Configuring Virtual Private Networks (VPNs) and Security
Configuring Advanced VPN Parameters
Cisco RV120W Administration Guide
103
5
NOTE
When configuring a lifetime in kilobytes (also known as lifebytes), be aware
that two SAs are created for each policy. One SA applies to inbound traffic,
and one SA applies to outbound traffic. Due to differences in the upstream
and downstream traffic flows, the SA may expire asymmetrically. For
example, if the downstream traffic is very high, the lifebyte for a download
stream may expire frequently. The lifebyte of the upload stream may not
expire as frequently. It is recommended that the values be reasonably set, to
reduce the difference in expiry frequencies of the SAs; otherwise the
system may eventually run out of resources as a result of this asymmetry.
The lifebyte specifications are generally recommended for advanced users
only.
STEP 2
Select the algorithm used to encrypt the data.
STEP 3
Select the algorithm used to verify the integrity of the data.
STEP 4
Under PFS Key Group, check the Enable box to enable Perfect Forward Secrecy
(PFS) to improve security. While slower, this protocol helps to prevent
eavesdroppers by ensuring that a Diffie-Hellman exchange is performed for every
phase-2 negotiation.
STEP 5
Choose the IKE policy that will define the characteristics of phase 1 of the
negotiation. (For information on creating these policies, see
Configuring IKE
Policies, page 95
.)
Configuring VPN Clients
VPN clients must be configured with the same VPN policy parameters used in the
VPN tunnel the client wishes to use: encryption, authentication, life time, and PFS
key-group. Upon establishing these authentication parameters, the VPN Client
user database must also be populated with an account to give a user access to
the tunnel.
VPN client software is required to establish a VPN tunnel between the router and
remote endpoint. Open source software (such as OpenVPN or Openswan) as well
as Microsoft IPsec VPN software can be configured with the required IKE policy
parameters to establish an IPsec VPN tunnel. Refer to the client software guide for
detailed instructions on setup as well as the router’s online help.
