semaphore TBOX LT2-530 Series, Руководство пользователя, Страница: 102 / 197

Version : 1.09 102
11. IP Security
IP security services are:

VPN

Firewall (must be activated from the RTU properties -> IP security)
11.1. VPN
11.1.1. Introduction
This feature provides secure connections using OpenVPN.
OpenVPN version used: 2.3.0-1.
TB
OX
LT2
can be configured as "Client" or "Server" in mode routing.
Any physical media can be used (Ethernet, 3G). The VPN connection represents a new communication
port, including its communication variables.
As we have “COM3-Ethernet" or COM4-3G", we have new com. port(s) "VPN".
It supports site-to-site type of VPN.
11.1.2. How does OpenVPN work ?
Asymmetric authentication
Asymmetric authentication uses a pair of keys:
- the public key
- the private key, not known by anybody.
When "Client" connects to the server, they exchange their certificate, which are checked using the CA
certificate.
Each party receives the other one certificate, it checks whether the certificate is signed by the master
root certificate as specified in its CA certificate.
If the verification succeeds, the symmetric key (DH key) is exchanged between parties.
This asymmetric mechanism allows keeping this symmetric key secret.
Each partner is now able to encrypt data and the VPN tunnel is up.
Symmetric encryption
Once parties have authenticated each other, meaning the VPN is up and secured, each client uses the
symmetric key (DH key) to encrypt and decrypt data.
Symmetric encryption highly improves time performance of communication.