In cases where large network infrastructures are coupled via VPN, it is advantageous for the costs and effort in configuring a new subnetwork to be confined to the local VPN router and for the central dial-in router configuration to remain unchanged. In order to achieve this simplified network connection, the dial-in devices transmit their identity with the help of a digital certificate.
If simplified dial-in with certificates is activated for the router at headquarters, then the remote routers can suggest a network to be used for the connection during the IKE negotiation in phase 2. This network is entered, for example, when setting up the VPN connection on the remote router. The router at the headquarters accepts the suggested network as long as the simplified dial-in is activated with in addition to activating the option . Moreover, the parameters used by the client during dial in must agree with the default values in the VPN router.
If necessary, the default parameters can be found under .
