Refer
e
nc
e M
anu
al
for
the
Pr
oSafe
802.11
g
Wire
less
VPN Fir
e
wal
l FVG318
7-
2
A
dva
n
ced Vir
tu
a
l Private Networkin
g
BE
TA
Using Policies to Manage VPN T
raffic
Y
ou create
pol
icy definitions to
manage VPN traf
fi
c
on
the FVG318.
There are t
w
o ki
nds of
policies:
•
IKE Policies
: Defi
ne the aut
henticatio
n scheme and automatica
lly ge
nera
te the e
ncryption
keys. As an alternative opti
on,
to further automate
the proce
ss, you ca
n cre
ate an IKE
polic
y
that
uses
a
trusted certificat
e authority
to prov
ide the
authenti
cation whi
le
the IKE policy
sti
ll
ha
nd
les the
enc
ryp
tion
.
•
VPN Policies
: Apply
the IKE
polic
y to specific traf
fic
that requ
ires
a VPN tu
nn
el.
Or
, yo
u
can
crea
te a VPN policy
that does not use an
IK
E
policy but in which you
manually enter all the
auth
entication
and key parameters.
Since
V
PN
polic
ies use IKE policies, you define th
e IK
E
po
lic
y first. Th
e FVG3
18
also
allow
s yo
u
to manually
input t
he authentica
tion
s
che
me
a
nd
e
nc
ryp
tion
k
ey
valu
es. In
th
e cas
e of m
anu
al ke
y
management
there will not be any
IKE
policies.
In order to
establish secure co
mmuni
cation over the
Internet with
the remote site
yo
u
need
to
configure matching VPN policies on both the lo
ca
l and remote FVG318 W
irele
ss VPN Firewalls.
Th
e
ou
tbo
und
VPN p
olicy
on
on
e en
d must match
to
the in
bo
un
d VPN p
olicy
on
oth
er
en
d,
an
d
vic
e vers
a.
When the
network traf
fic enters
int
o the
FVG318 from
the
LAN
network interface,
if there is no
VPN p
olicy
fou
nd
for a ty
pe o
f network
traf
fic,
then that traf
fic pa
sse
s th
ro
ug
h with
ou
t a
ny
change. However
, if the
tra
ffic
is se
lected by
a VPN policy
, then
the
IPSe
c authentication and
encryption rules
are applied to
it as defined in the VPN poli
cy
.
By
d
efaul
t, a new VP
N po
licy is
ad
ded with the least priority
, that
is, at
the
end of the V
PN
policy
tabl
e.
Using Automat
ic Key
Manage
me
nt
The
mos
t c
ommon
configura
tion s
cenarios
w
ill
use IKE policies
to automati
cally manage
the
authentication a
nd encryption keys. Base
d on
the IK
E
p
oli
cy
, so
me paramete
rs for the VPN tunnel
are generated automa
tically
. The IKE protocol
s
pe
rfo
rm nego
tiat
ion
s between the
two VP
N
endpoints to automatically ge
nerate required
parameters.
Some or
ganizations will
use
an
IKE policy
wit
h a Certificat
e Authority
(CA) t
o perform
authentication. T
ypically
, CA authent
ication is
used
in
lar
ge or
ganizations
that maintain their own
internal CA se
rver
. This
re
quires tha
t e
ach VP
N gate
way
have a ce
rtific
ate from the CA
. Us
ing
CAs reduces the amount of data entry require
d on eac
h VPN endpoint.
