Personal aXsGUARD - 7.7.1
Chapter 3. Features and Concepts
© VASCO Data Security 2013
11
will first try to establish a TCP connection with the same server, before it switches to the second server. If
a connection is made to the second server, UDP will be attempted first. In case a specific VPN protocol is
selected, the failover occurs without delay, as only the selected protocol is used.
Example 3.1. Maintenance of master in HA cluster
Assume that you have a HA cluster and that the master is down for maintenance. If configured, the PAX
will automatically try to establish a VPN connection with the slave system, which is listening on a different
IP address.
Example 3.2. Selecting UDP as the VPN protocol
Assume you have configured the PAX to use UDP only. The PAX will connect to the first IP using UDP. If the
connection fails, it will immediately switch to the second IP, without attempting to establish a TCP connection
with the first IP.
For details about Internet Redundancy, see the aXsGUARD Gatekeeper Internet Redundancy How To
guide, which can be accessed via the Documentation button in the Administrator Tool.
3.6. Wireless Access Point
It is possible to enable wireless mode on the PAX (this option must be configured on the aXsGUARD
Gatekeeper). As such, your PAX becomes a secured wireless access point for your corporate network. This
requires some minor configuration on the client side. Consult the documentation of the client’s operating
system if necessary.
The following encryption types are supported:
• WPA2 Enterprise CCMP Encryption
• WPA2 PSK CCMP Encryption
• WPA/WPA2 Enterprise AES Encryption
• WPA/WPA2 PSK AES Encryption
• WPA/WPA2 Enterprise TKIP+AES Encryption
• WPA/WPA2 PSK TKIP+AES Encryption
• WEP 128 bit Encryption
The encryption types are listed from strongest to weakest, in descending order.
3.7. TCP or UDP?
The PAX is in fact a hardware OpenVPN client and uses UDP Port 1194 to establish a VPN connection with
the aXsGUARD Gatekeeper VPN server. UDP port 1194 is the port number that is officially assigned by the
IANA
for OpenVPN.
Although UDP is the standard protocol, TCP is also supported. The PAX can be configured to automatically
detect the configured VPN protocol type (UDP or TCP) of the remote aXsGUARD Gatekeeper.
TCP is the preferred option if your PAX client is located in a remote area and is likely to have an Internet
connection of a quality inferior to modern standards. The TCP protocol offers error correction mechanisms and
is therefore more reliable and suitable for unstable Internet connections, but produces more overhead. UDP
is a faster protocol, but offers no error control mechanisms and guaranteed delivery. UDP is more suitable
for stable Internet connections.