Viper SC+™ IP Router for Licensed Spectrum PN 001-5008-000 Rev. C
| Page 106
Figure 64 – Viper VPN Network with Relay Point
A VPN tunnel is created by a client to a specific server. A server can have tunnels to many clients.
A special shared tunnel is also provided to support a few special traffic types:
Point-to-multipoint broadcast and multicast packets.
Telnet, Web, SNMP, and RADIUS packets.
Device specific IP-service packets (GPS, RSSI, diagnostics, etc.).
The shared tunnel is always available on a device, provided that its VPN service is enabled.
Tunnel Maintenance
Key exchange: Random cipher keys are used to encrypt VPN tunnel traffic. These keys are unique to each tunnel and
are generated during VPN client/server key exchange. Tunnel keys are periodically updated to maximize security.
Server Status Advertisement
By default, traffic normally sent via VPN tunnel is blocked if one client/server tunnel endpoint is non-operational. A
server therefore advertises its status to ensure that all its tunnels have a very high availability. These are sent whenever
the server is enabled or disabled through a reset, device hot-swap, or manual intervention. VPN clients can thus quickly
re-establish their tunnels as needed.
Configuration
Most VPN server configuration settings are sent to each client during key exchange. AVPN server does not send the
following settings to VPN clients:
VPN login password and Master Key.
Device-specific General settings and IP-filter settings.
Master Key
The VPN Master Key is a configuration item essential to the security of VPN operations. A VPN server’s Master Key
must also be set on each of its clients. Access to the Master Key (along with other VPN settings) is therefore protected
by the VPN login mechanism.
