Creating a Remote Security Gateway Profile

To create a new Remote Security Gateway, click the New Remote Security Gateway link. A pop-up window will appear with the configuration page.

• [Gateway Name]This is a symbolic name by which this profile will be referenced later on. It should describe the characteristics of the profile. A good naming convention is to use the names of the two machines followed by the authentication method, for example "left-right-rsa" or "sunrise-sunset-key"
• [Local Profile]Select the local profile to serve as the local end for this VPN.
• [Cipher]Select the cryptographic cipher to use.
• [Compression]Enable/disable IPComp.
• [PFS]Enable/disable Perfect Forward Secrecy.
• [Connection Type]Select the addressing scheme for this profile.
  • [Road Warrior]This profile is for use by Road Warriors. A Road Warrior is a class of users which do not have static IP addresses. For example, a team of salespeople visiting customers.

    Typically, Road Warriors are all issued X.509 Certificates to use for Authentication.

    Some important Road Warrior notes: you can only have one Road Warrior Security Gateway, and you may only have one shared key for Road Warriors, so it is highly recommended that RSA Signature authentication is used.

  • [Standard]Specify the address/remote network of the other Security Gateway. This is typically used for other VPN servers, and employees working from home on a static DSL IP.

    Enter the IP address, gateway, and (optionally) the Remote Secure LAN you want to connect to.

• [Virtual IP Network]This setting allows you to create a pool of Virtual Addresses for your clients to acquire upon connecting to the VPN. Normally all traffic from the client's would appear to come from their Internet IP address.

  Entering a subnet in this box allows the client (when properly configured) to acquire an address on the given subnet, making all traffic appear as if it is coming from this address.

• [Authentication Type]There are two ways to authenticate other Security Gateways: Shared Key and RSA Signature.
  • [Shared Key]If you want to use Shared Key, Identification should be "IP Address" and Certificate should be left empty.
  • [RSA Signature]If you want to use RSA Signature, Identification should be "Certificate" and you should select the Certificate for the other Security Gateway.

When you are done entering your configuration, click the "Create Profile" button.