NETGEAR DGFV338 - ProSafe Wireless ADSL Modem VPN Firewall... Manual

Version 1.0
Hub and Spoke VPN using the VPN Prosafe Client
This document describes the steps to undertake in configuring a Hub-and-Spoke network over
the Internet using VPNs (box-to-box and client-to-box).
In particular it describes how to allow VPN clients (Spoke) to access Remote LANs (Spokes) via
a single VPN connection to a central (Hub) Firewall/Router.
The configuration can apply to any of the VPN Firewall/Router from firmware version 3.5.0.24 and
above, and VPN clients from version 10.8.3 and above.
The diagram below shows a typical scenario.
Internet
Spoke 2
192.168.0.x/24
VPN Box to Box connection
VPN Client to Box connection (mode config)
LAN2
LAN1
Client connection to LAN 2 via VPN Client connection to LAN1
FVS338 (Spoke 1)
Public IP: 83.71.251.20
LAN IP : 172.22.102.102
VPN Information:
BoxToBox (To FVX538)
LAN2toClient (FVS338 To VPN clients via FVX538)
FVX538
Public IP: 83.71.251.19
LAN IP: 172.22.101.101
VPN Information:
BoxToBox (To FVS338)
LAN1toVPN (FVX538 To VPN clients)
LAN2toClient (VPN Clients to FVS338 via FVX538)
LAN1

Version 1.0
Table of Contents
NETWORK SETUP.......................................................................................................... 3
Physical setup............................................................................................................... 3
Logical setup................................................................................................................. 3
Configuration of VPN policies on the Firewall/Routers.............................................. 4
FVX538 VPN Config (Policy name: BoxtoBox)....................................................... 4
FVS338 VPN Config (Policy name: BoxtoBox)....................................................... 4
FVX538 VPN Config (Policy name: LAN1toVPN)................................................... 5
FVX538 VPN Config (Policy name: LAN2Client).................................................... 6
FVS338 VPN Config (Policy name: LAN2Client).................................................... 6
VPN client configuration.................................................................................................. 7
Testing the connection.................................................................................................... 8

Version 1.0
NETWORK SETUP
Physical setup
FVX538 connected to the Internet via a modem or modem/router
FVS338 connected to the Internet via a modem or modem/router
VPN Client PCs connected Wireless/Wired to the Internet (via a LAN allowing IPSEC
traffic)
Logical setup
FVX538
LAN IP: 172.22.101.101/24
DHCP: 172.22.101.0/24
Mode Config DHCP: 192.168.0.0/24
Firmware version: 3.5.0.24
FVS338
LAN IP: 172.22.102.102/24
DHCP: 172.22.102.0/24
Firmware version: 3.5.0.24
VPN Client
Version: 10.8.3
NIC IP: 192.168.0.x/24
VPN configuration
The setup will require the creation of multiple VPN policies:
FVX538
- 1x Box-to-box policy from the FVX538 to the FVS338 (Policy name: BoxtoBox)
- 1x Client-to-Box policy on the FVX538 to connect to the VPN clients (Policy name:
LAN1toVPN)
- 1x Manual VPN policy using the IKE policy used for the box-to-box connection to
allow the VPN clients to connect to the LAN behind the FVS338 (Policy name:
LAN2toClient)
FVS338
- 1x Box-to-box policy from the FVS338 to the FVX538 (Policy name: BoxtoBox)
- 1x Manual VPN policy using the IKE policy used for the box-to-box connection to
allow the FVS338 to connect to the VPN clients (Policy name: LAN2toClient)
VPN Client
- 1x Policy connecting to the Public address of the FVS338 specifying as the IP range
for the Remote party 172.22.0.0 mask 255.255.0.0 (class full only mask accepted)

Version 1.0
Configuration of VPN policies on the Firewall/Routers
FVX538 VPN Config (Policy name: BoxtoBox)
Access the VPN Wizard via the VPN
configuration page.
Configure the Connection name (for
admin reasons this will match the
FVS338 box as BoxtoBox).
❶Input the pre-shared key.
Configure the Public or DNS address of
the Remote location, and the LAN details
(the Remote LAN IP address is intended
as the subnet address).
Click on Apply
FVS338 VPN Config (Policy name: BoxtoBox)
Access the VPN Wizard via the VPN
configuration page.
Configure the Connection name (for
admin reasons this will match the other
box as BoxtoBox).
Input the pre-shared key as at point ❶
Configure the Public or DNS address of
the Remote location, and the LAN details
(the Remote LAN IP address is intended
as the subnet address).
Click on Apply
❶

Version 1.0
FVX538 VPN Config (Policy name: LAN1toVPN)
Access the VPN Wizard via the VPN
configuration page.
Create a new VPN client policy named
LAN1toVPN (with any pre-shared key)
Take note of the Remote and Local
identifier whether using the default ones
or new ones.
Click on Apply
Edit the LAN1toVPN.
Change the Local IP setting to any and
the Remote IP to subnet, modifying the
Start IP address to 192.168.0.0 with
subnet mask 255.255.255.0
Click on Apply

Version 1.0
FVX538 VPN Config (Policy name: LAN2Client)
Access the VPN Wizard via the VPN
configuration page.
In the VPN Policy section click on Add
(this will create a new manual VPN policy
which will use an existing IKE policy)
Create a new VPN client policy named
LAN2toClient
Specify the Remote Endpoint IP address
to be the Public address of the FVS338
Specify the Local IP subnet to be the one
of the VPN clients as 192.168.0.0/24 and
the Remote IP subnet to be the LAN of
the FVS338 as 172.22.102.0/24
Ensure that the Select IKE Policy is set to
BoxtoBox
Click on Apply
FVS338 VPN Config (Policy name: LAN2Client)
Access the VPN Wizard via the VPN
configuration page.
In the VPN Policy section click on Add
(this will create a new manual VPN policy
which will use an existing IKE policy)
Create a new VPN client policy named
LAN2toClient
Specify the Remote Endpoint IP address
to be the Public address of the FVX538
Specify the Local IP subnet to be the one
of the FVS338 172.22.102.0/24 and the
Remote IP subnet to be the VPN clients
one 192.168.0.0/24
Ensure that the Select IKE Policy is set to
BoxtoBox
Click on Apply

Version 1.0
VPN client configuration
This configuration requires advanced IP address planning. The VPN client policy needs to be
able to address both Local Area Network #1 and Local Area Network #2 in the same client policy
profile, therefore, the two networks must be presentable as one subnet or one address range.
This has been considered in our scenario.
Create a new VPN client policy
Specify the Remote Party ID type as IP
Subnet and the subnet and mask as
172.22.0.0 255.255.255.0 (this will
address both LAN1 and LAN2)
The gateway IP address will be specified
at the WAN address of the FVX538 in our
case
In My identity change the pre-shared key
to match the VPN policy LAN1toVPN
created on the FVX538 (12345678)
Set the Virtual adapter as Required as
specify a unique value for the Internal
network IP address (this will be different
on each PC running the VPN client
In the Security policy section ensure the
Phase 1 negotiation mode is set to
aggressive , PFS is enabled and Enable
Replay Detection is ticked

Version 1.0
Testing the connection
VPN Client
From the VPN client run ipconfig to
confirm once the VPN is established that
the Virtual adapter interface is assigned
with the IP address specified in the policy
(in this case 192.168.0.1 )
Test the VPN connection to both the
FVX538 and FVS338 by pinging each
box LAN IP address
FVS338
From Monitoring, Diagnostic on the
FVS338 ping the VPN client IP address
1902.168.0.1