User manual NETGEAR FVS336G

[. . . ] ProSafe Dual WAN Gigabit Firewall with SSL & IPsec VPN FVS336G Reference Manual NETGEAR, Inc. 4500 Great America Parkway Santa Clara, CA 95054 USA October 2007 202-10257-01 v1. 0 © 2007 by NETGEAR, Inc. All rights reserved. Trademarks NETGEAR and the NETGEAR logo are registered trademarks and ProSafe is a trademark of NETGEAR, Inc. Microsoft, Windows, and Windows NT are registered trademarks of Microsoft Corporation. [. . . ] The value entered under Domain Name will be of the form "<name><XY>. fvg_remote. com", where each user must use a different variation on the Domain Name entered here. The <name> is the policy name used in the FVS336G configuration. X and Y are an arbitrary pair of numbers chosen for each user. Note: X may not be zero! In this example, we have entered home11. fvg_remote. com. Leave Virtual Adapter disabled, and click your computer's Network Adapter. This key will be shared by all users of the FVS336G policy "home". For the Phase 1 Negotiation Mode, check the Aggressive Mode radio box. PFS should be disabled, and Enable Replay Detection should be enabled. In the left frame, expand Authentication (Phase 1) and choose Proposal 1. In the left frame, expand Key Exchange (Phase 2) and choose Proposal 1. The fields in this proposal should also mirror those in the following figure. In the upper left of the window, click the disk icon to save the policy. Testing the Connection 1. From your PC, right-click on the VPN client icon in your Windows toolbar and choose Connect. . . , then My Connections\to_FVG. Within 30 seconds you should receive the message "Successfully connected to My Connections\to_FVG" and the VPN client icon in the toolbar should say On: Virtual Private Networking Using IPsec v1. 0, October 2007 5-19 ProSafe Dual WAN Gigabit Firewall with SSL & IPsec VPN FVS336G Reference Manual 2. For additional status and troubleshooting information, right-click on the VPN client icon Logs and Connection Status screens in the FVS336G. Manually Assigning IP Addresses to Remote Users (ModeConfig) To simply the process of connecting remote VPN clients to the FVS336G, the ModeConfig module can be used to assign IP addresses to remote users, including a network access IP address, subnet mask, and name server addresses from the VPN firewall. Remote users are given IP addresses available in secured network space so that remote users appear as seamless extensions of the network. In the following example, we configured the VPN firewall using ModeConfig, and then configured a PC running ProSafe VPN Client software using these IP addresses. · NETGEAR FVS336G ProSafe Dual WAN Gigabit Firewall with SSL & IPsec VPN ­ ­ · WAN IP address: 172. 21. 4. 1 LAN IP address/subnet: 192. 168. 2. 1/255. 255. 255. 0 NETGEAR ProSafe VPN Client software IP address: 192. 168. 1. 2 Mode Config Operation After IKE Phase 1 is complete, the VPN connection initiator (remote user/client) asks for IP configuration parameters such as IP address, subnet mask and name server addresses. The Mode Config module will allocate an IP address from the configured IP address pool and will activate a temporary IPsec policy using the template security proposal information configured in the Mode Config record. Note: After configuring a Mode Config record, you must go to the IKE Policies menu and configure an IKE policy using the newly-created Mode Config record as the Remote Host Configuration Record. The VPN Policies menu does not need to be edited. Configuring the VPN Firewall Two menus must be configured--the Mode Config menu and the IKE Policies menu. To configure the Mode Config menu: 5-20 v1. 0, October 2007 Virtual Private Networking Using IPsec ProSafe Dual WAN Gigabit Firewall with SSL & IPsec VPN FVS336G Reference Manual 1. Enter a descriptive Record Name such as "Sales". Virtual Private Networking Using IPsec v1. 0, October 2007 5-21 ProSafe Dual WAN Gigabit Firewall with SSL & IPsec VPN FVS336G Reference Manual 6. [. . . ] If the IP address is fixed, a fully-qualified domain name is optional. VPN Telecommuter: Dual Gateway WAN Ports for Improved Reliability In the case of the dual WAN ports on the gateway VPN firewall (Figure C-18), the remote PC client initiates the VPN tunnel with the active gateway WAN port (port WAN1 in this example) because the IP address of the remote NAT router is not known in advance. The gateway WAN port must act as the responder. Figure C-18 C-18 v1. 0, October 2007 Network Planning for Dual WAN Ports ProSafe Dual WAN Gigabit Firewall with SSL & IPsec VPN FVS336G Reference Manual The IP addresses of the gateway WAN ports can be either fixed or dynamic, but a fully-qualified domain name must always be used because the active WAN port could be either WAN1 or WAN2 (i. e. , the IP address of the active WAN port is not known in advance). After a rollover of the gateway WAN port (Figure C-19), the previously inactive gateway WAN port becomes the active port (port WAN2 in this example) and the remote PC must re-establish the VPN tunnel. [. . . ]