Ipsec Roaming Clients With Pre-Shared Keys - D-Link NetDefendOS User Manual

Network security firewall

Hide thumbs Also See for NetDefendOS:

Table of Contents

Note that the Gateway Certificate is sometimes referred to as the Host Certificate.

Set up the IPsec Tunnel object as for pre-shared keys, but specify the certificates to use

under Authentication. Do this with the following steps:

Enable the X.509 Certificate option.

Select the Root Certificate to use. If there is a certificate chain to the gateway

certificate, all the intermediate certificates must also be added as root certificates.

Select the Gateway Certificate.

Open the management Web Interface for the NetDefend Firewall at the other side of the

tunnel and repeat the above steps with a different set of certificates.

Also review Section 3.9.4, "CA Server Access" below, which describes important considerations for

certificate validation.

Self-signed certificates instead of CA signed can be used for LAN-to-LAN tunnels but the Web

Interface and other interfaces do not have a feature to generate them. Instead, they must be

generated by another utility and imported into NetDefendOS. This means that they are not truly

self-signed since they are generated outside of NetDefendOS control and it should be

remembered that there is no guarantee that their private key is unique. However, the security

provided can still be considered adequate for some scenarios.

Two self-signed certificates are required and the same two are used at either end of the tunnel

but their usage is reversed. In other words: one certificate is used as the root certificate at one

end, call it Side A, and as the host certificate at the other end, call it Side B. The second certificate

is used in the opposite way: as the host certificate at Side A and the root certificate at Side B.

No CA server considerations are needed with self-signed certificates since CRL lookup does not

9.2.3. IPsec Roaming Clients with Pre-shared Keys

Note: The system time and date should be correct

The NetDefendOS date and time should be set correctly since certificates have an expiry

date and time.

Chapter 9: VPN

Show Quick Links

Table of Contents