NETGEAR fvs114 Chapter 5 Basic Virtual Private Networking

Basic Virtual Private Networking 5-1

202-10098-01, April 2005

Chapter 5 Basic Virtual Private Networking

This chapter describes how to use the virtual private networking (VPN) features of the FVS114

VPN Firewall. VPN communications paths are called tunnels. VPN tunnels provide secure,

encrypted communications between your local network and a remote network or computer.

The VPN information is organized as follows:

•“Overview of VPN Configuration” on page 5-2 provides an overview of the two most

common VPN configurations: client-to-gateway and gateway-to-gateway.

•“Planning a VPN” on page 5-3 provides the VPN Committee (VPNC) recommended default

parameters set by the VPN Wizard.

•“VPN Tunnel Configuration” on page 5-5 summarizes the two ways to configure a VPN

tunnel: VPN Wizard (recommended for most situations) and Advanced (see Chapter 6,

“Advanced Virtual Private Networking).

•“How to Set Up a Client-to-Gateway VPN Configuration” on page 5-5 provides the steps

needed to configure a VPN tunnel between a remote PC and a network gateway using the VPN

Wizard and the NETGEAR ProSafe VPN Client.

•“How to Set Up a Gateway-to-Gateway VPN Configuration” on page 5-20 provides the steps

needed to configure a VPN tunnel between two network gateways using the VPN Wizard.

•“VPN Tunnel Control” on page 5-26 provides the step-by-step procedures for activating,

verifying, deactivating, and deleting a VPN tunnel once the VPN tunnel has been configured.

•Chapter 6, “Advanced Virtual Private Networking” provides the steps needed to configure

VPN tunnels when there are special circumstances and the VPNC recommended defaults of

the VPN Wizard are inappropriate.

•Appendix C, “Virtual Private Networking” discusses Virtual Private Networking (VPN)

Internet Protocol security (IPSec). IPSec is one of the most complete, secure, and

commercially available, standards-based protocols developed for transporting data.

Contents

Main ii 202-10098-01, April 2005 Trademarks Statement of Conditions Federal Communications Commission (FCC) Compliance Notice: Radio Frequency Notice EN 55 022 Declaration of Conformance Page Page Contents Page Page Page Page Page Page Page Chapter 1 About This Manual Audience, Scope, Conventions, and Formats How to Use This Manual How to Print this Manual Page Chapter 2 Introduction Key Features of the VPN Firewall A Powerful, True Firewall with Content Filtering Security Autosensing Ethernet Connections with Auto Uplink Extensive Protocol Support Easy Installation and Management Maintenance and Support Package Contents The FVS114 Front Panel 2-6 Introduction The FVS114 Rear Panel The rear panel of the FVS114 VPN Firewall contains the port connections listed below. Figure 2-2: FVS114 rear panel Table 2-1. LED Descriptions Introduction 2-7 NETGEAR-Related Products NETGEAR products related to the FVS114 are listed in the following table: NETGEAR Product Registration, Support, and Documentation Table 2-2. NETGEAR-Related Products Page Chapter 3 Connecting the Firewall to the Internet Prepare to Install Your FVS114 ProSafe VPN Firewall First, Connect the FVS114 1. CONNECT THE CABLES BETWEEN THE FVS114, COMPUTER, AND MODEM &DEOH A B Cable 1 Internet port C D 2. RESTART YOUR NETWORK IN THE CORRECT SEQUENCE Now, Configure the FVS114 for Internet Access Page Troubleshooting Tips Connecting the Firewall to the Internet 3-7 Overview of How to Access the FVS114 VPN Firewall http://www.routerlogin.net/basicsetting.htm Table 3-1. Ways to access the firewall http://www.routerlogin.net http://www.routerlogin.com How to Log On to the FVS114 After Configuration Settings Have Been Applied How to Bypass the Configuration Assistant Using the Smart Setup Wizard How to Manually Configure Your Internet Connection Page Page Page Chapter 4 Firewall Protection and Content Filtering Firewall Protection and Content Filtering Overview Block Sites Using Rules to Block or Allow Specific Kinds of Traffic Page Page Inbound Rules (Port Forwarding) Page Outbound Rules (Service Blocking) Page Order of Precedence for Rules Services Page Page Time Zone Getting E-Mail Notifications of Event Logs and Alerts Page Viewing Logs of Web Access or Attempted Web Access Syslog Chapter 5 Basic Virtual Private Networking Overview of VPN Configuration Client-to-Gateway VPN Tunnels 192.168.3.1 Gateway-to-Gateway VPN Tunnels FVS114 Planning a VPN VPN Gateway A VPN Gateway B Page VPN Tunnel Configuration How to Set Up a Client-to-Gateway VPN Configuration 192.168.3.1 FVS114 24.0.0.1 Step 1: Configuring the Client-to-Gateway VPN Tunnel on the FVS114 The Summary screen below displays. Page Step 2: Configuring the NETGEAR ProSafe VPN Client on the Remote PC Page Page Page Page Page Page Monitoring the Progress and Status of the VPN Client Connection Transferring a Security Policy to Another Client Page Page How to Set Up a Gateway-to-Gateway VPN Configuration AB Procedure to Configure a Gateway-to-Gateway VPN Tunnel 3. Fill in the IP Address or FQDN for the target VPN endpoint WAN connection and click Next. 4. Identify the IP addresses at the target endpoint that can use this tunnel, and click Next. Page Page Page VPN Tunnel Control Activating a VPN Tunnel Page Page Verifying the Status of a VPN Tunnel Deactivating a VPN Tunnel Page Deleting a VPN Tunnel Chapter 6 Advanced Virtual Private Networking Overview of FVS114 Policy-Based VPN Configuration Using Policies to Manage VPN Traffic Using Automatic Key Management Page 6-4 Advanced Virtual Private Networking The IKE Policy Configuration fields are defined in the following table. Table 6-1. IKE Policy Configuration fields Advanced Virtual Private Networking 6-5 VPN Policy Configuration for Auto Key Negotiation Table 6-1. IKE Policy Configuration fields Page Advanced Virtual Private Networking 6-7 The VPN Auto Policy fields are defined in the following table. Table 6-1. VPN Auto Policy Configuration Fields 6-8 Advanced Virtual Private Networking Table 6-1. VPN Auto Policy Configuration Fields VPN Policy Configuration for Manual Key Exchange Page Advanced Virtual Private Networking 6-11 The VPN Manual Policy fields are defined in the following table. Table 6-1. VPN Manual Policy Configuration Fields 6-12 Advanced Virtual Private Networking 202-10098-01, April 2005 Table 6-1. VPN Manual Policy Configuration Fields Using Digital Certificates for IKE Auto-Policy Authentication Certificate Revocation List (CRL) Walk-Through of Configuration Scenarios on the FVS114 VPN Consortium Scenario 1: Gateway-to-Gateway with Preshared Secrets FVS114 Scenario 1: FVS114 to Gateway B IKE and VPN Policies Page Page Page Page How to Check VPN Connections FVS114 Scenario 2: FVS114 to FVS114 with RSA Certificates Page Page Page Page Page Page Page This screen shows the following parameters: Page Click Show Statistics to display firewall usage statistics. This screen shows the following statistics: WAN Status action buttons are described in the table below: Viewing a List of Attached Devices Upgrading the Firewall Software Configuration File Management Backing Up the Configuration Restoring the Configuration Erasing the Configuration Changing the Administrator Password Diagnostics Page Page Chapter 8 Advanced Configuration WAN Set u p Default DMZ Server Respond to Ping on Internet WAN Port How to Configure Dynamic DNS Page Using the LAN IP Setup Options Configuring LAN TCP/IP Setup Parameters Page Using the Firewall as a DHCP server Using Address Reservation Configuring Static Routes Page Static Route Example Enabling Remote Management Access Page Page UPnP Page Chapter 9 Troubleshooting Basic Functioning Power LED Not On LEDs Never Turn Off LAN or Internet Port LEDs Not On Troubleshooting the Web Configuration Interface Troubleshooting the ISP Connection Troubleshooting a TCP/IP Network Using a Ping Utility Testing the LAN Path to Your Firewall Testing the Path from Your PC to a Remote Device Restoring the Default Configuration and Password Problems with Date and Time Page Appendix A Technical Specifications Page Appendix B Network, Routing, and Firewall Basics Related Publications Basic Router Concepts What is a Router? Routing Information Protocol IP Addresses and the Internet Page Netmask Subnet Addressing Page Private IP Addresses Single IP Address Operation Using NAT MAC Addresses and Address Resolution Protocol Related Documents Domain Name Server IP Configuration by DHCP Internet Security and Firewalls What is a Firewall? Ethernet Cabling Category 5 Cable Quality Inside Twisted Pair Cables Uplink Switches, Crossover Cables, and MDI/MDIX Switching Page Page Appendix C Virtual Private Networking What is a VPN? What Is IPSec and How Does It Work? IPSec Security Features IPSec Components Encapsulating Security Payload (ESP) Authentication Header (AH) IKE Security Association Page Key Management Understand the Process Before You Begin VPN Process Overview Network Interfaces and Addresses VPN Tunnel Between Gateways VPN Gateway A VPN Gateway B IPSec Security Association IKE VPN Tunnel Negotiation Steps VPNC IKE Security Parameters VPNC IKE Phase I Parameters VPNC IKE Phase II Parameters Testing and Troubleshooting Additional Reading Page Appendix D Preparing Your Network Preparing Your Computers for TCP/IP Networking Configuring Windows 95, 98, and Me for TCP/IP Networking Install or Verify Windows Networking Components Page Enabling DHCP to Automatically Configure TCP/IP Settings Locate your Network Neighborhood icon. Page Selecting Windows Internet Access Method Verifying TCP/IP Properties Configuring Windows NT4, 2000 or XP for IP Networking Install or Verify Windows Networking Components Enabling DHCP to Automatically Configure TCP/IP Settings DHCP Configuration of TCP/IP in Windows XP Page DHCP Configuration of TCP/IP in Windows 2000 Page Page DHCP Configuration of TCP/IP in Windows NT4 Page Verifying TCP/IP Properties for Windows XP, 2000, and NT4 Configuring the Macintosh for TCP/IP Networking MacOS 8.6 or 9.x MacOS X Verifying TCP/IP Properties for Macintosh Computers Verifying the Readiness of Your Internet Account Are Login Protocols Used? What Is Your Configuration Information? Obtaining ISP Configuration Information for Windows Computers Obtaining ISP Configuration Information for Macintosh Computers Restarting the Network Page Glossary List of Glossary Terms Use the list below to find definitions for technical terms used in this manual. Numeric A B C D E G I L M P Q R S T U W