Netgear DG834G user guide: How to Set Up a Gateway-to-Gateway VPN Configuration

How to Set Up a Gateway-to-Gateway VPN Configuration

Note: This section uses the VPN Wizard to set up the VPN tunnel using the VPNC default parameters listed in Table 7-2 on page 7-5. If you have special requirements not covered by these VPNC-recommended parameters, refer to “How to Set Up VPN Tunnels in Special Circumstances” on page 7-38 to set up the VPN tunnel.

Follow this procedure to configure a gateway-to-gateway VPN tunnel using the VPN Wizard.

Figure 7-19

Set the LAN IPs on each DG834G v3 to different subnets and configure each properly for the Internet. The examples below assume the following settings:

Virtual Private Networking

Reference Manual for the ADSL Modem Wireless Router DG834G

Table 7-4. VPN Tunnel Configuration Worksheet

Note: The LAN IP address ranges of each VPN endpoint must be different. The connection will fail if both are using the NETGEAR default address range of 192.168.0.x.

Follow this procedure to configure a gateway-to-gateway VPN tunnel using the VPN Wizard.

1. Log in to the DG834G v3 on LAN A at its default LAN address of http://192.168.0.1 with its default user name of admin and password of password. Click the VPN Wizard link in the main menu to display this screen. Click Next to proceed.

Virtual Private Networking

2. Fill in the Connection Name and the pre-shared key, select the type of target end point, and click Next to proceed.

Enter the new Connection Name: (e.g., GtoG)

Enter the pre-shared key: (e.g., 12345678)

Select the radio button: A remote VPN Gateway

Virtual Private Networking v1.0, January 2006 7-23

3. Fill in the IP Address or FQDN for the target VPN endpoint WAN connection and click Next.

Enter the WAN IP address of the remote VPN gateway: (e.g., 22.23.24.25)

Figure 7-22

4. Identify the IP addresses at the target endpoint which can use this tunnel, and click Next.

Enter the LAN IP settings of the remote VPN gateway:

• IP Address (e.g., 192.168.3.1)
• Subnet Mask (e.g., 255.255.255.0)

Virtual Private Networking

The Summary screen below displays.

Virtual Private Networking

To view the VPNC recommended authentication and encryption settings used by the VPN Wizard, click the “here” link (see Figure 7-24). Click Back to return to the Summary screen.

5. Click Done on the Summary screen (see Figure 7-24) to complete the configuration procedure. The VPN Settings menu below displays showing that the new tunnel is enabled.

Virtual Private Networking

Note: Refer to “Using Auto Policy to Configure VPN Tunnels” on page 7-38 to enable the IKE keepalive capability on an existing VPN tunnel.

6. Repeat for the DG834G v3 on LAN B and pay special attention to use the following network settings as appropriate.

   • WAN IP of the remote VPN gateway (e.g., 14.15.16.17)
   • LAN IP settings of the remote VPN gateway: — IP Address (e.g, 192.168.0.1) — Subnet Mask (e.g., 255.255.255.0) — Preshared Key (e.g., 12345678)

7. Use the VPN Status screen to activate the VPN tunnel by performing the following steps:

Note: The VPN Status screen is only one of three ways to active a VPN tunnel. See “Activating a VPN Tunnel” on page 7-29 for information on the other ways.

Virtual Private Networking

a. Open the DG834G v3 management interface and click on VPN Status to get the VPN Status/Log screen (Figure 7-27).

b. Click on VPN Status (Figure 7-29) to get the Current VPN Tunnels (SAs) screen (Figure 7-28). Click on Connect for the VPN tunnel you want to activate.

Figure 7-28

c. Look at the VPN Status/Log screen (Figure 7-27) to verify that the tunnel is connected.

Virtual Private Networking

VPN Tunnel Control

Activating a VPN Tunnel

There are three ways to activate a VPN tunnel:

• Use the VPN Status page.

• Activate the VPN tunnel by pinging the remote endpoint.

• Start using the VPN tunnel.

Note: Refer to “Using Auto Policy to Configure VPN Tunnels” on page 7-38 to enable the IKE keepalive capability on an existing VPN tunnel.

Using the VPN Status Page to Activate a VPN Tunnel

To use the VPN Status screen to activate a VPN tunnel, perform the following steps:

1. Log in to the Modem Router.

2. Open the DG834G v3 management interface and click on VPN Status to get the VPN Status/Log screen (Figure 7-29).

Virtual Private Networking

3. Click on VPN Status (Figure 7-29) to get the Current VPN Tunnels (SAs) screen (Figure 7-30). Click on Connect for the VPN tunnel you want to activate.

Activate the VPN Tunnel by Pinging the Remote Endpoint

Note: This section uses 192.168.3.1 for an example remote endpoint LAN IP address.

To activate the VPN tunnel by pinging the remote endpoint (e.g., 192.168.3.1), do the following steps depending on whether your configuration is client-to-gateway or gateway-to-gateway:

• Client-to-Gateway Configuration—to check the VPN Connection, you can initiate a request from the remote PC to the DG834G v3’s network by using the “Connect” option in the NETGEAR ProSafe menu bar. The NETGEAR ProSafe client will report the results of the attempt to connect. Since the remote PC has a dynamically assigned WAN IP address, it must initiate the request.

To perform a ping test using our example, start from the remote PC:

a. Establish an Internet connection from the PC. b. On the Windows taskbar, click the Start button, and then click Run. c. Type ping -t 192.168.3.1 and then click OK.

7-30 Virtual Private Networking

Figure 7-31: Running a Ping test to the LAN from the PC

This will cause a continuous ping to be sent to the first DG834G v3. After between several seconds and two minutes, the ping response should change from “timed out” to “reply.”

Note: Use Ctrl-C to stop the pinging.

Figure 7-32

Once the connection is established, you can open the browser of the PC and enter the LAN IP address of the remote DG834G v3. After a short wait, you should see the login screen of the Modem Router (unless another PC already has the DG834G v3 management interface open).

• Gateway-to-Gateway Configuration—test the VPN tunnel by pinging the remote network from a PC attached to the DG834G v3. a. Open command prompt (i.e., Start -> Run -> cmd).

Virtual Private Networking

b. ping 192.168.3.1.

Note: The pings may fail the first time. If so, then try the pings a second time.

Start Using a VPN Tunnel to Activate It

To use a VPN tunnel, use a Web browser to go to a URL whose IP address or range is covered by the policy for that VPN tunnel.

Virtual Private Networking

Verifying the Status of a VPN Tunnel

To use the VPN Status page to determine the status of a VPN tunnel, perform the following steps:

1. Log in to the Modem Router.
2. Open the DG834G v3 management interface and click on VPN Status to get the VPN Status/Log screen (Figure 7-34).

Figure 7-34

Log—this log shows the details of recent VPN activity, including the building of the VPN tunnel. If there is a problem with the VPN tunnel, refer to the log for information about what might be the cause of the problem.

• Click Refresh to see the most recent entries.
• Click Clear Log to delete all log entries.

Virtual Private Networking

3. Click on VPN Status (Figure 7-29) to get the Current VPN Tunnels (SAs) screen.

This table lists the following data for each active VPN Tunnel.

• SPI—each SA has a unique SPI (Security Parameter Index) for traffic in each direction. For "Manual" key exchange, the SPI is specified in the Policy definition. For "Automatic" key exchange, the SPI is generated by the IKE protocol.
• Policy Name—the name of the VPN policy associated with this SA.
• Remote Endpoint—the IP address on the remote VPN Endpoint.
• Action—the action will be either a "Drop" or a "Connect" button.
• SLifeTime (Secs)—the remaining Soft Lifetime for this SA in seconds. When the Soft Lifetime becomes zero, the SA (Security Association) will re-negotiated.
• HLifeTime (Secs)—the remaining Hard Lifetime for this SA in seconds. When the Hard Lifetime becomes zero, the SA (Security Association) will be terminated. (It will be re-established if required.)

7-34 Virtual Private Networking

Deactivating a VPN Tunnel

Sometimes a VPN tunnel must be deactivated for testing purposes. There are two ways to deactivate a VPN tunnel:

• Policy table on VPN Policies page

• VPN Status page

Using the Policy Table on the VPN Policies Page to Deactivate a VPN Tunnel

To use the VPN Policies page to deactivate a VPN tunnel, perform the following steps:

1. Log in to the Modem Router.

2. Open the DG834G v3 management interface and click on VPN Policies to get the VPN Policies screen (Figure 7-36).

Figure 7-36

3. Clear the Enable check box for the VPN tunnel you want to deactivate and click Apply. (To reactivate the tunnel, check the Enable box and click Apply.)

Using the VPN Status Page to Deactivate a VPN Tunnel

To use the VPN Status page to deactivate a VPN tunnel, perform the following steps:

1. Log in to the Modem Router.

2. Open the DG834G v3 management interface and click on VPN Status to get the VPN Status/Log screen (Figure 7-37).

3. Click VPN Status (Figure 7-37) to get the Current VPN Tunnels (SAs) screen (Figure 7-38). Click Drop for the VPN tunnel you want to deactivate.

Virtual Private Networking

Note: When NETBIOS is enabled (which it is in the VPNC defaults implemented by the VPN Wizard), automatic traffic will reactivate the tunnel. To prevent reactivation from happening, either disable NETBIOS or disable the policy for the tunnel (see “Using the Policy Table on the VPN Policies Page to Deactivate a VPN Tunnel” on page 7-35).

Deleting a VPN Tunnel

To delete a VPN tunnel:

1. Log in to the Modem Router.

2. Open the DG834G v3 management interface and click VPN Policies to display the VPN Policies screen (Figure 7-39). Select the radio button for the VPN tunnel to be deleted and click the Delete button.

Virtual Private Networking

How to Set Up VPN Tunnels in Special Circumstances

When the VPN Wizard and its VPNC defaults (see Table 7-2) are not appropriate for your special circumstances, use one of the following alternatives:

• Auto Policy—for a typical automated Internet Key Exchange (IKE) setup, see “Using Auto Policy to Configure VPN Tunnels” on page 7-38. Auto Policy uses the IKE protocol to define the authentication scheme and automatically generate the encryption keys.

• Manual Policy—for a Manual Keying setup in which you must specify each phase of the connection, see “Using Manual Policy to Configure VPN Tunnels” on page 7-48. Manual Policy does not use IKE. Rather, you manually enter all the authentication and key parameters. You have more control over the process, however the process is more complex and there are more opportunities for errors or configuration mismatches between your DG834G v3 and the corresponding VPN endpoint gateway or client workstation.

Using Auto Policy to Configure VPN Tunnels

You need to configure matching VPN settings on both VPN endpoints. The outbound VPN settings on one end must match to the inbound VPN settings on other end, and vice versa.

See “Example of Using Auto Policy” on page 7-43 for an example of using Auto Policy.

Configuring VPN Network Connection Parameters

All VPN tunnels on the ADSL Modem Wireless Router require configuring several network parameters. This section describes those parameters and how to access them.

The most common configuration scenarios will use IKE to manage the authentication and encryption keys. The IKE protocol performs negotiations between the two VPN endpoints to automatically generate and update the required encryption parameters.

Click the VPN Policies link of the main menu, and then click the Add Auto Policy button to display the VPN - Auto Policy menu shown in Figure 7-40.

Virtual Private Networking

Reference Manual for the ADSL Modem Wireless Router DG834G

Virtual Private Networking

The DG834G v3 VPN tunnel network connection fields are defined as follows:

General. These settings identify this policy and determine its major characteristics.

• Policy Name—Enter a unique name to identify this policy. This name is not supplied to the remote VPN endpoint. It is used only to help you manage the policies.
• Remote VPN Endpoint—If the remote endpoint has a dynamic IP address, select Dynamic IP address. No "Address Data" input is required. You can set up multiple remote dynamic IP policies, but only one such policy can be enabled at a time. Otherwise, select the desired option (IP address or Domain Name) and enter the address of the remote VPN endpoint to which you wish to connect.

Note: The remote VPN endpoint must have this VPN Gateway's address entered as its "Remote VPN Endpoint".

• NETBIOS Enable—check this if you wish NETBIOS traffic to be forwarded over the VPN tunnel. The NETBIOS protocol is used by Microsoft Networking.
• IKE Keep-alive—Enable this if you wish to ensure that a connection is kept open, or, if that is not possible, that it is quickly re-established when disconnected.

The Ping IP Address must be associated with the remote endpoint. The remote LAN address must be used. This IP address will be "pinged" periodically to generate traffic for the VPN tunnel. The remote keep-alive IP address must be covered by the remote LAN IP range and must correspond to a device that can respond to ping. The range should be made as narrow as possible to meet this objective.

Local LAN. This identifies which PCs on your LAN are covered by this policy. For each selection, data must be provided as follows:

• Single address—enter an IP address in the "Single/Start IP address" field. Typically, this setting is used when you wish to make a single Server on your LAN available to remote users.
• Range address—enter the starting IP address in the "Single/Start IP address" field, and the finish IP address in the "Finish IP address" field. This must be an address range used on your LAN.
• Subnet address—enter an IP address in the "Single/Start IP address" field, and the desired network mask in the "Subnet Mask" field. The remote VPN endpoint must have these IP addresses entered as its "Remote" addresses.

Virtual Private Networking

Remote LAN. This identifies which PCs on the remote LAN are covered by this policy. For each selection, data must be provided as follows:

• Single PC - no Subnet—select this option if there is no LAN (only a single PC) at the remote endpoint. If this option is selected, no additional data is required. The typical application is a PC running the VPN client at the remote end.
• Single address—Enter an IP address in the "Single/Start IP address" field. This must be an address on the remote LAN. Typically, this setting is used when you wish to access a server on the remote LAN.
• Range address—enter the starting IP address in the "Single/Start IP address" field, and the finish IP address in the "Finish IP address" field. This must be an address range used on the remote LAN.
• Subnet address—enter an IP address in the "Single/Start IP address" field, and the desired network mask in the "Subnet Mask" field.

The remote VPN endpoint must have these IP addresses entered as its "Local" addresses.

IKE. Direction/Type—this setting is used when determining if the IKE policy matches the current traffic. Select the desired option.

• Responder only—incoming connections are allowed, but outgoing connections will be blocked.
• Initiator and Responder—both incoming and outgoing connections are allowed.

Exchange Mode—ensure the remote VPN endpoint is set to use "Main Mode".

Diffie-Hellman (DH) Group—the Diffie-Hellman algorithm is used when exchanging keys. The DH Group setting determines the number of bit size used in the exchange. This value must match the value used on the remote VPN Gateway.

Local Identity Type—select the desired option to match the "Remote Identity Type" setting on the remote VPN endpoint.

• WAN IP Address—your Internet IP address.
• Fully Qualified Domain Name—your domain name.
• Fully Qualified User Name—your name, E-mail address, or other ID.

Local Identity Data—enter the data for the selection above. (If WAN IP Address is selected, no input is required.)

Virtual Private Networking 7-41

Remote Identity Type—select the desired option to match the "Local Identity Type" setting on the remote VPN endpoint.

• IP Address—the Internet IP address of the remote VPN endpoint. • Fully Qualified Domain Name—the Domain name of the remote VPN endpoint. • Fully Qualified User Name—the name, E-mail address, or other ID of the remote VPN endpoint.

Remote Identity Data—enter the data for the selection above. (If IP Address is selected, no input is required.)

Parameters. Encryption Algorithm—encryption Algorithm used for both IKE and IPSec. This setting must match the setting used on the remote VPN Gateway. DES and 3DES are supported.

• DES—the Data Encryption Standard (DES) processes input data that is 64 bits wide, encrypting these values using a 56 bit key. Faster but less secure than 3DES. • 3DES—(Triple DES) achieves a higher level of security by encrypting the data three times using DES with three different, unrelated keys.

Authentication Algorithm—authentication Algorithm used for both IKE and IPSec. This setting must match the setting used on the remote VPN Gateway. Auto, MD5, and SHA-1 are supported. Auto negotiates with the remote VPN endpoint and is not available in responder-only mode.

• MD5—128 bits, faster but less secure. • SHA-1 (default)—160 bits, slower but more secure.

Pre-shared Key—the key must be entered both here and on the remote VPN Gateway.

SA Life Time—this determines the time interval before the SA (Security Association) expires. (It will automatically be re-established as required.) While using a short time period (or data amount) increases security, it also degrades performance. It is common to use periods over an hour (3600 seconds) for the SA Life Time. This setting applies to both IKE and IPSec SAs.

IPSec PFS (Perfect Forward Secrecy)—if enabled, security is enhanced by ensuring that the key is changed at regular intervals. Also, even if one key is broken, subsequent keys are no easier to break. (Each key has no relationship to the previous key.)

This setting applies to both IKE and IPSec SAs. When configuring the remote endpoint to match this setting, you may have to specify the "Key Group" used. For this device, the "Key Group" is the same as the "DH Group" setting in the IKE section.

Virtual Private Networking

Example of Using Auto Policy

1. Set the LAN IPs on each DG834G v3 to different subnets and configure each properly for the Internet. The following settings are assumed for this example:

Table 7-5. VPN Tunnel Configuration Worksheet

Virtual Private Networking

2. Open the DG834G v3 on LAN A management interface and click on VPN Policies.

3. Click Add Auto Policy.
4. Enter policy settings (see Figure 7-43).
   • General — Policy Name = GtoG — Remote VPN Endpoint Address Type = Fixed IP Address — Remote VPN Endpoint Address Data = 22.23.24.25
   • Local LAN – use default setting
   • Remote LAN — IP Address = select Subnet address from the pulldown menu. — Start IP address = 192.168.3.1 — Subnet Mask = 255.255.255.0
   • IKE — Direction = Initiator and Responder — Exchange Mode = Main Mode — Diffie-Hellman (DH) Group = Group 2 (1024 Bit) — Local Identity Type = use default setting — Remote Identity Type = use default setting
   • Parameters — Encryption Algorithm = 3DES

Virtual Private Networking

— Authentication Algorithm = MD5 — Pre-shared Key = 12345678

VPN - Auto Policy

General Policy Name: GtoG Remote VPN Endpoint Address Type: Fixed IP Address Address Data: 22.23.24.25 ☑ NetBIOS Enable ☐ IKE Keep Alive Ping IP Address: □ . □ . □ . □

Local LAN IP Address Subnet address Single/Start address: 192 . 168 . 0 . 1 Finish address: □ . □ . □ . □ Subnet Mask: 255 . 255 . 255 . 0

Remote LAN IP Address Subnet address Single/Start IP address: 192 . 168 . 3 . 1 Finish IP address: □ . □ . □ . □ Subnet Mask: 255 . 255 . 255 . 0

IKE Direction: Initiator and Responder Exchange Mode: Main Mode Diffie-Hellman (DH) Group: Group 2 (1024 Bit) Local Identity Type: WAN IP Address Data: n/a Remote Identity Type: IP Address Data: n/a

Parameters Encryption Algorithm: 3DES Authentication Algorithm: Auto Pre-shared Key: 12345678 SA Life Time: 3600 (Seconds) ☐ Enable PFS (Perfect Forward Security)

Back Apply Cancel

Virtual Private Networking v1.0, January 2006 7-45

5. Click Apply. The Get VPN Policies web page is displayed.

6. Repeat for the DG834G v3 on LAN B and pay special attention to use the following network settings as appropriate.

• General, Remote Address Data (e.g., 14.15.16.17)
• Remote LAN, Start IP Address
  • IP Address (e.g, 192.168.0.1)
  • Subnet Mask (e.g., 255.255.255.0)
  • Preshared Key (e.g., 12345678)

7. Use the VPN Status screen to activate the VPN tunnel by performing the following steps:

Note: The VPN Status screen is only one of three ways to active a VPN tunnel. See “Activating a VPN Tunnel” on page 7-29 for information on the other ways.

7-46 Virtual Private Networking

a. Open the DG834G v3 management interface and click on VPN Status to display the VPN Status/Log screen (Figure 7-45).

b. Click VPN Status (Figure 7-45) to display the Current VPN Tunnels (SAs) screen (Figure 7-46). Click on Connect for the VPN tunnel you want to activate.

Figure 7-46

c. Review the VPN Status/Log screen (Figure 7-45) to verify that the tunnel is connected.

Virtual Private Networking

Using Manual Policy to Configure VPN Tunnels

As an alternative to IKE, you may use Manual Keying, in which you must specify each phase of the connection. A "Manual" VPN policy requires all settings for the VPN tunnel to be manually input at each end (both VPN endpoints).

Click the VPN Policies link of the main menu, and then click the Add Manual Policy radio button to display the Manual Keys menu shown in Figure 7-47.

Virtual Private Networking

General. The DG834G v3 VPN tunnel network connection fields are defined as follows:

• Policy Name—enter a unique name to identify this policy. This name is not supplied to the remote VPN endpoint. It is used only to help you manage the policies.
• Remote VPN Endpoint—select the desired option (IP address or Fully Qualified Domain Name) and enter the address of the remote VPN endpoint to which you wish to connect.

Note: The remote VPN endpoint must have this VPN Gateway's address entered as its "Remote VPN Endpoint".

• NETBIOS Enable—check this if you wish NETBIOS traffic to be forwarded over the VPN tunnel. The NETBIOS protocol is used by Microsoft Networking.

Local LAN. This identifies which PCs on your LAN are covered by this policy. For each selection, data must be provided as follows:

• Single address—enter an IP address in the "Single/Start IP address" field. Typically, this setting is used when you wish to make a single Server on your LAN available to remote users.
• Range address—enter the starting IP address in the "Single/Start IP address" field, and the finish IP address in the "Finish IP address" field. This must be an address range used on your LAN.
• Subnet address—enter an IP address in the "Single/Start IP address" field, and the desired network mask in the "Subnet Mask" field.

The remote VPN endpoint must have these IP addresses entered as its "Remote" addresses.

Remote LAN. This identifies which PCs on the remote LAN are covered by this policy. For each selection, data must be provided as follows:

• Single PC - no Subnet—select this option if there is no LAN (only a single PC) at the remote endpoint. If this option is selected, no additional data is required.
• Single address—enter an IP address in the "Single/Start IP address" field. This must be an address on the remote LAN. Typically, this setting is used when you wish to access a server on the remote LAN.
• Range address—enter the starting IP address in the "Single/Start IP address" field, and the finish IP address in the "Finish IP address" field. This must be an address range used on the remote LAN.

Virtual Private Networking

• Subnet address—enter an IP address in the "Single/Start IP address" field, and the desired network mask in the "Subnet Mask" field.

The remote VPN endpoint must have these IP addresses entered as its "Local" addresses.

ESP Configuration. ESP (Encapsulating Security Payload) provides security for the payload (data) sent through the VPN tunnel.

SPI—enter the required security policy indexes (SPIs). Each policy must have unique SPIs. These settings must match the remote VPN endpoint. The "in" setting here must match the "out" setting on the remote VPN endpoint, and the "out" setting here must match the "in" setting on the remote VPN endpoint.

Encryption—select the desired Encryption Algorithm, and enter the key in the field provided. For 3DES, the keys should be 24 ASCII characters and for DES, the keys should be 8 ASCII characters.

• DES—the Data Encryption Standard (DES) processes input data that is 64 bits wide, encrypting these values using a 56 bit key. Faster but less secure than 3DES.
• 3DES—(Triple DES) achieves a higher level of security by encrypting the data three times using DES with three different, unrelated keys.

Authentication—select the desired SHA-1 or MD5 Authentication Algorithm, and enter the key in the field provided. For MD5, the keys should be 16 ASCII characters. For SHA-1, the keys should be 20 ASCII characters.

• MD5—128 bits, faster but less secure.
• SHA-1 (default)—160 bits, slower but more secure.

7-50 Virtual Private Networking