VPN close
VPN Policies
The VPN Policies page helps you with managing VPN Tunnels and Policies. The table lists the policies that have been added and allows several operations on the policies.
List of VPN Policies
Policy fields displayed in the table are:
! (Status): A policy can be disabled if not in use and enabled as needed. A policy is disabled if the status light is grey and it is enabled if the status light is green. Disabling a policy does not delete the configuration, but merely de-activates the tunnel.
Name: This is a unique name assigned to the policy. The name is not used to identify the tunnel to the remote WAN/client, but for managing the tunnel properties.
Local: IP address or address range on your local LAN. Traffic must be from (or to) these addresses to be covered by this policy.
Remote: IP address or address range of the remote network. Traffic must be to (or from) these addresses to be covered by this policy.
AH: Authentication Header. This column displays the data integrity algorithm used by the tunnel.
ESP: Encapsulating Security Payload. This column displays the encryption algorithm used by this tunnel.
Action/Edit: Make changes to the selected policy.
The actions that can be taken on policies are:
Select All: Select all the policies in the table
Delete: Delete the selected policy or policies
Enable: Check the box next to one or more policies listed in the table and click Enable to enable a policy.
Disable: Check the box next to one or more policies listed in the table and click Disable to disable a policy.
Add: Add a new policy
Add VPN Policy
The Add VPN Policy Page is used to add a new VPN policy.
A policy can be a manual policy or an auto policy:
v Manual: All settings (including the keys) for the VPN tunnel are manually input for each end point. No 3rd party server or organization is involved.
v Auto: Some parameters for the VPN tunnel are generated automatically. This requires using the IKE (Internet Key Exchange) protocol to perform negotiations between the 2 VPN Endpoints.
To create an Auto VPN Policy, you need to first create an IKE policy and then add the corresponding Auto Policy for that IKE Policy.
General
The fields in this section are:
Policy Name: A unique name for identifying of the policy.
Policy Type: Policy can be either Manual or Automatic (IKE)
Local Gateway: The WAN interface that will act as one end of the tunnel
Remote End Point: The IP address or Internet Name/FQDN of the remote gateway or client PC.
Enable NetBIOS: Check this to allow NetBIOS broadcasts to travel over the VPN tunnel.
Traffic Selection
 Keep alive :
It periodically sends ping packets to the host on the peer side of the network to keep the tunnel alive.
Enable Keep alive : check to enable .
Ping IP Address  :  Enter the IP Address to which ping packets need to be sent.
Detection period  : Router sends ping packets  periodically at regular intervals of time which is specified by the user.
Reconnect after failure count  : Fresh negotiation starts when no acknowledgement is received for the specified number of consecutive packets.
Select the IP addresses on the remote and local side that will be part of the tunnel. This can be either a single IP address, several IP addresses in a range, an entire subnet, or any IP address that wants to connect.
Choose the Local IP type from the drop list:
Any: Specifies that the policy being created is for traffic from the given end point (local or remote). Note that selecting ANY for both local and remote end points is not valid.
Single: Limit to one host. Requires the IP address of the host that will be part of the VPN.
Range: Select it you want to allow computers within an IP address range to connect to the VPN. Requires Start IP address and End IP address.
Subnet: Requires network address and subnet mask of a subnet.
Manual Policy Parameters
The Manual Policy creates an SA (Security Association) based on static inputs:
SPI-Incoming, SPI-Outgoing: Takes a hexadecimal value between 3 and 8 characters. For example: 0x1234
Encryption Algorithm: The algorithm used to encrypt the data
Integrity Algorithm: Algorithm used to verify the integrity of the data.
Encryption Key-In: Encryption key of the inbound policy. The length of the key depends on the algorithm chosen. The length is in characters as follows:
DES - 8 characters
3DES - 24 characters
AES-128 – 16 characters
AES-192 – 24 characters
AES-256 – 32 characters
Encryption Key-Out: Encryption key of the outbound policy. The length of the key depends on the algorithm chosen. Lengths for the outbound policy encryption key are the same as for the inbound policy.
Integrity Key-In: This is the integrity key (for ESP with Integrity-mode) for the inbound policy and depends on the algorithm chosen:
MD5 – 16 characters
SHA-1 – 20 characters
Integrity Key-Out: This is the integrity key (for ESP with Integrity-mode) for the outbound policy and depends on the algorithm chosen. Lengths are the same as mentioned above.
Manual Policy Example: Creating a VPN tunnel between two routers
Router 1: WAN1=10.0.0.1 LAN=192.168.1.1 Subnet=255.255.255.0
Policy Name: manualVPN
Policy Type: Manual Policy
Local Gateway: WAN1
Remote Endpoint: 10.0.0.2
Local IP: Subnet 192.168.1.0 255.255.255.0
Remote IP: Subnet 192.168.2.0 255.255.255.0
SPI-Incoming: 0x1111
Encryption Algorithm: DES
Key-In: 11112222
Key-Out: 33334444
SPI-Outgoing: 0x2222
Integrity Algorithm: MD5
Key-In: 1122334444332211
Key-Out: 5566778888776655
Router 2: WAN1=10.0.0.2 LAN=192.168.2.1 Subnet=255.255.255.0
Policy Name: manualVPN
Policy Type: Manual Policy
Local Gateway: WAN1
Remote Endpoint: 10.0.0.1
Local IP: Subnet 192.168.2.0 255.255.255.0
Remote IP: Subnet 192.168.2.0 255.255.255.0
SPI-Incoming: 0x2222
Encryption Algorithm: DES
Key-In: 33334444
Key-Out: 11112222
SPI-Outgoing: 0x1111
Integrity Algorithm: MD5
Key-In: 5566778888776655
Key-Out: 1122334444332211
Auto Policy Parameters
The Auto Policy parameters are:
SA Lifetime: The lifetime of a Security Association can either be specified in seconds or kilobytes. If specified as time, it is the interval after which the Security Association becomes invalid. The SA is renegotiated after this interval. If specified in kilobytes, the SA is renegotiated after the specified number of kilobytes of data is transferred over the SA. It is recommended that the lifebyte specifications be very large numbers or be left blank.
Note: For every policy two SAs are created, one each for inbound and outbound traffic. When using a lifetime configured in kilobytes (also known as lifebyte) along with a lifetime in seconds, the SA may expire asymmetrically. For example the lifebyte for a download stream may expire frequently if the downstream traffic is very high, but the lifebyte of the upload stream may not expire so frequently or until it reaches its timeout period. It is recommended that when setting the lifetime in both, seconds and kilobytes, the values for both should be reasonably set, so as to reduce the difference in expiry frequencies of the SAs; otherwise the system may eventually run out of resources as a result of this asymmetry. The lifebyte specifications are generally recommended for advanced users only.
Encryption Algorithm: The algorithm used to encrypt the data
Integrity Algorithm: Algorithm used to verify the integrity of the data.
PFS Key Group: Enable Perfect Forward Secrecy (PFS) to improve security. While this is slower, it will ensure that a Diffie-Hellman exchange is performed for every phase-2 negotiation.
Select IKE Policy: Choose the IKE policy that will define the characteristics of phase-1 of the negotiation.
Click Apply to save the settings.
Click Reset to revert to the previous settings.
Edit VPN Policy
The Edit VPN Policy Page helps in making changes to an existing policy.
To set the VPN policy to an Auto VPN Policy, you need to first create an IKE policy and then select the corresponding IKE Policy.
General
The fields in this section are:
Policy Name: A unique name for identifying of the policy.
Policy Type: Policy can be either Manual or Automatic (IKE)
Local Gateway: The WAN interface that will act as one end of the tunnel
Remote End Point: The IP address or Internet Name/FQDN of the remote gateway or client PC.
Enable NetBIOS: Check this to allow NetBIOS broadcasts to travel over the VPN tunnel.
Traffic Selection
 Keep alive :
It periodically sends ping packets to the host on the peer side of the network to keep the tunnel alive.
Enable Keep alive : check to enable .
Ping IP Address  :  Enter the IP Address to which ping packets need to be sent.
Detection period  : Router sends ping packets  periodically at regular intervals of time which is specified by the user.
Reconnect after failure count  : Fresh negotiation starts when no acknowledgement is received for the specified number of consecutive packets.
Select the IP addresses on the remote and local side that will be part of the tunnel. This can be either a single IP address, several IP addresses in a range, an entire subnet, or any IP address that wants to connect.
Choose the Local IP type from the drop list:
Any: Requires a valid IPv4 address
Single: Limit to one host. Requires the IP address of the host that will be part of the VPN.
Range: Select it you want to allow computers within an IP address range to connect to the VPN. Requires Start IP address and End IP address.
Subnet: Requires network address and subnet mask of a subnet.
Manual Policy Parameters
The Manual Policy creates an SA (Security Association) based on static inputs:
SPI-Incoming, SPI-Outgoing: Takes a hexadecimal value between 3 and 8 characters. For example: 0x1234
Encryption Algorithm: The algorithm used to encrypt the data
Integrity Algorithm: Algorithm used to verify the integrity of the data.
Encryption Key-In: Encryption key of the inbound policy. The length of the key depends on the algorithm chosen. The length is in characters as follows:
DES - 8 characters
3DES - 24 characters
AES-128 – 16 characters
AES-192 – 24 characters
AES-256 – 32 characters
Encryption Key-Out: Encryption key of the outbound policy. The length of the key depends on the algorithm chosen. Lengths for the outbound policy encryption key are the same as for the inbound policy.
Integrity Key-In: This is the integrity key (for ESP with Integrity-mode) for the inbound policy and depends on the algorithm chosen:
MD5 – 16 characters
SHA-1 – 20 characters
Integrity Key-Out: This is the integrity key (for ESP with Integrity-mode) for the outbound policy and depends on the algorithm chosen. Lengths are the same as mentioned above.
Auto Policy Parameters
The Auto Policy parameters are:
SA Lifetime: The lifetime of a Security Association can either be specified in seconds or kilobytes. If specified as time, it is the interval after which the Security Association becomes invalid. The SA is renegotiated after this interval. If specified in kilobytes, the SA is renegotiated after the specified number of kilobytes of data is transferred over the SA. It is recommended that the lifebyte specifications be very large numbers or be left blank.
Note: For every policy two SAs are created, one each for inbound and outbound traffic. When using a lifetime configured in kilobytes (also known as lifebyte) along with a lifetime in seconds, the SA may expire asymmetrically. For example the lifebyte for a download stream may expire frequently if the downstream traffic is very high, but the lifebyte of the upload stream may not expire so frequently or until it reaches its timeout period. It is recommended that when setting the lifetime in both, seconds and kilobytes, the values for both should be reasonably set, so as to reduce the difference in expiry frequencies of the SAs; otherwise the system may eventually run out of resources as a result of this asymmetry. The lifebyte specifications are generally recommended for advanced users only.
Encryption Algorithm: The algorithm used to encrypt the data
Integrity Algorithm: Algorithm used to verify the integrity of the data.
PFS Key Group: Enable Perfect Forward Secrecy (PFS) to improve security. While this is slower, it will ensure that a Diffie-Hellman exchange is performed for every phase-2 negotiation.
Select IKE Policy: Choose the IKE policy that will define the characteristics of phase-1 of the negotiation.
Click Apply to save the settings.
Click Reset to discard any changes and revert to the previous settings.
 

2009 © Copyright NETGEAR®

close