QX5
QXFXO4/QXISDN4/QXE1T1/QXFXS24; (SW Version 6.0.x)
98
QXFXO4/QXISDN4/QXE1T1/QXFXS24 Manual II: Administrator’s Guide
This device <> Remote
Gateway
allows access from the local QX IP PBX to the remote VPN gateway (local subnet and remote subnet are not included).
This includes management access. The checkbox is disabled when “This device<>NAT<>[Internet]<>Peer” or “This device<>[Internet]<>NAT<>Peer” the
is selected from the
VPN Network Topology
drop down list on the first page of the
IPSec Connection Wizard
.
Local Subnet <> Remote Gateway
allows access from all stations connected to the local network to the remote VPN gateway device (local QX gateway
and remote subnet are not included). The checkbox is disabled when “This device<>[Internet]<>NAT<>Peer” is selected from the
VPN Network
Topology
drop down list on the first page of the
IPSec Connection Wizard
.
This device <> Remote Subnet
allows access from the local QX gateway to all stations of the remote LAN (local subnet and remote VPN gateway devices
are not included). The checkbox is disabled when “This device<>NAT<>[Internet]<>Peer” is selected from the
VPN Network Topology
drop down list on
the first page of the
IPSec Connection Wizard
.
Local Subnet <> Remote Subnet
allows access from all stations of the local network to all stations of the remote LAN (VPN gateway devices are not
included). In this case, the local and remote subnet IP addresses and subnet masks have to be entered in the corresponding text fields
Local Subnet IP
and
Remote Subnet IP
.
More than one of the above checkboxes may be selected to specify the desired communication relations.
The
Stop Connection if not successful
checkbox
allows you to stop the IPSec connection attempts if the partner is still unreachable after the timeout
period. If the checkbox is not selected, the system will continue to try to reach the IPSec connection partner.
To Delete/Stop/Start an IPSec Connection
1.
Select one or more checkboxes of the corresponding connections that should to be deleted/stopped/started from the
Connections
tables.
2.
Click on the
Delete/Stop/Start
button from the table’s menu to perform the corresponding operation for the selected IPSec connection(s).
3.
If deleting, confirm it with pressing on
Yes
. The IPSec connection will be deleted. To abort the deletion and keep the IPSec connection in the list, click
No
.
RSA Key Management
The
RSA Key Management
sub-page is used to see the current RSA key and to generate a new one. This page contains the following components:
The public key is displayed in the
RSA Public Key
text field so
that the user may inform their IPSec connection partner about it,
for example, via fax.
The user has the option of generating a new pair of keys by
specifying the key length with the corresponding radio buttons
Generate a new 1024bit RSA Key
and
Generate a new
2048bit RSA Key
and then clicking the
Generate
Button.
A valid RSA key should fit to following requirements:
•
RSA key doesn't start with "0s"
•
RSA key doesn't end with "=="
•
RSA key contains symbols other than Alphanum, +, /,
=
The
Email this to the peer
text field requires the mailing
address of the IPSec connection partner. The
Send
button will
insert QX gateway’s public RSA key into an e-mail and send it to
the IPSec connection partner.
Fig.II- 150: IPSec Configuration - RSA Key Management page
PPTP/L2TP Configuration
PPTP
(
P
oint-to-
P
oint
T
unneling
P
rotocol) is used to establish a virtual private network (VPN) over the Internet. Remote users can access their corporate
networks via any ISP that supports PPTP on its servers. PPTP encapsulates any type of network protocol (IP, IPX, etc.) and transports it over IP. Therefore,
if IP is the original protocol, IP packets ride as encrypted messages inside PPTP packets running over IP. PPTP is based on point-to-point protocol (PPP)
and the Generic Routing Encapsulation (GRE) protocol. Encryption is performed by Microsoft's Point-to-Point Encryption (MPPE), which is based on RC4.
L2TP (L
ayer
2
T
unneling
P
rotocol) is a protocol from the IETF, which allows a PPP session to run over the Internet, an ATM, or frame relay network. L2TP
does not include encryption (as does PPTP), but defaults to using IPSec in order to provide virtual private network (VPN) connections from remote users
to the corporate LAN. Derived from Microsoft's Point-to-Point Tunneling Protocol (PPTP) and Cisco's Layer 2 Forwarding (L2F) technology, L2TP
encapsulates PPP frames into IP packets either at the remote user's PC or at an ISP that has an L2TP remote access concentrator (LAC). The LAC transmits
the L2TP packets over the network to the L2TP network server (LNS) at the corporate side. Large carriers also may use L2TP to offer remote POPs to
smaller ISPs. Users at the remote locations dial into the modem pool of an L2TP access concentrator, which forwards the L2TP traffic over the Internet or
private network to the L2TP servers at the ISP side, which then sends them on to the Internet.
For
PPTP
and
L2TP Connections
,
two parties are required: a
Client
and a
Server
. The client is responsible for establishing the connection. The server is
waiting for clients, it is not able to initiate the connection itself.
Attention:
L2TP tunnels have no data encryption mechanism.
