TP-Link TL-R600VPN Configuration Manual page 137

Configuring VPN
SA. IKEv1 phase-2 is used to negotiate about keys and security related parameters, then
establish the IPSec SA. It is suggested to keep the default advanced settings. You can
complete the configurations according to your actual needs.
 Configuring the IKE Phase-1 Parameters
Choose the menu VPN > IPSec > IPSec Policy and click Advanced Settings to load the
following page.
Figure 2-2 Configuring the IKE Phase-1 Parameters
In the Phase-1 Settings section, configure the IKE phase-1 parameters and click OK.
Proposal
Exchange
Mode
Negotiation
Mode
Local ID Type
Select the proposal for IKE negotiation phase 1 to specify the encryption algorithm,
authentication algorithm and DH group. Up to four proposals can be selected.
Specify the IKE Exchange Mode as Main Mode or Aggressive Mode. By default, it is
Main Mode.
Main Mode: Main mode provides identity protection and exchanges more information,
which applies to scenarios with higher requirements for identity protection.
Aggressive Mode: Aggressive Mode establishes a faster connection but with lower
security, which applies to scenarios with lower requirements for identity protection.
Specify the IKE Negotiation Mode as Initiator Mode or Responder Mode. Initiator Mode
means that the local device initiates a connection to the peer. Responder Mode means
that the local device waits for the connection request initiated by the peer. You can
keep this parameter as default.
Specify the local ID type for IKE negotiation.
IP Address: Use an IP address as the ID in IKE negotiation. It is the default type.
NAME: Use a name as the ID in IKE negotiation. It refers to FQDN (Fully Qualified
Domain Name).
IPSec VPN Configuration
Configuration Guide 129