Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Руководство администратора

Страница: 384 / 861

383 Providing remote access using VPN tunnels
Understanding VPN policies
2
In the right pane, on the VPN Policies tab, click New > IPsec static key policy .
3 In the IPsec static key policy Properties dialog box, on the General tab, do the following:
4 On the Data Privacy Preference tab, in the Available list box, select a data privacy algorithm, and
then click the right-arrow
>> button to move it to the Selected list box.
In a static policy, you can select only one data privacy algorithm.
5 On the Data Integrity Preferences tab, in the Available list box, select a data integrity preference,
and then click the right-arrow
>> button to move it to the Selected list box.
This dictates the type of authentication header that is prepended to packets sent through the
tunnel.
6 Click OK .
You will need to reboot the security gateway before the changes to your VPN policy take effect.
7 Optionally, do one of the following:
■
To save your configuration now and activate later, on the toolbar, click Save .
■
To activate your configuration now, on the toolbar, click Activate .
When prompted to save your changes, click Yes .
Policy Name Type a unique name for the VPN policy.
Filter Applied To apply a filter as part of the VPN policy, select it.
Apply firewall rules To proxy tunnel traffic, check Apply firewall rules . Enabling this feature sends the data
packet up the protocol stack for authorization. The packets are then subject to all the
address transforms performed by the proxies in accordance with the configured rules.
Data Integrity
Protocol Select one of the following data integrity protocols:
■
To apply the preference to the data portion of the packet, select Apply integrity
preference to data portion of the packet (ESP).
■
To apply the preference to the entity packet, select Apply integrity preference to
entity packet (AH).
Encapsulation Mode Select either Tunnel mode or Transport mode. You should only select transport mode
when both tunnel endpoints are the same as their gateway addresses. In that case,
using transport mode saves bandwidth.
Caption Type a brief description of the VPN policy.