Creating and Modifying IPsec Tunnel Entries

Specifies the operating mode for communication with the remote VPN peer for IKE negotiations and IPsec connections.

Initiator: Enables the branch office

gateway to initiate the IKE Security Association (SA) and IPsec tunnel negotiation request.
Responder: Enables the corporate gateway to receive the request to establish an IKE/IPsec tunnel connection.

Specifies the how

communications with the remote VPN peer is initiated. The IKE and IPsec phase negotiations are initiated as either permanent or on-demand depending on the type of activation selected. This field is only visible when "Initiator" is selected in the Operating Mode list box.
Always: Initiates the IKE Security Association(SA) and IPsec phase negotiations permanently with the remote VPN peer.
Link Monitor Action: Initiates the IKE and IPsec phase negotiations with the remote VPN peer as on-demand upon request from the link monitor switch-over action.

Enabled: The local address is acquired during negotiation by automatic keying. Overrides any assigned local address.
Disabled: The value in the Local Address field is used.

Specifies the IP address or fully-qualified domain name of the local network interface. If Allow Any Local Address is enabled, then the

allows any outgoing address during negotiations.

Enabled: The remote address is acquired during negotiation by automatic keying. Overrides any assigned remote address.
Disabled: The value in the Remote Address field is used.
This field is only visible when Responder is selected in the Operator Mode select list.

Specifies the IP address or fully-qualified domain name of the remote network interface. If Allow any remote address is enabled, the

allows any incoming address during negotiations.

Specifies the IP address of the private subnet behind the local network interface. This can be expressed as network/netmask. Maximum of 10 subnets can be specified. Allow traffic on any address is represented as 0.0.0.0/0. Setting both the Local Subnet Address and the Remote Subnet Address to all traffic 0.0.0.0/0 is not a valid configuration for security concerns.

Specifies the IP address of the private subnet behind the remote network interface. This can be expressed as network/netmask. A maximum of 10 subnets can be specified. Allow traffic on any address is represented as 0.0.0.0/0. Setting both the Local Subnet Address and the Remote Subnet Address to all traffic 0.0.0.0/0 is not a valid configuration for security concerns.

Enabled: Specifies that the local VPN gateway performs forwarding and firewalling using IP tables for traffic from Local Subnet Address and Remote Subnet Address fields.
Disabled: Specifies that IP tables policy rules are not created for traffic to and from the peer endpoint.

Specifies whether or not the

requests a renegotiation when the connection expires.

Enabled: Initiate SA Negotiation upon connection expiry. Applies to both IKE SA and IPsec SA.
Disabled: SA Negotiation is not initiated upon connection expiry.

Specifies the number of times the

will attempt to negotiate a connection. Applies to both IKE SA and IPsec SA.

If the number of number of retries value is exceeded, the

issues a Tunnel Link Lost alarm."

Specifies the duration, in seconds, of an IKE SA connection keying channel.

Specifies the duration, in seconds, of the IPsec SA connection, from successful negotiation to expiry.

Specifies the length of time, in seconds, before SA expiry that the rekeying should start. Applies to both IKE SA and IPsec SA.

When enabled, a new ISAKMP SA is created for each IPsec SA negotiation and a Diffie-Hellman exchange is performed for each IPsec SA negotiation.

Specifies whether or not the

reauthenticates when a re-key is accomplished.

Enabled: IKE SA Rekeying also initiates Peer Authentication. IKE and IPsec SA's are uninstalled then recreated.
Disabled: IKE SA Rekeying performed without the Peer Authentication.

Specifies whether or not the Subject Alternative Name (SAN) Identifier is used for peer authentication. This field is only visible when Certificate is selected from the "Authentication Mode* select list.

Enabled: The SAN Identifier is sent to the remote gateway for an authentication match. The SAN identifier must be configured in the Local SAN Identifier attribute when this option is Enabled.
Disabled: By default, the

Certificate's Subject Distinguished Name (Subject DN) identifier is automatically extracted from the certificate and sent to the remote gateway for an authentication config match.

Specifies the SAN identifier to be sent to the remote gateway for a peer authentication config match. This field is only available if Enabled is selected in the Use SAN Identifier select list.

If the Peer Authentication Identifier on the remote gateway is configured to authenticate a SAN identifier from the peer's certificate, it will attempt to match its configured SAN identifier with the expected SAN identifier retrieved from the peer authentication config.

If Use SAN Identifier is enabled, the SAN identifier must be picked from a list of DNS names displayed under the local attributes for the

Unable to show "metadata-from": No such page "_space_variables"

Certificate.

Specifies the authentication method required from the remote side.

Certificate: Specifies the use of public key signature when authenticating the peer VPN gateway. The

must contain a valid server certificate/private key, the Certificate Authority (CA) that signed the server certificate, and the CA that signed the peer's Server Certificate.

Preshared Key: Specifies the key to be shared with the peer. This key must match the same key configured on the peer system.

Specifies an identifier for a peer.

When Preshared Key is selected from the Peer Authentication Mode list box, the identifier may be an IP address, fully qualified domain name, or any.

When Certificate is selected from the Peer Authentication Mode list box, the identifier may be the peer certificate's Subject Alternative Name (SAN) or Subject Distinguished Name (DN). If the SAN or DN are unknown a vaalue of any may be used allowing any peer with a trusted and non-revoked certificate.

Specifies how the peer is identified for IKE preshared key authentication.

The identifier selector can be an all host address(0.0.0.0), a specific IP address or a fully-qualified domain name of the remote LAN network interface. This option is available when "Allow any address" is set to "True" and the "Peer Authentication Mode" is set to "Preshared Key".'

A strong passphrase used for authentication.

Specifies the Internet Key Exchange (IKE) and Encapsulating Security Payload (ESP) encryption algorithm.

Specifies the IKE ESP and hash algorithm.

Specifies which Diffie-Hellman group to use for exchanging keys (IKE and ESP).