7 VPN connection
SINAUT MD741-1
C79000-G8976-C236-05
81
●
CA certificate
●
Pre-shared Key (PSK)
X.509 certificate and CA certificate
With the authentication methods X.509 certificate and CA certificate, keys are used
for authentication that were previously signed by a certification authority (CA). This
method is considered particularly secure. A CA can be a provider but also, for
example the system administrator of your project as long as the required software
tools are available. The CA creates a certificate file (PKCS12) for both ends of a
VPN connection with the file extension ".p12". This certificate file contains the
public and private key of the local station, the signed certificate of the CA and the
public key of the CA. With the authentication method X.509, there is also a key file
(*.pem, *.cer or *.crt) for both of the partner stations with the public key of the local
station.
The two methods differ in the exchange of the public key. With X.509 certificate,
the key and the key file are exchanged between the SINAUT MD741-1 and the
VPN gateway manually, for example using a CD-ROM or e-mail. You will find more
information on loading the certificate in section 7.4.
With CA certificate, the key is exchanged between the SINAUT MD741-1 and VPN
gateway of the remote station via the data connection when the VPN connection is
established. Here, there is no manual exchange of key files.
Pre-shared Key (PSK)
This method is supported in the main by older IPsec implementations. Here, the
authentication is made with a previously agreed character string. To achieve a high
degree of security, use character strings made up of approximately 30 uppercase
and lowercase characters as well as numbers selected at random.
Local ID and ID of the partner
The local ID and the ID of the partner are used by IPsec to uniquely identify the
partners during establishment of the VPN connection. The device's own local ID
forms the remote ID of the remote station and vice versa.
●
When authenticating with X.509 certificate and CA certificate:
–
If you leave the default setting "NONE", the distinguished names from the
device's own certificate and from the certificate transferred by the partner
are automatically adopted and used as the local ID and ID of the partner.
–
If you change the entries for the local ID or the ID of the partner manually,
adapt the entries of the partner accordingly. The manual entry for the IDs
must be made in the ASN.1 format, for example "C=XY/O=XY
Org/CN=xy.org.org".
●
With
authentication
using Pre-shared Key:
