Digi Connect IT 16, Руководство пользователя

Страница: 236 / 756

Virtual Private Networks (VPN) IPsec
Digi Connect IT® 16/48 User Guide 236
n
IKE configuration items
l
The IKE version, either IKEv1 or IKEv2.
l
Whether to initiate a key exchange or wait for an incoming request.
l
The IKE mode, either main aggressive.
l
The IKE authentication protocol to use for the IPsec tunnel negotiation during phase 1 and
phase 2.
l
The IKE encryption protocol to use for the IPsec tunnel negotiation during phase 1 and
phase 2.
l
The IKE Diffie-Hellman group to use for the IPsec tunnel negotiation during phase 1 and
phase 2.
n
Enable dead peer detection and configure the delay and timeout.
n
Destination networks that require source NAT.
n
Active recovery configuration. See Configure SureLink active recovery for IPsec for information
about IPsec active recovery.
Additional configuration items
The following additional configuration settings are not typically configured to get an IPsec tunnel
working, but can be configured as needed:
n
Determine whether the device should use UDP encapsulation even when it does not detect
that NAT is being used.
n
If using IPsec failover, identify the primary tunnel during configuration of the backup tunnel.
n
The Network Address Translation (NAT) keep alive time.
n
The protocol, either Encapsulating Security Payload (ESP) or Authentication Header (AH).
n
The management priority for the IPsec tunnel interface. The active interface with the highest
management priority will have its address reported as the preferred contact address for
central management and direct device access.
n
Enable XAUTH client authentication, and the username and password to be used to
authenticate with the remote peer.
n
Enable Mode-configuration (MODECFG) to receive configuration information, such as the
private IP address, from the remote peer.
n
Disable the padding of IKE packets. This should normally not be done except for compatibility
purposes.
n
Destination networks that require source NAT.
n
Depending on your network and firewall configuration, you may need to add a packet filtering
rule to allow incoming IPsec traffic.
n
Tunnel and key renegotiating
l
The lifetime of the IPsec tunnel before it is renegotiated.
l
The amount of time before the IKE phase 1 lifetime expires.
l
The amount of time before the IKE phase 2 lifetime expires
l
The lifetime margin, a randomizing amount of time before the IPsec tunnel is renegotiated.