____________________________________________________________________________________
____________________________________________________________________________________
TAU-4M.IP Subscriber gateway
33
Enable
– allow using IPSec for data encryption;
Interface
– this setting takes effect only when PPPoE, PPTP or L2TP are selected for the Internet,
and defines the interface that will be accessed with IPSec: Ethernet (secondary access interface)
or PPP (primary access interface). When DHCP or Static protocol is selected, there is only a single
interface (Ethernet) active for the service that may be accessed with IPSec only:
Local IP address
– device address for IPSec operation;
Local Subnet
together with
Local Netmask
define a local subnet for creation of network-to-
network or network-to-point topologies;
Remote Subnet
together with
Remote Netmask
define a remote subnet address used for IPSec
encrypted communication. If the mask value is 255.255.255.255, communication is performed
with a single host. Mask that differs from 255.255.255.255 allows defining a whole subnet. Thus,
functionality of the device allows you to organize the following 4 network topologies with using
encryption traffic via IPSec protocol: point-to-point, network-to-point, point-to-network,
network-to-network;
Remote gateway
– gateway used for remote network access;
NAT-Traversal IPSec
– NAT-T mode selection. NAT-T (NAT Traversal) encapsulates IPSec traffic
and simultaneously creates UDP packets to be sent correctly by a NAT device. For this purpose,
NAT-T adds an additional UDP header before IPSec packet so it would be processed as an ordinary
UDP packet and the recipient host would not perform any integrity checks. When the packet
arrives to the destination, UDP header is removed and the packet goes further as an encapsulated
IPSec packet. With NAT-T technique, you may establish communication between IPSec clients in
secured networks and public IPSec hosts via firewalls. NAT-T operation modes:
–
On
– NAT-T mode is enabled only when NAT is detected on the way to the destination
host;
–
Force
– use NAT-T in any case;
–
Off
– disable NAT-T on connection establishment.
The following NAT-T settings are available:
NAT-T UDP Port
– UDP port for packets used for IPSec message encapsulation. Default
value is 4500.
Interval between sending NAT-T keepalive packets, s
– periodic message transmission
interval for UDP connection keepalive on the device performing NAT functions.
Aggressive mode
– phase 1 operation mode, when all the necessary data is exchanged using three
unencrypted packets. In the main mode, the exchange process involves six unencrypted packets.
My Identifier type
– device identifier type: address, fqdn, keyed, user_fqdn, asn1dn;
My Identifier
– device identifier used for identification during phase 1 (fill in, if required). Identifier
format depends on the type.
Phase 1
During the first step (phase), two hosts negotiate on the identification method, encryption
algorithm, hash algorithm and Diffie Hellman group. They also identify each other. For phase 1, there are the
following settings.
Pre-shared Key
– a secret key used by authentication algorithm in phase 1. A string from 8 to 63
characters long.
IKE Authentication algorithm
– select an authentication algorithm from the list: MD5, SHA1;
