tainy hmod-v3-io, tainy hmod-l3-io - Dr. Neuhaus ...

VPN connections
ISAKMP-SA lifetime
IPsec-SA
lifetime
The keys for an IPsec connection are renewed at certain intervals in order to
increase the effort required to attack an IPsec connection.
Specify the lifetime (in seconds) of the keys agreed on for the ISAKMP-SA
and IPsec-SA.
The lifetime can be defined differently for ISAKMP-SA and IPsec-SA.
NAT-T There may be a NAT router between the TAINY xMOD-V3-IO and the VPN
gateway of the remote network. Not all NAT routers allow IPsec data packets
to go through. It may therefore be necessary to encapsulate the IPsec data
packets in UDP packets so that they can go through the NAT router.
Enable
dead peer detection
On: If the TAINY xMOD-V3-IO detects a NAT router that does not
let the IPsec data packets through, then UDP encapsulation is
started automatically.
Force: During negotiation of the connection parameters for the VPN
connection, encapsulated transmission of the data packets
during the connection is insisted upon.
Off: The NAT-T function is switched off
If the remote station supports the dead peer detection (DPD) protocol, then
the partner in question can detect whether the IPsec connection is still valid
or not, meaning that it may have to be re-established. Without DPD,
depending on the configuration it may be necessary to wait until the SA
lifetime elapses or the connection has to be re-initiated manually. To check
whether the IPsec connection is still valid, the dead peer detection sends
DPD requests to the remote station itself. If there is no answer, then after the
permitted number of failed attempts the IPsec connection is considered to be
interrupted.
Warning
Sending the DPD requests and using NAT-T increases the amount of data
sent and received over the mobile data service connection (HSPA+, UMTS,
EGPRS, GPRS). Depending on the selected settings, the additional data
traffic can amount to 5 Mbyte per month or more. This can lead to additional
costs.
Yes Dead peer detection is switched on. Attempts are made to reestablish
the IPsec connection if it has been declared dead,
independently of the transmission of user data.
No Dead peer detection is switched off
DPD - delay (seconds) Time period in seconds after which DPD requests will be sent. These
requests test whether the remote station is still available.
DPD - timeout
(seconds)
Time period in seconds after which the connection to the remote station will
be declared dead if no response has been made to the DPD requests.
DPD – maximum failures Number of failed attempts permitted before the IPsec connection is
considered to be interrupted.
Factory setting The factory settings used by the TAINY xMOD-V3-IO for a newly created
connection are as follows:
Name NewConnection
Enabled No (switched off)
Authentication method CA certificate
Remote ID NONE
Local ID NONE
Page 70 of 111 TAINY xMOD