NETGEAR VPN Manual

VPN Concepts, Tips, and Techniques 1-1

Version 1.0, July 2003

1Introduction to VPN

VPN Concepts, Tips, and Techniques

There have been many improvements in the Internet including Quality of Service, network

performance, and inexpensive technologies, such as DSL. But one of the most important advances

has been in Virtual Private Networking (VPN) Internet Protocol security (IPSec). IPSec is one of

the most complete, secure, and commercially available, standards-based protocols developed for

transporting data.

What is a VPN?

A VPN is a shared network where private data is segmented from other traffic so that only the

intended recipient has access. The term VPN was originally used to describe a secure connection

over the Internet. Today, however, VPN is also used to describe private networks, such as Frame

Relay, Asynchronous Transfer Mode (ATM), and Multiprotocol Label Switching (MPLS).

A key aspect of data security is that the data flowing across the network is protected by encryption

technologies. Private networks lack data security, which allows data attackers to tap directly into

the network and read the data. IPSec-based VPNs use encryption to provide data security, which

increases the network’s resistance to data tampering or theft.

IPSec-based VPNs can be created over any type of IP network, including the Internet, Frame

Relay, ATM, and MPLS, but only the Internet is ubiquitous and inexpensive.

VPNs are traditionally used for:

•Intranets: Intranets connect an organization’s locations. These locations range from the

headquarters offices, to branch offices, to a remote employee’s home. Often this connectivity

is used for e-mail and for sharing applications and files. While Frame Relay, ATM, and MPLS

accomplish these tasks, the shortcomings of each limits connectivity. The cost of connecting

home users is also very expensive compared to Internet-access technologies, such as DSL or

cable. Because of this, organizations are moving their networks to the Internet, which is

inexpensive, and using IPSec to create these networks.

Intro2VPN.fm Page 1 Sunday, November 23, 2003 12:57 PM

TechNote: VPN Configuration Case Studies

1-2 VPN Concepts, Tips, and Techniques

Version 1.0, July 2003

•Remote Access: Remote access enables telecommuters and mobile workers to access e-mail

and business applications. A dial-up connection to an organization’s modem pool is one

method of access for remote workers, but is expensive because the organization must pay the

associated long distance telephone and service costs. Remote access VPNs greatly reduce

expenses by enabling mobile workers to dial a local Internet connection and then set up a

secure IPSec-based VPN communications to their organization.

•Extranets: Extranets are secure connections between two or more organizations. Common

uses for extranets include supply-chain management, development partnerships, and

subscription services. These undertakings can be difficult using legacy network technologies

due to connection costs, time delays, and access availability. IPSec-based VPNs are ideal for

extranet connections. IPSec-capable devices can be quickly and inexpensively installed on

existing Internet connections.

What Is IPSec and How Does It Work?

IPSec is an Internet Engineering Task Force (IETF) standard suite of protocols that provides data

authentication, integrity, and confidentiality as data is transferred between communication points

across IP networks. IPSec provides data security at the IP packet level. A packet is a data bundle

that is organized for transmission across a network, and includes a header and payload (the data in

the packet). IPSec emerged as a viable network security standard because enterprises wanted to

ensure that data could be securely transmitted over the Internet. IPSec protects against possible

security exposures by protecting data while in while in transit.

IPSec Security Features

IPSec is the most secure method commercially available for connecting network sites. IPSec was

designed to provide the following security features when transferring packets across networks:

•Authentication: Verifies that the packet received is actually from the claimed sender.

•Integrity: Ensures that the contents of the packet did not change in transit.

•Confidentiality: Conceals the message content through encryption.

IPSec Components

IPSec contains the following elements:

Intro2VPN.fm Page 2 Sunday, November 23, 2003 12:57 PM

TechNote: VPN Configuration Case Studies

VPN Concepts, Tips, and Techniques 1-3

Version 1.0, July 2003

•Encapsulating Security Payload (ESP): Provides confidentiality, authentication, and

integrity.

•Authentication Header (AH): Provides authentication and integrity.

•Internet Key Exchange (IKE): Provides key management and Security Association (SA)

management.

Encapsulating Security Payload (ESP)

ESP provides authentication, integrity, and confidentiality, which protect against data tampering

and, most importantly, provide message content protection.

IPSec provides an open framework for implementing industry standard algorithms, such as SHA

and MD5. The algorithms IPSec uses produce a unique and unforgeable identifier for each packet,

which is a data equivalent of a fingerprint. This fingerprint allows the device to determine if a

packet has been tampered with. Furthermore, packets that are not authenticated are discarded and

not delivered to the intended receiver.

ESP also provides all encryption services in IPSec. Encryption translates a readable message into

an unreadable format to hide the message content. The opposite process, called decryption,

translates the message content from an unreadable format to a readable message. Encryption/

decryption allows only the sender and the authorized receiver to read the data. In addition, ESP has

an option to perform authentication, called ESP authentication. Using ESP authentication, ESP

provides authentication and integrity for the payload and not for the IP header.

Figure 1-1: Original packet and packet with IPSec Encapsulated Security Payload

Intro2VPN.fm Page 3 Sunday, November 23, 2003 12:57 PM

TechNote: VPN Configuration Case Studies

1-4 VPN Concepts, Tips, and Techniques

Version 1.0, July 2003

The ESP header is inserted into the packet between the IP header and any subsequent packet

contents. However, because ESP encrypts the data, the payload is changed. ESP does not encrypt

the ESP header, nor does it encrypt the ESP authentication.

Authentication Header (AH)

AH provides authentication and integrity, which protect against data tampering, using the same

algorithms as ESP. AH also provides optional anti-replay protection, which protects against

unauthorized retransmission of packets. The authentication header is inserted into the packet

between the IP header and any subsequent packet contents. The payload is not touched.

Although AH protects the packet’s origin, destination, and contents from being tampered with, the

identity of the sender and receiver is known. In addition, AH does not protect the data’s

confidentiality. If data is intercepted and only AH is used, the message contents can be read. ESP

protects data confidentiality. For added protection in certain cases, AH and ESP can be used

together. In the following table, IP HDR represents the IP header and includes both source and

destination IP addresses.

Figure 1-2: Original packet and packet with IPSec Authentication Header

IKE Security Association

IPSec introduces the concept of the Security Association (SA). An SA is a logical connection

between two devices transferring data. An SA provides data protection for unidirectional traffic by

using the defined IPSec protocols. An IPSec tunnel typically consists of two unidirectional SAs,

which together provide a protected, full-duplex data channel.

The SAs allow an enterprise to control exactly what resources may communicate securely,

according to security policy. To do this an enterprise can set up multiple SAs to enable multiple

secure VPNs, as well as define SAs within the VPN to support different departments and business

partners.

Intro2VPN.fm Page 4 Sunday, November 23, 2003 12:57 PM

TechNote: VPN Configuration Case Studies

VPN Concepts, Tips, and Techniques 1-5

Version 1.0, July 2003

Mode

SAs operate using modes. A mode is the method in which the IPSec protocol is applied to the

packet. IPSec can be used in tunnel mode or transport mode. Typically, the tunnel mode is used for

gateway-to-gateway IPSec tunnel protection, while transport mode is used for host-to-host IPSec

tunnel protection. A gateway is a device that monitors and manages incoming and outgoing

network traffic and routes the traffic accordingly. A host is a device that sends and receives

network traffic.

•Transport Mode: The transport mode IPSec implementation encapsulates only the packet’s

payload. The IP header is not changed. After the packet is processed with IPSec, the new IP

packet contains the old IP header (with the source and destination IP addresses unchanged)

and the processed packet payload. Transport mode does not shield the information in the IP

header; therefore, an attacker can learn where the packet is coming from and where it is going

to. The previous packet diagrams show a packet in transport mode.

•Tunnel Mode: The tunnel mode IPSec implementation encapsulates the entire IP packet. The

entire packet becomes the payload of the packet that is processed with IPSec. A new IP header

is created that contains the two IPSec gateway addresses. The gateways perform the

encapsulation/decapsulation on behalf of the hosts. Tunnel mode ESP prevents an attacker

from analyzing the data and deciphering it, as well as knowing who the packet is from and

where it is going.

Note: AH and ESP can be used in both transport mode or tunnel mode.

Figure 1-3: Original packet and packet with IPSec ESP in Tunnel mode

Intro2VPN.fm Page 5 Sunday, November 23, 2003 12:57 PM

TechNote: VPN Configuration Case Studies

1-6 VPN Concepts, Tips, and Techniques

Version 1.0, July 2003

Key Management

IPSec uses the Internet Key Exchange (IKE) protocol to facilitate and automate the SA setup and

the exchange of keys between parties transferring data. Using keys ensures that only the sender

and receiver of a message can access it.

IPSec requires that keys be re-created, or refreshed, frequently so that the parties can communicate

securely with each other. IKE manages the process of refreshing keys; however, a user can control

the key strength and the refresh frequency. Refreshing keys on a regular basis ensures data

confidentiality between sender and receiver.

Understand the Process Before You Begin

This TechNote provides case studies on how to configure a secure IPSec VPN tunnels. This

document assumes the reader has a working knowledge of NETGEAR management systems.

NETGEAR is a member of the VPN Consortium, a group formed to facilitate IPSec VPN vendor

interoperability. The VPN Consortium has developed specific scenarios to aid system

administrators in the often confusing process of connecting two different vendor implementations

of the IPSec standard. The case studies in this TechNote follow the addressing and configuration

mechanics defined by the VPN Consortium. Additional information regarding inter-vendor

interoperability may be found at http://www.vpnc.org/interop.html.

It is a good idea to gather all the necessary information required to establish a VPN before you

begin the configuration process. You should understand whether the firmware is up to date, all of

the addresses that will be necessary, and all of the parameters that need to be set on both sides. Try

to understand any incompatibilities before you begin, so that you minimize any potential

complications which may arise from normal firewall or WAN processes.

If you are not a full-time system administrator, it is a good idea to familiarize yourself with the

mechanics of a VPN. The brief description in this TechNote will help. Other good sources include:

• The NETGEAR VPN Tutorial – http://www.netgear.com/planetvpn/pvpn_2.html

• The VPN Consortium – http://www.vpnc.org/

Intro2VPN.fm Page 6 Sunday, November 23, 2003 12:57 PM

TechNote: VPN Configuration Case Studies

VPN Concepts, Tips, and Techniques 1-7

Version 1.0, July 2003

VPN Process Overview

Even though IPSec is standards-based, each vendor has its own set of terms and procedures for

implementing the standard. Because of these differences, it may be a good idea to review some of

the terms and the generic processes for connecting two gateways before diving into to the

specifics.

Network Interfaces and Addresses

The VPN gateway is aptly named because it functions as a “gatekeeper” for each of the computers

connected on the Local Area Network behind it.

In most cases, each Gateway will have a “public” facing address (WAN side) and a “private”

facing address (LAN side). These addresses are referred to as the “network interface” in

documentation regarding the construction of VPN communication. Please note that the addresses

used in the example.

Interface Addressing

This TechNote uses example addresses provided the VPN Consortium. It is important to

understand that you will be using addresses specific to the devices that you are attempting to

connect via IPSec VPN.

Figure 1-4: VPNC Example Network Interface Addressing

Gateway A

22.23.24.25

14.15.16.17

10.5.6.0/24 172.23.9.0/24

172.23.9.110.5.6.1

WAN IP WAN IP LAN IPLAN IP

Gateway B

VPNC Example

Network Interface Addressing

Intro2VPN.fm Page 7 Sunday, November 23, 2003 12:57 PM

TechNote: VPN Configuration Case Studies

1-8 VPN Concepts, Tips, and Techniques

Version 1.0, July 2003

It is also important to make sure the addresses do not overlap or conflict. That is, each set of

addresses should be separate and distinct.

It will also be important to know the subnet mask of both gateway LAN Connections. Use the

worksheet in Appendix A to gather the necessary address and subnet mask information to aid in

the configuration and troubleshooting process.

Firewalls

It is important to understand that many gateways are also firewalls. VPN tunnels cannot function

properly if firewall settings disallow all incoming traffic. Please refer to the firewall instructions

for both gateways to understand how to open specific protocols, ports, and addresses that you

intend to allow.

Setting Up a VPN Tunnel Between Gateways

A SA, frequently called a tunnel, is the set of information that allows two entities (networks, PCs,

routers, firewalls, gateways) to “trust each other” and communicate securely as they pass

information over the Internet.

Table 1-1. WAN (Internet/Public) and LAN (Internal/Private) Addressing

Gateway LAN or WAN VPNC Example Address

Gateway A LAN (Private) 10.5.6.1

Gateway A WAN (Public) 14.15.16.17

Gateway B LAN (Private) 22.23.24.25

Gateway B WAN (Public) 172.23.9.1

Table 1-2. Subnet Addressing

Gateway LAN or WAN Interface Name Example Subnet Mask

Gateway A LAN (Private) Subnet Mask A 255.255.255.0

Gateway B LAN (Private) Subnet Mask B 255.255.255.0

Intro2VPN.fm Page 8 Sunday, November 23, 2003 12:57 PM

TechNote: VPN Configuration Case Studies

VPN Concepts, Tips, and Techniques 1-9

Version 1.0, July 2003

Figure 1-5: VPN Tunnel SA

The SA contains all the information necessary for gateway A to negotiate a secure and encrypted

communication stream with gateway B. This communication is often referred to as a “tunnel.” The

gateways contain this information so that it does not have to be loaded onto every computer

connected to the gateways.

Each gateway must negotiate its Security Association with another gateway using the parameters

and processes established by IPSec. As illustrated below, the most common method of

accomplishing this process is via the Internet Key Exchange (IKE) protocol which automates some

of the negotiation procedures. Alternatively, you can configure your gateways using manual key

exchange, which involves manually configuring each paramter on both gateways.

Figure 1-6: IPSec SA negotiation

1. The IPSec software on Host A initiates the IPSec process in an attempt to communicate

with Host B. The two computers then begin the Internet Key Exchange (IKE) process.

VPN Gateway A VPN Gateway B

VPN Tunnel

VPN Gateway

1) Communication

request sent to VPN Gateway

2) IKE Phase I authentication

3) IKE Phase II negotiation

4) Secure data transfer

5) IPSec tunnel termination

IPSec Security Association IKE

VPN Tunnel Negotiation Steps

Intro2VPN.fm Page 9 Sunday, November 23, 2003 12:57 PM

TechNote: VPN Configuration Case Studies

1-10 VPN Concepts, Tips, and Techniques

Version 1.0, July 2003

2. IKE Phase I.

a. The two parties negotiate the encryption and authentication algorithms to use in the IKE

SAs.

b. The two parties authenticate each other using a predetermined mechanism, such as

preshared keys or digital certificates.

c. A shared master key is generated by the Diffie-Hellman Public key algorithm within the

IKE framework for the two parties. The master key is also used in the second phase to

derive IPSec keys for the SAs.

3. IKE Phase II.

a. The two parties negotiate the encryption and authentication algorithms to use in the IPSec

SAs.

b. The master key is used to derive the IPSec keys for the SAs. Once the SA keys are created

and exchanged, the IPSec SAs are ready to protect user data between the two VPN

gateways.

4. Data transfer. Data is transferred between IPSec peers based on the IPSec parameters and

keys stored in the SA database.

5. IPSec tunnel termination. IPSec SAs terminate through deletion or by timing out.

VPNC IKE Security Parameters

It is important to remember that both gateways must have the identical parameters set for the

process to work correctly. The settings in these TechNote examples follow the examples given for

Scenario 1 of the VPN Consortium.

VPNC IKE Phase I Parameters

The IKE Phase 1 parameters used:

•Mainmode

•TripleDES

• SHA-1

• MODP group 1

• pre-shared secret of "hr5xb84l6aa9r6"

• SA lifetime of 28800 seconds (eight hours)

Intro2VPN.fm Page 10 Sunday, November 23, 2003 12:57 PM

Otros manuales para VPN

Tabla de contenidos

Otros manuales de Enrutador de red de NETGEAR

NETGEAR

NETGEAR RANGEMAX WNDR3300 Manual de usuario

NETGEAR

NETGEAR RT311 Cómo utilizar

NETGEAR

NETGEAR RM356 RM356 RM356 Manual de usuario

NETGEAR

NETGEAR WGE101 Manual de usuario

NETGEAR

NETGEAR XE104 - 85 Mbps Wall-Plugged EN Switch... Manual de usuario

NETGEAR

NETGEAR XR500 Nighthawk Manual de usuario

NETGEAR

NETGEAR D6400 Manual de usuario

NETGEAR

NETGEAR R6100 Manual de usuario

NETGEAR

NETGEAR WNHDE111 Manual de usuario

NETGEAR

NETGEAR DG632 - ADSL Modem Router Manual de usuario

NETGEAR

NETGEAR Orbi RBR350 Manual de usuario

NETGEAR

NETGEAR FS308 - Switch Manual de usuario

NETGEAR

NETGEAR RP334 Manual de usuario

NETGEAR

NETGEAR Nighthawk R7400 Manual de usuario

NETGEAR

NETGEAR FR314 Manual de usuario

NETGEAR

NETGEAR JNR3210 Manual de usuario

NETGEAR

NETGEAR DG834Gv1 - 54 Mbps Wireless ADSL Firewall... Manual de usuario

NETGEAR

NETGEAR D6200 Manual de usuario

NETGEAR

NETGEAR R6700AX Manual de usuario

NETGEAR

NETGEAR WGE101 Manual de usuario

NETGEAR

NETGEAR N150 Manual de usuario

NETGEAR

NETGEAR JNR3210 Manual de lista de piezas

NETGEAR

NETGEAR RAX75 Manual de usuario

NETGEAR

NETGEAR FS605 Manual de usuario

Manuales populares de Enrutador de red de otras marcas

Allnet

Allnet ALL0333AU Manual de usuario

HomeSeer

HomeSeer HT-SEL Manual de usuario

Sercomm

Sercomm Genesis OC3505D Manual de usuario

Billion

Billion BIPAC 5102 Series Manual de usuario

TP-Link

TP-Link TD-8817 Manual de usuario

Motorola

Motorola MR1900 Manual de usuario

Digi

Digi IX14 Manual de usuario

Cisco

Cisco NCS 540 Manual

XAVi

XAVi X8821e Manual de usuario

BEC

BEC 6200WZL Manual de usuario

MikroTik

MikroTik hAP ac3 Series Manual de usuario

Korenix

Korenix JetNet 5428G Series Manual de usuario

Korenix

Korenix JetNet 5710G Series Manual de usuario

Automated Logic

Automated Logic ZN551 Manual del propietario

Cisco

Cisco ASR 1000 Series Manual del operador

EnGenius

EnGenius ESR-9710 Manual de usuario

Cisco

Cisco 805 Series Instrucciones de funcionamiento y seguridad

LevelOne

LevelOne FBR-1416 Manual de usuario