The routing-based method offers various advantages over the policy-based method, e.g.,
NAT/PAT within a tunnel, IPSec in combination with routing protocols and the creation of
VPN backup scenarios. With the routing-based method, the configured or dynamically
learned routes are used to negotiate the IPSec phase 2 SAs. Although this method doe
simplify many configurations, problems may also be caused by competing routes or the
"coarser" filtering of data traffic.
The Additional Traffic Filter parameter fixes this problem. You can apply a "finer" filter,
i.e. you can enter the source IP address or the source port. If a Additional Traffic Filter
is configured, this is used to negotiate the IPSec phase 2 SAs; the route now only determ-
ines which data traffic is to be routed.
If an IP packet does not match the defined Additional Traffic Filter , it is rejected.
If an IP packet meets the requirements in an Additional Traffic Filter , IPSec phase 2 ne-
gotiation begins and data traffic is transferred over the tunnel.
Note
The parameter Additional Traffic Filter is exclusively relevant for the initiat-
or of the IPSec connection, it is only used for outgoing traffic.
Note
Please note that the phase 2 policies must be configured identically on both
of the IPSec tunnel endpoints.
13.1.1 IPSec Peers
An endpoint of a communication is defined as peer in a computer network. Each peer of-
fers its services and uses the services of other peers.
A list of all configured IPSec Peers is displayed in the VPN->IPSec->IPSec Peers menu.
Peer Monitoring
The menu for monitoring a peer is called by selecting the
button for the peer in the
peer list. See
Values in the IPSec Tunnels list
on page 391.
13 VPN
Gigaset Communications GmbH
252
hybird 120 Gigaset Edition