Vpn - D-Link DFL-1100 User Manual

VPN

This chapter introduces IPSec, the method, or rather set of methods used to provide VPN
functionality. IPSec, Internet Protocol Security, is a set of protocols defined by the IETF,
Internet Engineering Task Force, to provide IP security at the network layer.
An IPSec based VPN, such as the DFL-1100 VPN, is made up of two parts:
Internet Key Exchange protocol (IKE)
IPSec protocols (ESP)
The first part, IKE, is the initial negotiation phase, where the two VPN endpoints agree on
which methods will be used to provide security for the underlying IP traffic. Furthermore, IKE
is used to manage connections, by defining a set of Security Associations, SAs, for each
connection. SAs are unidirectional, so there will be at least two SAs per IPSec connection.
The other part is the actual IP data being transferred, using the encryption and authentication
methods agreed upon in the IKE negotiation. This can be accomplished in a number of ways;
by using the IPSec protocol ESP.
To set up a Virtual Private Network (VPN), you do not need to configure an Access Policy to
enable encryption. Just fill in the following settings: VPN Name, Source Subnet (Local Net),
Destination Gateway (If LAN-to-LAN), Destination Subnet (If LAN-to-LAN) and Authentication
Method (Pre-shared key or Certificate). The firewalls on both ends must use the same Pre-
shared key or set of Certificates and IPSec lifetime to make a VPN connection.
52