Reference Manual for the ADSL Modem Wireless Router DG834G Note: When NETBIOS is enabled (which it is in the VPNC defaults implemented by the VPN Wizard), automatic traffic will reactivate the tunnel. To prevent reactivation from happening, either disable NETBIOS or disable the policy for the tunnel (see “Using the Policy Table on the VPN Policies Page to Deactivate a VPN Tunnel” on page 7-35). Deleting a VPN Tunnel To delete a VPN tunnel: 1. Log in to the Modem Router. 2.
Reference Manual for the ADSL Modem Wireless Router DG834G How to Set Up VPN Tunnels in Special Circumstances When the VPN Wizard and its VPNC defaults (see Table 7-2) are not appropriate for your special circumstances, use one of the following alternatives: • Auto Policy—for a typical automated Internet Key Exchange (IKE) setup, see “Using Auto Policy to Configure VPN Tunnels” on page 7-38.
Reference Manual for the ADSL Modem Wireless Router DG834G Figure 7-40 Virtual Private Networking 7-39 v1.
Reference Manual for the ADSL Modem Wireless Router DG834G The DG834G v3 VPN tunnel network connection fields are defined as follows: General. These settings identify this policy and determine its major characteristics. • Policy Name—Enter a unique name to identify this policy. This name is not supplied to the remote VPN endpoint. It is used only to help you manage the policies. • Remote VPN Endpoint—If the remote endpoint has a dynamic IP address, select Dynamic IP address.
Reference Manual for the ADSL Modem Wireless Router DG834G Remote LAN. This identifies which PCs on the remote LAN are covered by this policy. For each selection, data must be provided as follows: • Single PC - no Subnet—select this option if there is no LAN (only a single PC) at the remote endpoint. If this option is selected, no additional data is required. The typical application is a PC running the VPN client at the remote end.
Reference Manual for the ADSL Modem Wireless Router DG834G Remote Identity Type—select the desired option to match the "Local Identity Type" setting on the remote VPN endpoint. • IP Address—the Internet IP address of the remote VPN endpoint. • Fully Qualified Domain Name—the Domain name of the remote VPN endpoint. • Fully Qualified User Name—the name, E-mail address, or other ID of the remote VPN endpoint. Remote Identity Data—enter the data for the selection above.
Reference Manual for the ADSL Modem Wireless Router DG834G Example of Using Auto Policy A B VPN Tunnel 14.15.16.17 DG834G VPN Firewall 22.23.24.25 DG834G VPN Firewall 192.168.3.1 192.168.0.1 PCs PCs Figure 7-41 1. Set the LAN IPs on each DG834G v3 to different subnets and configure each properly for the Internet. The following settings are assumed for this example: Table 7-5.
Reference Manual for the ADSL Modem Wireless Router DG834G 2. Open the DG834G v3 on LAN A management interface and click on VPN Policies. Figure 7-42 3. Click Add Auto Policy. 4. Enter policy settings (see Figure 7-43). • General — Policy Name = GtoG — Remote VPN Endpoint Address Type = Fixed IP Address — Remote VPN Endpoint Address Data = 22.23.24.25 • Local LAN – use default setting • Remote LAN — IP Address = select Subnet address from the pulldown menu. — Start IP address = 192.168.3.
Reference Manual for the ADSL Modem Wireless Router DG834G — Authentication Algorithm = MD5 — Pre-shared Key = 12345678 Figure 7-43 Virtual Private Networking 7-45 v1.
Reference Manual for the ADSL Modem Wireless Router DG834G 5. Click Apply. The Get VPN Policies web page is displayed. Figure 7-44 6. Repeat for the DG834G v3 on LAN B and pay special attention to use the following network settings as appropriate. • General, Remote Address Data (e.g., 14.15.16.17) • Remote LAN, Start IP Address — IP Address (e.g, 192.168.0.1) — Subnet Mask (e.g., 255.255.255.0) — Preshared Key (e.g., 12345678) 7.
Reference Manual for the ADSL Modem Wireless Router DG834G a. Open the DG834G v3 management interface and click on VPN Status to display the VPN Status/Log screen (Figure 7-45). Figure 7-45 b. Click VPN Status (Figure 7-45) to display the Current VPN Tunnels (SAs) screen (Figure 7-46). Click on Connect for the VPN tunnel you want to activate. Figure 7-46 c. Review the VPN Status/Log screen (Figure 7-45) to verify that the tunnel is connected. Virtual Private Networking 7-47 v1.
Reference Manual for the ADSL Modem Wireless Router DG834G Using Manual Policy to Configure VPN Tunnels As an alternative to IKE, you may use Manual Keying, in which you must specify each phase of the connection. A "Manual" VPN policy requires all settings for the VPN tunnel to be manually input at each end (both VPN endpoints). Click the VPN Policies link of the main menu, and then click the Add Manual Policy radio button to display the Manual Keys menu shown in Figure 7-47.
Reference Manual for the ADSL Modem Wireless Router DG834G General. The DG834G v3 VPN tunnel network connection fields are defined as follows: • Policy Name—enter a unique name to identify this policy. This name is not supplied to the remote VPN endpoint. It is used only to help you manage the policies. • Remote VPN Endpoint—select the desired option (IP address or Fully Qualified Domain Name) and enter the address of the remote VPN endpoint to which you wish to connect.
Reference Manual for the ADSL Modem Wireless Router DG834G • Subnet address—enter an IP address in the "Single/Start IP address" field, and the desired network mask in the "Subnet Mask" field. The remote VPN endpoint must have these IP addresses entered as its "Local" addresses. ESP Configuration. ESP (Encapsulating Security Payload) provides security for the payload (data) sent through the VPN tunnel. SPI—enter the required security policy indexes (SPIs). Each policy must have unique SPIs.
Chapter 8 Troubleshooting This chapter gives information about troubleshooting your 54 Mbps ADSL Modem Wireless Router Model DG834G. After each problem description, instructions are provided to help you diagnose and solve the problem. For the common problems listed, go to the section indicated. • Is the router on? • Have I connected the router correctly? Go to “Basic Functioning” on page 8-1. • I can’t access the router’s configuration with my browser.
Reference Manual for the ADSL Modem Wireless Router DG834G c. The WAN port LED is lit. If a port’s LED is lit, a link has been established to the connected device. If a LAN port is connected to a 100 Mbps device, verify that the port’s LED is green. If the port is 10 Mbps, the LED will be amber. If any of these conditions does not occur, refer to the appropriate following section.
Reference Manual for the ADSL Modem Wireless Router DG834G • Make sure that the Ethernet cable connections are secure at the router and at the hub or workstation. • Make sure that power is turned on to the connected hub or workstation. • Be sure you are using the correct cable: — When connecting the router’s WAN ADSL port, use the cable that was supplied with the DG834G v3.
Reference Manual for the ADSL Modem Wireless Router DG834G If the router does not save changes you have made in the Web Configuration Interface, check the following: • When entering configuration settings, be sure to click the Apply button before moving to another menu or tab, or your changes are lost. • Click the Refresh or Reload button in the Web browser. The changes may have occurred, but the Web browser may be caching the old configuration.
Reference Manual for the ADSL Modem Wireless Router DG834G Internet LED Off If the Internet LED is off, disconnect all telephones on the line. If this solves the problem, reconnect the telephones one at a time, being careful to use a microfilter on each telephone. If the microfilters are connected correctly, you should be able to connect all your telephones.
Reference Manual for the ADSL Modem Wireless Router DG834G • If you have selected a login program, you may have incorrectly set the Service Name, User Name and Password. See “Troubleshooting PPPoE or PPPoA”, below. • Your ISP may check for your computer's host name. Assign the computer Host Name of your ISP account to the modem router in the browserbased Setup Wizard. • Your ISP only allows one Ethernet MAC address to connect to Internet, and may check for your computer’s MAC address.
Reference Manual for the ADSL Modem Wireless Router DG834G Troubleshooting Internet Browsing If your modem router can obtain an IP address but your computer is unable to load any Web pages from the Internet: • Your computer may not recognize any DNS server addresses. A DNS server is a host on the Internet that translates Internet names (such as www addresses) to numeric IP addresses. Typically your ISP will provide the addresses of one or two DNS servers for your use.
Reference Manual for the ADSL Modem Wireless Router DG834G If the path is working, you see this message: Reply from < IP address >: bytes=32 time=NN ms TTL=xxx If the path is not working, you see this message: Request timed out If the path is not functioning correctly, you could have one of the following problems: • Wrong physical connections — Make sure the LAN port LED is on. If the LED is off, follow the instructions in “LAN or Internet Port LEDs Not On” on page 8-2.
Reference Manual for the ADSL Modem Wireless Router DG834G — If your ISP assigned a host name to your PC, enter that host name as the Account Name in the Basic Settings menu. — Your ISP could be rejecting the Ethernet MAC addresses of all but one of your PCs. Many broadband ISPs restrict access by only allowing traffic from the MAC address of your broadband modem, but some ISPs additionally restrict access to the MAC address of a single PC connected to that modem.
Reference Manual for the ADSL Modem Wireless Router DG834G • Date shown is January 1, 2000 Cause: The router has not yet successfully reached a Network Time Server. Check that your Internet access settings are configured correctly. If you have just completed configuring the router, wait at least five minutes and check the date and time again. • Time is off by one hour Cause: The router does not automatically sense Daylight Savings Time.
Appendix A Technical Specifications This appendix provides technical specifications for the 54 Mbps ADSL Modem Wireless Router Model DG834G.
Reference Manual for the ADSL Modem Wireless Router DG834G A-2 Technical Specifications v1.
Appendix B NETGEAR VPN Configuration DG834G v3 to FVL328 This appendix is a case study on how to configure a secure IPSec VPN tunnel from a NETGEAR DG834G v3 to a FVL328. This case study follows the VPN Consortium interoperability profile guidelines (found at http://www.vpnc.org/InteropProfiles/Interop-01.html). Configuration Profile The configuration in this document follows the addressing and configuration mechanics defined by the VPN Consortium.
Reference Manual for the ADSL Modem Wireless Router DG834G 10.5.6.0/24 Gateway A LAN IP 10.5.6.1 172.23.9.0/24 VPNC Example Network Interface Addressing 14.15.16.17 22.23.24.25 WAN IP WAN IP Gateway B LAN IP 172.23.9.1 FVL328 DG834G Figure B-1 Note: Product updates are available on the NETGEAR, Inc. web site at http://kbserver.netgear.com/DG834G v3.asp. Step-By-Step Configuration 1.
Reference Manual for the ADSL Modem Wireless Router DG834G Click VPN Policies under Advanced - VPN to invoke this screen toFVL328 10.5.6.1 172.23.9.1 toFVL328 22.23.24.25 10 5 6 172 23 9 Figure B-2 NETGEAR VPN Configuration B-3 v1.
Reference Manual for the ADSL Modem Wireless Router DG834G 2. Configure the FVL328 as in the Gateway-to-Gateway procedures for the VPN Wizard (see “How to Set Up a Gateway-to-Gateway VPN Configuration” on page 7-21), being certain to use appropriate network addresses for the environment. a. In Step 1, enter toDG834 for the Connection Name b. In Step 2, enter 14.15.16.17 for the remote WAN's IP address c. In Step 3, enter the following: • IP Address = 10.5.6.1 • Subnet Mask = 255.255.255.
Reference Manual for the ADSL Modem Wireless Router DG834G toDG834 toDG834 22.23.24.25 14.15.16.17 Click IKE Policies under VPN to invoke this screen 22.23.24.25 14.15.16.17 toDG834 172.23.9.1 10.5.6.1 Click VPN Policies under VPN to invoke this screen toDG834 toDG834 14.15.16.17 172 23 9 10 5 6 1 Figure B-3 NETGEAR VPN Configuration B-5 v1.
Reference Manual for the ADSL Modem Wireless Router DG834G 3. Test the VPN tunnel by pinging the remote network from a PC attached to the DG834G v3. a. Open the command prompt (Start -> Run -> cmd) b. ping 172.23.9.1 Figure B-4 Note: The pings may fail the first time. If this happens, try the pings a second time.
Reference Manual for the ADSL Modem Wireless Router DG834G Table B-2. Profile Summary VPN Consortium Scenario: Scenario 1 Type of VPN LAN-to-LAN or Gateway-to-Gateway (not PC/Client-to-Gateway) Security Scheme: IKE with Preshared Secret/Key (not Certificate-based) IP Addressing: NETGEAR-Gateway A Fully Qualified Domain Name (FQDN) NETGEAR-Gateway B FDQN 10.5.6.0/24 Gateway A WAN IP LAN IP 10.5.6.1 172.23.9.0/24 VPNC Example Network Interface Addressing WAN IP dg834g.dyndns.
Reference Manual for the ADSL Modem Wireless Router DG834G The Use of a Fully Qualified Domain Name (FQDN) Many ISPs (Internet Service Providers) provide connectivity to their customers using dynamic instead of static IP addressing. This means that a user’s IP address does not remain constant over time which presents a challenge for gateways attempting to establish VPN connectivity.
Reference Manual for the ADSL Modem Wireless Router DG834G 3. On the DG834G v3, configure the Dynamic DNS settings. a. Browse to the Dynamic DNS Setup Screen (see Figure B-6) in the Advanced menu. Figure B-6 b. Configure this screen with appropriate account and hostname settings and then click Apply. • Check the box Use a Dynamic DNS Service. • Host Name = dg834g.dyndns.org • User Name = • Password = c. Click Show Status.
Reference Manual for the ADSL Modem Wireless Router DG834G 4. On the FVL328, configure the Dynamic DNS settings. Assume a properly configured DynDNS account. a. Browse to the Dynamic DNS Setup Screen (see Figure B-8) in the Advanced menu. Figure B-8 b. Select the DynDNS.org radio button (see Figure B-8), configure with appropriate account and hostname settings (see Figure B-9), and then click Apply. • Host and Domain Name = fvl328.dyndns.
Reference Manual for the ADSL Modem Wireless Router DG834G Figure B-9 c. Click Show Status. The resulting screen should show Update OK: good (see Figure B-10). Figure B-10 NETGEAR VPN Configuration B-11 v1.
Reference Manual for the ADSL Modem Wireless Router DG834G 5. Configure the DG834G v3 as in the Gateway-to-Gateway procedures using the VPN Wizard (see “How to Set Up a Gateway-to-Gateway VPN Configuration” on page 7-21), being certain to use appropriate network addresses for the environment. The LAN Addresses used in this example are as follows: Device LAN IP Address LAN Subnet Mask DG834G v3 10.5.6.1 255.255.255.0 FVL328 172.23.6.1 255.255.255.0 a.
Reference Manual for the ADSL Modem Wireless Router DG834G Figure B-11 Note: The pings may fail the first time. If this happens, try the pings a second time. NETGEAR VPN Configuration B-13 v1.
Reference Manual for the ADSL Modem Wireless Router DG834G Configuration Summary (Telecommuter Example) The configuration in this document follows the addressing and configuration mechanics defined by the VPN Consortium. Gather all the necessary information before you begin the configuration process. Verify whether the firmware is up to date, all of the addresses that will be necessary, and all of the parameters that need to be set on both sides. Assure that there are no firewall restrictions. Table B-3.
Reference Manual for the ADSL Modem Wireless Router DG834G • Step 2: Configuring the NETGEAR ProSafe VPN Client on the Remote PC at the Telecommuter’s Home Office configures the NETGEAR ProSafe VPN Client endpoint. Step 1: Configuring the Client-to-Gateway VPN Tunnel on the VPN Router at the Employer’s Main Office Follow this procedure to configure a client-to-gateway VPN tunnel by filling out the VPN Auto Policy screen. 1. Log in to the VPN router at its LAN address of http://192.168.0.
Reference Manual for the ADSL Modem Wireless Router DG834G fromDG834G (in the example) Dynamic IP address IKE Keep Alive is optional; must match Remote LAN IP Address when enabled (remote PC must respond to pings) Subnet address 192.168.0.1 (in this example) 255.255.255.0 Single address 192.168.2.3 (in this example) (Remote NAT router must have Address Reservation set and VPN Passthrough enabled) Main Mode Fully Qualified Domain Name fromDG834G.com (in this example) Fully Qualified Domain Name toDG834G.
Reference Manual for the ADSL Modem Wireless Router DG834G 2. Click Apply when done to get the VPN Policies screen. Figure B-14 To view or modify the tunnel settings, select the radio button next to the tunnel entry and click Edit. NETGEAR VPN Configuration B-17 v1.
Reference Manual for the ADSL Modem Wireless Router DG834G Step 2: Configuring the NETGEAR ProSafe VPN Client on the Remote PC at the Telecommuter’s Home Office This procedure describes how to configure the 54 Mbps ADSL Modem Wireless Router Model DG834G. We will assume the PC running the client has a dynamically assigned IP address. The PC must have a VPN client program installed that supports IPSec (in this case study, the NETGEAR VPN ProSafe Client is used). Go to the NETGEAR website (http://www.
Reference Manual for the ADSL Modem Wireless Router DG834G b. From the Edit menu of the Security Policy Editor, click Add, then Connection. A New Connection listing appears in the list of policies. Rename the New Connection so that it matches the Connection Name you entered in the VPN Settings of the DG834G v3 on Gateway A.
Reference Manual for the ADSL Modem Wireless Router DG834G Figure B-16 c. Select Secure in the Connection Security check-box group. d. Select IP Subnet in the ID Type menu. e. In this example, type 192.168.0.1 in the Subnet field as the network address of the DG834G v3. f. Enter 255.255.255.0 in the Mask field as the LAN Subnet Mask of the DG834G v3. g. Select All in the Protocol menu to allow all traffic through the VPN tunnel. h. Select the Connect using Secure Gateway Tunnel check box. i.
Reference Manual for the ADSL Modem Wireless Router DG834G b. Click on the Security Policy subheading to show the Security Policy menu. Figure B-17 c. Select the Main Mode in the Select Phase 1 Negotiation Mode check box. 4. Configure the VPN Client Identity. In this step, you will provide information about the remote VPN client PC. You will need to provide the Pre-Shared Key that you configured in the DG834G v3 and either a fixed IP address or a “fixed virtual” IP address of the VPN client PC.
Reference Manual for the ADSL Modem Wireless Router DG834G a. In the Network Security Policy list on the left side of the Security Policy Editor window, click My Identity. Figure B-18 b. Choose None in the Select Certificate menu. c. Select Domain Name in the ID Type menu and enter toDG834G.com (in this example) in the box below it. Choose Disabled in the Virtual Adapter menu. d.
Reference Manual for the ADSL Modem Wireless Router DG834G e. Click the Pre-Shared Key button. Figure B-19 f. In the Pre-Shared Key dialog box, click the Enter Key button. Enter the DG834G v3's Pre-Shared Key and click OK. In this example, 12345678 is entered. This field is case sensitive. 5. Configure the VPN Client Authentication Proposal. In this step, you will provide the type of encryption (DES or 3DES) to be used for this connection.
Reference Manual for the ADSL Modem Wireless Router DG834G Figure B-20 c. In the Authentication Method menu, select Pre-Shared key. d. In the Encrypt Alg menu, select the type of encryption. In this example, use Triple DES. e. In the Hash Alg menu, select SHA-1. f. In the SA Life menu, select Unspecified. g. In the Key Group menu, select Diffie-Hellman Group 2. 6. Configure the VPN Client Key Exchange Proposal.
Reference Manual for the ADSL Modem Wireless Router DG834G a. Expand the Key Exchange subheading by double clicking its name or clicking on the “+” symbol. Then select Proposal 1 below Key Exchange. Figure B-21 b. In the SA Life menu, select Unspecified. c. In the Compression menu, select None. d. Check the Encapsulation Protocol (ESP) checkbox. e. In the Encrypt Alg menu, select the type of encryption. In this example, use Triple DES. f. In the Hash Alg menu, select SHA-1. g.
Reference Manual for the ADSL Modem Wireless Router DG834G To check the VPN Connection, you can initiate a request from the remote PC to the VPN router’s network by using the Connect option in the ADSL Modem Wireless Router menu bar (see Figure B-22). Since the remote PC has a dynamically assigned WAN IP address, it must initiate the request. a. Right-click the system tray icon to open the popup menu. b. Select Connect to open the My Connections list. c. Choose toDG834G.
Reference Manual for the ADSL Modem Wireless Router DG834G c. Type ping -t 192.168.0.1, and then click OK. Figure B-23 This will cause a continuous ping to be sent to the VPN router. After between several seconds and two minutes, the ping response should change from timed out to reply. Figure B-24 Once the connection is established, you can open the browser of the PC and enter the LAN IP address of the VPN router.
Reference Manual for the ADSL Modem Wireless Router DG834G Monitoring the VPN Tunnel (Telecommuter Example) Viewing the PC Client’s Connection Monitor and Log Viewer To view information on the progress and status of the VPN client connection, open the 54 Mbps ADSL Modem Wireless Router Model DG834G Log Viewer. 1. To launch this function, click on the Windows Start button, then select Programs, then 54 Mbps ADSL Modem Wireless Router Model DG834G, then Log Viewer.
Reference Manual for the ADSL Modem Wireless Router DG834G While the connection is being established, the Connection Name field in this menu will show SA before the name of the connection. When the connection is successful, the SA will change to the yellow key symbol. Note: While your PC is connected to a remote LAN through a VPN, you might not have normal Internet access. If this is the case, you will need to close the VPN connection in order to have normal Internet access.
Reference Manual for the ADSL Modem Wireless Router DG834G 2. To view the VPN tunnels status, click the VPN Status link on the right side of the main menu. Figure B-27 B-30 NETGEAR VPN Configuration v1.
Reference Manual for the ADSL Modem Wireless Router DG834G NETGEAR VPN Configuration B-31 v1.
Reference Manual for the ADSL Modem Wireless Router DG834G B-32 NETGEAR VPN Configuration v1.
Appendix C Related Documents This appendix provides links to reference documents you can use to gain a more complete understanding of the technologies used in your NETGEAR product. Document Link Internet Networking and TCP/IP Addressing http://documentation.netgear.com/reference/enu/tcpip/index.htm Wireless Communications http://documentation.netgear.com/reference/enu/wireless/index.htm Preparing a Computer for Network Access http://documentation.netgear.com/reference/enu/wsdhcp/index.
Reference Manual for the ADSL Modem Wireless Router DG834G C-2 Related Documents v1.
