Digi IX14, Руководство пользователя

Страница: 534 / 828

Virtual Private Networks (VPN) IPsec
IX14 User Guide 534
12. Select the Mode, either:
n
Tunnel mode : The entire IP packet is encrypted and/or authenticated and then
encapsulated as the payload in a new IP packet.
n
Transport mode : Only the payload of the IP packet is encrypted and/or authenticated.
The IP header is unencrypted.
13. Select the Protocol , either:
n
ESP (Encapsulating Security Payload): Provides encryption as well as authentication
and integrity.
n
AH (Authentication Header): Provides authentication and integrity only.
14. Click to expand Authentication .
a. For Authentication type , select one of the following:
n
Pre-shared key : Uses a pre-shared key (PSK) to authenticate with the remote peer.
i. Type the Pre-shared key .
n
Asymmetric pre-shared keys : Uses asymmetric pre-shared keys to authenticate
with the remote peer.
i. For Local key , type the local pre-shared key. This must be the same as the
remote key on the remote host.
ii. For Remote key , type the remote pre-shared key. This must be the same as
the local key on the remote host.
n
RSA signature : Uses a private RSA key to authenticate with the remote peer.
i. For Private key , paste the device's private RSA key in PEM format.
ii. Type the Private key passphrase that is used to decrypt the private key.
Leave blank if the private key is not encrypted.
iii. For Peer public key , paste the peer's public RSA key in PEM format.
n SCEP certificates : Uses Simple Certificate Enrollment Protocol (SCEP) to download
a private key, certificates, and an optional Certificate Revocation List (CRL) to the
IX14 device from a SCEP server.
You must create the SCEP client prior to configuring the IPsec tunnel. See Configure
a Simple Certificate Enrollment Protocol client for instructions.
i. For SCEP Client , select the SCEP client.
n
X.509 certificate : Uses private key and X.509 certificates to authenticate with the
remote peer.
i. For Private key , paste the device's private RSA key in PEM format.
ii. Type the Private key passphrase that is used to decrypt the private key.
Leave blank if the private key is not encrypted.
iii. For Certificate , paste the local X.509 certificate in PEM format.