3. CONFIGURATION
Continued from previous page
Item
Description
CA Certificate
Certificate for X.509 authentication.
Remote Certificate
Certificate for X.509 authentication.
Local Certificate
Certificate for X.509 authentication.
Local Private Key
Private key for X.509 authentication.
Local Passphrase
Passphrase used during private key generation.
Extra Options
Specifies the additional parameters of the IPsec tunnel for exam-
ple, secure parameters.
Table 40: IPsec Tunnel Configuration
The IPsec function supports the following types of identifiers (ID) for both sides of the
tunnel,
Remote ID
and
Local ID
parameters:
•
IP address (for example, 192.168.1.1)
•
DN (for example, C=CZ,O=Conel,OU=TP,CN=A)
•
FQDN (for example, @director.conel.cz) –
the @ symbol proceeds the FQDN.
•
User FQDN (for example, [email protected])
The certificates and private keys have to be in the PEM format. Use only certificates containing
start and stop tags.
The random time, after which the router re-exchanges new keys is defined as follows:
Lifetime - (Rekey random value in range (from 0 to Rekey margin * Rekey Fuzz/100))
The default exchange of keys is in the following time range:
•
Minimal time: 1h - (9m + 9m) = 42m
•
Maximal time: 1h - (9m + 0m) = 51m
We recommend that you maintain the default settings. When you set key exchange times
higher, the tunnel produces lower operating costs, but the setting also provides less security.
Conversely, when you reducing the time, the tunnel produces higher operating costs, but
provides for higher security.
The changes in settings will apply after clicking the
Apply
button.
63
09-05-16
LUCOM GmbH * Ansbacher Str. 2a * 90513 Zirndorf * Tel. 09127/59 460-10 * Fax. 09127/59 460-20 * www.lucom.de
w
w
w
.luco
m.d
e
inf
o@lucom
.de