Netgear FVS318N User Manual
Virtual Private Networking Using IPSec and L2TP Connections
239
ProSafe Wireless-N 8-Port Gigabit VPN Firewall FVS318N
authenticate users from a stored list of user accounts. XAUTH provides the mechanism for
requesting individual authentication information from the user. A local user database or an
external authentication server, such as a RADIUS server, provides a method for storing the
authentication information centrally in the local network.
requesting individual authentication information from the user. A local user database or an
external authentication server, such as a RADIUS server, provides a method for storing the
authentication information centrally in the local network.
You can enable XAUTH when you manually add or edit an IKE policy. Two types of XAUTH
are available:
are available:
•
Edge Device. The wireless VPN firewall is used as a VPN concentrator on which one or
more gateway tunnels terminate. You need to specify the authentication type that should
be used during verification of the credentials of the remote VPN gateways: the user
database, RADIUS-PAP, or RADIUS-CHAP.
more gateway tunnels terminate. You need to specify the authentication type that should
be used during verification of the credentials of the remote VPN gateways: the user
database, RADIUS-PAP, or RADIUS-CHAP.
•
IPSec Host. Authentication by the remote gateway through a user name and password
that are associated with the IKE policy. The user name and password that are used to
authenticate the wireless VPN firewall need to be specified on the remote gateway.
that are associated with the IKE policy. The user name and password that are used to
authenticate the wireless VPN firewall need to be specified on the remote gateway.
Note:
If a RADIUS-PAP server is enabled for authentication, XAUTH first
checks the local user database for the user credentials. If the user
account is not present, the wireless VPN firewall then connects to a
RADIUS server.
account is not present, the wireless VPN firewall then connects to a
RADIUS server.
Configure XAUTH for VPN Clients
Once the XAUTH has been enabled, you need to establish user accounts in the user
database to be authenticated against XAUTH, or you need to enable a RADIUS-CHAP or
RADIUS-PAP server.
database to be authenticated against XAUTH, or you need to enable a RADIUS-CHAP or
RADIUS-PAP server.
Note:
You cannot modify an existing IKE policy to add XAUTH while the
IKE policy is in use by a VPN policy. The VPN policy needs to be
disabled before you can modify the IKE policy.
disabled before you can modify the IKE policy.
To enable and configure XAUTH:
1.
Select VPN > IPSec VPN. The IPSec VPN submenu tabs display with the IKE Policies
for IPv4 screen in view (see
for IPv4 screen in view (see
2.
Specify the IP version for which you want to edit an IKE policy:
•
IPv4. In the upper right of the screen, the IPv4 radio button is already selected by
default. Go to
default. Go to
.
•
IPv6. Select the IPv6 radio button. The IKE Policies screen for IPv6 displays.
3.
In the List of IKE Policies table, click the Edit table button to the right of the IKE policy for
which you want to enable and configure XAUTH. The Edit IKE Policy screen displays. This
screen shows the same fields as the Add IKE Policy screen (see
which you want to enable and configure XAUTH. The Edit IKE Policy screen displays. This
screen shows the same fields as the Add IKE Policy screen (see