Teldat bintec R3002 Manual page 352

18 VPN
338
via DynDNS is not correct. This problem is avoided by transferring the IP address over
ISDN. This type of transfer of dynamic IP addresses also enables the more secure ID Pro-
tect mode (main mode) to be used for tunnel setup.
Method of operation: Various modes are available for transferring your own IP address to
the peer: The address can be transferred free in the D channel or in the B channel, but
here the call must be accepted by the remote station and therefore incurs costs. If a peer
whose IP address has been assigned dynamically wants to arrange for another peer to set
up an IPSec tunnel, it can transfer its own IP address as per the settings described in
Fields in the menu IPSec Callback
telephone companies. If you are not sure, automatic selection by the device can be used to
ensure that all the available possibilities can be used.
Note
The callback configuration should be the same on the two devices so that your device
is able to identify the IP address information from the called peer.
The following roles are possible:
• One side takes on the active role, the other the passive role.
• Both sides can take on both roles (both).
The IP address transfer and the start of IKE phase 1 negotiation take place in the following
steps:
(1) Peer A (the callback initiator) sets up a connection to the Internet in order to be as-
signed a dynamic IP address and be reachable for peer B over the Internet.
(2) Your device creates a token with a limited validity and saves it together with the cur-
rent IP address in the MIB entry belonging to peer B.
(3) Your device sends the initial ISDN call to peer B, which transfers the IP address of
peer A and the token as per the callback configuration.
(4) Peer B extracts the IP address of peer A and the token from the ISDN call and as-
signs them to peer A based on the calling party number configured (the ISDN number
used by peer A to send the initial call to peer B).
(5) The IPSec Daemon at peer B's device can use the transferred IP address to initiate
phase 1 negotiation with peer A. Here the token is returned to peer A in part of the
payload in IKE negotiation.
(6) Peer A is now able to compare the token returned by peer B with the entries in the
MIB and so identify the peer without knowing its IP address.
As peer A and peer B can now mutually identify each other, negotiations can also be con-
on page 339. Not all transfer modes are supported by all
Teldat GmbH
bintec Rxxx2/RTxxx2