Ipsec Roaming Clients With Pre-Shared Keys - D-Link NetDefend DFL-210 User Manual

9.2.3. IPsec Roaming Clients with
Pre-shared Keys
considered adequate.
Two self-signed certificates are required and the same two are used at either end of the tunnel but
their usage is reversed. In other words: one certificate is used as the root certificate at one end, call
it Side A, and as the host certificate at the other end, call it Side B. The second certificate is used in
the opposite way: as the host certificate at Side A and the root certificate at Side B.
No CA server considerations are needed with self-signed certificates since CA server lookup does
not take occur.

9.2.3. IPsec Roaming Clients with Pre-shared Keys

This section details the setup with roaming clients connecting through an IPsec tunnel with
pre-shared keys. There are two types of roaming clients:
A. The IP addresses of the clients are already allocated.
B. The IP addresses of clients are not known beforehand and must be handed out by NetDefendOS
as the clients connect.
A. IP addresses already allocated
The IP addresses may be known beforehand and have been pre-allocated to the roaming clients
before they connect. The client's IP address will be manually input into the VPN client software.
1. Set up user authentication. XAuth user authentication is not required with IPsec roaming clients
but is recommended (this step could initially be left out to simplify setup). The authentication
source can be one of the following:
• A Local User DB object which is internal to NetDefendOS.
• An external authentication server.
An internal user database is easier to set up and is assumed here. Changing this to an external
server is simple to do later.
To implement user authentication with an internal database:
• Define a Local User DB object (let's call this object TrustedUsers).
• Add individual users to TrustedUsers. This should consist of at least a username and
password combination.
344
Chapter 9. VPN