Prestige 652H/HW Series User’s Guide
43-12
VPN/IPSec
Setup
Table 43-3
Menu 27.1.1.1 IKE Setup
FIELD DESCRIPTION
EXAMPLE
Phase 1
Negotiation
Mode
Press [SPACE BAR] to choose from
Main
or
Aggressive
and then press
[ENTER]. See earlier for a discussion of these modes. Multiple SAs
connecting through a secure gateway must have the same negotiation mode.
Main
Pre-Shared
Key
Prestige gateways authenticate an IKE VPN session by matching pre-shared
keys. Pre-shared keys are best for small networks with fewer than ten nodes.
Enter your pre-shared key here. Enter up to 31 characters. Any character may
be used, including spaces, but trailing spaces are truncated.
Both ends of the VPN tunnel must use the same pre-shared key. You will
receive a “PYLD_MALFORMED” (payload malformed) packet if the same pre-
shared key is not used on both ends.
Encryption
Algorithm
The Prestige and the remote IPSec router generate an encryption key from
the Diffie-Hellman key exchange. Prestige
DES
encryption algorithm uses a
56-bit key.
Triple DES (
3DES
), is a variation on DES that uses a 168-bit key. As a result,
3DES
is more secure than
DES
. It also requires more processing power,
resulting in slightly increased latency and decreased throughput.
This implementation of
AES
uses a 128-bit key.
AES
is faster than
3DES
.
Press [SPACE BAR] to choose from
DES
,
3DES
or
AES
and then press
[ENTER].
AES
Authentication
Algorithm
MD5
(Message Digest 5) and
SHA1
(Secure Hash Algorithm) are hash
algorithms used to authenticate packet data. The
SHA1
algorithm is generally
considered stronger than
MD5
, but is slightly slower.
Press [SPACE BAR] to choose from
SHA1
or
MD5
and then press [ENTER].
SHA1
SA Life Time
(Seconds)
Define the length of time before an IKE Security Association automatically
renegotiates in this
field. It
may range from 60 to 3,000,000 seconds (almost
35 days).
A short
SA Life Time
increases security by forcing the two VPN gateways to
update the encryption and authentication keys. However, every time the VPN
tunnel renegotiates, all users accessing remote resources are temporarily
disconnected.
28800
(default)
Key Group You must choose a key group for phase 1 IKE setup.
DH1
(default)
refers to
Diffie-Hellman Group 1 a 768 bit random number.
DH2
refers to Diffie-Hellman
Group 2 a 1024 bit (1Kb) random number.
DH1
Summary of Contents for Prestige 652H series
Page 32: ......
Page 50: ......
Page 66: ......
Page 68: ......
Page 76: ......
Page 80: ......
Page 120: ...Prestige 652H HW Series User s Guide 8 12 WAN Setup Figure 8 6 Advanced WAN Backup ...
Page 128: ......
Page 146: ......
Page 148: ......
Page 162: ......
Page 178: ...Prestige 652H HW Series User s Guide 13 16 Firewall Screens Figure 13 8 Rule Edit Example ...
Page 196: ......
Page 198: ......
Page 204: ......
Page 214: ...Prestige 652H HW Series User s Guide 16 10 VPN Screens Figure 16 5 VPN IKE ...
Page 227: ...Prestige 652H HW Series User s Guide VPN Screens 16 23 Figure 16 8 Manual Setup ...
Page 238: ......
Page 258: ......
Page 277: ...Maintenance VIII Part VIII Maintenance This part covers the maintenance screens ...
Page 278: ......
Page 296: ......
Page 298: ......
Page 308: ......
Page 324: ......
Page 330: ......
Page 386: ......
Page 406: ......
Page 418: ......
Page 428: ......
Page 450: ......
Page 454: ......
Page 464: ......
Page 470: ......
Page 486: ......
Page 494: ......
Page 500: ......
Page 512: ......
Page 516: ......
Page 520: ......
Page 560: ......
Page 574: ......