D-Link DFL-500, Руководство пользователя

Страница: 55 / 140

Creating the VPN tunnel
A VPN tunnel consists of a name for the tunnel, the IP address of the VPN gateway at the opposite end of the
tunnel, the keylife for the tunnel, and the authentication key to be used to start the tunnel. You must create
complementary VPN tunnels on each of the VPN gateways. On both gateways the tunnel should have the
same name, keylife, and authentication key.
Example IPSec Autokey VPN Tunnel configuration shows the information required to configure the VPN
tunnel for the VPN in Example VPN between two internal networks .
Example IPSec Autokey VPN Tunnel configuration
Description Main Office Branch Office
Tunnel Name
Enter a name for the tunnel. The name can contain numbers
(0-9), and upper and lower case letters (A-Z, a-z), and the
special characters - and _. Other special characters and
spaces are not allowed.
Branch_Office_VPN Main_Office_VPN
Remote
Gateway
The External IP address of the VPN gateway at the other
end of the VPN tunnel.
2.2.2.1 1.1.1.1
Select the Encryption algorithms to propose for Phase 1 of
the IPSec VPN connection. See About P1 and P2 proposals .
DES and 3DES DES and 3DES
Select the Authentication algorithms to propose for Phase 1
of the IPSec VPN connection.
MD5 MD5
P1 Proposal
Specify the Keylife for Phase 1. The keylife is the amount of
time in seconds before the phase 1 encryption key expires.
When the key expires, a new key is generated without
interrupting service.
600 600
Select the encryption and authentication algorithms to propose for Phase 2 of the IPSec VPN
connection. See
About P1 and P2 proposals .
Select Enable replay detection to prevent IPSec replay
attacks. See About replay detection
Select Select
Select Enable perfect forward secrecy (PFS) to improve
the security of Phase 2 keys. See About perfect forward
secrecy (PFS) .
Select Select
Specify the Keylife for Phase 2. The keylife is the amount of
time in seconds before the phase 2 encryption key expires.
When the key expires, a new key is generated without
interrupting service.
600 600
P2 Proposal
Specify the IKE Identity (also called the proxy ID) to use for
the tunnel. The identity labels all IPSec packets associated
with a specific tunnel so that the VPN gateway can associate
IPSec packets that it receives with the correct tunnel. The
default identity is IP Subnet, which means the IPSec packets
associated with this tunnel are identified using the subnet IP
address. You can also set Identity to IP address.
IP Subnet IP Subnet
Authentication
Key
Enter up to 20 characters. The key must be the same on
both VPN gateways and should only be known by network
administrators.
ddcHH01887d ddcHH01887d
Incoming NAT
Select Incoming NAT if you require Network address
translation for VPN packets.
Select Select
DFL-500 User Manual
55