Functions
EBW-E100
64
In order to assign a descriptive name to the loaded tunnel, enter it into
the field "Tunnel name". This makes the assignment of messages in the
log or status view easier.
In order to specify the remote terminal, to which the tunnel is to be
established, enter the IP address or the domain name of the remote
terminal into the field "IP address or domain name of remote site". If no
remote terminal is specified, incoming connection requests from all
remote terminals are accepted, but no connection can be initiated. In this
case, the "Action on dead peer" of the dead peer detection must be set
to "hold", since no new incoming connection request can be accepted
any more in case the existing connection has been terminated.
In order to define a network behind the switch of the EBW-E100 to be
tunnelled, enter this network with according netmask into the field
"Local subnet". This does not have to be the actual local subnet, but can
also be behind further gateways. In such a case it must be observed that
the required routing rules are entered correctly. If this field is not
completed, the local subnet is used automatically.
In order to define the local subnet behind the remote terminal, enter this
network with according netmask into the field "Remote subnet". Only
data, which is addressed to this network, is packed in ESP packets.
In order to specify the ID of the remote terminal, enter it into the field
"Remote ID". The respective IP address is used as ID by default. If the
actual IP address differs from the received ID (e.g. due to NAT routers in
between) or is unknown, the ID of the remote terminal can be specified
explicitly (a self-defined string, which must contain an "@"). When using
certificates, the DN (Distinguished Name) is used as ID by default. The
domain name of the remote terminal can also be used as ID, because it is
resolved by a DNS lookup.
In order to adjust the own ID, enter it into the field "Local ID". This is only
necessary, if the default ID can or shall not be used.
In order to permit only a certain protocol and a certain port for the local
tunnel end, enter the IANA protocol number and the port (if the protocol
supports ports) into the fields "Local protocol and port". If protocol
and/or port are not specified here, all protocols or ports are permitted.
In order to permit only a certain protocol and a certain port for the
remote tunnel end, enter the IANA protocol number and the port (if the
protocol supports ports) into the fields "Remote protocol and port". If
protocol and/or port are not specified here, all protocols or ports are
permitted.
In order to specify the authentication mode, select it in the drop-down
list "Authentication mode". The main mode is more secure, because all
authentication data is transmitted encrypted. The aggressive mode is
quicker, because it does not use encryption and the authentication is
preformed via a passphrase.
