PoE
AP
Router
161
also
imports
the
certificates
of
the
root
CA
of
the
Gateway
1
into
the
Gateway
2
as
the
trusted
ones.
(Please
also
refer
to
"My
Certificate"
and
"Trusted
Certificate"
sections).
Establish
an
IPSec
VPN
tunnel
with
IKE
and
X.509
protocols
by
starting
from
either
peer,
so
that
all
client
hosts
in
these
both
subnets
can
communicate
with
each
other.
Parameter
Setup
Example
(same
as
the
one
described
in
"My
Certificate"
section)
For
Network
‐
A
at
HQ
Following
tables
list
the
parameter
configuration
as
an
example
for
the
"Issue
Certificate"
function
used
in
the
user
authentication
of
IPSec
VPN
tunnel
establishing,
as
shown
in
above
diagram.
The
configuration
example
must
be
combined
with
the
ones
in
"My
Certificate"
and
"Trusted
Certificate"
sections
to
complete
the
setup
for
whole
user
scenario.
Configuration
Path
[Issue
Certificate]
‐
[Certificate
Signing
Request
Import
from
a
File]
Browse
C:/BranchCSR
Command
Button
Sign
Configuration
Path
[Issue
Certificate]
‐
[Signed
Certificate
View]
Command
Button
Download
(default
name
is
"issued.crt")
Scenario
Operation
Procedure
(same
as
the
one
described
in
"My
Certificate"
section)
In
above
diagram,
the
"Gateway
1"
is
the
gateway
of
Network
‐
A
in
headquarters
and
the
subnet
of
its
Intranet
is
10.0.76.0/24.
It
has
the
IP
address
of
10.0.76.2
for
LAN
interface
and
203.95.80.22
for
WAN
‐
1
interface.
The
"Gateway
2"
is
the
gateway
of
Network
‐
B
in
branch
office
and
the
subnet
of
its
Intranet
is
10.0.75.0/24.
It
has
the
IP
address
of
10.0.75.2
for
LAN
interface
and
118.18.81.33
for
WAN
‐
1
interface.
They
both
serve
as
the
NAT
security
gateways.
Gateway
1
generates
the
root
CA
and
a
local
certificate
(HQCRT)
that
is
signed
by
itself.
Import
the
certificates
of
the
root
CA
and
HQCRT
into
the
"Trusted
CA
Certificate
List"
and
"Trusted
Client
Certificate
List"
of
Gateway
2.
Gateway
2
generates
a
Certificate
Signing
Request
(BranchCSR)
for
its
own
certificate
BranchCRT
to
be
signed
by
root
CA
(Please
generate
one
not
self
‐
signed
certificate
in
the
Gateway
2,
and
click
on
the
"View"
button
for
that
CSR.
Just
downloads
it).
Take
the
CSR
to
be
signed
by
the
root
CA
of
the
Gateway
1
and
obtain
the
BranchCRT
certificate
(you
need
rename
it).
Import
the
certificate
into
the
"Trusted
Client
Certificate
List"
of
the
Gateway
1
and
the
"Local
Certificate
List"
of
the
Gateway
2.
Gateway
2
can
establish
an
IPSec
VPN
tunnel
with
"Site
to
Site"
scenario
and
IKE
and
X.509
protocols
to
Gateway
1.
Finally,
the
client
hosts
in
two
subnets
of
10.0.75.0/24
and
10.0.76.0/24
can
communicate
with
each
other.
