Defining tunnels to your device
Setting up Generic Routing Encapsulation (GRE) tunnels
Tunneling allows the use of a public network to convey data on behalf of two remote private networks. It is also a way to transform data frames to allow them to pass networks with incompatible address spaces or even incompatible protocols.
Generic Routing Encapsulation (GRE) is a tunneling mechanism that uses IP as the transport protocol and can be used for carrying many different passenger protocols. The tunnels behave as virtual point‐to‐point links that have two endpoints identified by the tunnel source and tunnel destination addresses at each endpoint.
Configuring a GRE tunnel involves creating a tunnel interface, which is a logical interface, then configuring the tunnel endpoints for the tunnel interface.
To set up GRE tunnels:
1. From Tunnels, select GRE Tunnels. The Tunnels: GRE Tunnels pane opens.
2. From the Tunnels:GRE Tunnels pane, click Add Tunnel.
A series of wizard panels helps you configure the connection.
3. In the Tunnel Name field, enter a name for the new tunnel.
4. In the description area, type a description that helps you further identify the tunnel. Click Next.
5. In the next wizard pane:
In the Remote WAN IP field, type the IP address of the gateway to which you want to connect.
(Optional) From the Saved Network drop‐down list, select the network that is to be routed through the tunnel. To select a local interface: Select the local interface on which the tunnel is being created.
Eventually, the packets destined for this tunnel will be routed through it
If you are not using a saved network, in the Network Route field, type the IP address of the network that is routed through the tunnel.
If you are not using a saved network, in the Network Mask field, type the mask of the network.
Click Add Route. The defined GRE tunnel configuration is added and appears in the Network Routes list.
6. Click Finish.
Using the Router’s Web Interface
31
Defining Virtual Private Networks (VPNs)
Your router supports VPN tunnels for secure LAN‐to‐LAN access. To set up a VPN through your router:
1. From the navigation pane, select Tunnels, IPsec Tunnels.
2. In the pane that opens, click Add Tunnel. A series of wizard panels helps you configure the connection.
3. In the first panel, enter the following information:
In the Name field, type a name for the connection.
If desired, in the Description field, type a description for the connection.
Click Next.
4. In the next panel:
In the Remote WAN IP field, type the IP address of the remote WAN.
In the Saved Network drop‐down list, select the desired network. Otherwise you can manually define the network by completing the Network Route and Network Mask fields.
Click Next.
5. In the next panel:
In the Pre‐Shared Key field type the pre‐shared key that is agreed upon and shared by the VPN endpoints. You must configure this key at both endpoints of the tunnel.
From the Encryption Method drop‐down list, select the encryption method. 3DES is recommended.
Options include 3DES, AES‐128, AES‐192, AES‐256.
In the IKE Life Time field, type the duration for which the ISAKMP security association (SA) lasts, from successful negotiation to expiration. The default value is one hour and the maximum is 8 hours.
In the Key Life field, type the duration for which the IPSec SA lasts, from successful negotiation to expiration. The default value is one hour and the maximum is 24 hours.
In the Max Retries field, type the number of retries for the IPSec tunnel. Enter zero for unlimited retries.
To enable the Local ID and Remote ID, check Enable UID (Unique Identifier String) . Then enter local
ID and remote string identifiers:
Local ID, type a string identifier for the local security gateway.
Remote ID, type a string identifier for the remote security gateway.
To enable IPCOMP, the compression algorithm, check Compression.
To enable Perfect Forward Secrecy (PFS), a concept in which the newly generated keys are unrelated to the older keys, check Perfect Forward Secrecy.
Click Finish.
Using the Router’s Web Interface
32
