NETGEAR FVS124G - ProSafe VPN Firewall 25 User manual

!
VPN Configuration Guide
NETGEAR® FVS124G

equinux AG and equinux USA, Inc.
© 2015 equinux USA, Inc. All rights reserved.
Under the copyright laws, this manual may not be copied, in whole or in part,
without the written consent of equinux AG or equinux USA, Inc. Your rights to
the software are governed by the accompanying software license agreement.
The equinux logo is a trademark of equinux AG and equinux USA, Inc.,
registered in the U.S. and other countries.
Every effort has been made to ensure that the information in this manual is
accurate. equinux is not responsible for printing or clerical errors.
www.equinux.com!
Apple, the Apple logo, iBook, Mac, Mac OS, MacBook, PowerBook are
trademarks of Apple Computer, Inc., registered in the U.S. and other countries.
NETGEAR is a registered trademark of NETGEAR Inc.
equinux shall have absolutely no liability for any direct or indirect, special
or other consequential damages in connection with the use of the quick
setup guide or any change to the router generally, including without
limitation, any lost profits, business, or data, even if equinux has been
advised of the possibility of such damages.
2

Introduction 4........................................................
Important Prerequisites 5.........................................................
Scenario 6................................................................................
Terminology 7..........................................................................
My NETGEAR Configuration 8.............................
Task 1 – Configure your NETGEAR 9..................
Step 2 –"Retrieve your NETGEAR’s LAN and WAN Configuration
11
Step 3 –"Create a new VPN Policy 12.....................................
Task 2 – Configure VPN Tracker 14.....................
Step 1 - Create a New Connection 14.....................................
Step 2 – Configure the VPN Connection 15............................
Task 3 –"Test the VPN Connection 16..................
It‘s time to go out! 16...............................................................
Start your connection 16..........................................................
Supporting Multiple Users 18...............................
Using Mode Config for IP Address Assignment 18..................
Adding more VPN Tunnels 22.................................................
Troubleshooting 24...............................................
VPN Connection Fails to Establish 24.....................................
Cannot Access Resources on the Remote Network 25.........
Further Questions? 26.............................................................
VPN Settings Explained 27..................................
IKE Policy 27...........................................................................
VPN Policy 30..........................................................................
The Role of the Local Address in VPN Tracker 33..................
3

Introduction
This document describes how VPN Tracker can be used to establish a connection between a
Mac running Mac OS X and a NETGEAR VPN gateway.
NETGEAR Configuration
The first part of this document will show you how to configure a VPN tunnel on a NETGEAR VPN router using a basic
VPN setup that can accept incoming connections from any IP address.
VPN Tracker Configuration
In the second part, this document will show you how to configure VPN Tracker to easily connect to your newly created
VPN tunnel.
Troubleshooting and Advanced Topics
Troubleshooting and advanced topics are covered in the third part of this document. There you will find:
‣instructions for setting up a VPN connection for multiple users
‣troubleshooting tips
‣an in-depth discussion of the various NETGEAR settings and how they relate to VPN Tracker
4
Note This documentation is only a supplement to, not a replacement for, the instructions included with your NETGEAR
device. Please be sure to read those instructions and understand them before starting.

Important Prerequisites
Your NETGEAR Device
This document applies to the following NETGEAR devices
‣FVS124G
The documentation is based on firmware 1.1.48.
Your Mac
‣Make sure to use a recent VPN Tracker version. The latest VPN Tracker release can be obtained from http://
www.vpntracker.com
‣You will need one VPN Tracker license for each Mac running VPN Tracker
5
Tip If you are setting up VPN on your device for the first time, we strongly recommend you start out with the tutorial-
style setup in the first and second part of this document, and only additional features to your connection once you
have the basic setup working.

Scenario
In our example, we need to connect an employee's Mac to an office network. The following diagram illustrates this
scenario:
This guide assumes that the Mac running VPN Tracker already has internet connectivity. The office's NETGEAR firewall
(the “VPN Gateway”) is also already connected to the Internet and can be accessed through a static IP address or a
(Dynamic) DNS host name. In our example setup, we will be using a DNS host name: vpn.example.com.
The NETGEAR device has a second network interface which is connected to the internal office network (LAN). In our
example, the office network has the IP range 192.168.13.0/24 (which is the same as 192.168.13.0/255.255.255.0). This is
the network that will be accessed from the employee’s Mac through the VPN. It is called the “Remote Network” in VPN
Tracker.
6

Terminology
A VPN connection is often called a “tunnel” (or “VPN tunnel”). Every VPN tunnel is established between two “endpoints”.
In our example one endpoint is VPN Tracker and the other endpoint is the VPN gateway.
Please note that for each endpoint, the settings on the other endpoint are considered to be “remote”, while its own settings
are considered to be “local”. That means a “local” setting from VPN Tracker’s perspective, is a “remote” setting from the
VPN gateway’s perspective, and vice versa.
The sample configuration described in this guide is called a “Host to Network” configuration: A single computer, called a
“Host” establishes a VPN tunnel to an entire “Network” behind the VPN gateway.
7

My NETGEAR Configuration
Throughout this guide, there are certain pieces of information that are needed later on for
configuring VPN Tracker. This information is marked with red numbers to make it easier to
reference it later. You can print out this form to help keep track of the various configuration
settings of your NETGEAR device.
➊Pre-Shared Key:
➋NETGEAR’s Local Identifier:
➌NETGEAR’s Remote Identifier:
➍WAN IP Address: . . . (or DNS host name )
➎LAN IP Address: . . .
➏LAN Subnet Mask: . . .
➐LAN Network Address (calculated, see page 12 ): . . .
➑VPN Policy Name: !
8

Task 1 – Configure your NETGEAR
This section describes how to set up your NETGEAR’s VPN. If you do not yet have VPN
configured and in use on your device, please proceed exactly as described in this section. We
will first be creating an IKE policy, which corresponds to “Phase 1” in VPN Tracker. In a second
step, we will be setting up an associated VPN (IPsec) policy, which corresponds to “Phase 2” in
VPN Tracker.
9
Advanced Users If you already have VPN in use on your device, you can use this chapter to verify your settings (refer
to the chapter “VPN Settings Explained” for more detailed information about the settings available on
your NETGEAR). If you have multiple VPN policies set up on the device, you will have to ensure that
there are no unintended side-effects. Please read the chapter “Supporting Multiple Users“ to learn
how to set up multiple tunnels without them interfering with each other.
‣Go to VPN > IKE Policies
‣Click “Add”
Note Make sure you have a current backup of your NETGEAR’s configuration before making any changes.
Step 1 – Create a new IKE policy

!
10
Advanced Users You can use an existing FQDN if your clients
actually connect from the IP address this name
resolves to.
‣Encryption Algorithm: Select “3DES”
‣Authentication Algorithm: Select “SHA-1”
‣Authentication Method: Select “Pre-Shared Key”
‣The pre-shared key is the password that users have to enter before
connecting. Make sure to set a strong password ➊
‣Diffie-Hellman (DH) Group: Select “Group 2 (1024 Bit)”
‣SA Lifetime: 3600 seconds
‣Click “Apply” to add your new IKE policy
‣Policy Name: Enter a name for the connection
‣Direction / Type: Select “Responder”
‣Exchange Mode: Select “Aggressive Mode”
‣Local Identity Type: Select “Fully Qualified Domain Name”
‣Local Identity Data: Enter the identifier to be used by the device, e.g.
“netgear.local”. Make sure to write down the exact identifier ➋
‣Remote Identity Type: Select “Fully Qualified Domain Name”
‣Remote Identity Data: Enter the identifier to be used by the client, e.g.
“vpntracker.local”. It should not be an actually existing name. Make sure
to write down the exact identifier ➌
➋
➌
➊
Tip Use the form on page 9 of this document to keep track of the various settings. You will need again them later on.