Prestige 334 User’s Guide

Having everyone use the same pre-shared key may create a vulnerability. If the pre-shared key is compromised, all of the VPN connections using that VPN rule are at risk. A recommended alternative is to use a different VPN rule for each telecommuter and identify them by unique IDs (see the Telecommuters Using Unique VPN Rules Example section )..

Table 56 Telecommuter and Headquarters Configuration Example

 

TELECOMMUTER

HEADQUARTERS

 

 

 

My IP Address:

0.0.0.0 (dynamic IP address

Public static IP address

 

assigned by the ISP)

 

 

Secure Gateway

Public static IP address or domain

0.0.0.0

With this IP address only the

IP Address:

name.

telecommuter can initiate the IPSec tunnel.

Figure 70 Telecommuters Sharing One VPN Rule Example

15.17.2 Telecommuters Using Unique VPN Rules Example

With aggressive negotiation mode (see section Negotiation Mode), the Prestige can use the ID types and contents to distinguish between VPN rules. Telecommuters can each use a separate VPN rule to simultaneously access a Prestige at headquarters. They can use different IPSec parameters (including the pre-shared key) and the local IP addresses (or ranges of addresses) can overlap.

181

Chapter 15 VPN Screens