Operation and Configuration Guide 3.14
86
4118618
•
Local Subnets
: lists the LAN segments configured on the unit - just select
the ones to use for the VPN. Note: this field will auto update the names if they
have been updated on the LAN configuration page.
·
Gateway Virtual IP
: if Local Termination is set to network, this field must
be set to the IP address that the oMG has on one of the LAN segments
selected on the VPN (defined on the LAN Segments configuration page).
If Local Termination is set to host, this field must be set to the gateway
virtual IP address (i.e. not an IP address on the LAN segment, but a host
address to use for that VPN).
Note: This field is not used for IKEv1.
•
Internet Key Exchange
:
·
IKE Transform
: set to the desired IKE transform.
·
MOBIKE
: set this field to enabled only when using an ACM (other appli-
ances don't support MOBIKE). This is compatible only with IKEv2 and
allows the IP addresses associated with IKEv2 and the SA (security
association) to be changed without tearing down and re-establishing the
VPN connection. This end result is a fast switch of the VPN that has
minimal impact to end user data.
·
Dead Peer Detection
: during idle periods, an "R_U_THERE" packet is
sent every delay period. If an "R_U_THERE_ACK" packet has not been
received within the timeout period, the peer will be declared dead. When
Dead Peer Detection is enabled, the Delay and Timeout time can be set.
The default values are 10 and 30 seconds respectively. Note that interop-
erable DPD is not completely reliable. A VPN link monitor is recom-
mended to ensure reliable failure detection and recovery. Note: set to
disabled if MOBIKE is enabled.
Delay
: Set to 10.
Timeout
: Set to 30.
·
IKE Lifetime (min)
: Set to 60. The lifetime for the IKE SA (security
association). Once the lifetime has been reached a new SA will be
negotiated. Either end may initiate the negotiation; both sides need not
agree.
·
Reauthenticate on IKE ReKey
: This field specifies if re authentication
should be performed when re-keying IKE SA (security association). This
parameter is only meaningful for IKEv2.
•
IPSec
:
·
ESP Transform
: Set to the desired ESP transform. Note: this value and
the IKE Transform must be configured the same on the ACM.
·
IP Compression
: enable this field to use packet compression. Note: this
field must be set to disabled if the VPN server doesn't support
compression.
·
Force UDP Encapsulation
: Set to enabled (default). Sierra Wireless
recommends this field be enabled. When the VPN server is behind a
firewall, firewall configuration is simplified as the firewall only has to allow
ports 500 (IKE) and 4500 (UDP-encapsulated ESP) when UDP encapsu-
lation is employed.