Netgear DGND3300 [104/174] Example of using auto policy

Virtual Private Networking

104

N300 Wireless Dual Band ADSL2+ Modem Router DGND3300v2

• Authentication Algorithm. The authentication algorithm used for both IKE and IPSec.

This setting has to match the setting used on the remote VPN gateway. Auto, MD5, and

SHA-1 are supported. Auto negotiates with the remote VPN endpoint and is not available

in responder-only mode.

- MD5. 128 bits, faster but less secure.

- SHA-1. 160

bits, slower but more secure. This is the default.

• Pre-share

d Key. The key has to be entered both here and on the remote VPN gateway.

• SA Life Time.

The time interval before the SA (security association) expires. (It is

automatically reestablished as required.) While using a short time period (or data amount)

increases security, it also degrades performance. It is common to use periods over an

hour (3600 seconds) for the SA life time. This setting applies to both IKE and IPSec SAs.

• Enable IPSec PFS (Perfect Forward Secrecy). If th

is check box is selected, security is

enhanced by ensuring that the key is changed at regular intervals. Also, even if one key is

broken, subsequent keys are no easier to break. (Each key has no relationship to the

previous key.)

This setting applies to both IKE and IPSec SAs. When configuring the remote endpoint to

matc

h this setting, you might have to specify the key group used. For this device, the key

group is the same as the DH Group setting in the IKE section.

Example of Using Auto Policy

Gateway A

Gateway B

VPN Tunnel

Internet

22.23.24.25

14.15.16.17

IP: 192.168.0.1

IP:192.168.3.1

Figure 6. Auto Policy

The following settings are assumed for this example:.

Table 5. Gateway-to-Gateway VPN Tunnel Configuration Worksheet

Parameter Value to Be Entered Field Selection

Connection Name GtoG N/A

Pre-Shared Key 12345678 N/A

Secure Association N/A Main Mode Manual Keys

Perfect Forward secrecy N/A Enabled Disabled