112
6620-3201
4.48 Confi gure
>
IPSec
>
IPSec Eroutes
>
Eroute n
Once the IKE parameters have been set-up, the next stage is to de
fi
ne the characteristics of the
encrypted routes, or tunnels (“eroutes”). This includes items such as what source/destination
addresses will be connected by the tunnel and what type of encryption/authentication procedures will
be applied to the packets traversing it. For obvious reasons it is essential that parameters such as
encryption and authentication are the same at each end of the tunnel. If they are not, then the two
systems will not be able to agree on what set of rules or “policy” to adopt for the encrypted route and
communication cannot take place.
Using the Web Page(s
)
The
Confi gure
>
IPSec
>
Eroutes
page contains a number of sub-pages for
Eroutes 0-9
,
10-19
, etc.
Note:
The number of Eroutes available depends on how many licenses you have purchased. Eroute
licenses may be purchased in groups of 10 up to a maximum of 30).
The parameters listed on each Eroute page are as follows:
Peer IP/hostname:
This is the IP address of the remote unit to which you wish to connect.
Peer ID:
In Main mode (i.e. when
Aggressive mode
is “Off”) this must be the IP address of the
peer. When
Aggressive mode
is “On”, this parameter is a string of up to 20 characters that is used
in to identify the remote system and should contain the same text as the
Our ID
parameter in the
corresponding remote unit’s Eroute con
fi
guration.
Our ID:
When
Aggressive mode
is “On”, this parameter is a string of up to 20 characters sent to
the remote system to identify the initiator. When certi
fi
cates are used this
fi
eld should contain, the
“Altname”
fi
eld in a valid certi
fi
cate held on the unit.
RSA private key fi le:
This
fi
eld is used to override the private key
fi
lename con
fi
gured in IKE. It is only used when
certi
fi
cates are being used for the authentication stage of the IKE negotiation.
Send our ID as FQDN:
When set to “Yes”, this parameter indicates to the remote peer that the ID is in Fully Quali
fi
ed Domain
Name format, e.g. “vpnclient1.anycompany.com”. When set to “No”, the ID is indicated as being of
simple Key ID type e.g. “vpnclient1”. The default is “No” and it should only be necessary to select
“Yes” where interoperability problems are encountered with other manufacturer’s VPN equipment.
Interface to use for local subnet IP address / Interface # to use for local subnet IP address:
Together, these parameters allow the local subnet setting (
Local subnet IP address
/
Local subnet
mask
) to take the value of the IP address of an interface. To con
fi
gure, clear the
Local subnet IP
address
and
Local subnet mask
parameters, and then con
fi
gure the
Interface to use for local
subnet IP address
as either “PPP” or “Ethernet” and
Interface # to use for local subnet IP address
interface instance (e.g. PPP 1).
Local subnet IP address:
This is the IP address of the local sub-net. This will usually be the IP address of the local router’s
Ethernet interface or that of a speci
fi
c device on the local sub-net (such as a PC running a client or
host application).
Local subnet mask:
When connecting two sub-nets it will often be desirable to allow any device on one sub-net to connect
to any other device on the remote sub-net. This mask sets the range of addresses that will be allowed
to use the Eroute.
