VPN close
VPN Client
This page is used to specify configuration for VPN Clients.
VPN Client
The VPN Client is disabled by default. To enable it, select Yes.
Automatic Association
The router generates an internal policy dynamically for connecting clients. The following parameters must be specified for the generating policy:
Local FQDN: The local domain name ex: local_id.com
Remote FQDN: The local domain name ex: remote_id.com. Use 0.0.0.0 for anonymous client connections.
Encryption Algorithm: The algorithm used to negotiate the SA
Authentication Algorithm: Specify the authentication algorithm
Pre-shared key: Enter a simple password like key. The same key must also be specified with the client
Diffie-Hellman (DH) Group: The Diffie-Hellman algorithm is used when exchanging keys. The DH Group sets the algorithm strength in bits. (This setting must match the settings of the remote VPN.)
SA-Lifetime (sec): The time after which the SA expires and is negotiated. A shorter lifetime will improve security, but will add a negotiation delay every time the SA expires.
Mode Config
The router allows specification of IP addresses and other information for accessing the tunnel via the selection of the Mode Config records.
Do you want to use Mode Config Record?
Indicates whether ModeConfig should be enabled with this policy.
Select Mode Config Record: This drop-down list shows the specified list of Mode Config records to choose from. This field is required if you opt to specify ModeConfig record with the policy, i.e., “Yes” to the above question.
Extended Authentication
When connecting many VPN clients to a VPN gateway router, XAUTH allows authentication of users beyond the pre-shared key authentication. Although you could configure a unique VPN policy for each user, it would be convenient if the VPN gateway router authenticated users from a stored list of user accounts or with an external authentication server such as a RADIUS server.
XAUTH Configuration
Select None to disable XAuth.
Select “Edge Device” to use this router as a VPN concentrator where one or more gateway tunnels terminate. When this option is chosen, you will need to specify the authentication type to be used in verifying credentials of the remote VPN gateways.
Authentication Type: Select the user database which will be used to verify account information. Select System Database to verify against the router’s user database. Users must be added thorough the User Database page. To use an external RADIUS server, select either RADIUS – CHAP or RADIUS – PAP, depending on the authentication mode accepted by the RADIUS server.
Note: If RADIUS – PAP is selected, the router will first check in the System Database to see if the user credentials are available. If the user account is not present, the router will then connect to the RADIUS server.
Traffic Tunnel Security Level
To configure the SA that will be negotiated by the tunnel, configure the following fields:
PFS Key Group: Select the PFS group to will be used for the Proposal phase of building the tunnel. While this is slower, it will ensure that a Diffie-Hellman exchange is performed for every IKE phase-2 negotiation.
SA Lifetime: The lifetime of a Security Association can either be specified in seconds or kilobytes. If specified as time, it is the interval after which the Security Association becomes invalid. The SA is renegotiated after this interval. If specified in kilobytes, the SA is renegotiated after the specified number of kilobytes of data is transferred over the SA. It is recommended that the lifebyte specifications be very large numbers or be left blank.
Encryption Algorithm: The algorithm used to encrypt the data.
Integrity Algorithm: Algorithm used to verify the integrity of the data.
Click Apply to save the settings.
Click Reset to discard any changes and revert to the previous settings.
 

2009 © Copyright NETGEAR®

close