Cyclades AlterPath KVM 16, Manual

Page: 147 / 206

4: KVM Web Configuration
AlterPath KVM Manual 4-55
Network > VPN
The VPN configuration form allows you to configure one or more VPN
connections to other systems or KVM devices.
Select one of the existing VPN connections and click the edit button or click
the add button to add a new one. This launches a dialog box to prompt for the
details of the connection. Complete the fields in the dialog box. The RSA
keys may be entered using the Copy and Paste feature of your Browser.
If you already understand how VPN works, skip this section and
proceed to the next procedure
, To configure VPN .
____________________________________________________________________
A VPN, or Virtual Private Network lets the KVM and a whole network communicate
securely when the only connection between them is over a third network which is
untrustable. The method is to put a security gateway machine in the network and
create a security tunnel between the KVM and the gateway. The gateway machine
and the KVM encrypt packets entering the untrusted net and decrypt packets leaving
it, creating a secure tunnel through it.
Often it may be useful to have explicitly configured IPsec tunnels between the KVM
and a gateway of an office with a fixed IP address (in this case every machine on the
office network would have a secure connection with the KVM), or between the KVM
and the KVM administrator machine, which must, in this case, have a fixed IP
address. You can add this connection descriptor to both the Console Server and the
other end. This is the advantage of using left and right instead of using local remote
parameters.
If you give an explicit IP address for left (and left and right are not directly
connected), then you must specify leftnexthop (the router which KVM sends packets
to in order to get them delivered to right). Similarly, you may need to specify
rightnexthop (vice versa).
The Role of IPsec
IPsec is used mainly to construct a secure connection (tunnel) between two networks
(ends) over a not-necessarily-secure third network. In the KVM, the IPsec is used to
connect the KVM switch securely to a host or to a whole network--configurations
usually referred to as
host-to-network and host-to-host tunnel . Practically, this is the
same thing as a VPN, but here one or both sides have a degenerated subnet ( i.e ., only
one machine).
The IPsec protocol provides encryption and authentication services at the IP level of
the network protocol stack. Working at this level, IPsec can protect any traffic carried