|
|
|
|
|
Enter a Name to identify the gateway (up to 31 characters). The name is case-sensitive and must be unique. Use only letters, numbers, spaces, hyphens, and underscores.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
•
|
Dynamic—Select this option if the peer IP address or FQDN value is unknown. When the peer IP address type is Dynamic, it is up to the peer to initiate the IKE gateway negotiation.
|
|
•
|
IP—Enter Peer Address as an IPv4 or IPv6 address or an address object that is an IPv4 or IPv6 address.
|
|
•
|
FQDN—Enter Peer Address as an FQDN or an address object that uses an FQDN.
|
|
|
|
|
|
|
|
|
If you select Pre-Shared Key, enter a single security key to use for symmetric authentication across the tunnel. The Pre-Shared Key value is a string that the administrator creates using a maximum of 255 ASCII or non-ASCII characters. Generate a key that is difficult to crack with dictionary attacks; use a pre-shared key generator, if necessary.
|
|
|
|
|
|
|
|
|
|
|
If Certificate is selected as the Authentication type, from the drop-down, select a certificate that is already on the firewall.
|
•
|
Shared—Click if this certificate is to be shared among multiple virtual systems.
|
|
•
|
Certificate File—Click Browse to navigate to the location where the certificate file is located. Click on the file and select Open.
|
|
•
|
Import Private Key—Click if a private key is to be imported because it is in a different file from the certificate file.
|
|
◦
|
Block Private Key Export—When you select Import Private Key, prevents any administrators, including Superusers, from exporting the private key.
|
|
◦
|
Key File—Browse and navigate to the key file to import. This entry is if you chose PEM as the File Format.
|
|
◦
|
Passphrase and Confirm Passphrase—Enter to access the key.
|
|
|
|
|
•
|
Common Name—Enter the common name, which is the IP address or FQDN to appear on the certificate.
|
|
•
|
Shared—Click if this certificate is to be shared among multiple virtual systems.
|
|
•
|
Signed By—Select External Authority (CSR) or enter the firewall IP address. This entry must be a CA.
|
|
•
|
OCSP Responder—Enter the OCSP that tracks whether the certificate is valid or revoked.
|
|
•
|
Algorithm—Select RSA or Elliptic Curve DSA to generate the key for the certificate.
|
|
•
|
Number of Bits—Select 512, 1024, 2048, or 3072 as the number of bits in the key.
|
|
•
|
Digest—Select md5, sha1, sha256, sha384, or sha512 as the method to revert the string from the hash.
|
|
•
|
Certificate Attributes: Type—Optionally, select additional attribute types from the drop-down to be in the certificate.
|
|
•
|
Value—Enter a value for the attribute.
|
|
|
|
Click HTTP Certificate Exchange and enter the Certificate URL to use the Hash-and-URL method to tell the peer where to fetch the certificate. The Certificate URL is the URL of the remote server where you store your certificate.
|
|
|
|
|
|
|
|
|
Select Exact or Wildcard. This setting applies to the Peer Identification being examined to validate the certificate. For example, if the Peer Identification is a Name equal to domain.com, you select Exact, and the name of the certificate in the IKE ID payload is mail.domain2.com, the IKE negotiation will fail. But if you selected Wildcard, then only characters in the Name string before the wildcard asterisk (*) must match and any character after the wildcard can be different.
|
|
|
|
|
|
|
|
|
|