Watchguard Firebox X5-W Betriebsanweisung PDF herunterladen (Seite 156)

Configuring Virtual Private Networks

140 Firebox X Edge e-Series

- If your Firebox X Edge or remote VPN device has a static external IP address, set the local ID

type to IP Address. Type the external IP address of the Edge or device as the local ID.

- If your Firebox X Edge or remote VPN device has a dynamic external IP address, you must

select Aggressive Mode and the device must use Dynamic DNS. For more information, see

“Registering with the Dynamic DNS Service” on page 58. Set the local ID type to Domain

Name. Enter the DynDNS domain name of the device as the local ID.

Note

If your Firebox X Edge external interface has a private IP address instead of a public IP address, then your

ISP or the Internet access device connected to the Edge’s external interface (modem or router) does

Network Address Translation (NAT). See the instructions at the end of this section if your Edge’s external

interface has a private IP address.

3 Select the type of authentication from the Authentication Algorithm drop-down list.

The options are MD5-HMAC (128-bit authentication) or SHA1-HMAC (160-bit authentication).

4 From the Encryption Algorithm drop-down list, select the type of encryption.

The options are DES-CBC or 3DES-CBC.

5 Type the number of kilobytes and the number of hours until the IKE negotiation expires.

To make the negotiation never expire, enter zero (0). For example, 24 hours and zero (0) kilobytes means that the

phase 1 key is negotiated every 24 hours no matter how much data has passed.

6 Select the group number from the Diffie-Hellman Group drop-down list. We support group 1 and

group 2.

Diffie-Hellman groups securely negotiate secret keys through a public network. Group 2 is more secure than group 1,

but uses more processing power and more time.

7 Select the Send IKE Keep Alive Messages check box to help find when the tunnel is down.

Select this check box to send short packets across the tunnel at regular intervals. This helps the two devices to see if

the tunnel is up. If the Keep Alive packets get no response after three tries, the Firebox X Edge starts the tunnel

again.

Note

The IKE Keep Alive feature is different from the VPN Keep Alive feature in “VPN Keep Alive,” on page 142.

If your Edge is behind a device that does Network Address Translation (NAT)

The Firebox X Edge e-Series can use NAT Traversal. This means that you can make VPN tunnels if your ISP

does NAT (Network Address Translation) or if the external interface of your Edge is connected to a

device that does NAT. We recommend that the Firebox X Edge external interface have a public IP

address. If that is not possible, use this section for more information.

Devices that do NAT frequently have some basic firewall features built into them. To make a VPN tunnel

to your Firebox X Edge e-Series when the Edge is behind a device that does NAT, the NAT device must let

the traffic through. These ports and protocols must be open on the NAT device:

• UDP port 500 (IKE)

• UDP port 4500 (NAT Traversal)

• IP protocol 50 (ESP)

Speak with the NAT device’s manufacturer for information on opening these ports and protocols on the

NAT device.

If your Firebox X Edge e-Series external interface has a private IP address, you cannot use an IP address

as the local ID type in the Phase 1 settings. Because private IP addresses cannot get through the Inter-

net, the other device cannot find the private external IP address of your Edge through the Internet.

• If the NAT device to which the Firebox X Edge is connected has a dynamic public IP address:

1 2 ... 151 152 153 154 155 156 157 158 159 160 161 ... 233 234

Watchguard Firebox X5-W Betriebsanweisung Seite 156

Kommentare zu diesen Handbüchern

Watchguard Firebox X5-W Betriebsanweisung Seite 156

Kommentare zu diesen Handbüchern

Verwandte Produkte und Handbücher für Vernetzung Watchguard Firebox X5-W