InHand InGateway502, Руководство пользователя

Страница: 93 / 107

89
•
Transport Mode: inserts an IPsec header (AH or ESP) between the IP header
and upper-layer protocol header. This mode retains the original IP header but
changes the IP protocol field to AH or ESP, and calculates a new checksum for
the IP header. The transport mode is applicable to communication between two
hosts or between a host and a security gateway.
•
IPsec Tunnels
o
Basic Parameters
•
Destination Address: specifies the IP address or domain name of the
IKE peer. (Set this parameter to 0.0.0.0 when the IG902 acts as a
server.)
•
Map Interface: specifies the interface to which the IPsec policy is
applied.
•
IKE Version: specifies the version of the IKE protocol. Options are
IKEv1 and IKEv2.
•
IKEv1 Policy: specifies a policy ID defined in the IKEv1 policy list.
•
IKEv2 Policy: specifies a policy ID defined in the IKEv2 policy list.
•
IPsec Policy: specifies a policy ID defined in the IPsec policy list.
•
Authentication Type: specifies the authentication method used
for the IPsec tunnel. Shared key authentication and digital
certificate authentication are supported.
•
Shared Key: specifies the shared key used for
authentication.
•
Digital Certificate: specifies the digital certificate used for authentication. You
need to import a valid certificate on the certificate management page.
▪
Negotiation Mode: specifies the mode of IKEv1 negotiation.
•
Main Mode: separates key exchange information from the identity information.
This mode protects identity information to enhance the security.
•
Aggressive Mode: does not provide identity authentication but meets
requirements of some special network environments. The aggressive mode
can be used when the address of the tunnel initiator cannot be obtained in
advance or keeps changing, but both parties want to establish an IKE SA by
using a pre-shared key.
▪
Local Subnet: specifies the source network of the interested flow defined for
the IPsec tunnel.
▪
Remote Subnet: specifies the destination network of the interested flow defined
for the IPsec tunnel.