Wieland wienet v3, Руководство пользователя

Страница: 50 / 95

Contents of Package
51
Wieland Electric GmbH | BA001039 (Rev. A) | 08/2016
5.11 IPsec Tunnel Configuration
IPsec tunnel configuration can be called up by option IPsec item in the menu. IPsec tunnel allows pro-
tected (encrypted) connection of two networks LAN to the one which looks like one homogenous. In the
IPsec Tunnels Configuration window are four rows, each row for one configured one IPsec tunnel.
Item Description
Create This item enables the individual tunnels.
Description The name of the tunnel specified in the configuration of the tunnel.
Edit Configuration IPsec tunnel.
Overview IPsec tunnels
Item Description
Description Name (description) of the tunnel
Remote IP Address IP address of remote side of the tunnel. Domain name possible.
Remote ID Identifier (ID) of remote side of the tunnel. It consists of two parts:
hostname
and
domain-name
(more information under the table).
Remote Subnet IP address of a network behind remote side of the tunnel
Remote Subnet Mask Subnet mask of a network behind remote side of the tunnel
Remote Protocol/Port
Specifies Protocol/Port of remote side of the tunnel. The general form is
pro-
tocol/port
, for example 17/1701 for UDP (protocol 17) and port 1701. Enter-
ing protocol number only is possible, above mentioned format is preferred.
Local ID Identifier (ID) of local side of the tunnel. It consists of two parts: hostname
and domain-name (more information under the table).
Local Subnet IP address of a local network
Local Subnet Mask Subnet mask of a local network
Local Protocol/Port Specifies Protocol/Port of a local network. The general form is protocol/port ,
for example 17/1701 for UDP (protocol 17) and port 1701. Entering protocol
number only is possible, above mentioned format is preferred.
Encapsulation Mode IPsec mode (the method of encapsulation) – choose tunnel (entire IP data-
gram is encapsulated) or transport (only IP header).
NAT traversal If address translation is used between two end points of the tunnel, it needs
to enable
NAT Traversal
.
IKE Mode Defines mode for establishing connection (
main or aggressive
). If the aggres-
sive mode is selected, establishing of IPsec tunnel will be faster, but encryp-
tion will set permanently on 3DES-MD5. We recommend not to use ag-
gressive mode due to a lower security!
IKE Algorithm Way of algorithm selection:
•
auto – encryption and hash alg. are selected automatically
•
manual – encryption and hash alg. are defined by the user
IKE Encryption Encryption algorithm – 3DES, AES128, AES192, AES256
IKE Hash Hash algorithm – MD5, SHA1, SHA256, SHA384 or SHA512
IKE DH Group Diffie-Hellman groups determine the strength of the key used in the key ex-
change process. Higher group numbers are more secure, but require addi-
tional time to compute the key. Group with higher number provides more se-
curity, but requires more processing time.