RAS connections that support certificates can be set up for the LANCOM Advanced VPN Client or for any other VPN client with user-defined parameters. The LANCOM Standard VPN Client does not support certificates.
Note: Various parameters are requested depending on the choice of client or the options. This description shows all of the possible
Wizard dialogs, some of which may not necessarily be relevant for your application.
-
Choose the Wizard that provides remote access over VPN. In the appropriate dialog, select VPN connection authentication with
certificates (RSA signature). The default "Exchange Mode" is the Main Mode.
-
If you wish to use different parameters for incoming main mode connections, you can adapt the standard IKE parameters to fit
your requirements. You can either create a new list 'WIZ-IKE-MAIN-MODE' or you can select one of the existing IKE proposal lists
as the new "Standard IKE proposal list". The list defined here will be used for all incoming main mode connections in the future.
For a new IKE proposal list, you can select the encryption and authentication methods that are to be used by the client during the
IKE negotiation.
-
Enter the identities contained in the certificates for the local and remote devices. Be sure to use the information from each
certificate in full and in the right order: The ASN.1-Distinguished Names listed in Windows from top to bottom in the certificates
must be entered into LANconfig from left to right.
Note: Microsoft Windows displays some values in the certificates with outdated abbreviations, such as 'S' instead of 'ST' for 'stateOrProvinceName', or 'G' instead of 'GN' for 'givenName'. In these cases make sure that you use the current abbreviations 'ST' and 'GN'.Note: The Telnet command show vpn cert displays the content of the device certificate in a device, including the entered Distinguished Names (DN) under "Subject". The Distinguished Names are displayed in reverse order here until LCOS 6.00 and in the usual order as of LCOS 6.10! -
If available choose the optimized connection establishment with IKE and PFS group 2. Only choose group 5 as the PFS group if
this is required by the client.
-
The following dialogs define the encryption and authentication methods, the authentication header and the data compression that
the client will use for the transfer of the payload data with IPSec. Use the preset values as much as possible as long as the
client does not demand different settings.
