Remote Ipsec Client Support; Ipsec And Router Interfaces; Configuring Ipsec Tunnels - Siemens RX1500 User Manual

RUGGEDCOM ROX II
User Guide
Section 5.28.1.6

Remote IPsec Client Support

If the router is to support a remote IPsec client and the client will be assigned an address in a subnet of a local
interface, a proxy ARP must be activated for that interface. This will cause the router to respond to ARP requests
on behalf of the client and direct traffic to it over its connection.
IPsec relies upon the following protocols and ports:
• protocol 51, IPSEC-AH Authentication Header (RFC2402)
• protocol 50, IPSEC-ESP Encapsulating Security Payload (RFC2046)
• UDP port 500
The firewall must be configured to accept connections on these ports and protocols. For more information, refer
to Section 5.17.6, "Configuring the Firewall for a
Section 5.28.1.7

IPsec and Router Interfaces

If IPsec works on an interface which could disappear, such as a PPP connection, or if the IP address could
change, the Monitor Interface option must be set for the IPsec connection. When this option is set, IPsec will
restart when the interface disappears and reappears, or the IP address is changed.
The Monitor Interface option is set on the Connection form available for each connection. For more information
about connections, refer to
Section 5.28.2

Configuring IPsec Tunnels

To configure IPsec tunnels, do the following:
NOTE
ROX II supports the creation of policy-based VPNs, which can be characterized as follows:
• No IPsec network interfaces have been created.
• The routing table is not involved in directing packets to IPsec.
• Only data traffic matching the tunnel's local and remote subnets is forwarded to the tunnel. Normal
traffic is routed by one set of firewall rules and VPN traffic is routed based on separate rules.
• The firewall is configured with a VPN zone of type ipsec.
• As IPsec packets are received, they are decoded, flagged as IPsec-encoded, and presented as
having arrived directly from the same network interface on which they were originally received.
• Firewall rules are written to allow traffic to and from VPN tunnels. These are based on the normal
form of source/destination IP addresses, and IP protocol and port numbers. These rules, by virtue of
the zones they match, use the policy flags inserted by the netkey to route matching data traffic to the
proper interface.
For more information about configuring a policy-based VPN, refer to
Firewalls".
1. Change the mode to Edit Private or Edit Exclusive.
Remote IPsec Client Support
VPN".
Section 5.28.6, "Managing Connections".
Setup and Configuration
Section 5.17, "Managing
Chapter 5
615