Panasonic Network Camera Server BB HCS301A Geting Started Manual

							Operating Instructions
[For assistance, please call: 1-800-272-7033] 45
2.4 What is IPsec?
IPsec provides security for the transmission of sensitive information over 
unprotected networks such as the Internet. IPsec authenticates IP packets 
between participating IPsec devices. 
This products IPsec Feature
This product can use IPsec in both IPv4/IPv6. This product supports the following 
IPsec feature. 
ItemSupported Feature
IKEv1Pre-shared Key Method
Phase 1 mode:Main mode*1
*1This product does not support aggressive mode.
Phase 2 mode:Quick mode
Cipher Algorithm:DES-CBC, 3DES-CBC, AES-CBC (128, 
192, 256 bits)
Message-Digest 
Algorithm:HMAC-MD5, HMAC-SHA-1
IPsecESP (Encapsulating Security Payload)*2
Transport mode, Tunnel mode
*2This product does not support authentication header (AH).
Cipher Algorithm:DES-CBC, 3DES-CBC, AES-CBC (128, 
192, 256 bits)
Message-Digest 
Algorithm:HMAC-MD5-96, HMAC-SHA-1-96
Internet Image
Allowed User
Readable Unreadable
Malicious User
I
ND
C
 
I
NI
NI
NAU
D
I
OU
DIOV
ID
E
OVID
EOP
OPOW
E
RWER 
						

							Operating Instructions
46
IPsec Mode Selection
Select transport mode or tunnel mode to access this product.
Transport Mode (IPv4 Only)
The image is encrypted in the whole way between this product and your PC. In the 
environment of Windows XP Service Pack 1 or later, transport mode is available 
only in IPv4.
Prepare the following requirements.
ItemSupported Feature
PCOperating System:Windows XP Service Pack 1 or later
Web Browser:Internet Explorer 6.0 or later
ISP Service:Services for multiple static global 
addresses (A global address must be 
set up on your PC.)
Note
To use IPsec, you need to set up your operating system. 
See the Panasonic support website at 
http://
panasonic.co.jp/pcc/products/en/netwkcam/ for the 
setup.
Camera ServerISP Service:Services for multiple global addresses 
(A global address must be set up to this 
product.)
Transport Mode
Encrypted
I
ND
C
 
I
NI
NINAU
D
I
OUDIOV
I
D
E
OVIDEOP
OPOW
E
RWER 
						

							Operating Instructions
[For assistance, please call: 1-800-272-7033] 47
Tunnel Mode (IPv4/IPv6)
An IPsec mode of operation where the entire IP packet including IP header is 
authenticated and encrypted. A new IP header is added (protecting the entire 
original packet). Both VPN clients and VPN gateways can use this mode.
Note
This product can be accessed only from the PCs under the VPN router. Other 
PCs cannot access this product.
Prepare the following requirements.
ItemSupported Feature
PCOperating System:Windows XP, Windows 2000, Windows 
Me, Windows 98SE (in IPv4)
:Windows XP Service Pack 1 or later (in 
IPv6)
Web Browser:Internet Explorer 6.0 or later
RouterISP Service  
(in IPv4) 
:Static global address service (A global 
address must be set up to the WAN side 
of the router.)
ISP Service  
(in IPv6)
:IPv4/IPv6 Dual-Stack or IPv6 over 
IPv4 Tunneling service
Note
See the Panasonic support website at http://
panasonic.co.jp/pcc/products/en/netwkcam/ for the 
recommended router.
Camera ServerISP Service  
(in IPv4)
:Services for multiple static global 
addresses (A global address must be 
set up to this product.)
ISP Service  
(in IPv6)
:IPv4/IPv6 Dual-Stack or IPv6 over 
IPv4 Tunneling service
Encrypted
Not EncryptedTunnel Mode WA N
LAN
IND
C
 I
NI
NI
NAU
D
I
OUDIOV
I
D
E
OVIDEOP
OP
OW
E
RWE
R 
						

							Operating Instructions
48
2.5 Encrypt the Camera Image in Transport Mode
This product can encrypt the image using IPsec transport mode.
Note
If you use IPsec, refresh interval slows down.
1.Click [IPsec] on the Setup page.
2.Click Camera in the Transport column.
 If you use transport mode in E-mail or FTP transfer, click No. in the Buffer/
Transfer column.
Note
To display Alarm Log, set Alarm or Motion Detection for Trigger Setting 
and check [Enable].
3.Enter each parameter in the data field.
The display shows that 
the communication is in 
HTTP and any people can 
access this product if they 
have the pre-shared key.
Set up these settings to 
transfer images in 
transport mode (see page 
116).
Set to use Alarm Log (see page 121). 
						

							Operating Instructions
[For assistance, please call: 1-800-272-7033] 49
4.Click [Save] when finished.
 New settings are saved.
5.Click [Cancel].
 The IPsec page is displayed.
6.Check [Use] in the IPsec column, select an encoding strength, and click 
[Save]. 
SettingDescription
Status Check the box to use this encryption method.
Pre-Shared Key It is the key to use in the authentication of communications. 
Enter the same pre-shared key as your PC.
 Enter ASCII characters for the host name (see page 163). 
But [Space], [], [], [&], [] are not available.
Note
If the pre-shared key leaks to a third party, it may lead to illegal 
access, private information leak or interference. To protect your 
security and privacy, pay attention to the following points.
 Make it known only to the specified people.
 Set it as many characters as possible.
 Change the password regularly.
SettingDescription
IPsec Check the box to enable IPsec features. If you clear the 
box, whole IPsec features will be invalid.
Encoding strength Encoding strength for IPsec can be selected. If you select 
[Standard], DES or NULL is valid as an algorithm, and then 
the data will become easier to be decrypted. 
						

							Operating Instructions
50
7.Click [Restart].
8.Set up your PC as it fits to the requirements on page 46.
 Set the FTP server or E-mail server to transfer images.
9.Access this product (see page 12).
 If you can access this product, the IPsec setup is complete.
Notes
 In IPsec communications, IPsec is displayed on the Top page or the 
Single Camera page.
 If you cannot communicate using IPsec, see page 20 of the 
Troubleshooting on the Setup CD-ROM.
 See the Panasonic support website at  
http://panasonic.co.jp/pcc/products/en/netwkcam/ for the IPsec 
features. 
						

							Operating Instructions
[For assistance, please call: 1-800-272-7033] 51
2.6 Encrypt the Camera Image in Tunnel Mode
This product can encrypt the image using IPsec tunnel mode.
Notes
 Do not set IPsec on the PCs under the VPN router. Communications may 
be blocked.
 If you use IPsec, refresh interval slows down.
 This product can be accessed only from the PCs under the VPN router. 
Other PCs cannot access this product.
1.Click [IPsec] on the Setup page.
2.Click Add in the Tunnel column.
3.Enter each parameter in the data field. 
						

							Operating Instructions
52
4.Click [Save] when finished.
 New settings are saved.
5.Click [Cancel].
 The IPsec page is displayed.
6.Check [Use] in the IPsec column, select an encoding strength, and click 
[Save]. 
SettingDescription
Status Check the box to use this encryption method.
Pre-Shared Key It is the key to use in the authentication of communications. 
Enter the same pre-shared key as your VPN router.
 Enter ASCII characters for the host name (see page 163). 
But [Space], [], [], [&], [] are not available.
Note
If the pre-shared key leaks to a third party, it may lead to illegal 
access, private information leak or interference. To protect your 
security and privacy, pay attention to the following points.
 Make it known only to the specified people.
 Set it as many characters as possible.
 Change the password regularly.
Network address Enter the destination network address.
 Enter IP address/Prefix length in the data field.
Router address Enter the WAN IP address of the VPN router on a 
destination network.
Notes
 IPv6 link-local address is not available.
 This product can be accessed only from the PCs 
under the VPN router. Other PCs cannot access this 
product. 
						

							Operating Instructions
[For assistance, please call: 1-800-272-7033] 53
7.Click [Restar t].
8.Set up your VPN router as shown below.
 To use tunnel mode, you need to set up your VPN router.
SettingDescription
IPsec Check the box to enable IPsec features. If you clear the 
box, whole IPsec features will be invalid.
Encoding strength Encoding strength for IPsec can be selected. If you select 
[Standard], DES or NULL is valid as an algorithm, and then 
the data will become easier to be decrypted.
IKE ItemsSettings
Phase 1Authentication 
MethodPre-shared Key Method
IDSpecifies by address.
ModeMain mode*1
Diffie-Hellman 
MODP GroupSpecifies 1 or 2.
Cipher AlgorithmSelect from DES-CBC, 3DES-CBC or 
AES-CBC (128, 192, 256 bits). (Multiple 
selections are available.)
Message-Digest 
AlgorithmHMAC-MD5, HMAC-SHA-1
(Multiple selections are available.)
LifetimeSpecifies by 28800 s (Byte setting is not 
supported.) 
						

							Operating Instructions
54
 Set up the IPsec policy as shown below.
9.Access this product (see page 12).
 If you can access this product, the IPsec setup is complete.
Notes
 In IPsec communications, IPsec is displayed on the Top page or the 
Single Camera page.
 If you cannot communicate using IPsec, see page 20 of the 
Troubleshooting on the Setup CD-ROM.
 See the Panasonic support website at  
http://panasonic.co.jp/pcc/products/en/netwkcam/ for the IPsec 
features.
Phase 2ModeQuick mode
PFSSpecifies either of Off, D-H Group 1 or D-
H Group 2. 
Cipher AlgorithmSelect from DES-CBC, 3DES-CBC, 
AES-CBC (128, 192, 256 bits) or NULL. 
(Multiple selections are available.)
Message-Digest 
AlgorithmHMAC-MD5-96, HMAC-SHA-1-96
(Multiple selections are available.)
LifetimeSpecifies by 28800 s (Byte setting is not 
supported.)
*1This product does not support aggressive mode.
ItemsSettings
ProtocolANY
Source NetworkNetwork address and subnet mask on the LAN side of the 
VPN router
Source IP addressA global address on the WAN side of the VPN router
Destination NetworkA global address of camera server
Destination IP addressA global address of camera server
IKE Items Settings