Configuration
4.10 IPsec Tunnel Configuration
******************** server cert *************************************
openssl genrsa -des3 -passout pass:router -out private/server.pem 2048
openssl req -new -key private/server.pem -out tmp/server.req
openssl x509 -req -days 7305 -sha1 -extensions v3_req -CA ca.crt -CAkey
private/ca.key -in tmp/server.req -CAserial ca.srl -CAcreateserial
-out server.crt
******************** client cert **************************************
openssl genrsa -des3 -passout pass:router -out private/client.pem 2048
openssl req -new -key private/client.pem -out tmp/client.req
openssl x509 -req -days 7305 -sha1 -extensions v3_req -CA ca.crt -CAkey
private/ca.key -in tmp/client.req -CAserial ca.srl -CAcreateserial
-out client.crt
The IPsec function supports the following types of identifiers (ID) for both sides of the tunnel,
Remote ID
and
Local ID
parameters:
•
IP address (for example, 192.168.1.1)
•
DN (for example, C=CZ,O=CompanyName,OU=TP,CN=A)
•
FQDN (for example, @director.companyname.cz) –
the @ symbol proceeds the FQDN.
FQDN resolving is not supported.
•
User FQDN (for example, [email protected])
The certificates and private keys have to be in the PEM format. Use only certificates containing
start and stop tags.
The random time, after which the router re-exchanges new keys is defined as follows:
Lifetime - (Rekey random value in range (from 0 to Rekey margin * Rekey Fuzz/100))
The default exchange of keys is in the following time range:
•
Minimal time: 1h - (9m + 9m) = 42m
•
Maximal time: 1h - (9m + 0m) = 51m
UM Configuration OWL LTE M12
Rel. 06.1.09 - 07/2019
79
