About Virtual Private Networking


Tunnels

A VPN secures network traffic by transporting it within encrypted 'tunnels' between two VPN devices. A VPN tunnel ensures data privacy over any type of network. Multiple physical network(s) can exist between two VPN devices, a VPN tunnel thus provides a virtual 'single-hop' network connection between two VPN devices.

A VPN tunnel is created by a 'client' to a specific 'server'; a server can have tunnels to many clients.

A special 'shared' tunnel is also provided to support a few special traffic types:
   Point-to-multipoint broadcast and multicast packets
   Telnet, Web, SNMP, and RADIUS packets
   Device-specific IP-service packets (GPS, RSSI, diagnostics, etc)
The shared tunnel is always available on a device, provided that its VPN service is enabled.

Tunnel Maintenance

Key Exchange

Random cipher keys are used to encrypt VPN tunnel traffic, these keys are unique to each tunnel and are generated during VPN client/server key exchange. Tunnel keys are periodically updated to maxmize security.

Server Status Advertisement

By default, traffic normally sent via VPN tunnel is blocked if one client/server tunnel endpoint is non-operational.
A server therefore advertises its status to ensure all its tunnels have a very high availability, these are sent whenever the server is enabled or disabled through reset, device hot-swap, or manual intervention. VPN clients can thus quickly re-establish their tunnels as needed.

Configuration

Most VPN server configuration settings are sent to each client during key exchange.
A VPN server does not send the following settings to VPN clients:
   VPN login password and Master Key
   Device-specific General settings, and IP-filter settings

Master Key

The VPN Master Key is a configuration item essential to the security of VPN operations. A VPN server's Master Key must also be set on each of its clients. Access to the Master Key (along with other VPN settings) is therefore protected by the 'VPN login' mechanism.

A VPN deployment consisting of multiple isolated VPN servers can employ a different Master Key per server for additional security, since redeploying VPN clients to other servers would require their Master Key to be changed to match the new server's key.



VPN - Access To Settings


VPN Password

Enter the VPN password (leave field empty if not set), and click the 'Login' button to be able to change VPN-specific configuration settings.

Clear Password and Master Key

Permits access to VPN confiugration settings when the VPN password is unknown.


VPN - Service Control


Enable VPN

Enables the VPN service on the local device.

Note: For packets to securely pass over the network, the VPN service must be enabled on both tunnel endpoints.

Disable VPN

Disables the VPN service on the local device.

Note: For packets to unsecurely pass over the network, the VPN service must be disabled on both tunnel endpoints.

Enable VPN Clients

(Available on VPN servers only)

Sends a 'VPN enable' command to all clients, regardless of the VPN server's state.

Note: The command is broadcast a few times, based on the 'Network Latency' VPN setting. A server can send only one command at a time.
Note: VPN clients with a user accessing the VPN configuration cannot process commands from the server.

Disable VPN Clients

(Available on VPN servers only)

Sends a 'VPN disable' command to all clients, regardless of the VPN server's state.

Note: The command is broadcast a few times, based on the 'Network Latency' VPN setting. A server can send only one command at a time.
Note: VPN clients with a user accessing the VPN configuration cannot process commands from the server.


VPN - Status and Statistics


The result of clicking the 'Enable VPN' or 'Disable VPN' buttons is not immediately reflected in the status.
Click the 'Refresh' button to update the status and statistics.

Number of Tunnels

Number of active VPN tunnels originating/terminating in the device.
This number is subdivided into tunnels that are ready and tunnels currently undergoing key exchange.
One additional 'shared' tunnel is used for special types of traffic (see About Virtual Private Networking)

Note: At least two tunnels must be ready for normal application traffic to pass via the VPN (one shared and one or more regular tunnels). By default, packets normally sent via a VPN tunnel are blocked if the tunnel is not ready.

Packets Sent

Number of packets sent by the device through all VPN tunnels.

Packets Received

Number of packets received by the device from all VPN tunnels.

Packets Received In Error

Number of packets received in error by the device from all VPN tunnels, possible causes include:
   Reception of non-VPN packets when 'Block non-VPN packets' is enabled.
   Decryption errors due to key exchange, or packet corruption (infrequent).



VPN Configuration - Password, Key Strength, Master Key


Note: These settings are not affected by the 'Set To Defaults' button.

VPN Password

This field is used to change the password used to gain access to VPN confiugration settings.
The password must contain at least 8 and not exceeding 15 characters using a combination of three out of the following four classes:
   uppercase letters
   lowercase letters
   numbers
   special characters

Note: The list of supported special characters is shown after entering an invalid password.
Note: The VPN service cannot be enabled if this field is not set.

Key Strength

The number of bits used by all VPN keys.

The value can be one of the following:
   128 bits - 16 text characters, or 32 hexadecimal digits.
   192 bits - 24 text characters, or 48 hexadecimal digits.
   256 bits - 32 text characters, or 64 hexadecimal digits.
Hexadecimal digits include: 0-9, and a-f or A-F

Default: 128 bits

Master Key

A key that must be the same for a VPN server and all its clients.
This key can be entered as a text string (weaker), or as a binary number (stronger).
   A string can contain any character
      exmaple: "a 16-byte string", quotes are optional.
   A numeric value should start with '0x' to permit hexadecimal digits
      example: 0x00112233445566778899aabbccddeeff is a 16-byte (128-bit) value.
A numeric value provides a stronger key than a string, since each string character contains only 7 bits, but two hexadecimal digits contain 8 bits.

Note: The length of the key must match the Key Strength setting in bytes (ie. strength/8).
Note: The VPN service cannot be enabled if this field is not set.

Clear VPN Password and Master Key

Clears the VPN password used to gain access to VPN confiugration settings.
Also clears the VPN Master Key.

Note: To just reset the Master Key, set the Key Strength to a different value.


VPN Configuration - General Settings


Set Server/Client Defaults

Sets most VPN settings to appropriate values for either server or client mode of operation.
Server mode should be selected on devices connected by ethernet to the backhaul network.
Client mode should be selected on all other devices.

Note: The VPN Password, Key Strength, and Master Key settings are not affected.
Note: It is recommended to select one of these buttons as the first step in configuring the VPN service.

Automatic Start

Enabled - Start the VPN service at startup.
Disabled - Do not start the VPN service at startup.

Default: Enabled

Operating Mode

Server - The device is a VPN server (must be an access point RF device).
Client - The device is a VPN client (must be a non-access point RF device).

Note: an access point connects to the backhaul via its ethernet port
Note: after changing this setting, click the 'Apply' button to refresh the page.

Default: Client


VPN Configuration - Server Settings


Block non-VPN Traffic

(Available on VPN servers only)

When enabled, the VPN service blocks all packets from the RF link which were no sent via a VPN tunnel.
When disabled, non-matching traffic is sent in the clear.

Note: This setting is especially useful for blocking devices not configured for VPN operation from sending packets into the backhaul network.
Note: A VPN server automatically sets this parameter on its clients during key exchange.

Default: Enabled

Status Frequency

(Available on VPN servers only)

The number of seconds between server-status advertisements sent to VPN clients. An advertisement consists of a few packets sent at an interval determined by the Network Latency setting. A server's status includes its VPN service state (enabled/disabled) and load (0-100% tunnel capacity in use).
A non-zero value permits VPN clients to 'discover' servers (ie. they do not need to be pre-configured with server IP addresses). Clients that are aware of more than one server can intelligently select one based on its advertised load.

Note: This item does not affect the server-statuses that are sent whenever a VPN server is enabled or disabled.
Note: Server-status packets are broadcast over radio links to minimize traffic, devices acting as radio-relays must therefore explicitly enable station relay mode to forward server-statuses.
Note: A VPN server automatically sets this parameter on its clients during key exchange.

Default: 10 seconds
Minimum: 5 seconds (0 = disabled)
Maximum: 60 seconds

Idle Timeout

(Available on VPN servers only)

The number of minutes with no traffic received from a VPN tunnel before attempting Idle Probe and/or Key Exchange.
When Idle Probes are disabled, the Idle Timeout will simply trigger key exchange.

Note: This value affects the time it takes for VPN clients to re-establish their tunnels after a VPN server is restarted.
Note: A VPN server automatically sets this parameter on its clients during key exchange.

Default: 15 minutes
Minimum: 0 minutes (disabled)
Maximum: 60 minutes

Idle Probes

(Available on VPN servers only)

On Idle Timeout, the number of Idle Probes to send without receiving a reply.
An Idle Probe attempt consists of a 100 byte UDP packet that is sent/received via a VPN tunnel. A successful send/receive prevents premature key exchange for that VPN tunnel.

Note: The Idle Timeout setting must be non-zero before Idle Probes are sent.
Note: The retry frequency of each probe attempt is determined by the Network Latency setting.
   For a Network Latency of 10, the probe frequency is 10 seconds.
Note: A VPN server automatically sets this parameter on its clients during key exchange.

Default: 3
Minimum: 0 (disabled)
Maximum: 10

Key Timeout

(Available on VPN servers only)

Maximum duration of VPN tunnel cipher keys.
Key Exchange consists of approximately 12 80-100 byte TCP packets (1 kilobyte), which may take several seconds, or more when the network is busy.

Note: The retry frequency of each key exchange attempt is determined by the Network Latency setting.
   For a Network Latency of 10, the key exchange attempt frequency is 0-70 seconds.
Note: A VPN server automatically sets this parameter on its clients during key exchange.

Default: 6 hours
Minimum: 1 hour
Maximum: 24 hours

Network Latency

(Available on VPN servers only)

This parameter is a factor (multiplier) for tuning VPN maintenance operations, it affects the frequency of server-status packets, idle probes and key exchange retries (see those settings for details). It should be larger if key exchanges are occuring more frequently than the Key Timeout setting (see the VPN Status and Statistics help section).

Note: Only change this value by small amounts (1-5).
Note: A VPN server automatically sets this parameter on its clients during key exchange.

Default: 20 seconds
Minimum: 2 seconds
Maximum: 60 seconds


VPN Configuration - Client Settings


Server IP addresses

(Available on VPN clients only)

The IP addresses of one or more VPN servers.

Note: When the VPN Server 'Status Frequency' setting is zero (default), each of its clients must be set with that server's RF IP address, otherwise this is optional (clients will 'discover' the server's IP address.


VPN Configuration - Packet Filter Settings


These filters provide criteria used to select which packets are sent via VPN tunnels. Packets passing inside VPN tunnels are protected with strong encryption.
Traffic not matching these filters is discarded when the 'Block non-VPN Traffic' setting is enabled (default), otherwise it is forwarded as-is (unencrypted).

Note: appropriate filters are automatically set when selecting the 'Set Client/Server Defaults' buttons.

Source/Destination IP Address and Netmask

The source and destination IP addresses are used to select which packets sent via VPN tunnels.
   Source IP filter: controls which traffic from the VPN device or its immediate Ethernet LAN enters the VPN.
   Destination IP filter: controls which traffic to the given ip address or range enters the VPN.

Examples (with netmask 255.255.255.255):
   Source IP address 172.30.51.3 allows packets from only the specified LAN IP address into the VPN.
   Source IP address 0.0.0.0 allows packets from any LAN IP address into the VPN.
      This is useful when LAN devices sending via the VPN are behind routers, usually the case for a VPN server connected to a backhaul network.

The netmask for each IP address controls whether it is a single address or a subnet range.
Examples:
   255.255.255.255 restricts the IP address range to the specified value.
   255.255.255.0 allows the last part of the IP address to range from 1 to 254.

Source defaults:
   0.0.0.0 (server, allow any source)
   [LAN subnet] (client, allow any local source)
Destination default:
   0.0.0.0 (allow any destination)

Source/Destination Ports

The source and destination TCP/UDP port number ranges are used to select which packets sent via the VPN based on application type.
   Source port filter: controls which traffic from the VPN device or its immediate Ethernet LAN enters the VPN.
   Destination port filter: controls which traffic to the given TCP/UDP port or range enters the VPN.

Examples:
   Destination ports 0 to 0 allows packets to any port.
   Destination ports 5555 to 0 allows packets to only port 5555.
   Destination ports 5555 to 6000 allows packets to all ports between 5555 and 6000.

Default: 0 (allow any port)
Minimum: 1
Maximum: 65535

Back to Top