SpeedTouchTM608WL and SpeedTouchTM620 only SpeedTouchTM608(WL)/620

Chapter 3
Configuration via Local Pages
E-DOC-CTC-20051017-0169 v0.1
80
Primary Untrusted
Physical Interface
This field shows a list of your SpeedTouch™ interfaces. You select the preferred
Primary Untrusted Physical Interface. This interface is used as the primary carrier
for your VPN connection. In general, the primary untrusted interface is your DSL
connection to the public Internet. On the DSL line, various logical connections can
be defined, eventually using different protocol stacks (IpoA, PPPoE, PPPoA,…). The
peer entity has to be tied to the correct IP connection.
In the SpeedTouch™ the routing engine determines which interface is used for the
VPN connection (your DSL connection to the Internet in most cases). So, what is the
relevance to select a physical interface?
First of all, for incoming VPN connections where your SpeedTouch™ is the
responder in the IKE negotiations, the interface is part of the matching process for
accepting the connection. Selecting the default value any has the effect of removing
this matching criterion. If you select a specific interface as Primary Untrusted
Physical Interface, then a new incoming VPN connection on a backup interface is
not accepted.
Secondly, if your SpeedTouch™ is equipped with a backup physical interface, for
example an ISDN backup interface, then this field determines the preferred
interface for your VPN connection. This interface is used whenever it is available.
When this interface fails, the active VPN connections are re-routed via the backup
interface. When the primary interface becomes available again, the VPN
connections are re-routed to the primary interface. On the other hand, when you
select any as the Primary Untrusted Physical Interface and this interface fails, the
active VPN connections are also re-routed to the backup interface. But when the
DSL connection becomes available again, the VPN connections are not re-routed as
long as the backup connection is available.
Exchange mode Select the exchange mode used during the Phase 1 negotiation. The SpeedTouch™
supports both main mode and aggressive mode.
Authentication Select from the list the symbolic name of the applicable Authentication Attribute.
Either pre-shared key or certificates can be used for authentication. Authentication
Attributes are defined on the Authentication sub-page. See “3.5.2 Authentication
Page” on page 82.
Peer Descriptor Select from the list the symbolic name of a Peer Security Descriptor to be used for
the IKE negotiation. Up to four Descriptors can be selected in the Profiles page.
These Descriptors are presented as alternative proposals during the IKE
negotiations. Peer Security Descriptors are managed on the Peer Descriptors sub-
page. See “3.5.3 Peer Descriptors Page” on page 83.
Client/Server This optional parameter refers to a dialup VPN Client/Server descriptor. Client/
Server parameters are managed on separate sub-pages. See “3.5.5 VPN-Client
Page” on page 86 for the VPN client configuration. See “3.5.6 VPN-Server Page” on
page 88 for the VPN server configuration.
The IPSec peer can also be tied to the LAN interface (eth0). This could be
useful to set up a secure connection with a local host within the local LAN
for testing purposes, or when a redundant gateway to the public Internet,
other than the SpeedTouch™, is present in the LAN.