See Also

Configuring a Site-to-Site VPN Gateway

Shared Secret Authentication Method

Gateway Address

Type the IP address of the Site-to-Site VPN Gateway to which you want to connect, as given to you by the network administrator.

Bypass NAT

Select this option to allow the VPN site to bypass NAT when connecting to your internal network.

This option is selected by default.

Bypass default firewall policy

Select this option to allow the VPN site to bypass the default firewall policy and access your internal network without restriction.

User-defined rules will still apply to the VPN site.

Tunnel Local IP

Type a local IP address for this end of the VPN tunnel.

Tunnel Remote IP

Type the IP address of the remote end of the VPN tunnel.

OSPF Cost

Type the cost of this link for dynamic routing purposes.

The default value is 10.

If OSPF is not enabled, this setting is not used. OSPF is enabled using the Safe@Office command line interface (CLI). For information on using CLI, see Controlling the Appliance via the Command Line. For information on the relevant commands for OSPF, refer to the Embedded NGX CLI Reference Guide.

Shared Secret

Select this option to use a shared secret for VPN authentication.

A shared secret is a string used to identify VPN sites to each other.

Certificate

Select this option to use a certificate for VPN authentication.

If you select this option, a certificate must have been installed. (Refer to Installing a Certificate for more information about certificates and instructions on how to install a certificate.)

Topology User

Type the topology user's user name.

Topology Password

Type the topology user's password.

Use Shared Secret

Type the shared secret to use for secure communications with the VPN site.

This shared secret is a string used to identify the VPN sites to each other. The secret can contain spaces and special characters.

Phase 1

Security Methods

Select the encryption and integrity algorithm to use for IKE negotiations:

• Automatic. The Safe@Office appliance automatically selects the best security methods supported by the site. This is the default.
• A specific algorithm

Diffie-Hellman group

Select the Diffie-Hellman group to use:

• Automatic. The Safe@Office appliance automatically selects a group. This is the default.
• A specific group

A group with more bits ensures a stronger key but lowers performance.

Renegotiate every

Type the interval in minutes between IKE Phase-1 key negotiations. This is the IKE Phase-1 SA lifetime.

A shorter interval ensures higher security, but impacts heavily on performance. Therefore, it is recommended to keep the SA lifetime around its default value.

The default value is 1440 minutes (one day).

Phase 2

Security Methods

Select the encryption and integrity algorithm to use for VPN traffic:

• Automatic. The Safe@Office appliance automatically selects the best security methods supported by the site. This is the default.
• A specific algorithm

Perfect Forward Secrecy

Specify whether to enable Perfect Forward Secrecy (PFS), by selecting one of the following:

• Enabled. PFS is enabled. The Diffie-Hellman group field is enabled.
• Disabled. PFS is disabled. This is the default.

Enabling PFS will generate a new Diffie-Hellman key during IKE Phase 2 and renew the key for each key exchange.

PFS increases security but lowers performance. It is recommended to enable PFS only in situations where extreme security is required.

Diffie-Hellman group

Select the Diffie-Hellman group to use:

• Automatic. The Safe@Office appliance automatically selects a group. This is the default.
• A specific group

A group with more bits ensures a stronger key but lowers performance.

Renegotiate every

Type the interval in seconds between IPSec SA key negotiations. This is the IKE Phase-2 SA lifetime.

A shorter interval ensures higher security.

The default value is 3600 seconds (one hour).