User manual NETGEAR DGND3700

[. . . ] All rights reserved No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or by any means without the written permission of NETGEAR, Inc. technical Support Thank you for choosing NETGEAR. To register your product, get the latest product updates, get support online, or for more information about the topics covered in this manual, visit the Support website at http://support. Phone (US & Canada only): 1-888-NETGEAR Phone (Other Countries): Check the list of phone numbers at http://support. [. . . ] Gateway-to-Gateway VPN Tunnels Gateway-to-gateway VPN tunnels provide secure access between networks, such as a branch or home office and a main office. modem Router DGND3700 Gateway A (Home) VPN Tunnel Modem Router DGND3700 Gateway B (Office) Internet Figure 42. VPN Tunnel between networks Virtual Private Networking 87 N600 Wireless Dual Band Gigabit ADSL2+ Modem Router DGND3700 A VPN between two or more NETGEAR VPN-enabled routers is a good way to connect branch or home offices and business partners over the Internet. vPN tunnels also enable access to network resources across the Internet. In this case, use gateways on each end of the tunnel to form the VPN tunnel endpoints. See Set Up a Gateway-to-Gateway VPN Configuration on page 101 for information about how to set up this configuration. Plan a VPN When you set up a VPN, it is helpful to plan the network configuration and record the configuration parameters on a worksheet: Table 15. VPN tunnel configuration worksheet Parameter Connection Name Pre-Shared Key Secure Association Perfect Forward Secrecy Encryption Protocol Authentication Protocol Diffie-Hellman (DH) Group Key Life in seconds IKE Life Time in seconds VPN Endpoint Local IPSecID LAN IP Address N/A N/A N/A N/A N/A Value to Be Entered Field Selection N/A N/A Main Mode Enabled DES MD5 Group 1 N/A N/A Subnet Mask FQDN or Gateway IP (WAN IP Address Manual Keys Disabled 3DES SHA-1 Group 2 To set up a VPN connection, you have to configure each endpoint with specific identification and connection information describing the other endpoint. You have to configure the outbound VPN settings on one end to match the inbound VPN settings on other end, and vice versa. This set of configuration information defines a security association (SA) between the two VPN endpoints. When planning your VPN, you should make a few choices first: • • Will the local end be any device on the LAN, a portion of the local network (as defined by a subnet or by a range of IP addresses), or a single PC?Will the remote end be any device on the remote LAN, a portion of the remote network (as defined by a subnet or by a range of IP addresses), or a single PC?Virtual Private Networking 88 N600 Wireless Dual Band Gigabit ADSL2+ Modem Router DGND3700 • Will either endpoint use fully qualified domain names (FQDNs)?FQDNs supplied by Dynamic DNS providers (see Use a Fully Qualified Domain Name (FQDN) on page 163) can allow a VPN endpoint with a dynamic IP address to initiate or respond to a tunnel request. Otherwise, the side using a dynamic IP address has to always be the initiator. Which method will you use to configure your VPN tunnels?The VPN Wizard using VPNC defaults (see the following table) The typical automated Internet Key Exchange (IKE) setup (see Use Auto Policy to Configure VPN Tunnels on page 112) A manual keying setup in which you have to specify each phase of the connection (see Use Manual Policy to Configure VPN Tunnels on page 119) • Table 16. Parameters recommended by the VPNC and used in the VPN Wizard Parameter Secure Association Authentication Method Encryption Method Authentication Protocol Diffie-Hellman (DH) Group Key Life IKE Life Time Factory Default Setting Main Mode Pre-Shared Key 3DES SHA-1 Group 2 (1024 bit) 8 hours 1 hour • What level of IPSec VPN encryption will you use?The Data Encryption Standard (DES) processes input data that is 64 bits wide, encrypting these values using a 56-bit key. Triple DES achieves a higher level of security by encrypting the data three times using DES with three different, unrelated keys. €¢ What level of authentication will you use?- VPN Tunnel Configuration There are two tunnel configurations and three ways to configure them: • Use the VPN Wizard to configure a VPN tunnel (recommended for most situations): • See Set Up a Client-to-Gateway VPN Configuration on page 90. [. . . ] However, there is no guarantee that interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following methods: • Reorient or relocate the receiving antenna. €¢ Increase the separation between the equipment and the receiver. €¢ Connect the equipment into an electrical outlet on a circuit different from that which the radio receiver is connected. [. . . ]