D-Link NetDefend DFL-210 User Manual page 337

9.3.2. Internet Key Exchange (IKE)
IPsec DH Group
IPsec Encryption
IPsec Authentication
IPsec Lifetime
Diffie-Hellman Groups
Diffie-Hellman (DH) is a cryptographic protocol that allows two parties that have no prior
knowledge of each other to establish a shared secret key over an insecure communications channel
through a series of plain text exchanges. Even though the exchanges between the parties might be
monitored by a third party, Diffie-Hellman makes it extremely difficult for the third party to
determine what the agreed shared secret key is and to decrypt data that is encrypted using the key.
Diffie-Hellman is used to establish the shared secret keys for IKE, IPsec and PFS.
The Diffie-Hellman group indicates the degree of security used for DH exchanges. The higher the
group number, the greater the security but also the processing overhead. The DH groups supported
by NetDefendOS are as follows:
• DH group 1 (768-bit)
This specifies the Diffie-Hellman group to use for IPsec
communication. The available DH groups are discussed
below in the section titled Diffie-Hellman Groups.
The encryption algorithm that will be used on the protected
IPsec traffic.
This is not needed when AH is used, or when ESP is used
without encryption.
The algorithms supported by D-Link Firewall VPNs are:
• AES
• Blowfish
• Twofish
• Cast128
• 3DES
• DES
This specifies the authentication algorithm used on the
protected traffic.
This is not used when ESP is used without authentication,
although it is not recommended to use ESP without
authentication.
The algorithms supported by D-Link Firewall VPNs are:
• SHA1
• MD5
This is the lifetime of the VPN connection. It is specified in
both time (seconds) and data amount (kilobytes). Whenever
either of these values is exceeded, a re-key will be initiated,
providing new IPsec encryption and authentication session
keys. If the VPN connection has not been used during the last
re-key period, the connection will be terminated, and
re-opened from scratch when the connection is needed again.
This value must be set lower than the IKE lifetime.
337
Chapter 9. VPN