Netgroup VPN Form

VPN Policy

Parties’ VPN devices must support IKEv1 or IKEv2 IPSEC VPNs.

Business purpose of VPN connection

Contact Details

Party A (requestor) contact
Name	Rasmus Rask
Organisation	Kreditregisteret ApS
Email address	rpr@kreditregisteret.dk
Mobile number	+45 28145812

Party B technical contact
Name
Organisation
Email address
Mobile number

Netgroup A/S technical contact
Name	Hroi Sigurdsson
Email address	hs@netgroup.dk
Mobile number	+45 2845 5597

VPN Parameters

The tables below represent Netgroup’s minimum recommended VPN settings. Adjust to match required security level.

Party A	Party B
VPN gateway IP address	77.66.18.209
VPN gateway vendor/model	Cisco ASA

Encryption domain (Proxy IDs)
Party A addresses/subnets	Party B addresses/subnets
77.66.20.224/32

IKE version used (1, 2)	1

IKE parameters	IKEv1	IKEv2
Authentication method	Pre-shared key	Pre-shared keys
Integrity Algorithm	SHA1	SHA256
Encryption Algorithm	AES128-CBC	AES128-CBC
Diffie-Hellman Group	5	14
Pseudorandom Function	SHA256
Security Association lifetime	28800 seconds (8 hours)	28800 seconds (8 hours)

IPSEC parameters	IKEv1	IKEv2
Mode	ESP	ESP
Encryption Algorithm	AES128-CBC	AES128-GCM
Integrity Algorithm	SHA1	NONE
PFS Diffie-Hellman Group	5	14
Security Association lifetime	3600 seconds (1 hour)	3600 seconds (1 hour)

Key exchange

Pre-shared key exchange between parties
Keying material exchanged through (PGP, S/MIME, SMS, voice, other)	SMS
Keys are provided by	Netgroup

Keys should be randomly generated and contain at least enough entropy to match the IKE/IPSEC security level (128-256 bits).

Preferred method of key generation on Unix:

openssl rand -base64 32

Preferred method key generation on Windows using Powershell:

$RandomBytes = New-Object Byte[](32)

[Security.Cryptography.RNGCryptoServiceProvider]::Create().GetBytes($RandomBytes)

[Convert]::ToBase64String($RandomBytes)

Firewall settings

Please specify which services on Party A’s side Party B is allowed to access.

Access rules
Party B source addresses	Party A destination addresses	Protocols/services permitted
any

Additional comments