VP-12, VP-12P IP phones. Operation manual
23
•
Local IP Address
– device address for IPSec operation;
•
Local Subnet
together with a
Local Netmask
define a local subnet for creation of network-to-
network or network-to-point topologies;
•
Remote Subnet
together with a
Remote Netmask
define a remote subnet address used for IPSec-
encrypted communication. If the mask value is 255.255.255.255, communication is performed
with a single host. Mask that differs from 255.255.255.255 allows you to define a whole subnet.
Thus, device features allow you to establish 4 network topologies that utilize IPSec traffic
encryption: Point-to-Point, Network-to-Point, Point-to-Network, Network-to-Network;
•
Remote gateway
– gateway used for remote network access;
•
NAT-Traversal IPsec –
NAT-T mode selection. NAT-T (NAT Traversal) encapsulates IPSec traffic
and simultaneously creates UDP packets to be sent correctly by a NAT device. For this purpose,
NAT-T adds an additional UDP header before IPSec packet so it would be processed as an
ordinary UDP packet and the recipient host would not perform any integrity checks. When the
packet arrives to the destination, UDP header is removed and the packet goes further as an
encapsulated IPSec packet. With NAT-T technique you may establish communication between
IPSec clients in secured networks and public IPSec hosts via firewalls. NAT-T operation modes:
•
On
– NAT-T mode is activated only when NAT is detected on the way to the
destination host;
•
Force
– use NAT-T in any case;
•
Off
– disable NAT-T on connection establishment.
The following NAT-T settings are available:
•
NAT-
T
UDP port
– UDP port for packets for IPSec message encapsulation. Default
value is 4500.
•
Interval Between Sending NAT-T Keepalive Packets
, s
– periodic message
transmission interval for UDP connection keepalive on the device performing NAT
functions.
•
Aggressive Mode
– phase 1 operation mode when all the necessary information is
exchanged using three unencrypted packets. In the main mode, the exchange process
involves six unencrypted packets.
•
My Identifier Type
– device identifier type: address, fqdn, keyed, user_fqdn, asn1dn;
•
My Identifier
– device identifier used for identification during phase 1 (fill in, if required). Identifier format
depends on the type.
Phase
1
During the first step (phase), two hosts negotiate on the identification method, encryption algorithm, hash
algorithm and Diffie Hellman group. Also, they identify each other. For phase 1, there are the following settings:
•
Pre-shared Key
– a secret key used by authentication algorithm in phase 1. It is represented by a string
from 8 to 63 characters.
•
IKE Authentication Algorithm
– select an authentication algorithm from the list: MD5, SHA1.
•
IKE Encryption Algorithm
– select an encryption algorithm from the list : DES, 3DES, Blowfish.
•
Diffie Hellman Group
– select an Diffie-Hellman group.
•
IKE SA Lifetime, s
– time that should pass for hosts' mutual re-identification and policy comparison
(other name 'IKE SA lifetime'). Default value is 24 hours (86400 seconds).
