The policy-based method uses data traffic filters to negotiate the IPSec phase 2 SAs. This
allows for a very "fine-grained" filter to be applied to the IP packet, even at the level of the
protocol and the port.
The routing-based method offers various advantages over the policy-based method, e.g.,
NAT/PAT within a tunnel, IPSec in combination with routing protocols and the creation of
VPN backup scenarios. With the routing-based method, the configured or dynamically
learned routes are used to negotiate the IPSec phase 2 SAs. Although this method doe
simplify many configurations, problems may also be caused by competing routes or the
"coarser" filtering of data traffic.
The Additional Traffic Filter parameter fixes this problem. You can apply a "finer" filter,
i.e. you can enter the source IP address or the source port. If a Additional Traffic Filter is
configured, this is used to negotiate the IPSec phase 2 SAs; the route now only determines
which data traffic is to be routed.
If an IP packet does not match the defined Additional Traffic Filter , it is rejected.
If an IP packet meets the requirements in an Additional Traffic Filter , IPSec phase 2 ne-
gotiation begins and data traffic is transferred over the tunnel.
Note
The parameter Additional Traffic Filter is exclusively relevant for the initiator of the
IPSec connection, it is only used for outgoing traffic.
Note
Please note that the phase 2 policies must be configured identically on both of the
IPSec tunnel endpoints.
18.1.1 IPSec Peers
An endpoint of a communication is defined as peer in a computer network. Each peer of-
fers its services and uses the services of other peers.
A list of all configured IPSec Peers is displayed in the VPN->IPSec->IPSec Peers menu.
Teldat GmbH
18 VPN
bintec Rxxx2/RTxxx2
325
