Cisco Small Business RV 120W Wireless-N VPN Firewall ...

Cisco Small Business RV 120W Wireless-N VPN Firewall ... Cisco Small Business RV 120W Wireless-N VPN Firewall ...

ipland.com.ua
from ipland.com.ua More from this publisher
12.07.2015 Views

Configuring Virtual Private Networks (VPNs) and SecurityConfiguring Advanced VPN Parameters5NOTE Ensure that the authentication algorithm is configured identically on bothsides.STEP 3Choose the authentication method:• Select Pre-Shared Key for a simple password based key that is shared withthe IKE peer.• Select RSA-Signature to disable the pre-shared key text field and use theActive Self Certificate uploaded in the Certificates page. A certificate mustbe configured in order for RSA-Signature to work.NOTE The double quote character (“) is not supported in the pre-shared key.STEP 4Choose the Diffie-Hellman (DH) Group algorithm, which is used when exchangingkeys. The DH Group sets the strength of the algorithm in bits.NOTE Ensure that the DH Group is configured identically on both sides of the IKEpolicy.STEP 5STEP 6STEP 7STEP 8In the SA Lifetime field, enter the interval, in seconds, after which the SecurityAssociation becomes invalid.To enable dead peer detection, check the Enable box. Dead Peer Detection isused to detect whether the peer is alive or not. If peer is detected as dead, therouter deletes the IPsec and IKE Security Association.In the Detection Period field, enter the interval, in seconds, between consecutiveDPD R-U-THERE messages. DPD R-U-THERE messages are sent only when theIPsec traffic is idle.In the Reconnect after Failure Count field, enter the maximum number of DPDfailures allowed before tearing down the connection.Cisco RV120W Administration Guide 97

Configuring Virtual Private Networks (VPNs) and SecurityConfiguring Advanced VPN Parameters5Extended Authentication (XAUTH) ParametersRather than configuring a unique VPN policy for each user, you can enable the VPNgateway router to authenticate users from a stored list of user accounts or with anexternal authentication server such as a RADIUS server. When connecting manyVPN clients to a VPN gateway router, Extended Authentication (XAUTH) allowsauthentication of users with methods in addition to the authentication methodmentioned in the IKE SA parameters. XAUTH can be configured in the followingmodes:STEP 1Select the XAUTH type:• None—Disables XAUTH.• Edge Device—Authentication is done by one of the following:- User Database—User accounts created in the router are used toauthenticate users. See Configuring VPN Users, page 105.- RADIUS-PAP—Authentication is done using a RADIUS server andpassword authentication protocol (PAP).- RADIUS-CHAP—Authentication is done using a RADIUS server andchallenge handshake authentication protocol (CHAP).• IPsec Host—The router is authenticated by a remote gateway with ausername and password combination. In this mode, the router acts as a VPNClient of the remote gateway.STEP 2If you selected IPsec Host, enter the username and password for the host.Configuring VPN PoliciesTo configure a VPN policy:STEP 1STEP 2STEP 3STEP 4Choose VPN > IPsec > Advanced VPN Setup.In the VPN Policy Table, click Add.Enter a unique name to identify the policy.Choose the Policy Type:Cisco RV120W Administration Guide 98

Configuring Virtual Private Networks (<strong>VPN</strong>s) and SecurityConfiguring Advanced <strong>VPN</strong> Parameters5NOTE Ensure that the authentication algorithm is configured identically on bothsides.STEP 3Choose the authentication method:• Select Pre-Shared Key for a simple password based key that is shared withthe IKE peer.• Select RSA-Signature to disable the pre-shared key text field and use theActive Self Certificate uploaded in the Certificates page. A certificate mustbe configured in order for RSA-Signature to work.NOTE The double quote character (“) is not supported in the pre-shared key.STEP 4Choose the Diffie-Hellman (DH) Group algorithm, which is used when exchangingkeys. The DH Group sets the strength of the algorithm in bits.NOTE Ensure that the DH Group is configured identically on both sides of the IKEpolicy.STEP 5STEP 6STEP 7STEP 8In the SA Lifetime field, enter the interval, in seconds, after which the SecurityAssociation becomes invalid.To enable dead peer detection, check the Enable box. Dead Peer Detection isused to detect whether the peer is alive or not. If peer is detected as dead, therouter deletes the IPsec and IKE Security Association.In the Detection Period field, enter the interval, in seconds, between consecutiveDPD R-U-THERE messages. DPD R-U-THERE messages are sent only when theIPsec traffic is idle.In the Reconnect after Failure Count field, enter the maximum number of DPDfailures allowed before tearing down the connection.<strong>Cisco</strong> <strong>RV</strong><strong>120W</strong> Administration Guide 97

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!