Using Id Lists With Certificates - D-Link NetDefendOS User Manual

Network security firewall

Hide thumbs Also See for NetDefendOS:

Table of Contents

gw-world:/> set Interface IPsecTunnel MyIPsecTunnel PSK=MyPSK

Web Interface

First create a Pre-shared Key:

Go to: Objects > Key Ring > Add > Pre-shared key

Enter a name for the pre-shared key, for example MyPSK

Choose Hexadecimal Key and click Generate Random Key to generate a key to the

Passphrase textbox

Then, apply the pre-shared key to the IPsec tunnel:

Go to: Network > Interfaces and VPN > IPsec

Select the target IPsec tunnel object

Under the Authentication tab, choose Pre-shared Key and select MyPSK

9.3.8. Using ID Lists with Certificates

When certificates are used as the authentication method for IPsec tunnels, NetDefendOS will

accept all remote peers that are capable of presenting a CA signed certificate. This can be a

potential problem, especially when using roaming clients.

A Typical Scenario

Consider the scenario of traveling employees being given access to the internal corporate

networks using IPsec with certificates. The organization administers their own Certificate

Authority, and certificates have been issued to the employees. Different groups of employees are

likely to have access to different parts of the internal networks. For example, members of the

sales force might access servers running the order system, while technical engineers would

access technical databases.

Since the IP addresses of the traveling employees VPN clients cannot be known beforehand, the

incoming IPsec connections from clients cannot be differentiated. This means that the firewall is

unable to correctly administer access to different parts of the internal networks using only the

client's IP address.

The ID List Solution

Identification lists (ID lists) provide a solution to this problem. A NetDefendOS ID List object

contains one or more ID objects as children. An IPsec Tunnel object can then have its Remote ID

property set to an ID list object. For a particular tunnel to be used by a particular client, the

Chapter 9: VPN

Show Quick Links

Table of Contents