Digi TransPort LR54, Руководство пользователя

Страница: 455 / 1113

Virtual Private Networks (VPN) IPsec
LR54 User Guide 455
n
rfc822 : The ID will be interpreted as an RFC822 (email address).
Set the ID in internet email address format:
(config vpn ipsec tunnel ipsec_example)> remote id type rfc822_
id
id
(config vpn ipsec tunnel ipsec_example)>
n
fqdn : The ID will be interpreted as FQDN (Fully Qualified Domain Name) and sent as
an ID_FQDN IKE identity.
n
keyid : The ID will be interpreted as a Key ID and sent as an ID_KEY_ID IKE identity.
Set the key ID:
(config vpn ipsec tunnel ipsec_example)> remote id type keyid_id
id
(config vpn ipsec tunnel ipsec_example)>
n
mac_address : The device's MAC address will be used for the Key ID and sent as an
ID_KEY_ID IKE identity.
n
serial_number : The ID device's serial number will be used for the Key ID and sent
as an ID_KEY_ID IKE identity.
15. Configure IKE settings:
a. Set the IKE version:
(config vpn ipsec tunnel ipsec_example)> ike version value
(config vpn ipsec tunnel ipsec_example)>
where value is either ikev1 or ikev2 . This setting must match the peer's IKE version.
b. Determine whether the device should initiate the key exchange, rather than waiting for an
incoming request. By default, the device will initiate the key exchange. This must be
disabled if
remote hostname is set to any . To disable:
(config vpn ipsec tunnel ipsec_example)> ike initiate false
(config vpn ipsec tunnel ipsec_example)>
c. Set the IKE phase 1 mode:
(config vpn ipsec tunnel ipsec_example)> ike mode value
(config vpn ipsec tunnel ipsec_example)>
where value is either aggressive or main .
d. Set the IKE fragmentation:
(config vpn ipsec tunnel ipsec_example)> ike fragmentation value
(config vpn ipsec tunnel ipsec_example)>
where value is one of:
n
if_supported : Send oversized IKE messages in fragments, if the peer supports
receiving them.
n
always : Always send IKEv1 messages in fragments. For IKEv2, this option is
equivalent to if supported .