QuadroFXO Manual II: Administrator's Guide
Administrator’s Menus
QuadroFXO; SW Version 5.1.x
72
Please Note:
The Static IP/ Remote Gateway selection is not possible if this Gateway is positioned behind NAT, since the IP-address of the remote
gateway is not reachable directly in this case.
Quadro <> Remote Gateway allows access from the local Quadro to the remote VPN gateway (local subnet and remote subnet are not included).
This includes management access. The checkbox is disabled when “Quadro<>NAT<>[Internet]<>Peer” or “Quadro<>[Internet]<>NAT<>Peer” the is
selected from the VPN Network Topology drop down list on the first page of the IPSec Connection Wizard.
Local Subnet <> Remote Gateway allows access from all stations connected to the local network to the remote VPN gateway device (local Quadro
and remote subnet are not included). The checkbox is disabled when “Quadro<>[Internet]<>NAT<>Peer” is selected from the VPN Network
Topology drop down list on the first page of the IPSec Connection Wizard.
Quadro <> Remote Subnet allows access from the local Quadro to all stations of the remote LAN (local subnet and remote VPN gateway devices
are not included). The checkbox is disabled when “Quadro<>NAT<>[Internet]<>Peer” is selected from the VPN Network Topology drop down list on
the first page of the IPSec Connection Wizard.
Local Subnet <> Remote Subnet allows access from all stations of the local network to all stations of the remote LAN (VPN gateway devices are
not included). In this case, the local and remote subnet IP addresses and subnet masks have to be entered in the corresponding text fields Local
Subnet IP and Remote Subnet IP.
More than one of the above checkboxes may be selected to specify the desired communication relations.
The Stop Connection if not successful checkbox allows you to stop the IPSec connection attempts if the partner is still unreachable after the
timeout period. If the checkbox is not selected, the system will continue to try to reach the IPSec connection partner.
The Internet Key Exchange (IKE) and Encapsulated Security payload (ESP) parameters are used to define the security of your VPN tunnel. The
Internet Key Exchange (IKE) parameters group is used to select the Encryption, Authentication and Diffie-Helman Group. The Encapsulated
Security payload (ESP) parameters group is used to select the Encryption and Authentication.
The Encryption drop down list offers the following standards for selection:
•
Triple DES uses three DES encryptions on a single data block with three different keys to achieve a higher security than is available
from a single DES pass (block cipher algorithm with 64-bit blocks and a 56-bit key).
•
AES 128 bit cryptography scheme is a symmetric block cipher, which encrypts and decrypts 128-bit blocks of data.
•
AES 192 bit cryptography scheme is a symmetric block cipher, which encrypts and decrypts 192-bit blocks of data.
•
AES 256 bit cryptography scheme is a symmetric block cipher, which encrypts and decrypts 256-bit blocks of data.
The area Authentication offers the following parameters to be selected:
•
SHA (Secure Hash Algorithm) is a strong digest algorithm proposed by the US NIST (National Institute of Standards and Technology)
agency as a standard digest algorithm and is used in the Digital Signature standard, FIPS number 186 from NIST. SHA is an improved
variant of MD4 producing a 160-bit hash. SHA and MD5 are the message digest algorithms available in IPSEC.
•
MD5 (Message Digest) is a hash algorithm that makes a checksum over the messages. The checksum is sent with the data and
enables the receiver to notice whether the data has been altered.
The Diffie-Hellman parameter is used to determine the length of the base prime numbers used during the key exchange process. The cryptographic
strength of any key derived depends, in part, on the strength of the Diffie-Hellman group, which is based upon the prime numbers. The higher is the
group bit rate, the better is encryption. If mismatched groups are specified on each peer, negotiation fails.
The third page of the IPSec Connection wizard, Automatic Keying, is used to setup a type of password (Shared Secret) or the RSA public key to
secure your IPSec Connection. The functionality of Perfect Forward Secrecy (PFS) can be added to both. Following ways of automatic keying are
available.
•
Shared Secret is a type of password consisting of any characters that both of the IPSec Connection partners must know. The authentication will
be done with this shared secret. All encryption functions below will remain concealed.
Please Note:
It is also not recommended to start multiple road warrior connections with the Shared Secret automatic keying selected. For
multiple road warriors to be started at the same time, it is recommended to use RSA keying with Local ID and Remote ID fields configured.
•
RSA requires the public RSA key of your IPSec Connection partner.
Please Note:
System prevents to start a connection with Shared Secret automatic keying selected if there is already a connection with RSA
automatic keying started, and vice versa.
The Local ID requires an IP address, Quadro FQDN (Fully Qualified Domain Name) that is resolved to an IP address, or any @-ed string that is
used in the same way.
Remote ID also requires an IP address, the IPSec Connection partner’s FQDN (Fully Qualified Domain Name) that is resolved to an IP address, or
any @-ed string that is used in the same way.
The Local ID and Remote ID text fields may have the values
in one of the formats presented below:
•
IP address – example: 10.1.19.32.
•
Host name – example: vpn.epygi.com. This form
requires additional resources to resolve the host name,
therefore it is not recommended to use this format.
•
@FQDN – example: @vpn.epygi.com. This form is
considered as a string, and is not being resolved. It is
recommended to use this form for most applications.
•
user@FQDN - example: quadro@vpn.epygi.com. This
form is also considered as a string, and is not being
resolved. It has no advantages over the previous form.
Fig. II-126: IPSec Connection Wizard - Automatic Keying Settings page
