D-Link DS-605 User Guide - Page 3

1. Scenario 1: Client-to-gateway with pre-shared secrets 1.1 Scenario Setup The following is a typical client-to-gateway VPN that uses a preshared secret for authentication. 172.23.9.0/24 | |-- /-^-^-^-^--\ | | Client A |=====| Internet |=====| Gateway B |-----| AW \--v-v-v-v-/ BW BL | Dynamically assigned 22.23.24.25 172.23.9.1 |-- | Figure 1.1.1: Scenario Client A's WAN interface (AW) has the address dynamically assigned to it by the ISP. Client A will access Gateway B's internal LAN, by means of a secure tunnel. Gateway B connects the internal LAN 172.23.9.0/24 to the Internet. Gateway B's WAN (Internet) interface has the address 22.23.24.25. Gateway B's LAN interface address, 172.23.9.1, can be used for testing IPsec but is not needed for configuring Client A. The IKE Phase 1 parameters used in Scenario 1 are: Main mode TripleDES SHA-1 MODP group 2 (1024 bits) pre-shared secret of "hr5xb84l6aa9r6" SA lifetime of 28800 seconds (eight hours) with no kbytes rekeying The IKE Phase 2 parameters used in Scenario 1 are: TripleDES SHA-1 ESP tunnel mode MODP group 2 (1024 bits) Perfect forward secrecy for rekeying SA lifetime of 3600 seconds (one hour) with no kbytes rekeying Selectors for all IP protocols, all ports, between the client and 172.23.9.0/24, using IPv4 subnets 1.2 Using the Configuration Assistant Figure 1.2.1: Configuration Assistant The first time you start up the D-Link VPN Client you may be prompted to create a profile if one doesn't already exist. You can either use the assistant as outlined in section 1.2, or modify an existing profile as in section 1.3. Version 0.90 Page 3 of 15 06.Sep.04