9,590
edits
Changes
Template:Networking rut2xx manual vpn ipsec (view source)
Revision as of 08:48, 19 August 2021
, 08:48, 19 August 2021no edit summary
The <b>IPsec configuration</b> section is used to configure the main parameters of an IPsec connection. Refer to the figure and table below for information on the configuration fields located in the general settings section.
The <b>IPsec configuration</b> section is used to configure the main parameters of an IPsec connection. Refer to the figure and table below for information on the configuration fields located in the general settings section.
[[File:{{{file_ipsec_config}}}]]
[[File:{{{file_ipsec_config}}}|border|class=tlt-border]]
<table class="nd-mantable">
<table class="nd-mantable">
<td>yes | no; default: <b>no</b></td>
<td>yes | no; default: <b>no</b></td>
<td>Turns the IPv6 address of the left interface on or off</td>
<td>Turns the IPv6 address of the left interface on or off</td>
</tr>
<tr>
<td>Left IPv6</td>
<td>IPv6 address; default: <b>none</b></td>
<td>IPv6 address used as the source. If left empty, uses one of the available global addresses.</td>
</tr>
</tr>
<tr>
<tr>
</ul>
</ul>
</td>
</td>
</tr>
<tr>
<td>Ignore security</td>
<td>yes | no; default: <b>no</b></td>
<td>If enabled responders are allowed to use IKEv1 Aggressive Mode with pre-shared keys. Discouraged to use due to security concerns.</td>
</tr>
<tr>
<td>Use additional xauth authentification</td>
<td><span style="color:tomato; font-weight:bold;">yes</span> | no; default: <b>no</b></td>
<td>Turns additional xauth authentification for this instance on or off.</td>
</tr>
<tr>
<td><span style="color:tomato; font-weight:bold;">Xauth password</span></td>
<td>string; default: <b>none</b></td>
<td>Password for xauth.</td>
</tr>
</tr>
<tr>
<tr>
<td>ip/netmask; default: <b>none</b></td>
<td>ip/netmask; default: <b>none</b></td>
<td>Remote network IP address and subnet mask used to determine which part of the network can be accessed in the VPN network. Netmask range [0..32]. This value must differ from the device’s LAN IP</td>
<td>Remote network IP address and subnet mask used to determine which part of the network can be accessed in the VPN network. Netmask range [0..32]. This value must differ from the device’s LAN IP</td>
</tr>
<tr>
<td>Passthrough networks</td><td>None | LAN | Wired | WiFi | Mobile | custom; default: '''none'''</td>
<td>Select networks which should be passthrough and excluded from routing through tunnel</td>
</tr>
</tr>
<tr>
<tr>
<td>yes | no; default: <b>no</b></td>
<td>yes | no; default: <b>no</b></td>
<td>Allows WebUI access for hosts in the VPN network</td>
<td>Allows WebUI access for hosts in the VPN network</td>
</tr>
<tr>
<td>Compatibility mode</td>
<td>yes | no; default: <b>no</b></td>
<td>Enable this if multiple subnets do not work with a 3rd party IPsec peer.</td>
</tr>
</tr>
<tr>
<tr>
<b>Additional notes</b>:
<b>Additional notes</b>:
<ul>
<ul>
<li>Some configuration fields become available only when certain other parameters are selected. The names of the parameters are followed by a prefix that specifies the authentication type under which they become visible. Different color codes are used for different prefixes:
<li>Some configuration fields become available only when certain other parameters are selected. Different color codes are used for different parameters:
<ul>
<ul>
<!--<li>Green for <span style="color: #6E9710;">Authentication type: X.509</span></li>-->
<!--<li>Green for <span style="color: #6E9710;">Authentication type: X.509</span></li>-->
===Pre-shared keys===
===Pre-shared keys===
----
----
A <b>pre-shared key</b> is a secret password used for authentication between IPsec peers before a secure tunnel is established. To create a new key, click the 'Add' button.
A <b>pre-shared key</b> is a secret password used for authentication between IPsec peers
before a secure tunnel is established. During authentication device will try to check if
connection matches any <b>Secret's ID selector</b> and then the <b>pre-shared key</b> from
the first match will be used.
To create a new key, click the 'Add' button.
The figure below is an example of the Pre-shared keys section and the table below provides information on configuration fields contained in that section:
The figure below is an example of the Pre-shared keys section and the table
below provides information on configuration fields contained in that section:
[[File:{{{file_ipsec_psk}}}]]
[[File:{{{file_ipsec_psk}}}]]