Table of Contents
Advertisement
6.10 Connection Options
Options list
IPSec routing mode
[routed]
Virtual interface
E-DOC-CTC-20051017-0169 v0.1
The connection options alter the behaviour of the VPN network. Options to be
applied to Connections are stored in named Option Lists. An Option List contains
the following options:
Option
Keyword
IPSec routing mode
routed
Virtual interface
virtual_if
DF bit
force_df
Minimal MTU
min_mtu
Add route
add_route
This parameter has two possible settings: routed and non-routed mode.
Routed mode means that the packets are routed to the IPSec interface. This is the
preferred mode of operation, which is valid for all possible scenarios.
Non-routed mode simulates the behaviour of previous SpeedTouch™ IPSec
implementations. In the present release, it is recommended to
routed mode, because some scenarios are not supported in this mode.
The SpeedTouch™ uses the concept of a Virtual Interface to implement the IPSec
processing. By default, the IPSec module uses the Virtual Interface, named ipsec0.
This interface is automatically created when IPSec is enabled.
Firewall rules for example, can be attached to virtual interfaces.
In most cases, the use of the default ipsec0 virtual interface is sufficient. Only in
some very specific occasions, it may be useful to create an additional virtual
interface for IPSec. For example, if you want to apply different firewall rules to
different IPSec tunnels, an additional Virtual Interface can be created in the
Connection Options list.
virtual_if
A typical situation where multiple IPSec virtual interfaces might be needed, is the
VPN hub and spoke model.
Description
Selects routed or non-routed mode.
Defines the Virtual Interface for a
connection.
Selects treatment of Don't Fragment bit
Minimal value for MTU.
Enables or disables automatic addition of
routes to the routing table.
not
Possible values
A string value, containing the name of
the Virtual interface
Chapter 6
Advanced Features
use the non-
207
Advertisement
Table of Contents
