Understanding How Fvs318 Vpn Tunnels Are Configured - NETGEAR FVS318 - ProSafe VPN Firewall Router Reference Manual

Reference Manual for the Model FVS318 Broadband ProSafe VPN Firewall
VPN client access allows a remote PC to connect to your network from any location on the
Internet. In this case, the remote PC is one tunnel endpoint, running VPN client software. The
FVS318 VPN Firewall router on your network is the other tunnel endpoint
• The FVS318 VPN Firewall supports up to eight concurrent tunnels.
These scenarios are described below.
Note: The FVS318 VPN Firewall uses industry standard VPN protocols. However, due
to variations in how manufacturers interpret these standards, many VPN products do not
interoperate. NETGEAR provides support for connections between NETGEAR VPN
Firewalls, and between an FVS318 VPN Firewall and the SafeNet SoftRemote VPN
Client for Windows. This manual is written based on tests with the FVS318 and versions
8 and 9 of the SafeNet client. Although the FVS318 can interoperate with many other
VPN products, it is not possible for NETGEAR to provide specific technical support for
every other interconnection. Please see NETGEAR's web site for additional VPN
information.

Understanding How FVS318 VPN Tunnels Are Configured

You create VPN tunnels definitions via the VPN Settings link under the Setup section of the main
menu on the FVS318. The VPN tunnel configuration consists of these two kinds of information:
• Connection. Identifies the VPN endpoints by IPSec ID, IP address, or a fully qualified domain
name (FQDN).
Note: A FQDN is the complete URL of the router. Using a dynamic DNS service for a
FVS318 with a dynamically-assigned IP address enables that FVS318 to both initiate and
respond to requests to open a VPN tunnel. Otherwise, a FVS318 with a dynamically-assigned
IP address can only initiate a request to open a VPN tunnel because no other initiators can
know its IP address.
• Security Association (SA). There are three kinds of SA key exchange modes:
— IKE Main Mode: Uses the Internet Key Exchange (IKE) protocol to define the
authentication scheme and automatically generate the encryption keys. Main Mode
authentication is slightly slower than Aggressive Mode but more secure.
— IKE Aggressive Mode: Uses the IKE protocol to define the authentication scheme and
automatically generate the encryption keys. Aggressive Mode authentication is slightly
faster than Main Mode but less secure.
6-2
M-10146-01
Virtual Private Networking