Siemens RUGGEDCOM ROX II User Manual page 458

Chapter 12
Tunneling and VPNs
!
If no connections have been configured, add connections as needed. For more information, refer to
Section 12.8.6.2, "Adding a
Section 12.8.6.2
Adding a Connection
To add a new connection for a VPN, do the following:
1. Make sure the CLI is in Configuration mode.
2. Add the connection by typing:
tunnel ipsec connection name
Where:
• name is the connection name. If the name is default, this makes it the default setting for all connections.
3. Configure the following parameter(s) as required:
Parameter
startup { startup }
authenticate { authenticate }
connection-type { connection-type }
address-family { address-family }
pfs { pfs }
keylife { keylife }
412
Connection".
Synopsis: { ignore, add, start, route, default }
Default: default
The action to take when IPsec is initialized. The default value is 'ignore' unless
overwritten by the default connection setting.
Synopsis: { default, rsasig, secret }
Default: default
The authentication method. The default value is 'default' unless overwritten by the
default connection setting.
Synopsis: { tunnel, transport, passthrough, default }
Default: default
The connection type/mode. Options include:
• tunnel: Encrypts traffic on host-to-host, host-to-subnet or subnet-to-subnet tunnels.
This is the default type/mode unless overwritten by the default connection setting.
• transport: Encrypts traffic on a host-to-host tunnel.
• passthrough: Traffic is not encrypted.
Synopsis: { ipv4, ipv6 }
Default: ipv4
The address-family to run for the connection. Accepted values include 'ipv4' (default) and
'ipv6'. All addresses used in the connection must have the same address family.
Synopsis: { default, yes, no }
Default: default
Enables/disables Perfect Forwarding Secrecy (PFS). When enabled, IPsec negotiates new
keys for each session. If an attacker compromises a key, only the session protected by the
key is revealed. Not all clients support PFS. The default value is 'yes' unless overwritten by
the default connection setting.
Synopsis: { default } or a 32-bit unsigned integer between 1081 and 28800
Default: default
The lifetime in seconds for the Security Association (SA) key. This determines how long
a particular instance of a connection should last, from successful negotiation to expiry.
Normally, the connection is renegotiated before it expires. The default value is 28800
unless overwritten by the default connection setting. Peers can specify different lifetime
Description
Adding a Connection
RUGGEDCOM ROX II
CLI User Guide