31,703
edits
Changes
IPsec configuration examples (view source)
Revision as of 08:03, 18 January 2019
, 08:03, 18 January 2019→Remote LAN access
'''Prerequisites''':
'''Prerequisites''':
* Two RUTxxx routers of any type (excluding [[RUT850]])
* Two RUTxxx routers of any type (excluding [[RUT850]])
* Both routers must have a Public Static or Public Dynamic IP addresses
* At least one router must have a Public Static or Public Dynamic IP address
* At least one end device (PC, Laptop, Tablet, Smartphone) to configure the routers
* At least one end device (PC, Laptop, Tablet, Smartphone) to configure the routers
* (Optional) A second end device to configure and test remote LAN access
* (Optional) A second end device to configure and test remote LAN access
[[File:Configuration examples ipsec scheme 1.png]]
[[File:Configuration examples ipsec scheme 1.png]]
The figure above above depicts two RUTxxx routers (RUT1 and RUT2) connected by an IPsec tunnel via the Internet.
The figure above depicts two RUTxxx routers (RUT1 and RUT2) connected by an IPsec tunnel via the Internet.
----
----
'''Configuration scheme 2''':
'''Configuration scheme 2''':
* You will be redirected to the instance's configuration window. From here we will discuss how to configure both instances (''RUT1'' and ''RUT2''). Creating a second instance is analogous to how we created the first one - just login to the second router and repeat the first two steps. Although not mandatory, we recommend that you use a distinct name for the second instance (for this example we use ''RUT2'') for easier management purposes. <br> The specifics of both configurations are described in the figure below:
* You will be redirected to the instance's configuration window. From here we will discuss how to configure both instances (''RUT1'' and ''RUT2''). Creating a second instance is analogous to how we created the first one - just login to the second router and repeat the first two steps. Although not mandatory, we recommend that you use a distinct name for the second instance (for this example we use ''RUT2'') for easier management purposes. <br> The specifics of both configurations are described in the figure below:
[[File:Creating an ipsec instance part 3 v3.png]]
[[File:Creating an ipsec instance part 3 v3.png|1150px]]
* Below are explanations of the parameters highlighted in the figure above. Other parameters (not highlighted) are defaults. You can find descriptions for these parameters in the '''[[VPN#IPsec|VPN manual page, IPsec section]]'''
* Below are explanations of the parameters highlighted in the figure above. Other parameters (not highlighted) are defaults. You can find descriptions for these parameters in the '''[[VPN#IPsec|VPN manual page, IPsec section]]'''
* The last step in configuring the IPsec instances is '''Phase settings'''. For this example we left the default Phase settings. If you're planning to change Phase settings, make sure they match with the Phase settings (both Phase 1 and Phase 2) of the incoming connection:
* The last step in configuring the IPsec instances is '''Phase settings'''. For this example we left the default Phase settings. If you're planning to change Phase settings, make sure they match with the Phase settings (both Phase 1 and Phase 2) of the incoming connection:
[[File:Creating an ipsec instance part 4 v2.png]]
[[File:Creating an ipsec instance part 4 v2.png|1150px]]
When you're finished with the configuration, don't forget to click the "Save" button.
When you're finished with the configuration, don't forget to click the "Save" button.
===Remote LAN access===
<!--===Remote LAN access===
----
----
Once your IPsec tunnel is operational, you can configure remote access to LAN devices via the tunnel as referenced in ''[[IPsec_configuration_examples#Configuration_overview_and_prerequisites|configuration scheme 2]]''. This section provides a description on how to do just that.
Once your IPsec tunnel is operational, you can configure remote access to LAN devices via the tunnel as referenced in ''[[IPsec_configuration_examples#Configuration_overview_and_prerequisites|configuration scheme 2]]''. This section provides a description on how to do just that.
'''NOTE''': make sure to add a new entry in the Static Routes table when you configure custom routes. You can configure existing routes, but take note that this may cause backup WAN to function improperly or not at all.
'''NOTE''': make sure to add a new entry in the Static Routes table when you configure custom routes. You can configure existing routes, but take note that this may cause backup WAN to function improperly or not at all.
-->
==Testing the setup==
==Testing the setup==
