FVS338 ProSafe VPN Firewall 50 Re ference Manual
5-6 Virtual Private Networking
v1.0, March 2008
In addition, a CA (Certificate Authority) can also be used to perform authentication (see
“Certificates” on page 5-33). To use a CA, each VPN Gateway must have a Certificate from the
CA. For each Certificate, there is both a “Public Key” and a “Private Key”. The “Public Key” is
freely distributed, and is used to encrypt data. The receiver then uses their “Private Key” to decrypt
the data (without the Private Key, decryption is impossible). CAs can be beneficial since using
them reduces the amount of data entry required on each VPN Endpoint.
VPN Policy Operation
The VPN Policies screen allows you to add additional policies—either Auto or Manual—and to
manage the VPN policies already created. You can edit policies, enable or disable them, or delete
them entirely. The rules for VPN policy use conform to:
1. Traffic covered by a policy will automatically be sent via a VPN tunnel.
2. The VPN tunnel is created according to the parameters in the SA (Security Association).
3. The remote VPN Endpoint must have a matching SA, or it will refuse the connection.
VPN Policy Table
When you use the VPN Wizard to set up a VPN tunnel, both a VPN Policy and an IKE Policy is
established and populated in both Tables on the VPN Policies scre en. The name you selected as the
VPN T unnel connection name during W izard setup identifies both the VPN Policy and IKE Policy .
You can also edit exiting policies, add new VPN policies directly or change the policy hierarchy to
the Policy Table. The Policy Table contains the following fields:
•! (Status). Indicates whether the policy is enabled (green circle) or disabled (grey circle). To
Enable or Disable a Policy, check the radio box adjacent to the circle and click Enable or
Disable, as required.
•Name. Each policy is given a unique name (the Connection Na me when using the VPN
Wizard). Client Policies are annotated by an “*”.
•Type. The Type is “Auto ” or “Manual” as described previously (Auto is used during VPN
Wizard configuration).
•Keep alive: It periodically sends ping packets to the host on the peer side of the network to
keep the tunnel alive.
–Enable Keep Alive: Check to enable.
–Ping IP Address: Enter the IP Address to which ping packets need to be sent.
–Detection period: Router sends ping packets periodically at regular intervals of time
which is specified by the user.