| | |
| ||
| ||
     |
On the Connections and Encryption page, you can create connection rules that restrict connections based on various selectors. You can also set the ciphers and MACs used for the connections.
The selectors define which connections a connection rule applies to. The order of the rules is important. The first matching rule is used and the remaining rules are ignored.
If no selectors (or only empty selectors) are specified in a connection rule, the rule matches to all connections. In the simple GUI mode, there is only one connection rule that is used for all connections.
If a user does not match to any selectors in the connection rules, the server default connection settings are used.
To add a new connection rule, click the Add button below the tree view. Each rule will have a sub-page with two tabs. On the Selectors tab, you can edit the selectors of the rule and define whether the connection is allowed or denied, and on the Parameters tab, you can configure the settings for the rule.
To edit a connection rule, select a connection item on the tree view. See Editing Connection Rules for more information.
To change the order of the rules, select a connection item on the tree view and use the Up and Down buttons. The rules are read in order, and the first matching connection rule on the list is used.
To delete a connection rule, select a connection item and click Delete.
Each item under Connections and Encryption has two tabs, Selectors and Parameters. The Selectors tab is shown only in the advanced GUI mode.
On the Selectors tab, you can configure the selectors that apply to the connection rule and define whether the connection is allowed or denied.
Enter a name for the connection rule.
The selector list view shows the selectors that apply to the rule.
To add a new selector to the rule, click Add Selector. The new selector will contain automatically at least one attribute. The Add Selector dialog box opens allowing you to specify the selector type. See Editing Selectors for more information on the different selector attributes.
Only the Interface and IP selector attributes are relevant for connection rules. For example, the username is not yet available when the connection rules are processed. See the section called “Selectors” for more information.
To remove a selector, choose the selector from the list view on the Selectors tab and click Delete Selector. This will delete the selector and all its attributes.
To add a new attribute to a selector, choose a selector from the list and click Add Attribute. The Add Selector dialog box opens. See Editing Selectors for more information on the different selector attributes.
To edit a selector attribute, choose the attribute from the list and click Edit Attribute. The relevant selector dialog box opens. See Editing Selectors for more information on the different selector attributes.
To remove a selector attribute, choose the attribute from the list and click Delete Attribute. Note that a selector with no attributes will match everything.
Select whether the connection is allowed or denied.
If you select to deny the connection, the Parameters tab is disabled.
On the Parameters tab, you can configure the allowed ciphers and MACs for the connection.
Select this check box to send keepalive messages to the other side. If they are sent, a broken connection or crash of one of the machines will be properly noticed. This also means that connections will die if the route is down temporarily.
Specify the number of Seconds or transferred Bytes after which the key exchange is done again.
If a value for both Seconds and Bytes is specified, rekeying is done whenever one of the values is reached, after which the counters are reset.
The defaults are 3600 seconds (1 hour) and
1000000000 bytes (~1 GB). The value 0 (zero) turns rekey
requests off. This does not prevent the client from requesting
rekeys.
Under Encryption, select the Ciphers and MACs allowed for the connection from the list. To select several ciphers or MACs, hold down the Ctrl key while clicking.
By default, the following ciphers are allowed:
CryptiCore
AES-128
AES-192
AES-256
3DES
SEED
The ciphers that can operate in the FIPS mode are 3DES, AES-128, AES-192, and AES-256.
By default, the following MACs are allowed:
CryptiCore
HMAC-MD5
HMAC-SHA1
The HMAC-SHA1 algorithm can operate in the FIPS mode.
| |
Copyright 
2007 SSH Communications Security Corp.
This software is protected by international copyright laws. All rights reserved.
Contact Information
