NETGEAR FVL328 - Cable/DSL ProSafe VPN Firewall... User manual

NETGEAR VPN Client to NETGEAR FVL328 or FWAG114 VPN Router D-1
202-10015-01
NETGEAR VPN Client
to NETGEAR FVL328 or FWAG114 VPN Router
Follow these procedures to configure a VPN tunnel from a NETGEAR ProSafe VPN Client to an
FVL328. This case study follows the VPN Consortium interoperability profile guidelines. The
configuration options for the FVS328 and FWAG114 are the same.
Configuration Profile
The configuration in this document follows the addressing and configuration mechanics defined
by the VPN Consortium. Gather all the necessary information before you begin the configuration
process. Verify whether the firmware is up to date, all of the addresses that will be necessary, and
all of the parameters that need to be set on both sides. Check that there are no firewall restrictions.
Table D-1. Summary
VPN Consortium Scenario: Scenario 1
Type of VPN PC/Client-to-Gateway
Security Scheme: IKE with Preshared Secret/Key (not Certificate-based)
Date Tested: November 2003
Model/Firmware Tested:
Gateway NETGEAR FVL328 firmware v 1.4 or FWAG114 firmware v 2.1
Client NETGEAR ProSafe VPN Client v10.1
IP Addressing:
Gateway Static IP address
Client Dynamic

Reference Manual for the NETGEAR ProSafe VPN Client
D-2 NETGEAR VPN Client to NETGEAR FVL328 or FWAG114 VPN Router
202-10015-01
Figure D-1: Addressing and Subnet Used for Examples
Step-By-Step Configuration of FVL328 or FWAG114 Gateway
1. Log in to the FVL328 gateway as in the illustration.
Out of the box, the FVL328 is set for its default LAN address of http://192.168.0.1 with its
default user name of admin and default password of password. Even though the remainder of
this document will refer to the FVL328, the login procedures and configuration menu screens
are the same for the FVL328 and the FWAG114.
2. Click IKE Policies under the VPN menu and click Add on the IKE Policies Menu.
Note: Product updates are available on the NETGEAR Web site at
www.netgear.com/support/main.asp. VPNC Interoperability guidelines can be found at
http://www.vpnc.org/InteropProfiles/Interop-01.html.
Gateway
0.0.0.0
66.120.188.153
192.168.0.0
WAN IP WAN IP
LAN IP
Network Addresses
Client
PC with Netgear
ProSafe VPN client
FVL328

Reference Manual for the NETGEAR ProSafe VPN Client
NETGEAR VPN Client to NETGEAR FVL328 or FWAG114 VPN Router D-3
202-10015-01
Figure D-2: NETGEAR FVL328 IKE Policy Configuration
– Enter a descriptive name for the policy in the Policy Name field. This name is not supplied
to the remote VPN Endpoint. It is used to help you manage the IKE policies. In our
example, we used VPNclient as the Policy Name.
– From the Direction/Type drop-down box, select Remote Access
– From the Exchange Mode drop-down box, select Aggressive Mode. This will also be
selected in the NETGEAR ProSafe VPN Client My Identity ID Type fields, as seen in
“Security Policy“ on page D-11.
– From the Local Identity drop-down box, select Fully Qualified Domain Name (the actual
WAN IP address of the FVL328 will also be used in the Connection ID Type fields of the
NETGEAR ProSafe VPN Client as seen in “Security Policy Editor New Connection“ on
page D-9).
– For this example we typed FVL328 in the Local Identity Data field.
– From the Remote Identity drop-down box, select Fully Qualified Domain Name.
–TypeVPNclient in the Remote Identity Data. This will also be entered in the NETGEAR
ProSafe VPN Client My Identity ID Type fields, as seen in “My Identity“ on page D-10.

Reference Manual for the NETGEAR ProSafe VPN Client
D-4 NETGEAR VPN Client to NETGEAR FVL328 or FWAG114 VPN Router
202-10015-01
Figure D-3: NETGEAR FVL328 IKE Policy Configuration
– From the Encryption Algorithm drop-down box, select 3DES. This will also be selected in
the NETGEAR ProSafe VPN Client Security Policy Authentication Phase 1 Proposal 1
Encrypt Alg field, as seen in “Connection Security Policy Authentication (Phase 1)“ on
page D-12.
– From the Authentication Algorithm drop-down box, select SHA-1.This will also be
selected in the NETGEAR ProSafe VPN Client Security Policy Authentication Phase 1
Proposal 1 Hash Alg field, as seen in “Connection Security Policy Authentication (Phase
1)“ on page D-12.
– From the Authentication Method radio button, select Pre-shared Key. This will also be
selected in the NETGEAR ProSafe VPN Client Security Policy Authentication Phase 1
Proposal 1 Authentication Method field, as seen in “Connection Security Policy
Authentication (Phase 1)“ on page D-12.
– In the Pre-Shared Key field, type hr5xb84l6aa9r6. You must make sure the key is the
same for both the FVL328 and the NETGEAR VPN Client. This will also be selected in
the NETGEAR ProSafe VPN Client Security Policy Authentication Phase 1 Proposal 1
Encrypt Alg field, as seen in “Connection Identity Pre-Shared Key“ on page D-11.
– From the Diffie-Hellman (DH) Group drop-down box, select Group 2 (1024 Bit). This
will also be selected in the NETGEAR ProSafe VPN Client Security Policy
Authentication Phase 1 Proposal 1 Key Group field, as seen in “Connection Security
Policy Authentication (Phase 1)“ on page D-12.
–IntheSALifeTime field, type 86400.
Click Apply. This will bring you back to the IKE Policies Menu.The FVL328 IKE Policy is
now displayed in the IKE Policies page.

Reference Manual for the NETGEAR ProSafe VPN Client
NETGEAR VPN Client to NETGEAR FVL328 or FWAG114 VPN Router D-5
202-10015-01
3. Click the VPN Policies link under the VPN category on the left side of the main menu. This
will take you to the VPN Policies Menu page. Click Add Auto Policy. This will open a new
screen titled VPN – Auto Policy.
Figure D-4: NETGEAR FVL328 VPN – Auto Policy General settings
– Enter a unique name to identify this policy. This name is not supplied to the remote VPN
endpoint. In our example we have used to318 as the Policy Name. In the Policy Name
field type VPNclient.
– From the IKE policy drop-down box, select VPNclient which is the IKE Policy that was
set up in the earlier step.
– From the Remote VPN Endpoint Address Type drop-down box, select IP Address.
–Type0.0.0.0 as the Address Data of the client because we are assuming the remote PC will
have a dynamically assigned IP address. This will also be entered in the NETGEAR
ProSafe VPN Client Internal Network IP Address field, as seen in “My Identity“ on page
D-10.
–Type86400 in the SA Life Time (Seconds) field.
–Type0 in the SA Life Time (Kbytes) field.
– Check the IPSec PFS checkbox to enable Perfect Forward Secrecy. This will also be
entered in the NETGEAR ProSafe VPN Client Security Policy Enable Perfect Forward
Secrecy checkbox, as seen in “Security Policy“ on page D-11.
– From the PFS Key Group drop-down box, select Group 2 (1024 Bit). This will also be
entered in the NETGEAR ProSafe VPN Client Security Policy PFS Key Group
drop-down selection box, as seen in “Security Policy“ on page D-11.

Reference Manual for the NETGEAR ProSafe VPN Client
D-6 NETGEAR VPN Client to NETGEAR FVL328 or FWAG114 VPN Router
202-10015-01
Figure D-5: NETGEAR FVL328 VPN – Auto Policy Traffic Selector
– From the Traffic Selector Local IP drop-down box, select Subnet addresses. This will
also be entered in the NETGEAR ProSafe VPN Client Connection Remote Party Identity
and Addressing ID Type field, as seen in “Security Policy Editor New Connection“ on
page D-9.
– Type the starting LAN IP Address of the FVL328 in the Local IP Start IP Address field.
For this example, we used 192.168.0.0 which is the default LAN IP address of the
FVL328.This will also be entered in the NETGEAR ProSafe VPN Client Connection
Remote Party Identity and Addressing Subnet field, as seen in “Security Policy Editor
New Connection“ on page D-9.
– Type the LAN Subnet Mask of the FVL328 (255.255.255.0 in our example) in the Local
IP Subnet Mask field. This will also be entered in the NETGEAR ProSafe VPN Client
Connection Remote Party Identity and Addressing Mask field, as seen in “Security Policy
Editor New Connection“ on page D-9.
– From the Traffic Selector Remote IP drop-down box, select Single addresses.
–Type0.0.0.0 as the start IP Address of the in the Remote IP Start IP Address field because
we are assuming the remote PC will have a dynamically assigned IP address. This will
also be entered in the NETGEAR ProSafe VPN Client My Identity Internal Network IP
Address field, as seen in “My Identity“ on page D-10.

Reference Manual for the NETGEAR ProSafe VPN Client
NETGEAR VPN Client to NETGEAR FVL328 or FWAG114 VPN Router D-7
202-10015-01
Figure D-6: NETGEAR FVL328 VPN – Auto Policy ESP Configuration
– Select Enable Encryption in the ESP Configuration Enable Encryption checkbox. This
will also be entered in the NETGEAR ProSafe VPN Client Security Policy Key Exchange
(Phase 2) Encapsulation Protocol (ESP) checkbox, as seen in “Connection Security Policy
Key Exchange (Phase 2)“ on page D-13.
– From the ESP Configuration Encryption Algorithm drop-down box, select 3DES. This
will also be entered in the NETGEAR ProSafe VPN Client Security Policy Key Exchange
(Phase 2) Encrypt Alg field, as seen in “Connection Security Policy Key Exchange (Phase
2)“ on page D-13.
– Select Enable Authentication in the ESP Configuration Enable Authentication checkbox.
Note: Do not confuse this with the Authentication Protocol (AH) option. Using the AH
option will prevent clients behind a home NAT router from connecting.
– From the ESP Configuration Authentication Algorithm drop-down box, select SHA-1.
This will also be entered in the NETGEAR ProSafe VPN Client Security Policy Key
Exchange (Phase 2) Hash Alg field, as seen in “Connection Security Policy Key Exchange
(Phase 2)“ on page D-13.
– Select NETBIOS Enable in the NETBIOS Enable checkbox to enable networking
features like Windows Network Neighborhood.
Click Apply to save your changes. You will be taken back to the VPN Policies Menu page.
4. When the screen returns to the VPN Policies, make sure the Enable checkbox is selected.
Click Apply to save your changes.

Reference Manual for the NETGEAR ProSafe VPN Client
D-8 NETGEAR VPN Client to NETGEAR FVL328 or FWAG114 VPN Router
202-10015-01
Step-By-Step Configuration of the NETGEAR VPN Client B
This procedure describes linking a remote PC and a LAN. The LAN will connect to the Internet
using an FVL328 with a static IP address. The PC can be directly connected to the Internet through
dialup, cable or DSL modem, or other means, and we will assume it has a dynamically assigned IP
address.
1. Install the NETGEAR VPN Client Software on the PC.
• You may need to insert your Windows CD to complete the installation.
• Reboot your PC after installing the client software.
Note: The NETGEAR ProSafe VPN Client has the ability to “Import” a predefined
configuration profile. The FVL328.SPD file on the NETGEAR ProSafe VPN Client
Resource CD (230-10007-01) includes all the settings identified in this procedure.
Whenever importing policy settings, you should first export any existing settings you
may have configured to prevent the new imported settings from replacing an existing
working configuration.
To import this policy, use the Security Policy Editor File menu to select Import Policy,
and select the FVL328.SPD file at D:\Software\Policies where D is the drive letter of
your CD-ROM drive.
Note: Before installing the NETGEAR ProSafe VPN Client software, be sure to turn off
any virus protection or firewall software you may be running on your PC.

Reference Manual for the NETGEAR ProSafe VPN Client
NETGEAR VPN Client to NETGEAR FVL328 or FWAG114 VPN Router D-9
202-10015-01
2. Configure the Connection Network Settings.
Figure D-7: Security Policy Editor New Connection
a. Run the Security Policy Editor program and create a VPN Connection.
Figure D-8: Security Policy Editor Options menu
Note: If the configuration settings on this screen are not available for editing, go to the
Options menu, select Secure, and Specified Options to enable editing of these settings.
From the Edit menu of the Security Policy Editor, click Add, then Connection. A “New
Connection” listing appears. Rename the “New Connection” to FVL328.
b. Assure that the following settings are configured:
– In the Connection Security box, Secure is selected

Reference Manual for the NETGEAR ProSafe VPN Client
D-10 NETGEAR VPN Client to NETGEAR FVL328 or FWAG114 VPN Router
202-10015-01
– In the Protocol menu, All is selected
– The Connect using Secure Gateway Tunnel checkbox is checked
c. In this example, select IP Subnet as the ID Type, 192.168.0.0 in the Subnet field (the
Subnet address is the LAN IP Address of the FVL328 with 0 as the last number), and
255.255.255.0 in the Mask field, which is the LAN Subnet Mask of the FVL328
d. In the ID Type menus, select Domain Name and Gateway IP Address. Enter FVL328 in
the Domain Name field. In this example, 66.120.188.153 would be used for the Gateway
IP Address, which is the static IP address for the FVL328 WAN port.
3. Configure the Connection Identity Settings.
a. In the Network Security Policy list, click the My Identity subheading.
Figure D-9: My Identity
In this example, select Domain Name as the ID Type, and enter VPNclient. Also, accept
the default Internal Network IP Address of 0.0.0.0.
Figure D-10: My Identity Pre-Shared Key
b. Click Pre-Shared Key.