ZyXEL Communications Vantage CNM 2.3 User Manual page 152

Chapter 6 Device Security Settings
Table 51 Device Operation > Device Configuration > Security > VPN > VPN Rules
(IKE) > Network Policy Add/Edit (continued)
LABEL
Starting IP
Address
Ending IP
Address/Subnet
Mask
Remote Port
IPSec Proposal
Encapsulation
Mode
Active Protocol
Encryption
Algorithm
Authentication
Algorithm
SA Life Time
(Seconds)
152
DESCRIPTION
When the Address Type field is configured to Single Address, enter
a (static) IP address on the network behind the remote IPSec router.
When the Addr Type field is configured to Range Address, enter the
beginning (static) IP address, in a range of computers on the network
behind the remote IPSec router. When the Address Type field is
configured to Subnet Address, enter a (static) IP address on the
network behind the remote IPSec router.
When the Address Type field is configured to Single Address, this
field is N/A. When the Address Type field is configured to Range
Address, enter the end (static) IP address, in a range of computers
on the network behind the remote IPSec router. When the Address
Type field is configured to Subnet Address, enter a subnet mask on
the network behind the remote IPSec router.
0 is the default and signifies any port. Type a port number from 0 to
65535 in the Start and End fields. Some of the most common IP
ports are: 21, FTP; 53, DNS; 23, Telnet; 80, HTTP; 25, SMTP; 110,
POP3.
Select Tunnel mode or Transport mode.
Select the security protocols used for an SA.
Both AH and ESP increase the device's processing requirements and
communications latency (delay).
Select which key size and encryption algorithm to use in the IPSec
SA. Choices
are:
DES - a 56-bit key with the DES encryption algorithm
3DES - a 168-bit key with the DES encryption algorithm
AES128/AES192/AES256 - a 128/192/256-bit key with the AES
encryption algorithm
NULL - no encryption key or algorithm
The selected device and the remote IPSec router must use the same
algorithms and keys. Longer keys require more processing power,
resulting in increased latency and decreased throughput.
MD5 (Message Digest 5) and SHA1 (Secure Hash Algorithm) are
hash algorithms used to authenticate packet data. The SHA1
algorithm is generally considered stronger than MD5, but is slower.
Select MD5 for minimal security and SHA-1 for maximum security.
Define the length of time before an IPSec SA automatically
renegotiates in this field. The minimum value is 180 seconds.
A short SA Life Time increases security by forcing the two VPN
gateways to update the encryption and authentication keys. However,
every time the VPN tunnel renegotiates, all users accessing remote
resources are temporarily disconnected.
Vantage CNM User's Guide