Chapter 6
Advanced Features
Remote match [remotematch]
This setting is relevant in responder mode only.
It is optionally filled out. In a basic configuration it is left unset. When unset, the
SpeedTouch™ uses its dynamic IPSec policy capabilities to complete this field. The ipsec connection advanced command group allows manual control over this parameter.
The remotematch expresses the traffic policy for access to a remote private network in responder mode. It describes which IP addresses, address ranges or subnets can be reached in a remote private network through an IPSec Security Association.
During the Phase 2 negotiations, the proposals of the remote peer (initiator) are compared with the contents of the remotematch parameter. As a result, a remote traffic selector is derived in compliance with the local and remote traffic policies.
The valid values for the remotematch parameter are limited to specific keywords, eventually followed by a network name.
Keyword: | Followed by a Network name: |
|
|
exactly_ | A symbolic name of a network |
one_of_ | descriptor, defined in the ipsec |
subnet_of_ | connection network command |
subrange_of_ | group. |
|
|
black_ip | - |
|
|
The meaning of the keywords is the following:
exactly_<network name>:
The proposal issued by the remote initiator must exactly match the network described by the symbolic network name. This network descriptor can designate an individual IP address, an IP address range, or an IP subnet in the remote private network. If the proposal of the remote initiator does not exactly match the designated net, then the local responder does not establish a Security Association.
one_of_ <network name>:
The proposal issued by the remote initiator must contain an IP address that lies within the range described by the symbolic network name in order to successfully set up the Security Association.
subnet_of_ <network name>:
The proposal of the remote initiator must contain a subnet that lies within the range described by the symbolic network name in order to successfully set up the Security Association.
subrange_of_ <network name>:
The proposal of the remote initiator must contain a subrange that lies within the range described by the symbolic network name in order to successfully set up the Security Association.
black_ip:
The proposal of the remote initiator must contain the public IP address of the remote Security Gateway.
216 | |
|
