NETGEAR FVS124G - ProSafe VPN Firewall 25 User manual

VPN Conﬁguration Guide

NETGEAR® FVS124G

equinux AG and equinux USA, Inc.

Under the copyright laws, this manual may not be copied, in whole or in part,

without the written consent of equinux AG or equinux USA, Inc. Your rights to

the software are governed by the accompanying software license agreement.

The equinux logo is a trademark of equinux AG and equinux USA, Inc.,

registered in the U.S. and other countries.

Every effort has been made to ensure that the information in this manual is

accurate. equinux is not responsible for printing or clerical errors.

www.equinux.com!

Apple, the Apple logo, iBook, Mac, Mac OS, MacBook, PowerBook are

trademarks of Apple Computer, Inc., registered in the U.S. and other countries.

NETGEAR is a registered trademark of NETGEAR Inc.

equinux shall have absolutely no liability for any direct or indirect, special

or other consequential damages in connection with the use of the quick

setup guide or any change to the router generally, including without

limitation, any lost proﬁts, business, or data, even if equinux has been

advised of the possibility of such damages.

2

Introduction 4........................................................

Important Prerequisites 5.........................................................

Scenario 6................................................................................

Terminology 7..........................................................................

My NETGEAR Conﬁguration 8.............................

Task 1 – Conﬁgure your NETGEAR 9..................

Step 2 –"Retrieve your NETGEAR’s LAN and WAN Conﬁguration

Step 3 –"Create a new VPN Policy 12.....................................

Task 2 – Conﬁgure VPN Tracker 14.....................

Step 1 - Create a New Connection 14.....................................

Step 2 – Conﬁgure the VPN Connection 15............................

Task 3 –"Test the VPN Connection 16..................

It‘s time to go out! 16...............................................................

Start your connection 16..........................................................

Supporting Multiple Users 18...............................

Using Mode Conﬁg for IP Address Assignment 18..................

Adding more VPN Tunnels 22.................................................

Troubleshooting 24...............................................

VPN Connection Fails to Establish 24.....................................

Cannot Access Resources on the Remote Network 25.........

Further Questions? 26.............................................................

VPN Settings Explained 27..................................

IKE Policy 27...........................................................................

VPN Policy 30..........................................................................

The Role of the Local Address in VPN Tracker 33..................

3

Introduction

This document describes how VPN Tracker can be used to establish a connection between a

Mac running Mac OS X and a NETGEAR VPN gateway.

NETGEAR Conﬁguration

The ﬁrst part of this document will show you how to conﬁgure a VPN tunnel on a NETGEAR VPN router using a basic

VPN setup that can accept incoming connections from any IP address.

VPN Tracker Conﬁguration

In the second part, this document will show you how to conﬁgure VPN Tracker to easily connect to your newly created

VPN tunnel.

Troubleshooting and Advanced Topics

Troubleshooting and advanced topics are covered in the third part of this document. There you will ﬁnd:

‣instructions for setting up a VPN connection for multiple users

‣troubleshooting tips

‣an in-depth discussion of the various NETGEAR settings and how they relate to VPN Tracker

4

Note This documentation is only a supplement to, not a replacement for, the instructions included with your NETGEAR

device. Please be sure to read those instructions and understand them before starting.

Important Prerequisites

Your NETGEAR Device

This document applies to the following NETGEAR devices

‣FVS124G

The documentation is based on ﬁrmware 1.1.48.

Your Mac

‣Make sure to use a recent VPN Tracker version. The latest VPN Tracker release can be obtained from http://

www.vpntracker.com

‣You will need one VPN Tracker license for each Mac running VPN Tracker

5

Tip If you are setting up VPN on your device for the ﬁrst time, we strongly recommend you start out with the tutorial-

style setup in the ﬁrst and second part of this document, and only additional features to your connection once you

have the basic setup working.

Scenario

In our example, we need to connect an employee's Mac to an ofﬁce network. The following diagram illustrates this

scenario:

This guide assumes that the Mac running VPN Tracker already has internet connectivity. The ofﬁce's NETGEAR ﬁrewall

(the “VPN Gateway”) is also already connected to the Internet and can be accessed through a static IP address or a

(Dynamic) DNS host name. In our example setup, we will be using a DNS host name: vpn.example.com.

The NETGEAR device has a second network interface which is connected to the internal ofﬁce network (LAN). In our

example, the ofﬁce network has the IP range 192.168.13.0/24 (which is the same as 192.168.13.0/255.255.255.0). This is

the network that will be accessed from the employee’s Mac through the VPN. It is called the “Remote Network” in VPN

Tracker.

6

Terminology

A VPN connection is often called a “tunnel” (or “VPN tunnel”). Every VPN tunnel is established between two “endpoints”.

In our example one endpoint is VPN Tracker and the other endpoint is the VPN gateway.

Please note that for each endpoint, the settings on the other endpoint are considered to be “remote”, while its own settings

are considered to be “local”. That means a “local” setting from VPN Tracker’s perspective, is a “remote” setting from the

VPN gateway’s perspective, and vice versa.

The sample conﬁguration described in this guide is called a “Host to Network” conﬁguration: A single computer, called a

“Host” establishes a VPN tunnel to an entire “Network” behind the VPN gateway.

7

My NETGEAR Conﬁguration

Throughout this guide, there are certain pieces of information that are needed later on for

conﬁguring VPN Tracker. This information is marked with red numbers to make it easier to

reference it later. You can print out this form to help keep track of the various conﬁguration

settings of your NETGEAR device.

➊Pre-Shared Key:

➋NETGEAR’s Local Identiﬁer:

➌NETGEAR’s Remote Identiﬁer:

➍WAN IP Address: . . . (or DNS host name )

➎LAN IP Address: . . .

➏LAN Subnet Mask: . . .

➐LAN Network Address (calculated, see page 12 ): . . .

➑VPN Policy Name: !

8

Task 1 – Conﬁgure your NETGEAR

This section describes how to set up your NETGEAR’s VPN. If you do not yet have VPN

conﬁgured and in use on your device, please proceed exactly as described in this section. We

will ﬁrst be creating an IKE policy, which corresponds to “Phase 1” in VPN Tracker. In a second

step, we will be setting up an associated VPN (IPsec) policy, which corresponds to “Phase 2” in

VPN Tracker.

9

Advanced Users If you already have VPN in use on your device, you can use this chapter to verify your settings (refer

to the chapter “VPN Settings Explained” for more detailed information about the settings available on

your NETGEAR). If you have multiple VPN policies set up on the device, you will have to ensure that

there are no unintended side-effects. Please read the chapter “Supporting Multiple Users“ to learn

how to set up multiple tunnels without them interfering with each other.

‣Go to VPN > IKE Policies

‣Click “Add”

Note Make sure you have a current backup of your NETGEAR’s conﬁguration before making any changes.

Step 1 – Create a new IKE policy

10

Advanced Users You can use an existing FQDN if your clients

actually connect from the IP address this name

resolves to.

‣Encryption Algorithm: Select “3DES”

‣Authentication Algorithm: Select “SHA-1”

‣Authentication Method: Select “Pre-Shared Key”

‣The pre-shared key is the password that users have to enter before

connecting. Make sure to set a strong password ➊

‣Difﬁe-Hellman (DH) Group: Select “Group 2 (1024 Bit)”

‣SA Lifetime: 3600 seconds

‣Click “Apply” to add your new IKE policy

‣Policy Name: Enter a name for the connection

‣Direction / Type: Select “Responder”

‣Exchange Mode: Select “Aggressive Mode”

‣Local Identity Type: Select “Fully Qualiﬁed Domain Name”

‣Local Identity Data: Enter the identiﬁer to be used by the device, e.g.

“netgear.local”. Make sure to write down the exact identiﬁer ➋

‣Remote Identity Type: Select “Fully Qualiﬁed Domain Name”

‣Remote Identity Data: Enter the identiﬁer to be used by the client, e.g.

“vpntracker.local”. It should not be an actually existing name. Make sure

to write down the exact identiﬁer ➌

➋

➌

➊

Tip Use the form on page 9 of this document to keep track of the various settings. You will need again them later on.

Other manuals for FVS124G - ProSafe VPN Firewall 25

Table of contents

Other NETGEAR Firewall manuals

NETGEAR

NETGEAR FVS336Gv2 - ProSafe Dual WAN Gigabit... User manual

NETGEAR

NETGEAR ProSAFE FVS318G v2 User manual

NETGEAR

NETGEAR ProSafe FWAG114 User manual

NETGEAR

NETGEAR STM150 - ProSecure Web And Email Threat Management... User manual

NETGEAR

NETGEAR FVS328 - ProSafe VPN Firewall User manual

NETGEAR

NETGEAR ProSafe FVS318N User manual

NETGEAR

NETGEAR ProSafe FVS318N User manual

NETGEAR

NETGEAR FVG318 - ProSafe 802.11g Wireless VPN Firewall 8... User manual

NETGEAR

NETGEAR FVS338 - ProSafe VPN Firewall 50 Router Installation and operating instructions

NETGEAR

NETGEAR ProSafe FR328S User manual

NETGEAR

NETGEAR FVS318 - ProSafe VPN Firewall Router User manual

NETGEAR

NETGEAR ProSafe FVS318N User manual

NETGEAR

NETGEAR ProSafe FVX538 User manual

NETGEAR

NETGEAR FVS318 - ProSafe VPN Firewall Router User manual

NETGEAR

NETGEAR FVS318 - ProSafe VPN Firewall Router User manual

NETGEAR

NETGEAR FVS338 - ProSafe VPN Firewall 50 Router User manual

NETGEAR

NETGEAR ProSafe FR328S User manual

NETGEAR

NETGEAR FWG114Pv1 - Wireless Firewall With USB Print... User manual

NETGEAR

NETGEAR FVS318 - ProSafe VPN Firewall Router User manual

NETGEAR

NETGEAR STM150 - ProSecure Web And Email Threat Management... User manual

NETGEAR

NETGEAR FVS318G-100NAS User manual

NETGEAR

NETGEAR FVS336Gv2 - ProSafe Dual WAN Gigabit... User manual

NETGEAR

NETGEAR ProSAFE SRX5308 User manual

NETGEAR

NETGEAR ProSafe FVS318N User manual

Popular Firewall manuals by other brands

Cisco

Cisco S190 quick start guide

Fortinet

Fortinet FortiGate Voice Series install guide

ADTRAN

ADTRAN NetVanta 2300 Specifications

SecureLogix

SecureLogix ETM System installation guide

Lanner

Lanner FW-8877 user manual

Huawei

Huawei USG6000 Series Upgrade guide

H3C

H3C SecPath F5000-AI-15 installation guide

Nexcom

Nexcom DNA 1150 user manual

Fortinet

Fortinet FortiGate-60 series install guide

Cisco

Cisco 3110 Hardware installation guide

Draytek

Draytek Vigor2860 Series user guide

Lanner electronics

Lanner electronics FW-7650 Series user manual

Swisscom

Swisscom Internet Backup manual

SonicWALL

SonicWALL NSa 5700 quick start guide

DPtech

DPtech FW1000 SERIES Maintenance manual

FEITIAN

FEITIAN MultiPass FIDO product manual

EBLOCKER

EBLOCKER PRO user manual

GTA

GTA GB-200 Product guide