Chapter 19 IPSec VPN
SBG3300-N Series User’s Guide
209
Connection Name Enter a name to identify this VPN policy. If you are editing an existing policy, this field is
not editable.
Note: The Connection Name of an IPsec rule must be unique and cannot be changed
once it has been created.
Nailed-up Select this if you want the Device to automatically renegotiate the IPSec SA when the
VPN connection is down.
This feature is only applicable if you set the Application Scenario to Site-to-Site.
When Nailed-up is enabled, you cannot disconnect the specified IPsec VPN tunnel in
the VPN > IPSec VPN > Monitor screen.
NAT Traversal (NAT-
T)
Select this check box to enable NAT traversal. NAT traversal allows you to set up a VPN
connection when there are NAT routers between the two IPSec routers.
The remote IPSec router must also have NAT traversal enabled.
You can use NAT traversal with ESP protocol using Transport or Tunnel mode, but not
with AH protocol nor with manual key management. In order for an IPSec router
behind a NAT router to receive an initiating IPSec packet, set the NAT router to forward
UDP ports 500 and 4500 to the IPSec router behind the NAT router.
Note: It is suggested to always enable the NAT Traversal (NAT-T) feature if you are not
sure if a NAT device is connected to your VPN gateway. Once this feature is
enabled, it will automatically detect connected NAT devices for you.
Application Scenario Select the scenario that best describes your intended VPN connection.
Site-to-Site - Choose this if the remote IPSec router has a static IP address or a
domain name. This Device can initiate the VPN tunnel.
Site-to-Site with Dynamic Peer - Choose this if the remote IPSec router has a
dynamic IP address. Only the remote IPSec router can initiate the VPN tunnel.
Remote Access - Choose this to allow incoming connections from IPSec VPN clients.
The clients have dynamic IP addresses and are also known as dial-in users. Only the
clients can initiate the VPN tunnel.
My Address Select an interface from the drop-down list and its IP address will be shown. The IP
address of the Device is the IP address of the interface.
Note: Only choose Any when the Application Scenario is configured as Remote
Access. It is not applicable to Site-to-Site and Site-to-Site with Dynamic Peer.
Primary Peer
Gateway Address
The primary peer gateway address is applicable (and required) when you choose Site-
to-Site in the Application Scenario field. The Device primarily attempts to establish
the VPN tunnel with this remote address. The peer gateway address can be either an IP
address or FQDN.
Secondary Peer
Gateway Address
The secondary peer gateway IP address is applicable (and optional) if you choose Site-
to-Site in the Application Scenario field. The Device attempts to establish the VPN
tunnel with this remote address if it fails to connect to the primary peer gateway
address. The secondary peer gateway address can be either an IP address or FQDN.
Fall Back to Primary
Peer Gateway when
possible
When checked, the Device attempts to connect to the primary peer gateway address if
the connection to secondary peer gateway address is dropped.
Authentication
Note: The Device and remote IPSec router must use the same authentication method
to establish the IKE SA.
Key Exchange Mode When this field is set to Manual, the specified IPsec VPN tunnel will be considered as
connected at any time. You cannot disconnect the specified IPsec VPN tunnel in the
IPsec Monitor screen.
Table 91 VPN > IPSec VPN > Setup > Edit (continued)
LABEL DESCRIPTION
To Next Page
Loading...
