About IKE Mode Config

At times you will want to assign a virtual IP address on your organization's private network to remote VPN users. The IKE mode config option can be configured for client-to-site VPNs — for example, that telecommuters would use. These users connect to the private network through the VPN tunnel, often from their home Internet connection. IKE mode config assigns virtual private addresses to these mobile users for as long as they connect through the VPN gateway.

IKE mode config allows a relatively small pool of mobile users to access the VPN from remote locations. (IKE mode config is not designed for wide-scale management.)

The remote client requests an IP address and default gateway from the IRAS IPsec Remote Access Server on the TMS zl Module between IKE phase 1 and phase 2 negotiations. It may also request addresses for DNS and WINS servers that will resolve domain names for the user while on the private network. The users appear as internal users on the network once they have received the IKE mode config parameters.

When configuring IKE mode config, follow these guidelines.

  • You can configure IKE config mode only for an IPsec policy that uses Auto (with IKEv1) for Key Management and that specifies a client-to-site IKEv1 policy. Each IKEv1 client-to-site policy supports only one IP address pool.

 

Microsoft Windows VPN clients and IPSecuritas for Macintosh VPN clients do not support the TMS zl Module implementation of IKE mode config.

  • When configuring the IPsec policy for IKE mode config, on the traffic selector (Step 1 of 4):

  • Local Address must be the local VPN gateway, and you must type it manually instead of selecting a named object or Any.

  • Remote Address must be the IKE mode config addresses.

  • When configuring firewall access policies for VPNs that use IKE mode config, you must permit normal traffic (not ISAKMP Internet Security Association and Key Management Protocol ) between the local zone and the IKE mode config zone.

  • IKE mode config addresses are assigned to a VLAN that is designated irstintXXX on Network > Routing > View Routes, where XXX is a unique three-digit number. Do not create a VLAN association for this VLAN or you will get IP address conflicts.

  • On Network > Routing > View Routes, the irstintXXX VLAN appears as a connected route.