Motorola AP-7131 Series, Reference Manual

Page: 192 / 954

5 - 106 WiNG 5.5 Access Point System Reference Guide
5.2.7.1 Defining Profile VPN Settings
Profile Security Configuration
IPSec VPN provides a secure tunnel between two networked peer access points or controllers. Administrators can define which
packets are sent within the tunnel, and how they’re protected. When a tunnelled peer sees a sensitive packet, it creates a
secure tunnel and sends the packet through the tunnel to its remote peer destination.
Tunnels are sets of security associations (SA) between two peers. SAs define the protocols and algorithms applied to sensitive
packets and specify the keying mechanisms used by tunnelled peers. SAs are unidirectional and exist in both the inbound and
outbound direction. SAs are established per the rules and conditions of defined security protocols (AH or ESP).
Use crypto maps to configure IPSec VPN SAs. Crypto maps combine the elements comprising IPSec SAs. Crypto maps also
include transform sets . A transform set is a combination of security protocols, algorithms and other settings applied to IPSec
protected traffic. One crypto map is utilized for each IPSec peer, however for remote VPN deployments one crypto map is used
for all the remote IPSec peers.
Internet Key Exchange (IKE) protocol is a key management protocol standard used in conjunction with IPSec. IKE enhances
IPSec by providing additional features, flexibility, and configuration simplicity for the IPSec standard. IKE automatically
negotiates IPSec SAs, and enables secure communications without time consuming manual pre-configuration.
To define a profile’s VPN settings:
1. Select the Configuration tab from the Web UI.
2. Select Devices .
3. Select System Profile from the options on left-hand side of the UI.
4. Expand the Security menu and select VPN .
Figure 5-60 Profile Security - VPN IKE Policy screen
5. Select either the IKEv1 or IKEv2 radio button to enforce VPN peer key exchanges using either IKEv1 or IKEv2.
IKEv2 provides improvements from the original IKEv1 design (improved cryptographic mechanisms, NAT and firewall
traversal, attack resistance etc.) and is recommended in most deployments. The appearance of the IKE Policy screens differ
depending on the selected IKEv1 or IKEv2 mode.
6. Refer to the following to determine whether an IKE Policy requires creation, modification or removal:
Name Displays the 32 character maximum name assigned to the IKE policy.