Conel xr5i sl, Руководство пользователя

Страница: 42 / 79

CONFIGURATION
42
4.12. IPSec Tunnel Configuration
IPsec tunnel configuration can be called up by option IPsec item in the menu. IPsec
tunnel allows protected connection of two networks LAN to the one which looks like one
homogenous. In the IPsec Tunnels Configuration window are four rows, each row for one
configured IPSec tunnel. The column Create switches on tunnels, other columns contain
values view set in the IPsec Tunnel Configuration windows; configuration is possible by
the Edit button.
In the IPsec Tunnel Configuration windows it is possible to define the tunnel name
(Description), off - side tunnel IP address (Remote IP Address), identification of off-side
tunnel (Remote ID), address nets behind off - side tunnel (Remote Subnet), mask nets
behind off - side tunnel (Remote Subnet Mask), identification of local side (Local ID), local
subnet address (Local Subnet), local network mask (Local Subnet Mask), sharable key for
both parties tunnel (Pre shared Key), service life keys (Key Lifetime) and service life IKA SA
(IKE Lifetime). Rekey Margin specifies how long before connection expiry should attempt to
negotiate a replacement begin. Rekey Fuzz specifies the maximum percentage by which
Rekey Margin should be randomly increased to randomize re-keying intervals. Parameter
DPD Delay defines time after which is made IPsec tunnel verification. By parameter DPD
Timeout is set timeout of the answer. If address translation between two end points of the
IPsec tunnel is used, it needs to allow NAT Traversal (Enabled). If parameter Aggressive
mode is enabled, then establishing of IPsec tunnel will be faster, but encryption will set
permanently on 3DES-MD5. Authentication is possible to set by parameter Authenticate
mode. At choice are following possibilities: Pre-shared key or X.509 Certificate. Parameter
Pre-shared Key set shared key for both off-side tunnel. At authentication by X.509 certificate
it is necessary put in certificates CA Certificate, Remote Certificate and Local Certificate and
private key Local Private Key and Local Passphrase. The certificates and private keys have
to be in PEM format. As certificate it is possible to use only certificate which has start and
stop tag certificate. Parameters ID contain two parts: hostname and domain-name. Items
which can be blank, are used for to exact IPsec tunnel identification. By the help
of parameter Extra Options it is possible to define additional parameters of the IPsec tunnel,
for example secure parameters and the like.
The changes in settings will apply after pressing the Apply button.
Openswan version: 2.6.25