Netgear FWG114Pv2 FWG114Pv2 Reference Manual - Page 137

Reference Manual for the ProSafe Wireless 802.11g Firewall/Print Server Model FWG114P v2 VPNC Scenario 2: Gateway-to-Gateway with Certificates The following is a typical gateway-to-gateway VPN that uses PKIX certificates for authentication. 10.5.6.0/24 172.23.9.0/24 Gateway A Internet Gateway B 10.5.6.1 14.15.16.17 Figure 8-16: VPN Consortium Scenario 2 22.23.24.25 172.23.9.1 Gateway A connects the internal LAN 10.5.6.0/24 to the Internet. Gateway A's LAN interface has the address 10.5.6.1, and its WAN (Internet) interface has the address 14.15.16.17. Gateway B connects the internal LAN 172.23.9.0/24 to the Internet. Gateway B's WAN (Internet) interface has the address 22.23.24.25. Gateway B's LAN interface address, 172.23.9.1, can be used for testing IPsec but is not needed for configuring Gateway A. The IKE Phase 1 parameters used in Scenario 2 are: • Main mode • TripleDES • SHA-1 • MODP group 2 (1024 bits) • Authentication with signatures authenticated by PKIX certificates; both Gateway A and Gateway B have end-entity certificates that chain to a root authority called "Trusted Root CA." • SA lifetime of 28800 seconds (eight hours) with no kbytes rekeying The IKE Phase 2 parameters used in Scenario 2 are: • TripleDES • SHA-1 • ESP tunnel mode • MODP group 2 (1024 bits) • Perfect forward secrecy for rekeying • SA lifetime of 3600 seconds (one hour) with no kbytes rekeying Virtual Private Networking 201-10301-02, May 2005 8-25