Ike Setup; Figure 29-8 Two Phases To Set Up The Ipsec Sa - ZyXEL Communications 10 User Manual

29.5 IKE Setup

To edit this menu, the Key Management field Menu 27.1.1 – IPSec Setup must be set to IKE. Move the
cursor to the Edit Key Management Setup field in Menu 27.1.1 – IPSec Setup; press [SPACE BAR] to
select Yes and then press [ENTER] to display Menu 27.1.1.1 – IKE Setup.
29.5.1 IKE Phases
There are two phases to every IKE (Internet Key Exchange) negotiation – phase 1 (Authentication) and phase
2 (Key Exchange). A phase 1 exchange establishes an IKE SA and the second one uses that SA to negotiate
SAs for IPSec.
In phase 1 you must:
Choose a negotiation mode.
Authenticate the connection by entering a pre-shared key.
Choose an encryption algorithm.
Choose an authentication algorithm.
Choose a Diffie-Hellman public-key cryptography key group (DH1 or DH2).
Set the IKE SA lifetime. This field allows you to determine how long an IKE SA should stay up
before it times out. An IKE SA times out when the IKE SA lifetime period expires. If an IKE
SA times out when an IPSec SA is already established, the IPSec SA stays connected.
In phase 2 you must:
Choose which protocol to use (ESP or AH) for the IKE key exchange.
Choose an encryption algorithm.
Choose an authentication algorithm
Choose whether to enable Perfect Forward Secrecy (PFS) using Diffie-Hellman public-key
cryptography – see section 29.5.5. Select None (the default) to disable PFS.
Choose Tunnel mode or Transport mode.
VPN/IPSec Setup

Figure 29-8 Two Phases to Set Up the IPSec SA

ZyWALL 10~100 Series Internet Security Gateway
29-17