Assigning Ip Addresses To Remote Users (Mode Config); Mode Config Operation; Configuring Mode Config Operation On The Vpn Firewall - NETGEAR SRX5308 - ProSafe® Quad WAN Gigabit SSL VPN Firewall Reference Manual

ProSafe Gigabit Quad WAN SSL VPN Firewall SRX5308 Reference Manual

Assigning IP Addresses to Remote Users (Mode Config)

To simplify the process of connecting remote VPN clients to the VPN firewall, use the Mode
Config feature to assign IP addresses to remote users, including a network access IP address,
subnet mask, WINS server, and DNS address from the VPN firewall. Remote users are given IP
addresses available in a secured network space so that remote users appear as seamless extensions
of the network.

Mode Config Operation

After the IKE Phase 1 negotiation is complete, the VPN connection initiator (which is the remote
user with a VPN client) requests the IP configuration settings such as the IP address, subnet mask,
WINS server, and DNS address from the VPN firewall. The Mode Config feature allocates an IP
address from the configured IP address pool and activates a temporary IPsec policy, using the
information that is specified in the Traffic Tunnel Security Level section of the Mode Config
record (on the Add Mode Config Record screen that is shown in
Note: After configuring a Mode Config record, you must manually configure an IKE
policy and select the newly created Mode Config record from the Select Mode
Config Record drop-down list (see
VPN Firewall" on page
policy.
Note: An IP address that is allocated to a VPN client is released only after the VPN client
has gracefully disconnected or after the SA liftetime for the connection has timed
out.

Configuring Mode Config Operation on the VPN Firewall

To configure Mode Config on the VPN firewall, you first must create a Mode Config record, and
then select the Mode Config record for an IKE policy:
1. Select VPN > IPSec VPN from the menu. The IPsec VPN submenu tabs display, with the IKE
Policies screen in view (see
5-42
"Configuring Mode Config Operation on the
5-42). You do not need to make changes to any VPN
Figure 5-20 on page 5-22).
Virtual Private Networking Using IPsec Connections
v1.0, April 2010
Figure 5-26 on page 5-44).