A VPN secures network traffic by transporting it within encrypted 'tunnels' between two VPN devices. A VPN tunnel ensures data privacy over any type of network.
Multiple physical network(s) can exist between two VPN devices, a VPN tunnel thus provides a virtual 'single-hop' network connection between two VPN devices.
A VPN tunnel is created by a 'client' to a specific 'server'; a server can have tunnels to many clients.
A special 'shared' tunnel is also provided to support a few special traffic types:
Point-to-multipoint broadcast and multicast packets
Telnet, Web, SNMP, and RADIUS packets
Device-specific IP-service packets (GPS, RSSI, diagnostics, etc)
The shared tunnel is always available on a device, provided that its VPN service is enabled.
Random cipher keys are used to encrypt VPN tunnel traffic,
these keys are unique to each tunnel and are generated during VPN client/server key exchange.
Tunnel keys are periodically updated to maxmize security.
By default, traffic normally sent via VPN tunnel is blocked if one client/server tunnel endpoint is non-operational.
A server therefore advertises its status to ensure all its tunnels have a very high availability,
these are sent whenever the server is enabled or disabled through reset, device hot-swap, or manual intervention.
VPN clients can thus quickly re-establish their tunnels as needed.
Most VPN server configuration settings are sent to each client during key exchange.
A VPN server does not send the following settings to VPN clients:
VPN login password and Master Key
Device-specific General settings, and IP-filter settings
The VPN Master Key is a configuration item essential to the security of VPN operations. A VPN server's Master Key must also be set on each of its clients. Access to the Master Key (along with other VPN settings) is therefore protected by the 'VPN login' mechanism.
A VPN deployment consisting of multiple isolated VPN servers can employ a different Master Key per server for additional security, since redeploying VPN clients to other servers would require their Master Key to be changed to match the new server's key.
Enter the VPN password (leave field empty if not set), and click the 'Login' button to be able to change VPN-specific configuration settings.
Permits access to VPN confiugration settings when the VPN password is unknown.
Enables the VPN service on the local device.
Note: For packets to securely pass over the network, the VPN service must be enabled on both tunnel endpoints.
Disables the VPN service on the local device.
Note: For packets to unsecurely pass over the network, the VPN service must be disabled on both tunnel endpoints.
(Available on VPN servers only)
Sends a 'VPN enable' command to all clients, regardless of the VPN server's state.
Note: The command is broadcast a few times, based on the 'Network Latency' VPN setting. A server can send only one command at a time.
Note: VPN clients with a user accessing the VPN configuration cannot process commands from the server.
(Available on VPN servers only)
Sends a 'VPN disable' command to all clients, regardless of the VPN server's state.
Note: The command is broadcast a few times, based on the 'Network Latency' VPN setting. A server can send only one command at a time.
Note: VPN clients with a user accessing the VPN configuration cannot process commands from the server.
The result of clicking the 'Enable VPN' or 'Disable VPN' buttons is not immediately reflected in the status.
Click the 'Refresh' button to update the status and statistics.
Number of active VPN tunnels originating/terminating in the device.
This number is subdivided into tunnels that are ready and tunnels currently undergoing key exchange.
One additional 'shared' tunnel is used for special types of traffic (see About Virtual Private Networking)
Note: At least two tunnels must be ready for normal application traffic to pass via the VPN (one shared and one or more regular tunnels). By default, packets normally sent via a VPN tunnel are blocked if the tunnel is not ready.
Number of packets sent by the device through all VPN tunnels.
Number of packets received by the device from all VPN tunnels.
Number of packets received in error by the device from all VPN tunnels, possible causes include:
Reception of non-VPN packets when 'Block non-VPN packets' is enabled.
Decryption errors due to key exchange, or packet corruption (infrequent).
Note: These settings are not affected by the 'Set To Defaults' button.
This field is used to change the password used to gain access to VPN confiugration settings.
The password must contain at least 8 and not exceeding 15 characters using a combination of three out of the following four classes:
uppercase letters
lowercase letters
numbers
special characters
Note: The list of supported special characters is shown after entering an invalid password.
Note: The VPN service cannot be enabled if this field is not set.
The number of bits used by all VPN keys.
The value can be one of the following:
128 bits - 16 text characters, or 32 hexadecimal digits.
192 bits - 24 text characters, or 48 hexadecimal digits.
256 bits - 32 text characters, or 64 hexadecimal digits.
Hexadecimal digits include: 0-9, and a-f or A-F
Default: 128 bits
A key that must be the same for a VPN server and all its clients.
This key can be entered as a text string (weaker), or as a binary number (stronger).
A string can contain any character
exmaple: "a 16-byte string", quotes are optional.
A numeric value should start with '0x' to permit hexadecimal digits
example: 0x00112233445566778899aabbccddeeff is a 16-byte (128-bit) value.
A numeric value provides a stronger key than a string, since each string character contains only 7 bits, but two hexadecimal digits contain 8 bits.
Note: The length of the key must match the Key Strength setting in bytes (ie. strength/8).
Note: The VPN service cannot be enabled if this field is not set.
Clears the VPN password used to gain access to VPN confiugration settings.
Also clears the VPN Master Key.
Note: To just reset the Master Key, set the Key Strength to a different value.
Sets most VPN settings to appropriate values for either server or client mode of operation.
Server mode should be selected on devices connected by ethernet to the backhaul network.
Client mode should be selected on all other devices.
Note: The VPN Password, Key Strength, and Master Key settings are not affected.
Note: It is recommended to select one of these buttons as the first step in configuring the VPN service.
Enabled - Start the VPN service at startup.
Disabled - Do not start the VPN service at startup.
Default: Enabled
Server - The device is a VPN server (must be an access point RF device).
Client - The device is a VPN client (must be a non-access point RF device).
Note: an access point connects to the backhaul via its ethernet port
Note: after changing this setting, click the 'Apply' button to refresh the page.
Default: Client
(Available on VPN servers only)
When enabled, the VPN service blocks all packets from the RF link which were no sent via a VPN tunnel.
When disabled, non-matching traffic is sent in the clear.
Note: This setting is especially useful for blocking devices not configured for VPN operation from sending packets into the backhaul network.
Note: A VPN server automatically sets this parameter on its clients during key exchange.
Default: Enabled
(Available on VPN servers only)
The number of seconds between server-status advertisements sent to VPN clients. An advertisement consists of a few packets sent at an interval determined by the Network Latency setting.
A server's status includes its VPN service state (enabled/disabled) and load (0-100% tunnel capacity in use).
A non-zero value permits VPN clients to 'discover' servers (ie. they do not need to be pre-configured with server IP addresses).
Clients that are aware of more than one server can intelligently select one based on its advertised load.
Note: This item does not affect the server-statuses that are sent whenever a VPN server is enabled or disabled.
Note: Server-status packets are broadcast over radio links to minimize traffic, devices acting as radio-relays must therefore explicitly enable station relay mode to forward server-statuses.
Note: A VPN server automatically sets this parameter on its clients during key exchange.
Default: 10 seconds
Minimum: 5 seconds (0 = disabled)
Maximum: 60 seconds
(Available on VPN servers only)
The number of minutes with no traffic received from a VPN tunnel before attempting Idle Probe and/or Key Exchange.
When Idle Probes are disabled, the Idle Timeout will simply trigger key exchange.
Note: This value affects the time it takes for VPN clients to re-establish their tunnels after a VPN server is restarted.
Note: A VPN server automatically sets this parameter on its clients during key exchange.
Default: 15 minutes
Minimum: 0 minutes (disabled)
Maximum: 60 minutes
(Available on VPN servers only)
On Idle Timeout, the number of Idle Probes to send without receiving a reply.
An Idle Probe attempt consists of a 100 byte UDP packet that is sent/received via a VPN tunnel. A successful send/receive prevents premature key exchange for that VPN tunnel.
Note: The Idle Timeout setting must be non-zero before Idle Probes are sent.
Note: The retry frequency of each probe attempt is determined by the Network Latency setting.
For a Network Latency of 10, the probe frequency is 10 seconds.
Note: A VPN server automatically sets this parameter on its clients during key exchange.
Default: 3
Minimum: 0 (disabled)
Maximum: 10
(Available on VPN servers only)
Maximum duration of VPN tunnel cipher keys.
Key Exchange consists of approximately 12 80-100 byte TCP packets (1 kilobyte), which may take several seconds, or more when the network is busy.
Note: The retry frequency of each key exchange attempt is determined by the Network Latency setting.
For a Network Latency of 10, the key exchange attempt frequency is 0-70 seconds.
Note: A VPN server automatically sets this parameter on its clients during key exchange.
Default: 6 hours
Minimum: 1 hour
Maximum: 24 hours
(Available on VPN servers only)
This parameter is a factor (multiplier) for tuning VPN maintenance operations, it affects the frequency of server-status packets, idle probes and key exchange retries (see those settings for details). It should be larger if key exchanges are occuring more frequently than the Key Timeout setting (see the VPN Status and Statistics help section).
Note: Only change this value by small amounts (1-5).
Note: A VPN server automatically sets this parameter on its clients during key exchange.
Default: 20 seconds
Minimum: 2 seconds
Maximum: 60 seconds
(Available on VPN clients only)
The IP addresses of one or more VPN servers.
Note: When the VPN Server 'Status Frequency' setting is zero (default), each of its clients must be set with that server's RF IP address, otherwise this is optional (clients will 'discover' the server's IP address.
These filters provide criteria used to select which packets are sent via VPN tunnels.
Packets passing inside VPN tunnels are protected with strong encryption.
Traffic not matching these filters is discarded when the 'Block non-VPN Traffic' setting is enabled (default),
otherwise it is forwarded as-is (unencrypted).
Note: appropriate filters are automatically set when selecting the 'Set Client/Server Defaults' buttons.
The source and destination IP addresses are used to select which packets sent via VPN tunnels.
Source IP filter: controls which traffic from the VPN device or its immediate Ethernet LAN enters the VPN.
Destination IP filter: controls which traffic to the given ip address or range enters the VPN.
Examples (with netmask 255.255.255.255):
Source IP address 172.30.51.3 allows packets from only the specified LAN IP address into the VPN.
Source IP address 0.0.0.0 allows packets from any LAN IP address into the VPN.
This is useful when LAN devices sending via the VPN are behind routers, usually the case for a VPN server connected to a backhaul network.
The netmask for each IP address controls whether it is a single address or a subnet range.
Examples:
255.255.255.255 restricts the IP address range to the specified value.
255.255.255.0 allows the last part of the IP address to range from 1 to 254.
Source defaults:
0.0.0.0 (server, allow any source)
[LAN subnet] (client, allow any local source)
Destination default:
0.0.0.0 (allow any destination)
The source and destination TCP/UDP port number ranges are used to select which packets sent via the VPN based on application type.
Source port filter: controls which traffic from the VPN device or its immediate Ethernet LAN enters the VPN.
Destination port filter: controls which traffic to the given TCP/UDP port or range enters the VPN.
Examples:
Destination ports 0 to 0 allows packets to any port.
Destination ports 5555 to 0 allows packets to only port 5555.
Destination ports 5555 to 6000 allows packets to all ports between 5555 and 6000.
Default: 0 (allow any port)
Minimum: 1
Maximum: 65535