User manual NETGEAR FWAG114 Reference Manual

[. . . ] Reference Manual for the ProSafe Dual Band Wireless VPN Firewall FWAG114 NETGEAR, Inc. 4500 Great America Parkway Santa Clara, CA 95054 USA SM-FWAG114NA-0 Version 1. 0 June 2003 © 2003 by NETGEAR, Inc. All rights reserved. Trademarks NETGEAR is a trademark of Netgear, Inc. Microsoft, Windows, and Windows NT are registered trademarks of Microsoft Corporation. [. . . ] Create a certificate request for the FWAG114. a. 7-22 Virtual Private Networking Reference Manual for the ProSafe Dual Band Wireless VPN Firewall FWAG114 b. . Click the Generate Request button to display the screen illustrated in Figure 7-11 below. FWAG114 Figure 7-11: Generate Self Certificate Request menu c. Fill in the fields on the Add Self Certificate screen. This is the name which other organizations will see as the holder (owner) of this certificate. This should be your registered business name or official company name. Generally, all certificates should have the same value in the Subject field. If you use "IP type" in the IKE policy, you should input the IP Address here. You can enter you e-mail address here. 7-23 ­ ­ ­ · ­ ­ ­ Optional Virtual Private Networking Reference Manual for the ProSafe Dual Band Wireless VPN Firewall FWAG114 d. Click the Next button to continue. The FWAG114 generates a Self Certificate Request as shown below. Highlight, copy and paste this data into a text file. Figure 7-12: Self Certificate Request data 4. Transmit the Self Certificate Request data to the Trusted Root CA. a. b. Highlight the text in the Data to supply to CA area, copy it, and paste it into a text file. In the case of a Windows 2000 internal CA, you might simply e-mail it to the CA administrator. The procedures of a CA like Verisign and a CA such as a Windows 2000 certificate server administrator will differ. Follow the procedures of your CA. 7-24 Virtual Private Networking Reference Manual for the ProSafe Dual Band Wireless VPN Firewall FWAG114 c. When you have finished gathering the Self Certificate Request data, click the Done button. You will return to the Certificates screen where your pending "FWAG114" Self Certificate Request will be listed, as illustrated in Figure 7-13 below. FWAG114 Figure 7-13: Self Certificate Requests table 5. Receive the certificate back from the Trusted Root CA and save it as a text file. Note: In the case of a Windows 2000 internal CA, the CA administrator might simply email it to back to you. Save the certificate you get back from the CA as a text file called final. txt. Click the radio button of the Self Certificate Request you want to upload. Browse to the location of the file you saved in step 5 above which contains the certificate from the CA. Click the Upload button. Virtual Private Networking 7-25 Reference Manual for the ProSafe Dual Band Wireless VPN Firewall FWAG114 f. You will now see the "FWAG114" entry in the Active Self Certificates table and the pending "FWAG114" Self Certificate Request is gone, as illustrated below. FWAG Figure 7-14: Self Certificates table 7. Associate the new certificate and the Trusted Root CA certificate on the FWAG114. a. Create a new IKE policy called Scenario_2 with all the same properties of Scenario_1 (see "Scenario 1 IKE Policy" on page 6-19) except now use the RSA Signature instead of the shared key. Figure 7-15: IKE policy using RSA Signature b. Create a new VPN Auto Policy called scenario2a with all the same properties as scenario1a except that it uses the IKE policy called Scenario_2. Virtual Private Networking 7-26 Reference Manual for the ProSafe Dual Band Wireless VPN Firewall FWAG114 Now, the traffic from devices within the range of the LAN subnet addresses on FWAG114 A and Gateway B will be authenticated using the certificates rather than via a shared key. Set up Certificate Revocation List (CRL) checking. a. Get a copy of the CRL from the CA and save it as a text file. Note: The procedure for obtaining a CRL differs from a CA like Verisign and a CA such as a Windows 2000 certificate server, which an organization operates for providing certificates for its members. [. . . ] For example, a 28-bit mask starting from the MSB can be shown as 255. 255. 255. 192 or as /28 appended to the IP address. Network Address Translation A technique by which several hosts share a single IP address for access to the Internet. packet A block of information sent over a network. A packet typically contains a source and destination network address, some protocol and length information, a block of data, and a checksum. Point-to-Point Protocol PPP. A protocol allowing a computer using TCP/IP to connect directly to the Internet. RADIUS Short for Remote Authentication Dial-In User Service, RADIUS is an authentication system. Using RADIUS, you must enter your user name and password before gaining access to a network. [. . . ]