Eicon Networks SHIVA 1100, Руководство администратора, Страница: 77 / 136

IPSec
System Administrator’s Guide 77
5. Select the type of keying the tunnel will use. The Shiva VPN Gateway supports
the following types of keying:
• Main mode with Automatic Keying (IKE) automatically exchanges encryption
and authentication keys and protects the identities of the parties attempting
to establish the tunnel.
• Aggressive mode with Automatic Keying (IKE) automatically exchanges
encryption and authentication keys and uses less messages in the exchange
when compared to Main mode. Aggressive mode is must be used to allow
parties that are configured with a dynamic IP address and a preshared secret
to connect or if the Shiva VPN Gateway or the remote party is behind a NAT
device.
• Manual Keying requires the encryption and authentication keys to be
specified.
For this example, select the Aggressive mode with Automatic Keying option.
6. Select the type of IPSec endpoint the remote party has. The remote endpoint can
have a static IP address, dynamic IP address or a DNS hostname address. For
this example, select the static IP address option.
7. Select the type of authentication the tunnel will use. The Shiva VPN Gateway
supports the following types of authentication:
• Preshared Secret is a common secret (passphrase) that is shared between
the Shiva VPN Gateway and the remote party.
• RSA Digital Signatures uses a public/private RSA key pair for authentication.
The Shiva VPN Gateway can generate these key pairs. The public keys
need to be exchanged between the Shiva VPN Gateway and the remote
party in order to configure the tunnel.
• X.509 Certificates are used to authenticate the remote party against a
Certificate Authority's (CA) certificate. The CA certificate must have signed
the local certificates that are used for tunnel authentication. Certificates need
to be uploaded to the Shiva VPN Gateway before a tunnel can be configured
to use them (see Certificate Management).
• Manual Keys establishes the tunnel using predetermined encryption and
authentication keys.
For this example, select the Preshared Secret option.
8. Select the type of private network that is behind the Shiva VPN Gateway. The
following types of networks are supported:
• Single network is selected when a single subnet resides behind the Shiva
VPN Gateway that the remote party will have access to.
• Multiple networks is selected when multiple subnets reside behind the Shiva
VPN Gateway that the remote party will have access to.
• Masqueraded network is selected when all traffic behind the Shiva VPN
Gateway is seen as originating from its Internet IP address by the remote
party. The remote party will not have any access to the network behind the
Shiva VPN Gateway.
For this example, select the single network behind this Shiva Gateway option.