Digi Connect IT 16, Руководство пользователя

Страница: 235 / 756

Virtual Private Networks (VPN) IPsec
Digi Connect IT® 16/48 User Guide 235
Aggressive mode is usually used when one or both of the devices have a dynamic external IP
address.
Phase 2
In phase 2, IKE negotiates the SAs for IPsec. This creates two unidirectional SAs, one for each
direction. Once the phase 2 negotiation is complete, the IPsec tunnel should be fully functional.
IPsec and IKE renegotiation
To reduce the chances of an IPsec tunnel being compromised, the IPsec SAs and IKE SA are
renegotiated at a regular interval. This results in different encryption keys being used in the IPsec
tunnel.
Authentication
Client authenticaton
XAUTH (extended authentication) pre-shared key authentication mode provides additional security by
using client authentication credentials in addition to the standard pre-shared key. The Connect IT
16/48 device can be configured to authenticate with the remote peer as an XAUTH client.
RSA Signatures
With RSA signatures authentication, the Connect IT 16/48 device uses a private RSA key to
authenticate with a remote peer that is using a corresponding public key.
Certificate-based Authentication
X.509 certificate-based authentication makes use of private keys on both the server and client which
are secured and never shared. Both the server and client have a certificate which is generated with
their respective private key and signed by a Certificate Authority (CA).
The Connect IT 16/48 implementation of IPsec can be configured to use X.509 certificate-based
authentication using the private keys and certificates, along with a root CA certificate from the
signing authority and, if available, a Certificate Revocation List (CRL).
Configure an IPsec tunnel
Configuring an IPsec tunnel with a remote device involves configuring the following items:
Required configuration items
n
IPsec tunnel configuration items:
l
The mode: either tunnel or transport.
l
Enable the IPsec tunnel.
The IPsec tunnel is enabled by default.
l
The firewall zone of the IPsec tunnel.
l
The routing metric for routes associated with this IPsec tunnel.
l
The authentication type and pre-shared key or other applicable keys and certificates.
l
The local endpoint type and ID values, and the remote endpoint host and ID values.