TeleBoss 850 2.06.280_STD User Manual
Page 79
VPN Server FAQs
How do I specify SSL VPN Server mode?
Set
net.vpn.mode
to
SSL SERVER
.
How many VPNs can I configure?
The unit can be configured with up to 2 VPNs. The configuration settings for these VPNs are under the
net.vpn.*
key branch.
How many VPNs can I run at one time?
Although the unit supports multiple VPN configurations, only 1 VPN can be operational at any one time. The
setting that controls which VPN can be operational is the
net.vpn.active
key. It has values of VPN1, VPN2, or
NONE.
Am I using this VPN with SitePath?
The unit cannot use this feature to form a VPN with SitePath. If you need to use SitePath, let SitePath configure
the unit, which results in using the SSL VPN Client function.
Should my VPN start automatically when the unit starts?
If yes, then set
net.vpn[x].startmode
to
AUTO-PASSIVE
. If no then set it to MANUAL. When in MANUAL
startmode, start the VPN by setting
net.vpn[x].cmd
=1
. Note that this is different than manually starting an SSL
VPN client. Once started, the VPN will listen until told to stop (either by setting
net.vpn[x].cmd
=0
, or by the
unit resetting when the VPN is in MANUAL startmode).
Can multiple VPN clients connect to the unit?
Yes. You can enforce the maximum number of clients the unit will support with the “max-clients” OpenVPN
configuration item (configurable with the
net.vpn[x].ssl.conf
key, discussed below).
How do I know the VPN is working?
To check the status of the VPN, read the
net.vpn[x].status
key. It returns one of 3 values:
0 (which means the VPN is off)
1 (which means the unit is listenting for a VPN connection)
2 (which means the VPN is operational (and still listening for a VPN connection)
Note that the return value of 2 means the tunnel is up, but does not necessarily preclude configuration errors from
preventing VPN traffic to pass. So to ultimately know the VPN is operational, in addition to verifying
net.vpn.status
returns 2, you should also ping the client from the unit using the VPN address of the client. (Or
you can ping the unit from the client, using the VPN address of the unit.)
You can also use the
net.vpn[x].cmd
key to read the status of the VPN.
Do I need to give the VPN a name?
You may want to describe the VPN or give it a name; use the
net.vpn[x].description
key for that. This has
no functional purpose, it is just for making a note.
How does the unit know the VPN client is authentic (and vice versa)?
The unit uses certificate-based SSL/TLS security to authenticate the client (and the client uses the same thing to
authenticate the unit). Configuring certificates can be done with Setting Keys, but is likely more simple for a user
to use the SSLC command on the unit. The SSLC command allows unit administrators to manipulate the SSL
VPN certificates and other authentication data associated with the VPN.
The SSLC command takes a variety of command line arguments that tell it what to do. These arguments are
mainly broken down into "actions" and "items"
actions
o
add:
add an item (load it into the unit)
o
list:
list an item (display what is already in the unit)
o
delete: delete an item
Содержание Teleboss 850
Страница 6: ......
