Chapter 6 Basic Virtual Private Networking
This chapter describes how to use the virtual private networking (VPN) features of the FVG318 wireless VPN firewall. VPN communications paths are called tunnels. VPN tunnels provide secure, encrypted communications between your local network and a remote network or computer. The VPN information is organized as follows: Overview of VPN Configuration on page 6-2 provides an overview of the two most common VPN configurations: client-to-gateway and gateway-to-gateway. Planning a VPN on page 6-3 provides the VPN Committee (VPNC) recommended default parameters set by the VPN Wizard. VPN Tunnel Configuration on page 6-5 summarizes the two ways to configure a VPN tunnel: VPN Wizard (recommended for most situations) and Advanced (see Chapter 7, Advanced Virtual Private Networking). How to Set Up a Client-to-Gateway VPN Configuration on page 6-5 provides the steps needed to configure a VPN tunnel between a remote PC and a network gateway using the VPN Wizard and the NETGEAR ProSafe VPN Client. How to Set Up a Gateway-to-Gateway VPN Configuration on page 6-22 provides the steps needed to configure a VPN tunnel between two network gateways using the VPN Wizard. VPN Tunnel Control on page 6-29 provides the step-by-step procedures for activating, verifying, deactivating, and deleting a VPN tunnel once the VPN tunnel has been configured. Chapter 7, Advanced Virtual Private Networking provides the steps needed to configure VPN tunnels when there are special circumstances and the VPNC recommended defaults of the VPN Wizard are inappropriate. Virtual Private Networking (VPN): in Appendix A discusses Virtual Private Networking (VPN) Internet Protocol security (IPSec). IPSec is one of the most complete, secure, and commercially available, standards-based protocols developed for transporting data. Appendix C, VPN Configuration of NETGEAR FVG318 presents a case study on how to configure a secure IPSec VPN tunnel from a NETGEAR FVG318 to a FVL328. This case study follows the VPN Consortium interoperability profile guidelines (found at http://www.vpnc.org/InteropProfiles/Interop-01.html).
Basic Virtual Private Networking v1.0, October 2005
Reference Manual for the ProSafe Wireless 802.11g VPN Firewall Model FVG318
Overview of VPN Configuration
Two common scenarios for configuring VPN tunnels are between a remote personal computer and a network gateway and between two or more network gateways. The FVG318 supports both of these types of VPN configurations. The FVG318 wireless VPN firewall supports up to eight concurrent tunnels.
Client-to-Gateway VPN Tunnels
Client-to-gateway VPN tunnels provide secure access from a remote PC, such as a telecommuter connecting to an office network.

FVS318

24.0.0.1 192.168.3.1

VPN Tunnel

Figure 6-1
A VPN client access allows a remote PC to connect to your network from any location on the Internet. In this case, the remote PC is one tunnel endpoint, running the VPN client software. The FVG318 wireless VPN firewall on your network is the other tunnel endpoint. See How to Set Up a Client-to-Gateway VPN Configuration on page 6-5 to set up this configuration.

6-2 v1.0, October 2005

Basic Virtual Private Networking
Gateway-to-Gateway VPN Tunnels
Gateway-to-gateway VPN tunnels provide secure access between networks, such as a branch or home office and a main office.
VPN Gateway A VPN Gateway B

Figure 6-2

A VPN between two or more NETGEAR VPN-enabled firewalls is a good way to connect branch or home offices and business partners over the Internet. VPN tunnels also enable access to network resources across the Internet. In this case, use FVG318s on each end of the tunnel to form the VPN tunnel end points. See How to Set Up a Gateway-to-Gateway VPN Configuration on page 6-22 to set up this configuration.

Planning a VPN

To set up a VPN connection, you must configure each endpoint with specific identification and connection information describing the other endpoint. You must configure the outbound VPN settings on one end to match the inbound VPN settings on other end, and vice versa. This set of configuration information defines a security association (SA) between the two VPN endpoints. When planning your VPN, you must make a few choices first: Will the local end be any device on the LAN, a portion of the local network (as defined by a subnet or by a range of IP addresses), or a single PC? Will the remote end be any device on the remote LAN, a portion of the remote network (as defined by a subnet or by a range of IP addresses), or a single PC?
Will either endpoint use Fully Qualified Domain Names (FQDNs)? Many DSL accounts are provisioned with DHCP addressing, where the IP address of the WAN port can change from time to time. Under these circumstances, configuring the WAN port with a dynamic DNS (DynDNS) service provider simplifies the configuration task. When DynDNS is configured on the WAN port, configure the VPN using FDQN. FQDNs supplied by Dynamic DNS providers can allow a VPN endpoint with a dynamic IP address to initiate or respond to a tunnel request. Otherwise, the side using a dynamic IP address must always be the initiator. What method will you use to configure your VPN tunnels? The VPN Wizard using VPNC defaults (see Table 6-1) Advanced methods (see Chapter 7, Advanced Virtual Private Networking)
Table 6-1. Parameters recommended by the VPNC and used in the VPN Wizard
Parameter Secure Association Authentication Method Encryption Method Authentication Protocol Diffie-Hellman (DH) Group Key Life IKE Life Time NETBIOS Factory Default Main Mode Pre-shared Key 3DES SHA-1 Group 2 (1024 bit) 8 hours 24 hours Enabled

What level of IPSec VPN encryption will you use? DE The Data Encryption Standard (DES) processes input data that is 64 bits wide, encrypting these values using a 56 bit key. Faster but less secure than 3DES. 3DES (Triple DES) achieves a higher level of security by encrypting the data three times using DES with three different, unrelated keys.
AES What level of authentication will you use? MDS 128 bits, faster but less secure. SHA-bits, slower but more secure.

6-4 v1.0, October 2005

Note: NETGEAR publishes additional interoperability scenarios with various gateway and client software products.

VPN Tunnel Configuration

There are two tunnel configurations and three ways to configure them: Use the VPN Wizard to configure a VPN tunnel (recommended for most situations): See How to Set Up a Client-to-Gateway VPN Configuration on page 6-5. See How to Set Up a Gateway-to-Gateway VPN Configuration on page 6-22. See Chapter 7, Advanced Virtual Private Networking when the VPN Wizard and its VPNC defaults (see Table 6-1 on page 6-4) are not appropriate for your special circumstances.
How to Set Up a Client-to-Gateway VPN Configuration
Setting up a VPN between a remote PC running the NETGEAR ProSafe VPN Client and a network gateway (see figure below) involves the following two steps: Step 1: Configuring the Client-to-Gateway VPN Tunnel on the FVG318 on page 6-6 uses the VPN Wizard to configure the VPN tunnel between the remote PC and network gateway.
Step 2: Configuring the NETGEAR ProSafe VPN Client on the Remote PC on page 6-10 configures the NETGEAR ProSafe VPN Client endpoint.

FVS318v3

PC (Running NETGEAR ProSafe VPN Client)

Figure 6-3

Step 1: Configuring the Client-to-Gateway VPN Tunnel on the FVG318
Note: This section uses the VPN Wizard to set up the VPN tunnel using the VPNC default parameters listed in Table 6-1 on page 6-4. If you have special requirements not covered by these VPNC-recommended parameters, refer to Chapter 7, Advanced Virtual Private Networking to set up the VPN tunnel. Follow this procedure to configure a client-to-gateway VPN tunnel using the VPN Wizard.

6-6 v1.0, October 2005

1. Log in to the FVG318 at its LAN address of http://192.168.1.1 with its default user name of admin and password of password. Click the VPN Wizard link in the main menu to display this screen. Click Next to proceed.

Figure 6-4

2. Fill in the Connection Name and the pre-shared key, select the type of target end point, and click Next to proceed.
Note: The Connection Name is arbitrary and not relevant to how the configuration functions.
Enter the new Connection Name: (RoadWarrior in this example) Enter the pre-shared key: (12345678 in this example)
Select the radio button: A remote VPN client (single PC)

Figure 6-5

The Summary screen below displays.

Figure 6-6

6-8 v1.0, October 2005
To view the VPNC recommended authentication and encryption settings used by the VPN Wizard, click the here link (see Figure 6-6). Click Back to return to the Summary screen.

Figure 6-7

3. Click Done on the Summary screen (see Figure 6-6) to complete the configuration procedure. The VPN Policies menu below displays showing that the new tunnel is enabled.

Figure 6-8

To view or modify the tunnel settings, select the radio button next to the tunnel entry and click Edit.
Step 2: Configuring the NETGEAR ProSafe VPN Client on the Remote PC
This procedure describes how to configure the NETGEAR ProSafe VPN Client. This example assumes the PC running the client has a dynamically assigned IP address. The PC must have the NETGEAR ProSafe VPN Client program installed that supports IPSec. Go to the NETGEAR Web site (http://www.netgear.com) and select VPN01L_VPN05L in the Product Quick Find drop-down menu for information on how to purchase the NETGEAR ProSafe VPN Client.

6-10 v1.0, October 2005

Note: Before installing the NETGEAR ProSafe VPN Client software, be sure to turn off any virus protection or firewall software you may be running on your PC. 1. Install the NETGEAR ProSafe VPN Client on the remote PC and reboot. a. You may need to insert your Windows CD to complete the installation. b. If you do not have a modem or dial-up adapter installed in your PC, you may see the warning message stating The NETGEAR ProSafe VPN Component requires at least one dial-up adapter be installed. You can disregard this message. c. Install the IPSec Component. You may have the option to install either the VPN Adapter or the IPSec Component or both. The VPN Adapter is not necessary. d. The system should show the ProSafe icon ( ) in the system tray after rebooting.

e. Double-click the system tray icon to open the Security Policy Editor. 2. Add a new connection Note: The procedure in this section explains how to create a new security policy from scratch. For the procedure on how to import an existing security policy that has already been created on another client running the NETGEAR ProSafe VPN Client, see Transferring a Security Policy to Another Client on page 6-19. a. Run the NETGEAR ProSafe Security Policy Editor program and create a VPN Connection. b. From the Edit menu of the Security Policy Editor, click Add, then Connection. A New Connection listing appears in the list of policies. Rename the New Connection so that it matches the Connection Name you entered in the VPN Settings of the FVG318 on LAN A. Note: In this example, the Connection Name used on the client side of the VPN tunnel is NETGEAR_VPN_router and it does not have to match the RoadWarrior Connection Name used on the gateway side of the VPN tunnel (see Figure 6-5) because Connection Names are unrelated to how the VPN tunnel functions.
Tip: Choose Connection Names that make sense to the people using and administrating the VPN.

Figure 6-9

Figure 6-10
c. Select Secure in the Connection Security check box. d. Select IP Subnet in the ID Type menu.
6-12 v1.0, October 2005 Basic Virtual Private Networking
In this example, type 192.168.3.1 in the Subnet field as the network address of the FVG318. e. Enter 255.255.255.0 in the Mask field as the LAN Subnet Mask of the FVG318. f. Select All in the Protocol menu to allow all traffic through the VPN tunnel.
g. Select the Connect using Secure Gateway Tunnel check box. h. Select IP Address in the ID Type menu below the check box. i. Enter the public WAN IP Address of the FVG318 in the field directly below the ID Type menu. In this example, 22.23.24.25 would be used. The resulting Connection Settings are shown in Figure 6-10. 3. Configure the Security Policy in the NETGEAR ProSafe VPN Client software. a. In the Network Security Policy list, expand the new connection by double clicking its name or clicking on the + symbol. My Identity and Security Policy subheadings appear below the connection name. b. Click on the Security Policy subheading to show the Security Policy menu.

Figure 6-11

c. Select the Main Mode in the Select Phase 1 Negotiation Mode check box. 4. Configure the VPN Client Identity. In this step, you will provide information about the remote VPN client PC. You will need to provide:
Basic Virtual Private Networking v1.0, October 2005 6-13
The Pre-Shared Key that you configured in the FVG318. Either a fixed IP address or a fixed virtual IP address of the VPN client PC. a. In the Network Security Policy list on the left side of the Security Policy Editor window, click on My Identity.

Figure 6-12

b. Choose None in the Select Certificate box. c. Select IP Address in the ID Type box. If you are using a virtual fixed IP address, enter this address in the Internal Network IP Address box. Otherwise, leave this box empty. d. In the Internet Interface box, select the adapter you use to access the Internet. Select PPP Adapter in the Name menu if you have a dial-up Internet account. Select your Ethernet adapter if you have a dedicated Cable or DSL line. You may also choose Any if you will be switching between adapters or if you have only one adapter.

6-14 v1.0, October 2005

e. Click the Pre-Shared Key button. In the Pre-Shared Key dialog box, click the Enter Key button. Enter the FVG318's Pre-Shared Key and click OK. In this example, 12345678 is entered. This field is case sensitive.

Figure 6-13

5. Configure the VPN Client Authentication Proposal. In this step, you will provide the type of encryption (DES or 3DES) to be used for this connection. This selection must match your selection in the FVG318 configuration. a. In the Network Security Policy list on the left side of the Security Policy Editor window, expand the Security Policy heading by double clicking its name or clicking on the + symbol. b. Expand the Authentication subheading by double clicking its name or clicking on the + symbol. Then select Proposal 1 below Authentication.

Figure 6-14

c. In the Authentication Method menu, select Pre-Shared key. d. In the Encrypt Alg menu, select the type of encryption. In this example, use Triple DES. e. In the Hash Alg menu, select SHA-1. f. In the SA Life menu, select Unspecified.
g. In the Key Group menu, select Diffie-Hellman Group 2. 6. Configure the VPN Client Key Exchange Proposal. In this step, you will provide the type of encryption (DES or 3DES) to be used for this connection. This selection must match your selection in the FVG318 configuration. a. Expand the Key Exchange subheading by double clicking its name or clicking on the + symbol. Then select Proposal 1 below Key Exchange.

Figure 6-15

b. In the SA Life menu, select Unspecified. c. In the Compression menu, select None. d. Check the Encapsulation Protocol (ESP) check box. e. In the Encrypt Alg menu, select the type of encryption. In this example, use Triple DES. f. In the Hash Alg menu, select SHA-1.
g. In the Encapsulation menu, select Tunnel. h. Leave the Authentication Protocol (AH) check box unchecked.

6-16 v1.0, October 2005

7. Save the VPN Client Settings. From the File menu at the top of the Security Policy Editor window, select Save. After you have configured and saved the VPN client information, your PC will automatically open the VPN connection when you attempt to access any IP addresses in the range of the remote VPN firewalls LAN. 1. Check the VPN Connection. To check the VPN Connection, you can initiate a request from the remote PC to the FVG318s network by using the Connect option in the NETGEAR ProSafe menu bar. The NETGEAR ProSafe client will report the results of the attempt to connect. Since the remote PC has a dynamically assigned WAN IP address, it must initiate the request. To perform a ping test using our example, start from the remote PC: a. Establish an Internet connection from the PC. b. On the Windows taskbar, click the Start button, and then click Run. c. Type ping -t 192.168.3.1 , and then click OK.

Figure 6-16

This will cause a continuous ping to be sent to the first FVG318. After between several seconds and two minutes, the ping response should change from timed out to reply.

Figure 6-17

Once the connection is established, you can open the browser of the PC and enter the LAN IP address of the remote FVG318. After a short wait, you should see the login screen of the Wireless VPN Firewall (unless another PC already has the FVG318 management interface open).
Monitoring the Progress and Status of the VPN Client Connection
Information on the progress and status of the VPN client connection can be viewed by opening the NETGEAR ProSafe Log Viewer. 1. To launch this function, click on the Windows Start button, then select Programs, then NETGEAR ProSafe VPN Client, then Log Viewer. The Log Viewer screen for a similar successful connection is shown below:

Figure 6-18

6-18 v1.0, October 2005
Note: Use the active VPN tunnel information and pings to determine whether a failed connection is due to the VPN tunnel or some reason outside the VPN tunnel. 2. The Connection Monitor screen for a similar connection is shown below:

Figure 6-19

In this example you can see the following: The FVG318 has a public IP WAN address of 22.23.24.25. The FVG318 has a LAN IP address of 192.168.3.1. The VPN client PC has a dynamically assigned address of 192.168.2.2. While the connection is being established, the Connection Name field in this menu will say SA before the name of the connection. When the connection is successful, the SA will change to the yellow key symbol shown in the illustration above. Note: While your PC is connected to a remote LAN through a VPN, you might not have normal Internet access. If this is the case, you will need to close the VPN connection in order to have normal Internet access.

Transferring a Security Policy to Another Client
This section explains how to export and import a security policy as an.spd file so that an existing NETGEAR ProSafe VPN Client configuration can be copied to other PCs running the NETGEAR ProSafe VPN Client.
Exporting a Security Policy The following procedure (Figure 6-20) enables you to export a security policy as an.spd file. Step 1: Select Export Security Policy from the File pulldown.
Step 2: Click Export once you decide the name of the file and directory where you want to store the client policy. In this example, the exported policy is named policy.spd and is being stored on the C drive.

Figure 6-20

6-20 v1.0, October 2005
Importing a Security Policy The following procedure (Figure 6-21) enables you to import an existing security policy. Step 1: Invoke the NETGEAR ProSafe VPN Client and select Import Security Policy from the File pulldown. Step 2: Select the security policy to import. In this example, the security policy file is named FVS318v3_clientpolicy_direct.spd and located on the Desktop.
The security policy is now imported. In this example, the connection name is Scenario_1.

Figure 6-21

How to Set Up a Gateway-to-Gateway VPN Configuration
Note: This section uses the VPN Wizard to set up the VPN tunnel using the VPNC default parameters listed in Table 6-1 on page 6-4. If you have special requirements not covered by these VPNC-recommended parameters, refer to Chapter 7, Advanced Virtual Private Networking to set up the VPN tunnel.

FVS318v3 VPN Firewall

Figure 6-22
Follow the procedure below to set the LAN IPs on each FVG318 to different subnets and configure each properly for the Internet. The LAN IP address ranges of each VPN endpoint must be different. The connection will fail if both are using the NETGEAR default address range of 192.168.0.x. In this example, LAN A uses 192.168.0.1 and LAN B uses 192.168.3.1.
Procedure to Configure a Gateway-to-Gateway VPN Tunnel
Follow this procedure to configure a gateway-to-gateway VPN tunnel using the VPN Wizard.

6-22 v1.0, October 2005

1. Log in to the FVG318 on LAN A at its default LAN address of http://192.168.0.1 with its default user name of admin and password of password. Click the VPN Wizard link in the main menu to display this screen. Click Next to proceed.

Figure 6-23

Enter the new Connection Name: (GtoG in this example) Enter the pre-shared key: (12345678 in this example)
Select the radio button: A remote VPN Gateway

Figure 6-24

3. Fill in the IP Address or FQDN for the target VPN endpoint WAN connection and click Next.
Enter the WAN IP address of the remote VPN gateway: (22.23.24.25 in this example)

Figure 6-25

4. Identify the IP addresses at the target endpoint that can use this tunnel, and click Next.
Enter the LAN IP settings of the remote VPN gateway: IP Address (192.168.3.1 in this example) Subnet Mask (255.255.255.0 in this example)

Figure 6-26

6-24 v1.0, October 2005

Figure 6-27

To view the VPNC recommended authentication and encryption settings used by the VPN Wizard, click the here link (see Figure 6-27). Click Back to return to the Summary screen.

Figure 6-28

6-26 v1.0, October 2005
5. Click Done on the Summary screen (see Figure 6-27) to complete the configuration procedure. The VPN Policies menu below displays showing that the new tunnel is enabled.

Figure 6-29

6. Repeat for the FVG318 on LAN B. Pay special attention and use the following network settings as appropriate. WAN IP of the remote VPN gateway (e.g., 14.15.16.17) LAN IP settings of the remote VPN gateway: IP Address (e.g, 192.168.0.1) Subnet Mask (e.g., 255.255.255.0) Preshared Key (e.g., 12345678)
7. Use the VPN Status screen to activate the VPN tunnel by performing the following steps: Note: The VPN Status screen is only one of three ways to active a VPN tunnel. See Activating a VPN Tunnel on page 6-29 for information on the other ways. a. Open the FVG318 management interface and click on VPN Status under VPN to get the VPN Status/Log screen shown below.

Figure 6-30

b. Click on VPN Status (in Figure 6-30) to get the IPSec Connection Status screen (Figure 6-31). Click on Connect for the VPN tunnel you want to activate.

Figure 6-31

c. Look at the VPN Status/Log screen (Figure 6-30) to verify that the tunnel is connected.
6-28 v1.0, October 2005 Basic Virtual Private Networking

VPN Tunnel Control

Activating a VPN Tunnel
There are three ways to activate a VPN tunnel: Start using the VPN tunnel. Use the VPN Status page. Activate the VPN tunnel by pinging the remote endpoint. Start Using a VPN Tunnel to Activate It To use a VPN tunnel, use a Web browser to go to a URL whose IP address or range is covered by the policy for that VPN tunnel. Using the VPN Status Page to Activate a VPN Tunnel To use the VPN Status screen to activate a VPN tunnel, perform the following steps: 1. Log in to the Wireless VPN Firewall. 2. Open the FVG318 management interface and click on VPN Status under VPN to get the VPN Status/Log screen shown below.

Figure 6-32 Basic Virtual Private Networking v1.0, October 2005 6-29
3. Click VPN Status (Figure 6-32) to get the IPSec Connection Status screen (Figure 6-33). Click Connect for the VPN tunnel you want to activate.

Figure 6-33

Activate the VPN Tunnel by Pinging the Remote Endpoint
Note: This section uses 192.168.3.1 for an example remote endpoint LAN IP address.
To activate the VPN tunnel by pinging the remote endpoint (192.168.3.1), do the following steps depending on whether your configuration is client-to-gateway or gateway-to-gateway: Client-to-Gateway Configurationto check the VPN Connection, you can initiate a request from the remote PC to the FVG318s network by using the Connect option in the NETGEAR ProSafe menu bar. The NETGEAR ProSafe client will report the results of the attempt to connect. Since the remote PC has a dynamically assigned WAN IP address, it must initiate the request. To perform a ping test using our example, start from the remote PC: a. Establish an Internet connection from the PC. b. On the Windows taskbar, click the Start button, and then click Run.

6-30 v1.0, October 2005

c. Type ping -t 192.168.3.1 and then click OK.

Figure 6-34

This will cause a continuous ping to be sent to the first FVG318. Within two minutes, the ping response should change from timed out to reply.
Note: Use Ctrl-C to stop the pinging.

Figure 6-35

Once the connection is established, you can open the browser of the PC and enter the LAN IP address of the remote FVG318. After a short wait, you should see the login screen of the Wireless VPN Firewall (unless another PC already has the FVG318 management interface open). Gateway-to-Gateway Configurationtest the VPN tunnel by pinging the remote network from a PC attached to the FVG318. a. Open a command prompt (Start -> Run -> cmd).
b. Type ping 192.168.3.1.

Figure 6-36

Note: The pings may fail the first time. If so, then try the pings a second time.
Verifying the Status of a VPN Tunnel
To use the VPN Status page to determine the status of a VPN tunnel, perform the following steps: 1. Log in to the Wireless VPN Firewall. 2. Open the FVG318 management interface and click VPN Status under VPN to get the VPN Status/Log screen shown below.

Figure 6-37

6-32 v1.0, October 2005
Logthis log shows the details of recent VPN activity, including the building of the VPN tunnel. If there is a problem with the VPN tunnel, refer to the log for information about what might be the cause of the problem. Click Refresh to see the most recent entries. Click Clear Log to delete all log entries.
3. Click VPN Status (Figure 6-37) to get the IPSec Connection Status screen (Figure 6-38).

Figure 6-38

This page lists the following data for each active VPN Tunnel. SPIeach SA has a unique SPI (Security Parameter Index) for traffic in each direction. For Manual key exchange, the SPI is specified in the Policy definition. For Automatic key exchange, the SPI is generated by the IKE protocol. Policy Namethe name of the VPN policy associated with this SA. Remote Endpointthe IP address on the remote VPN Endpoint. Actionthe action will be either a Drop or a Connect button. SLifeTime (Secs)the remaining Soft Lifetime for this SA in seconds. When the Soft Lifetime becomes zero, the SA (Security Association) will re-negotiated. HLifeTime (Secs)the remaining Hard Lifetime for this SA in seconds. When the Hard Lifetime becomes zero, the SA (Security Association) will be terminated. (It will be reestablished if required.)
Deactivating a VPN Tunnel
Sometimes a VPN tunnel must be deactivated for testing purposes. There are two ways to deactivate a VPN tunnel: Policy table on VPN Policies page
Basic Virtual Private Networking v1.0, October 2005 6-33

VPN Status page

Using the Policy Table on the VPN Policies Page to Deactivate a VPN Tunnel To use the VPN Policies page to deactivate a VPN tunnel, perform the following steps: 1. Log in to the Wireless VPN Firewall. 2. Click on VPN Policies under VPN to get the VPN Policies screen shown below.

Figure 6-39

3. Clear the Enable check box for the VPN tunnel you want to deactivate and click Apply. (To reactivate the tunnel, check the Enable box and click Apply.) Using the VPN Status Page to Deactivate a VPN Tunnel To use the VPN Status page to deactivate a VPN tunnel, perform the following steps: 1. Log in to the Wireless VPN Firewall.

6-34 v1.0, October 2005

2. Click VPN Status under VPN to get the VPN Status/Log screen shown below.

Figure 6-40

3. Click VPN Status (Figure 6-40) to get the IPSEC Connection Status screen (Figure 6-41). Click Drop for the VPN tunnel you want to deactivate.

Figure 6-41

Note: When NETBIOS is enabled (which it is in the VPNC defaults implemented by the VPN Wizard), automatic traffic will reactivate the tunnel. To prevent reactivation from happening, either disable NETBIOS or disable the policy for the tunnel (see Using the Policy Table on the VPN Policies Page to Deactivate a VPN Tunnel on page 6-34).

Deleting a VPN Tunnel

To delete a VPN tunnel: 1. Log in to the Wireless VPN Firewall. 2. Click VPN Policies under VPN to display the VPN Policies screen shown below. Select the radio button for the VPN tunnel to be deleted and click the Delete button.

Figure 6-42

6-36 v1.0, October 2005