Update to my own message.  After getting past Netgear's level 1   
   support, the Netgear rep tells me the FVM314 and other F-series   
   routers are not designed to use wireless access points in conjunction   
   with VPN.  His recommendation was to purchase an antenna (ANT2409) to   
   extend the range of the router.   
      
   So, if anyone else is thinking about using wireless access points to   
   extend their VPN network, forget about it if you are using Netgear...   
      
   On Wed, 06 Oct 2004 08:54:48 -0700, dont_bother@aol.com wrote:   
      
   >I have Netgear FVM318 IPSec VPN set up so that workstations with   
   >Netgear MA401 wireless card can establish VPN connection when   
   >connected to FVM318.   
   >   
   >My problem: I added WG602 access point to network, and added it as a   
   >trusted connection to the FVM318.  The WAP hands out DHCP from the   
   >router, but I am not able to establish VPN tunnel when the MA401 has   
   >connected via the WG602.   
   >   
   >Question: how do I configure the WG602 so that workstations connected   
   >to the WAP can establish VPN tunnel to the FVM318?   
   >   
   >FVM318 firmware is V1.1 Jan. 29 2003.  WG602 firmware is 3.2rc6.   
   >MA501 firmware is 1.03.06, driver is 1.07.37, config utility is   
   >1.07.37.25.  Workstations are running Windows 2000 with all service   
   >packs & patches.   
   >   
   >Currently WG602 settings are:   
   >Encryption Type  	OFF   
   >Access Control 	Disable   
   >Spanning Tree: enabled   
   >Mode: b only   
   >Data rate: 11Mbs   
   >Security: off   
   >Access control: disabled   
   >Advanced settings are factory default.   
   >Wireless bridging is configured to act as an access point.   
   >   
   >FVM318 settings are:   
   >allow only trusted PCs based on MAC address (I have not added the MAC   
   >for the WG602 -- do I need to?)   
   >IPSec -- Safenet SoftRemote VPN client, with Aggressive Mode and   
   >AES-256 Encryption   
   >   
   >Once VPN tunnel is established I would also like to lock down the WAP   
   >using trusted MAC addresses.  Are there other best practices I should   
   >adopt?   
   >   
   >Thanks,   
   >   
   >Chris   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)