Watchguard Firebox X15, Руководство пользователя

Страница: 196 / 266

Configuring Virtual Private Networks
182 WatchGuard Firebox X Edge
The default settings for Phase 1 are the same for all Firebox X
devices. Many users keep the factory-default settings.
N
OTE
N
OTE
Make sure that the Phase 1 configuration is the same on the two
devices.
To change Phase 1 configuration:
1 Select the negotiation mode from the drop-down list.
N
OTE
N
OTE
You can use Main Mode only when the two devices have static IP
addresses. If any of the devices have external IP addresses that are
dynamically assigned, you must use Aggressive Mode.
2
Enter the local ID and remote ID. Select the ID types— IP
Address or Domain Name —from the drop-down lists. Make sure
this configuration is the same as the configuration on the
remote device.
Note that on the other device, the local ID type and remote ID type are
reversed.
- If your Firebox X Edge or remote VPN device has a static
external IP address, set the local ID type to IP Address . Type
the external IP address of the Edge or device as the local ID.
- If your Firebox X Edge or remote VPN device has a dynamic
external IP address, you must select Aggressive Mode and the
device must use Dynamic DNS. For more information, see
“Registering with the Dynamic DNS Service” on page 81. Set
the local ID type to
Domain Name
. Enter the DynDNS domain
name of the device as the local ID.
N
OTE
N
OTE
If your Edge’s external interface has a private IP address instead of
a public IP address, then your ISP or the Internet access device
connected to the Edge’s external interface (modem or router) does
Network Address Translation (NAT). See the instructions at the end
of this section if your Edge’s external interface has a private IP
address.
3
Select the type of authentication from the Authentication
Algorithm drop-down list.
The options are MD5-HMAC (128-bit authentication) or SHA1-HMAC
(160-bit authentication).