Vpn Rules (Ike): Network Policy Move - ZyXEL Communications ZyWall 5 Series User Manual

ZyWALL 5/35/70 Series User's Guide
Table 96 SECURITY > VPN > VPN Rules (IKE) > Edit Network Policy (continued)
LABEL
Encryption Algorithm Select which key size and encryption algorithm to use in the IKE SA. Choices
Authentication
Algorithm
SA Life Time
(Seconds)
Perfect Forward
Secret (PFS)
Enable Replay
Detection
Enable Multiple
Proposals
Apply
Cancel

18.8 VPN Rules (IKE): Network Policy Move

Click the move (
Network Policy Move screen.
A VPN (Virtual Private Network) tunnel gives you a secure connection to another computer or
network. Each VPN tunnel uses a single gateway policy and one or more network policies.
346
DESCRIPTION
are:
NULL - no encryption key or algorithm
DES - a 56-bit key with the DES encryption algorithm
3DES - a 168-bit key with the DES encryption algorithm
AES - a 128-bit key with the AES encryption algorithm
The ZyWALL and the remote IPSec router must use the same algorithms and
keys. Longer keys require more processing power, resulting in increased
latency and decreased throughput.
Select which hash algorithm to use to authenticate packet data in the IPSec SA.
Choices are SHA1 and MD5. SHA1 is generally considered stronger than MD5,
but it is also slower.
Define the length of time before an IPSec SA automatically renegotiates in this
field. The minimum value is 180 seconds.
A short SA Life Time increases security by forcing the two VPN gateways to
update the encryption and authentication keys. However, every time the VPN
tunnel renegotiates, all users accessing remote resources are temporarily
disconnected.
Select whether or not you want to enable Perfect Forward Secrecy (PFS) and, if
you do, which Diffie-Hellman key group to use for encryption. Choices are:
NONE - disable PFS
DH1 - enable PFS and use a 768-bit random number
DH2 - enable PFS and use a 1024-bit random number
PFS changes the root key that is used to generate encryption keys for each
IPSec SA. It is more secure but takes more time.
As a VPN setup is processing intensive, the system is vulnerable to Denial of
Service (DOS) attacks. The IPSec receiver can detect and reject old or duplicate
packets to protect against replay attacks. Enable replay detection by selecting
this check box.
Select this to allow the ZyWALL to use any of its phase 2 encryption and
authentication algorithms when negotiating an IPSec SA.
When you enable multiple proposals, the ZyWALL allows the remote IPSec
router to select which phase 2 encryption and authentication algorithms to use
for the IPSec SA, even if they are less secure than the ones you configure for
the VPN rule.
Clear this to have the ZyWALL use only the configured phase 2 encryption and
authentication algorithms when negotiating an IPSec SA.
Click Apply to save the changes.
Click Cancel to discard all changes and return to the main VPN screen.
) icon in the VPN Rules (IKE) screen to display the VPN Rules (IKE):
Chapter 18 IPSec VPN