113
6620-3201
Local subnet IP address to negotiate (if different from above): /
Local subnet mask to negotiate (if different from above):
If eroutes are allowed to negotiate local traf
fi
c selectors which differ from the normal ones, these two
parameters will be the values used when negotiating the tunnels. The
fi
rewall can then be used to
translate the source addresses of packets to a value that lies within the negotiated range. This is so
that a packet can match more than one eroute, but will use a different source address (from the peers
perspective) depending on which tunnel gets used.
Remote subnet IP address:
This is the IP address of the remote sub-net. It will usually be the IP address of the remote router’s
Ethernet interface or that of a speci
fi
c device on the remote sub-net (such as a PC running a client or
host application).
Remote subnet mask:
When connecting two sub-nets it will often be desirable to allow any device on one sub-net to connect
to any other device on the remote sub-net. This mask sets the range of addresses that can be
addressed on the remote sub-net via the Eroute.
Remote subnet ID:
When the unit is in server mode and negotiating IPsec from behind a NAT box,
the
Remote subnet IP
address and
Remote subnet mask
parameters should be left blank, and
this parameter should be con
fi
gured to the ID sent by the remote Windows client (this is usually the
computer name).
Local port / Remote port:
These parameters are used to match packets with a particular Eroute. For example, if Local port is 0
and Remote port is 80, only packets where the TCP or UDP remote port number is 80 will be matched
by the Eroute. The value of 0 indicates that any port will match.
First local port (IKEv2 only) / Last local port (IKEv2 only):
These parameters allow you to restrict which ports on the unit will be able to send and receive traf
fi
c
on this Eroute.
First remote port (IKEv2 only) / Last remote port (IKEv2 only):
These parameters allow you to restrict which ports on the client will be able to send and receive traf
fi
c
on this Eroute.
Mode:
This parameter can be set to “Tunnel” or “Transport”. In normal use this will be set to “Tunnel”, i.e.
both the data payload and the packet headers/routing information will be encrypted.
AH authentication algorithm:
This parameter selects the algorithm used to verify that the packet contents have not been
changed in transit since they were sent. You may select none (blank), “MD5” or “SHA1”.
Normally it is preferable to use ESP authentication and turn AH authentication off (as ESP
provides better protection) but for compatibility with some older systems it may necessary.
There is
little point in using AH and ESP Authentication together but this is also possible.
ESP authentication algorithm:
This parameter selects the algorithm used to verify that packet contents have not been changed. You
may select none (blank), “MD5” or “SHA-1”.
