NETGEAR FVS124G - ProSafe VPN Firewall 25 User manual

!
VPN Configuration Guide
NETGEAR® FVS124G

equinux AG and equinux USA, Inc.
© 2015 equinux USA, Inc. All rights reserved.
Under the copyright laws, this manual may not be copied, in whole or in part,
without the written consent of equinux AG or equinux USA, Inc. Your rights to
the software are governed by the accompanying software license agreement.
The equinux logo is a trademark of equinux AG and equinux USA, Inc.,
registered in the U.S. and other countries.
Every effort has been made to ensure that the information in this manual is
accurate. equinux is not responsible for printing or clerical errors.
www.equinux.com!
Apple, the Apple logo, iBook, Mac, Mac OS, MacBook, PowerBook are
trademarks of Apple Computer, Inc., registered in the U.S. and other countries.
NETGEAR is a registered trademark of NETGEAR Inc.
equinux shall have absolutely no liability for any direct or indirect, special
or other consequential damages in connection with the use of the quick
setup guide or any change to the router generally, including without
limitation, any lost profits, business, or data, even if equinux has been
advised of the possibility of such damages.
2

Introduction 4........................................................
Important Prerequisites 5.........................................................
Scenario 6................................................................................
Terminology 7..........................................................................
My NETGEAR Configuration 8.............................
Task 1 – Configure your NETGEAR 9..................
Step 2 –"Retrieve your NETGEAR’s LAN and WAN Configuration
11
Step 3 –"Create a new VPN Policy 12.....................................
Task 2 – Configure VPN Tracker 14.....................
Step 1 - Create a New Connection 14.....................................
Step 2 – Configure the VPN Connection 15............................
Task 3 –"Test the VPN Connection 16..................
It‘s time to go out! 16...............................................................
Start your connection 16..........................................................
Supporting Multiple Users 18...............................
Using Mode Config for IP Address Assignment 18..................
Adding more VPN Tunnels 22.................................................
Troubleshooting 24...............................................
VPN Connection Fails to Establish 24.....................................
Cannot Access Resources on the Remote Network 25.........
Further Questions? 26.............................................................
VPN Settings Explained 27..................................
IKE Policy 27...........................................................................
VPN Policy 30..........................................................................
The Role of the Local Address in VPN Tracker 33..................
3

Introduction
This document describes how VPN Tracker can be used to establish a connection between a
Mac running Mac OS X and a NETGEAR VPN gateway.
NETGEAR Configuration
The first part of this document will show you how to configure a VPN tunnel on a NETGEAR VPN router using a basic
VPN setup that can accept incoming connections from any IP address.
VPN Tracker Configuration
In the second part, this document will show you how to configure VPN Tracker to easily connect to your newly created
VPN tunnel.
Troubleshooting and Advanced Topics
Troubleshooting and advanced topics are covered in the third part of this document. There you will find:
‣instructions for setting up a VPN connection for multiple users
‣troubleshooting tips
‣an in-depth discussion of the various NETGEAR settings and how they relate to VPN Tracker
4
Note This documentation is only a supplement to, not a replacement for, the instructions included with your NETGEAR
device. Please be sure to read those instructions and understand them before starting.

Important Prerequisites
Your NETGEAR Device
This document applies to the following NETGEAR devices
‣FVS124G
The documentation is based on firmware 1.1.48.
Your Mac
‣Make sure to use a recent VPN Tracker version. The latest VPN Tracker release can be obtained from http://
www.vpntracker.com
‣You will need one VPN Tracker license for each Mac running VPN Tracker
5
Tip If you are setting up VPN on your device for the first time, we strongly recommend you start out with the tutorial-
style setup in the first and second part of this document, and only additional features to your connection once you
have the basic setup working.

Scenario
In our example, we need to connect an employee's Mac to an office network. The following diagram illustrates this
scenario:
This guide assumes that the Mac running VPN Tracker already has internet connectivity. The office's NETGEAR firewall
(the “VPN Gateway”) is also already connected to the Internet and can be accessed through a static IP address or a
(Dynamic) DNS host name. In our example setup, we will be using a DNS host name: vpn.example.com.
The NETGEAR device has a second network interface which is connected to the internal office network (LAN). In our
example, the office network has the IP range 192.168.13.0/24 (which is the same as 192.168.13.0/255.255.255.0). This is
the network that will be accessed from the employee’s Mac through the VPN. It is called the “Remote Network” in VPN
Tracker.
6

Terminology
A VPN connection is often called a “tunnel” (or “VPN tunnel”). Every VPN tunnel is established between two “endpoints”.
In our example one endpoint is VPN Tracker and the other endpoint is the VPN gateway.
Please note that for each endpoint, the settings on the other endpoint are considered to be “remote”, while its own settings
are considered to be “local”. That means a “local” setting from VPN Tracker’s perspective, is a “remote” setting from the
VPN gateway’s perspective, and vice versa.
The sample configuration described in this guide is called a “Host to Network” configuration: A single computer, called a
“Host” establishes a VPN tunnel to an entire “Network” behind the VPN gateway.
7

My NETGEAR Configuration
Throughout this guide, there are certain pieces of information that are needed later on for
configuring VPN Tracker. This information is marked with red numbers to make it easier to
reference it later. You can print out this form to help keep track of the various configuration
settings of your NETGEAR device.
➊Pre-Shared Key:
➋NETGEAR’s Local Identifier:
➌NETGEAR’s Remote Identifier:
➍WAN IP Address: . . . (or DNS host name )
➎LAN IP Address: . . .
➏LAN Subnet Mask: . . .
➐LAN Network Address (calculated, see page 12 ): . . .
➑VPN Policy Name: !
8

Task 1 – Configure your NETGEAR
This section describes how to set up your NETGEAR’s VPN. If you do not yet have VPN
configured and in use on your device, please proceed exactly as described in this section. We
will first be creating an IKE policy, which corresponds to “Phase 1” in VPN Tracker. In a second
step, we will be setting up an associated VPN (IPsec) policy, which corresponds to “Phase 2” in
VPN Tracker.
9
Advanced Users If you already have VPN in use on your device, you can use this chapter to verify your settings (refer
to the chapter “VPN Settings Explained” for more detailed information about the settings available on
your NETGEAR). If you have multiple VPN policies set up on the device, you will have to ensure that
there are no unintended side-effects. Please read the chapter “Supporting Multiple Users“ to learn
how to set up multiple tunnels without them interfering with each other.
‣Go to VPN > IKE Policies
‣Click “Add”
Note Make sure you have a current backup of your NETGEAR’s configuration before making any changes.
Step 1 – Create a new IKE policy

!
10
Advanced Users You can use an existing FQDN if your clients
actually connect from the IP address this name
resolves to.
‣Encryption Algorithm: Select “3DES”
‣Authentication Algorithm: Select “SHA-1”
‣Authentication Method: Select “Pre-Shared Key”
‣The pre-shared key is the password that users have to enter before
connecting. Make sure to set a strong password ➊
‣Diffie-Hellman (DH) Group: Select “Group 2 (1024 Bit)”
‣SA Lifetime: 3600 seconds
‣Click “Apply” to add your new IKE policy
‣Policy Name: Enter a name for the connection
‣Direction / Type: Select “Responder”
‣Exchange Mode: Select “Aggressive Mode”
‣Local Identity Type: Select “Fully Qualified Domain Name”
‣Local Identity Data: Enter the identifier to be used by the device, e.g.
“netgear.local”. Make sure to write down the exact identifier ➋
‣Remote Identity Type: Select “Fully Qualified Domain Name”
‣Remote Identity Data: Enter the identifier to be used by the client, e.g.
“vpntracker.local”. It should not be an actually existing name. Make sure
to write down the exact identifier ➌
➋
➌
➊
Tip Use the form on page 9 of this document to keep track of the various settings. You will need again them later on.

Step 2 –"Retrieve your NETGEAR’s LAN and WAN Configuration
(*) If you are using a subnet mask with elements that are not 0 or 255, you can
use one of the many subnet calculators available for free on the Internet to
calculate the network address.!
11
00:00:00
1
2
00:00:00
➍
➏
➎
‣Go to Maintenance > Router Status and obtain the
following information from the Router Status page:
‣WAN1 Configuration:
‣Write down the WAN IP Address ➍
‣If you use Dynamic DNS for your device, or if it has a
DNS host name, write down the host name instead
‣LAN Port:
‣Write down the LAN IP Address ➎
‣Write down the LAN IP Subnet Mask ➏
‣Calculate your LAN Network Address by applying the LAN
Subnet Mask ➏to the LAN IP Address ➎:
‣Applying the subnet mask means setting those elements of
the IP address to 0 where the subnet mask is 0, and
preserving all elements where the subnet mask is 255 (*)
‣In our example:
‣Write down the LAN Network Address you have
calculated as ➐
192 168 13 1
255 255 0255. . .
. . .
LAN Subnet Mask
LAN IP Address
applied to
LAN Network Address 192 168 13 0
. . .

Step 3 –"Create a new VPN Policy
12
‣VPN Policy Name: Enter a name for the VPN Policy ➑.
You can use the same name you used for the IKE policy.
‣IKE Policy: Select the IKE Policy you have just created
‣Remote VPN Endpoint: Select “Fully Qualified Domain
Name”, and enter the same identifier here that you used
as the Remote Identity ➌in the IKE policy
‣SA Life Time: 3600 seconds / 0 Kbytes
‣IPsec PFS: Keep IPsec PFS turned off
‣PFS Key Group: Keep the selected “Group 1 (768 Bit)”
‣Go to VPN > VPN Policies
‣Click “Add Auto Policy”
➌
Advanced Users You can turn on Perfect Forward Secrecy (PFS) later, if you wish. The setting on the device must
match the setting in VPN Tracker (Advanced > Phase 2 > Perfect Forward Secrecy).

13
‣Local IP: Select “Subnet Address”
‣Start IP address: Enter the LAN Network Address ➐
you calculated in Step 2 (here:192.168.13.0)
‣Subnet Mask: Enter the LAN subnet mask ➏you
wrote down in Step 2 (here: 255.255.255.0)
‣Remote IP: Select “Any”
‣AH Configuration: Leave this setting turned off
‣ESP Configuration
‣Enable Encryption: Turn on encryption
‣Encryption Algorithm: Select “3DES”
‣Enable Authentication: Turn on authentication
‣Authentication Algorithm: Select “SHA-1”
‣Click “Apply” to add your new VPN policy

Task 2 – Configure VPN Tracker
This section describes how to configure VPN Tracker to connect to your NETGEAR. You will
need the configuration information you collected during Task 1. If you are missing any
information, please refer back to “Task 1 – Configure your NETGEAR”.
Step 1 - Create a New Connection
14
‣Start VPN Tracker
‣Click the “+” button at the bottom of the
connection list
You will be asked to select a device profile for the
new connection:
‣Select “Netgear” from the list
‣Select your device from the list of NETGEAR
devices
‣If your device has more than one device or
firmware revision available, be sure to select the
revision/firmware matching your device
‣Connection Name: Choose a name for your
connection (e.g. “Office”)
‣Click “OK”

Step 2 – Configure the VPN Connection
15
‣VPN Gateway: Enter your NETGEAR’s public IP
address ➍. If you are using Dynamic DNS, or if the
device has a DNS host name, use it instead (in our
example, we are using the host name
“vpn.example.com”)
‣Local Address: Leave empty for now.. Depending on
your setup, you may have to set a specific Local
Address eventually. Refer to “Supporting Multiple
Users” for details
‣Remote Networks: Enter the network address ➐
and the subnet mask ➏of the network that is being
accessed through the VPN tunnel Separate the
subnet mask with a forward slash (“/”)
‣Identifiers
‣Make sure the types for both identifiers are set to
“Fully Qualified Domain Name (FQDN)”
‣Local: The local identifier consists of the
NETGEAR’s VPN policy name ➑, a number
between 1 and 10 (different for each user of this
connection), and the NETGEAR’s remote identifier
➌(see the diagram on the left). In our example, the
local identifier is “vpntracker1.vpntracker.local”
‣Remote: Enter the local identifier from your
NETGEAR (e.g. “netgear.local”) ➋
vpntracker1.vpntracker.local
(*) How to build the Local Identifier:
➍
➏
➐
➌
➑+ ➋

Task 3 –"Test the VPN Connection
This section explains how to start and test your VPN connection.
It‘s time to go out!
You will not be able to test and use your VPN connection from within the internal network that you want to connect to. To
test your connection, you will need to connect from a different location. For example, if you are setting up a VPN
connection to your office, test it from home. If you are setting up a VPN connection to your home network, test it from an
Internet cafe, or go visit a friend.
Start your connection
!
16
‣Connect to the Internet
‣Make sure that your Internet connection is working –"open your Internet browser and try to
connect to http://www.equinux.com
‣Start VPN Tracker if it’s not already running
‣Slide the On/Off slider for the connection you have just configured to On

When you are prompted for your pre-shared key:
17
➊
‣Pre-shared key: Enter the pre-shared key that you configured on the
NETGEAR device ➊
‣Optionally, check the box “Store in Keychain” to save the password in your
keychain so you are not asked for it again when connecting the next time
‣Click “OK”
‣If the slider goes back to Off after starting the connection, or after entering your pre-shared
key, please read the Troubleshooting section of this document
‣If the slider goes to On and turns blue after a while, you have successfully established a
connection
Congratulations!

Supporting Multiple Users
Once your VPN expands to multiple users, you must ensure that IP addresses do not conflict. In
addition to such purely technical considerations, VPN Tracker makes it easy to distribute pre-
configured connections to your users, and prevent the modification of VPN connections and
access to confidential data.
Using Mode Config for IP Address Assignment
If multiple users connect using the same policy on your NETGEAR at the same time, you must ensure that each of
them uses a different Local Address in VPN Tracker by setting an individual Local Address for each of them. The
easiest way to ensure this, is to automatically have the NETGEAR assign IP addresses to connecting clients through
Mode Config.
Creating an Address Pool for Mode Config
18
Note If you cannot use Mode Config for distributing IP addresses, please refer to “The Role of the Local Address in
VPN Tracker” for alternative solutions.
‣Go to “VPN > ModeConfig”
‣Click “Add”

#
19
➐
➍
‣Record Name: Enter a name that will later allow you to recognize this
entry
‣First IP Pool: Enter an IP range that is not part of your NETGEAR’s LAN.
The range must be from the private (RFC1918) IP address space, and it
should be large enough to accommodate at least the maximum number of
simultaneous VPN connections expected
‣Second/Third IP Pool (optional): It is possible to add more pools, if
required
‣First/Second WINS server (optional): The WINS servers are not used by
VPN Tracker and therefore can remain empty
‣First/Second DNS Server (optional): If you operate your own DNS server,
enter it here. Otherwise, these fields should remain empty
‣Traffic Tunnel Security Level: These settings correspond to the VPN
Policy settings of the same name. The screenshot shows the default
settings used by a normal (non Mode Config) VPN policy. Since these
match the settings pre-configured in VPN Tracker, it is a good idea to use
them for now. You will need to customize the following settings according
to your specific configuration (refer to “ Step 2 –"Retrieve your
NETGEAR’s LAN and WAN Configuration” for the specific values that you
will have to enter):
‣Local Address: Enter the LAN Network Address ➐calculated earlier,
‣Local Subnet Mask: Enter the LAN subnet mask ➍of your NETGEAR
‣Click “Apply” to add the new address pool

Delete the VPN Policy
Configure the IKE Policy to use Mode Config
20
‣The VPN policy must be removed before you
can change the IKE policy to use Mode Config
‣Go to “VPN > VPN Policies”
‣Select your VPN Policy
‣Click “Delete”
‣Go to “VPN > IKE Policies”
‣Select your IKE Policy
‣Click “Edit”
‣In the “Remote” section, select “Remote Host
Configuration Record”
‣Select the record you created earlier
‣Click “Apply”