MLR 3G 2.0
Functions
In order to
mask the received packets with the local IP address of the MLR 3G
2.0
, check the checkbox "Mask packets through tunnel". The recipient of the
packets will see the local IP address of the MLR 3G 2.0 as sender than, not the
address of the original sender from the local net of the remote terminal.
In order to
configure the dead peer detection
, enter the interval, which is used
to send requests to the remote terminal, in seconds into the field "Dead peer
detection interval" and the maximum time, in which these requests must be
replied, in seconds into the field "Dead peer detection timeout". Select the be-
haviour for a connection, which is considered as interrupted, in the drop-
down list "Action on dead peer". If you select "restart" (default setting) here,
the connection will be restarted, for "clear", it will be terminated, and for
"hold", it will be held.
In order to
enable perfect forward secrecy
, check the checkbox "Activate per-
fect forward secrecy". This can prevent that the next key can be discovered
more quickly from a hacked encryption. Both remote terminals must have
matching settings to be able to establish the connection.
In order to
configure the interval for the key renegotiation
, enter the value in
seconds into the field "Interval for renegotiation of data channel key". The
minimum value is 3600 seconds (1 hour). The regular renewal of the used keys
can ensure the security of the IPsec connection for a longer period.
in order to
send an additional ping via ICMP protocol to an IP address
, enter
this address, which must be located in the local subnet of the remote termi-
nal, into the field "Additional ICMP ping to". If the ping is not successful, a pos-
sibly existing tunnel will be terminated, and a new tunnel will be established.
The ping interval is 15 minutes.
In order to
configure the authentication for an IPsec connection
, select either
the radio button "Authentication based on certificates" or the radio button
"Authentication with pre shared key (PSK)“. The authentication with certifi-
cates can be used for the main mode. It is indicated under the option here,
whether the individual certificates and keys are present (green checkmark) or
not (red cross). Present certificates can also be downloaded (blue arrow) or de-
leted again (red cross on white box). The private key can only be deleted. The
authentication with passphrase can be used for main mode and aggressive
mode. The passphrase, which must be used by all IPsec participants, must be
entered into the field below the option for this.
In order to
confirm all settings for the loaded tunnel
made above, click on
"OK".
In order to
upload a certificate or key
, click in the section "Upload key or cer-
tificates" on the "Browse..." button. Then, select in the "Upload file" window
the desired file on the respective data carrier and click on the "Open" button. If
the file is encrypted, you must also enter the password into the "Password
(only with encrypted file)" field. Click on "OK" then to upload the file.
59
