VPN |
 |
|
IKE Policies |
The Internet Key Exchange protocol (IKE) is used to automatically exchange keys
between two IPsec hosts. |
List of IKE Policies |
The List of IKE Policies table contains the following fields that define a
policy: |
Name: A unique name given to the policy for
identification and management purposes. |
Mode: IKE Exchange Mode can be "Main" or
"Aggressive". |
Local ID: The IKE/ISAKMP identity of this device. |
Remote ID: The IKE/ISAKMP identity of the remote
VPN Gateway. |
Encr: Encryption Algorithm used for the IKE SA. |
Auth: Authentication Algorithm used for the IKE SA. |
DH: Diffie-Hellman Group. |
Action/Edit: Edit the parameters of an IKE Policy. |
Select All: Select all the IKE policies. |
Delete: Delete selected IKE policies. |
Add: Create a new IKE policy. |
Note: If the IKE policy is in use by a VPN Policy,
you must disable or delete the VPN policy first and then make changes to the IKE
Policy. |
Add IKE Policy |
To setup an Auto VPN Policy, you first need to create an IKE policy. This page
will assist you with creating an IKE policy. |
Mode Config Record |
Specify whether this IKE policy uses a Mode Config Record (Mode Config Records
can be defined on the Mode Config page under the VPN menu). Select the
Yes radio button if you would like IP
addresses to be assigned to remote VPN Clients. Since Mode Config works only in
Aggressive Mode, enabling this will set the tunnel exchange mode to Aggressive
Mode and disable
Main Mode. Mode Config also requires that both the local and
remote ends be defined by their Internet Names (FQDN) only. |
Selecting
No disables Mode Config for this IKE policy. For more details refer
Extended Authentication section at the bottom of the page. |
General |
Policy Name: A unique name given to the policy for
identification and management purposes. |
Direction/Type:The connection methods for this router can be one of the following: |
v |
Initiator: The router will initiate the connection to the remote end. |
v |
Responder: The router will wait passively and respond to remote IKE requests. |
v |
Both: The router will work in either Initiator or Responder mode. |
|
Exchange Mode: Main Mode negotiates the tunnel with
higher security, but is slower whereas Aggressive Mode establishes a faster
connection but with lowered security.
Note: If either the Local or Remote identifier type (defined below) is not an IP address, then negotiation is only possible in Aggressive Mode. If FQDN, User FQDN or DER ASN1 DN are selected, the router will disable Main Mode and set the default to Aggressive Mode. |
Local |
Identifier Type: The ISAKMP identifier for this
router. It can be one of the following: |
v |
IP Address – WAN IP address of this router. |
v |
Internet Address/FQDN |
v |
User FQDN |
v |
DER ASN1 DN |
|
Identifier: The value of the respective option
chosen in the Identifier Type drop-list for this router. |
Remote |
Identifier Type: The ISAKMP identifier for the
remote device. It can be one of the following: |
v |
IP Address – WAN IP address of the remote machine |
v |
Internet Address/FQDN |
v |
User FQDN |
v |
DER ASN1 DN |
|
Identifier: The value of the respective option
chosen in the Identifier Type drop-list for remote host. |
IKE SA Parameters |
The Security Association (SA) parameters define the strength and the mode for
negotiating the SA. The fields in the SA are: |
Encryption Algorithm: The algorithm used to
negotiate the SA. There are four algorithms supported by this router: DES, 3DES,
AES-128, AES-192, and AES-256. |
Authentication Algorithm: Specify the
authentication algorithm for the VPN header. There are two algorithms supported
by this router: MD5 and SHA-1.
Note: Ensure that the authentication algorithm is configured identically on both
sides. |
Authentication Type: Select Pre-shared Key for a
simple password based key. Selecting RSA-Signature will disable the Pre-shared
key text box and uses the Active Self Certificate uploaded in the Certificates
page. In that case, a certificate must be configured in order for RSA-Signature
to work.
-Please Note: Following character is not supported for Pre-shared Key: " (Double
-Quote).
|
Diffie-Hellman (DH) Group: The Diffie-Hellman
algorithm is used when exchanging keys. The DH Group sets the strength of the
algorithm in bits.
Note: Ensure that the DH Group is configured identically on both sides. |
Dead Peer Detection: Dead Peer Detection is used to detect
whether the Peer is alive or not, If peer is detected as Dead, deletes the IPSec and IKE Security Association.
Detection Period(secs): Detection Period is the interval between consecutive DPD R-U-THERE messages. DPD R-U-THERE
messages are sent only when the IPSec traffic is idle.
Reconnect after failure count: Maximum number of DPD failures allowed before tearing down the connection.
|
Extended Authentication (XAUTH) |
Rather than configuring a unique VPN policy for each user, you can enable the VPN gateway router to authenticate users from a stored list of user accounts or with an external authentication server such as a RADIUS server. When connecting many VPN clients to a VPN gateway router, Extended Authentication (XAUTH)
allows authentication of users with methods in addition to the authentication
method mentioned in the IKE SA parameters. XAUTH can be configured in the
following modes: |
v |
None: This option disables XAUTH. |
v |
Edge Device: Select this option to use this router
as a VPN concentrator where one or more gateway tunnels terminate. The
authentication modes are:
User Database: User accounts created in the router are used to authenticate users (under the VPN Client menu on the User Database page).
RADIUS: The router will connect to a RADIUS server
and pass on the credentials it receives from the VPN Client. The connection
between the router and the RADIUS server can be secured with the authentication
protocol supported by the server (PAP or
CHAP). RADIUS server
settings are configured under the
VPN Client menu on the
RADIUS Client page.
Note: If RADIUS – PAP is selected, the router will
first check in the
User Database to see if the user credentials are
available. If the user account is not present, the router will then connect to
the RADIUS server. |
v |
IPSec Host: The router is authenticated by a remote gateway with a username and password
combination. In this mode, the router acts as a VPN Client of the remote
gateway. |
|
Click
Apply to save the settings. |
Click
Reset to discard any changes. |
|