Ipsec Vpn Setup Page - McAfee SG310 Administration Manual

VPN menu features
IPSec VPN
• x.509 Certificates are used to authenticate the remote party against a Certificate Authority's (CA)
certificate. The CA must have signed the local certificates that are used for tunnel authentication.
Certificates need to be uploaded to the UTM Firewall appliance before a tunnel can be configured to use
them (see Certificate
however, differing terminology between vendors can make it difficult to set up a tunnel between a UTM
Firewall appliance and an appliance from another vendor. This authentication method allows dynamic
endpoints to be used with main mode keying.

IPSec VPN Setup page

Use the IPSec main page
initiate from the appliance. This page also shows a list of all of the IPSec connections configured on the
appliance.
Figure 263 IPSec VPN Setup General Settings
Once populated with tunnels, the Tunnel List pane displays the following information:
• Connection – This is the user-defined name for the IPSec tunnel connection.
• Remote Party – This is the identity of the IPSec tunnel's remote endpoint. It is defined either by its
Endpoint ID, IP Address, or Distinguished Name.
• Status – Tunnels that use Automatic Keying (IKE) will have one of several states in this field. The states
include the following:
• Down indicates that the tunnel is not being negotiated. This may be due to the following reasons:
• IPSec is disabled
• The tunnel is disabled
• The tunnel could not be loaded due to misconfiguration
• Negotiating Phase 1 indicates that IPSec is negotiating Phase 1 to establish the tunnel. Aggressive
or Main mode packets (depending on tunnel configuration) are transmitted during this stage of the
negotiation process.
• Negotiating Phase 2 indicates that IPSec is negotiating Phase 2 to establish the tunnel. Quick mode
packets are transmitted during this stage of the negotiation process.
• Running indicates that the tunnel has been established.
• Running, Renegotiating Phase 1 indicates that the tunnel has been established and the tunnel is
attempting to renegotiate its Phase 1 keys.
McAfee UTM Firewall 4.0.4 Administration Guide
management). This authentication method is widely supported and very secure;
(Figure 263) to configure the appliance to allow IPSec tunnels to connect to or
261