QuadroM 32x/8L/26x/12Li/26xi Manual II: Administrator's Guide
Administrator’s Menus
QuadroM 32x/8L/26x/12Li/26xi; (SW Version 5.2.x)
136
The
Local ID
and
Remote ID
text fields may have the
values in one of the formats presented below:
•
IP address
– example: 10.1.19.32.
•
Host name
– example: vpn.epygi.com. This form
requires additional resources to resolve the host
name, therefore it is not recommended to use this
format.
•
@FQDN
– example: @vpn.epygi.com. This form is
considered as a string, and is not being resolved. It is
recommended to use this form for most applications.
•
user@FQDN
- example: [email protected]. This
form is also considered as a string, and is not being
resolved. It has no advantages over the previous form.
Please Note:
The
Local ID
and
Remote ID
values are
mandatory for
RSA
selection and are optional for
Shared
Secret
selection. However, it is recommended to define the
Local ID
and
Remote ID
values for multiple road-warrior
connections.
Fig. II-238: IPSec Connection Wizard - Automatic Keying Settings page
PFS
(Perfect Forward Secrecy) is a procedure of system key exchange, which uses a long-term key and generates short-term keys as is required.
Thus, an attacker who acquires the long-term key can neither read previous messages that they may have captured nor read future ones.
Use IPSec Compression
enables IPSec data compression. This option is displayed only if the IPSec-VPN partner supports it.
The forth page of the
IPSec Connection Wizard
contains
IPSec Connection Properties
which
serve to specify the
members of the IPSec Connection and to set the basic
parameters for encryption.
A group of radio buttons are used with
Dynamic IP/Road
Warrior
and
Static IP/ Remote Gateway
to select if the
remote Quadro (or another VPN gateway device) is
connected to the Internet with a dynamic IP address and is
acting as a
Road Warrior
, or is connected to the Internet
with a fixed IP address and is acting as a
VPN Gateway
.
If
Dynamic IP / RoadWarrior
is selected, the
Remote
Gateway
IP Address
text field will automatically generate
the value “any”, to allow access independent from the
sending IP address.
Selecting
Static IP / Remote Gateway
requires entering
the IP address or the hostname of the remote Quadro (or
another VPN gateway device) in the
Remote Gateway
text
field.
Please Note:
The
Static IP/ Remote Gateway
selection is
not possible if this Gateway is positioned behind NAT,
since the IP-address of the remote gateway is not
reachable directly in this case.
Fig. II-239: IPSec Connection Wizard -IPSec Connection Properties
Quadro <> Remote
Gateway
allows access from the local Quadro to the remote VPN gateway (local subnet and remote subnet are not included).
This includes management access. The checkbox is disabled when “Quadro<>NAT<>[Internet]<>Peer” or “Quadro<>[Internet]<>NAT<>Peer” the is
selected from the
VPN Network Topology
drop down list on the first page of the
IPSec Connection Wizard
.
Local Subnet <> Remote Gateway
allows access from all stations connected to the local network to the remote VPN gateway device (local Quadro
and remote subnet are not included). The checkbox is disabled when “Quadro<>[Internet]<>NAT<>Peer” is selected from the
VPN Network
Topology
drop down list on the first page of the
IPSec Connection Wizard
.
Quadro <> Remote Subnet
allows access from the local Quadro to all stations of the remote LAN (local subnet and remote VPN gateway devices
are not included). The checkbox is disabled when “Quadro<>NAT<>[Internet]<>Peer” is selected from the
VPN Network Topology
drop down list on
the first page of the
IPSec Connection Wizard
.
Local Subnet <> Remote Subnet
allows access from all stations of the local network to all stations of the remote LAN (VPN gateway devices are
not included). In this case, the local and remote subnet IP addresses and subnet masks have to be entered in the corresponding text fields
Local
Subnet IP
and
Remote Subnet IP
.
More than one of the above checkboxes may be selected to specify the desired communication relations.
The
Stop Connection if not successful
checkbox
allows you to stop the IPSec connection attempts if the partner is still unreachable after the
timeout period. If the checkbox is not selected, the system will continue to try to reach the IPSec connection partner.
The
RSA Key Management
sub-page is used to see the current RSA key and to generate a new one. This page contains the following components: