Digi TX40 User Manual page 466

Virtual Private Networks (VPN)
10. For Metric, enter or select the priority of routes associated with this IPsec tunnel. When more
than one active route matches a destination, the route with the lowest metric is used.
The metric can also be used in tandem with SureLink to configure IPsec failover behavior. See
Configure IPsec failover
11. For Mode, select Tunnel mode. Transport mode is not currently supported.
12. Select the Mode, either:
Tunnel mode: The entire IP packet is encrypted and/or authenticated and then
n
encapsulated as the payload in a new IP packet.
Transport mode: Only the payload of the IP packet is encrypted and/or authenticated.
n
The IP header is unencrypted.
13. Select the Protocol, either:
ESP (Encapsulating Security Payload): Provides encryption as well as authentication
n
and integrity.
AH (Authentication Header): Provides authentication and integrity only.
n
14. Strict routing is disabled by default. Toggle on to enable.
Strict routing makes IPsec behave like a policy-based VPN, rather than a route-based VPN.
15. Click to expand Authentication.
a. For Authentication type, select one of the following:
n
n
TX40 User Guide
for more information.
Pre-shared key: Uses a pre-shared key (PSK) to authenticate with the remote peer.
i. Type the Pre-shared key.
Asymmetric pre-shared keys: Uses asymmetric pre-shared keys to authenticate
with the remote peer.
i. For Local key, type the local pre-shared key. This must be the same as the
remote key on the remote host.
ii. For Remote key, type the remote pre-shared key. This must be the same as
the local key on the remote host.
IPsec
466