click on Request Certificate.

Then, click on ‘Yes’ when you get the file-

based request prompt.

For last, input the settings like instructed

in the screenshot.

Note: Do not change file extension in client software. Change the whole filename after

creating a certificate request instead.

Version 2.0

10- Rename the generated certificate request from:”CertReq.req” to “client1.csr”.

11- Sign your certificate request using your newly created CA:

openssl x509 -req -days 365 -in client1.csr -CA cacert.crt -CAkey cakey.pem -CAcreateserial -out

client1.crt

client1.csr – generated self certificate request (client),

cacert.crt – CA certification,

cakey.pem – CA keys,

client1.crt – signed certificate (client).

12- Install CA certificate: “cacert.crt” in your system. If you are using Microsoft Windows

just select: “Install” from files’ context menu.

13- Load your signed certificate using the Certificate Manager:

Version 2.0

14- Create a new VPN connection according to these steps:

First, input your own details in

the same way that is instructed

here and click on Edit Name.

Verify your settings are input

correctly in this screen and

click on OK.

Select the correct certificate,

leave the ID Type as

Distinguished Name.

Virtual adapter should be

specified as: “Required” to

allow using of virtual adapter

interface on the client.

Version 2.0

In the Security Policy section,

verify your settings match

those in this screenshot.

For the “Proposal 1” of the

Authentication phase (Phase 1),

the Authentication Method

should be RSA Signatures.

The Key Exchange Proposal

should be correct by default,

but check it to make sure it

matches the settings on the

screenshot nonetheless.

Version 2.0

1. Create IKE and VPN policies on your router using VPN Wizard.

2. Delete the VPN Policy, leaving the IKE policy.

3. Create new record for Mode Config in the following way:

Note: IP address ranges defined in: First, Second and Third Pool should be different then

router’s own LAN IP address range.

4. Modify your IKE Policy according to the following settings:

Andere Handbücher für DGFV338 - ProSafe Wireless ADSL Modem VPN Firewall...

Dieses Handbuch passt für folgende Modelle

Inhaltsverzeichnis

Andere NETGEAR Netzwerk-Router Handbücher

NETGEAR

NETGEAR JWNR3000 Bedienungsanleitung

NETGEAR

NETGEAR Nighthawk R7450 Bedienungsanleitung

NETGEAR

NETGEAR PR2000 Bedienungsanleitung

NETGEAR

NETGEAR XE102 - Wall-Plugged EN Bridge Bedienungsanleitung

NETGEAR

NETGEAR Orbi RBR20 Bedienungsanleitung

NETGEAR

NETGEAR Super-G WGT624 Benutzerhandbuch

NETGEAR

NETGEAR MBR1515 Bedienungsanleitung

NETGEAR

NETGEAR ProSafe Plus FS116E Bedienungsanleitung

NETGEAR

NETGEAR Nighthawk CAX30 Bedienungsanleitung

NETGEAR

NETGEAR Orbi Bedienungsanleitung

NETGEAR

NETGEAR R6300 Bedienungsanleitung

NETGEAR

NETGEAR GS908E Bedienungsanleitung

NETGEAR

NETGEAR FS308 - Switch Bedienungsanleitung

NETGEAR

NETGEAR DGFV338 - ProSafe Wireless ADSL Modem VPN Firewall... Handbuch

NETGEAR

NETGEAR GC510P Handbuch

NETGEAR

NETGEAR C3700 Bedienerhandbuch

NETGEAR

NETGEAR R9000 Bedienungsanleitung

NETGEAR

NETGEAR FVS328 - ProSafe VPN Firewall Bedienungsanleitung

NETGEAR

NETGEAR Nighthawk AC1900 D7000v2 Bedienungsanleitung

NETGEAR

NETGEAR JNR3210 Bedienungsanleitung

NETGEAR

NETGEAR DG834 - ADSL Firewall Router Technisches Datenblatt

NETGEAR

NETGEAR GC110 Bedienungsanleitung

NETGEAR

NETGEAR N750 Bedienungsanleitung

NETGEAR

NETGEAR VPN Bedienungsanleitung

Beliebte Netzwerk-Router Handbücher anderer Marken

Allnet

Allnet ALL0333AU Bedienungsanleitung

HomeSeer

HomeSeer HT-SEL Bedienungsanleitung

Sercomm

Sercomm Genesis OC3505D Bedienungsanleitung

Billion

Billion BIPAC 5102 Series Bedienungsanleitung

TP-Link

TP-Link TD-8817 Bedienungsanleitung

Motorola

Motorola MR1900 Bedienungsanleitung

Digi

Digi IX14 Bedienungsanleitung

Cisco

Cisco NCS 540 Handbuch

XAVi

XAVi X8821e Bedienungsanleitung

BEC

BEC 6200WZL Bedienungsanleitung

MikroTik

MikroTik hAP ac3 Series Bedienungsanleitung

Korenix

Korenix JetNet 5428G Series Bedienungsanleitung

Korenix

Korenix JetNet 5710G Series Bedienungsanleitung

Automated Logic

Automated Logic ZN551 Betriebsanleitung

Cisco

Cisco ASR 1000 Series Bedienerhandbuch

EnGenius

EnGenius ESR-9710 Bedienungsanleitung

Cisco

Cisco 805 Series Bedienungs- und Sicherheitshinweise

LevelOne

LevelOne FBR-1416 Bedienungsanleitung