CONEL SPECTRE v3 ERT — настройка IPsec туннелей: параметры и рекомендации [71/136]

Превью страниц Страница 71 / 136

4. CONFIGURATION

Continued from previous page

Item Description

Remote Subnet Mask Subnet mask of a network behind remote side of the tunnel.

Remote Protocol/Port Speciﬁes Protocol/Port of remote side of the tunnel. The general

form is protocol/port, for example 17/1701 for UDP (protocol 17)

and port 1701. It is also possible to enter only the number of

protocol, however, the above mentioned format is preferred.

Local ID Identiﬁer (ID) of local side of the tunnel. It consists of two parts:

a hostname and a domain-name.

Local Subnet IP address of a local network.

Local Subnet Mask Subnet mask of a local network.

Local Protocol/Port Speciﬁes Protocol/Port of a local network. The general form is

protocol/port, for example 17/1701 for UDP (protocol 17) and

port 1701. It is also possible to enter only the number of protocol,

however, the above mentioned format is preferred.

Encapsulation Mode Speciﬁes the IPsec mode, according to the method of encap-

sulation. You can select the tunnel mode in which the entire IP

datagram is encapsulated or the transport mode in which only IP

header is encapsulated.

NAT traversal Enable/disables NAT address translation on the tunnel. If you

use NAT between the end points of the tunnel, then enable this

parameter.

IKE Mode Speciﬁes the mode for establishing a connection (main or ag-

gressive). If you select the aggressive mode, then the router es-

tablishes the IPsec tunnel faster, but the encryption is perma-

nently set to 3DES-MD5. We recommend that you not use the

aggressive mode due to lower security!

IKE Algorithm Speciﬁes the means by which the router selects the algorithm:

• auto – The encryption and hash algorithm are selected au-

tomatically.

• manual – The encryption and hash algorithm are deﬁned

by the user.

IKE Encryption Encryption algorithm – 3DES, AES128, AES192, AES256.

IKE Hash Hash algorithm – MD5, SHA1, SHA256, SHA384 or SHA512.

Continued on next page