User's Manual

Chapter 8 Security
BM2022 Users Guide
145
enables the BM2022 to distinguish between multiple rules for SAs that connect from remote IPSec
routers that have dynamic WAN IP addresses.
Regardless of the ID type and content configuration, the BM2022 does not allow you to save
multiple active rules with overlapping local and remote IP addresses.
With main mode (see Section 8.12.4 on page 143), the ID type and content are encrypted to
provide identity protection. In this case the BM2022 can only distinguish between up to 12 different
incoming SAs that connect from remote IPSec routers that have dynamic WAN IP addresses. The
BM2022 can distinguish up to 48 incoming SAs because you can select between three encryption
algorithms (DES, 3DES and AES), two authentication algorithms (MD5 and SHA1) and eight key
groups when you configure a VPN rule (see Section 8.11.1 on page 133). The ID type and content
act as an extra level of identification for incoming SAs.
The type of ID can be a domain name, an IP address or an e-mail address. The content is the IP
address, domain name, or e-mail address.
8.12.7.1 ID Type and Content Examples
Two IPSec routers must have matching ID type and content configuration in order to set up a VPN
tunnel.
The two BM2022s in this example can complete negotiation and establish a VPN tunnel.
The two BM2022s in this example cannot complete their negotiation because BM2022 Bs Local ID
type is IP, but BM2022 As Remote ID type is set to E-mail. An ID mismatched message
displays in the IPSEC LOG.
Table 59 Local ID Type and Content Fields
LOCAL ID TYPE= CONTENT=
IP Type the IP address of your computer.
DNS Type a domain name (up to 31 characters) by which to identify this BM2022.
E-mail Type an e-mail address (up to 31 characters) by which to identify this BM2022.
The domain name or e-mail address that you use in the Local ID Content field
is used for identification purposes only and does not need to be a real domain
name or e-mail address.
Table 60 Matching ID Type and Content Configuration Example
BM2022 A BM2022 B
Local ID type: E-mail Local ID type: IP
Local ID content: [e-mail] Local ID content: 1.1.1.2
Remote ID type: IP Remote ID type: E-mail
Remote ID content: 1.1.1.2 Remote ID content: [e-mail]
Table 61 Mismatching ID Type and Content Configuration Example
BM2022 A BM2022 B
Local ID type: IP Local ID type: IP
Local ID content: 1.1.1.10 Local ID content: 1.1.1.2
Remote ID type: E-mail Remote ID type: IP
Remote ID content: [e-mail] Remote ID content: 1.1.1.0