Field
Description
Additional Traffic Filter Only for Internet Key Exchange =
?4
Use Add to create a new filter.
Additional data traffic filters
bintec elmeg Gateways support two different methods for establishing IPSec connec-
tions:
• a method based on policies and
• a method based on routing.
The policy-based method uses data traffic filters to negotiate the IPSec phase 2 SAs. This
enables the filtering of the IP packets to be very "fine grained" down to protocol and port
level.
The routing-based method offers various advantages over the policy-based method, e.g.,
NAT/PAT within a tunnel, IPSec in combination with routing protocols and the creation of
VPN backup scenarios. With the routing-based method, the configured or dynamically
learned routes are used to negotiate the IPSec phase 2 SAs. While it is true that this
method simplifies many configurations, at the same time there can be problems due to
competing routes or the "coarser" filtering of the data traffic.
The Additional Traffic Filter parameter fixes this problem. You can filter more "finely", i.
e. you can, e. g., specify the source IP address or the source port. If there is a Additional
Traffic Filter configured, it is used to negotiate the IPSec phase 2 SAs; the route only de-
termines which data traffic is to be routed.
If an IP packet does not match the defined Additional Traffic Filter it is discarded.
If an IP packet meets the requirements in an Additional Traffic Filter , IPSec phase 2 ne-
gotiation begins and data traffic is transferred over the tunnel.
Note
The parameter Additional Traffic Filter is only relevant to the initiator of the
IPSec connection, it only applies to outgoing data traffic.
Note
Please note that the phase 2 policies must be configured identically on both
of the IPSec tunnel endpoints.
Gigaset Communications GmbH
13 VPN
hybird 120 Gigaset Edition
257
