NETGEAR ProSafe VPN Firewall FVS338 Server
NETGEAR ProSafe VPN Firewall FVS338 Server
NETGEAR ProSafe VPN Firewall FVS338 Server
This document describes the steps to undertake in configuring a Hub-and-Spoke network over the Internet using VPNs (box-to-box and client-to-box). In particular it describes how to allow VPN clients (Spoke) to access Remote LANs (Spokes) via a single VPN connection to a central (Hub) Firewall/Router. The configuration can apply to any of the VPN Firewall/Router from firmware version 3.5.0.24 and above, and VPN clients from version 10.8.3 and above. The diagram below shows a typical scenario.
FVS338 (Spoke 1) Public IP: 83.71.251.20 LAN IP : 172.22.102.102 VPN Information: BoxToBox (To FVX538) LAN2toClient (FVS338 To VPN clients via FVX538)
nne Client co
ctio
2 via V n to LAN
PN Clien
ion to LA t connect
N1
Spoke 2 192.168.0.x/24
Internet
co
FVX538 Public IP: 83.71.251.19 LAN IP: 172.22.101.101 VPN Information: BoxToBox (To FVS338) LAN1toVPN (FVX538 To VPN clients) LAN2toClient (VPN Clients to FVS338 via FVX538)
VPN
Clie
nn
ec
tio n
nt to
ox
Bo x
LAN2
Bo
xt oB
co n
VP
nec
tion
( mo
de c
onfig )
LAN1
LAN1
Version 1.0
Table of Contents
NETWORK SETUP.......................................................................................................... 3 Physical setup ............................................................................................................... 3 Logical setup ................................................................................................................. 3 Configuration of VPN policies on the Firewall/Routers .............................................. 4 FVX538 VPN Config (Policy name: BoxtoBox) ....................................................... 4 FVS338 VPN Config (Policy name: BoxtoBox) ....................................................... 4 FVX538 VPN Config (Policy name: LAN1toVPN) ................................................... 5 FVX538 VPN Config (Policy name: LAN2Client) .................................................... 6 FVS338 VPN Config (Policy name: LAN2Client) .................................................... 6 VPN client configuration .................................................................................................. 7 Testing the connection .................................................................................................... 8
Version 1.0
NETWORK SETUP
Physical setup FVX538 connected to the Internet via a modem or modem/router FVS338 connected to the Internet via a modem or modem/router VPN Client PCs connected Wireless/Wired to the Internet (via a LAN allowing IPSEC traffic) Logical setup FVX538 LAN IP: 172.22.101.101/24 DHCP: 172.22.101.0/24 Mode Config DHCP: 192.168.0.0/24 Firmware version: 3.5.0.24 FVS338 LAN IP: 172.22.102.102/24 DHCP: 172.22.102.0/24 Firmware version: 3.5.0.24 VPN Client Version: 10.8.3 NIC IP: 192.168.0.x/24
VPN configuration The setup will require the creation of multiple VPN policies: FVX538 1x Box-to-box policy from the FVX538 to the FVS338 (Policy name: BoxtoBox) 1x Client-to-Box policy on the FVX538 to connect to the VPN clients (Policy name: LAN1toVPN) 1x Manual VPN policy using the IKE policy used for the box-to-box connection to allow the VPN clients to connect to the LAN behind the FVS338 (Policy name: LAN2toClient)
FVS338 1x Box-to-box policy from the FVS338 to the FVX538 (Policy name: BoxtoBox) 1x Manual VPN policy using the IKE policy used for the box-to-box connection to allow the FVS338 to connect to the VPN clients (Policy name: LAN2toClient)
VPN Client 1x Policy connecting to the Public address of the FVS338 specifying as the IP range for the Remote party 172.22.0.0 mask 255.255.0.0 (class full only mask accepted)
Version 1.0
Access the VPN Wizard via the VPN configuration page. Configure the Connection name (for admin reasons this will match the FVS338 box as BoxtoBox). Input the pre-shared key. Configure the Public or DNS address of the Remote location, and the LAN details (the Remote LAN IP address is intended as the subnet address). Click on Apply
Access the VPN Wizard via the VPN configuration page. Configure the Connection name (for admin reasons this will match the other box as BoxtoBox). Input the pre-shared key as at point Configure the Public or DNS address of the Remote location, and the LAN details (the Remote LAN IP address is intended as the subnet address). Click on Apply
Version 1.0
Access the VPN Wizard via the VPN configuration page. Create a new VPN client policy named LAN1toVPN (with any pre-shared key) Take note of the Remote and Local identifier whether using the default ones or new ones. Click on Apply
Edit the LAN1toVPN. Change the Local IP setting to any and the Remote IP to subnet, modifying the Start IP address to 192.168.0.0 with subnet mask 255.255.255.0 Click on Apply
Version 1.0
Access the VPN Wizard via the VPN configuration page. In the VPN Policy section click on Add (this will create a new manual VPN policy which will use an existing IKE policy) Create a new VPN client policy named LAN2toClient Specify the Remote Endpoint IP address to be the Public address of the FVS338 Specify the Local IP subnet to be the one of the VPN clients as 192.168.0.0/24 and the Remote IP subnet to be the LAN of the FVS338 as 172.22.102.0/24 Ensure that the Select IKE Policy is set to BoxtoBox Click on Apply
Access the VPN Wizard via the VPN configuration page. In the VPN Policy section click on Add (this will create a new manual VPN policy which will use an existing IKE policy) Create a new VPN client policy named LAN2toClient Specify the Remote Endpoint IP address to be the Public address of the FVX538 Specify the Local IP subnet to be the one of the FVS338 172.22.102.0/24 and the Remote IP subnet to be the VPN clients one 192.168.0.0/24 Ensure that the Select IKE Policy is set to BoxtoBox Click on Apply
Version 1.0
Create a new VPN client policy Specify the Remote Party ID type as IP Subnet and the subnet and mask as 172.22.0.0 255.255.255.0 (this will address both LAN1 and LAN2) The gateway IP address will be specified at the WAN address of the FVX538 in our case
In My identity change the pre-shared key to match the VPN policy LAN1toVPN created on the FVX538 (12345678) Set the Virtual adapter as Required as specify a unique value for the Internal network IP address (this will be different on each PC running the VPN client
In the Security policy section ensure the Phase 1 negotiation mode is set to aggressive , PFS is enabled and Enable Replay Detection is ticked
Version 1.0
From the VPN client run ipconfig to confirm once the VPN is established that the Virtual adapter interface is assigned with the IP address specified in the policy (in this case 192.168.0.1 ) Test the VPN connection to both the FVX538 and FVS338 by pinging each box LAN IP address
FVS338 From Monitoring, Diagnostic on the FVS338 ping the VPN client IP address 1902.168.0.1
Version 1.0