Virtual Private Networking | NETGEAR FVS124G instruction

Reference Manual for the ProSafe VPN Firewall 25 with 4 Gigabit LAN and Dual WAN Ports

•[RFC 791] Internet Protocol DARPA Internet Program Protocol Specification, Information Sciences Institute, USC, September 1981.

•[RFC 1058] Routing Information Protocol, C Hedrick, Rutgers University, June 1988.

•[RFC 1483] Multiprotocol Encapsulation over ATM Adaptation Layer 5, Juha Heinanen, Telecom Finland, July 1993.

•[RFC 2401] S. Kent, R. Atkinson, Security Architecture for the Internet Protocol, RFC 2401, November 1998.

•[RFC 2407] D. Piper, The Internet IP Security Domain of Interpretation for ISAKMP, November 1998.

•[RFC 2474] K. Nichols, S. Blake, F. Baker, D. Black, Definition of the Differentiated Services Field (DS Field) in the IPv4 and IPv6 Headers, December 1998.

•[RFC 2475] S. Blake, D. Black, M. Carlson, E. Davies, Z. Wang, and W. Weiss, An Architecture for Differentiated Services, December 1998.

•[RFC 2481] K. Ramakrishnan, S. Floyd, A Proposal to Add Explicit Congestion Notification (ECN) to IP, January 1999.

•[RFC 2408] D. Maughan, M. Schertler, M. Schneider, J. Turner, Internet Security Association and Key Management Protocol (ISAKMP).

•[RFC 2409] D. Harkins, D.Carrel, Internet Key Exchange (IKE) protocol.

•[RFC 2401] S. Kent, R. Atkinson, Security Architecture for the Internet Protocol.

D-12	Virtual Private Networking

202-10085-01, March 2005

Image 226

NETGEAR FVS124G manual Virtual Private Networking

Contents

202-10085-01, March EN 55 022 Declaration of Conformance TrademarksStatement of Conditions Bestätigung des Herstellers/Importeurs Voluntary Control Council for Interference Vcci Statement Certificate of the Manufacturer/ImporterAdditional Copyrights 202-10085-01, March MD5 Product and Publication Details Contents Chapter Connecting the FVS124G to the Internet Chapter LAN Configuration Chapter Router and Network Management Chapter Troubleshooting Appendix C Preparing Your Network Appendix D Virtual Private Networking Glossary-5 Typographical Conventions Audience, Scope, Conventions, and FormatsManual Scope How to Use This Manual How to Print this Manual Printing a Page in the Html View About This Manual Key Features of the VPN Firewall Chapter Introduction Powerful, True Firewall with Content Filtering Security Autosensing Ethernet Connections with Auto Uplink Easy Installation and Management Extensive Protocol Support Package Contents Router’s Front Panel FVS124G Front Panel Router’s Rear Panel Object Activity Description Router’s IP Address, Login Name, and Password FVS124G Rear Panel Logging into the Router FVS124G Bottom Label Default Factory Settings Login screen on the Web browser Factory Default Settings Netgear Related Products Introduction Inbound Traffic Overview of the Planning ProcessVirtual Private Networks VPNs Ports Port rolls over, the VPN tunnel collapses and address That the public and enabled Inbound Traffic Always change at Virtual Private Networks VPNs IP addressing requirements for VPNs in dual WAN port systems Dual VPN Road Warrior Domain i.e., the IP Road Warrior Example Single WAN Port Road Warrior Example Dual WAN Ports, After Rollover Gateway Domain For Improved Reliability 13, either of the gateway WAN Gateway-to-Gateway Example Dual WAN Ports, After Rollover VPN Telecommuter Client-to-Gateway Through a NAT Router Gigabit LAN and Dual WAN Ports Address to establish or re-establish a VPN Remote PC Or WAN2 Connecting the FVS124G to the Internet What You Will Need to Do Before You Begin Customer premises Route diversity WAN port Physical facility Postulated WAN provisioning used in this document Internet Computer Network Configuration Requirements Cabling and Computer Hardware Requirements Internet Configuration Requirements Where Do I Get the Internet Configuration Parameters? Record Your Internet Connection Information Connect the firewall physically to your network required Physically Connect the VPN Firewall to Your Network Required Log in to the VPN Firewall Required Configure the Internet Connections to Your ISPs Required WAN1 and WAN2 Basic Settings and Setup Wizard Screens WAN1 screens WAN2 screens Internet connection methods Connection Method Data Required Connecting the FVS124G to the Internet Manually Configuring Your Internet Connection ISP Does Not Require Login Programming the Traffic Meter if Desired Traffic Meter screens Traffic meter Parameter Description Configure the WAN Mode Required for Dual WAN Rollover Setup WAN Mode screen for auto-rollover Load Balancing and Protocol Binding Setup WAN Mode screen for load balancing and protocol binding Connecting the FVS124G to the Internet Configure Dynamic DNS If Needed Dynamic DNS screens Each DNS service provider requires its own parameters Figure Dynamic DNS service provider screens Configure the WAN Options If Needed 10 WAN Options Screens Connecting the FVS124G to the Internet Chapter LAN Configuration Using the LAN IP Setup Options Configuring LAN TCP/IP Setup Parameters LAN IP Setup menu LAN Configuration Using the Firewall as a Dhcp server Using Address Reservation Groups and Hosts Entry screen Configuring Static Routes Multi Home LAN IPs Static Routes Summary Table and Add screens LAN Configuration Firewall Protection and Content Filtering Overview Using Rules to Block or Allow Specific Kinds of Traffic Rules menu Firewall Protection and Content Filtering Services-Based Rules Add Inbound Service Rules screen Inbound Rules Port Forwarding Inbound Services Services menu see Customized Services on Inbound Rule Example a Local Public Web Server Inbound Rule Example One-to-One NAT Mapping Rule example one-to-one NAT mapping Rule example one-to-one NAT mapping on inbound services Inbound Rule Example Exposed Host Outbound Rules Service Blocking Add Outbound Service Rules screen Outbound Services Block or Allow Specific Traffic on QoS Priorities on Outbound Rule Example Blocking Instant Messenger Customized Services 10 Rules table with examples 11 Services and Add Custom Service screens Quality of Service QoS Priorities 12 Setting and Overriding QoS priorities Highest Default Lowest Managing Groups and Hosts 13 Groups and Hosts screens Using a Schedule to Block or Allow Specific Traffic Groups and hosts 14 Schedule menu Block Sites Time Zone Block Sites menu is shown in Figure 15 Block Sites menu Block Sites Filtering does not apply. See Managing Groups and Hosts on Source MAC Filtering 16 Source MAC Filter screens Port Triggering Source MAC address filter 17 Port Triggering screens Getting E-Mail Notifications of Event Logs and Alerts Port Triggering 18 Logs and E-mail screens Firewall Protection and Content Filtering Viewing Logs of Web Access or Attempted Web Access Syslog 19 Firewall Logs menu Log entry descriptions Administrator Information Log action buttons Firewall Protection and Content Filtering Rollover vs. Load Balancing Mode Dual WAN Port Systems Rollover Mode Setup Screen Fully Qualified Domain Names FVS124G Functional Block Diagram FVS124G Firewall Rest Functional operation of FVS124G WAN ports for rollover mode Load Configuring the FVX538 Creating a VPN Connection Between FVX538 and FVS124G Click Next WAN IP address of remote FVS124G IKE Policies FVX538 VPN Policies screen Configuring the FVS124G 10 FVX538-to-FVS124G VPN screen 11 VPN Wizard start 12 WAN IP address of remote FVX538 Testing the Connection Creating a VPN Connection Netgear VPN Client to FVS124G Configuring the VPN Client 14 VPN Wizard 15 New Client Connection screen Give the New Connection a name, such as toFVS 16 New connection named 17 Remote client info 18 My Identity screen Left frame, click on Security Policy 19 Pre-shared key 20 Client Security Policy screen 21 Client Authorization screen 22 Client Key Exchange screen 23 Client Connection Monitor screen Virtual Private Networking Performance Management Bandwidth Capacity VPN Firewall Features That Reduce Traffic Service Blocking Services Block Sites VPN Firewall Features That Increase TrafficSource MAC Filtering VPN tunnels Port Forwarding Port Triggering Tools for Traffic Management Using QoS to Shift the Traffic MixVPN Tunnels Administrator and Guest Access Authorization Changing the Passwords and Login Timeout Enabling Remote Management Access Remote Management screen Command Line Interface Https//134.177.0.1238080 WAN Port Rollover Event AlertsTraffic Limits Reached Login Failures and Attacks Traffic Limit Reached alert Logs and email screen Viewing VPN Firewall Status and Time Information MonitoringFirewall Status Router Status screen Time information is found on the Schedules screen Time InformationRouter Status Time information on the Schedule screen WAN Ports WAN Port Connection Status Dynamic DNS Status Internet Traffic Information LAN Ports and Attached Devices Known PCs and Devices 10 Network Database screen Known PCs and Devices table Dhcp Log Port Triggering Status You can view the log of the firewall activities FirewallPort Triggering Status data 13 Logs and email screen Invoke the Firewall Log screen from Logs and Email screen 14 Firewall Log screen invoked from Logs and Email screen VPN Tunnels You can view the status of the VPN tunnels Diagnostics 16 Snmp Configuration screens 17 Diagnostics screen Options are described in the following sections Configuration File ManagementDiagnostics Be careful how you use these Restoring and Backing Up the Configuration Upgrading the Firewall Software Erasing the Configuration Factory Defaults Reset Be careful how you use this Router and Network Management Power LED Not On Basic Functioning LEDs Never Turn Off LAN or Internet Port LEDs Not On Troubleshooting the Web Configuration Interface Troubleshooting the ISP Connection Click on OK You should see a message like this one Troubleshooting a TCP/IP Network Using a Ping UtilityTesting the LAN Path to Your Firewall If the path is working, you see this message Testing the Path from Your PC to a Remote Device If the path is not working, you see this message Restoring the Default Configuration and Password Problems with Date and Time Troubleshooting Data and Routing Protocols Dimensions 15 x 7.5 x 4.75 WeightVoltage and amperage 12 VDC, 1.2A 10BASE-T or 100BASE-Tx, RJ-45 Interface Specifications10BASE-T or 100BASE-Tx Appendix B Network, Routing, Firewall, and Basics Related Publications Basic Router Concepts Routing Information Protocol What is a Router?IP Addresses and the Internet Is normally written as Three Main Address Classes Combined with NetmaskEquals Subnet Addressing Example of Subnetting a Class B Address Netmask Notation Translation Table for One Octet Netmask Formats Private IP Addresses Single IP Address Operation Using NAT Single IP Address Operation Using NAT MAC Addresses and Address Resolution Protocol Related Documents Internet Security and Firewalls IP Configuration by DhcpDomain Name Server Ethernet Cabling What is a Firewall?Denial of Service Attack Stateful Packet Inspection Table B-1 UTP Ethernet cable wiring, straight-through Category 5 Cable Quality Inside Twisted Pair Cables Figure B-1illustrates straight-through twisted pair cable Uplink Switches, Crossover Cables, and MDI/MDIX Switching Network, Routing, Firewall, and Basics Network, Routing, Firewall, and Basics Appendix C Preparing Your Network Preparing Your Computers for TCP/IP Networking Configuring Windows 95, 98, and Me for TCP/IP Networking Install or Verify Windows Networking Components Preparing Your Network Enabling Dhcp to Automatically Configure TCP/IP Settings Locate your Network Neighborhood icon Primary Network Logon is set to Windows logon Verifying TCP/IP Properties Selecting Windows’ Internet Access MethodClick OK to continue Restart the PC Configuring Windows NT4, 2000 or XP for IP Networking Dhcp Configuration of TCP/IP in Windows XP Locate your Network Neighborhood icon Preparing Your Network Dhcp Configuration of TCP/IP in Windows Preparing Your Network Obtain an IP address automatically is selected Dhcp Configuration of TCP/IP in Windows NT4 Preparing Your Network Verifying TCP/IP Properties for Windows XP, 2000, and NT4 TCP/IP Properties dialog box now displays MacOS 8.6 or Configuring the Macintosh for TCP/IP NetworkingDefault gateway is Type exit MacOS Verifying TCP/IP Properties for Macintosh Computers What Is Your Configuration Information? Are Login Protocols Used?Verifying the Readiness of Your Internet Account Select the Gateway tab Preparing Your Network Restarting the Network Preparing Your Network What is a VPN? Appendix D Virtual Private Networking IPSec Components What Is IPSec and How Does It Work?IPSec Security Features IPSec contains the following elements Encapsulating Security Payload ESP Authentication Header AH IKE Security Association Original packet and packet with IPSec ESP in Tunnel mode Mode Understand the Process Before You Begin Key Management Interfaces and Addresses VPN Process OverviewVpnc Example Network Interface Addressing WAN Internet/Public and LAN Internal/Private Addressing Setting Up a VPN Tunnel Between GatewaysFirewalls Subnet Addressing Exchange IPSec Security Association IKE VPN Tunnel Negotiation Steps Vpnc IKE Phase I Parameters Vpnc IKE Security Parameters Vpnc IKE Phase II Parameters Testing and TroubleshootingAdditional Reading Virtual Private Networking List of Glossary Terms Numeric Adsl Packet sent to all devices on a network DSL See Internet Control Message Protocol Internet service provider Megabits per second Set of rules for communication between devices on a network See Quality of Service See Wide Area Network Wins Glossary