724-746-5500 | blackbox.com
Page 104
Chapter 8: Virtual Private Networks
1. A VPN Profile Table includes all records. When the user specifies the type of keying the profile will use, the WRT4000 Series
Cellular Wireless Router presents for configuration only the fields that apply to the specified keying. (Table 5-4 presents param-
eters for autokeying.)
2. The WRT4000 Series Cellular Wireless Router does not use manual keying in normal operation. The WRT4000 Series Cellular
Wireless Router normally performs only automatic keying. If you wish to use manual keying, contact your Encore Networks rep-
resentative.
8.4.2 Automatic Keying
In automatic keying (autokeying), keys are dynamic, always changing. Special keys are exchanged at the beginning of the
connection, and the VPN gateways negotiate other keys for the connection. If desired, keys can time out and new keys can be
negotiated for subsequent parts of the connection.
The WRT4000 Series Cellular Wireless Router uses the Internet Key Exchange (IKE) protocol for automatic generation of keys in
VPN connections. When an WRT4000 Series Cellular Wireless Router uses the automatic keying feature, an IKE tunnel is set up for
key exchange. That IKE tunnel sets up keys for a subsequent data tunnel (if a subsequent tunnel is needed). The data tunnel is
used for data exchange. See Section 8.3.4, Internet Key Exchange.
Table 5-4 shows sample parameters to set up IKEv1 automatic keying for a VPN connection.
Table 8-4. Sample VPN Profile, Automatic Keying (Sheet 1 of 2).
Sample Fields
Sample Values
Authentication Mode
Main mode (also known as ID Protection), Aggressive mode
Local ID (User ID)
1
1.1.1.1
Remote Gateway IP Address
2
3.3.3.1
Preshared Key
3
******
Phase 1, Proposal 1
4
PRE-G2-DES-MD5
Phase 1, Proposal 2
VSA-G2-3DES-SHA
Phase 2, Proposal 1
STD-G2-3DES-MD5
Phase 2, Proposal 2
PFS-G2-3DES-SHA
Replay Protection
Enable/Disable
1. There are three formats for the local ID:
• E-mail format: ascii-format@ascii-format
• IP address format: x.x.x.x
• Perfect domain name format: hostdomain.net
2. There are two kinds of remote IP addresses: static and dynamic.
3. The preshared key is used to establish the IKE tunnel. This preshared key must be protected as a super-password. The
preshared key uses Diffie–Hellman Exchange 2 (DH2).
4. The initiator may provide up to four proposals per phase. The recipient must choose at least one proposal for each phase.
Table 8-5 and Table 8-6 illustrate sample proposal combinations for IKEv1 phase 1 and phase 2, respectively.
