NETGEAR FVS338 manual VPN Policy Operation, VPN Policy Table

FVS338 ProSafe VPN Firewall 50 Reference Manual

In addition, a CA (Certificate Authority) can also be used to perform authentication (see “Certificates” on page 5-33). To use a CA, each VPN Gateway must have a Certificate from the CA. For each Certificate, there is both a “Public Key” and a “Private Key”. The “Public Key” is freely distributed, and is used to encrypt data. The receiver then uses their “Private Key” to decrypt the data (without the Private Key, decryption is impossible). CAs can be beneficial since using them reduces the amount of data entry required on each VPN Endpoint.

VPN Policy Operation

The VPN Policies screen allows you to add additional policies—either Auto or Manual—and to manage the VPN policies already created. You can edit policies, enable or disable them, or delete them entirely. The rules for VPN policy use conform to:

1.Traffic covered by a policy will automatically be sent via a VPN tunnel.

2.The VPN tunnel is created according to the parameters in the SA (Security Association).

3.The remote VPN Endpoint must have a matching SA, or it will refuse the connection.

VPN Policy Table

When you use the VPN Wizard to set up a VPN tunnel, both a VPN Policy and an IKE Policy is established and populated in both Tables on the VPN Policies screen. The name you selected as the VPN Tunnel connection name during Wizard setup identifies both the VPN Policy and IKE Policy. You can also edit exiting policies, add new VPN policies directly or change the policy hierarchy to the Policy Table. The Policy Table contains the following fields:

•! (Status). Indicates whether the policy is enabled (green circle) or disabled (grey circle). To Enable or Disable a Policy, check the radio box adjacent to the circle and click Enable or Disable, as required.

•Name. Each policy is given a unique name (the Connection Name when using the VPN Wizard). Client Policies are annotated by an “*”.

•Type. The Type is “Auto” or “Manual” as described previously (Auto is used during VPN Wizard configuration).

•Keep alive: It periodically sends ping packets to the host on the peer side of the network to keep the tunnel alive.

–Enable Keep Alive: Check to enable.

–Ping IP Address: Enter the IP Address to which ping packets need to be sent.

–Detection period: Router sends ping packets periodically at regular intervals of time which is specified by the user.

5-6 Virtual Private Networking

v1.0, March 2008