Netgear DG834GSP User's Manual

Appendix B

NETGEAR VPN Configuration

DG834GSP to FVL328

This appendix is a case study on how to configure a secure IPSec VPN tunnel from a NETGEAR

DG834GSP to a FVL328. This case study follows the VPN Consortium interoperability profile guidelines (found at http://www.vpnc.org/InteropProfiles/Interop-01.html

).

Configuration Profile

The configuration in this document follows the addressing and configuration mechanics defined by the VPN Consortium. Gather all the necessary information before you begin the configuration process. Verify whether the firmware is up to date, all of the addresses that will be necessary, and all of the parameters that need to be set on both sides. Check that there are no firewall restrictions.

Table B-1.

Profile Summary

VPN Consortium Scenario:

Type of VPN

Security Scheme:

IP Addressing:

NETGEAR-Gateway A

NETGEAR-Gateway B

Scenario 1

LAN-to-LAN or Gateway-to-Gateway (not PC/Client-to-Gateway)

IKE with Preshared Secret/Key (not Certificate-based)

Static IP address

Static IP address

NETGEAR VPN Configuration v1.0, June 2007

B-1

Reference Manual for the ADSL Modem Wireless Router DG834GSP

10.5.6.0/24

LAN IP

10.5.6.1

VPNC Example

Network Interface Addressing

Gateway A

Gateway B

14.15.16.17

WAN IP

22.23.24.25

WAN IP

DG834G FVL328

172.23.9.0/24

LAN IP

172.23.9.1

Figure B-1

Note: Product updates are available on the NETGEAR, Inc. web site at http://kbserver.netgear.com/DG834GSP.asp

.

Step-By-Step Configuration

1. Configure the DG834GSP as in the Gateway-to-Gateway procedures using the VPN Wizard

(see “How to Set Up a Gateway-to-Gateway VPN Configuration” on page 8-21 ), being certain to use appropriate network addresses for the environment.

The LAN Addresses used in this example are as follows:

Unit

DG834G

FVL328

WAN IP

14.15.16.17

22.13.24.25

LAN IP

10.5.6.1

172.23.9.1

LAN Subnet Mask

255.255.255.0

255.255.255.0

a. In Step 1, enter toFVL328 for the Connection Name.

b. In Step 2, enter 22.23.24.25 for the remote WAN's IP address.

c.

In Step 3, enter the following:

• IP Address = 172.23.9.1

• Subnet Mask = 255.255.255.0

B-2 v1.0, June 2007

NETGEAR VPN Configuration


Click VPN Policies under

Advanced - VPN to invoke this screen toFVL328

10.5.6.1

172.23.9.1

toFVL328

22.23.24.25

5 6

172 23 9

Figure B-2


B-3


2. Configure the FVL328 as in the Gateway-to-Gateway procedures for the VPN Wizard (see

“How to Set Up a Gateway-to-Gateway VPN Configuration” on page 8-21 ), being certain to use appropriate network addresses for the environment.

a. In Step 1, enter toDG834 for the Connection Name

b. In Step 2, enter 14.15.16.17 for the remote WAN's IP address c.


• IP Address = 10.5.6.1

• Subnet Mask = 255.255.255.0

B-4 v1.0, June 2007


toDG834 22.23.24.25

14.15.16.17

Click IKE Policies under

VPN to invoke this screen

Reference Manual for the ADSL Modem Wireless Router DG834GSP toDG834

22.23.24.25

14.15.16.17

toDG834 172.23.9.1

10.5.6.1

Click VPN Policies under

VPN to invoke this screen toDG834 toDG834

14.15.16.17

172 23 9 1

10 5 6

Figure B-3


B-5


3. Test the VPN tunnel by pinging the remote network from a PC attached to the DG834GSP.

a. Open the command prompt (Start -> Run -> cmd)

b. ping 172.23.9.1

Figure B-4

Note: The pings may fail the first time. If this happens, try the pings a second time.

DG834GSP with FQDN to FVL328

This appendix is a case study on how to configure a VPN tunnel from a NETGEAR DG834GSP to a FVL328 using a Fully Qualified Domain Name (FQDN) to resolve the public address of one or both routers. This case study follows the VPN Consortium interoperability profile guidelines

(found at http://www.vpnc.org/InteropProfiles/Interop-01.html

).

Configuration Profile

The configuration in this document follows the addressing and configuration mechanics defined by the VPN Consortium. Gather all the necessary information before you begin the configuration process. Verify whether the firmware is up to date, all of the addresses that will be necessary, and all of the parameters that need to be set on both sides. Check that there are no firewall restrictions.

B-6 NETGEAR VPN Configuration v1.0, June 2007


Table B-2.

Profile Summary


Type of VPN

Security Scheme:

IP Addressing:

NETGEAR-Gateway A

NETGEAR-Gateway B

Scenario 1

LAN-to-LAN or Gateway-to-Gateway (not PC/Client-to-Gateway)


Fully Qualified Domain Name (FQDN)

FDQN

10.5.6.0/24

LAN IP

10.5.6.1

VPNC Example

Network Interface Addressing

Gateway A

WAN IP WAN IP

Gateway B

DG834G dg834g.dyndns.org

(FQDN) fvl328.dyndns.org

(FQDN)

FVL328

172.23.9.0/24

LAN IP

172.23.9.1

Figure B-5

Note: Product updates are available on the NETGEAR, Inc. web site at http://kbserver.netgear.com/DG834GSP.asp

.


B-7


The Use of a Fully Qualified Domain Name (FQDN)

Many ISPs (Internet Service Providers) provide connectivity to their customers using dynamic instead of static IP addressing. This means that a user’s IP address does not remain constant over time which presents a challenge for gateways attempting to establish VPN connectivity.

A Dynamic DNS (DDNS) service allows a user whose public IP address is dynamically assigned to be located by a host or domain name. It provides a central public database where information

(such as email addresses, host names and IP addresses) can be stored and retrieved. Now, a gateway can be configured to use a 3 rd party service in lieu of a permanent and unchanging IP address to establish bi-directional VPN connectivity.

To use DDNS, you must register with a DDNS service provider. Example DDNS Service

Providers include:

• DynDNS: www.dyndns.org

• TZO.com: netgear.tzo.com

• ngDDNS: ngddns.iego.net

In this example, Gateway A is configured using an example FQDN provided by a DDNS Service provider. In this case we established the hostname dg834g.dyndns.org for gateway A using the

DynDNS service. Gateway B will use the DDNS Service Provider when establishing a VPN tunnel.

In order to establish VPN connectivity Gateway A must be configured to use Dynamic DNS, and

Gateway B must be configured to use a DNS hostname to find Gateway A provided by a DDNS

Service Provider. Again, the following step-by-step procedures assume that you have already registered with a DDNS Service Provider and have the configuration information necessary to set up the gateways.

Step-By-Step Configuration

1. Log in to the DG834GSP labeled Gateway A as in the illustration.

Out of the box, the DG834GSP is set for its default LAN address of http://10.1.1.1 with its default user name of admin and default password of password . For this example we will assume you have set the local LAN address as 10.5.6.1 for Gateway A and have set your own password.

2. Click on the Dynamic DNS link on the left side of the Settings management GUI. This will take you to the Dynamic DNS Menu.



3. On the DG834GSP, configure the Dynamic DNS settings.

a. Browse to the Dynamic DNS Setup Screen (see

Figure B-6

) in the Advanced menu.

Figure B-6

b. Configure this screen with appropriate account and hostname settings and then click

Apply.

• Check the box Use a Dynamic DNS Service.

• Host Name = dg834g.dyndns.org

• User Name = <user's account username>

• Password = <user's account password> c.

Click Show Status. The resulting screen should show Update OK: good (see

Figure B-7

).

Figure B-7


B-9


4. On the FVL328, configure the Dynamic DNS settings. Assume a properly configured

DynDNS account.

a. Browse to the Dynamic DNS Setup Screen (see

Figure B-8

) in the Advanced menu.

Figure B-8

b. Select the DynDNS.org radio button (see Figure B-8

), configure with appropriate account

and hostname settings (see Figure B-9

), and then click Apply.

• Host and Domain Name = fvl328.dyndns.org

• User Name = <user's account username>

• Password = <user's account password>

B-10 v1.0, June 2007



Figure B-9 c.

Click Show Status. The resulting screen should show Update OK: good (see

Figure B-10

).

Figure B-10


B-11


5. Configure the DG834GSP as in the Gateway-to-Gateway procedures using the VPN Wizard

(see “How to Set Up a Gateway-to-Gateway VPN Configuration” on page 8-21 ), being certain to use appropriate network addresses for the environment.

The LAN Addresses used in this example are as follows:

Device

DG834GSP

FVL328

LAN IP Address LAN Subnet Mask

10.5.6.1

172.23.6.1

255.255.255.0

255.255.255.0

a. In Step 1, enter toFVL328 for the Connection Name.

b. In Step 2, enter fvl328.dyndns.org for the remote WAN's IP address.

c.


• IP Address = 172.23.9.1

• Subnet Mask = 255.255.255.0

6. Configure the FVL328 as in the Gateway-to-Gateway procedures for the VPN Wizard (see

“How to Set Up a Gateway-to-Gateway VPN Configuration” on page 8-21 ), being certain to use appropriate network addresses for the environment.

a. In Step 1, enter toDG834 for the Connection Name.

b. In Step 2, enter dg834g.dyndns.org for the remote WAN's IP address.

c.


• IP Address = 10.5.6.1

• Subnet Mask = 255.255.255.0

7. Test the VPN tunnel by pinging the remote network from a PC attached to the DG834GSP.

a. Open the command prompt (Start -> Run -> cmd)

b. ping 172.23.9.1

B-12 v1.0, June 2007



Figure B-11

Note: The pings may fail the first time. If this happens, try the pings a second time.


B-13


Configuration Summary (Telecommuter Example)

The configuration in this document follows the addressing and configuration mechanics defined by the VPN Consortium. Gather all the necessary information before you begin the configuration process. Verify whether the firmware is up to date, all of the addresses that will be necessary, and all of the parameters that need to be set on both sides. Assure that there are no firewall restrictions.

Table B-3.

Configuration summary (telecommuter example)


Type of VPN:

Security Scheme:

IP Addressing:

Scenario 1

PC/client-to-gateway, with client behind NAT router


Gateway Fully Qualified Domain Name (FQDN)

Client Dynamic

192.168.0.1/24

LAN IP

192.168.0.1

Telecommuter Example

Gateway A

WAN IP

Router

(at employer's main office)

FQDN ntgr.dyndns.org

"fromDG834G.com"

Client B

WAN IP

0.0.0.0

"toDG834G.com"

NAT Router B

192.168.2.3

Router

(at telecommuter's home office)

PC

(running NETGEAR

ProSafe VPN Client)

Figure B-12

Setting Up the Client-to-Gateway VPN Configuration

(Telecommuter Example)

Setting up a VPN between a remote PC running the NETGEAR ProSafe VPN Client and a network gateway involves the following two steps:

•

Step 1: Configuring the Client-to-Gateway VPN Tunnel on the VPN Router at the Employer’s

Main Office .



•

Step 2: Configuring the NETGEAR ProSafe VPN Client on the Remote PC at the

Telecommuter’s Home Office configures the NETGEAR ProSafe VPN Client endpoint.

Step 1: Configuring the Client-to-Gateway VPN Tunnel on the

VPN Router at the Employer’s Main Office

Follow this procedure to configure a client-to-gateway VPN tunnel by filling out the VPN Auto

Policy screen.

1. Log in to the VPN router at its LAN address of http://10.1.1.1 with its default user name of admin and password of password . Click the VPN Policies link in the main menu to display the VPN Policies screen. Click Add Auto Policy to proceed and enter the information.


B-15


fromDG834GSP (in the example)

Dynamic IP address

IKE Keep Alive is optional; must match Remote LAN IP

Address when enabled

(remote PC must respond to pings)

Subnet address

192.168.0.1 (in this example)

255.255.255.0

Single address

192.168.2.3 (in this example)

(Remote NAT router must have

Address Reservation set and

VPN Passthrough enabled)

Main Mode

Fully Qualified Domain Name

fromDG834G.com (in this example)

Fully Qualified Domain Name

toDG834G.com (in this example)

3DES

12345678 (in this example)

3600

Figure B-13

B-16 v1.0, June 2007



2. Click Apply when done to get the VPN Policies screen.

Figure B-14

To view or modify the tunnel settings, select the radio button next to the tunnel entry and click

Edit.


B-17


Step 2: Configuring the NETGEAR ProSafe VPN Client on the

Remote PC at the Telecommuter’s Home Office

This procedure describes how to configure the 54 Mbps ADSL Modem Wireless Router Model

DG834GSP. We will assume the PC running the client has a dynamically assigned IP address.

The PC must have a VPN client program installed that supports IPSec (in this case study, the

NETGEAR VPN ProSafe Client is used). Go to the NETGEAR website ( http://www.netgear.com

) and select VPN01L_VPN05L in the Product Quick Find drop-down menu for information on how to purchase the NETGEAR ProSafe VPN Client.

Note: Before installing the 54 Mbps ADSL Modem Wireless Router Model DG834GSP software, be sure to turn off any virus protection or firewall software you may be running on your PC.

1. Install the NETGEA ProSafe VPN Client on the remote PC and reboot.

a. You may need to insert your Windows CD to complete the installation.

b. If you do not have a modem or dial-up adapter installed in your PC, you may see the warning message stating “The NETGEAR ProSafe VPN Component requires at least one dial-up adapter be installed.” You can disregard this message.

c.

Install the IPSec Component. You may have the option to install either the VPN Adapter or the IPSec Component or both. The VPN Adapter is not necessary.

d. The system should show the ProSafe icon ( ) in the system tray after rebooting.

e.

Double-click the system tray icon to open the Security Policy Editor.

2. Add a new connection.

a. Run the NETGEAR ProSafe Security Policy Editor program and create a VPN

Connection.

B-18 v1.0, June 2007



b. From the Edit menu of the Security Policy Editor, click Add, then Connection. A New

Connection listing appears in the list of policies. Rename the New Connection so that it matches the Connection Name you entered in the VPN Settings of the DG834GSP on

Gateway A.

Note: In this example, the Connection Name used on the client side of the VPN tunnel is to DG834GSP and it does not have to match the VPN_client

Connection Name used on the gateway side of the VPN tunnel (see

Figure B-16

) because Connection Names are arbitrary to how the VPN tunnel functions.

Tip: Choose Connection Names that make sense to the people using and administrating the VPN.

Figure B-15


B-19


Figure B-16 c.

Select Secure in the Connection Security check-box group.

d. Select IP Subnet in the ID Type menu. e.

In this example, type 10.1.1.1 in the Subnet field as the network address of the

DG834GSP.

f.

Enter 255.255.255.0 in the Mask field as the LAN Subnet Mask of the DG834GSP.

g. Select All in the Protocol menu to allow all traffic through the VPN tunnel.

h. Select the Connect using Secure Gateway Tunnel check box. i.

Select Domain Name in the ID Type menu below the check box and enter

fromDG834G.com (in this example). j.

Select Gateway Hostname and enter ntgr.dyndns.org (in this example).

k. The resulting Connection Settings are shown in Figure B-16

.

3. Configure the Security Policy in the 54 Mbps ADSL Modem Wireless Router Model

DG834GSP software.

a. In the Network Security Policy list, expand the new connection by double clicking its name or clicking on the “+” symbol. My Identity and Security Policy subheadings appear below the connection name.

B-20 v1.0, June 2007



b. Click on the Security Policy subheading to show the Security Policy menu.

Figure B-17 c.

Select the Main Mode in the Select Phase 1 Negotiation Mode check box.

4. Configure the VPN Client Identity.

In this step, you will provide information about the remote VPN client PC. You will need to provide the Pre-Shared Key that you configured in the DG834GSP and either a fixed IP address or a “fixed virtual” IP address of the VPN client PC.


B-21


a. In the Network Security Policy list on the left side of the Security Policy Editor window, click My Identity.

B-22

Figure B-18

b. Choose None in the Select Certificate menu. c.

Select Domain Name in the ID Type menu and enter toDG834G.com (in this example) in the box below it. Choose Disabled in the Virtual Adapter menu.

d. In the Internet Interface box, select Intel PRO/100VE Network Connection (in this example, your Ethernet adapter may be different) in the Name menu and enter 10.1.2.3 (in this example) in the IP Addr box. v1.0, June 2007


Reference Manual for the ADSL Modem Wireless Router DG834GSP e.

Click the Pre-Shared Key button.

Figure B-19 f.

In the Pre-Shared Key dialog box, click the Enter Key button. Enter the DG834GSP's

Pre-Shared Key and click OK. In this example, 12345678 is entered. This field is case sensitive.

5. Configure the VPN Client Authentication Proposal.

In this step, you will provide the type of encryption (DES or 3DES) to be used for this connection. This selection must match your selection in the VPN router configuration.

a. In the Network Security Policy list on the left side of the Security Policy Editor window, expand the Security Policy heading by double clicking its name or clicking on the “+” symbol.

b. Expand the Authentication subheading by double clicking its name or clicking on the “+” symbol. Then select Proposal 1 below Authentication.


B-23


Figure B-20 c.

In the Authentication Method menu, select Pre-Shared key.

d. In the Encrypt Alg menu, select the type of encryption. In this example, use Triple DES. e.

In the Hash Alg menu, select SHA-1. f.

In the SA Life menu, select Unspecified.

g. In the Key Group menu, select Diffie-Hellman Group 2.

6. Configure the VPN Client Key Exchange Proposal.

In this step, you will provide the type of encryption (DES or 3DES) to be used for this connection. This selection must match your selection in the VPN router configuration.

B-24 v1.0, June 2007



a. Expand the Key Exchange subheading by double clicking its name or clicking on the “+” symbol. Then select Proposal 1 below Key Exchange.

Figure B-21

b. In the SA Life menu, select Unspecified. c.

In the Compression menu, select None.

d. Check the Encapsulation Protocol (ESP) checkbox. e.

In the Encrypt Alg menu, select the type of encryption. In this example, use Triple DES.

f.

In the Hash Alg menu, select SHA-1.

g. In the Encapsulation menu, select Tunnel.

h. Leave the Authentication Protocol (AH) checkbox unchecked.

7. Save the VPN Client settings.

From the File menu at the top of the Security Policy Editor window, select Save.

After you have configured and saved the VPN client information, your PC will automatically open the VPN connection when you attempt to access any IP addresses in the range of the remote VPN router’s LAN.

8. Check the VPN Connection.

NETGEAR VPN Configuration B-25 v1.0, June 2007


To check the VPN Connection, you can initiate a request from the remote PC to the VPN router’s network by using the Connect option in the ADSL Modem Wireless Router menu bar

(see

Figure B-22 ). Since the remote PC has a dynamically assigned WAN IP address, it must

initiate the request.

a. Right-click the system tray icon to open the popup menu.

b. Select Connect to open the My Connections list.

c.

Choose toDG834G.

The 54 Mbps ADSL Modem Wireless Router Model DG834GSP will report the results of the attempt to connect. Once the connection is established, you can access resources of the network connected to the VPN router.

Right-mouse-click on the system tray icon to open the popup menu.

Figure B-22

To perform a ping test using our example, start from the remote PC:

a. Establish an Internet connection from the PC.

b. On the Windows taskbar, click the Start button, and then click Run.

B-26 v1.0, June 2007


Reference Manual for the ADSL Modem Wireless Router DG834GSP c.

Type ping -t 10.1.1.1, and then click OK.

Figure B-23

This will cause a continuous ping to be sent to the VPN router. After between several seconds and two minutes, the ping response should change from timed out to reply.

Figure B-24

Once the connection is established, you can open the browser of the PC and enter the LAN IP address of the VPN router. After a short wait, you should see the login screen of the VPN router

(unless another PC already has the VPN router management interface open).

Note: You can use the VPN router diagnostic utilities to test the VPN connection from the

VPN router to the client PC. Run ping tests from the Diagnostics link of the VPN router main menu.


B-27


Monitoring the VPN Tunnel (Telecommuter Example)

Viewing the PC Client’s Connection Monitor and Log Viewer

To view information on the progress and status of the VPN client connection, open the 54 Mbps

ADSL Modem Wireless Router Model DG834GSP Log Viewer.

1. To launch this function, click on the Windows Start button, then select Programs, then 54

Mbps ADSL Modem Wireless Router Model DG834GSP, then Log Viewer.

Note: Use the active VPN tunnel information and pings to determine whether a failed connection is due to the VPN tunnel or some reason outside the VPN tunnel.

2. The Connection Monitor screen is shown below:

Figure B-25

B-28 v1.0, June 2007



While the connection is being established, the Connection Name field in this menu will show SA before the name of the connection. When the connection is successful, the SA will change to the yellow key symbol.

Note: While your PC is connected to a remote LAN through a VPN, you might not have normal Internet access. If this is the case, you will need to close the VPN connection in order to have normal Internet access.

Viewing the VPN Router’s VPN Status and Log Information

To view information on the status of the VPN client connection, open the VPN router’s VPN

Status screen by following the steps below:

1. To view this screen, click the Router Status link of the VPN router’s main menu, then click the VPN Status button. The VPN Status/Log screen for a connection is shown below:

Figure B-26


B-29


2. To view the VPN tunnels status, click the VPN Status link on the right side of the main menu.

Figure B-27

B-30 v1.0, June 2007




B-31


B-32 v1.0, June 2007


Netgear DG834GSP User's Manual

Appendix B

NETGEAR VPN Configuration

DG834GSP to FVL328

Configuration Profile

Step-By-Step Configuration

DG834GSP with FQDN to FVL328

Configuration Profile

Step-By-Step Configuration

Configuration Summary (Telecommuter Example)

Setting Up the Client-to-Gateway VPN Configuration

(Telecommuter Example)

Step 1: Configuring the Client-to-Gateway VPN Tunnel on the

VPN Router at the Employer’s Main Office

Step 2: Configuring the NETGEAR ProSafe VPN Client on the

Remote PC at the Telecommuter’s Home Office

Monitoring the VPN Tunnel (Telecommuter Example)

Viewing the PC Client’s Connection Monitor and Log Viewer

Viewing the VPN Router’s VPN Status and Log Information

Related manuals

Netgear

DG834GSP

Netgear

DG834G

Netgear

DG834G

Netgear

DG834G

Netgear

PY305300023

Netgear

DG834G

Netgear

PY305300023