NETGEAR FVL328 - Cable/DSL ProSafe VPN Firewall... Bedienungsanleitung

NETGEAR VPN Client to NETGEAR FVL328 or FWAG114 VPN Router D-1

202-10015-01

NETGEAR VPN Client

to NETGEAR FVL328 or FWAG114 VPN Router

Follow these procedures to configure a VPN tunnel from a NETGEAR ProSafe VPN Client to an

FVL328. This case study follows the VPN Consortium interoperability profile guidelines. The

configuration options for the FVS328 and FWAG114 are the same.

Configuration Profile

The configuration in this document follows the addressing and configuration mechanics defined

by the VPN Consortium. Gather all the necessary information before you begin the configuration

process. Verify whether the firmware is up to date, all of the addresses that will be necessary, and

all of the parameters that need to be set on both sides. Check that there are no firewall restrictions.

Table D-1. Summary

VPN Consortium Scenario: Scenario 1

Type of VPN PC/Client-to-Gateway

Security Scheme: IKE with Preshared Secret/Key (not Certificate-based)

Date Tested: November 2003

Model/Firmware Tested:

Gateway NETGEAR FVL328 firmware v 1.4 or FWAG114 firmware v 2.1

Client NETGEAR ProSafe VPN Client v10.1

IP Addressing:

Gateway Static IP address

Client Dynamic

Reference Manual for the NETGEAR ProSafe VPN Client

D-2 NETGEAR VPN Client to NETGEAR FVL328 or FWAG114 VPN Router

202-10015-01

Figure D-1: Addressing and Subnet Used for Examples

Step-By-Step Configuration of FVL328 or FWAG114 Gateway

1. Log in to the FVL328 gateway as in the illustration.

Out of the box, the FVL328 is set for its default LAN address of http://192.168.0.1 with its

default user name of admin and default password of password. Even though the remainder of

this document will refer to the FVL328, the login procedures and configuration menu screens

are the same for the FVL328 and the FWAG114.

2. Click IKE Policies under the VPN menu and click Add on the IKE Policies Menu.

Note: Product updates are available on the NETGEAR Web site at

www.netgear.com/support/main.asp. VPNC Interoperability guidelines can be found at

http://www.vpnc.org/InteropProfiles/Interop-01.html.

Gateway

0.0.0.0

66.120.188.153

192.168.0.0

WAN IP WAN IP

LAN IP

Network Addresses

Client

PC with Netgear

ProSafe VPN client

FVL328

Reference Manual for the NETGEAR ProSafe VPN Client

NETGEAR VPN Client to NETGEAR FVL328 or FWAG114 VPN Router D-3

202-10015-01

Figure D-2: NETGEAR FVL328 IKE Policy Configuration

– Enter a descriptive name for the policy in the Policy Name field. This name is not supplied

to the remote VPN Endpoint. It is used to help you manage the IKE policies. In our

example, we used VPNclient as the Policy Name.

– From the Direction/Type drop-down box, select Remote Access

– From the Exchange Mode drop-down box, select Aggressive Mode. This will also be

selected in the NETGEAR ProSafe VPN Client My Identity ID Type fields, as seen in

“Security Policy“ on page D-11.

– From the Local Identity drop-down box, select Fully Qualified Domain Name (the actual

WAN IP address of the FVL328 will also be used in the Connection ID Type fields of the

NETGEAR ProSafe VPN Client as seen in “Security Policy Editor New Connection“ on

page D-9).

– For this example we typed FVL328 in the Local Identity Data field.

– From the Remote Identity drop-down box, select Fully Qualified Domain Name.

–TypeVPNclient in the Remote Identity Data. This will also be entered in the NETGEAR

ProSafe VPN Client My Identity ID Type fields, as seen in “My Identity“ on page D-10.

Reference Manual for the NETGEAR ProSafe VPN Client

D-4 NETGEAR VPN Client to NETGEAR FVL328 or FWAG114 VPN Router

202-10015-01

Figure D-3: NETGEAR FVL328 IKE Policy Configuration

– From the Encryption Algorithm drop-down box, select 3DES. This will also be selected in

the NETGEAR ProSafe VPN Client Security Policy Authentication Phase 1 Proposal 1

Encrypt Alg field, as seen in “Connection Security Policy Authentication (Phase 1)“ on

page D-12.

– From the Authentication Algorithm drop-down box, select SHA-1.This will also be

selected in the NETGEAR ProSafe VPN Client Security Policy Authentication Phase 1

Proposal 1 Hash Alg field, as seen in “Connection Security Policy Authentication (Phase

1)“ on page D-12.

– From the Authentication Method radio button, select Pre-shared Key. This will also be

selected in the NETGEAR ProSafe VPN Client Security Policy Authentication Phase 1

Proposal 1 Authentication Method field, as seen in “Connection Security Policy

Authentication (Phase 1)“ on page D-12.

– In the Pre-Shared Key field, type hr5xb84l6aa9r6. You must make sure the key is the

same for both the FVL328 and the NETGEAR VPN Client. This will also be selected in

the NETGEAR ProSafe VPN Client Security Policy Authentication Phase 1 Proposal 1

Encrypt Alg field, as seen in “Connection Identity Pre-Shared Key“ on page D-11.

– From the Diffie-Hellman (DH) Group drop-down box, select Group 2 (1024 Bit). This

will also be selected in the NETGEAR ProSafe VPN Client Security Policy

Authentication Phase 1 Proposal 1 Key Group field, as seen in “Connection Security

Policy Authentication (Phase 1)“ on page D-12.

–IntheSALifeTime field, type 86400.

Click Apply. This will bring you back to the IKE Policies Menu.The FVL328 IKE Policy is

now displayed in the IKE Policies page.

Reference Manual for the NETGEAR ProSafe VPN Client

NETGEAR VPN Client to NETGEAR FVL328 or FWAG114 VPN Router D-5

202-10015-01

3. Click the VPN Policies link under the VPN category on the left side of the main menu. This

will take you to the VPN Policies Menu page. Click Add Auto Policy. This will open a new

screen titled VPN – Auto Policy.

Figure D-4: NETGEAR FVL328 VPN – Auto Policy General settings

– Enter a unique name to identify this policy. This name is not supplied to the remote VPN

endpoint. In our example we have used to318 as the Policy Name. In the Policy Name

field type VPNclient.

– From the IKE policy drop-down box, select VPNclient which is the IKE Policy that was

set up in the earlier step.

– From the Remote VPN Endpoint Address Type drop-down box, select IP Address.

–Type0.0.0.0 as the Address Data of the client because we are assuming the remote PC will

have a dynamically assigned IP address. This will also be entered in the NETGEAR

ProSafe VPN Client Internal Network IP Address field, as seen in “My Identity“ on page

D-10.

–Type86400 in the SA Life Time (Seconds) field.

–Type0 in the SA Life Time (Kbytes) field.

– Check the IPSec PFS checkbox to enable Perfect Forward Secrecy. This will also be

entered in the NETGEAR ProSafe VPN Client Security Policy Enable Perfect Forward

Secrecy checkbox, as seen in “Security Policy“ on page D-11.

– From the PFS Key Group drop-down box, select Group 2 (1024 Bit). This will also be

entered in the NETGEAR ProSafe VPN Client Security Policy PFS Key Group

drop-down selection box, as seen in “Security Policy“ on page D-11.

Reference Manual for the NETGEAR ProSafe VPN Client

D-6 NETGEAR VPN Client to NETGEAR FVL328 or FWAG114 VPN Router

202-10015-01

Figure D-5: NETGEAR FVL328 VPN – Auto Policy Traffic Selector

– From the Traffic Selector Local IP drop-down box, select Subnet addresses. This will

also be entered in the NETGEAR ProSafe VPN Client Connection Remote Party Identity

and Addressing ID Type field, as seen in “Security Policy Editor New Connection“ on

page D-9.

– Type the starting LAN IP Address of the FVL328 in the Local IP Start IP Address field.

For this example, we used 192.168.0.0 which is the default LAN IP address of the

FVL328.This will also be entered in the NETGEAR ProSafe VPN Client Connection

Remote Party Identity and Addressing Subnet field, as seen in “Security Policy Editor

New Connection“ on page D-9.

– Type the LAN Subnet Mask of the FVL328 (255.255.255.0 in our example) in the Local

IP Subnet Mask field. This will also be entered in the NETGEAR ProSafe VPN Client

Connection Remote Party Identity and Addressing Mask field, as seen in “Security Policy

Editor New Connection“ on page D-9.

– From the Traffic Selector Remote IP drop-down box, select Single addresses.

–Type0.0.0.0 as the start IP Address of the in the Remote IP Start IP Address field because

we are assuming the remote PC will have a dynamically assigned IP address. This will

also be entered in the NETGEAR ProSafe VPN Client My Identity Internal Network IP

Address field, as seen in “My Identity“ on page D-10.

Reference Manual for the NETGEAR ProSafe VPN Client

NETGEAR VPN Client to NETGEAR FVL328 or FWAG114 VPN Router D-7

202-10015-01

Figure D-6: NETGEAR FVL328 VPN – Auto Policy ESP Configuration

– Select Enable Encryption in the ESP Configuration Enable Encryption checkbox. This

will also be entered in the NETGEAR ProSafe VPN Client Security Policy Key Exchange

(Phase 2) Encapsulation Protocol (ESP) checkbox, as seen in “Connection Security Policy

Key Exchange (Phase 2)“ on page D-13.

– From the ESP Configuration Encryption Algorithm drop-down box, select 3DES. This

will also be entered in the NETGEAR ProSafe VPN Client Security Policy Key Exchange

(Phase 2) Encrypt Alg field, as seen in “Connection Security Policy Key Exchange (Phase

2)“ on page D-13.

– Select Enable Authentication in the ESP Configuration Enable Authentication checkbox.

Note: Do not confuse this with the Authentication Protocol (AH) option. Using the AH

option will prevent clients behind a home NAT router from connecting.

– From the ESP Configuration Authentication Algorithm drop-down box, select SHA-1.

This will also be entered in the NETGEAR ProSafe VPN Client Security Policy Key

Exchange (Phase 2) Hash Alg field, as seen in “Connection Security Policy Key Exchange

(Phase 2)“ on page D-13.

– Select NETBIOS Enable in the NETBIOS Enable checkbox to enable networking

features like Windows Network Neighborhood.

Click Apply to save your changes. You will be taken back to the VPN Policies Menu page.

4. When the screen returns to the VPN Policies, make sure the Enable checkbox is selected.

Click Apply to save your changes.

Reference Manual for the NETGEAR ProSafe VPN Client

D-8 NETGEAR VPN Client to NETGEAR FVL328 or FWAG114 VPN Router

202-10015-01

Step-By-Step Configuration of the NETGEAR VPN Client B

This procedure describes linking a remote PC and a LAN. The LAN will connect to the Internet

using an FVL328 with a static IP address. The PC can be directly connected to the Internet through

dialup, cable or DSL modem, or other means, and we will assume it has a dynamically assigned IP

address.

1. Install the NETGEAR VPN Client Software on the PC.

• You may need to insert your Windows CD to complete the installation.

• Reboot your PC after installing the client software.

Note: The NETGEAR ProSafe VPN Client has the ability to “Import” a predefined

configuration profile. The FVL328.SPD file on the NETGEAR ProSafe VPN Client

Resource CD (230-10007-01) includes all the settings identified in this procedure.

Whenever importing policy settings, you should first export any existing settings you

may have configured to prevent the new imported settings from replacing an existing

working configuration.

To import this policy, use the Security Policy Editor File menu to select Import Policy,

and select the FVL328.SPD file at D:\Software\Policies where D is the drive letter of

your CD-ROM drive.

Note: Before installing the NETGEAR ProSafe VPN Client software, be sure to turn off

any virus protection or firewall software you may be running on your PC.

Reference Manual for the NETGEAR ProSafe VPN Client

NETGEAR VPN Client to NETGEAR FVL328 or FWAG114 VPN Router D-9

202-10015-01

2. Configure the Connection Network Settings.

Figure D-7: Security Policy Editor New Connection

a. Run the Security Policy Editor program and create a VPN Connection.

Figure D-8: Security Policy Editor Options menu

Note: If the configuration settings on this screen are not available for editing, go to the

Options menu, select Secure, and Specified Options to enable editing of these settings.

From the Edit menu of the Security Policy Editor, click Add, then Connection. A “New

Connection” listing appears. Rename the “New Connection” to FVL328.

b. Assure that the following settings are configured:

– In the Connection Security box, Secure is selected

Reference Manual for the NETGEAR ProSafe VPN Client

D-10 NETGEAR VPN Client to NETGEAR FVL328 or FWAG114 VPN Router

202-10015-01

– In the Protocol menu, All is selected

– The Connect using Secure Gateway Tunnel checkbox is checked

c. In this example, select IP Subnet as the ID Type, 192.168.0.0 in the Subnet field (the

Subnet address is the LAN IP Address of the FVL328 with 0 as the last number), and

255.255.255.0 in the Mask field, which is the LAN Subnet Mask of the FVL328

d. In the ID Type menus, select Domain Name and Gateway IP Address. Enter FVL328 in

the Domain Name field. In this example, 66.120.188.153 would be used for the Gateway

IP Address, which is the static IP address for the FVL328 WAN port.

3. Configure the Connection Identity Settings.

a. In the Network Security Policy list, click the My Identity subheading.

Figure D-9: My Identity

In this example, select Domain Name as the ID Type, and enter VPNclient. Also, accept

the default Internal Network IP Address of 0.0.0.0.

Figure D-10: My Identity Pre-Shared Key

b. Click Pre-Shared Key.

Andere Handbücher für FVL328 - Cable/DSL ProSafe VPN Firewall...

Dieses Handbuch passt für folgende Modelle

Inhaltsverzeichnis

Andere NETGEAR Netzwerk-Router Handbücher

NETGEAR

NETGEAR PR2000 Bedienungsanleitung

NETGEAR

NETGEAR RH348 Bedienungsanleitung

NETGEAR

NETGEAR WNDR4500 Bedienungsanleitung

NETGEAR

NETGEAR FVS328 - ProSafe VPN Firewall Bedienungsanleitung

NETGEAR

NETGEAR Super-G WGT624 Benutzerhandbuch

NETGEAR

NETGEAR RP114 Bedienungsanleitung

NETGEAR

NETGEAR RAXE500 Bedienungsanleitung

NETGEAR

NETGEAR WGE101 Bedienungsanleitung

NETGEAR

NETGEAR Nighthawk AX6 Bedienungsanleitung

NETGEAR

NETGEAR MR1100EE Bedienungsanleitung

NETGEAR

NETGEAR D3600 Bedienungsanleitung

NETGEAR

NETGEAR Nighthawk R6700v3 Bedienungsanleitung

NETGEAR

NETGEAR N450 WNR2500 Bedienungsanleitung

NETGEAR

NETGEAR FR314 Bedienungsanleitung

NETGEAR

NETGEAR DG834Gv3 - 54 Mbps Wireless ADSL Firewall... Bedienungsanleitung

NETGEAR

NETGEAR MR814 - 802.11b Cable/DSL Wireless Router Bedienungsanleitung

NETGEAR

NETGEAR RP614 v2 Bedienungsanleitung

NETGEAR

NETGEAR RM356 - Router - EN Bedienungsanleitung

NETGEAR

NETGEAR RBRE960 Bedienungsanleitung

NETGEAR

NETGEAR FVX538v1 - ProSafe VPN Firewall Dual WAN Bedienungsanleitung

NETGEAR

NETGEAR ProSafe FVX538 Montage- und Bedienungsanleitung

NETGEAR

NETGEAR GS908E Bedienungsanleitung

NETGEAR

NETGEAR JFS516NA Bedienungsanleitung

NETGEAR

NETGEAR XR500 Nighthawk Bedienungsanleitung

Beliebte Netzwerk-Router Handbücher anderer Marken

Allnet

Allnet ALL0333AU Bedienungsanleitung

HomeSeer

HomeSeer HT-SEL Bedienungsanleitung

Sercomm

Sercomm Genesis OC3505D Bedienungsanleitung

Billion

Billion BIPAC 5102 Series Bedienungsanleitung

TP-Link

TP-Link TD-8817 Bedienungsanleitung

Motorola

Motorola MR1900 Bedienungsanleitung

Digi

Digi IX14 Bedienungsanleitung

Cisco

Cisco NCS 540 Handbuch

XAVi

XAVi X8821e Bedienungsanleitung

BEC

BEC 6200WZL Bedienungsanleitung

MikroTik

MikroTik hAP ac3 Series Bedienungsanleitung

Korenix

Korenix JetNet 5428G Series Bedienungsanleitung

Automated Logic

Automated Logic ZN551 Betriebsanleitung

Cisco

Cisco ASR 1000 Series Bedienerhandbuch

EnGenius

EnGenius ESR-9710 Bedienungsanleitung

Cisco

Cisco 805 Series Bedienungs- und Sicherheitshinweise

LevelOne

LevelOne FBR-1416 Bedienungsanleitung

Dynacord

Dynacord Promatrix 6000 Bedienungsanleitung