Appendix B NETGEAR VPN Configuration DG834GSP to FVL328 This appendix is a case study on how to configure a secure IPSec VPN tunnel from a NETGEAR DG834GSP to a FVL328. This case study follows the VPN Consortium interoperability profile guidelines (found at http://www.vpnc.org/InteropProfiles/Interop-01.html). Configuration Profile The configuration in this document follows the addressing and configuration mechanics defined by the VPN Consortium.
Reference Manual for the ADSL Modem Wireless Router DG834GSP 10.5.6.0/24 172.23.9.0/24 VPNC Example Network Interface Addressing Gateway A LAN IP 10.5.6.1 Gateway B 14.15.16.17 22.23.24.25 WAN IP WAN IP LAN IP 172.23.9.1 FVL328 DG834G Figure B-1 Note: Product updates are available on the NETGEAR, Inc. web site at http://kbserver.netgear.com/DG834GSP.asp. Step-By-Step Configuration 1.
Reference Manual for the ADSL Modem Wireless Router DG834GSP Click VPN Policies under Advanced - VPN to invoke this screen toFVL328 10.5.6.1 172.23.9.1 toFVL328 22.23.24.25 10 5 6 172 23 9 Figure B-2 NETGEAR VPN Configuration B-3 v1.
Reference Manual for the ADSL Modem Wireless Router DG834GSP 2. Configure the FVL328 as in the Gateway-to-Gateway procedures for the VPN Wizard (see “How to Set Up a Gateway-to-Gateway VPN Configuration” on page 8-21), being certain to use appropriate network addresses for the environment. a. In Step 1, enter toDG834 for the Connection Name b. In Step 2, enter 14.15.16.17 for the remote WAN's IP address c. In Step 3, enter the following: • IP Address = 10.5.6.1 • Subnet Mask = 255.255.255.
Reference Manual for the ADSL Modem Wireless Router DG834GSP toDG834 toDG834 22.23.24.25 14.15.16.17 Click IKE Policies under VPN to invoke this screen 22.23.24.25 14.15.16.17 toDG834 172.23.9.1 10.5.6.1 Click VPN Policies under VPN to invoke this screen toDG834 toDG834 14.15.16.17 172 23 9 10 5 6 1 Figure B-3 NETGEAR VPN Configuration B-5 v1.
Reference Manual for the ADSL Modem Wireless Router DG834GSP 3. Test the VPN tunnel by pinging the remote network from a PC attached to the DG834GSP. a. Open the command prompt (Start -> Run -> cmd) b. ping 172.23.9.1 Figure B-4 Note: The pings may fail the first time. If this happens, try the pings a second time.
Reference Manual for the ADSL Modem Wireless Router DG834GSP Table B-2. Profile Summary VPN Consortium Scenario: Scenario 1 Type of VPN LAN-to-LAN or Gateway-to-Gateway (not PC/Client-to-Gateway) Security Scheme: IKE with Preshared Secret/Key (not Certificate-based) IP Addressing: NETGEAR-Gateway A Fully Qualified Domain Name (FQDN) NETGEAR-Gateway B FDQN 10.5.6.0/24 Gateway A WAN IP LAN IP 10.5.6.1 172.23.9.0/24 VPNC Example Network Interface Addressing WAN IP dg834g.dyndns.
Reference Manual for the ADSL Modem Wireless Router DG834GSP The Use of a Fully Qualified Domain Name (FQDN) Many ISPs (Internet Service Providers) provide connectivity to their customers using dynamic instead of static IP addressing. This means that a user’s IP address does not remain constant over time which presents a challenge for gateways attempting to establish VPN connectivity.
Reference Manual for the ADSL Modem Wireless Router DG834GSP 3. On the DG834GSP, configure the Dynamic DNS settings. a. Browse to the Dynamic DNS Setup Screen (see Figure B-6) in the Advanced menu. Figure B-6 b. Configure this screen with appropriate account and hostname settings and then click Apply. • Check the box Use a Dynamic DNS Service. • Host Name = dg834g.dyndns.org • User Name = • Password = c. Click Show Status.
Reference Manual for the ADSL Modem Wireless Router DG834GSP 4. On the FVL328, configure the Dynamic DNS settings. Assume a properly configured DynDNS account. a. Browse to the Dynamic DNS Setup Screen (see Figure B-8) in the Advanced menu. Figure B-8 b. Select the DynDNS.org radio button (see Figure B-8), configure with appropriate account and hostname settings (see Figure B-9), and then click Apply. • Host and Domain Name = fvl328.dyndns.
Reference Manual for the ADSL Modem Wireless Router DG834GSP Figure B-9 c. Click Show Status. The resulting screen should show Update OK: good (see Figure B-10). Figure B-10 NETGEAR VPN Configuration B-11 v1.
Reference Manual for the ADSL Modem Wireless Router DG834GSP 5. Configure the DG834GSP as in the Gateway-to-Gateway procedures using the VPN Wizard (see “How to Set Up a Gateway-to-Gateway VPN Configuration” on page 8-21), being certain to use appropriate network addresses for the environment. The LAN Addresses used in this example are as follows: Device LAN IP Address LAN Subnet Mask DG834GSP 10.5.6.1 255.255.255.0 FVL328 172.23.6.1 255.255.255.0 a.
Reference Manual for the ADSL Modem Wireless Router DG834GSP Figure B-11 Note: The pings may fail the first time. If this happens, try the pings a second time. NETGEAR VPN Configuration B-13 v1.
Reference Manual for the ADSL Modem Wireless Router DG834GSP Configuration Summary (Telecommuter Example) The configuration in this document follows the addressing and configuration mechanics defined by the VPN Consortium. Gather all the necessary information before you begin the configuration process. Verify whether the firmware is up to date, all of the addresses that will be necessary, and all of the parameters that need to be set on both sides. Assure that there are no firewall restrictions. Table B-3.
Reference Manual for the ADSL Modem Wireless Router DG834GSP • Step 2: Configuring the NETGEAR ProSafe VPN Client on the Remote PC at the Telecommuter’s Home Office configures the NETGEAR ProSafe VPN Client endpoint. Step 1: Configuring the Client-to-Gateway VPN Tunnel on the VPN Router at the Employer’s Main Office Follow this procedure to configure a client-to-gateway VPN tunnel by filling out the VPN Auto Policy screen. 1. Log in to the VPN router at its LAN address of http://10.1.1.
Reference Manual for the ADSL Modem Wireless Router DG834GSP fromDG834GSP (in the example) Dynamic IP address IKE Keep Alive is optional; must match Remote LAN IP Address when enabled (remote PC must respond to pings) Subnet address 192.168.0.1 (in this example) 255.255.255.0 Single address 192.168.2.3 (in this example) (Remote NAT router must have Address Reservation set and VPN Passthrough enabled) Main Mode Fully Qualified Domain Name fromDG834G.
Reference Manual for the ADSL Modem Wireless Router DG834GSP 2. Click Apply when done to get the VPN Policies screen. Figure B-14 To view or modify the tunnel settings, select the radio button next to the tunnel entry and click Edit. NETGEAR VPN Configuration B-17 v1.
Reference Manual for the ADSL Modem Wireless Router DG834GSP Step 2: Configuring the NETGEAR ProSafe VPN Client on the Remote PC at the Telecommuter’s Home Office This procedure describes how to configure the 54 Mbps ADSL Modem Wireless Router Model DG834GSP. We will assume the PC running the client has a dynamically assigned IP address. The PC must have a VPN client program installed that supports IPSec (in this case study, the NETGEAR VPN ProSafe Client is used). Go to the NETGEAR website (http://www.
Reference Manual for the ADSL Modem Wireless Router DG834GSP b. From the Edit menu of the Security Policy Editor, click Add, then Connection. A New Connection listing appears in the list of policies. Rename the New Connection so that it matches the Connection Name you entered in the VPN Settings of the DG834GSP on Gateway A.
Reference Manual for the ADSL Modem Wireless Router DG834GSP Figure B-16 c. Select Secure in the Connection Security check-box group. d. Select IP Subnet in the ID Type menu. e. In this example, type 10.1.1.1 in the Subnet field as the network address of the DG834GSP. f. Enter 255.255.255.0 in the Mask field as the LAN Subnet Mask of the DG834GSP. g. Select All in the Protocol menu to allow all traffic through the VPN tunnel. h. Select the Connect using Secure Gateway Tunnel check box. i.
Reference Manual for the ADSL Modem Wireless Router DG834GSP b. Click on the Security Policy subheading to show the Security Policy menu. Figure B-17 c. Select the Main Mode in the Select Phase 1 Negotiation Mode check box. 4. Configure the VPN Client Identity. In this step, you will provide information about the remote VPN client PC. You will need to provide the Pre-Shared Key that you configured in the DG834GSP and either a fixed IP address or a “fixed virtual” IP address of the VPN client PC.
Reference Manual for the ADSL Modem Wireless Router DG834GSP a. In the Network Security Policy list on the left side of the Security Policy Editor window, click My Identity. Figure B-18 b. Choose None in the Select Certificate menu. c. Select Domain Name in the ID Type menu and enter toDG834G.com (in this example) in the box below it. Choose Disabled in the Virtual Adapter menu. d.
Reference Manual for the ADSL Modem Wireless Router DG834GSP e. Click the Pre-Shared Key button. Figure B-19 f. In the Pre-Shared Key dialog box, click the Enter Key button. Enter the DG834GSP's Pre-Shared Key and click OK. In this example, 12345678 is entered. This field is case sensitive. 5. Configure the VPN Client Authentication Proposal. In this step, you will provide the type of encryption (DES or 3DES) to be used for this connection.
Reference Manual for the ADSL Modem Wireless Router DG834GSP Figure B-20 c. In the Authentication Method menu, select Pre-Shared key. d. In the Encrypt Alg menu, select the type of encryption. In this example, use Triple DES. e. In the Hash Alg menu, select SHA-1. f. In the SA Life menu, select Unspecified. g. In the Key Group menu, select Diffie-Hellman Group 2. 6. Configure the VPN Client Key Exchange Proposal.
Reference Manual for the ADSL Modem Wireless Router DG834GSP a. Expand the Key Exchange subheading by double clicking its name or clicking on the “+” symbol. Then select Proposal 1 below Key Exchange. Figure B-21 b. In the SA Life menu, select Unspecified. c. In the Compression menu, select None. d. Check the Encapsulation Protocol (ESP) checkbox. e. In the Encrypt Alg menu, select the type of encryption. In this example, use Triple DES. f. In the Hash Alg menu, select SHA-1. g.
Reference Manual for the ADSL Modem Wireless Router DG834GSP To check the VPN Connection, you can initiate a request from the remote PC to the VPN router’s network by using the Connect option in the ADSL Modem Wireless Router menu bar (see Figure B-22). Since the remote PC has a dynamically assigned WAN IP address, it must initiate the request. a. Right-click the system tray icon to open the popup menu. b. Select Connect to open the My Connections list. c. Choose toDG834G.
Reference Manual for the ADSL Modem Wireless Router DG834GSP c. Type ping -t 10.1.1.1, and then click OK. Figure B-23 This will cause a continuous ping to be sent to the VPN router. After between several seconds and two minutes, the ping response should change from timed out to reply. Figure B-24 Once the connection is established, you can open the browser of the PC and enter the LAN IP address of the VPN router.
Reference Manual for the ADSL Modem Wireless Router DG834GSP Monitoring the VPN Tunnel (Telecommuter Example) Viewing the PC Client’s Connection Monitor and Log Viewer To view information on the progress and status of the VPN client connection, open the 54 Mbps ADSL Modem Wireless Router Model DG834GSP Log Viewer. 1. To launch this function, click on the Windows Start button, then select Programs, then 54 Mbps ADSL Modem Wireless Router Model DG834GSP, then Log Viewer.
Reference Manual for the ADSL Modem Wireless Router DG834GSP While the connection is being established, the Connection Name field in this menu will show SA before the name of the connection. When the connection is successful, the SA will change to the yellow key symbol. Note: While your PC is connected to a remote LAN through a VPN, you might not have normal Internet access. If this is the case, you will need to close the VPN connection in order to have normal Internet access.
Reference Manual for the ADSL Modem Wireless Router DG834GSP 2. To view the VPN tunnels status, click the VPN Status link on the right side of the main menu. Figure B-27 B-30 NETGEAR VPN Configuration v1.
Reference Manual for the ADSL Modem Wireless Router DG834GSP NETGEAR VPN Configuration B-31 v1.
Reference Manual for the ADSL Modem Wireless Router DG834GSP B-32 NETGEAR VPN Configuration v1.
