Digital Certificate; Preshared Key; Authentication; Encryption - Cisco VPN 3000 User Manual

Digital Certificate

This parameter specifies whether to use preshared keys or a PKI (Public Key Infrastructure) digital
identity certificate to authenticate the peer during Phase 1 IKE negotiations. See the discussion under
Administration | Certificate Management
Click the drop-down menu button and select the option. The list shows any digital certificates that have
been installed, plus:

Preshared Key

Enter a preshared key for this connection. Use a minimum of 4, a maximum of 32 alphanumeric
characters; e.g, sZ9s14ep7 . The system displays your entry in clear text. Even if you use a PKI digital
certificate, enter a key in this field.
This key becomes the password for the IPSec LAN-to-LAN group that is created, and you must enter the
same key on the peer VPN Concentrator. (This is not a manual encryption or authentication key. The
system automatically generates those session keys.)

Authentication

This parameter specifies the data, or packet, authentication algorithm. Packet authentication proves that
data comes from whom you think it comes from; it is often referred to as "data integrity" in VPN
literature. The IPSec ESP (Encapsulating Security Payload) protocol provides both encryption and
authentication.
Click the drop-down menu button and select the algorithm:

Encryption

This parameter specifies the data, or packet, encryption algorithm. Data encryption makes the data
unreadable if intercepted.
Click the drop-down menu button and select the algorithm:
VPN 3000 Concentrator Series User Guide
None (Use Preshared Keys)
negotiations. This is the default selection.
None = No data authentication.
ESP/MD5/HMAC-128 = ESP protocol using HMAC (Hashed Message Authentication Coding) with the
MD5 hash function using a 128-bit key. This is the default selection.
= ESP protocol using HMAC with the SHA-1 hash function using a 160-bit key.
ESP/SHA/HMAC-160
This selection is more secure but requires more processing overhead.
Null = Use ESP without encryption; no packet encryption.
DES-56 = Use DES encryption with a 56-bit key.
3DES-168 = Use Triple-DES encryption with a 168-bit key. This selection is the most secure and it is
the default selection.
Configuration | System | Tunneling Protocols | IPSec LAN-to-LAN | Add or Modify
.
= Use only preshared keys to authenticate the peer during Phase 1 IKE
7-13