Versionen im Vergleich

Alte Version 2

changes.mady.by.user LANCOM Redaktion

Gespeichert am

verglichen mit

Neue Version 3

changes.mady.by.user LANCOM Redaktion

Gespeichert am

Schlüssel

  • Diese Zeile wurde hinzugefügt.
  • Diese Zeile wurde entfernt.
  • Formatierung wurde geändert.

...

This article describes special configuration parameters in LANCOM routers/Central Site Gateways with LCOS, which can be used to optimize the connection setup of VPn VPN connections (IKEv2).

Hinweis

The default settings for the parameters described below are the recommended configuration settings. If you change these parameters, be sure to perform simulated failure tests, to ensure, that the connections are still functioning properly. 

Info
titleNotes regarding scaling


An IKEv2-Initiator has a Backoff-Timer, which ensures, that the next connection setup (IKE_SA_INIT) does not start immediately after a failed attempt. 

A Backoff-Timer of 30 seconds plus/minus a random value between 0 and 10 seconds is applied after the following VPN errors. The timer does not riseincrease after multiple failed connection attempts.

 ike_i_ike_key_mismatch
 ike_r_ike_key_mismatch
 ipsec_r_no_rule_matched_ids
 ipsec_i_no_proposal_matched
 ipsec_r_no_proposal_matched
 interface_i_connection_timeout_protocol
 interface_r_connection_timeout_protocol

...

The Negotiation-Control defines, how many IKEv2 connection setups connections can be set up by the IKEv2-Responder can perform simultaneously.

If the parameter Negotiation-Control in the CLI path Setup/VPN/ is set from Normal to Medium or Fast, more connections can be set upsimultaneously. When using a greater number of VPN connctions, this reduces the time, till all connections are established.     

Hinweis

Setting up more a greater number of VPN connections simultaneously takes more CPU ressources. Therefore this parameter has to be balanced with the value set for "Precalculation".

...