User manual NETGEAR DGND3700

[. . . ] All rights reserved No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or by any means without the written permission of NETGEAR, Inc. To register your product, get the latest product updates, get support online, or for more information about the topics covered in this manual, visit the Support website at http://support. Phone (US & Canada only): 1-888-NETGEAR Phone (Other Countries): Check the list of phone numbers at http://support. Trademarks NETGEAR, the NETGEAR logo, and Connect with Innovation are trademarks and/or registered trademarks of NETGEAR, Inc. [. . . ] Virtual Private Networking Setting up secure encrypted communications 7 This chapter describes how to use the virtual private networking (VPN) features of the wireless modem router. This chapter is organized as follows: • • • • • • • Overview of VPN Configuration Plan a VPN VPN Tunnel Configuration Set Up a Client-to-Gateway VPN Configuration Set Up a Gateway-to-Gateway VPN Configuration VPN Tunnel Control Set Up VPN Tunnels in Special Circumstances 86 N600 Wireless Dual Band Gigabit ADSL2+ Modem Router DGND3700 Overview of VPN Configuration Two common scenarios for VPN tunnels are between a remote PC and a network gateway, and between two or more network gateways. The N600 Wireless Dual Band Gigabit ADSL2+ Modem Router DGND3700 supports both types. Client-to-Gateway VPN Tunnels Client-to-gateway VPN tunnels provide secure access from a remote PC, such as a telecommuter connecting to an office network. modem Router DGND3700 VPN Tunnel Internet PC running NETGEAR ProSafe VPN client Figure 41. Telecommuter VPN tunnel A VPN client access allows a remote PC to connect to your network from any location on the Internet. The remote PC is one tunnel endpoint, running the VPN client software. The wireless modem router on your network is the other tunnel endpoint. See Set Up a Client-to-Gateway VPN Configuration on page 90 for information about how to set up this configuration. Gateway-to-Gateway VPN Tunnels Gateway-to-gateway VPN tunnels provide secure access between networks, such as a branch or home office and a main office. modem Router DGND3700 Gateway A (Home) VPN Tunnel Modem Router DGND3700 Gateway B (Office) Internet Figure 42. VPN Tunnel between networks Virtual Private Networking 87 N600 Wireless Dual Band Gigabit ADSL2+ Modem Router DGND3700 A VPN between two or more NETGEAR VPN-enabled routers is a good way to connect branch or home offices and business partners over the Internet. vPN tunnels also enable access to network resources across the Internet. In this case, use gateways on each end of the tunnel to form the VPN tunnel endpoints. See Set Up a Gateway-to-Gateway VPN Configuration on page 101 for information about how to set up this configuration. Plan a VPN When you set up a VPN, it is helpful to plan the network configuration and record the configuration parameters on a worksheet: Table 15. VPN tunnel configuration worksheet Parameter Connection Name Pre-Shared Key Secure Association Perfect Forward Secrecy Encryption Protocol Authentication Protocol Diffie-Hellman (DH) Group Key Life in seconds IKE Life Time in seconds VPN Endpoint Local IPSecID LAN IP Address N/A N/A N/A N/A N/A Value to Be Entered Field Selection N/A N/A Main Mode Enabled DES MD5 Group 1 N/A N/A Subnet Mask FQDN or Gateway IP (WAN IP Address Manual Keys Disabled 3DES SHA-1 Group 2 To set up a VPN connection, you have to configure each endpoint with specific identification and connection information describing the other endpoint. You have to configure the outbound VPN settings on one end to match the inbound VPN settings on other end, and vice versa. This set of configuration information defines a security association (SA) between the two VPN endpoints. When planning your VPN, you should make a few choices first: • • Will the local end be any device on the LAN, a portion of the local network (as defined by a subnet or by a range of IP addresses), or a single PC?Will the remote end be any device on the remote LAN, a portion of the remote network (as defined by a subnet or by a range of IP addresses), or a single PC?Virtual Private Networking 88 N600 Wireless Dual Band Gigabit ADSL2+ Modem Router DGND3700 • Will either endpoint use fully qualified domain names (FQDNs)? [. . . ] These limits are designed to provide reasonable protection against harmful interference in a residential installation. This equipment uses and can radiate radio frequency energy and, if not installed and used in accordance with the instructions, may cause harmful interference to radio communications. However, there is no guarantee that interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following methods: • Reorient or relocate the receiving antenna. [. . . ]