Netgear FVG318v1 FVG318 Reference Manual - Page 124

Scenario_2, RSA Signature, Certificate, Revocation Lists CRL, Browse, Upload

Get Netgear FVG318v1 - ProSafe 802.11g Wireless VPN Firewall Switch PDF manuals and user guides View all Netgear FVG318v1 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 124 highlights

ProSafe 802.11g Wireless VPN Firewall FVG318 Reference Manual f. The "FVG318" certificate will display in the Active Self Certificates table and the pending "FVG318" Self Certificate Request will be deleted. 7. Associate the new certificate and the Trusted Root CA certificate on the FVG318. a. Create a new IKE policy called Scenario_2 with all the same properties of Scenario_1, except now select the RSA Signature radio box instead of the Pre-shared key. b. Create a new VPN Auto Policy called scenario2a with all the same properties as scenario1a except that it uses the IKE policy called Scenario_2. Now, the traffic from devices within the range of the LAN subnet addresses on FVG318 A and Gateway B will be authenticated using the certificates rather than via a pre-shared key. 8. Set up Certificate Revocation List (CRL) checking. a. Get a copy of the CRL from the CA and save it as a text file. Note: The procedure for obtaining a CRL differs from a CA like Verisign and a CA such as a Windows 2000 certificate server, which an organization operates for providing certificates for its members. Follow the procedures of your CA. b. Select VPN > Certificates from the main menu and scroll down to the Certificate Revocation Lists (CRL) section. c. Click Browse to locate the CRL file. d. Click Upload. The CRL will be uploaded to the Certificate Revocation Lists (CRL) table. Now expired or revoked certificates will not be allowed to use the VPN tunnels managed by IKE policies which use this CA. Note: You must update the CRLs regularly in order to maintain the validity of the certificate-based VPN policies. 6-18 Advanced Virtual Private Networking v1.0, September 2007

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
  • 173
  • 174
  • 175
  • 176
ProSafe 802.11g Wireless VPN Firewall FVG318 Reference Manual
6-18
Advanced Virtual Private Networking
v1.0, September 2007
f.
The “FVG318” certificate will display in the Active Self Certificates table and the pending
“FVG318” Self Certificate Request will be deleted.
7.
Associate the new certificate and the Trusted Root CA certificate on the FVG318.
a.
Create a new IKE policy called
Scenario_2
with all the same properties of
Scenario_1,
except now select the
RSA Signature
radio box instead of the Pre-shared key.
b.
Create a new VPN Auto Policy called
scenario2a
with all the same properties as
scenario1a
except that it uses the IKE policy called Scenario_2.
Now, the traffic from devices within the range of the LAN subnet addresses on FVG318 A and
Gateway B will be authenticated using the certificates rather than via a pre-shared key.
8.
Set up Certificate Revocation List (CRL) checking.
a.
Get a copy of the CRL from the CA and save it as a text file.
b.
Select VPN > Certificates from the main menu and scroll down to the
Certificate
Revocation Lists (CRL)
section.
c.
Click
Browse
to locate the CRL file.
d.
Click
Upload
. The CRL will be uploaded to the Certificate Revocation Lists (CRL) table.
Now expired or revoked certificates will not be allowed to use the VPN tunnels managed by
IKE policies which use this CA.
Note:
The procedure for obtaining a CRL differs from a CA like Verisign and a
CA such as a Windows 2000 certificate server, which an organization
operates for providing certificates for its members. Follow the procedures
of your CA.
Note:
You must update the CRLs regularly in order to maintain the validity of the
certificate-based VPN policies.