Netgear DG834G user guide: Gateway-to-Gateway VPN Tunnels

Gateway-to-Gateway VPN Tunnels

• Gateway-to-Gateway VPN Tunnels provide secure access between networks, such as a branch or home office and a main office.

Figure 7-2

A VPN between two or more NETGEAR VPN-enabled routers is a good way to connect branch or home offices and business partners over the Internet. VPN tunnels also enable access to network resources across the Internet. In this case, use DG834G v3s on each end of the tunnel to form the VPN tunnel end points. See “How to Set Up a Gateway-to-Gateway VPN Configuration” on page 7-21 to set up this configuration.

Virtual Private Networking

Planning a VPN

When you set up a VPN, it is helpful to plan the network configuration and record the configuration parameters on a worksheet:

Table 7-1. VPN Tunnel Configuration Worksheet

Connection Name: Pre-Shared Key: Secure Association -- Main Mode or Manual Keys: Perfect Forward Secrecy -- Enabled or Disabled: NETBIOS -- Enabled or Disabled: Encryption Protocol -- DES or 3DES: Authentication Protocol -- MD5 or SHA-1: Diffie-Hellman (DH) Group -- Group 1 or Group 2: Key Life in seconds: IKE Life Time in seconds:

VPN Endpoint Local IPSec ID LAN IP Address Subnet Mask FQDN or Gateway IP (WAN IP Address)

To set up a VPN connection, you must configure each endpoint with specific identification and connection information describing the other endpoint. You must configure the outbound VPN settings on one end to match the inbound VPN settings on other end, and vice versa.

This set of configuration information defines a security association (SA) between the two VPN endpoints. When planning your VPN, you must make a few choices first:

• Will the local end be any device on the LAN, a portion of the local network (as defined by a subnet or by a range of IP addresses), or a single PC?

7-4 Virtual Private Networking

Reference Manual for the ADSL Modem Wireless Router DG834G

• Will the remote end be any device on the remote LAN, a portion of the remote network (as defined by a subnet or by a range of IP addresses), or a single PC?
• Will either endpoint use Fully Qualified Domain Names (FQDNs)? FQDNs supplied by Dynamic DNS providers (see “The Use of a Fully Qualified Domain Name (FQDN)” on page B-8) can allow a VPN endpoint with a dynamic IP address to initiate or respond to a tunnel request. Otherwise, the side using a dynamic IP address must always be the initiator.
• What method will you use to configure your VPN tunnels?
  • The VPN Wizard using VPNC defaults (see Table 7-2)
  • The typical automated Internet Key Exchange (IKE) setup (see “Using Auto Policy to Configure VPN Tunnels” on page 7-38)
  • A Manual Keying setup in which you must specify each phase of the connection (see “Using Manual Policy to Configure VPN Tunnels” on page 7-48)?

Table 7-2. Parameters Recommended by the VPNC and Used in the VPN Wizard

• What level of IPSec VPN encryption will you use?
  • DES - The Data Encryption Standard (DES) processes input data that is 64 bits wide, encrypting these values using a 56 bit key. Faster but less secure than 3DES.
  • 3DES - (Triple DES) achieves a higher level of security by encrypting the data three times using DES with three different, unrelated keys.
• What level of authentication will you use?
  • MDS: 128 bits, faster but less secure.
  • SHA-1: 160 bits, slower but more secure.

Virtual Private Networking

VPN Tunnel Configuration

There are two tunnel configurations and three ways to configure them:

• Use the VPN Wizard to configure a VPN tunnel (recommended for most situations): — See “How to Set Up a Client-to-Gateway VPN Configuration” on page 7-7. — See “How to Set Up a Gateway-to-Gateway VPN Configuration” on page 7-21.

• See “Using Auto Policy to Configure VPN Tunnels” on page 7-38 when the VPN Wizard and its VPNC defaults (see Table 7-2) are not appropriate for your special circumstances, but you want to automate the Internet Key Exchange (IKE) setup.

• See “Using Manual Policy to Configure VPN Tunnels” on page 7-48 when the VPN Wizard and its VPNC defaults (see Table 7-2) are not appropriate for your special circumstances and you must specify each phase of the connection. You manually enter all the authentication and key parameters. You have more control over the process, however the process is more complex and there are more opportunities for errors or configuration mismatches between your DG834G v3 and the corresponding VPN endpoint gateway or client workstation.

Note: NETGEAR publishes additional interoperability scenarios with various gateway and client software products. Look on the NETGEAR web site at www.netgear.com for these interoperability scenarios.

Virtual Private Networking

How to Set Up a Client-to-Gateway VPN Configuration

Setting up a VPN between a remote PC running the NETGEAR ProSafe VPN Client and a network gateway involves the following two steps:

• “Step 1: Configuring the Client-to-Gateway VPN Tunnel on the DG834G v3” on page 7-7 uses the VPN Wizard to configure the VPN tunnel between the remote PC and network gateway.
• “Step 2: Configuring the NETGEAR ProSafe VPN Client on the Remote PC” on page 7-12 configures the NETGEAR ProSafe VPN Client endpoint.

Step 1: Configuring the Client-to-Gateway VPN Tunnel on the DG834G v3

Note: This section uses the VPN Wizard to set up the VPN tunnel using the VPNC default parameters listed in Table 7-2 on page 7-5. If you have special requirements not covered by these VPNC-recommended parameters, refer to “How to Set Up VPN Tunnels in Special Circumstances” on page 7-38 to set up the VPN tunnel.

The worksheet below identifies the parameters used in the following procedure. A blank worksheet is at “Planning a VPN” on page 7-4.

Virtual Private Networking

Reference Manual for the ADSL Modem Wireless Router DG834G

Table 7-3. VPN Tunnel Configuration Worksheet

Follow this procedure to configure a client-to-gateway VPN tunnel using the VPN Wizard.

Virtual Private Networking

1. Log in to the DG834G v3 at its LAN address of http://192.168.0.1 with its default user name of admin and password of password. Click the VPN Wizard link in the main menu to display this screen. Click Next to proceed.

2. Fill in the Connection Name and the pre-shared key, select the type of target end point, and click Next to proceed.

Figure 7-5

Tip: The Connection Name is arbitrary and not relevant to how the configuration functions.

Virtual Private Networking

The Summary screen below displays.

Virtual Private Networking

To view the VPNC recommended authentication and encryption settings used by the VPN Wizard, click the “here” link. Click Back to return to the Summary screen.

3. Click Done on the Summary screen to complete the configuration procedure. The VPN Policies menu below displays showing that the new tunnel is enabled.

To view or modify the tunnel settings, select the radio button next to the tunnel entry and click Edit.

Note: Refer to “Using Auto Policy to Configure VPN Tunnels” on page 7-38 to enable the IKE keepalive capability on an existing VPN tunnel.

Step 2: Configuring the NETGEAR ProSafe VPN Client on the Remote PC

This procedure describes how to configure the NETGEAR ProSafe VPN Client. We will assume the PC running the client has a dynamically assigned IP address.

The PC must have the NETGEAR ProSafe VPN Client program installed that supports IPSec. Go to the NETGEAR website (http://www.netgear.com) and select VPN01L_VPN05L in the Product Quick Find drop-down menu for information on how to purchase the NETGEAR ProSafe VPN Client.

Note: Before installing the NETGEAR ProSafe VPN Client software, be sure to turn off any virus protection or firewall software you may be running on your PC.

1. Install the NETGEAR ProSafe VPN Client on the remote PC and reboot.
   • You may need to insert your Windows CD to complete the installation.
   • If you do not have a modem or dial-up adapter installed in your PC, you may see the warning message stating “The NETGEAR ProSafe VPN Component requires at least one dial-up adapter be installed.” You can disregard this message.
   • Install the IPSec Component. You may have the option to install either the VPN Adapter or the IPSec Component or both. The VPN Adapter is not necessary.
   • The system should show the ProSafe icon (S) in the system tray after rebooting.
   • Double-click the system tray icon to open the Security Policy Editor.
2. Add a new connection. a. Run the NETGEAR ProSafe Security Policy Editor program and, using the “VPN Tunnel Configuration Worksheet” on page 7-8, create a VPN Connection.

7-12 Virtual Private Networking

b. From the Edit menu of the Security Policy Editor, click Add, then Connection.

A “New Connection” listing appears in the list of policies. Rename the “New Connection” so that it matches the Connection Name you entered in the VPN Settings of the DG834G v3 on LAN A.

Note: In this example, the Connection Name used on the client side of the VPN tunnel is toDG834 and it does not have to match the RoadWarrior Connection Name used on the gateway side of the VPN tunnel because Connection Names are arbitrary to how the VPN tunnel functions.

Tip: Choose Connection Names that make sense to the people using and administering the VPN.

c. Select Secure in the Connection Security check-box group. d. Select IP Subnet in the ID Type menu. e. In this example, type 192.168.3.1 in the Subnet field as the network address of the DG834G v3. f. Enter 255.255.255.0 in the Mask field as the LAN Subnet Mask of the DG834G v3. g. Select All in the Protocol menu to allow all traffic through the VPN tunnel.

Virtual Private Networking

h. Select the Connect using Secure Gateway Tunnel check box. i. Select IP Address in the ID Type menu below the check box. j. Enter the public WAN IP Address of the DG834G v3 in the field directly below the ID Type menu. In this example, 22.23.24.25 would be used. k. The resulting Connection Settings are shown in Figure 7-10.

3. Configure the Security Policy in the NETGEAR ProSafe VPN Client software: a. In the Network Security Policy list, expand the new connection by double clicking its name or clicking on the “+” symbol. My Identity and Security Policy subheadings appear below the connection name. b. Click on the Security Policy subheading to show the Security Policy menu.

c. Select the Main Mode in the Select Phase 1 Negotiation Mode check-box group.

4. Configure the VPN Client Identity.

In this step, you will provide information about the remote VPN client PC. You will need to provide the Pre-Shared Key that you configured in the DG834G v3 and either a fixed IP address or a “fixed virtual” IP address of the VPN client PC.

a. In the Network Security Policy list on the left side of the Security Policy Editor window, click on My Identity.

b. Choose None in the Select Certificate menu. c. Select IP Address in the ID Type menu. If you are using a virtual fixed IP address, enter this address in the Internal Network IP Address box. Otherwise, leave this box empty. d. In the Internet Interface box, select the adapter you use to access the Internet. Select PPP Adapter in the Name menu if you have a dial-up Internet account. Select your Ethernet adapter if you have a dedicated Cable or DSL line. You may also choose Any if you will be switching between adapters or if you have only one adapter.

Virtual Private Networking

e. Click the Pre-Shared Key button. In the Pre-Shared Key dialog box, click the Enter Key button. Enter the DG834G v3's Pre-Shared Key and click OK. In this example, 12345678 is entered. This field is case sensitive.

5. Configure the VPN Client Authentication Proposal.

In this step, you will provide the type of encryption (DES or 3DES) to be used for this connection. This selection must match your selection in the DG834G v3 configuration.

a. In the Network Security Policy list on the left side of the Security Policy Editor window, expand the Security Policy heading by double clicking its name or clicking on the “+” symbol.

b. Expand the Authentication subheading by double clicking its name or clicking on the “+” symbol. Then select Proposal 1 below Authentication.

Virtual Private Networking

c. In the Authentication Method menu, select Pre-Shared key. d. In the Encrypt Alg menu, select the type of encryption to correspond with what was configured for the Encryption Protocol in the DG834G v3 in Table 7-3 on page 7-8. In this example, use Triple DES. e. In the Hash Alg menu, select SHA-1. f. In the SA Life menu, select Unspecified. g. In the Key Group menu, select Diffie-Hellman Group 2.

6. Configure the VPN Client Key Exchange Proposal.

In this step, you will provide the type of encryption (DES or 3DES) to be used for this connection. This selection must match your selection in the DG834G v3 configuration.

a. Expand the Key Exchange subheading by double clicking its name or clicking on the “+” symbol. Then select Proposal 1 below Key Exchange.

Figure 7-14

b. In the SA Life menu, select Unspecified. c. In the Compression menu, select None. d. Check the Encapsulation Protocol (ESP) checkbox. e. In the Encrypt Alg menu, select the type of encryption to correspond with what was configured for the Encryption Protocol in the DG834G v3 in Table 7-3 on page 7-8. In this example, use Triple DES.

Virtual Private Networking

f. In the Hash Alg menu, select SHA-1. g. In the Encapsulation menu, select Tunnel. h. Leave the Authentication Protocol (AH) checkbox unchecked.

7. Save the VPN Client Settings. From the File menu at the top of the Security Policy Editor window, select Save. After you have configured and saved the VPN client information, your PC will automatically open the VPN connection when you attempt to access any IP addresses in the range of the remote VPN router’s LAN.

8. Check the VPN Connection. To check the VPN Connection, you can initiate a request from the remote PC to the DG834G v3’s network by using the “Connect” option in the NETGEAR ProSafe menu bar. The NETGEAR ProSafe client will report the results of the attempt to connect. Since the remote PC has a dynamically assigned WAN IP address, it must initiate the request. To perform a ping test using our example, start from the remote PC: a. Establish an Internet connection from the PC. b. On the Windows taskbar, click the Start button, and then click Run. c. Type ping -t 192.168.3.1 , and then click OK.

7-18 Virtual Private Networking

This will cause a continuous ping to be sent to the first DG834G v3. After between several seconds and two minutes, the ping response should change from “timed out” to “reply.”

Once the connection is established, you can open the browser of the PC and enter the LAN IP address of the remote DG834G v3. After a short wait, you should see the login screen of the Modem Router (unless another PC already has the DG834G v3 management interface open).

Information on the progress and status of the VPN client connection can be viewed by opening the NETGEAR ProSafe Log Viewer.

To launch this function, click on the Windows Start button, then select Programs, then NETGEAR ProSafe VPN Client, then Log Viewer. The Log Viewer screen for a successful connection is shown below:

Note: Use the active VPN tunnel information and pings to determine whether a failed connection is due to the VPN tunnel or some reason outside the VPN tunnel.

9. The Connection Monitor screen for this connection is shown below:

In this example you can see the following:

• The DG834G v3 has a public IP WAN address of 22.23.24.25.
• The DG834G v3 has a LAN IP address of 192.168.3.1.
• The VPN client PC has a dynamically assigned address of 192.168.2.2.

While the connection is being established, the Connection Name field in this menu will say “SA” before the name of the connection. When the connection is successful, the “SA” will change to the yellow key symbol shown in the illustration above.

Note: While your PC is connected to a remote LAN through a VPN, you might not have normal Internet access. If this is the case, you will need to close the VPN connection in order to have normal Internet access.

Virtual Private Networking