D-Link NetDefend VPN Client (DS-601/605)
A quick installation guide to setting up the D-Link NetDefend VPN Client in a VPNC scenario
These scenarios were developed by the VPN Consortium
Scenario 1. Client-to-Gateway using pre-shared secrets Typical client-to-gateway VPN using a preshared secret for authentication. Description how to configure the NCP Secure Entry Client for Windows.
Document version 1.00 Using D-Link NetDefend Client v1.0
Prepared by: NCP Engineering GmbH Dombuehler Strasse 2, 90449 Nrnberg, Germany Phone: +49-911-99.68.0 Fax: +49-911-99.68.299

Disclaimer

Considerable care has been taken in the preparation of this quick guide, errors in content, typographical or otherwise may occur. If you have any comments or recommendations concerning the accuracy, then please contact NCP as desired. NCP makes no representations or warranties with respect to the contents or use of this quick guide, and explicitly disclaims all expressed or implied warranties of merchantability or use for any particular purpose. Furthermore, NCP reserves the right to revise this publication and to make amendments to the content, at any time, without obligation to notify any person or entity of such revisions and changes.

Copyright

This quick guide is the sole property of NCP and may not be copied for resale, commercial distribution or translated to another language without the express written permission of NCP engineering GmbH, Dombhler Str.2, D-90449 Nrnberg, Germany.

Trademarks

All trademarks or registered trademarks appearing in this manual belong to their respective owners.
2004 NCP Engineering GmbH. All rights reserved. Version 0.90 Page 2 of 15 06.Sep.04
1. Scenario 1: Client-to-gateway with pre-shared secrets

1.1 Scenario Setup

The following is a typical client-to-gateway VPN that uses a preshared secret for authentication. 172.23.9.0/24 | |-+-----------+ /-^-^-^-^--\ +-----------+ | | Client A |=====| Internet |=====| Gateway B |-----| +-----------+AW \--v-v-v-v-/ BW+-----------+BL | Dynamically assigned 22.23.24.25 172.23.9.1 |-| Figure 1.1.1: Scenario Client A's WAN interface (AW) has the address dynamically assigned to it by the ISP. Client A will access Gateway B's internal LAN, by means of a secure tunnel. Gateway B connects the internal LAN 172.23.9.0/24 to the Internet. Gateway B's WAN (Internet) interface has the address 22.23.24.25. Gateway B's LAN interface address, 172.23.9.1, can be used for testing IPsec but is not needed for configuring Client A. The IKE Phase 1 parameters used in Scenario 1 are: Main mode TripleDES SHA-1 MODP group 2 (1024 bits) pre-shared secret of "hr5xb84l6aa9r6" SA lifetime of 28800 seconds (eight hours) with no kbytes rekeying The IKE Phase 2 parameters used in Scenario 1 are: TripleDES SHA-1 ESP tunnel mode MODP group 2 (1024 bits) Perfect forward secrecy for rekeying SA lifetime of 3600 seconds (one hour) with no kbytes rekeying Selectors for all IP protocols, all ports, between the client and 172.23.9.0/24, using IPv4 subnets
1.2 Using the Configuration Assistant
Figure 1.2.1: Configuration Assistant The first time you start up the D-Link VPN Client you may be prompted to create a profile if one doesn't already exist. You can either use the assistant as outlined in section 1.2, or modify an existing profile as in section 1.3.

Version 0.90

Page 3 of 15

06.Sep.04

Figure 1.2.2: Configuration Assistant: Connection Name Several profiles can be created and each given different name. In this example, this profile is created and given the name Gateway B with Pre-Shared Key. Click Next >.
figure 1.2.3: Configuration Assistant: Link type (Dial up configuration) The VPN Client supports different media types; the integrated dialer for example, can be used to establish a connection to the ISP with a modem (if available to the system) prior to building the VPN Tunnel. In this example, select LAN (over IP). Click Next >. Version 0.90 Page 4 of 15 06.Sep.04
figure 1.2.4: Configuration Assistant: VPN gateway parameters Enter in the gateway's IP address or DNS name. Click Next >.
figure 1.2.5: Configuration Assistant: Pre-shared keys In this example, a pre-shared key or shared secret is used, identical passwords on the IPSec communicating peers. Enter in the given hr5xb84l6aa9r6 (see section 1.1) and confirm this to ensure that it is correctly entered in. The Finish button will not be available until the values have been correctly entered in and match. Version 0.90 Page 5 of 15 06.Sep.04

1.3 Checking/Modifying the Configuration
figure 1.3.1: Configuration -> Profile Settings Open the Profile Settings to modify the parameters to define the specific IKE and IPSec proposals as specified in section 1.1.
figure 1.3.2: Profile Settings Either double click on the profile that is going to be modified, or select the profile and then click on Configure.

Page 6 of 15

figure 1.3.3: Profile Settings: General Review the parameters and ensure they are correct. Select IPSec General Settings to continue
figure 1.3.4: Profile Settings: IPSec General Settings: Policy Lifetimes When automatic mode is selected for both the IKE (Phase 1) and IPSec (Phase 2) Policies, the client will transmit a range of different commonly used proposals and the VPN Gateway can then select one to use for the connection. However, in this example, (although automatic mode works) both the IKE and IPSec policies will be manually defined in accordance to section 1.1; so select Policy lifetimes

Page 7 of 15

figure 1.3.5: Policy Lifetimes The duration for the IKE Policy (SA lifetime) has been set to 8 hours (28800 seconds), and the IPSec Policy (SA) lifetime is limited to 1 hour (3600 seconds). Click OK to return to define the Proposals
figure 1.3.6: Profile Settings: IPSec General Settings: Policy Editor Select the Policy Editor to define specific proposals to be used in this connection as lined out in section 1.1.

Page 8 of 15

figure 1.3.7: Proposal Definitions: IKE Policy First select IKE Policy and click on New Entry to define a new IKE Policy (Phase 1 parameters) to be used.
figure 1.3.8: Defining an IKE Policy Simply select the parameters for this proposal. Several proposals may be grouped together under the name, but for the purpose of this example, only one proposal is defined. Select Preshared Key for the IKE mode, Triple DES (168bit 3DES) for the encryption algorithm to be used, SHA (160bit SHA-1) for the authentication algorithm, and finally DH-Group 2 (1024 Bit) for the key exchange protocol. Click OK to return to the previous dialog box.

Page 9 of 15

figure 1.3.9: Proposal Definitions: IPSec Policy In the same way, select IPSec Policy and click on New Entry to define the IPSec proposal (Phase 2 parameters).
figure 1.3.10: Defining an IPSec Policy Simply select the parameters for this policy: ESP tunnel mode, Triple DES (168bit 3DES-CBC) for encryption algorithm and SHA (SHA-Bit) for the authentication code/hash algorithm. Click OK to continue

Page 10 of 15

figure 1.3.11: IPSec/IKE (ISAKMP) parameters defined Click on Close to save the proposals created, and return to the Profile Settings | IPSec General Settings dialog box.
figure 1.3.12: Profile Settings: IPSec General Settings Select the newly defined IKE- (ISAKMP) and IPSec Policies, and click on Identities to move to the next dialog box.

Page 11 of 15

figure 1.3.13: Profile Settings: Identities In this scenario, the Gateway will not know what the IP Address is going to be, so the value is left blank. Other IKE-ID types can be used, but are beyond the scope of this document; please refer to the manual for more details. Click on IP Address Assignment to continue
figure 1.3.14: Profile Settings: IP Address Assignment In this example, the client is known to the VPN Gateway by a virtual IP address which has to be manually entered into the client. Click on Remote Networks to move to the next dialog box.

Page 12 of 15

figure 1.3.15: Profile Settings: Remote Networks Enter in the Network address(es) (depending on the subnet masks defined, these can be individual hosts or network segments) that are to be reached. This is used in the Phase 2 negotiation and often the cause for configuration mistakes. In this scenario, Gateway B's LAN segment, 172.23.9.0/24 (or netmask 255.255.255.0) is to be reached, so that can be defined here. Select the Firewall Settings to continue
figure 1.3.16: Profile Settings: Firewall Settings Click on OK to return to the main Profile Settings dialog box.

Page 13 of 15

figure 1.3.17: Profile Settings Select OK to return to the monitor (the graphical user interface of the VPN Client)

Page 14 of 15

1.4 Establishing the connection
figure 1.4.1: D-Link VPN Client Monitor Seeing as the connection is set to be established manually, click on Connect to create the tunnel. Then open a dos box, and ping the internal network interface of the VPN Gateway to confirm the connection has been successfully established. Depending on the VPN Gateway's configuration other hosts on the Gateway B's internal LAN can be reached.

figure 1.4.2: Command Prompt: Ping response

Page 15 of 15

D-Link And TheGreenBow Solution
DFL-800 Netdefend IPS/UTM Firewall Application Note

Version 2.00 (2009-5-28)

D-Link International Confidential and proprietary

Revision History

2009-4-24

Description

Editor

2009-5-28

Interoperability Compliance Testing Negotiate mode for Phase1 and Phase2 using TheGreenBow VPN Client John Yoong software and D-Link products DFL-800. Added the function VPN User Authentication using TheGreenBow VPN Client software (X-Auth) and DFL- 800 John Yoong (External Radius Server) and changed the network diagram.

1. Introduction

The objective of this document is to provide a guide describing how to configure the devices to achieve the same environment as show at the network topology. Users of this document are expected to already possess basic knowledge of D-Link devices and TheGreenBow VPN software, and are familiar with how to perform basic configurations. Only important configurations, such as those pertaining to interfacing and integrating, will be described in this document. For purpose of reference, configuration files for each device are available for download.

2. Audience

This document is intended for project engineers or end users that need to implement DFL series and TheGreenBow software at the sites.

3. Objective

This topology consist the scenarios that integrates using TheGreenBow VPN program and D-Link Firewall and demonstrate integrations and network solutions to OBUs, and in addition, to Partners and Customers from D-Link International.
4. List of Equipment and Software
The table below shows the devices information.
Device No. 3 Device Name TheGreenBow VPN Client Software Netdefend IPS Firewall WinRadius Radius Server Device Model DFL-800 Firmware 4.6x 2.20.03.08-8257 4.00

5. Network Diagram

Note: Router is set to allow IPSec pass through.

6. Configurations

In this document, we will only describe the main configurations for this Scenario. The configurations setting for all the D-Link products will not be described here and for more detail about the product you can download their user guide.
1) TheGreenBow VPN Client (IPSec) and D-Link Security Solutions (VPN Client DFL-800) TheGreenBow VPN Client (XAuth) and D-Link Security Solutions (VPN Client DFL-800 Radius Server)
TheGreenBow VPN Client (IPSec) and D-Link Security Solutions (VPN Client DFL-800)
In this scenario the user can connect back to the headquarter database by using TheGreenBow VPN Client connection to DFL-800. All configurations are based on DFL-800 (F/W: 2.20.03.08-8257) and TheGreenBow VPN Client (F/W: 4.60.0.0)
The steps in this configuration are: Setup DFL-800 for VPN tunneling Setup Pre-shared Key Phase 1 and Phase 2 algorithms setup Setting up IPSec-Tunnel Setup IP Rules Setup TheGreenBow VPN Client software Setup Phase 1 Setup Phase 2
6.1.1) Setup DFL-800 for VPN tunneling

6.1.1.1) 1)

Setup Pre-Shared Key
Login to the DFL-800 and click Authenticate Objects and add a new Pre-shared Key and fill in the passphrase and name.

6.1.1.2)

Phase 1 and Phase 2 algorithms setup
At the IKE Algorithms, select the Encryption and Integrity algorithms for your phase 1 authenticate.
Next is the IPSec Algorithms, select the Encryption and Integrity algorithms for the Phase 2.

6.1.1.3)

Setting up IPSec-Tunnel
After we finish setting up the algorithms, next we will need to create the IPSec-Tunnel as show below.
Next, click on the Authentication tab and select the PreShared Key you have setup at the steps 1.
After selecting the Pre-Shared Key, next is to enable the Dynamically add route at the routing tab.
Last step is to make sure the DH Group at the IKE setting is the same setting for the TheGreenBow VPN Client software.

6.1.1.4)

Setup IP Rules
Now is to setup the IP Rules so there the DFL-800 knows where to direct all the traffic to.
First add a new interface group name IPSec-LAN by grouping up IPSec-Tunnel and LAN.
Next, click IP Rules and add a new IP rule as show below.
6.1.2) Setup TheGreenBow VPN Client Software

6.1.2.1)

Setup Phase 1
Right click on the Root to add a new Phase1, next fill in the IP address for this VPN client and Remote gateway IP follow by Preshared Key and IKE setting.
Note: the Preshared Key and IKE must be the same setting set in the DFL-800.

6.1.2.2)

Setup Phase 2
Right click on the Phase1 to add a new Phase2, next fill in the VPN Client address for this VPN client and Remote gateway IP follow by ESP setting.
Note: the ESP Encryption and Authentication setting must be the same in the DFL-800 IPSec-Tunnel.
6.2 TheGreenBow VPN Client Software (X-Auth) and D-Link security solutions (VPN Client DFL-800)
In this scenario the client will be authenticate (X-Auth) before the user can connect back to the headquarter database by using TheGreenBow VPN Client connection to DFL-800 authenticate by External Authentication (Radius Server). All configurations are based on DFL-800 (F/W: 2.20.03.08-8257), TheGreenBow VPN Client (F/W: 4.60.0.0) and WinRadius (Version 4.00)
Note: Before configuration this solution, please make sure that your DFL-800 and VPN Client had the IPSec setting configured. Please refer to (6.1 - TheGreenBow VPN Client software (IPSec) DFL-800)) and D-Link Security Solutions (VPN Client
The steps in this configuration are: Setup DFL-800 for X-Auth Enable the X-Auth in DFL-800 Setup the External Authentication Server Setup TheGreenBow VPN Client software Enable the X-Auth Function Setup WinRadius Server Set the Secret Key

6.2.1) Setup DFL-800 for X-Auth

6.2.1.1) 1)

Enable the X-Auth in DFL-800
At the Interfaces IPSec, select the IPSec tunnel you have created in the previous solution and at the XAuth tab, enable the function as show below.

6.2.1.2) 1)

Setup the External Authentication Server (i.e. Radius)
Add the IP Address for the Radius Server in the Address Book.
Select the User Authentication External User Database and add a new Radius Server with the setting as show below.
Note: the Shared Secret must be the same key in the Radius Server.
Next, add a New Rule in the User Authentication Rules.
At the Authentication Options, select the Radius Server you have created and select the Radius Method as CHAP.
Save and activate the setting.
6.2.2) Setup TheGreenBow VPN Client software
6.2.2.1) Enable the X-Auth Function
Inside the P1 Advanced menu, tick the box for the X-Auth Popup.
Click Ok and Save &Apply the setting.
6.2.3) Setup WinRadius Server
6.2.3.1) 1) Set the Secret Key Click the System from the Setting drop down list

Key in the NAS Secret.

Note: The NAS Secret must be the same key set in the DFL-800 Shared Key.
Click OK, close and start the WinRadius Server again.
7. Interoperability Compliance Testing
7.1) General Test Approach
a. Open the VPN tunnel using different Negotiate Mode in phase 1 and phase 2:
Series Negotiate Mode Phase 1 AES-SHA AES-MD5 3DES-MD5 3DES-SHA DES-MD5 DES-SHA AES-SHA AES-MD5 3DES-MD5 3DES-SHA DES-MD5 DES-SHA AES-SHA AES-MD5 3DES-MD5 3DES-SHA DES-MD5 DES-SHA AES-SHA AES-MD5 3DES-MD5 3DES-SHA DES-MD5 DES-SHA AES-SHA AES-MD5 3DES-MD5 Phase 2 AES-SHA AES-SHA AES-SHA AES-SHA AES-SHA AES-SHA AES-MD5 AES-MD5 AES-MD5 AES-MD5 AES-MD5 AES-MD5 3DES-SHA 3DES-SHA 3DES-SHA 3DES-SHA 3DES-SHA 3DES-SHA 3DES-MD5 3DES-MD5 3DES-MD5 3DES-MD5 3DES-MD5 3DES-MD5 DES-SHA DES-SHA DES-SHA
Series Negotiate Mode Phase 1 3DES-SHA DES-MD5 DES-SHA AES-SHA AES-MD5 3DES-MD5 3DES-SHA DES-MD5 DES-SHA Phase 2 DES-SHA DES-SHA DES-SHA DES-MD5 DES-MD5 DES-MD5 DES-MD5 DES-MD5 DES-MD5
Create users in the WinRadius and during the X-Auth popup, key in the users ID and Password from the WinRadius.

Test Result a.

The VPN tunnel will be open at any negotiate mode set in Phase 1 and Phase 2.
TheGreenBow VPN Client software
The DFL-800 will show the tunnel is up at their VPN status.

DFL-800 IPSec

Client is able to Ping to the remote network.
For the X-Auth, when the valid users are enter in the X-Auth popup. The Radius Server will show Users Authentication OK and open up the VPN tunnel.

8. Conclusion

The Application Notes demonstrate how D-Link VPN products and TheGreenBow VPN software combined perfectly address the requirements of the small and medium businesses worldwide. The joint VPN solution offer advantages around multiple access control and authorization mechanisms for users and tunneling capabilities to access the entire corporate network; it can also provide different access rights to different users.
D-Link Inc. All Rights Reserved
D-Link is the worldwide leader and an award-winning designer, developer, and manufacturer of Wi-Fi and Ethernet networking, broadband, multimedia, voice and data communications and digital electronics solutions.