Testing The Mode Config Connection; Configuring Keepalives And Dead Peer Detection - NETGEAR SRX5308 - ProSafe® Quad WAN Gigabit SSL VPN Firewall Reference Manual

9. Enter the settings as explained in
Table 5-19. Security Policy Editor: Security Policy, Mode Config Settings
Setting
Select Phase 1 Negotiation
Mode
Enable Perfect Forward
Secrecy (PFS)
Enable Replay Detection
10. Click the disk icon to save the configuration, or select File > Save from the Security Policy
Editor menu.
11. Close the VPN ProSafe VPN client.

Testing the Mode Config Connection

To test the connection:
1. Right-click the VPN client icon in the Windows toolbar and click Connect. The connection
policy you configured appears, in this example "My Connections\ModeConfigTest."
2. Click the connection. For this example, the message "Successfully connected to
MyConnections/ModeConfigTest" is displayed within 30 seconds, and the VPN client icon in
the toolbar displays "On."
3. From the client PC, ping a computer on the VPN firewall LAN.

Configuring Keepalives and Dead Peer Detection

In some cases, you might not want a VPN tunnel to be disconnected when traffic is idle, for
example, when client-server applications over the tunnel cannot tolerate the tunnel establishment
time. If you require a VPN tunnel to remain connected, you can use the keepalive and Dead Peer
Detection (DPD) features to prevent the tunnel from being disconnected and to force a
reconnection if the tunnel disconnects for any reason.
For DPD to function, the peer VPN device on the other end of the tunnel must also support DPD.
Keepalive, though less reliable than DPD, does not require any support from the peer device.
Virtual Private Networking Using IPsec Connections
ProSafe Gigabit Quad WAN SSL VPN Firewall SRX5308 Reference Manual
Table
Description (or Subfield and Description)
Select the Aggressive Mode radio button.
Select the Enable Perfect Forward Secrecy (PFS) check box. From the
drop-down list below, select Diffie-Hellman Group 2.
Leave the default setting, which is selection of the Enable Replay
Detection check box.
v1.0, April 2010
5-19.
5-55