User manual AIRLIVE RS-1200

[. . . ] RS-1200 Dual WAN Security Gateway User's Manual Contents System Chapter 1 Administration . . . 5 7 9 10 11 Chapter 2 Configure . . . 35 Interface Chapter 3 Interface . . . 42 50 2 Policy Object Chapter 4 Address . . . [. . . ] IPSec Autokey The system manager can create a VPN connection using Autokey IKE. Autokey IKE (Internet Key Exchange) provides a standard method to negotiate keys between two security gateways. Also set up IPSec Lifetime and Preshared Key of the RS-1200. PPTP Server The System Manager can set up VPN-PPTP Server functions in this chapter. PPTP Client The System Manager can set up VPN-PPTP Client functions in this chapter How to use VPN? To set up a Virtual Private Network (VPN), you need to configure an Access Policy include IPSec Autokey, PPTP Server, or PPTP Client settings of Tunnel to make a VPN connection. 124 Define the required fields of VPN: RSA: A public-key cryptosystem for encryption and authentication. Preshared Key: The IKE VPN must be defined with a Preshared Key. ISAKMP (Internet Security Association Key Management Protocol): An extensible protocol-encoding scheme that complies to the Internet Key Exchange (IKE) framework for establishment of Security Associations (SAs). Main Mode: This is another first phase of the Oakley protocol in establishing a security association, but instead of using three packets like in aggressive mode, it uses six packets. Aggressive mode: This is the first phase of the Oakley protocol in establishing a security association using three data packets. AH (Authentication Header): One of the IPSec standards that allows for data integrity of data packets. ESP (Encapsulating Security Payload): One of the IPSec standards that provides for the confidentiality of data packets. 125 DES (Data Encryption Standard): The Data Encryption Standard developed by IBM in 1977 is a 64-bit block encryption block cipher using a 56-bit key. Triple-DES (3DES): The DES function performed three times with either two or three cryptographic keys. AES (Advanced Encryption Standard): An encryption algorithm yet to be decided that will be used to replace the aging DES encryption algorithm and that the NIST hopes will last for the next 20 to 30 years. NULL Algorithm: It is a fast and convenient connecting mode to make sure its privacy and authentication without encryption. NULL Algorithm doesn't provide any other safety services but a way to substitute ESP Encryption SHA-1 (Secure Hash Algorithm-1): A message-digest hash algorithm that takes a message less than 264 bits and produces a 160-bit digest. MD5: MD5 is a common message digests algorithm that produces a 128-bit message digest from an arbitrary length input, developed by Ron Rivest. GRE/IPSec: The device Select GRE/IPSec (Generic Routing Encapsulation) packet seal technology. 126 Define the required fields of IPSec Function To display the VPN connection status via icon Chart Meaning Name: -Not be applied Disconnect Connecting The VPN name to identify the IPSec Autokey definition. The name must be the only one and cannot be repeated. Gateway IP: The WAN interface IP address of the remote Gateway. IPSec Algorithm: To display the Algorithm way. Configure: Click Modify to change the argument of IPSec; click Remove to remote the setting. (Figure11-1) Figure11-1 IPSec Autokey WebUI 127 Define the required fields of PPTP Server Function PPTP Server: To select Enable or Disable Client IP Range: Setting the IP addresses range for PPTP Client connection To display the VPN connection status via icon Chart Meaning User Name: -Not be applied Disconnect Connecting Display the PPTP Client user's name when connecting to PPTP Server. Client IP: Display the PPTP Client's IP address when connecting to PPTP Server. Uptime: Display the connection time between PPTP Server and Client. Configure: Click Modify to modify the PPTP Server Settings or click Remove to remove the setting (Figure11-2) Figure11-2 PPTP Server WebUI 128 Define the required fields of PPTP Client Function To display the VPN connection status via icon Chart Meaning User Name: -Not be applied Disconnect Connecting Displays the PPTP Client user's name when connecting to PPTP Server. Server IP or Domain Name: Display the PPTP Server IP addresses or Domain Name when connecting to PPTP Server. Encryption: Display PPTP Client and PPTP Server transmission, whether opens the encryption authentication mechanism. Uptime: Displays the connection time between PPTP Server and Client. Configure: Click Modify to change the argument of PPTP Client; click Remove to remote the setting. (Figure11-3) Figure11-3 PPTP Client WebUI 129 Define the required fields of Tunnel Function To display the VPN connection status via icon Chart Meaning Name: -Not be applied Disconnect Connecting The VPN name to identify the VPN tunnel definition. The name must be the only one and cannot be repeated. Source Subnet: Displays the Source Subnet. Destination Subnet: Displays the Destination Subnet. IPSec / PPTP: Displays the Virtual Private Network's(IPSec Autokey, PPTP Server, PPTP Client) settings of Tunnel function. Configure: Click Modify to change the argument of VPN Tunnel; click Remove to remote the setting. (Figure11-4) Figure11-4 VPN Tunnel Web UI 130 We set up two VPN examples in this chapter: No. Suitable Situation Example Page Ex1 IPSec Autokey Setting IPSec VPN connection between two 132 RS-1200 Ex2 PPTP Setting PPTP VPN connection between two 145 RS-1200 131 Setting IPSec VPN connection between two RS-1200 Preparation Company A Company B WAN IP: 61. 11. 11. 11 LAN IP: 192. 168. 10. X WAN IP: 211. 22. 22. 22 LAN IP: 192. 168. 20. X This example takes two RS-1200 as work platform. [. . . ] According to the downstream / upstream report of the selected TOP numbering to draw the Protocol Distribution chart. (Figure16-8) Pull-down menu selection ServiceThe report of Communication Service when WAN users use the RS-1200 to connect to LAN service server. DownstreamThe percentage of downstream and the value of each WAN user who uses RS-1200 to LAN service server. UpstreamThe percentage of upstream and the value of each LAN service server who uses RS-1200 to WAN user. [. . . ]