Changes

Template:Networking rut2xx manual vpn ipsec (view source)

Revision as of 12:05, 17 October 2019

120 bytes removed , 12:05, 17 October 2019

→‎IPsec configuration

Line 20: Line 20:

<td>Enable</td>

<td>yes | no; default: no</td>

−

<td>Turns the IPsec instance on or off.</td>

+

<td>Turns the IPsec instance on or off</td>

</tr>

+

<tr>

+

<td>Enable IPv6</td>

+

<td>yes | no; default: no</td>

+

<td>Turns the IPv6 address of the left interface on or off</td>

+

</tr>

+

<tr>

+

<td>Authentication type</td>

+

<td>Pre-shared key | X.509; default: Pre-shared key</td>

+

<td>Authentication type accordingly to your IPsec configuration. IPsec </td>

+

</tr>

+

<!--

+

<tr>

+

+

<td>.key file; default: none</td>

+

<td>Authenticates to the server and establishes precisely who they are.</td>

+

</tr>

+

<tr>

+

<td>X.509: Certificate file</td>

+

<td>.crt file; default: none</td>

+

+

</tr>

+

<tr>

+

<td>X.509: Remote endpoint certificate</td>

+

<td>.crt file; default: none</td>

+

+

</tr>

+

<tr>

+

<td>X.509: CA certificate</td>

+

<td>.ca file; default: none</td>

+

<td>CA certificate issued by Certificate authority (CA) is an entity that issues digital certificates. A digital certificate certifies the ownership of a public key by the named subject of the certificate.</td>

+

</tr>

+

-->

<tr>

<td>IKE version</td>

<td>IKEv1 | IKEv2; default: IKEv1</td>

−

<td>Internet Key Exchange (IKE) version used for key exchange.

+

<td>Internet Key Exchange (IKE) version used for key exchange

<ul>

<li>IKEv1 - more commonly used but contains known issues, for example, dealing with NAT.</li>

−

<li>IKEv2 - updated version with increased and improved capabilities, such as integrated NAT support, supported multihosting, deprecated exchange modes (does not use main or aggressive mode; only 4 messages required to establish a connection).</li>

+

<li>IKEv2 - updated version with increased and improved capabilities, such as integrated NAT support, supported multihosting, deprecated exchange modes (does not use main or aggressive mode; only 4 messages required to establish a connection)</li>

</ul>

</td>

Line 38: Line 70:

<ul>

<li>Main - performs three two-way exchanges between the initiator and the receiver (a total of 9 messages).</li>

−

<li>Aggressive - performs fewer exchanges than main mode (a total of 6 messages) by storing most data into the first exchange. In aggressive mode, the information is exchanged before there is a secure channel, making it less secure but faster than main mode.</li>

+

<li>Aggressive - performs fewer exchanges than main mode (a total of 6 messages) by storing most data into the first exchange. In aggressive mode, the information is exchanged before there is a secure channel, making it less secure but faster than main mode</li>

</ul>

</td>

Line 51: Line 83:

</ul>

</td>

−

~~</tr>~~

−

~~<tr>~~

−

~~<td>My identifier type</td>~~

−

~~<td>FQDN | User FQDN | Address; default: FQDN</td>~~

−

~~<td>Defines the type of identity used in user (IPsec instance) authentication.~~

−

~~<ul>~~

−

~~<li>FQDN - identity defined by fully qualified domain name. It is the complete domain name for a host (for example, something.somedomain.com). Only supported with IKEv2.</li>~~

−

~~<li>User FQDN - identity defined by fully qualified username string (for example, [email protected]). Only supported with IKEv2.</li>~~

−

~~<li>Address - identity by IP address.</li>~~

−

~~</ul>~~

−

~~</td>~~

−

~~</tr>~~

<tr>

<td>On startup</td>

Line 68: Line 88:

<td>Defines how the instance should act on router startup.

<ul>

−

~~<li>Ignore - does not start the tunnel.</li>~~

<li>Add - loads a connection without starting it.</li>

<li>Route - starts the tunnel only if there is traffic.</li>

Line 113: Line 132:

<td>Remote VPN endpoint</td>

<td>host | ip; default: none</td>

−

<td>IP address or hostname of the remote IPsec instance.</td>

+

<td>IP address or hostname of the remote IPsec instance</td>

+

</tr>

+

<tr>

+

<td>Remote identifier</td>

+

<td>string | ip; default: none</td>

+

<td>FQDN or IP address of remote peer. Leave empty for any</td>

</tr>

<tr>

−

<td>Tunnel: Remote IP address/~~subnet~~ mask</td>

+

<td>Tunnel: Remote IP address/Subnet mask</td>

<td>ip/netmask; default: none</td>

−

<td>Remote network IP address and subnet mask used to determine which part of the network can be accessed in the VPN network. Netmask range [0..32]. This value must differ from the device’s LAN IP.</td>

+

<td>Remote network IP address and subnet mask used to determine which part of the network can be accessed in the VPN network. Netmask range [0..32]. This value must differ from the device’s LAN IP</td>

</tr>

<tr>

<td>Right firewall</td>

<td>yes | no; default: yes</td>

−

<td>Adds neccessary firewall rules to allow traffic of from the opposite IPsec instance on this router~~.</td>~~

+

<td>Adds neccessary firewall rules to allow traffic of from the opposite IPsec instance on this router</td>

−

~~</tr>~~

−

~~<tr>~~

−

~~<td>Transport: Use with DMVPN</td>~~

−

~~<td>yes | no; default: no</td>~~

−

~~<td>Adds several necessary options to make DMVPN work.</td>~~

−

~~</tr>~~

−

~~<tr>~~

−

~~<td>Enable keepalive</td>~~

−

~~<td>yes | no; default: no</td>~~

−

~~<td>When enabled, the instance sends ICMP packets to the specified host at the specified frequency. If no response is received, the router will attempt to restart the connection.</td>~~

−

~~</tr>~~

−

~~<tr>~~

−

~~<td>Host</td>~~

−

~~<td>host | ip; default: none</td>~~

−

~~<td>Hostname or IP address to which keepalive ICMP packets will be sent to.</td>~~

−

~~</tr>~~

−

~~<tr>~~

−

~~<td>Ping period (sec)</td>~~

−

~~<td>integer [0..9999999]; default: none</td>~~

−

~~<td>The frequency at which keepalive ICMP packets will be sent to the specified host or IP address.~~</td>

</tr>

<tr>

<td>Allow WebUI access</td>

<td>yes | no; default: no</td>

−

<td>Allows WebUI access for hosts in the VPN network.</td>

+

<td>Allows WebUI access for hosts in the VPN network</td>

</tr>

<tr>

Line 161: Line 165:

<li>Some configuration fields become available only when certain other parameters are selected. The names of the parameters are followed by a prefix that specifies the authentication type under which they become visible. Different color codes are used for different prefixes:

<ul>

+

<li>Red for Type: Tunnel</li>

<li>Purple for Type: Transport</li>

Aivaras

Administrators

538

edits