19216811.liveFVS338 ProSafe VPN Firewall 50 Reference Manual
5-6
Virtual Private Networking
v1.0, September 2006
•
Manual
. All settings (including the keys) for the VPN tunnel are manually input at each end
(both VPN endpoints). No third party server or organization is involved.
•
Auto
. Some parameters for the VPN tunnel are generated automatically by using the IKE
(Internet Key Exchange) protocol to perform negotiations between the two VPN endpoints
(the Local ID Endpoint and the Remote ID Endpoint).
In addition, a CA (Certificate Authority) can also be used to perform authentication (see
“Certificates” on page 5-33
). To use a CA, each VPN Gateway must have a Certificate from the
CA. For each Certificate, there is both a “Public Key” and a “Private Key”. The “Public Key” is
freely distributed, and is used to encrypt data. The receiver then uses their “Private Key” to decrypt
the data (without the Private Key, decryption is impossible). CAs can be beneficial since using
them reduces the amount of data entry required on each VPN Endpoint.
VPN Policy Operation
The VPN Policies screen allows you to add additional policies—either Auto or Manual—and to
manage the VPN policies already created. You can edit policies, enable or disable them, or delete
them entirely. The rules for VPN policy use conform to:
1.
Traffic covered by a policy will automatically be sent via a VPN tunnel.
2.
The VPN tunnel is created according to the parameters in the SA (Security Association).
3.
The remote VPN Endpoint must have a matching SA, or it will refuse the connection.
VPN Policy Table
When you use the VPN Wizard to set up a VPN tunnel, both a VPN Policy and an IKE Policy is
established and populated in both Tables on the VPN Policies screen. The name you selected as the
VPN Tunnel connection name during Wizard setup identifies both the VPN Policy and IKE Policy.
You can also edit exiting policies, add new VPN policies directly or change the policy hierarchy to
the Policy Table. The Policy Table contains the following fields:
•
! (Status)
. Indicates whether the policy is enabled (green circle) or disabled (grey circle). To
Enable or Disable a Policy, check the radio box adjacent to the circle and click
Enable
or
Disable
, as required.
•
Name
. Each policy is given a unique name (the Connection Name when using the VPN
Wizard). Client Policies are annotated by an “*”.
•
Type
. The Type is “Auto” or “Manual” as described previously (Auto is used during VPN
Wizard configuration).