Document Outline

• Contents
• About this IPSec Configuration Guide
  • Abstract
  • Applicability
  • Used Symbols
  • Terminology
  • Documentation and software updates
• 1 IPSec: Concept for secure IP connections
  • Policies
  • The Target of IPSec
  • In this section
  • 1.1 IPSec Concepts
    • Red and Black Network
    • Authentication Header
    • Encapsulated Security Payload
    • Internet Key Exchange
    • Security Associations
    • Tunnel Mode
    • Transport Mode
• 2 SpeedTouch™ IPSec terminology
  • Introduction
  • In this section
  • 2.1 Policy
    • What is ...
    • Static policy
    • Dynamic policy
  • 2.2 Security Descriptor
    • What is ...
    • IKE session Descriptor
    • IPSec Descriptor
  • 2.3 Authentication Attribute
    • What is ...
  • 2.4 Peer (Phase 1)
    • What is ...
  • 2.5 Connection (Phase 2)
    • What is ...
  • 2.6 Network descriptor
    • What is ...
• 3 Configuration via Local Pages
  • Prerequisites
  • IPSec Web Pages
  • VPN Menu
  • In this section
  • 3.1 LAN to LAN Application
    • Reference network
    • Selecting the LAN to LAN application
    • Outline of a configuration procedure
    • 3.1.1 Remote Gateway Address Known Page
      • VPN context
      • Initial page
      • Buttons
      • Remote Gateway
      • Miscellaneous
      • IKE Security Descriptors
      • Page layout with additional Descriptors
      • Page layout for pre- shared key authentication
      • IKE Authentication with Preshared Key
      • Page layout for certificate authentication
      • IKE Authentication: Certificate parameters
      • Example of a completed page
      • Buttons
    • 3.1.2 Remote Gateway Address Unknown Page
      • VPN context
      • Example
      • Aggressive Mode initial page
      • Aggressive Mode versus Main Mode
      • Buttons
      • Miscellaneous
      • IKE Security Descriptors
      • Page layout with additional Descriptors
      • Page layout for pre- shared key authentication
      • IKE Authentication with Preshared Key
      • Page layout for certificate authentication
      • IKE Authentication: Certificate parameters
      • Main Mode initial page
      • Buttons
      • IKE Security Descriptors
      • Page layout with additional Descriptors
      • Miscellaneous
      • Page layout for pre- shared key authentication
      • IKE Authentication with Preshared Key
      • Page layout for certificate authentication
      • IKE Authentication: Certificate parameters
      • Main mode expanded page
      • Identification & Interface
      • Example of a completed page
      • Buttons
    • 3.1.3 Connections Page
      • Page layout
      • Buttons
      • Trusted Network
      • Protocol
      • Port
      • IPSec Security Descriptors
      • Page layout with additional Descriptors
      • Starting and stopping a connection.
  • 3.2 VPN Client
    • VPN context
    • Advantages of the SpeedTouch™ VPN Client
    • Selecting the VPN Client application
    • Outline of a VPN Client configuration procedure
    • 3.2.1 VPN Client Page
      • Initial page
      • Buttons
      • Server IP Address or FQDN
      • Backup Server IP Address or FQDN
      • IKE Security Descriptor
      • IPSec Security Descriptor
      • Exchange Mode
      • Server Vendor
      • Primary Untrusted Physical Interface
      • Virtual IP mapping
      • Optional Remote network
      • Page layout for pre- shared key authentication
      • IKE Authentication with Preshared Key
      • Page layout for certificate authentication
      • IKE Authentication: Certificate parameters
      • Starting and stopping a VPN client connection
      • Page layout for Automatic Start
      • Local LAN IP Range
      • Set of Server Vendor specific parameters
      • Configuring XAuth
    • 3.2.2 Starting the VPN Client Connection
      • Method 1: Automatic Start
      • Method 2: Manual Start
      • Dialling in
      • VPN Client Connect Page
      • Client Identification
      • Using XAuth
    • 3.2.3 Closing a Connection
      • Disconnect procedure
  • 3.3 VPN Server
    • VPN context
    • Selecting the VPN Server application
    • Outline of a VPN server configuration procedure
    • 3.3.1 VPN Server Page
      • Initial page
      • Buttons
      • Local Trusted Network
      • Page layout with additional Networks
      • IKE Security Descriptor
      • Page layout with additional Descriptors
      • IPSec Security Descriptor
      • Page layout with additional Descriptors
      • Miscellaneous
      • VPN Server settings
      • Page layout for pre- shared key authentication
      • IKE Authentication with Preshared Key
      • Page layout for certificate authentication
      • IKE Authentication: Certificate parameters
      • Authorized Users List
  • 3.4 Certificates
    • Introduction
    • Secure Storage page
    • Request Import page
    • CRL page
    • CRL Distribution Point
    • CEP page
    • Enrollment URL
    • Subject DN
  • 3.5 Advanced VPN Menu
    • When to use
    • Peer Profiles page
    • Connection Profiles page
    • 3.5.1 Peer Profiles Page
      • Peer Profiles page layout
      • Peer name
      • Remote address
      • Backup remote address
      • Local ID
      • Remote ID
      • Primary Untrusted Physical Interface
      • Exchange mode
      • Authentication
      • Peer Descriptor
      • Client/Server
      • Peer Options
    • 3.5.2 Authentication Page
      • Authentication page layout
      • Parameter table
    • 3.5.3 Peer Descriptors Page
      • Descriptors page layout
      • Parameter table
      • Peer Descriptor name
      • Crypto
      • Integrity
      • Group
      • Lifetime-secs
    • 3.5.4 Peer Options Page
      • Options page layout
    • 3.5.5 VPN-Client Page
      • VPN-Client page layout
      • Client descriptor name
      • Configuring XAuth
      • Gateway Vendor
      • Type
    • 3.5.6 VPN-Server Page
      • VPN-Server page layout
      • Server descriptor name
      • Virtual IP Range
      • Netmask
      • Push IP
      • Domain
      • Primary DNS
      • Secondary DNS
      • Primary WINS
      • Secondary WINS
      • XAuth Pool
    • 3.5.7 VPN-Server-XAuth Page
      • VPN-Server-XAuth page layout
      • XAuth pool name
      • Type
      • Username and Password
    • 3.5.8 Connection Profiles Page
      • Connection Profiles page layout
      • Connection name
      • Peer name
      • Local network
      • Remote network
      • Always on
      • Connection Descriptor
      • Connection Options
      • Connection enabled
    • 3.5.9 Networks Page
      • Networks page layout
      • What is a Network Descriptor?
      • How is it used?
      • Network name
      • Type of network and IP address
      • Protocol
      • Port
    • 3.5.10 Connection Descriptors Page
      • Descriptors page layout
      • Parameter table
      • Connection Descriptor name
      • Crypto
      • Integrity
      • Encapsulation
      • PFS
      • Lifetime-secs
      • Lifetime-kbytes]
    • 3.5.11 Connection Options Page
      • Options page layout
    • 3.5.12 Client Page
      • Client page layout
      • Connection
      • Local ID
      • Configuring XAuth
• 4 Configuration via the Command Line Interface
  • In this chapter
  • Reference network
  • 4.1 Basic IPSec configuration procedure
    • Terminology
    • Procedure
  • 4.2 Peer: Authentication Attribute
    • What is ...
    • How is it used
    • In this section
    • 4.2.1 Authentication Attribute Parameters
      • Parameter table
    • 4.2.2 List all Authentication Attributes
      • list command
      • Example
    • 4.2.3 Create a New Authentication Attribute
      • add command
      • Example
    • 4.2.4 Set or Modify the Authentication Attribute Parameters
      • modify command
      • Example
    • 4.2.5 Delete an Authentication attribute
      • delete command
      • Example
  • 4.3 Peer Security Descriptor
    • What is ...
    • How is it used
    • In this section
    • 4.3.1 Peer Security Descriptor Parameters
      • Parameter table
      • Example
      • Peer Descriptor name [name]
      • Cryptographic function [crypto]
      • Key length [keylen]
      • Authentication Hashing function [integrity]
      • Diffie-Hellman group [group]
      • IKE SA lifetime [lifetime_secs]
    • 4.3.2 List all Peer Security Descriptors
      • list command
      • Example
    • 4.3.3 Create a New Peer Security Descriptor
      • add command
      • Example
    • 4.3.4 Set or Modify the Peer Descriptor Parameters
      • modify command
      • Example
    • 4.3.5 Delete a Peer Descriptor
      • delete command
      • Example
  • 4.4 Peer
    • What is ...
    • How is it used
    • In this section
    • 4.4.1 Peer parameters
      • Parameters table
      • Peer name [name]
      • Remote Security Gateway identifier [remoteaddr]
      • Backup remote Security Gateway Identifier [backupaddr]
      • Exchange mode [exchmode]
      • Local Identifier [localid]
      • Remote Identifier [remoteid]
      • Physical Interface [phyif]
      • Peer descriptor [descr]
      • Authentication Attribute [auth]
      • client/server
      • options
    • 4.4.2 List all peer entities
      • list command
      • Example
    • 4.4.3 Create a new peer entity
      • add command
      • Example
    • 4.4.4 Set or modify the peer parameters
      • modify command
      • Example
    • 4.4.5 Delete a Peer entity
      • delete command
      • Example
  • 4.5 Connection Security Descriptor
    • What is ...
    • How is it used
    • In this section
    • 4.5.1 Connection Security Descriptor parameters
      • Parameters table
      • Example:
      • Connection Descriptor name [name]
      • Cryptographic function [crypto]
      • Key length [keylen]
      • Authentication Hashing function [integrity]
      • Perfect Forward Secrecy [pfs]
      • IPSec SA lifetime [lifetime_secs]
      • IPSec SA volume lifetime [lifetime_kbytes]
      • Encapsulation mode [encapsulation]
    • 4.5.2 List all Connection Security Descriptors
      • list command
      • Example
    • 4.5.3 Create a new Connection Security Descriptor
      • add command
      • Example
    • 4.5.4 Set the Connection Security Descriptor Parameters
      • modify command
      • Example
    • 4.5.5 Delete a Connection Security Descriptor
      • delete command
      • Example
  • 4.6 Network Descriptor
    • What is ...
    • How is it used
    • In this section
    • 4.6.1 Network Descriptor Parameters
      • Parameters table
      • Network name [name]
      • Type of network and IP address [type] and [ip]
      • Protocol [proto]
      • Port [port]
    • 4.6.2 Create a New Network Descriptor
      • add command
      • Example
    • 4.6.3 Set the Network Descriptor Parameters
      • modify command
      • Example
    • 4.6.4 Delete a Network Descriptor
      • delete command
      • Example
  • 4.7 Connection
    • What is ...
    • How is it used
    • In this section
    • 4.7.1 Connection Parameters
      • Parameters table
      • Connection name [name]
      • Peer [peer]
      • Local network [localnetwork]
      • Remote network [remotenetwork]
      • Always-on connection [alwayson]
      • Descriptors [descr]
      • Options [options]
      • State [state]
    • 4.7.2 List all Connections
      • list command
      • Example
    • 4.7.3 Create a New Connection
      • add command
      • Example
    • 4.7.4 Set or Modify the Connection Parameters
      • modify command
      • Example
    • 4.7.5 Delete a Connection
      • delete command
      • Example
    • 4.7.6 Start a Connection
      • start command
      • Example
    • 4.7.7 Stop a connection
      • stop command
      • Example
  • 4.8 Auxiliary Commands
    • In this section
    • 4.8.1 Config Command
      • What is it used for
      • Display the VPN configuration settings
      • Control of general VPN settings
      • Example
      • AutoRoute
      • AutoProxyARP
      • When do I need ProxyARP
      • An example of Auto ProxyARP
    • 4.8.2 Flush Command
      • What is it used for
    • 4.8.3 Clear Command Group
      • What is it used for
      • clear all
      • clear session
  • 4.9 Organisation of the IPSec Command Group
    • Introduction
    • ipsec command group
    • Clear command group
    • Connection command group
    • Debug command group
    • Peer command group
    • Show command group
• 5 Troubleshooting SpeedTouch™ IPSec
  • Introduction
  • In this section
  • 5.1 Via the Debug Web pages
    • How to see the status of the VPN connection
    • How to monitor the IPSec negotiations
    • How to see the amount of traffic carried by a VPN connection
  • 5.2 Via the CLI: Show command group
    • Show command group
  • 5.3 Via the CLI: Debug command group
    • Traceconfig command
    • Via Syslog messages
    • Syslog messages
  • 5.4 Via SNMP
    • Debugging via SNMP
  • 5.5 Pinging from the SpeedTouch™ to the remote private network
    • Ping command
    • Adapting the routing table
• 6 Advanced Features
  • In this section
  • 6.1 IPSec and the Stateful Inspection Firewall
    • What about ...
  • 6.2 Surfing through the VPN tunnel
    • Web Browsing Interception and surfing through a tunnel
  • 6.3 Extended Authentication (XAuth)
    • What is ...
    • How does it work
  • 6.4 VPN Client
    • Introduction
    • 6.4.1 VPN Client parameters
      • Parameters table
    • 6.4.2 Create a new vpnclient
      • add command
      • Example
    • 6.4.3 Set or modify the vpnclient parameters
      • modify command
      • Example
    • 6.4.4 Attach the vpnclient entity to the peer entity
      • modify the peer parameters
      • Example
  • 6.5 VPN Server
    • Introduction
    • 6.5.1 VPN Server parameters
      • Parameters table
      • Connection name [name]
      • Push IP address [push_ip]
      • VPN clients IP address range
      • Client netmask
      • XAuth pool
    • 6.5.2 Create a new VPN server
      • add command
      • Example
    • 6.5.3 Set or modify the vpnserver parameters
      • modify command
      • Example
    • 6.5.4 Attach the vpnserver entity to the peer entity
      • modify the peer parameters
      • Example
  • 6.6 XAuth Users Pool
    • Introduction
    • 6.6.1 XAuth Pool parameters
      • Parameters table
    • 6.6.2 Create a new XAuth pool
      • add command
      • Example
    • 6.6.3 Modify the xauthpool type
      • modify command
      • Example
    • 6.6.4 Attach the xauthpool entity to the vpnserver entity
      • modify the vpnserver parameters
      • Example
    • 6.6.5 Delete an xauthpool entity
      • delete command
      • Example
    • 6.6.6 XAuth User parameters
      • Parameters table
    • 6.6.7 Create a new XAuth user
      • adduser command
      • Example
    • 6.6.8 Set or modify the password of an XAuth user
      • moduser command
      • Example
    • 6.6.9 Delete an xauthuser entity
      • delete command
      • Example
  • 6.7 The Default Peer Concept
    • Why the default peer concept
    • Example IPSec connection, applying the default peer concept
  • 6.8 One Peer - Multiple Connections
    • Multiple tunnels
  • 6.9 Peer Options
    • Options list
    • Local Address
    • NAT-Traversal
    • Dead Peer Detection
    • DPD Idle Period
    • DPD number of Transmits
    • DPD Timeout
    • Tunnel inactivity timeout
    • 6.9.1 List all Peer Options lists
      • list command
      • Example
    • 6.9.2 Create a Peer Options list
      • add command
      • Example
    • 6.9.3 Set or modify the Peer Option list parameters
      • modify command
      • Example
    • 6.9.4 Delete a Peer Options list
      • delete command
      • Example
  • 6.10 Connection Options
    • Options list
    • IPSec routing mode [routed]
    • Virtual interface
    • Don’t Fragment bit [force_df]
    • Minimal MTU [min_mtu]
    • Add Route [add_route]
    • 6.10.1 List all Connection Options lists
      • list command
      • Example
    • 6.10.2 Create a Connection Options list
      • add command
      • Example
    • 6.10.3 Set or modify the Connection Option list parameters
      • modify command
      • Example
    • 6.10.4 Delete an Options list
      • delete command
      • Example
  • 6.11 Advanced Connection
    • Introduction
    • Parameters table
    • Local network [localnetwork]
    • Remote network [remotenetwork]
    • Local match [localmatch]
    • Remote match [remotematch]
    • Local selector [localselector]
    • Remote selector [remoteselector]
    • Advanced Connection commands
• Need more help?