1. Home
    2. /
  2. Manuals
    3. /
  3. Billion
    4. /
  4. BiPAC 7800VDOX
    5. /
  5. 45
Page 221 / 308 Scroll up to view Page 216 - 220
216
VPN
A
virtual private network
(
VPN
) is a private network that interconnects remote (and often
geographically separate) networks through primarily public communication infrastructures such as
the Internet. VPNs provide security through tunneling protocols and security procedures such as
encryption. For example, a VPN could be used to securely connect the branch offices of an
organization to a head office network through the public Internet.
IPSec
Internet Protocol Security
(
IPsec
) is a protocol suite for securing Internet Protocol (IP)
communications by authenticating and encrypting each IP packet of a communication session. IPsec
also includes protocols for establishing mutual authentication between agents at the beginning of the
session and negotiation of cryptographic keys to be used during the session.
IPsec is an end-to-end security scheme operating in the Internet Layer of the Internet Protocol Suite.
It can be used in protecting data flows between a pair of security gateways (
network-to-network
), or
between a security gateway and a host (
network-to-host
).
Note:
A maximum of 16 sessions for IPSec.
NAT Traversal
NAT Traversal:
This directive enables use of the NAT-Traversal IPsec extension (NAT-T). NAT-T
allows one or both peers to reside behind a NAT gateway (i.e., doing address- or port-translation).
Keep Alive:
Type the interval time(sec) for sending packets to keep the NAT Traversal alive.
Click
Apply
to save and apply your settings.
Page 222 / 308
217
Click
Add
to create IPSec connections.
IPSec Settings
L2TP over IPSec:
Select Enable if user wants to use L2TP over IPSec. See
L2TPover IPSec
Connection Name:
A given name for the connection, but it should contain no spaces (e.g.
“connection-to-office”).
WAN Interface:
Select the set used interface for the IPSec connection, when you select adsl
pppoe_0_0_35/ppp0.1 interface, the IPSec tunnel would transmit data via this interface to connect to
the remote peer.
IP Version:
Select the IP version base on your network framework.
Local Network:
Set the IP address or subnet of the local network.
Single Address:
The IP address of the local host, for establishing an IPSec
connection between a security gateway and a host (
network-to-host
).
Subnet:
The subnet of the local network, for establishing an IPSec tunnel between a
pair of security gateways (
network-to-network
)
IP Address:
The local network address.
Netmask
: The local network netmask.
Remote Secure Gateway:
The IP address of the remote VPN device that is connected and
establishes a VPN tunnel.
Anonymous:
Enable any IP to connect in.
Remote Network:
Set the IP address or subnet of the remote network.
Single Address:
The IP address of the local host, for establishing an IPSec
connection between a security gateway and a host (
network-to-host
). If the remote
peer is a host, select Single Address.
Subnet:
The subnet of the local network, for establishing an IPSec tunnel between a
pair of security gateways (
network-to-network
), If the remote peer is a network, select
Subnet.
Page 223 / 308
218
Key Exchange Method:
Displays key exchange method.
Pre-Shared Key:
This is for the Internet Key Exchange (IKE) protocol, a string from 4 to 128
characters. Both sides should use the same key. IKE is used to establish a shared security policy
and authenticated keys for services (such as IPSec) that require a key. Before any IPSec traffic can
be passed, each router must be able to verify the identity of its peer. This can be done by manually
entering the pre-shared key into both sides (router or hosts).
Local ID Type
and
Remote ID Type:
When the mode of phase 1 is aggressive, Local and Remote
peers can be identified by other IDs.
ID content:
Enter ID content the name you want to identify when the Local and Remote Type are
Domain Name; Enter ID content IP address you want to identify when the Local and Remote Type
are IP addresses (IPv4 and IPv6 supported).
Phase 1
Mode:
Select IKE mode from the drop-down menu:
Main
or
Aggressive
. This IKE provides
secured key generation and key management.
Encryption Algorithm:
Select the encryption algorithm from the drop-down menu. There are
several options: 3DES and AES (128, 192 and 256). 3DES and AES are more powerful but
increase latency.
DES:
Stands for Triple Data Encryption Standard, it uses 56 bits as an encryption method.
3DES:
Stands for Triple Data Encryption Standard, it uses 168 (56*3) bits as an encryption
method.
AES:
Stands for Advanced Encryption Standards, you can use 128, 192 or 256 bits as
encryption method.
Integrity Algorithm:
Authentication establishes the integrity of the datagram and ensures it is not
tampered with in transmit. There are 2 options: Message Digest 5 (MD5) and Secure Hash
Algorithm (SHA1). SHA1 is more resistant to brute-force attacks than MD5. However, it is slower.
MD5:
A one-way hashing algorithm that produces a 128
−
bit hash.
SHA1:
A one-way hashing algorithm that produces a 160
−
bit hash.
DH Group:
It is a public-key cryptography protocol that allows two parties to establish a shared
secret over an unsecured communication channel (i.e. over the Internet). MODP stands for Modular
Exponentiation Groups.
SA Lifetime:
Specify the number of minutes that a Security Association (SA) will stay active before
new encryption and authentication key will be exchanged. Enter a value to issue an initial
connection request for a new VPN tunnel. Default is 480 minutes (28800 seconds). A short SA time
increases security by forcing the two parties to update the keys. However, every time when the VPN
tunnel re-negotiates, access through the tunnel will be temporarily disconnected.
Phase 2
Encryption Algorithm:
Select the encryption algorithm from the drop-down menu. There are
several options: 3DES and AES (128, 192 and 256). 3DES and AES are more powerful but
increase latency.
Integrity Algorithm:
Authentication establishes the integrity of the datagram and ensures it is not
tampered with in transmit. There are 2 options: Message Digest 5 (MD5) and Secure Hash
Algorithm (SHA1). SHA1 is more resistant to brute-force attacks than MD5. However, it is slower.
DH Group:
It is a public-key cryptography protocol that allows two parties to establish a shared
secret over an unsecured communication channel (i.e. over the Internet). MODP stands for Modular
Exponentiation Groups.
Page 224 / 308
219
IPSec Lifetime:
Specify the number of minutes that IPSec will stay active before new encryption
and authentication key will be exchanged. Enter a value to negotiate and establish secure
authentication. Default is 60 minutes (3600 seconds). A short time increases security by forcing the
two parties to update the keys. However, every time when the VPN tunnel re- negotiates, access
through the tunnel will be temporarily disconnected.
Ping for Keep Alive:
Select the operation methods:
None:
The default setting is “None”. To this mode, it will not detect the remote IPSec peer
has been lost or not. It only follows the policy of Disconnection time after no traffic, which the
remote IPSec will be disconnected after the time you set in this function.
DPD:
Dead peer detection (DPD) is a keeping alive mechanism that enables the router to be
detected lively when the connection between the router and a remote IPSec peer has lost.
Please be noted, it must be enabled on the both sites.
Detection Interval:
The period cycle for dead peer detection. The interval can be 180~86400
seconds.
Idle Timeout:
Auto-disconnect the IPSec connection after trying several consecutive times.
Ping:
This mode will detect whether the remote IPSec peer has lost or not by pinging specify IP
address.
Ping IP:
Type the IP for ping operation.
It is able to IP Ping the remote PC with the specified IP
address and alert when the connection fails. Once alter message is received, Router will drop this
tunnel connection. Reestablish of this connection is required. Default setting is 0.0.0.0 which
disables the function.
Interval:
This sets the time interval between Pings to the IP function to monitor the connection
status. Default interval setting is 10 seconds. Time interval can be set from 0 to 3600 second, 0
second disables the function.
MTU:
Maximum Transmission Unit, maximum value is 1500.
Page 225 / 308
220
IPSec for L2TP
Connection Name:
A given name for the connection, but it should contain no spaces (e.g.
“connection-to-office”).
WAN Interface:
Select the set interface for the IPSec tunnel.
Remote Security Gateway:
Input the IP of remote security gateway.
Key Exchange Method:
Displays key exchange method.
Pre-Shared Key:
This is for the Internet Key Exchange (IKE) protocol, a string from 4 to 128
characters. Both sides should use the same key. IKE is used to establish a shared security policy
and authenticated keys for services (such as IPSec) that require a key. Before any IPSec traffic can
be passed, each router must be able to verify the identity of its peer. This can be done by manually
entering the pre-shared key into both sides (router or hosts).
Encryption Algorithm:
Select the encryption algorithm from the drop-down menu. There are
several options: 3DES and AES (128, 192 and 256). 3DES and AES are more powerful but
increase latency.
DES:
Stands for Triple Data Encryption Standard, it uses 56 bits as an encryption method.
3DES:
Stands for Triple Data Encryption Standard, it uses 168 (56*3) bits as an encryption
method.
AES:
Stands for Advanced Encryption Standards, you can use 128, 192 or 256 bits as
encryption method.
Integrity Algorithm:
Authentication establishes the integrity of the datagram and ensures it is not
tampered with in transmit. There are 2 options: Message Digest 5 (MD5) and Secure Hash
Algorithm (SHA1). SHA1 is more resistant to brute-force attacks than MD5. However, it is slower.
MD5:
A one-way hashing algorithm that produces a 128
−
bit hash.
SHA1:
A one-way hashing algorithm that produces a 160
−
bit hash.
DH Group:
It is a public-key cryptography protocol that allows two parties to establish a shared
secret over an unsecured communication channel (i.e. over the Internet). MODP stands for Modular
Exponentiation Groups.
IPSec Lifetime:
Specify the number of minutes that IPSec will stay active before new encryption
and authentication key will be exchanged. Enter a value to negotiate and establish secure
authentication. Default is 60 minutes (3600 seconds). A short time increases security by forcing the
two parties to update the keys. However, every time when the VPN tunnel re- negotiates, access
through the tunnel will be temporarily disconnected.

Rate

4.5 / 5 based on 2 votes.

Popular Billion Models

Famous Router IPs
Famous Router Companies
Bookmark Our Site

Press Ctrl + D to add this site to your favorites!

Share
Top