VPN |
 |
|
VPN Client |
This page is used to specify configuration for VPN Clients. |
VPN Client |
The VPN Client is disabled by default. To enable it, select
Yes. |
Automatic Association |
The router generates an internal policy dynamically for connecting clients. The
following parameters must be specified for the generating policy: |
Local FQDN: The local domain name ex: local_id.com |
Remote FQDN: The local domain name ex: remote_id.com. Use 0.0.0.0 for anonymous
client connections. |
Encryption Algorithm: The algorithm used to negotiate the SA |
Authentication Algorithm: Specify the authentication algorithm |
Pre-shared key: Enter a simple password like key. The same key must also be
specified with the client |
Diffie-Hellman (DH) Group: The Diffie-Hellman algorithm is used when exchanging
keys. The DH Group sets the algorithm strength in bits. (This setting must match
the settings of the remote VPN.) |
SA-Lifetime (sec): The time after which the SA expires and is negotiated. A
shorter lifetime will improve security, but will add a negotiation delay every
time the SA expires. |
Mode Config |
The router allows specification of IP addresses and other information for
accessing the tunnel via the selection of the Mode Config records. |
Do you want to use Mode Config Record? |
Indicates whether ModeConfig should be
enabled with this policy. |
Select Mode Config Record: This drop-down list shows the specified list of Mode Config records to choose from. This field is required if you opt to specify
ModeConfig record with the policy, i.e., “Yes” to the above question. |
Extended Authentication |
When connecting many VPN clients to a VPN gateway router, XAUTH allows
authentication of users beyond the pre-shared key authentication. Although you
could configure a unique VPN policy for each user, it would be convenient if the
VPN gateway router authenticated users from a stored list of user accounts or
with an external authentication server such as a RADIUS server. |
XAUTH Configuration |
Select None to disable XAuth. |
Select “Edge Device” to use this router as a VPN concentrator where one or more
gateway tunnels terminate. When this option is chosen, you will need to specify
the authentication type to be used in verifying credentials of the remote VPN
gateways. |
Authentication Type: Select the user database which will be used to verify
account information. Select System Database to verify against the router’s user
database. Users must be added thorough the User Database page. To use an
external RADIUS server, select either RADIUS – CHAP or RADIUS – PAP, depending
on the authentication mode accepted by the RADIUS server. |
Note: If RADIUS – PAP is selected, the router will first check in the System
Database to see if the user credentials are available. If the user account is
not present, the router will then connect to the RADIUS server. |
Traffic Tunnel Security Level |
To configure the SA that will be negotiated by the tunnel, configure the
following fields: |
PFS Key Group: Select the PFS group to will be used for the Proposal phase of
building the tunnel. While this is slower, it will ensure that a Diffie-Hellman
exchange is performed for every IKE phase-2 negotiation. |
SA Lifetime: The lifetime of a Security Association can either be specified in
seconds or kilobytes. If specified as time, it is the interval after which the
Security Association becomes invalid. The SA is renegotiated after this
interval. If specified in kilobytes, the SA is renegotiated after the specified
number of kilobytes of data is transferred over the SA. It is recommended that
the lifebyte specifications be very large numbers or be left blank. |
Encryption Algorithm: The algorithm used to encrypt the data. |
Integrity Algorithm: Algorithm used to verify the integrity of the data. |
Click
Apply to save the settings. |
Click
Reset to discard any changes and revert to the previous settings. |
|