Filter
Top Products
Chapter 6 Device Security Settings
Vantage CNM User’s Guide
134
6.3.3 Add/Edit an IKE Network Policy
In the VPN Rule (IKE) screen, click the Add icon from a gateway policy or click Edit from
an existing network policy to display the Network Policy screen.
Password Enter the corresponding password for the above user name. The password
can be up to 31 case-sensitive ASCII characters, but spaces are not allowed.
IKE Proposal
Negotiation Mode Select Main or Aggressive from the drop-down list box. Multiple SAs
connecting through a secure gateway must have the same negotiation mode.
Encryption Algorithm Select which key size and encryption algorithm to use in the IKE SA. Choices
are:
DES - a 56-bit key with the DES encryption algorithm
3DES - a 168-bit key with the DES encryption algorithm
AES128/AES192/AES256 - a 128/192/256-bit key with the AES encryption
algorithm
The selected and the remote IPSec router must use the same algorithms and
keys. Longer keys require more processing power, resulting in increased
latency and decreased throughput.
Authentication
Algorithm
Select SHA1 or MD5 from the drop-down list box. MD5 (Message Digest 5)
and SHA1 (Secure Hash Algorithm) are hash algorithms used to authenticate
packet data. The SHA1 algorithm is generally considered stronger than MD5,
but is slower. Select MD5 for minimal security and SHA-1 for maximum
security.
SA Life Time
(Seconds)
Define the length of time before an IKE SA automatically renegotiates in this
field. It may range from 180 to 3,000,000 seconds (almost 35 days).
A short SA Life Time increases security by forcing the two VPN gateways to
update the encryption and authentication keys. However, every time the VPN
tunnel renegotiates, all users accessing remote resources are temporarily
disconnected.
Key Group Select which Diffie-Hellman key group (DHx) you want to use for encryption
keys. Choices are:
DH1 - use a 768-bit random number
DH2 - use a 1024-bit random number
DH5 - use a 1536-bit random number.
The longer the key, the more secure the encryption, but also the longer it
takes to encrypt and decrypt information. Both routers must use the same DH
key group.
Enable Multiple
Proposals
Select this check box to allow the device to use any of its phase 1 or phase 2
encryption and authentication algorithms when negotiating an IPSec SA.
When you enable multiple proposals, the device allows the remote IPSec
router to select which encryption and authentication algorithms to use for the
VPN tunnel, even if they are less secure than the ones you configure for the
VPN rule.
Clear this check box to have the device use only the phase 1 or phase 2
encryption and authentication algorithms configured below when negotiating
an IPSec SA.
Apply Click Apply to save your changes back to the device.
Cancel Click Cancel to exit this screen without saving.
Table 50 Device Operation > Device Configuration > Security > VPN > VPN Rules (IKE) >
Gateway Policy Add/Edit
LABEL DESCRIPTION