NETGEAR FVL328 - Cable/DSL ProSafe VPN Firewall... User manual

NETGEAR VPN Client to NETGEAR FVL328 or FWAG114 VPN Router D-1
202-10015-01
NETGEAR VPN Client
to NETGEAR FVL328 or FWAG114 VPN Router
Follow these procedures to configure a VPN tunnel from a NETGEAR ProSafe VPN Client to an
FVL328. This case study follows the VPN Consortium interoperability profile guidelines. The
configuration options for the FVS328 and FWAG114 are the same.
Configuration Profile
The configuration in this document follows the addressing and configuration mechanics defined
by the VPN Consortium. Gather all the necessary information before you begin the configuration
process. Verify whether the firmware is up to date, all of the addresses that will be necessary, and
all of the parameters that need to be set on both sides. Check that there are no firewall restrictions.
Table D-1. Summary
VPN Consortium Scenario: Scenario 1
Type of VPN PC/Client-to-Gateway
Security Scheme: IKE with Preshared Secret/Key (not Certificate-based)
Date Tested: November 2003
Model/Firmware Tested:
Gateway NETGEAR FVL328 firmware v 1.4 or FWAG114 firmware v 2.1
Client NETGEAR ProSafe VPN Client v10.1
IP Addressing:
Gateway Static IP address
Client Dynamic

Reference Manual for the NETGEAR ProSafe VPN Client
D-2 NETGEAR VPN Client to NETGEAR FVL328 or FWAG114 VPN Router
202-10015-01
Figure D-1: Addressing and Subnet Used for Examples
Step-By-Step Configuration of FVL328 or FWAG114 Gateway
1. Log in to the FVL328 gateway as in the illustration.
Out of the box, the FVL328 is set for its default LAN address of http://192.168.0.1 with its
default user name of admin and default password of password. Even though the remainder of
this document will refer to the FVL328, the login procedures and configuration menu screens
are the same for the FVL328 and the FWAG114.
2. Click IKE Policies under the VPN menu and click Add on the IKE Policies Menu.
Note: Product updates are available on the NETGEAR Web site at
www.netgear.com/support/main.asp. VPNC Interoperability guidelines can be found at
http://www.vpnc.org/InteropProfiles/Interop-01.html.
Gateway
0.0.0.0
66.120.188.153
192.168.0.0
WAN IP WAN IP
LAN IP
Network Addresses
Client
PC with Netgear
ProSafe VPN client
FVL328

Reference Manual for the NETGEAR ProSafe VPN Client
NETGEAR VPN Client to NETGEAR FVL328 or FWAG114 VPN Router D-3
202-10015-01
Figure D-2: NETGEAR FVL328 IKE Policy Configuration
– Enter a descriptive name for the policy in the Policy Name field. This name is not supplied
to the remote VPN Endpoint. It is used to help you manage the IKE policies. In our
example, we used VPNclient as the Policy Name.
– From the Direction/Type drop-down box, select Remote Access
– From the Exchange Mode drop-down box, select Aggressive Mode. This will also be
selected in the NETGEAR ProSafe VPN Client My Identity ID Type fields, as seen in
“Security Policy“ on page D-11.
– From the Local Identity drop-down box, select Fully Qualified Domain Name (the actual
WAN IP address of the FVL328 will also be used in the Connection ID Type fields of the
NETGEAR ProSafe VPN Client as seen in “Security Policy Editor New Connection“ on
page D-9).
– For this example we typed FVL328 in the Local Identity Data field.
– From the Remote Identity drop-down box, select Fully Qualified Domain Name.
–TypeVPNclient in the Remote Identity Data. This will also be entered in the NETGEAR
ProSafe VPN Client My Identity ID Type fields, as seen in “My Identity“ on page D-10.

Reference Manual for the NETGEAR ProSafe VPN Client
D-4 NETGEAR VPN Client to NETGEAR FVL328 or FWAG114 VPN Router
202-10015-01
Figure D-3: NETGEAR FVL328 IKE Policy Configuration
– From the Encryption Algorithm drop-down box, select 3DES. This will also be selected in
the NETGEAR ProSafe VPN Client Security Policy Authentication Phase 1 Proposal 1
Encrypt Alg field, as seen in “Connection Security Policy Authentication (Phase 1)“ on
page D-12.
– From the Authentication Algorithm drop-down box, select SHA-1.This will also be
selected in the NETGEAR ProSafe VPN Client Security Policy Authentication Phase 1
Proposal 1 Hash Alg field, as seen in “Connection Security Policy Authentication (Phase
1)“ on page D-12.
– From the Authentication Method radio button, select Pre-shared Key. This will also be
selected in the NETGEAR ProSafe VPN Client Security Policy Authentication Phase 1
Proposal 1 Authentication Method field, as seen in “Connection Security Policy
Authentication (Phase 1)“ on page D-12.
– In the Pre-Shared Key field, type hr5xb84l6aa9r6. You must make sure the key is the
same for both the FVL328 and the NETGEAR VPN Client. This will also be selected in
the NETGEAR ProSafe VPN Client Security Policy Authentication Phase 1 Proposal 1
Encrypt Alg field, as seen in “Connection Identity Pre-Shared Key“ on page D-11.
– From the Diffie-Hellman (DH) Group drop-down box, select Group 2 (1024 Bit). This
will also be selected in the NETGEAR ProSafe VPN Client Security Policy
Authentication Phase 1 Proposal 1 Key Group field, as seen in “Connection Security
Policy Authentication (Phase 1)“ on page D-12.
–IntheSALifeTime field, type 86400.
Click Apply. This will bring you back to the IKE Policies Menu.The FVL328 IKE Policy is
now displayed in the IKE Policies page.

Reference Manual for the NETGEAR ProSafe VPN Client
NETGEAR VPN Client to NETGEAR FVL328 or FWAG114 VPN Router D-5
202-10015-01
3. Click the VPN Policies link under the VPN category on the left side of the main menu. This
will take you to the VPN Policies Menu page. Click Add Auto Policy. This will open a new
screen titled VPN – Auto Policy.
Figure D-4: NETGEAR FVL328 VPN – Auto Policy General settings
– Enter a unique name to identify this policy. This name is not supplied to the remote VPN
endpoint. In our example we have used to318 as the Policy Name. In the Policy Name
field type VPNclient.
– From the IKE policy drop-down box, select VPNclient which is the IKE Policy that was
set up in the earlier step.
– From the Remote VPN Endpoint Address Type drop-down box, select IP Address.
–Type0.0.0.0 as the Address Data of the client because we are assuming the remote PC will
have a dynamically assigned IP address. This will also be entered in the NETGEAR
ProSafe VPN Client Internal Network IP Address field, as seen in “My Identity“ on page
D-10.
–Type86400 in the SA Life Time (Seconds) field.
–Type0 in the SA Life Time (Kbytes) field.
– Check the IPSec PFS checkbox to enable Perfect Forward Secrecy. This will also be
entered in the NETGEAR ProSafe VPN Client Security Policy Enable Perfect Forward
Secrecy checkbox, as seen in “Security Policy“ on page D-11.
– From the PFS Key Group drop-down box, select Group 2 (1024 Bit). This will also be
entered in the NETGEAR ProSafe VPN Client Security Policy PFS Key Group
drop-down selection box, as seen in “Security Policy“ on page D-11.

Reference Manual for the NETGEAR ProSafe VPN Client
D-6 NETGEAR VPN Client to NETGEAR FVL328 or FWAG114 VPN Router
202-10015-01
Figure D-5: NETGEAR FVL328 VPN – Auto Policy Traffic Selector
– From the Traffic Selector Local IP drop-down box, select Subnet addresses. This will
also be entered in the NETGEAR ProSafe VPN Client Connection Remote Party Identity
and Addressing ID Type field, as seen in “Security Policy Editor New Connection“ on
page D-9.
– Type the starting LAN IP Address of the FVL328 in the Local IP Start IP Address field.
For this example, we used 192.168.0.0 which is the default LAN IP address of the
FVL328.This will also be entered in the NETGEAR ProSafe VPN Client Connection
Remote Party Identity and Addressing Subnet field, as seen in “Security Policy Editor
New Connection“ on page D-9.
– Type the LAN Subnet Mask of the FVL328 (255.255.255.0 in our example) in the Local
IP Subnet Mask field. This will also be entered in the NETGEAR ProSafe VPN Client
Connection Remote Party Identity and Addressing Mask field, as seen in “Security Policy
Editor New Connection“ on page D-9.
– From the Traffic Selector Remote IP drop-down box, select Single addresses.
–Type0.0.0.0 as the start IP Address of the in the Remote IP Start IP Address field because
we are assuming the remote PC will have a dynamically assigned IP address. This will
also be entered in the NETGEAR ProSafe VPN Client My Identity Internal Network IP
Address field, as seen in “My Identity“ on page D-10.

Reference Manual for the NETGEAR ProSafe VPN Client
NETGEAR VPN Client to NETGEAR FVL328 or FWAG114 VPN Router D-7
202-10015-01
Figure D-6: NETGEAR FVL328 VPN – Auto Policy ESP Configuration
– Select Enable Encryption in the ESP Configuration Enable Encryption checkbox. This
will also be entered in the NETGEAR ProSafe VPN Client Security Policy Key Exchange
(Phase 2) Encapsulation Protocol (ESP) checkbox, as seen in “Connection Security Policy
Key Exchange (Phase 2)“ on page D-13.
– From the ESP Configuration Encryption Algorithm drop-down box, select 3DES. This
will also be entered in the NETGEAR ProSafe VPN Client Security Policy Key Exchange
(Phase 2) Encrypt Alg field, as seen in “Connection Security Policy Key Exchange (Phase
2)“ on page D-13.
– Select Enable Authentication in the ESP Configuration Enable Authentication checkbox.
Note: Do not confuse this with the Authentication Protocol (AH) option. Using the AH
option will prevent clients behind a home NAT router from connecting.
– From the ESP Configuration Authentication Algorithm drop-down box, select SHA-1.
This will also be entered in the NETGEAR ProSafe VPN Client Security Policy Key
Exchange (Phase 2) Hash Alg field, as seen in “Connection Security Policy Key Exchange
(Phase 2)“ on page D-13.
– Select NETBIOS Enable in the NETBIOS Enable checkbox to enable networking
features like Windows Network Neighborhood.
Click Apply to save your changes. You will be taken back to the VPN Policies Menu page.
4. When the screen returns to the VPN Policies, make sure the Enable checkbox is selected.
Click Apply to save your changes.

Reference Manual for the NETGEAR ProSafe VPN Client
D-8 NETGEAR VPN Client to NETGEAR FVL328 or FWAG114 VPN Router
202-10015-01
Step-By-Step Configuration of the NETGEAR VPN Client B
This procedure describes linking a remote PC and a LAN. The LAN will connect to the Internet
using an FVL328 with a static IP address. The PC can be directly connected to the Internet through
dialup, cable or DSL modem, or other means, and we will assume it has a dynamically assigned IP
address.
1. Install the NETGEAR VPN Client Software on the PC.
• You may need to insert your Windows CD to complete the installation.
• Reboot your PC after installing the client software.
Note: The NETGEAR ProSafe VPN Client has the ability to “Import” a predefined
configuration profile. The FVL328.SPD file on the NETGEAR ProSafe VPN Client
Resource CD (230-10007-01) includes all the settings identified in this procedure.
Whenever importing policy settings, you should first export any existing settings you
may have configured to prevent the new imported settings from replacing an existing
working configuration.
To import this policy, use the Security Policy Editor File menu to select Import Policy,
and select the FVL328.SPD file at D:\Software\Policies where D is the drive letter of
your CD-ROM drive.
Note: Before installing the NETGEAR ProSafe VPN Client software, be sure to turn off
any virus protection or firewall software you may be running on your PC.

Reference Manual for the NETGEAR ProSafe VPN Client
NETGEAR VPN Client to NETGEAR FVL328 or FWAG114 VPN Router D-9
202-10015-01
2. Configure the Connection Network Settings.
Figure D-7: Security Policy Editor New Connection
a. Run the Security Policy Editor program and create a VPN Connection.
Figure D-8: Security Policy Editor Options menu
Note: If the configuration settings on this screen are not available for editing, go to the
Options menu, select Secure, and Specified Options to enable editing of these settings.
From the Edit menu of the Security Policy Editor, click Add, then Connection. A “New
Connection” listing appears. Rename the “New Connection” to FVL328.
b. Assure that the following settings are configured:
– In the Connection Security box, Secure is selected

Reference Manual for the NETGEAR ProSafe VPN Client
D-10 NETGEAR VPN Client to NETGEAR FVL328 or FWAG114 VPN Router
202-10015-01
– In the Protocol menu, All is selected
– The Connect using Secure Gateway Tunnel checkbox is checked
c. In this example, select IP Subnet as the ID Type, 192.168.0.0 in the Subnet field (the
Subnet address is the LAN IP Address of the FVL328 with 0 as the last number), and
255.255.255.0 in the Mask field, which is the LAN Subnet Mask of the FVL328
d. In the ID Type menus, select Domain Name and Gateway IP Address. Enter FVL328 in
the Domain Name field. In this example, 66.120.188.153 would be used for the Gateway
IP Address, which is the static IP address for the FVL328 WAN port.
3. Configure the Connection Identity Settings.
a. In the Network Security Policy list, click the My Identity subheading.
Figure D-9: My Identity
In this example, select Domain Name as the ID Type, and enter VPNclient. Also, accept
the default Internal Network IP Address of 0.0.0.0.
Figure D-10: My Identity Pre-Shared Key
b. Click Pre-Shared Key.

Reference Manual for the NETGEAR ProSafe VPN Client
NETGEAR VPN Client to NETGEAR FVL328 or FWAG114 VPN Router D-11
202-10015-01
Figure D-11: Connection Identity Pre-Shared Key
c. Enter hr5xb84l6aa9r6 which is the same Pre-Shared Key entered in the FVL328.
d. Click OK.
4. Configure the Connection Identity Settings.
a. In the Network Security Policy list, click the Security Policy subheading.
Figure D-12: Security Policy
b. For this example, assure that the following settings are configured:
– In the Select Phase 1 Negotiation Mode menu, select Aggressive Mode.
– Check the Enable Perfect Forward Secrecy (PFS) checkbox.
– In the PFS Key Group drop-down list, Diffie-Hellman Group 2.
– Check the Enable Replay Detection checkbox.
In this example, enter this
pre-shared key in this field:
hr5xb84l6aa9r6

Reference Manual for the NETGEAR ProSafe VPN Client
D-12 NETGEAR VPN Client to NETGEAR FVL328 or FWAG114 VPN Router
202-10015-01
5. Configure the Connection Security Policy
In this step, you will provide the authentication (IKE Phase 1) settings, and the key exchange
(Phase 2) settings. The setting choices in this procedure follow the VPNC guidelines.
Figure D-13: Connection Security Policy Authentication (Phase 1)
a. Configure the Authentication (Phase 1) Settings.
• Expand the Security Policy heading, then expand the Authentication (Phase 1)
heading, and click on Proposal 1.
• For this example, assure that the following settings are configured:
– In the Encrypt Alg menu, select Triple DES.
– In the Hash Alg, select SHA-1.
– In the SA Life, select Unspecified.
– In the Key Group menu, select Diffie-Hellman Group 2.

Reference Manual for the NETGEAR ProSafe VPN Client
NETGEAR VPN Client to NETGEAR FVL328 or FWAG114 VPN Router D-13
202-10015-01
Figure D-14: Connection Security Policy Key Exchange (Phase 2)
b. Configure the Key Exchange (Phase 2).
• Expand the Key Exchange (Phase 2) heading, and click on Proposal 1.
• For this example, assure that the following settings are configured:
– In the SA Life menu, select Unspecified.
– In the Compression menu, select None.
– Check the Encapsulation Protocol (ESP) checkbox.
– In the Encrypt Alg menu, select Triple DES.
– In the Hash Alg, select SHA-1.
– In the Encapsulation menu, select Tunnel.

Reference Manual for the NETGEAR ProSafe VPN Client
D-14 NETGEAR VPN Client to NETGEAR FVL328 or FWAG114 VPN Router
202-10015-01
6. Configure the Global Policy Settings.
a. From the Options menu at the top of the Security Policy Editor window, select Global
Policy Settings.
Figure D-15: Security Policy Editor Global Policy Options
b. Increase the Retransmit Interval period to 45 seconds.
c. Check the Allow to Specify Internal Network Address checkbox and click OK.
7. Save the VPN Client Settings.
From the File menu at the top of the Security Policy Editor window, select Save.
After you have configured and saved the VPN client information, your PC will automatically
open the VPN connection when you attempt to access any IP addresses in the range of the
remote VPN router’s LAN.
Note: Whenever you make changes to a Security Policy, save them first, then deactivate
the security policy, reload the security policy, and finally activate the security policy.
This assures that your new settings will take effect.

Reference Manual for the NETGEAR ProSafe VPN Client
NETGEAR VPN Client to NETGEAR FVL328 or FWAG114 VPN Router D-15
202-10015-01
Testing the VPN Connection
You can test the VPN connection in several ways:
• From the client PC to the FVL328
• From the FVL328 to the client PC
These procedures are explained below.
From the Client PC to the FVL328
To check the VPN Connection, you can initiate a request from the remote PC to the FVL328 by
using the “Connect” option of the NETGEAR VPN Client popup menu.
Figure D-16: Connecting the PC to the FVL328 over the VPN tunnel
1. Open the popup menu by right-clicking on the system tray icon.
2. Select Connect to open the My Connections list.
3. Choose FVL328.
The NETGEAR VPN Client will report the results of the attempt to connect.
Note: Virus protection or firewall software can interfere with VPN communications. Be
sure such software is not running on the remote PC with the NETGEAR VPN Client and
that the firewall features of the FVL328 is not set in such a way as to prevent VPN
communications.
Right-mouse-click on the
system tray icon to open the
popup menu.

Reference Manual for the NETGEAR ProSafe VPN Client
D-16 NETGEAR VPN Client to NETGEAR FVL328 or FWAG114 VPN Router
202-10015-01
Once the connection is established, you can access resources of the network connected to the
FVL328.
Another method is to ping from the remote PC to the LAN IP address of the FVL328. To perform
a ping test using our example, start from the remote PC:
1. Establish an Internet connection from the PC.
2. On the Windows taskbar, click the Start button, and then click Run.
3. Type ping -t 192.168.0.1, and then click OK.
This will cause a continuous ping to be sent to the first FVL328. After a period of up to two
minutes, the ping response should change from “timed out” to “reply.”
To test the connection to a computer connected to the FVL328, simply ping the IP address of
that computer.
Once connected, you can open a browser on the remote PC and enter the LAN IP Address of the
FVL328, which is http://192.168.0.1 in this example. After a short wait, you should see the login
screen of the FVL328.
From the FVL328 to the Client PC
You can use the FVL328 Diagnostic utilities to test the VPN connection from the FVL328 to the
client PC. Run ping tests from the Diagnostics link of the FVL328 main menu.

Reference Manual for the NETGEAR ProSafe VPN Client
NETGEAR VPN Client to NETGEAR FVL328 or FWAG114 VPN Router D-17
202-10015-01
Monitoring the PC VPN Connection
Information on the progress and status of the VPN client connection can be viewed by opening the
NETGEAR VPN Client Connection Monitor or Log Viewer. To launch these functions, click on
the Windows Start button, then select Programs, then NETGEAR ProSafe VPN Client, then either
the Connection Monitor or Log Viewer.
The Log Viewer screen for a successful connection is shown below:
Figure D-17: Log Viewer screen

Reference Manual for the NETGEAR ProSafe VPN Client
D-18 NETGEAR VPN Client to NETGEAR FVL328 or FWAG114 VPN Router
202-10015-01
A sample Connection Monitor screen for a different connection is shown below:
Figure D-18: Connection Monitor screen
In this example you can see the following:
• The FVL328 has a public IP WAN address of 66.120.188.153
• The FVL328 has a LAN IP address of 192.168.0.1
• The VPN client PC is behind a home NAT router and has a dynamically assigned address
of 192.168.0.3
While the connection is being established, the Connection Name field in this menu will say “SA”
before the name of the connection. When the connection is successful, the “SA” will change to the
yellow key symbol shown in the illustration above.

Reference Manual for the NETGEAR ProSafe VPN Client
NETGEAR VPN Client to NETGEAR FVL328 or FWAG114 VPN Router D-19
202-10015-01
Viewing the FVL328 VPN Status and Log Information
Information on the status of the VPN client connection can be viewed by opening the FVL328
VPN Status screen. To view this screen, click the VPN Status link of the FVL328 main menu.
The FVL328 VPN Status screen for a successful connection is shown below:
Figure D-19: FVL328 VPN Status screen
To view the FVL328 VPN log, click on the VPN Status link on the left side of the main menu. The
log information should be similar to the example below:

Reference Manual for the NETGEAR ProSafe VPN Client
D-20 NETGEAR VPN Client to NETGEAR FVL328 or FWAG114 VPN Router
202-10015-01