Cisco Systems RVL200 manual IPSec Setup, IKE with Preshared Key

Page 46

Chapter 4

Advanced Configuration

Subnet

The default is Subnet. All computers on the remote subnet will be able to access the tunnel.

IP address  Enter the IP address.

Subnet Mask  Enter the subnet mask. The default is 255.255.255.0.

IP Range

Specify a range of IP addresses within a subnet that will be able to access the tunnel.

IP range  Enter the range of IP addresses.

IPSec Setup

In order for any encryption to occur, the two ends of a VPN tunnel must agree on the methods of encryption, decryption, and authentication. This is done by sharing a key to the encryption code. For key management, the default mode is IKE with Preshared Key.

Keying Mode  Select IKE with Preshared Key or Manual. Both ends of a VPN tunnel must use the same mode of key management. After you have selected the mode, the settings available on this screen may change, depending on the selection you have made. Follow the instructions for the mode you want to use.

IKE with Preshared Key

IKE is an Internet Key Exchange protocol used to negotiate key material for Security Association (SA). IKE uses the Preshared Key to authenticate the remote IKE peer.

Phase 1 DH Group  Phase 1 is used to create the SA. DH (Diffie-Hellman) is a key exchange protocol used during Phase 1 of the authentication process to establish pre- shared keys. There are three groups of different prime key lengths. Group 1 is 768 bits, and Group 2 is 1,024 bits. Group 5 is 1,536 bits. If network speed is preferred, select Group 1. If network security is preferred, select Group 5.

Phase 1 Encryption  Select a method of encryption: DES (56-bit), 3DES (168-bit), AES-128(128-bit), AES-192(192- bit), or AES-256(256-bit). The method determines the length of the key used to encrypt or decrypt ESP packets. AES-256 is recommended because it is the most secure. Make sure both ends of the VPN tunnel use the same encryption method.

Phase 1 Authentication  Select a method of authentication, MD5 or SHA. The authentication method determines how the ESP packets are validated. MD5 is a one-way hashing algorithm that produces a 128-bit digest. SHA is a one-way hashing algorithm that produces a 160-bit digest. SHA is recommended because it is more secure. Make sure both ends of the VPN tunnel use the same authentication method.

Phase 1 SA Life Time  Configure the length of time a VPN tunnel is active in Phase 1. The default value is 28800 seconds.

Perfect Forward Secrecy  If the Perfect Forward Secrecy (PFS) feature is enabled, IKE Phase 2 negotiation will generate new key material for IP traffic encryption and authentication, so hackers using brute force to break encryption keys will not be able to obtain future IPSec keys.

Phase 2 DH Group  If the Perfect Forward Secrecy feature is disabled, then no new keys will be generated, so you do not need to set the Phase 2 DH Group (the key for Phase 2 will match the key in Phase 1).

There are three groups of different prime key lengths. Group 1 is 768 bits, and Group 2 is 1,024 bits. Group 5 is 1,536 bits. If network speed is preferred, select Group 1. If network security is preferred, select Group 5. You do not have to use the same DH Group that you used for Phase 1.

Phase 2 Encryption  Phase 2 is used to create one or more IPSec SAs, which are then used to key IPSec sessions. Select a method of encryption: NULL, ES (56-bit), 3DES (168-bit), AES-128(128-bit), AES-192(192-bit), or AES- 256 (256-bit). It determines the length of the key used to encrypt or decrypt ESP packets. AES-256 is recommended because it is the most secure. Both ends of the VPN tunnel must use the same Phase 2 Encryption setting.

Phase 2 Authentication  Select a method of authentication, NULL, MD5, or SHA. The authentication method determines how the ESP packets are validated. MD5 is a one-way hashing algorithm that produces a 128-bit digest. SHA is a one-way hashing algorithm that produces a 160-bit digest. SHA is recommended because it is more secure. Both ends of the VPN tunnel must use the same Phase 2 Authentication setting.

Phase 2 SA Life Time  Configure the length of time a VPN tunnel is active in Phase 2. The default is 3600 seconds.

Preshared Key  This specifies the pre-shared key used to authenticate the remote IKE peer. Enter a key of keyboard and hexadecimal characters, e.g., My_@123 or 4d795f40313233. This field allows a maximum of 30 characters and/or hexadecimal values. Both ends of the VPN tunnel must use the same Preshared Key. It is strongly recommended that you change the Preshared Key periodically to maximize VPN security.

Manual

If you select Manual, you generate the key yourself, and no key negotiation is needed. Manual key management is used in small static environments or for troubleshooting purposes.

4-Port SSL/IPSec VPN Router

38

Page 45 Page 47
Image 46
Page 45 Page 47
Contents Port SSL/IPSec VPN Router About This Guide About This GuideTable of Contents Ddns IPSec VPN Gateway to Gateway Appendix D Active Directory Server Appendix C Bandwidth ManagementAppendix E User for the Active Directory Server Appendix J IPSec NAT Traversal Appendix I Gateway-to-Gateway VPN TunnelAppendix L Multiple VLANs with Computers Appendix Q Specifications Appendix O Firmware UpgradeAppendix P Battery Replacement Appendix M Multiple VLANs and SubnetsIntroduction ChapterChapter Introduction Introduction to the RouterComputer using SSL VPN client software to VPN Router Front Panel Chapter Product OverviewProduct Overview Back PanelInstallation Chapter InstallationPhysical Installation Cable Connection Overview Chapter Advanced ConfigurationAdvanced Configuration Before You BeginHow to Access the Web-Based Utility Click Security Select Use SSL 2.0 and Use SSLSystem Summary System InformationIPSec VPN Setting Status Network Setting StatusFirewall Setting Status SSL VPN Setting StatusNetwork Setup Tab NetworkLAN Setting WAN Connection TypeStatic IP PPPoE Point-to-Point Protocol over EthernetSetup Password Pptp Point-to-Point Tunneling ProtocolPassword Setup TimeSetup DMZ Host TimePort Range Forwarding Setup Tab ForwardingForwarding Port TriggeringSetup UPnP UPnPSetup MAC Clone Setup One-to-One NATOne-to-One NAT MAC Clone Setup DdnsSetup Advanced Routing Advanced RoutingDhcp Setup Static RoutingDynamic IP SetupStatic IP Dhcp Multiple VLANs Dhcp StatusStatus Multiple VLANsDhcp Inter-VLAN Routing System Management DiagnosticDiagnostic Inter-VLAN RoutingSystem Management Restart Factory DefaultFirmware Upgrade Firmware DownloadSystem Management Port Mirroring Import Configuration FileExport Configuration File RestartPort Management Port Status Port Management Port SetupBasic Per Port Config Port StatusPort Management Create Vlan Port Management Port SettingPort Setting Create VlanVlan Membership QoS Bandwidth ManagementBandwidth Management Rate Control PriorityQoS Mode QoS QoS SetupQoS Setup Trust Mode Default CoSQueue Settings QoS Queue SettingsQoS Dscp Settings CoS SettingsGeneral Dscp SettingsFirewall General Dscp to QueueAccess Rules Firewall Access RulesRestrict WEB Features Add a New Access Rule ServicesScheduling Firewall Content FilterContent Filter IP/MAC GroupWebsite Blocking by Keywords IPSec VPN SummaryForbidden Domains IP AddressSummary Local Group SetupIPSec VPN Gateway to Gateway Add a New TunnelLocal Security Group Type Remote Group SetupRemote Security Gateway Type Remote Security Group Type IPSec Setup IKE with Preshared KeyAdvanced SSL VPN Certificate Management IPSec VPN VPN Pass ThroughSSL VPN Summary VPN Pass ThroughUser Management Authentication TypeSSL VPN User Management Edit GroupSSL VPN Virtual Passage Edit UserVirtual Passage Snmp Global ParametersGlobal Parameters Views Snmp ViewsSnmp Group Profile Group ProfileGroup Membership Snmp Group MembershipSnmp Communities CommunitiesSnmp Notification Recipient Notification RecipientLog System Log System LogAlert Log Log SettingLog System Statistics General LogBasic Setup WizardObtain an IP automatically PPPoEAccess Rule Setup Select the Service Manual SupportLogout Linksys Web SiteLogout Troubleshooting Appendix a TroubleshootingAppendix a Appendix B Virtual Passage SSL VPN Client Appendix BBefore You Begin Windows OS Make the SSL VPN Portal a Trusted Site Windows OS Click Trusted sitesInstallation of the Virtual Passage Client Windows OS Login for the SSL VPN Portal Windows OSWhen you right-click the icon, you have three options Click Continue AnywayLogin for the SSL VPN Portal Mac OS Installation of the Virtual Passage Client Mac OSWindows Vista Usage Removal of the Virtual Passage Client Mac OS Click ContinueLogin for the SSL VPN Portal Linux OS Installation of the Virtual Passage Client Linux OSBefore You Begin Linux OS Removal of the Virtual Passage Client Linux OS Appendix C Bandwidth Management Creation of New ServicesAppendix C Bandwidth ManagementClick Save Settings Creation of New Bandwidth Management RulesAppendix D Active Directory Server Appendix DActive Directory Server Select Domain in a new forest, and then click Next Enter a domain name, and then click Next Active Directory Server Troubleshooting Appendix E Appendix E User for the Active Directory ServerUser for the Active Directory Server Appendix F Internet Authentication Service IAS Server Appendix FInternet Authentication Service IAS Server Select Unencrypted authentication. Click Apply Click Finish Welcome to the New Connection Request Policy Wizard Click Edit Profile Appendix G Click the User Management tabAppendix H Deployment in an Existing Network Select HTTPSTCP/443~443 from the Service drop- down menuAppendix H LAN-to-LAN ConnectionWAN-to-LAN Connection Appendix Gateway-to-Gateway VPN Tunnel Configuration of the RVL200Appendix Click the Gateway to Gateway tabConfiguration of the RV082 Configuration of PC 1 and PCRV082 RVL200 Dynamic IP B.B.B.B with Configuration when Both Gateways Use Dynamic IP Addresses Appendix Appendix J Configuration of ScenarioConfiguration of Router a Appendix J IPSec NAT TraversalConfiguration of Router B IPSec NAT TraversalOne-to-One NAT Rule on NAT 2 RV042 One-to-One NAT Rule on NAT 1 RV042Configuration of Router a Appendix K Configuration of MultipleRVL200-to-RV042 Configuration Appendix KClick Save Setting RV042 #1 ConfigurationClick the Advanced Routing tab RV042 #2 Configuration Appendix L Multiple VLANs with Computers RVL200-to-SRW2048 ConfigurationAppendix L Click the Port Management tabSelect Enable Vlan SRW2048 ConfigurationClick Save Settings Click the Vlan Membership tab Appendix M RVL200 ConfigurationAppendix M Multiple VLANsInter-VLAN Routing Option Click the Inter-VLAN Routing tabAppendix N Access of Multiple VLANsAppendix N Over a SSL VPN TunnelFirmware Upgrade Appendix O Firmware UpgradeAppendix O Upgrade the Firmware Click the Firmware Upgrade tabReplace the Lithium Battery Appendix P Battery ReplacementBattery Replacement Appendix PSpecifications Appendix Q SpecificationsAppendix Q Limited Warranty Warranty InformationAppendix R Appendix S Regulatory InformationDansk Danish Miljøinformation for kunder i EU Port SSL/IPSec VPN Router 106 Norsk Norwegian Miljøinformasjon for kunder i EU Port SSL/IPSec VPN Router 108 Appendix T Contact Information
Top Page Image Contents