D-Link NetDefend DFL-210 User Manual page 370

9.4.3. Roaming Clients
• Remote Endpoint: (None)
• Encapsulation Mode: Tunnel
3. For Algorithms enter:
• IKE Algorithms: Medium or High
• IPsec Algorithms: Medium or High
4. For Authentication enter:
• Choose X.509 Certificates as the authentication method
• Root Certificate(s): Select your CA server root certificate imported earlier and add it to the Selected list
• Gateway Certificate: Choose your newly created firewall certificate
• Identification List: Select your ID List that you want to associate with your VPN Tunnel. In our case that
will be sales
5. Under the Routing tab:
• Enable the option: Dynamically add route to the remote network when a tunnel is established
6. Click OK
D. Finally configure the IP rule set to allow traffic inside the tunnel.
Using Config Mode
IKE Configuration Mode (Config Mode) is an extension to IKE that allows NetDefendOS to
provide LAN configuration information to remote VPN clients. It is used to dynamically configure
IPsec clients with IP addresses and corresponding netmasks, and to exchange other types of
information associated with DHCP. The IP address provided to a client can be either be based on a
range of predefined static IP addresses defined for Config Mode or it can come from DHCP servers
associated with an IP Pool object.
An IP pool is a cache of IP addresses collected from DHCP servers and leases on these addresses are
automatically renewed when the lease time is about to expire. IP Pools also manage additional
information such as DNS and WINS/NBNS, just as an ordinary DHCP server would. (For detailed
information on pools see Section 5.5, "IP Pools".)
Defining the Config Mode Object
Currently only one Config Mode object can be defined in NetDefendOS and this is referred to as the
Config Mode Pool object. The key parameters associated with it are as follows:
Use Predefined IP Pool Object
Use a Static Pool
DNS
NBNS/WINS
DHCP
Subnets
The IP Pool object that provides the IP addresses.
As an alternative to using an IP Pool, a static set of IP
addresses can be defined.
The IP address of the DNS used for URL resolution (already
provided by an IP Pool).
The IP address for NBNS/WINS resolution (already provided
by an IP Pool).
Instructs the host to send any internal DHCP requests to this
address.
A list of the subnets that the client can access.
370
Chapter 9. VPN