INSTALLATION MANUAL FOR THE EMS I-MO 540 SERIES APPLIANCE
Version
1.2
ELECTRONIC MEDIA SERVICES LIMITED
PASSFIELD BUSINESS CENTRE, LYNCHBOROUGH ROAD, LIPHOOK, HAMPSHIRE, GU30 7SB, UK
Tel:
01428 751655 |
Fax:
01428 751654 |
E-mail:
Page
38
of
58
This is an example of a poor key: thisismykey
This is a much stronger key: vjXt3Z7bqw6rjUXe
Traffic over the tunnel can be encrypted setting encrypt option equal to yes. The default encryption is Blow-
fish 128.
The compress option enables compression of data sent over the bonded channel. The default value is no.
Valid options are no, yes, zlib:x where x is a number between 1 and 9 that specifies the level of compression
with 1 giving best speed and 9 giving the best compression.
The bonding option specifies if the link will be used for bonding of multiple connections, the default value is
yes. This value should be set to no if the tunnel is only being used for failover. If bonding is not enabled then
only one instance of the tunnel must exist at any time.
The networks option is used to update the routing table when the tunnel is active. This option is either a
CIDR (e.g. 192.168.0.1/24) or the value “default” which means all any traffic that does not match another
routing rule with be sent over this link.
The heartbeatrefresh sets how often in seconds that the status of the tunnel is checked. The status of the
tunnel is checked by sending an ICMP ping to the remote end of the tunnel. The heartbeatperiod sets num-
ber of seconds the link should be unresponsive before the tunnel is destroyed.
[tunneling]
enabled="yes"
tunnel0name="imo"
tunnel0protocolversion="2"
tunnel0ip="10.250.250.250"
tunnel0key="imokey"
tunnel0encrypt="no"
tunnel0compress="no"
tunnel0bonding="yes"
tunnel0networks="default"
tunnel0heartbeatrefresh="10"
tunnel0heartbeatperiod="30"
The [vpn] section configures one or more IPSEC tunnels.
The following example shows configuring an IPSEC VPN from the public IP of the i-MO appliance
(195.74.68.12) to public IP of the VPN server (100.68.86.56). Two tunnels will be created for for each of the
remote subnets 172.16.0.0/12 and 10.0.0.8/8.
[vpn]
enabled="yes"
remotepeerip="100.68.86.56"
remotesubnets="172.16.0.0/12 10.0.0.0/8"
remoteid_is_auto="no"
remoteid=
localid_is_auto="no"
localpeerip_is_auto="no"
localpeerip="195.74.68.12"
localid=
localinterface="br0"
localsubnets="172.16.0.0/1 172.16.0.0/2"
