V I R T U A L P R I V A T E N E T W O R K S
Configuring Internet Key Exchange
7-18
Security Appliance User Guide
Version 3R2
7
set ike gateway {name_str} ip {address_str} {main|
aggressive} outgoing-interface {name} preshare
{name_str} proposal {p1_name}
set vpn {name_str} gateway {gw_name} proposal {p2_name}
Table 7-5
shows the required Phase 1 and Phase 2 Proposal Settings.
Table 7-5: Required Phase 1 and Phase 2 IKE Proposal Settings
Tunnel Name
Name that uniquely identifies the VPN tunnel
IPSec Gateway
IP address or Fully Qualified Domain Name
Pre-Shared
Secret
Pass phrase used to authenticate VPN appliance.
IKE Identity
IPv4 address, e-mail address or FQDN
Phase 1
Exchange proposal to determine how to
authenticate and secure the channel.
Mode Exchange
Main or Aggressive
DH Group
1, 2 or 5
Protocol
AH, ESP
Encryption
DES, 3DES or AES
Authentication
MD5, SHA-1
SA Life Time
Lifetime for a single set of encryption keys.
Phase 2
Exchange that allows an SA to be created,
allowing for the secure transmission of data using
IPsec.
Encryption
DES, 3DES or AES
Authentication
MD5 or SHA-1
DH Group
1, 2 or 5
Protocol
AH or ESP
SA Life Time
Lifetime for a single set of encryption keys
Prefect Forward
Secrecy
Generates a new key for every message sent
through an SA.
Local Network
The local network attached to the VF-2112.
Destination
Network
Network to which the VPN tunnel will terminate
