Chapter 10 VPN
SBG5500 Series User’s Guide
168
Certificate
In order to use Certificate for IPsec authentication, you need to add new host
certificates in the
Firewall / Security > Certificate
screen.
Select this to have the SBG and remote IPsec router use certificates to authenticate
each other when they negotiate the IKE SA. Then select the certificate the SBG uses
to identify itself to the remote IPsec router.
This certificate is one of the certificates in
Certificate
. If this certificate is self-signed,
import it into the remote IPsec router. If this certificate is signed by a CA, the remote
IPsec router must trust that CA.
Note: The IPsec routers must trust each other’s certificates.
The SBG uses one of its
Trusted CA
to authenticate the remote IPsec router’s
certificate. The trusted certificate can be a self-signed certificate or that of a trusted
CA that signed the remote IPsec router’s certificate.
Advance
Local ID Type
This field is read-only if the SBG and remote IPsec router use certificates to identify
each other. Select which type of identification is used to identify the SBG during
authentication. Choices are:
IPv4
- the SBG is identified by an IP address.
DNS
- the SBG is identified by a domain name.
Email Address
- the SBG is identified by the string specified in the
Content
field.
My Address
- the SBG is identified by he IP address specified in the
My Address
field.
Content
This field is read-only if the SBG and remote IPsec router use certificates to identify
each other. Type the identity of the SBG during authentication. The identity depends
on the
Local ID Type
.
IPv4
- type an IP address. This is not recommended in the following situations:
• There is a NAT router between the SBG and remote IPsec router.
• You want the remote IPsec router to be able to distinguish between IPsec SA
requests that come from IPsec routers with dynamic WAN IP addresses.
In these situations, use a different IP address, or use a different
Local ID Type
.
DNS
- type the fully qualified domain name (FQDN). This value is only used for
identification and can be any string that matches the peer ID string.
Email Address
- the SBG is identified by the string you specify here; you can use up to
63 ASCII characters including spaces, although trailing spaces are truncated. This
value is only used for identification and can be any string.
Peer ID Type
Select which type of identification is used to identify the remote IPsec router during
authentication. Choices are:
IPv4
- the remote IPsec router is identified by an IP address.
DNS
- the remote IPsec router is identified by a domain name.
Email Address
- the remote IPsec router is identified by the string specified in this field.
Any
- the SBG does not check the identity of the remote IPsec router If the SBG and
remote IPsec router use certificates, there is one more choice.
Table 70 VPN Gateway: Add/Edit
LABEL
DESCRIPTION
Summary of Contents for SBG5500-A
Page 12: ...12 PART I User s Guide...
Page 44: ...44 PART II Technical Reference...
