Nortel Networks NN46110-602 manual Configuring the VPN Router as a user tunnel

220 Appendix D Configuring for interoperability

then select a default server certificate from the list. You configure servers from the System > Certificates window.

7Select Profiles > Branch Office, click Edit, scroll down to the IPsec section and click Configure.

The Branch Office window appears.

8Select the encryption type supported by your third-party client.

9Select Enable or Disable for the VendorID.

10Set Perfect Forward Secrecy (PFS) to match the client side.

11In the Rekey Time-outsection, enter the amount of time you want to limit the lifetime of a single key used to encrypt data. The default is 08:00:00 (8 hours).

12In the Rekey Data Count section, you can choose to set a rekey data count depending on how much data you expect to transmit through the tunnel with a single key. The default is 0 KB; a setting of 0 disables this count.

Configuring the VPN Router as a user tunnel

If you have third-party client software that supports Aggressive mode IPsec, you can configure the VPN Router as a user tunnel. You must use either the LDAP database or the certificate authentication. The VPN Router supports both preshared key and RSA digital signature authentication methods and you must specify one of these methods.

Nortel recommends enabling split tunnels for all groups that support third-party clients. If you disable split tunneling, third-party clients can connect only if you configure the group to allow undefined networks. This means that the client can establish IPsec security associations for all networks. If you do not enable split tunneling, you must enable the Allow undefined networks option.

Figure 13 shows a network with a split tunneling environment.

NN46110-602