Справочник Пользователя для Lancom Systems 1781VA 62034
Модели
62034
VPN
Enables IPsec VPN based on TCP (at port 443 like HTTPS) which can go through firewalls in networks where e. g. port 500 for IKE is blocked. Suitable
for client-to-site connections (with LANCOM Advanced VPN Client 2.22 or later) and site-to-site connections (LANCOM VPN gateways or routers
with LCOS 8.0 or later). IPSec over HTTPS is based on the NCP VPN Path Finder technology
for client-to-site connections (with LANCOM Advanced VPN Client 2.22 or later) and site-to-site connections (LANCOM VPN gateways or routers
with LCOS 8.0 or later). IPSec over HTTPS is based on the NCP VPN Path Finder technology
IPSec over HTTPS
Max. number of concurrent active IPSec and PPTP tunnels (MPPE): 5 (25 with VPN 25 Option). Unlimited configurable connections. Configuration
of all remote sites via one configuration entry when using the RAS user template or Proadaptive VPN.
of all remote sites via one configuration entry when using the RAS user template or Proadaptive VPN.
Number of VPN tunnels
Integrated hardware accelerator for 3DES/AES encryption and decryption
Hardware accelerator
Integrated, buffered realtime clock to save the date and time during power failure. Assures timely validation of certificates in any case
Realtime clock
Generates real random numbers in hardware, e. g. for improved key generation for certificates immediately after switching-on
Random number generator
One click function in LANconfig to create VPN client connections, incl. automatic profile creation for the LANCOM Advanced VPN Client
1-Click-VPN Client assistant
Creation of VPN connections between LANCOM routers via drag and drop in LANconfig
1-Click-VPN Site-to-Site
IPSec key exchange with Preshared Key or certificate
IKE
X.509 digital multi-level certificate support, compatible with Microsoft Server / Enterprise Server and OpenSSL, upload of PKCS#12 files via HTTPS
interface and LANconfig. Simultaneous support of multiple certification authorities with the management of up to nine parallel certificate hierarchies
as containers (VPN-1 to VPN-9). Simplified addressing of individual certificates by the hierarchy's container name (VPN-1 to VPN-9). Wildcards for
certificate checks of parts of the identity in the subject. Secure Key Storage protects a private key (PKCS#12) from theft
interface and LANconfig. Simultaneous support of multiple certification authorities with the management of up to nine parallel certificate hierarchies
as containers (VPN-1 to VPN-9). Simplified addressing of individual certificates by the hierarchy's container name (VPN-1 to VPN-9). Wildcards for
certificate checks of parts of the identity in the subject. Secure Key Storage protects a private key (PKCS#12) from theft
Certificates
Automatic creation, rollout and renewal of certificates via SCEP (Simple Certificate Enrollment Protocol) per certificate hierarchy
Certificate rollout
CRL retrieval via HTTP per certificate hierarchy
Certificate revocation lists (CRL)
Check X.509 certifications by using OCSP (Online Certificate Status Protocol) in real time as an alternative to CRLs
OCSP Client
XAUTH client for registering LANCOM routers and access points at XAUTH servers incl. IKE-config mode. XAUTH server enables clients to register
via XAUTH at LANCOM routers. Connection of the XAUTH server to RADIUS servers provides the central authentication of VPN-access with user
name and password. Authentication of VPN-client access via XAUTH and RADIUS connection additionally by OTP token
via XAUTH at LANCOM routers. Connection of the XAUTH server to RADIUS servers provides the central authentication of VPN-access with user
name and password. Authentication of VPN-client access via XAUTH and RADIUS connection additionally by OTP token
XAUTH
Configuration of all VPN client connections in IKE ConfigMode via a single configuration entry
RAS user template
Automated configuration and dynamic creation of all necessary VPN and routing entries based on a default entry for site-to-site connections.
Propagation of dynamically learned routes via RIPv2 if required
Propagation of dynamically learned routes via RIPv2 if required
Proadaptive VPN
3DES (168 bit), AES (128, 192 or 256 bit), Blowfish (128 bit), RSA (1024-4096 bit) and CAST (128 bit). OpenSSL implementation with FIPS-140
certified algorithms. MD-5 or SHA-1 hashes
certified algorithms. MD-5 or SHA-1 hashes
Algorithms
Wirespeed NAT performance through hardware support (offloading) for plain IP connections (incl. DHCP) where source and destination addresses
are not withn the same /20 network.
are not withn the same /20 network.
Hardware NAT
NAT-Traversal (NAT-T) support for VPN over routes without VPN passthrough
NAT-Traversal
VPN data compression based on Deflate compression for higher IPSec throughput on low-bandwidth connections (must be supported by remote
endpoint)
endpoint)
IPCOMP
Enables VPN connections from or to dynamic IP addresses. The IP address is communicated via ISDN B- or D-channel or with the ICMP or UDP
protocol in encrypted form. Dynamic dial-in for remote sites via connection template
protocol in encrypted form. Dynamic dial-in for remote sites via connection template
LANCOM Dynamic VPN
Enables the registration of IP addresses with a Dynamic DNS provider in the case that fixed IP addresses are not used for the VPN connection
Dynamic DNS
DNS forwarding according to DNS domain, e.g. internal names are translated by proprietary DNS servers in the VPN. External names are translated
by Internet DNS servers
by Internet DNS servers
Specific DNS forwarding
Enables the use of IPv4 VPN over IPv6 WAN connections
IPv4 VPN over IPv6 WAN
VPN throughput (max., AES)
320 Mbps
1418-byte frame size UDP
60 Mbps
256-byte frame size UDP
Firewall throughput (max.)
560 Mbps
1518-byte frame size UDP
100 Mbps
256-byte frame size UDP
Hardware firewall throughput (max.)
930 Mbps
HW-NAT TCP
Content Filter (optional)
Activate the 30-day trial version after free registration under http://www.lancom.eu/routeroptions
Demo version
LANCOM 1781VA
Features as of: LCOS 8.84