VPN |
 |
|
VPN Policies |
The VPN Policies page helps you with managing VPN Tunnels and Policies. The
table lists the policies that have been added and allows several operations on
the policies. |
List of VPN Policies |
Policy fields displayed in the table are: |
! (Status): A policy can be disabled if not in use
and enabled as needed. A policy is disabled if the status light is grey and it
is enabled if the status light is green. Disabling a policy does not delete the
configuration, but merely de-activates the tunnel. |
Name: This is a unique name assigned to the policy.
The name is not used to identify the tunnel to the remote WAN/client, but for
managing the tunnel properties. |
Local: IP address or address range on your local
LAN. Traffic must be from (or to) these addresses to be covered by this policy. |
Remote: IP address or address range of the remote
network. Traffic must be to (or from) these addresses to be covered by this
policy. |
AH: Authentication Header. This column displays the
data integrity algorithm used by the tunnel. |
ESP: Encapsulating Security Payload. This column
displays the encryption algorithm used by this tunnel. |
Action/Edit: Make changes to the selected policy. |
The actions that can be taken on policies are: |
Select All: Select all the policies in the table |
Delete: Delete the selected policy or policies |
Enable: Check the box next to one or more policies
listed in the table and click Enable to enable a policy. |
Disable: Check the box next to one or more policies
listed in the table and click Disable to disable a policy. |
Add: Add a new policy |
Add VPN Policy |
The Add VPN Policy Page is used to add a new VPN policy. |
A policy can be a manual policy or an auto policy: |
v |
Manual: All settings (including the keys) for the VPN tunnel are manually
input for each end point. No 3rd party server or organization is involved. |
v |
Auto: Some parameters for the VPN tunnel are generated automatically. This
requires using the IKE (Internet Key Exchange) protocol to perform negotiations
between the 2 VPN Endpoints. |
|
To create an Auto VPN Policy, you need to first create an IKE policy and then
add the corresponding Auto Policy for that IKE Policy. |
General |
The fields in this section are: |
Policy Name: A unique name for identifying of the policy. |
Policy Type: Policy can be either Manual or Automatic (IKE) |
Local Gateway: The WAN interface that will act as one end of the tunnel |
Remote End Point: The IP address or Internet Name/FQDN of the remote gateway or
client PC. |
Enable NetBIOS: Check this to allow NetBIOS broadcasts to travel over the VPN
tunnel. |
Traffic Selection
Keep alive : |
It periodically sends ping packets to the host on
the peer side of the network to keep the tunnel alive. |
Enable Keep alive : check to enable . |
Ping IP Address : Enter the IP Address to
which ping packets need to be sent. |
Detection period : Router sends ping
packets periodically at regular intervals of time which is specified by
the user. |
Reconnect after failure count : Fresh
negotiation starts when no acknowledgement is received for the specified
number of consecutive packets. |
|
Select the IP addresses on the remote and local side that will be part of the
tunnel. This can be either a single IP address, several IP addresses in a range,
an entire subnet, or any IP address that wants to connect. |
Choose the Local IP type from the drop list: |
Any: Specifies that the policy being created is for traffic from the given end
point (local or remote). Note that selecting ANY for both local and remote end
points is not valid. |
Single: Limit to one host. Requires the IP address of the host that will be part
of the VPN. |
Range: Select it you want to allow computers within an IP address range to
connect to the VPN. Requires
Start IP address and
End IP address. |
Subnet: Requires network address and subnet mask of a subnet. |
Manual Policy Parameters |
The Manual Policy creates an SA (Security Association) based on static inputs: |
SPI-Incoming, SPI-Outgoing: Takes a hexadecimal value between 3 and 8
characters. For example: 0x1234 |
Encryption Algorithm: The algorithm used to encrypt the data |
Integrity Algorithm: Algorithm used to verify the integrity of the data. |
Encryption Key-In: Encryption key of the inbound policy. The length of the key
depends on the algorithm chosen. The length is in characters as follows: |
DES - 8 characters |
3DES - 24 characters |
AES-128 – 16 characters |
AES-192 – 24 characters |
AES-256 – 32 characters |
Encryption Key-Out: Encryption key of the outbound policy. The length of the key
depends on the algorithm chosen. Lengths for the outbound policy encryption key
are the same as for the inbound policy. |
Integrity Key-In: This is the integrity key (for ESP with Integrity-mode) for
the inbound policy and depends on the algorithm chosen: |
MD5 – 16 characters |
SHA-1 – 20 characters |
Integrity Key-Out: This is the integrity key (for ESP with Integrity-mode) for
the outbound policy and depends on the algorithm chosen. Lengths are the same as
mentioned above. |
Manual Policy Example: Creating a VPN tunnel
between two routers |
Router 1: WAN1=10.0.0.1 LAN=192.168.1.1
Subnet=255.255.255.0 |
Policy Name: manualVPN |
Policy Type: Manual Policy |
Local Gateway: WAN1 |
Remote Endpoint: 10.0.0.2 |
Local IP: Subnet 192.168.1.0 255.255.255.0 |
Remote IP: Subnet 192.168.2.0 255.255.255.0 |
SPI-Incoming: 0x1111 |
Encryption Algorithm: DES |
Key-In: 11112222 |
Key-Out: 33334444 |
SPI-Outgoing: 0x2222 |
Integrity Algorithm: MD5 |
Key-In: 1122334444332211 |
Key-Out: 5566778888776655 |
Router 2: WAN1=10.0.0.2 LAN=192.168.2.1
Subnet=255.255.255.0 |
Policy Name: manualVPN |
Policy Type: Manual Policy |
Local Gateway: WAN1 |
Remote Endpoint: 10.0.0.1 |
Local IP: Subnet 192.168.2.0 255.255.255.0 |
Remote IP: Subnet 192.168.2.0 255.255.255.0 |
SPI-Incoming: 0x2222 |
Encryption Algorithm: DES |
Key-In: 33334444 |
Key-Out: 11112222 |
SPI-Outgoing: 0x1111 |
Integrity Algorithm: MD5 |
Key-In: 5566778888776655 |
Key-Out: 1122334444332211 |
Auto Policy Parameters |
The Auto Policy parameters are: |
SA Lifetime: The lifetime of a Security Association can either be
specified in seconds or kilobytes. If
specified as time, it is the interval after which the Security Association
becomes invalid. The SA is renegotiated after this interval. If specified in
kilobytes, the SA is renegotiated after the specified number of kilobytes of
data is transferred over the SA. It is recommended that the lifebyte
specifications be very large numbers or be left blank.
Note: For every policy two SAs are created, one
each for inbound and outbound traffic. When using a lifetime configured in
kilobytes (also known as lifebyte) along with a lifetime in seconds, the SA may
expire asymmetrically. For example the lifebyte for a download stream may expire
frequently if the downstream traffic is very high, but the lifebyte of the
upload stream may not expire so frequently or until it reaches its timeout
period. It is recommended that when setting the lifetime in both, seconds and
kilobytes, the values for both should be reasonably set, so as to reduce the
difference in expiry frequencies of the SAs; otherwise the system may eventually
run out of resources as a result of this asymmetry. The lifebyte specifications
are generally recommended for advanced users only. |
Encryption Algorithm: The algorithm used to encrypt the data |
Integrity Algorithm: Algorithm used to verify the integrity of the data. |
PFS Key Group: Enable Perfect Forward Secrecy (PFS) to improve security. While
this is slower, it will ensure that a Diffie-Hellman exchange is performed for
every phase-2 negotiation. |
Select IKE Policy: Choose the IKE policy that will define the characteristics of
phase-1 of the negotiation. |
Click
Apply to save the settings. |
Click
Reset to revert to the previous settings. |
Edit VPN Policy |
The Edit VPN Policy Page helps in making changes to an existing policy. |
To set the VPN policy to an Auto VPN Policy, you need to first create an IKE
policy and then select the corresponding IKE Policy. |
General |
The fields in this section are: |
Policy Name: A unique name for identifying of the policy. |
Policy Type: Policy can be either Manual or Automatic (IKE) |
Local Gateway: The WAN interface that will act as one end of the tunnel |
Remote End Point: The IP address or Internet Name/FQDN of the remote gateway or
client PC. |
Enable NetBIOS: Check this to allow NetBIOS broadcasts to travel over the VPN
tunnel. |
Traffic Selection
Keep alive : |
It periodically sends ping packets to the host on
the peer side of the network to keep the tunnel alive. |
Enable Keep alive : check to enable . |
Ping IP Address : Enter the IP Address to
which ping packets need to be sent. |
Detection period : Router sends ping
packets periodically at regular intervals of time which is specified by
the user. |
Reconnect after failure count : Fresh
negotiation starts when no acknowledgement is received for the specified
number of consecutive packets. |
|
Select the IP addresses on the remote and local side that will be part of the
tunnel. This can be either a single IP address, several IP addresses in a range,
an entire subnet, or any IP address that wants to connect. |
Choose the Local IP type from the drop list: |
Any: Requires a valid IPv4 address |
Single: Limit to one host. Requires the IP address of the host that will be part
of the VPN. |
Range: Select it you want to allow computers within an IP address range to
connect to the VPN. Requires Start IP address and End IP address. |
Subnet: Requires network address and subnet mask of a subnet. |
Manual Policy Parameters |
The Manual Policy creates an SA (Security Association) based on static inputs: |
SPI-Incoming, SPI-Outgoing: Takes a hexadecimal value between 3 and 8
characters. For example: 0x1234 |
Encryption Algorithm: The algorithm used to encrypt the data |
Integrity Algorithm: Algorithm used to verify the integrity of the data. |
Encryption Key-In: Encryption key of the inbound policy. The length of the key
depends on the algorithm chosen. The length is in characters as follows: |
DES - 8 characters |
3DES - 24 characters |
AES-128 – 16 characters |
AES-192 – 24 characters |
AES-256 – 32 characters |
Encryption Key-Out: Encryption key of the outbound policy. The length of the key
depends on the algorithm chosen. Lengths for the outbound policy encryption key
are the same as for the inbound policy. |
Integrity Key-In: This is the integrity key (for ESP with Integrity-mode) for
the inbound policy and depends on the algorithm chosen: |
MD5 – 16 characters |
SHA-1 – 20 characters |
Integrity Key-Out: This is the integrity key (for ESP with Integrity-mode) for
the outbound policy and depends on the algorithm chosen. Lengths are the same as
mentioned above. |
Auto Policy Parameters |
The Auto Policy parameters are: |
SA Lifetime: The lifetime of a Security Association
can either be specified in seconds or kilobytes. If specified as time, it is the
interval after which the Security Association becomes invalid. The SA is
renegotiated after this interval. If specified in kilobytes, the SA is
renegotiated after the specified number of kilobytes of data is transferred over
the SA. It is recommended that the lifebyte specifications be very large numbers
or be left blank.
Note: For every policy two SAs are created, one
each for inbound and outbound traffic. When using a lifetime configured in
kilobytes (also known as lifebyte) along with a lifetime in seconds, the SA may
expire asymmetrically. For example the lifebyte for a download stream may expire
frequently if the downstream traffic is very high, but the lifebyte of the
upload stream may not expire so frequently or until it reaches its timeout
period. It is recommended that when setting the lifetime in both, seconds and
kilobytes, the values for both should be reasonably set, so as to reduce the
difference in expiry frequencies of the SAs; otherwise the system may eventually
run out of resources as a result of this asymmetry. The lifebyte specifications
are generally recommended for advanced users only. |
Encryption Algorithm: The algorithm used to encrypt the data |
Integrity Algorithm: Algorithm used to verify the integrity of the data. |
PFS Key Group: Enable Perfect Forward Secrecy (PFS) to improve security. While
this is slower, it will ensure that a Diffie-Hellman exchange is performed for
every phase-2 negotiation. |
Select IKE Policy: Choose the IKE policy that will define the characteristics of
phase-1 of the negotiation. |
Click
Apply to save the settings. |
Click
Reset to discard any changes and revert to the previous settings. |
|