202
14.1.1-C
IPSec Parameters
MTU of ipsec interfaces
When extending IP packets with the IPSec headers, often the maximum allowed packet
size on the link to the remote IPSec server is exceeded. So these packets need to be
fragmented. This in turn may cause problems with some Internet routers, especially
those which have been configured to discard fragmented packets.
If e.g. the transmission of data packets of more than 1500 byte fails, while packets
with less than say 1200 byte are delivered ok, it indicates an MTU problem. Even the
negotiation phase of A IPSec connection can be affected. If you don't get a connection
but find complaints about duplicate packets in the IPSec log, the MTU might cause
this, too.
Reduce the MTU (Maximum Transmit Unit) in this case. With this parameter you can
control the maximum size of data packets before they are passed on to the encryption
stage. Choose a value which is low enough, so that no in transit fragmentation of
the encrypted packets is necessary. Note however, that a lower MTU reduces the
throughput.
Non-unique IDs
When disabled, a new connection will terminate an existing connection with the same
ID. This is important for dial-up clients with dynamic IP addresses as it will clean up
broken connections which might otherwise prevent new connections in the worst case.
You should enable this option only if there really are multiple peers using the same ID.
14.1.1-D
VPN Certificate
To authenticate VPN connections using X.509 certificates, SX-GATE requires a
certificate of its own.
Both, IPSec and OpenVPN based VPNs use this certificate.
This certificate is not part of the SX-GATE backups as it has to
be kept secret. Use the export feature to backup the certificate.
To specify the certificate you can either generate it yourself at "System > Certificates
> Certificates" or import it from a PKCS#12 file you received from an other certification
authority.
