Chapter 13 VPN
P-79X Series User’s Guide
145
Figure 85 VPN Host using Intranet DNS Server Example
If you do not specify an Intranet DNS server on the remote network, then the VPN host must use IP
addresses to access the computers on the remote network.
13.6.9 ID Type and Content
With aggressive negotiation mode (seeSection 13.6.6 on page 144), the P-79X identifies incoming
SAs by ID type and content since this identifying information is not encrypted. This enables the P-
79X to distinguish between multiple rules for SAs that connect from remote IPSec routers that have
dynamic WAN IP addresses. Telecommuters can use separate passwords to simultaneously connect
to the P-79X from IPSec routers with dynamic IP addresses (seeSection 13.6.12 on page 147 for a
telecommuter configuration example).
Regardless of the ID type and content configuration, the P-79X does not allow you to save multiple
active rules with overlapping local and remote IP addresses.
With main mode (seeSection 13.6.6 on page 144), the ID type and content are encrypted to
provide identity protection. In this case the P-79X can only distinguish between up to 12 different
incoming SAs that connect from remote IPSec routers that have dynamic WAN IP addresses. The P-
79X can distinguish up to 12 incoming SAs because you can select between three encryption
algorithms (DES, 3DES and AES), two authentication algorithms (MD5 and SHA1) and two key
groups (DH1 and DH2) when you configure a VPN rule (seeSection 13.4 on page 136). The ID type
and content act as an extra level of identification for incoming SAs. The DES encryption algorithm is
not supported at the time of writing.
The type of ID can be a domain name, an IP address or an e-mail address. The content is the IP
address, domain name, or e-mail address.
Remote
IPSec Router
HQ
10.1.1.1/200
Intranet DNS
10.1.1.10
ISP DNS Servers
212.54.64.170 212.54.54.171
Internet
LAN
DNS:212.54.64.170
212.54.64.171
A
VPN DNS: 10.1.1.10
= VPN Tunnel
2
192.168.1.1/50
3
172.16.1.1/50
1
Table 53 Local ID Type and Content Fields
LOCAL ID TYPE= CONTENT=
IP Type the IP address of your computer or leave the field blank to have the P-79X
automatically use its own IP address.
DNS Type a domain name (up to 31 characters) by which to identify this P-79X.
To Next Page
Loading...
Need help?
General
