Lan-To-Lan Tunnels With Pre-Shared Keys - D-Link NetDefendOS User Manual

(specified by the advanced setting DPD Metric) then NetDefendOS sends DPD-R-U-THERE
messages to the peer to determine if it is still reachable.
If the peer does not respond to these messages during a period of time (specified by the
advanced setting DPD Expire Time) then the peer is considered dead and the tunnel is
closed. NetDefendOS will then automatically try to re-establish the tunnel after a period of
time (specified by the advanced setting DPD Keep Time).
The advanced settings for DPD are described further in Section 9.4.9, "IPsec Advanced Settings".
Although DPD is enabled by default, disabling it does not disable NetDefendOS responding
to DPD-R-U-THERE messages from a peer, since the IPsec standard requires this. However,
disabling DPD means that NetDefendOS will not send out its own DPD-R-U-THERE messages.
• Tunnel Monitoring
NetDefendOS provides tunnel monitoring as an addition to DPD for monitoring the health of
an IPsec tunnel. Tunnel monitoring requires that an external host is available that is reachable
through the tunnel with ICMP ping messages. This feature is described further in Section 9.4.8,
"IPsec Tunnel Monitoring".
IPsec Tunnel Quick Start Sections
A quick start checklist of setup steps for these protocols in typical scenarios can be found in the
following sections in this document:
• Section 9.2.1, "IPsec LAN-to-LAN with Pre-shared Keys".
• Section 9.2.2, "IPsec LAN-to-LAN with Certificates".
• Section 9.2.3, "IPsec Roaming Clients with Pre-shared Keys".
• Section 9.2.4, "IPsec Roaming Clients with Certificates".
In addition to the quick start section, more explanation of tunnel setup is given below.

9.4.2. LAN-to-LAN Tunnels with Pre-shared Keys

A VPN can allow geographically distributed Local Area Networks (LANs) to communicate securely
over the public Internet. In a corporate context this means LANs at geographically separate sites
can communicate with a level of security comparable to that existing if they communicated
through a dedicated, private link.
Secure communication is achieved through the use of IPsec tunneling, with the tunnel extending
from the VPN gateway at one location to the VPN gateway at another location. The NetDefend
Firewall is therefore the implementer of the VPN, while at the same time applying normal
security surveillance of traffic passing through the tunnel. This section deals specifically with
setting up LAN-to-LAN tunnels created with a Pre-shared Key (PSK).
A number of steps are required to set up LAN-to-LAN tunnels with PSK:
• Set up the VPN tunnel properties and include the Pre-Shared key.
Note
Both Auto Establish and DPD could be used at the same time.
704
Chapter 9: VPN