Netgear DGND3800B DGND3800B User Manual (PDF) - Page 102

VPN Tunnel Configuration, The typical automated Internet Key Exchange IKE setup see

Get Netgear DGND3800B PDF manuals and user guides View all Netgear DGND3800B manuals
Add to My Manuals
Save this manual to your list of manuals

Page 102 highlights

N600 Wireless Dual Band Gigabit VDSL2 Modem Router DGND3800B • Will either endpoint use fully qualified domain names (FQDNs)? FQDNs supplied by Dynamic DNS providers (see Use a Fully Qualified Domain Name (FQDN) on page 152) can allow a VPN endpoint with a dynamic IP address to initiate or respond to a tunnel request. Otherwise, the side using a dynamic IP address has to always be the initiator. • Which method will you use to configure your VPN tunnels? - The VPN Wizard using VPNC defaults (see the following table) - The typical automated Internet Key Exchange (IKE) setup (see Use Auto Policy to Configure VPN Tunnels on page 124) - A manual keying setup in which you have to specify each phase of the connection (see Use Manual Policy to Configure VPN Tunnels on page 131) Table 4. Parameters recommended by the VPNC and used in the VPN Wizard Parameter Secure Association Authentication Method Encryption Method Authentication Protocol Diffie-Hellman (DH) Group Key Life IKE Life Time Factory Default Setting Main Mode Pre-Shared Key 3DES SHA-1 Group 2 (1024 bit) 8 hours 1 hour • What level of IPSec VPN encryption will you use? - DES. The Data Encryption Standard (DES) processes input data that is 64 bits wide, encrypting these values using a 56-bit key. Faster but less secure than 3DES. - 3DES. Triple DES achieves a higher level of security by encrypting the data three times using DES with three different, unrelated keys. • What level of authentication will you use? - MDS. 128 bits, faster but less secure. - SHA-1. 160 bits, slower but more secure. VPN Tunnel Configuration There are two tunnel configurations and three ways to configure them: • Use the VPN Wizard to configure a VPN tunnel (recommended for most situations): - See Set Up a Client-to-Gateway VPN Configuration on page 103. - See Set Up a Gateway-to-Gateway VPN Configuration on page 114. Virtual Private Networking 102

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
  • 173
  • 174
  • 175
Virtual Private Networking
102
N600 Wireless Dual Band Gigabit VDSL2 Modem Router DGND3800B
•
Will either endpoint use fully qualified domain names (FQDNs)? FQDNs supplied by
Dynamic DNS providers (see
Use a Fully Qualified Domain Name (FQDN)
on page
152)
can allow a VPN endpoint with a dynamic IP address to initiate or respond to a tunnel
request. Otherwise, the side using a dynamic IP address has to always be the initiator.
•
Which method will you use to configure your VPN tunnels?
-
The VPN Wizard using VPNC defaults (see the following table)
-
The typical automated Internet Key Exchange (IKE) setup (see
Use Auto Policy to
Configure VPN Tunnels
on page
124)
-
A manual keying setup in which you have to specify each phase of the connection
(see
Use Manual Policy to Configure VPN Tunnels
on page
131)
Table 4.
Parameters recommended by the VPNC and used in the VPN Wizard
Parameter
Factory Default Setting
Secure Association
Main Mode
Authentication Method
Pre-Shared Key
Encryption Method
3DES
Authentication Protocol
SHA-1
Diffie-Hellman (DH) Group
Group 2 (1024 bit)
Key Life
8 hours
IKE Life Time
1 hour
•
What level of IPSec VPN encryption will you use?
-
DES
. The Data Encryption Standard (DES) processes input data that is 64 bits wide,
encrypting these values using a 56-bit key. Faster but less secure than 3DES.
-
3DES
. Triple DES achieves a higher level of security by encrypting the data three
times using DES with three different, unrelated keys.
•
What level of authentication will you use?
-
MDS
. 128 bits, faster but less secure.
-
SHA-1
. 160 bits, slower but more secure.
VPN Tunnel Configuration
There are two tunnel configurations and three ways to configure them:
•
Use the VPN Wizard to configure a VPN tunnel (recommended for most situations):
-
See
Set Up a Client-to-Gateway VPN Configuration
on page
103.
-
See
Set Up a Gateway-to-Gateway VPN Configuration
on page
114.