Industry Cellular Gateway
also imports the certificates of the root CA of the Gateway 1 into the Gateway 2 as the trusted ones.
(Please also refer to "My Certificate" and "Trusted Certificate" sections).
Establish an IPSec VPN tunnel with IKE and X.509 protocols by starting from either peer, so that all
client hosts in these both subnets can communicate with each other.
Parameter Setup Example (same as the one described in "My Certificate" section)
For Network-A at HQ
Following tables list the parameter configuration as an example for the "Issue Certificate" function
used in the user authentication of IPSec VPN tunnel establishing, as shown in above diagram. The
configuration example must be combined with the ones in "My Certificate" and "Trusted
Certificate" sections to complete the setup for whole user scenario.
Configuration Path
[Issue Certificate]-[Certificate Signing Request Import from a File]
Browse
C:/BranchCSR
Command Button
Sign
Configuration Path
[Issue Certificate]-[Signed Certificate View]
Command Button
Download
(default name is "issued.crt")
Scenario Operation Procedure (same as the one described in "My Certificate" section)
In above diagram, the "Gateway 1" is the gateway of Network-A in headquarters and the subnet of
its Intranet is 10.0.76.0/24. It has the IP address of 10.0.76.2 for LAN interface and 203.95.80.22 for
WAN-1 interface. The "Gateway 2" is the gateway of Network-B in branch office and the subnet of
its Intranet is 10.0.75.0/24. It has the IP address of 10.0.75.2 for LAN interface and 118.18.81.33 for
WAN-1 interface. They both serve as the NAT security gateways.
Gateway 1 generates the root CA and a local certificate (HQCRT) that is signed by itself. Import the
certificates of the root CA and HQCRT into the "Trusted CA Certificate List" and "Trusted Client
Certificate List" of Gateway 2.
Gateway 2 generates a Certificate Signing Request (BranchCSR) for its own certificate BranchCRT to
be signed by root CA (Please generate one not self-signed certificate in the Gateway 2, and click on
the "View" button for that CSR. Just downloads it). Take the CSR to be signed by the root CA of the
Gateway 1 and obtain the BranchCRT certificate (you need rename it). Import the certificate into
the "Trusted Client Certificate List" of the Gateway 1 and the "Local Certificate List" of the Gateway
2.
Gateway 2 can establish an IPSec VPN tunnel with "Site to Site" scenario and IKE and X.509
protocols to Gateway 1.
Finally, the client hosts in two subnets of 10.0.75.0/24 and 10.0.76.0/24 can communicate with each
other.
179
