Nomadix AG 2300, User Manual, Page: 117 / 294

A
CCESS
G
ATEWAY
System Administration 105
2.
Select the tunnel peer IP address for which you would like to add a security policy from the
Tunnel
peer IP address
menu. You must select a peer if the policy is using
ESP
or
AH
; if the policy is a
Discard
or
Bypass
policy, select
none
.
3.
In the
Traffic Selectors
section, define a specific protocol by one of the following methods:
•
Select a specific protocol from the
Protocol
menu.
•
Enter a specific protocol number in the Protocol field. Protocol numbers are available at
www.iana.org/assignments/protocol-numbers .
Next you will define selectors of the Security Policy. All selectors must match for the policy to be applied.
4.
Define the following selectors for the
Remote End
:
 Remote IP/Subnet – Enter the IP address of the remote network secured by the IPSec tunnel. The
address can specify a host.
 Subnet Mask – Enter the subnet mask of the remote network secured by the IPSec tunnel.

Remote UDP/TCP Port – Enter the port number; 0 is for all ports (only if protocol is UDP or TCP).
5.
Security Policy can derive the settings for the Local End from the current Network IP settings of the
unit. Select one of the following network options for the
Local End
:
 Use current Network Interface IP Address
– Select this option if you would like to use the
current network interface IP Address. Note that the network IP address is dynamic if DHCP or
PPPoE client is enabled. This setting is the default setting.

Use this static IP address/subnet – If you select this option you must also enter the Local
IP/Subnet
, the
Subnet Mask
, and the
IP address of network interface for this policy
.

The Local IP/Subnet is the IP address of the local network secured by the IPSec tunnel.
The address can specify a host.

The
Subnet Mask
is the subnet mask of the local network secured by the IPSec tunnel. The
address can specify a host.

The
IP address of network interface for this policy
is the IP Address for the NSE inside
an IPSec tunnel. The IP address must be within the Local LAN subnet or the same as the
Local LAN IP address. IP address 0.0.0.0 disables the functionality. The default setting is
0.0.0.0.
6.
Enter the port number in the Local UDP/TCP Port field; 0 is for all ports (only if protocol is UDP or
TCP).
7.
In the Security Parameters section, define the parameters of the security policy. The options are
Discard
,
Bypass
,
ESP
, and
AH
.
ESP
is the default setting.

Discard
 Bypass
– Select the direction of the discard/bypass; the options are:
In only
,
Out only
, or
In
and Out
.
Out only
is the default setting.
 ESP – Select all the acceptable encryption algorithms by putting a check in the checkbox of
each option; the options are:
DES
,
3DES
, and
NULL
.
3DES
is the default setting. See Setting
joint ESP and AH parameters on page 105 to set parameters that pertain to both ESP and AH
polices.

AH – See Setting joint ESP and AH parameters on page 105 to set parameters that pertain to
both ESP and AH policies.
Setting joint ESP and AH parameters
These parameters affect both ESP and AH policies.
1.
Select all the Acceptable authentication algorithms by putting a check in the checkbox of each
option; the options are: MD5 , SHA , and NULL . The default settings are MD5 and SHA .
2.
Select the Perfect Forward Secrecy Strength to enable PFS. PFS makes the keying material used
in protecting the data independent of the keying material used for protecting the IKE exchanges.