19216811.liveChapter 18 IPSec VPN
NBG5715 User’s Guide
141
The type of ID can be a domain name, an IP address or an e-mail address. The content is the IP
address, domain name, or e-mail address.
18.7.7.1
ID Type and Content Examples
Two IPSec routers must have matching ID type and content configuration in order to set up a VPN
tunnel.
The two NBG5715s in this example can complete negotiation and establish a VPN tunnel.
The two NBG5715s in this example cannot complete their negotiation because NBG5715 B’s
Local
ID type
is
IP
, but NBG5715 A’s
Remote ID type
is set to
E-mail
. An “ID mismatched” message
displays in the IPSEC LOG.
18.7.8
Pre-Shared Key
A pre-shared key identifies a communicating party during a phase 1 IKE negotiation (see
Section
18.7.3 on page 137
for more on IKE phases). It is called “pre-shared” because you have to share it
with another party before you can communicate with them over a secure connection.
18.7.9
Diffie-Hellman (DH) Key Groups
Diffie-Hellman (DH) is a public-key cryptography protocol that allows two parties to establish a
shared secret over an unsecured communications channel. Diffie-Hellman is used within IKE SA
setup to establish session keys. 768-bit, 1024-bit 1536-bit, 2048-bit, and 3072-bit Diffie-Hellman
groups are supported. Upon completion of the Diffie-Hellman exchange, the two peers have a
shared secret, but the IKE SA is not authenticated. For authentication, use pre-shared keys.
Table 60
Local ID Type and Content Fields
LOCAL ID TYPE=
CONTENT=
IP
Type the IP address of your computer.
DNS
Type a domain name (up to 31 characters) by which to identify this NBG5715.
E-mail
Type an e-mail address (up to 31 characters) by which to identify this NBG5715.
The domain name or e-mail address that you use in the
Local ID
Content
field
is used for identification purposes only and does not need to be a real domain
name or e-mail address.
Table 61
Matching ID Type and Content Configuration Example
NBG5715 A
NBG5715 B
Local ID type: E-mail
Local ID type: IP
Local ID content: [email protected]
Local ID content: 1.1.1.2
Remote ID type: IP
Remote ID type: E-mail
Remote ID content: 1.1.1.2
Remote ID content: [email protected]
Table 62
Mismatching ID Type and Content Configuration Example
NBG5715 A
NBG5715 B
Local ID type: IP
Local ID type: IP
Local ID content: 1.1.1.10
Local ID content: 1.1.1.2
Remote ID type: E-mail
Remote ID type: IP
Remote ID content: [email protected]
Remote ID content: 1.1.1.0