User manual NETGEAR DG834GB REFERENCE MANUAL

[. . . ] Reference Manual for the Model Wireless ADSL Firewall Router DG834G NETGEAR, Inc. 4500 Great America Parkway Santa Clara, CA 95054 USA Phone 1-888-NETGEAR 202-10006-05 June 2005 202-10006-05, June 2005 © 2005 by NETGEAR, Inc. Microsoft, Windows, and Windows NT are registered trademarks of Microsoft Corporation. Other brand and product names are registered trademarks or trademarks of their respective holders. [. . . ] Click Drop for the VPN tunnel you want to deactivate. Figure 8-39: Current VPN Tunnels (SAs) Screen 8-34 Virtual Private Networking (Advanced Feature) 202-10006-05, June 2005 Reference Manual for the Model Wireless ADSL Firewall Router DG834G Note: When NETBIOS is enabled (which it is in the VPNC defaults implemented by the VPN Wizard), automatic traffic will reactivate the tunnel. To prevent reactivation from happening, either disable NETBIOS or disable the policy for the tunnel (see "Using the Policy Table on the VPN Policies Page to Deactivate a VPN Tunnel" on page 8-32). Deleting a VPN Tunnel To delete a VPN tunnel: 1. Open the DG834G management interface and click VPN Policies to display the VPN Policies screen (Figure 8-40). Select the radio button for the VPN tunnel to be deleted and click the Delete button. Figure 8-40: VPN Policies How to Set Up VPN Tunnels in Special Circumstances When the VPN Wizard and its VPNC defaults (see Table 8-2) are not appropriate for your special circumstances, use one of the following alternatives: · Auto Policy--for a typical automated Internet Key Exchange (IKE) setup, see "Using Auto Policy to Configure VPN Tunnels" on page 8-36. Auto Policy uses the IKE protocol to define the authentication scheme and automatically generate the encryption keys. Virtual Private Networking (Advanced Feature) 202-10006-05, June 2005 8-35 Reference Manual for the Model Wireless ADSL Firewall Router DG834G · Manual Policy--for a Manual Keying setup in which you must specify each phase of the connection, see "Using Manual Policy to Configure VPN Tunnels" on page 8-48. You have more control over the process, however the process is more complex and there are more opportunities for errors or configuration mismatches between your DG834G and the corresponding VPN endpoint gateway or client workstation. Using Auto Policy to Configure VPN Tunnels You need to configure matching VPN settings on both VPN endpoints. The outbound VPN settings on one end must match to the inbound VPN settings on other end, and vice versa. See "Example of Using Auto Policy" on page 8-41 for an example of using Auto Policy. Configuring VPN Network Connection Parameters All VPN tunnels on the DG834G wireless router require configuring several network parameters. The most common configuration scenarios will use IKE to manage the authentication and encryption keys. The IKE protocol performs negotiations between the two VPN endpoints to automatically generate and update the required encryption parameters. Click the VPN Policies link of the main menu, and then click the Add Auto Policy button to display the VPN - Auto Policy menu shown in Figure 8-41. 8-36 Virtual Private Networking (Advanced Feature) 202-10006-05, June 2005 Reference Manual for the Model Wireless ADSL Firewall Router DG834G Figure 8-41: DG834G VPN Tunnel Auto Policy Configuration Menu Virtual Private Networking (Advanced Feature) 202-10006-05, June 2005 8-37 Reference Manual for the Model Wireless ADSL Firewall Router DG834G The DG834G VPN tunnel network connection fields are defined as follows: General These settings identify this policy and determine its major characteristics. · · Policy Name--Enter a unique name to identify this policy. Remote VPN Endpoint--If the remote endpoint has a dynamic IP address, select "Dynamic IP address". You can set up multiple remote dynamic IP policies, but only one such policy can be enabled at a time. Otherwise, select the desired option (IP address or Domain Name) and enter the address of the remote VPN endpoint to which you wish to connect. Note: The remote VPN endpoint must have this VPN Gateway's address entered as its "Remote VPN Endpoint". · · NETBIOS Enable--check this if you wish NETBIOS traffic to be forwarded over the VPN tunnel. IKE Keep-alive--Enable this if you wish to ensure that a connection is kept open, or, if that is not possible, that it is quickly re-established when disconnected. This IP address will be "pinged" periodically to generate traffic for the VPN tunnel. The remote keep-alive IP address must be covered by the remote LAN IP range and must correspond to a device that can respond to ping. The range should be made as narrow as possible to meet this objective. [. . . ] Short for Remote Authentication Dial-In User Service, RADIUS is an authentication system. Using RADIUS, you must enter your user name and password before gaining access to a network. This information is passed to a RADIUS server, which checks that the information is correct, and then authorizes access. Though not an official standard, the RADIUS specification is maintained by a working group of the IETF. [. . . ]