NetModule NB3700 User Manual page 88

Parameter
Remote peer
DPD Status
Detection cycle)
Failure threshold
IKE Authentication
NetModule routers support IKE authentication through pre-shared keys (PSK) or certifi-
cates within a public key infrastructure. Extended Authentication (XAUTH) leverages
RADIUS-like authentication and can be used to apply user level access control over
IPSec.
Using PSK requires the following settings:
Parameter
PSK
Local ID Type
Local ID
Local ID Type
Remote ID
When using certificates you would need to specify the operation mode. When run as PKI
client (initiator) you can create a Certificate Signing Request (CSR) in the certificates
section which needs to be submitted at your Certificate Authority and imported to
the router afterwards. In PKI server mode (concentrator), the router represents the
Certificate Authority and issues the certificates for remote peers. They are revokable.
Using XAUTH the following settings can be made:
NB3700 User Manual 3.8
IPsec General Settings
IP address or host name of the remote IPsec peer. You may
specify 0.0.0.0 to act as a responder for roadwarrior clients.
Specifies whether Dead Peer Detection (see RFC 3706) shall
be used. DPD will detect any broken IPSec connections, in
particular the ISAKMP tunnel, and refresh the correspond-
ing SAs (Security Associations) and SPIs (Security Payload
Identifier) for a faster re-establishment of the tunnel.
The delay (in seconds) between DPD keepalives that are
sent for this connection (default 30 seconds)
The number of unanswered DPD requests until the IPsec
peer is considered dead (the router will then try to re-
establish a dead connection automatically)
IPsec IKE Authentication Settings
The pre-shared key used to authenticate at the peer
The type of identification for the local ID which can be a
FQDN, username@FQDN or IP address
The local ID value
The type of identification for the remote ID
The remote ID value
88