Canon iR3245 Network Manual page 122

[Off] for <PFS>: If you disable the PFS function, if one encryption key is exposed to a third
party, other encryption keys may be able to be guessed. If you set <PFS> to 'On', the
destination for PFS communication must also have PFS enabled.
11. On the IPSec Network Settings screen, select the algorithm for the
3
authentication and encryption to use for IKE phase 2.
Specifying the Authentication and Encryption Algorithm:
●
Automatically Setting the Authentication and Encryption Algorithm:
●
Specifying the Authentication and Encryption Algorithm:
Select [Manual Settings] for <Auth./Encryption Algorithm>.
Set the ESP authentication/encryption method, or the algorithm for the AH
authentication method.
[SHA1] for <ESP Auth.>: Select to set SHA1 as the algorithm for the ESP authentication
method. 160-bit hash values are supported.
[MD5] for <ESP Auth.>: Select to set MD5 as the algorithm for the ESP authentication
method. 128-bit hash values are supported.
[NULL] for <ESP Auth.>: Select to not set the algorithm for the ESP authentication method.
[3DES-CBC] for <ESP Encryption>: Select to set 3DES for the ESP encryption algorithm,
and CBC for the encryption mode. 3DES takes longer to process because it performs DES
three times, but enables increased encryption strength. CBC links the encryption result of
the previous block with the next block to make it harder to decipher the encryption.
3-70 Registering a Security Policy