Page History

...

To create or modify an existing IPsec Tunnel:

...

The Restart Service button on the IPsec Tunnel Table page enables you to restart the services in order for any changes to the system certificates to become effective. For more information about system certificates, see refer to Managing IPsec Tunnels.

1. Click on Restart Services on the IPsec Tunnel Table page. A confirmation window is displayed.
2. Click OK.

Creating an IPsec Tunnel

...

To create an IPsec Tunnel

1. Click the Create IPsec Tunnel Entry ( ) icon on the IPsec Connection Table page.

   Panel
   borderStyle none
   Caption 0 Figure 1 Create IPsec Tunnel Entry Image Modified

    

   Anchor
   properties properties

...

Panel
bgColor #FAFAFA borderStyle none
Specifies the operating mode for communication with the remote VPN peer for IKE negotiations and IPsec connections. Initiator: Enables the branch office SBC Spacevars 0 product2 gateway to initiate the IKE Security Association (SA) and IPsec tunnel negotiation request. Responder: Enables the corporate SBC Spacevars 0 product2 gateway to receive the request to establish an IKE/IPsec tunnel connection.

...

Panel
bgColor #FAFAFA borderStyle none
Specifies the how SBC Spacevars 0 product2 communications with the remote VPN peer is initiated. The IKE and IPsec phase negotiations are initiated as either permanent or on-demand depending on the type of activation selected. This field is only visible when "Initiator" is selected in the Operating Mode list box. Always: Initiates the IKE Security Association(SA) and IPsec phase negotiations permanently with the remote VPN peer. Link Monitor Action: Initiates the IKE and IPsec phase negotiations with the remote VPN peer as on-demand upon request from the link monitor switch-over action.

...

Panel
bgColor #FAFAFA borderStyle none
Specifies the IP address or fully-qualified domain name of the local network interface. If Allow Any Local Address is enabled, then the SBC Spacevars 0 product2 allows any outgoing address during negotiations.

...

Panel
bgColor #FAFAFA borderStyle none
Specifies the IP address or fully-qualified domain name of the remote network interface. If Allow any remote address is enabled, the SBC Spacevars 0 product2 allows any incoming address during negotiations.

...

Panel
bgColor #FAFAFA borderStyle none
Specifies whether or not the SBC Spacevars 0 product2 requests a renegotiation when the connection expires. Enabled: Initiate SA Negotiation upon connection expiry. Applies to both IKE SA and IPsec SA. Disabled: SA Negotiation is not initiated upon connection expiry.

...

Panel
bgColor #FAFAFA borderStyle none
Specifies the number of times the SBC Spacevars 0 product2 will attempt to negotiate a connection. Applies to both IKE SA and IPsec SA. If the number of number of retries value is exceeded, the SBC Spacevars 0 product2 issues a Tunnel Link Lost alarm."

...

Panel
bgColor #FAFAFA borderStyle none
Specifies whether or not the SBC Spacevars 0 product2 reauthenticates when a re-key is accomplished. Enabled: IKE SA Rekeying also initiates Peer Authentication. IKE and IPsec SA's are uninstalled then recreated. Disabled: IKE SA Rekeying performed without the Peer Authentication.

...

Panel
bgColor #FAFAFA borderStyle none
Specifies whether or not the Subject Alternative Name (SAN) Identifier is used for peer authentication. This field is only visible when Certificate is selected from the "Authentication Mode* select list. Enabled: The SAN Identifier is sent to the remote gateway for an authentication match. The SAN identifier must be configured in the Local SAN Identifier attribute when this option is Enabled. Disabled: By default, the Sonus SBC Spacevars 0 product2 Certificate's Subject Distinguished Name (Subject DN) identifier is automatically extracted from the certificate and sent to the remote gateway for an authentication config match.

...

Panel
bgColor #FAFAFA borderStyle none
Specifies the SAN identifier to be sent to the remote gateway for a peer authentication config match. This field is only available if Enabled is selected in the Use SAN Identifier select list. If the Peer Authentication Identifier on the remote gateway is configured to authenticate a SAN identifier from the peer's certificate, it will attempt to match its configured SAN identifier with the expected SAN identifier retrieved from the peer authentication config. If Use SAN Identifier is enabled, the SAN identifier must be picked from a list of DNS names displayed under the local attributes for the Sonus SBC Spacevars 0 product2 Certificate.

Authentication Mode

...

DH Group