2.
Enter a name for the list, for example esp-l2tptunnel
3.
Now check the following:
•
DES
•
3DES
•
SHA1
•
MD5
4.
Click OK
Then, apply the algorithm proposal list to the IPsec tunnel:
1.
Go to Interfaces > IPsec
2.
Select the target IPsec tunnel
3.
Select the recently created esp-l2tptunnel in the IPsec Algorithms control
4.
Click OK
9.3.7. Pre-shared Keys
Pre-Shared Keys are used to authenticate VPN tunnels. The keys are secrets that are shared by the
communicating parties before communication takes place. To communicate, both parties prove that
they know the secret. The security of a shared secret depends on how "good" a passphrase is.
Passphrases that are common words are extremely vulnerable to dictionary attacks.
Pre-shared Keys can be generated automatically through the WebUI but they can also be generated
through the CLI using the command pskgen (this command is fully documented in the CLI
Reference Guide).
Beware of Non-ASCII Characters in a PSK on Different Platforms!
If a PSK is specified as a passphrase and not a hexadecimal value, the different encodings on
different platforms can cause a problem with non-ASCII characters. Windows, for example, encodes
pre-shared keys containing non ASCII characters in UTF-16 while NetDefendOS uses UTF-8. Even
though they can seem the same at either end of the tunnel there will be a mismatch and this can
sometimes cause problems when setting up a Windows L2TP client that connects to NetDefendOS.
Example 9.2. Using a Pre-Shared key
This example shows how to create a Pre-shared Key and apply it to a VPN tunnel. Since regular words and
phrases are vulnerable to dictionary attacks, they should not be used as secrets. Here the pre-shared key is a
randomly generated hexadecimal key. Note that this example does not illustrate how to add the specific IPsec
tunnel object.
Command-Line Interface
First create a Pre-shared Key. To generate the key automatically with a 64 bit (the default) key, use:
gw-world:/> pskgen MyPSK
To have a longer, more secure 512 bit key the command would be:
gw-world:/> pskgen MyPSK -size=512
Or alternatively, to add the Pre-shared Key manually, use:
gw-world:/> add PSK MyPSK Type=HEX PSKHex=<enter the key here>
9.3.7. Pre-shared Keys
Chapter 9. VPN
408
Summary of Contents for NetDefend DFL-260E
Page 27: ...1 3 NetDefendOS State Engine Packet Flow Chapter 1 NetDefendOS Overview 27...
Page 79: ...2 7 3 Restore to Factory Defaults Chapter 2 Management and Maintenance 79...
Page 146: ...3 9 DNS Chapter 3 Fundamentals 146...
Page 227: ...4 7 5 Advanced Settings for Transparent Mode Chapter 4 Routing 227...
Page 241: ...5 4 IP Pools Chapter 5 DHCP Services 241...
Page 339: ...6 7 Blacklisting Hosts and Networks Chapter 6 Security Mechanisms 339...
Page 360: ...7 4 7 SAT and FwdFast Rules Chapter 7 Address Translation 360...
Page 382: ...8 3 Customizing HTML Pages Chapter 8 User Authentication 382...
Page 386: ...The TLS ALG 9 1 5 The TLS Alternative for VPN Chapter 9 VPN 386...
Page 439: ...Figure 9 3 PPTP Client Usage 9 5 4 PPTP L2TP Clients Chapter 9 VPN 439...
Page 450: ...9 7 6 Specific Symptoms Chapter 9 VPN 450...
Page 488: ...10 4 6 Setting Up SLB_SAT Rules Chapter 10 Traffic Management 488...
Page 503: ...11 6 HA Advanced Settings Chapter 11 High Availability 503...
Page 510: ...12 3 5 Limitations Chapter 12 ZoneDefense 510...
Page 533: ...13 9 Miscellaneous Settings Chapter 13 Advanced Settings 533...
