Topics
1. Security options and settings
2. Layer 2 vs. Layer 3 connection types
3. Advanced network and routing options
4. Local connections
5. Offline mode
Lock security options –
Admin password
•
The most important one!
•
The admin user can change all the security settings in the Lock, so the
password should be changed from the default
Lock security options –
MAC/IP filter
•
Settings -> Industry settings -> Limit LAN traffic to certain MAC or IP
addresses
•
Allowed targets can be specified either using MAC address or IP address
•
Useful especially in mode A
Lock security options –
“Do not enter” sign
•
Prevents new connections towards the Key from Lock’s LAN and other
connected devices
•
Enabled by default and changeable in Edit Tosibox devices
Lock security options –
Prevent traffic between Sub Locks
•
Used for isolating Sub Lock networks from each other
•
Devices in each Sub Lock network can only access the “main”
Lock’s LAN and the Internet, but not devices behind other Sub
Locks
•
Helps also performance-wise because it reduces the
broadcast traffic that would “leak” between the VPN
connections
Different connection types
•
Layer 2 – bridged, site-to-site
•
Creates a virtual network interface that appears to be residing in the remote network
•
Can be thought of as having a really long ethernet cable to the remote network
•
Each remote user gets its own address from the remote network
•
Works on the data link layer (MAC)
•
Layer 3 – routed, point-to-point
•
Tunnel end points have private addresses
•
Data is routed to the remote network via the remote end of the tunnel
•
Traffic in the remote network appears to be coming from the Lock device – no additional
addresses need to be allocated
•
Works on the network layer (Internet Protocol)
Changing the connection type
•
•
The default connection type is
•
Layer 2 for Key-Lock connections
•
Layer 3 for Key-Central Lock connections and Mobile Clients
The connection type can be changed in Lock’s web UI by clicking Edit
Tosibox devices
Advanced network options –
Routing Key users’ Internet connection through Lock
•
Similar to traditional corporate VPN setups
•
Usually slows down the Internet access a bit
•
Can be useful for providing access to office/corporate network
resources (via WAN) when Lock is deployed in mode B
•
Or forcing all traffic to go through the company’s proxy or
firewall
Advanced network options –
Access to hosts through WAN
•
Used for providing access to only selected devices outside Lock’s WAN
connection. Settings -> Industry settings
•
Other traffic (e.g. Internet) is not routed via the Lock
Advanced network options –
Static routes
•
Low-level configuration interface for more complex and rare cases
•
Needed e.g. if there are multiple routers in the LAN providing access to
different destinations
•
Static routes are pushed also to Key users’ computers - requires Layer 3
connection
•
Configuration at Network -> Static routes
Local connections
•
TOSIBOX Key periodically sends out messages in the local networks
(LANs) to discover Locks or Central Locks
•
When a connection is requested to a Lock/Central Lock located in the
same LAN, a direct connection is made locally, without MatchMaking
service
Offline mode
•
•
It is also possible to disable Internet access in the Lock device so that only local
connections are allowed (so-called Offline mode). The administrator can choose to
block either:
•
All Internet access: both inbound VPN connections and outbound Internet access from
LAN is blocked
•
VPN access from Internet (inbound)
A temporary exception (timer) can be defined for both, e.g. to allow a technician to
get remote access for one hour to perform maintenance work
Offline mode
•
•
It is also possible to disable Internet access in the Lock device so that only local
connections are allowed (so-called Offline mode). The administrator can choose to
block either:
•
All Internet access: both inbound VPN connections and outbound Internet access from
LAN is blocked
•
VPN access from Internet (inbound)
A temporary exception (timer) can be defined for both, e.g. to allow a technician to
get remote access for one hour to perform maintenance work