1. Home
    2. /
  2. Manuals
    3. /
  3. NETGEAR
    4. /
  4. SRXN3205
    5. /
  5. 23
Page 111 / 218 Scroll up to view Page 106 - 110
ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual
Virtual Private Networking Using IPsec
6-9
v1.0, October 2008
7.
In the left frame, click
My Identity
.
8.
From the
Select Certificate
pull-down menu, choose
None
.
9.
From the ID Type pull-down menu, choose
Domain Name.
10.
Leave
Virtual Adapter
disabled, and click your computer’s Network Adapter. Your current IP
address will appear.
1.
Before leaving the My Identity menu, click
Pre-Shared Key
.
2.
Click
Enter Key
and then enter your preshared key, and click
OK
. This key will be shared by
all users of the SRXN3205 policy “client”.
3.
In the left frame, click
Security Policy.
Figure 6-6
Page 112 / 218
ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual
6-10
Virtual Private Networking Using IPsec
v1.0, October 2008
4.
For the
Phase 1 Negotiation Mode
, check the
Aggressive Mode
radio box.
5.
PFS
should be disabled, and
Enable Replay Detection
should be enabled.
6.
In the left frame, expand
Authentication (Phase 1)
and choose
Proposal 1
. The Proposal 1
fields should mirror those in the following figure. No changes should be necessary.
Figure 6-7
Figure 6-8
Page 113 / 218
ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual
Virtual Private Networking Using IPsec
6-11
v1.0, October 2008
7.
In the left frame, expand
Key Exchange (Phase 2)
and choose
Proposal 1
. The fields in this
proposal should also mirror those in the following figure. No changes should be necessary.
8.
In the upper left of the window, click the disk icon to save the policy.
Testing the Connection
1.
From your PC, right-click on the VPN client icon in your Windows toolbar and choose
Connect...
, then
My Connections\SRXN
.
Within 30 seconds you should receive the message “Successfully connected to My
Connections\SRXN” and the VPN client icon in the toolbar should say On:
2.
For additional status and troubleshooting information, right-click on the VPN client icon Logs
and Connection Status screens in the SRXN3205.
Managing VPN Tunnel Policies
After you use the VPN Wizard to set up a VPN tunnel, a VPN policy and an IKE policy are stored
in separate policy tables. The name you selected as the VPN tunnel connection name during
Figure 6-9
Page 114 / 218
ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual
6-12
Virtual Private Networking Using IPsec
v1.0, October 2008
Wizard setup identifies both the VPN policy and IKE policy. You can edit existing policies, or add
new VPN and IKE policies directly in the policy tables.
About IKE
The IKE (Internet Key Exchange) protocol performs negotiations between the two VPN gateways,
and provides automatic management of the keys used in IPsec. It is important to remember the:
•
“Auto” generated VPN policies must use the IKE negotiation protocol.
•
“Manual” generated VPN policies cannot use the IKE negotiation protocol.
Managing IKE Policies
IKE Policies are activated when the following occur:
1.
The VPN policy selector determines that some traffic matches an existing VPN policy. If the
VPN policy is of type “Auto”, then the
Auto Policy Parameters
defined in the VPN policy
are accessed which specify which IKE Policy to use.
2.
If the VPN Policy is a “Manual” policy, then the
Manual Policy Parameters
defined in the
VPN policy are accessed and the first matching IKE policy is used to start negotiations with
the remote VPN gateway.
•
If negotiations fail, the next matching IKE policy is used.
•
If none of the matching IKE policies are acceptable to the remote VPN gateway, then a
VPN tunnel cannot be established.
3.
An IKE session is established, using the SA (Security Association) parameters specified in a
matching IKE Policy:
•
Keys and other parameters are exchanged.
•
An IPsec SA (Security Association) is established, using the parameters in the VPN
policy.
The VPN tunnel is then available for data transfer.
Note:
An IKE policy cannot be edited if it is associated with an enabled VPN policy.
Page 115 / 218
ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual
Virtual Private Networking Using IPsec
6-13
v1.0, October 2008
About the IKE Policy Table
When you use the VPN Wizard to set up a VPN tunnel, an IKE policy is established and populated
in the List of IKE Policies and is given the same name as the new VPN connection name. You can
also edit exiting policies or add new IKE policies directly on the List of IKE Policies. Each policy
contains the following data:
•
Policy Name
. Uniquely identifies each IKE policy. The name is chosen by you and used for
the purpose of managing your policies; it is not supplied to the remote VPN Server.
•
Direction / Type
.
•
Both
•
Initiator
•
Responder
•
Exchange Mode
. Two modes are available: either Main or Aggressive.
Main Mode negotiates the tunnel with higher security, but is slower whereas Aggressive Mode
establishes a faster connection but with lowered security.
Note: If either the Local or Remote identifier type (defined below) is not an IP address, then
negotiation is only possible in Aggressive Mode. If FQDN, User FQDN or DER ASN1 DN is
selected, the router will disable Main Mode and set the default to Aggressive Mode.
•
Mode Config Record
Specify whether this IKE policy uses a Mode Config Record (Mode Config Records can be
defined on the Mode Config page under the VPN menu). Select the Yes radio button if you
would like IP addresses to be assigned to remote VPN Clients. Since Mode Config works only
in Aggressive Mode, enabling this will set the tunnel exchange mode to Aggressive Mode and
disable Main Mode. Mode Config also requires that both the local and remote ends be defined
by their Internet Names (FQDN) only.
•
Local ID
. The IKE/ISAKMP identify of this device. (The remote VPN must have this value as
their “Remote ID”.)
•
Remote ID
. The IKE/ISAKMP identify of the remote VPN gateway. (The remote VPN must
have this value as its Local ID.)
•
IKE SA Parameters
–
Encryption Algorithm
. This algorithm is used for the IKE SA. The default setting using
the VPN Wizard is 3DES. (This setting must match the Remote VPN.)
–
Authentication Algorithm
. This algorithm is used for the IKE SA. The default setting
using the VPN Wizard is SHA1. (This setting must match the Remote VPN.)

Rate

3.5 / 5 based on 2 votes.

Popular NETGEAR Models

Famous Router IPs
Famous Router Companies
Bookmark Our Site

Press Ctrl + D to add this site to your favorites!

Share
Top