UTT Technologies
Chapter 10 VPN
http://www.uttglobal.com
Page
18418418
an initiator or a responder. However, for a dynamic-to-static or static-to-dynamic IPSec
tunnel with IKE aggressive mode, the IPSec endpoint with a static IP address cannot
initiate IKE negotiation because it doesn’t know where to send request; therefore, it will
only act as a responder, and the IPSec endpoint with a dynamic IP address will only act as
an initiator.
On the UTT VPN gateway, IPSec tunnel implementation is based on security virtual
interface, which is quite different from the PPTP virtual interface. The following describes
the main differences between them.
1. Drive Mechanism
The PPTP virtual interface is driven by the routing table; and you cannot create different
PPTP virtual interfaces based on service type. But the IPSec virtual interface is driven by
the Security Policy Database (SPD); and you can create different virtual interfaces based
on service type. For example, the UTT VPN gateway will forward the packets destined for
the same destination network (such as a corporate network) through the same route;
however, the UTT VPN gateway can be configured to encrypt some of them (such as
email packets) by IPSec, but not encrypt others (such as http packets).
In the Web UI, you can go to the
VPN > IPSec > IPSec Settings
page to click the
Advanced Options
hyperlink, and then configure the filter parameters including
Protocol
and
Port
to define the packets that
are protected by IPSec (section6.1.2.1 and 6.1.2.2).
2. Creation Method
Once the PPTP tunnel parameters have been configured properly, the system will
automatically create a virtual interface for the new tunnel to transmit data, and add two
routes pointing to the virtual interface into the routing table (refer to section 2.2.2 and 3.2.2
for more information).
However, once the IPSec tunnel parameters have been configured properly, the system
will automatically add the new security policy in the Security Policy Database (SPD).
When the system receives an outbound packet, it will compare the packet against the
SPD to find the first matching entry. If the first matching entry requires IPSec processing,
the system will encrypt and/or authenticate the packet, and then sends it out. When the
system receives an inbound packet, it will check the packet to see whether it contains an
IPSec header; if not, the packet will be forwarded directly. Else, the UTT VPN gateway will
authenticate and/or decrypt the packet, and then forward the resulting packet (i.e., initial
packet) to its intend destination.
In the CLI, you can use the
show crypt ipsec sp
command to check if the security policy is created. As
shown in
Figure 11-14 Viewing IPSec Security Policy
, “found 1 items in eroute table” means
that
there
is
one
security
policy
entry
in
the
SPD
now.
