tainy hmod-v3-io, tainy hmod-l3-io - Dr. Neuhaus ...

VPN connections
ISAKMP-SA mode Agree with the administrator of the remote station which method will be used
for negotiating the ISAKMP-SA. The following selections are available:
ISAKMP-SA lifetime
IPsec-SA
lifetime
� Main mode
� Aggressive mode
Note:
When the authentication method Pre-Shared Key is used, Aggressive mode
must be set in Roadwarrior mode.
The keys for an IPsec connection are renewed at certain intervals in order to
increase the effort required to attack an IPsec connection.
Specify the lifetime (in seconds) of the keys agreed on for the ISAKMP-SA
and IPsec-SA.
The lifetime can be defined differently for ISAKMP-SA and IPsec-SA.
NAT-T There may be a NAT router between the TAINY xMOD-V3-IO and the VPN
gateway of the remote network. Not all NAT routers allow IPsec data packets
to go through. It may therefore be necessary to encapsulate the IPsec data
packets in UDP packets so that they can go through the NAT router.
Enable
dead peer detection
On: If the TAINY xMOD-V3-IO detects a NAT router that does not
let the IPsec data packets through, then UDP encapsulation is
started automatically.
Force: During negotiation of the connection parameters for the VPN
connection, encapsulated transmission of the data packets
during the connection is insisted upon.
Off: The NAT-T function is switched off
If the remote station supports the dead peer detection (DPD) protocol, then
the partner in question can detect whether the IPsec connection is still valid
or not, meaning that it may have to be re-established. Without DPD,
depending on the configuration it may be necessary to wait until the SA
lifetime elapses or the connection has to be re-initiated manually. To check
whether the IPsec connection is still valid, the dead peer detection sends
DPD requests to the remote station itself. If there is no answer, then after the
permitted number of failed attempts the IPsec connection is considered to be
interrupted.
Warning
Sending the DPD requests and using NAT-T increases the amount of data
sent and received over the mobile data service connection (HSPA+, UMTS,
EGPRS, GPRS). Depending on the selected settings, the additional data
traffic can amount to 5 Mbyte per month or more. This can lead to additional
costs.
Yes Dead peer detection is switched on. Independently of the
transmission of user data, the TAINY xMOD-V3-IO detects if
the connection is lost, in which case it waits for the connection
to be re-established by the remote stations.
No Dead peer detection is switched off
DPD - delay (seconds) Time period in seconds after which DPD requests will be sent. These
requests test whether the remote station is still available.
DPD - timeout
(seconds)
Time period in seconds after which the connection to the remote station will
be declared dead if no response has been made to the DPD requests.
TAINY xMOD Page 63 of 111