QX5
QXFXO4/QXISDN4/QXE1T1/QXFXS24; (SW Version 6.0.x)
96
QXFXO4/QXISDN4/QXE1T1/QXFXS24 Manual II: Administrator’s Guide
stopped.
Add
leads to the
Add
IPSec Connection
wizard where a new IPSec connection can be defined and specified. The wizard provides several pages.
Edit
leads to a set of
IPSec Connection Properties
pages to modify the parameters of the selected IPSec connection. The page includes the same
components as the
Add IPSec Connection
page. To operate with
Edit
, only one record may be selected, otherwise an error message “One row must be
selected” appears.
Restart All Active Connections
restarts all active IPSec connections. The
State
of these IPSec connections will turn into
Connected
or
Activated
if the
restart procedure has been successfully completed.
The first IPSec Connection Wizard page
Add IPSec Connection
has the
Connection Name
text field that requires a new mandatory IPSec connection
name. If the text field is not filled in, the error message otherwise an error will occur “Error: Incorrect connection name” will appear.
Please Note:
The input in the
Connection Name
field should only be in Latin characters, otherwise an error occurs and IPSec connection cannot be
created.
The
Peer type
drop down list is used to choose the remote
machine type for the IPSec Connection to be established. If the list
does not include the required type of machine, choose
Other
.
The
VPN Network Topology
drop down list allows you to select
the location of the peers participating to the VPN connection. The
following options are present in the list:
•
This device<>Peer – direct connection between QX gateway
and a peer.
•
This device <>[Internet]<>Peer – connection between QX
gateway and peer over Internet.
•
This device <>NAT<>[Internet]<>Peer – connection between
QX gateway and peer over Internet through QX gateway
provider’s NAT.
•
This device <>[Internet]<>NAT<>Peer – connection between
QX gateway and peer over Internet through peer provider’s
NAT.
Fig.II- 146: IPSec Connection Wizard - Add IPSec Connection page
The next page of the wizard is
IPSec Keying Properties
which is
used to select IPSec connection's security encryption settings.
Auto Keying requires the
IKE
(Internet Key Exchange) and
ESP
(Encapsulated Security payload) settings defined.
Encryption
and
Authentication
parameters should be defined.
The
Encryption
drop down list offers the following standards for
selection:
•
Triple DES
uses three DES encryptions on a single data
block with three different keys to achieve a higher security
than is available from a single DES pass (block cipher
algorithm with 64-bit blocks and a 56-bit key).
•
AES 128
bit cryptography scheme is a symmetric block
cipher, which encrypts and decrypts 128-bit blocks of data.
•
AES 192
bit cryptography scheme is a symmetric block
cipher, which encrypts and decrypts 192-bit blocks of data.
•
AES 256
bit cryptography scheme is a symmetric block
cipher, which encrypts and decrypts 256-bit blocks of data.
Fig.II- 147: IPSec Connection Wizard -IPSec Keying Properties page
The area Authentication offers the following parameters to be selected:
•
SHA/SHA1
(Secure Hash Algorithm) is a strong digest algorithm proposed by the US NIST (National Institute of Standards and Technology)
agency as a standard digest algorithm and is used in the Digital Signature standard, FIPS number 186 from NIST. SHA is an improved variant of
MD4 producing a 160-bit hash. SHA and MD5 are the message digest algorithms available in IPSEC.
•
MD5
(Message Digest) is a hash algorithm that makes a checksum over the messages. The checksum is sent with the data and enables the receiver
to notice whether the data has been altered.
