Pre-Shared Keys; Identification Lists; Using A Pre-Shared Key - D-Link NetDefend DFL-210 User Manual

9.2.3. Pre-shared Keys

Then, apply the proposal list to the IPsec tunnel:
1. Go to Interfaces > IPsec
2. In the grid control, click the target IPsec tunnel
3. Select the recently created esp-l2tptunnel in the IPsec Algorithms control.
4. Click OK
9.2.3. Pre-shared Keys
Pre-Shared Keys are used to authenticate VPN tunnels. The keys are secrets that are shared by the
communicating parties before communication takes place. To communicate, both parties prove that
they know the secret. The security of a shared secret depends on how "good" a passphrase is. Pass-
phrases that are common words are for instance extremely vulnerable to dictionary attacks.
Example 9.2. Using a Pre-Shared key
This example shows how to create a Pre-shared Key and apply it to a VPN tunnel. Since regular words and
phrases are vulnerable to dictionary attacks, they should not be used as secrets. Here the pre-shared key is a
randomly generated hexadecimal key. Note that this example does not illustrate how to add the specific IPsec
tunnel object.
CLI
First create a Pre-shared Key:
gw-world:/> add PSK MyPSK Type=HEX PSKHex=<enter the key here>
Then, apply the Pre-shared Key to the IPsec tunnel:
gw-world:/> set Interface IPsecTunnel MyIPsecTunnel PSK=MyPSK
Web Interface
First create a Pre-shared Key:
1. Go to Objects > Authentication Objects > Add > Pre-shared key
2. Enter a name for the pre-shared key eg. MyPSK
3. Choose Hexadecimal Key and click Generate Random Key to generate a key to the Passphrase textbox.
4. Click OK
Then, apply the pre-shared key to the IPsec tunnel:
1. Go to Interfaces > IPsec
2. In the grid control, click the target IPsec tunnel object
3. Under the Authentication tab, choose Pre-shared Key and select MyPSK
4. Click OK

9.2.4. Identification Lists

When X.509 certificates are used as authentication method for IPsec tunnels, the D-Link Firewall
will accept all remote firewalls or VPN clients that are capable of presenting a certificate signed by
any of the trusted Certificate Authorities. This can be a potential problem, especially when using
Chapter 9. Virtual Private Networks
193