7
IPsec VPN
137
•
If
not
using
the
default
ipsec_high
list,
set
IPsecProposalList
to
the
proposal
list
to
be
used
for
the
tunnel.
•
Specify
a
LocalID
for
the
tunnel.
The
combination
of
this
and
the
RemoteID
will
identify
the
IPsecPSK
object
to
use.
•
Specify
a
RemoteID
for
the
tunnel.
This
can
be
specified
using
the
asterisk
(“*”)
as
a
wildcard
character.
•
Specify
the
LocalAuthMethod
to
be
PSK
.
By
default,
this
also
becomes
the
value
for
RemoteAuthMethod
,
although
you
could
set
the
local
and
remote
method
to
different
values.
The
IPsec
Tunnel
object
can
be
treated
exactly
like
any
SEG
Interface
object
in
later
steps.
5. Set
up
two
IP
rules
in
the
IP
rule
set
for
the
tunnel:
•
An
Allow
rule
for
outbound
traffic
that
has
the
previously
defined
ipsec_tunnel
object
as
the
Destination
Interface
.
The
rule's
Destination
Network
is
the
remote
network
remote_net
.
•
An
Allow
rule
for
inbound
traffic
that
has
the
previously
defined
ipsec_tunnel
object
as
the
Source
Interface
.
The
Source
Network
is
remote_net
.
The
Service
used
in
these
rules
is
All
but
it
could
be
a
predefined
service.
6. Define
a
new
SEG
Route
which
specifies
that
the
VPN
Tunnel
ipsec_tunnel
is
the
Interface
to
use
for
routing
packets
bound
for
the
remote
network
at
the
other
end
of
the
tunnel.
IPsec LAN to LAN with certificates
LAN
to
LAN
security
is
often
provided
with
pre
‐
shared
keys
but
sometimes
it
may
be
desirable
to
use
X.509
certificates
instead.
If
this
is
the
case,
Certificate
Authority
(CA)
signed
certificates
may
be
used
and
these
come
from
an
internal
CA
server
or
from
a
commercial
supplier
of
certificates.
Creating
a
LAN
to
LAN
tunnel
with
certificates
follows
exactly
the
same
procedures
as
the
previous
section
where
a
pre
‐
shared
key
was
used.
The
difference
is
that
certificates
now
replace
pre
‐
shared
keys
for
authentication.
In
this
case,
specify
the
LocalAuthMethod
to
be
Certificate
.
By
default,
the
RemoteAuthMethod
property
will
take
on
the
same
value
so
it
does
not
need
to
be
specified.
Two
unique
sets
of
two
CA
signed
certificates
(two
for
either
end,
a
root
certificate
and
a
gateway
certificate)
are
required
for
a
LAN
to
LAN
tunnel
authentication.
They
are
loaded
into
the
SEG
as
globally
available
objects.
Certificates
are
associated
with
a
LocalID
and
it
is
this
value
which
is
used
to
associate
them
with
a
particular
tunnel
object.
Action
Src Interface
Src Network
Dest Interface
Dest Network
Service
Allow sfp1
sfp1net
ipsec_tunnel
remote_net
All
Allow ipsec_tunnel
remote_net
sfp1
sfp1net
All
Interface
Network
Gateway
ipsec_tunnel remote_net <empty>
