Reference Manual for the ProSafe VPN Firewall FVS318v3

Using Policies to Manage VPN Traffic

You create policy definitions to manage VPN traffic on the FVS318v3. There are two kinds of policies:

•IKE Policies: Define the authentication scheme and automatically generate the encryption keys. As an alternative option, to further automate the process, you can create an IKE policy that uses a trusted certificate authority to provide the authentication while the IKE policy still handles the encryption.

•VPN Policies: Apply the IKE policy to specific traffic that requires a VPN tunnel. Or, you can create a VPN policy that does not use an IKE policy but in which you manually enter all the authentication and key parameters.

Since VPN policies use IKE policies, you define the IKE policy first. The FVS318v3 also allows you to manually input the authentication scheme and encryption key values. In the case of manual key management there will not be any IKE policies.

In order to establish secure communication over the Internet with the remote site you need to configure matching VPN policies on both the local and remote FVS318v3 VPN Firewalls. The outbound VPN policy on one end must match to the inbound VPN policy on other end, and vice versa.

When the network traffic enters into the FVS318v3 from the LAN network interface, if there is no VPN policy found for a type of network traffic, then that traffic passes through without any change. However, if the traffic is selected by a VPN policy, then the IPSec authentication and encryption rules are applied to it as defined in the VPN policy.

By default, a new VPN policy is added with the least priority, that is, at the end of the VPN policy table.

Using Automatic Key Management

The most common configuration scenarios will use IKE policies to automatically manage the authentication and encryption keys. Based on the IKE policy, some parameters for the VPN tunnel are generated automatically. The IKE protocols perform negotiations between the two VPN endpoints to automatically generate required parameters.

Some organizations will use an IKE policy with a Certificate Authority (CA) to perform authentication. Typically, CA authentication is used in large organizations that maintain their own internal CA server. This requires that each VPN gateway have a certificate from the CA. Using CAs reduces the amount of data entry required on each VPN endpoint.

6-2

Advanced Virtual Private Networking

January 2005

Page 89 Page 91
Page 90
Image 90
NETGEAR FVS318v3 manual Using Policies to Manage VPN Traffic, Using Automatic Key Management
Page 89 Page 91

FVS318v3 specifications

The NETGEAR FVS318v3 is a powerful dual WAN gigabit VPN firewall designed to provide robust security and reliable connectivity for small to medium-sized businesses. It offers an array of features and technologies that make it an outstanding choice for organizations requiring secure network access and improved bandwidth management.

One of the standout features of the FVS318v3 is its dual WAN capability. This allows users to connect two separate internet connections, which enhances redundancy and ensures continuous network availability. In the event that one WAN connection fails, the device automatically switches to the backup connection, minimizing downtime and maintaining productivity.

The firewall offers advanced security features, including a stateful packet inspection (SPI) firewall and NAT (Network Address Translation), which helps protect the network from unauthorized access and external threats. Additionally, the FVS318v3 supports IPsec and SSL VPN protocols, providing secure remote access for employees working from home or on the go. With support for up to 15 SSL VPN clients and 20 IPsec VPN tunnels, it is suitable for businesses that require flexible and secure remote connectivity.

In terms of performance, the FVS318v3 boasts a high-speed gigabit throughput, ensuring fast data transmission and minimal latency. This is particularly important for businesses that rely on cloud-based applications, video conferencing, and other bandwidth-intensive activities. Furthermore, the device is equipped with advanced QoS (Quality of Service) features that allow administrators to prioritize traffic, ensuring that critical applications receive the bandwidth they need during peak usage times.

Another noteworthy characteristic of the NETGEAR FVS318v3 is its user-friendly interface, which simplifies network management and configuration. Administrators can easily set up policies, monitor traffic, and manage connected devices through an intuitive web-based interface. It also offers support for 802.1Q VLAN tagging, allowing for network segmentation and improved security management.

In conclusion, the NETGEAR FVS318v3 is a versatile and feature-rich solution that delivers exceptional security and reliability for businesses. Its dual WAN functionality, advanced VPN capabilities, high-speed performance, and ease of use make it an excellent choice for organizations looking to safeguard their networks while ensuring seamless connectivity for employees.
Top Page Image Contents