User manual MAXTOR VPN8

[. . . ] Since data flows over a public network, such as the Internet, encryption technology protects the data. Only networking equipment that contains the correct algorithms and the correct decoding keys could read the data that the VPN transfers over the public network. Since the decoding keys are user configurable, administrators are able to create VPNs. [. . . ] The Matrox iSwitch requires this information to allow the correct choice of encryption algorithm and decoding keys. Encryption: Once the identification and encapsulation steps have allowed the packets to be correct routed across both the private and public networks, then the only remaining component is the encryption choice to allow for privacy and data security. In the case of encryption, the Matrox iSwitch makes no distinction between transmission and reception since it uses the same algorithm and keys for a given tunnel. Decryption occurs once the Matrox iSwitch removes the encapsulation from the original packet. Example: To clarify this process, an example based upon Figure 1 follows. Assume that we will follow a packet as it goes from client A on LAN 1 to client B on LAN 3. Client A (192. 168. 18. 9) on LAN 1 builds a packet to send to Client B (192. 168. 20. 5) on LAN 3. The packet arrives at the default gateway of client A: Matrox iSwitch # 1 at 192. 168. 18. 120. Matrox iSwitch #1 recognizes that the destination Subnet ID of the packet exists in its VPN table. The VPN table indicates that it is destined for LAN 3 with a corresponding Internet destination address of 132. 11. 1. 12. The entry also indicates the encryption parameters the Matrox iSwitch should use. It then encapsulates the result in a new packet with a destination IP address of 132. 11. 1. 12, a source IP address of 200. 200. 10. 1, and a setting to indicate that the payload contains a Generic Routing Encapsulation (GRE) packet. The packet is routed through the Internet to eventually arrive at Matrox iSwitch #3. c. Matrox iSwitch #3 inspects the received packet and notes that it contains a GRE packet. It then extracts the source IP address of 200. 200. 10. 1 and looks for a matching entry in its VPN table. The matching entry allows the encryption parameters to be obtained (the parameters are identical to the parameters used by Matrox iSwitch #1 in step 3). [. . . ] To ensure that the VPN is not deprived of bandwidth non-mission critical applications (WWW, FTP, E-Mail, . . . ), configure a WAN access port to be dedicated exclusively to VPN. The Random key generation feature is useful for creating a password but this password must be sent to the peer endpoint on the other side of the tunnel (they must be the same). While you can accomplish this through a telephone communication, we suggest that you obtain a secure E-mail program. [. . . ]