BinTec RS120 Reference Manual page 343

bintec elmeg GmbH
bintec RS Series
Note
If a tunnel is to be set up to a peer, the interface over which the tunnel is to be imple-
mented is activated first by the IPSec Daemon. If IPSec with DynDNS is configured on
the local device, the own IP address is propagated first and then the ISDN call is sent
to the remote device. This ensures that the remote device can actually reach the local
device if it initiates the tunnel setup.
Transfer of IP Address over ISDN
Transferring the IP address of a device over ISDN (in the D channel and/or B channel)
opens up new possibilities for the configuration of IPSec VPNs. This enables restrictions
that occur in IPSec configuration with dynamic IP addresses to be avoided.
Note
To use the IP address transfer over ISDN function, you must obtain a free-of-charge
extra licence.
You can obtain the licence data for extra licences via the online licensing pages in the
support section at www.bintec-elmeg.com
tions.
Before System Software Release 7.1.4, IPSec ISDN callback only supported tunnel setup if
the current IP address of the initiator could be determined by indirect means (e.g. via
DynDNS). However, DynDNS has serious disadvantages, such as the latency until the IP
address is actually updated in the database. This can mean that the IP address propagated
via DynDNS is not correct. This problem is avoided by transferring the IP address over
ISDN. This type of transfer of dynamic IP addresses also enables the more secure ID Pro-
tect mode (main mode) to be used for tunnel setup.
Method of operation: Various modes are available for transferring your own IP address to
the peer: The address can be transferred free in the D channel or in the B channel, but
here the call must be accepted by the remote station and therefore incurs costs. If a peer
whose IP address has been assigned dynamically wants to arrange for another peer to set
up an IPSec tunnel, it can transfer its own IP address as per the settings described in
Fields in the menu IPSec Callback
telephone companies. If you are not sure, automatic selection by the device can be used to
ensure that all the available possibilities can be used.
. Please follow the online licensing instruc-
on page 330. Not all transfer modes are supported by all
15 VPN
329