D-Link DSR-Series User Manual
110
Section 7 - VPN
3. Once the tunnel type and endpoints of the tunnel are defined you can determine the Phase 1/ Phase
2 negotiation to use for the tunnel. This is covered in the IPsec mode setting, as the policy can be
Manual or Auto. For Auto policies, the Internet Key Exchange (IKE) protocol dynamically exchanges
keys between two IPsec hosts. The Phase 1 IKE parameters are used to define the tunnel’s security
association details.
The Phase 2 Auto policy parameters cover the security association lifetime and encryption/authentication
details of the phase 2 key negotiation.
The VPN policy is one half of the IKE/VPN policy pair required to establish an Auto IPsec VPN tunnel. The
IP addresses of the machine or machines on the two VPN endpoints are configured here, along with
the policy parameters required to secure the tunnel.
Local IP/Remote IP
Select the type of identifier that you want to provide for the endpoint:
•
Any:
Specifies that the policy is for traffic from the given end point (local or remote). Note that
selecting Any for both local and remote end points is not valid.
•
Single:
Limits the policy to one host. Enter the IP address of the host that will be part of the VPN.
•
Range:
Allows computers within an IP address range to connect to the VPN. Enter the Start IP Address
and End IP Address in the provided fields.
•
Subnet:
Allows an entire subnet to connect to the VPN. Enter the network address and subnet mask
in the provided fields.
Enable Keepalive
Toggle to
ON
to periodically send ping packets to the host on the peer side of the network to keep the
tunnel alive.
