RACOM M!DGE3, Руководство пользователя

Страница: 111 / 183

There can be a maximum of 16 active CHILD SA (in total over all Active IKE SA).
Every "Active" line must have an equivalent on the peer side with reversed "Local network..." and
"Remote network..." fields.
"Local network..." and "Remote network..." fields must contain different address ranges and must
not interfere with the USB service connection (10.9.8.7/28) or internal connection to FPGA
(192.0.2.233/30).
Each "Active" Traffic selector in the configuration table must be unique.
7.4.1.1. IPsec settings
Make-before-break
{On; Off}, default = "Off"
This parameter is valid for all IKE SA using IKEv2 with re-authentication. A temporary connection
breaks during IKE_SA re-authentication is suppressed by this parameter. This function may not
operate correctly with some IPsec implementations (on peer side).
7.4.1.2. IPsec associations
To further configure IPsec VPN tunnel, click the Add VPN configuration button.
Add / Edit IPsec VPN tunnel associations
Every item in the table represents one IKE SA. There can be a maximum of 8 active IKE SA (limited
by system resources).
Start state
List box {Passive; On demand; Start}, default = "Passive"
MOBIKE
List box {On; Off}, default = "On"
Enables MOBIKE for IKEv2 supporting mobility or migration of the tunnels. Please note IKE is
moved from port 500 to port 4500 when MOBIKE is enabled. The peer configuration must match.
It is strongly recommended to use MOBIKE mode in case of routing the traffic over the Cellular
interface.
Dead Peer Detection
List box {On; Off}, default = "On"
Detection of lost connection with the peer. IKE test packets are sent periodically. When packets
are not acknowledged after several attempts, the connection is closed (corresponding actions
are initialized). In the case when Detection is not enabled, a connection loss is discovered when
regular key exchange process is initiated.
111 © RACOM s.r.o. – M!DGE3 Cellular Router
Settings