User`s guide

Chapter 10 IPSec VPN Config Screens
LAN-Cell 2 User’s Guide
223
10.2.3 Network Policy Edit: Port Forwarding Screen
Click SECURITY > VPN and the add network policy ( ) icon in the VPN Rules (IKE)
screen to display the VPN-Network Policy -Edit screen. Then, under Virtual Address
Mapping Rule, select Many-to-One as the Type and click the Port Forwarding Rules
button to open the following screen. Use this screen to configure port forwarding for your
VPN tunnels to let the LAN-Cell forward traffic coming in through the VPN tunnel to the
appropriate IP address on the LAN.
Perfect Forward
Secret (PFS)
Select whether or not you want to enable Perfect Forward Secrecy (PFS) and, if
you do, which Diffie-Hellman key group to use for encryption. Choices are:
NONE - disable PFS
DH1 - enable PFS and use a 768-bit random number
DH2 - enable PFS and use a 1024-bit random number
PFS changes the root key that is used to generate encryption keys for each
IPSec SA. It is more secure but takes more time.
Enable Replay
Detection
As a VPN setup is processing intensive, the system is vulnerable to Denial of
Service (DOS) attacks. The IPSec receiver can detect and reject old or
duplicate packets to protect against replay attacks. Enable replay detection by
selecting this check box.
Enable Multiple
Proposals
Select this to allow the LAN-Cell to use any of its phase 2 encryption and
authentication algorithms when negotiating an IPSec SA.
When you enable multiple proposals, the LAN-Cell allows the remote IPSec
router to select which phase 2 encryption and authentication algorithms to use
for the IPSec SA, even if they are less secure than the ones you configure for
the VPN rule.
Clear this to have the LAN-Cell use only the configured phase 2 encryption and
authentication algorithms when negotiating an IPSec SA.
Apply Click Apply to save the changes.
Cancel Click Cancel to discard all changes and return to the main VPN screen.
Table 78 SECURITY > VPN > VPN Rules (IKE) > Edit Network Policy (continued)
LABEL DESCRIPTION