NETGEAR FVS124G Router Manual PDF (Setup & Configuration Guide)

Page 221 / 238 Scroll up to view Page 216 - 220

Reference Manual for the ProSafe VPN Firewall 25 with 4 Gigabit LAN and Dual WAN Ports

Virtual Private Networking

D-7

202-10085-01, March 2005

VPN Process Overview

Even though IPSec is standards-based, each vendor has its own set of terms and procedures for

implementing the standard. Because of these differences, it may be a good idea to review some of

the terms and the generic processes for connecting two gateways before diving into to the

specifics.

Network Interfaces and Addresses

The VPN gateway is aptly named because it functions as a “gatekeeper” for each of the computers

connected on the Local Area Network behind it.

In most cases, each Gateway will have a “public” facing address (WAN side) and a “private”

facing address (LAN side). These addresses are referred to as the “network interface” in

documentation regarding the construction of VPN communication. Please note that the addresses

used in the example.

Interface Addressing

This TechNote uses example addresses provided the VPN Consortium. It is important to

understand that you will be using addresses specific to the devices that you are attempting to

connect via IPSec VPN.

Figure 9-7:

VPNC Example Network Interface Addressing

Gateway A

22.23.24.25

14.15.16.17

10.5.6.0/24

172.23.9.0/24

172.23.9.1

10.5.6.1

WAN IP

LAN IP

Gateway B

VPNC Example

Network Interface Addressing

Page 222 / 238

Reference Manual for the ProSafe VPN Firewall 25 with 4 Gigabit LAN and Dual WAN Ports

D-8

Virtual Private Networking

202-10085-01, March 2005

It is also important to make sure the addresses do not overlap or conflict. That is, each set of

addresses should be separate and distinct.

It will also be important to know the subnet mask of both gateway LAN Connections. Use the

worksheet in Appendix A to gather the necessary address and subnet mask information to aid in

the configuration and troubleshooting process.

Firewalls

It is important to understand that many gateways are also firewalls. VPN tunnels cannot function

properly if firewall settings disallow all incoming traffic. Please refer to the firewall instructions

for both gateways to understand how to open specific protocols, ports, and addresses that you

intend to allow.

Setting Up a VPN Tunnel Between Gateways

A SA, frequently called a tunnel, is the set of information that allows two entities (networks, PCs,

routers, firewalls, gateways) to “trust each other” and communicate securely as they pass

information over the Internet.

Table 9-1.

WAN (Internet/Public) and LAN (Internal/Private) Addressing

Gateway

LAN or WAN

VPNC Example Address

Gateway A

LAN (Private)

10.5.6.1

Gateway A

WAN (Public)

14.15.16.17

Gateway B

LAN (Private)

22.23.24.25

Gateway B

WAN (Public)

172.23.9.1

Table 9-2.

Subnet Addressing

Gateway

LAN or WAN

Interface Name

Example Subnet Mask

Gateway A

LAN (Private)

Subnet Mask A

255.255.255.0

Gateway B

LAN (Private)

Subnet Mask B

255.255.255.0

Page 223 / 238

Reference Manual for the ProSafe VPN Firewall 25 with 4 Gigabit LAN and Dual WAN Ports

Virtual Private Networking

D-9

202-10085-01, March 2005

Figure 9-8:

VPN Tunnel SA

The SA contains all the information necessary for gateway A to negotiate a secure and encrypted

communication stream with gateway B. This communication is often referred to as a “tunnel.” The

gateways contain this information so that it does not have to be loaded onto every computer

connected to the gateways.

Each gateway must negotiate its Security Association with another gateway using the parameters

and processes established by IPSec. As illustrated below, the most common method of

accomplishing this process is via the Internet Key Exchange (IKE) protocol which automates some

of the negotiation procedures. Alternatively, you can configure your gateways using manual key

exchange, which involves manually configuring each paramter on both gateways.

Figure 9-9:

IPSec SA negotiation

1.

The IPSec software on Host A initiates the IPSec process in an attempt to communicate

with Host B.

The two computers then begin the Internet Key Exchange (IKE) process.

VPN Gateway A

VPN Gateway B

VPN Tunnel

VPN Gateway

1) Communication

request sent to VPN Gateway

2) IKE Phase I authentication

3) IKE Phase II negotiation

4) Secure data transfer

5) IPSec tunnel termination

IPSec Security Association IKE

VPN Tunnel Negotiation Steps

Page 224 / 238

Reference Manual for the ProSafe VPN Firewall 25 with 4 Gigabit LAN and Dual WAN Ports

D-10

Virtual Private Networking

202-10085-01, March 2005

2.

IKE Phase I.

a.

The two parties negotiate the encryption and authentication algorithms to use in the IKE

SAs.

b.

The two parties authenticate each other using a predetermined mechanism, such as

preshared keys or digital certificates.

c.

A shared master key is generated by the Diffie-Hellman Public key algorithm within the

IKE framework for the two parties. The master key is also used in the second phase to

derive IPSec keys for the SAs.

3.

IKE Phase II.

a.

The two parties negotiate the encryption and authentication algorithms to use in the IPSec

SAs.

b.

The master key is used to derive the IPSec keys for the SAs. Once the SA keys are created

and exchanged, the IPSec SAs are ready to protect user data between the two VPN

gateways.

4.

Data transfer.

Data is transferred between IPSec peers based on the IPSec parameters and

keys stored in the SA database.

5.

IPSec tunnel termination.

IPSec SAs terminate through deletion or by timing out.

VPNC IKE Security Parameters

It is important to remember that both gateways must have the identical parameters set for the

process to work correctly. The settings in these TechNote examples follow the examples given for

Scenario 1 of the VPN Consortium.

VPNC IKE Phase I Parameters

The IKE Phase 1 parameters used:

•

Main mode

•

TripleDES

•

SHA-1

•

MODP group 1

•

pre-shared secret of "hr5xb84l6aa9r6"

•

SA lifetime of 28800 seconds (eight hours)

Page 225 / 238

Reference Manual for the ProSafe VPN Firewall 25 with 4 Gigabit LAN and Dual WAN Ports

Virtual Private Networking

D-11

202-10085-01, March 2005

VPNC IKE Phase II Parameters

The IKE Phase 2 parameters used in Scenario 1 are:

•

TripleDES

•

SHA-1

•

ESP tunnel mode

•

MODP group 1

•

Perfect forward secrecy for rekeying

•

SA lifetime of 28800 seconds (one hour)

Testing and Troubleshooting

Once you have completed the VPN configuration steps you can use PCs, located behind each of

the gateways, to ping various addresses on the LAN-side of the other gateway.

You can troubleshoot connections using the VPN status and log details on the Netgear gateway to

determine if IKE negotiation is working. Common problems encountered in setting up VPNs

include:

•

Parameters may be configured differently on Gateway A vs. Gateway B.

•

Two LANs set up with similar or overlapping addressing schemes.

•

So many required configuration parameters mean errors such as mistyped information or

mismatched parameter selections on either side are more likely to happen.

Additional Reading

•

Building and Managing Virtual Private Networks

, Dave Kosiur, Wiley & Sons; ISBN:

0471295264

•

Firewalls and Internet Security: Repelling the Wily Hacker

, William R. Cheswick and Steven

M. Bellovin, Addison-Wesley; ISBN: 0201633574

•

VPNs A Beginners Guide

, John Mains, McGraw Hill; ISBN: 0072191813

•

[FF98] Floyd, S., and Fall, K., Promoting the Use of End-to-End Congestion Control in the

Internet. IEEE/ACM Transactions on Networking, August 1999.

Relevant RFCs listed numerically:

Rate

Popular NETGEAR Models

Famous Router IPs

Famous Router Companies

Bookmark Our Site

Share