ADVPN

ADVPN domain

Enter an ADVPN domain for the VAMS.

The domain name must be unique.

ADVPN domain ID

Enter an ADVPN domain ID for the VAMS.

The domain ID must be unique.

Preshared key

Enter a preshared key.

The VAMS uses the preshared key to generate initial encryption and authentication keys during connection initialization with a VAMC. The key is also used to generate encryption and authentication keys for subsequent packets if encryption and authentication are needed.

Authentication method

Select an authentication method for the VAMS to authenticate VAMCs.

ISP domain

Select an ISP domain in which VAMCs are authenticated.

For more information, see ISP Domain Online Help.

This item is available only when the authentication method is PAP or CHAP.

Hub group

Hub group list.

The list also provides interfaces for creating, editing, and deleting hub groups. For more information about configuring hub groups, see Table 2.

Authentication algorithms

Select authentication algorithms used by the VAMS to communicate with VAMCs.

An authentication algorithm specified earlier has a higher priority during algorithm negotiation between the VAMS and a VAMC. The VAMS compares its algorithms in descending order of priority with the algorithms sent by the VAMC. If a match is found, the VAMS sends the matching algorithm to the VAMC. If no match is found, the negotiation fails.

If you select None (no authentication), make sure None is placed following all the other algorithms. The algorithms following None do not take effect.

Encryption algorithms

Select encryption algorithms used by the VAMS to communicate with VAMCs.

The priority and selection mechanisms are the same as those of authentication algorithms.

Keepalive packets: Sending interval

Set the interval at which a VAMC sends keepalive packets to the VAMS.

A change to this item does not affect registered VAMCs. The change takes effect only on subsequently registered VAMCs.

Keepalive packets: Max retries

Set the maximum number of attempts that a VAMC resends a keepalive packet to the VAMS.

A change to this item does not affect registered VAMCs. The change takes effect only on subsequently registered VAMCs.

VAM packet retry interval

Set the interval at which the VAMS resends a VAM packet.

Enable VAMS

Select this item to enable the VAMS.

Group name

Enter a hub group name.

Shortcut rule

Select a rule to control establishing spoke-spoke direct tunnels:

·     None—Spokes are not allowed to establish direct tunnels.

·     ACL—Specifies an ACL to control establishing spoke-spoke direct tunnels.

·     All—No restrictions for establishing spoke-spoke direct tunnels.

Hub

Hub list.

The hub list also provides interfaces for creating, editing, and deleting hubs. The Public address and ADVPN port fields are required for a hub if the hub is behind a NAT gateway. The values are the public address and port number translated by NAT.

Spoke

Spoke list.

The spoke list also provides interfaces for creating and deleting spokes.

VAMC name

Enter a VAMC name.

The name must be unique in an ADVPN domain.

ADVPN domain

Enter an ADVPN domain name for the VAMC.

Preshared key

Enter a preshared key.

The VAMC uses the preshared key to generate initial encryption and authentication keys during connection initialization with a VAMS. The key is also used to generate encryption and authentication keys for subsequent packets if encryption and authentication are needed.

Username

Password

Enter the username and password that the VAMC uses to register with a VAMS.

Enable VAMC

Select this item to enable the VAMC.

Dumb time

Set the dumb time of the VAMC.

The VAMC starts the dumb timer after its connection to a VAMS times out (keepalive times out), and it does not process any packets during the dumb time. When the dumb timer expires, the VAMC sends a new connection request to the VAMS.

VAM packet retry interval

Set the interval at which the VAMC resends a request to a VAMS.

After the VAMC sends a request to the VAMS, it resends the request if it does not receive any responses within the retry interval.

VAM packet max retries

Set the maximum number of attempts that the VAMC resends a request to a VAMS.

Primary server address

Secondary server address

Select a method to specify the public address of the primary or secondary VAMS. You can enter an IP address or a domain name.

The public address is a static IP address.

Primary server port

Secondary server port

Enter a port number.

The VAMC uses the port to listen to the primary or secondary VAMS.

Tunnel mode

Select an encapsulation mode for ADVPN tunnels.

Tunnel interface ID

Enter an ADVPN tunnel interface ID.

Tunnel private address

Enter the private address of the ADVPN tunnel interface and the network mask.

Tunnel public address

Select a method to specify the tunnel public address.

You can enter an IP address or select a source interface. The primary IP address of the selected interface is used.

VRF

Select a VRF for the VAMC.

The routing table of the VRF is used to forward traffic through the ADVPN tunnel. For more information, see VRF Online Help.

OSPF settings

Select an OSPF instance for the ADVPN tunnel. For more information, see OSPF Online Help.

Network type

Select an OSPF network type, which affects the ADVPN structure.

This item is available only after an OSPF instance is selected.

DR priority

Configure the OSPF DR priority of the VAMC.

This item is available only after an OSPF instance is selected.

GRE key

Configure the GRE key used in GRE mode. If GRE key is not required, do not configure this item. For more information, see GRE Online Help.

Enable GRE checksum

Select this item to enable GRE checksum to ensure packet integrity in GRE mode. For more information, see GRE Online Help.

Source UDP port

Set the source port number of packets in UDP mode.

If you select ADVPN V0 version compatible, the source UDP port of this tunnel cannot be the same as the source UDP port of any other ADVPN tunnel.

Register private address list

ADVPN tunnel private network information that the VAMC registers with the VAMS.

The VAMC requests the VAMS to resolve the destination address of a packet if the packet is destined for a remote private network. The VAMS sends the node information of the remote VAMC to the current VAMC after it finds that the resolved address is within the register private addresses of that remote VAMC.

The list displays existing private networks. It also provides interfaces for creating, editing, and deleting private networks. As a best practice, assign the Preference field a value that is higher than other dynamic routing protocols and lower than the static routing. A higher value indicates a lower preference.

ADVPN V0 version compatible

Configure whether the VAMC is compatible with the ADVPN V0 version.

Tunnel dumb time

Set the quiet time.

The quiet timer starts after an ADVPN tunnel establishment failure.

Idle timeout time

Set the idle timeout time of the spoke-spoke tunnel. If no data is forwarded along a spoke-spoke tunnel during the idle timeout time, the tunnel will be removed automatically.

ToS of tunneled packets

Set the ToS of ADVPN tunneled packets.

TTL of tunneled packets

Set the TTL of ADVPN tunneled packets.

Set DF bit

Select this item to set the DF bit for tunneled packets.

Enable IPsec

Select this item to enable IPsec.

IPsec profile name

Enter an IPsec profile name.

IKE settings

Configure IKE settings.

AuthN method

Select an IKE authentication method:

·     Preshared key.

·     Signature.

Preshared key

Enter a preshared key for the Preshared key authentication method.

PKI domain

Select a PKI domain for the certificate in the Signature authentication method. For more information, see PKI Online Help.

Cert access policy

Select a certificate access policy for the Signature authentication method. For more information, see PKI Online Help.

IKE proposal

Select an IKE proposal used by the IPsec profile. For more information, see IPsec Online Help.

Negotiation mode

Select an IKE negotiation mode.

IPsec configuration

Configure IPsec settings.

Encapsulation mode

Select an IPsec encapsulation mode.

Security protocol

Select an IPsec security protocol.

ESP authentication

Select an ESP authentication algorithm for the ESP or AH-ESP security protocol.

ESP encryption

Select an ESP encryption algorithm for the ESP or AH-ESP security protocol.

AH authentication

Select an AH authentication algorithm for the AH or AH-ESP security protocol.

PFS

Select a group for PFS.

The PFS feature is a security feature based on the DH algorithm. After PFS is enabled, an additional DH exchange is performed in IKE phase 2 to make sure IPsec keys have no derivative relations with IKE keys and a broken key brings no threats to other keys.

DPD check

Select this item to enable IKE DPD check.

Check method

Select an IKE DPD check method.

Detect interval

Set the IKE DPD detect interval:

·     On demand—The device performs a DPD detection if it does not receive an IPsec packet from the peer within the specified period.

·     Periodic—The device performs a DPD detection at the specified interval regardless of whether it has received an IPsec packet from the peer.

Retry interval

Set the interval at which the local end resends an IKE PDP packet.

If the local end does not receive a response from the peer within the retry interval, it resends the DPD request. If the local end has made two retries without receiving any response from the peer, it deletes the IKE key and the IPsec key corresponding to the IKE key.