Virtual PrivateNetworks(VPN) IPsec
IX20 User Guide
483
Required configuration items
n
IPsec tunnel configuration items:
l
Aname for the tunnel.
Note If the tunnel name is more than eight characters, the name will be truncated in the
underlying network interface to the first six characters followed by three digits,
incrementing from 000. Thisaffects any custom scripts or firewall rulesthat may be trying
to adjust the tunnel’s interface or routing table entries.
l
The mode: either tunnel or transport.
l
Enable the IPsec tunnel.
The IPsec tunnel is enabled by default.
l
The firewall zone of the IPsec tunnel.
l
The routing metric for routes associated with this IPsec tunnel.
l
The authentication type and pre-shared key or other applicable keys and certificates.
If SCEPcertificateswill be selected as the Authentication type, create the SCEPclient prior
to configuring the IPsec tunnel. See Configure a Simple Certificate Enrollment Protocol
client for instructions.
l
The local endpoint typeand IDvalues, and the remote endpoint host and IDvalues.
n
IKE configuration items
l
The IKEversion, either IKEv1or IKEv2.
l
Whether to initiate a key exchange or wait for an incoming request.
l
The IKE mode, either main aggressive.
l
The IKEauthentication protocol to use for the IPsec tunnel negotiation during phase 1 and
phase 2.
l
The IKEencryption protocol to use for the IPsec tunnel negotiation during phase 1 and
phase 2.
l
The IKEDiffie-Hellman group to use for the IPsec tunnel negotiation during phase 1 and
phase 2.
n
Enable dead peer detection and configure the delay and timeout.
n
Destination networksthat require source NAT.
n
Activerecovery configuration. See Configure SureLink activerecovery for IPsec for information
about IPsec active recovery.
Additional configuration items
The following additional configuration settings are not typically configured to get an IPsec tunnel
working, but can beconfigured as needed:
n
Determine whether the device should use UDPencapsulation even when it doesnot detect
that NAT is being used.
n
If using IPsec failover, identify the primary tunnel during configuration of the backup tunnel.
n
The Network Address Translation (NAT) keep alive time.
n
The protocol, either Encapsulating Security Payload (ESP) or Authentication Header (AH).
To Next Page
Loading...
Need help?
General