D-Link NetDefend DFL-210 User Manual page 199

9.2.1. IPsec Basics
Main/Aggressive Mode
IPsec Protocols
IKE Encryption
remote address as the remote gateway. This is particularly
useful in cases of roaming access, where the IP addresses of
the remote VPN clients are not known beforehand. Setting
this to "none" will allow anyone coming from an IP address
conforming to the "remote network" address discussed above
to open a VPN connection, provided they can authenticate
properly.
The remote gateway is not used in transport mode.
The IKE negotiation has two modes of operation, main mode
and aggressive mode.
The difference between these two is that aggressive mode will
pass more information in fewer packets, with the benefit of
slightly faster connection establishment, at the cost of trans-
mitting the identities of the security firewalls in the clear.
When using aggressive mode, some configuration parameters,
such as Diffie-Hellman groups, and PFS, can not be negoti-
ated, resulting in a greater importance of having "compatible"
configurations on both ends.
The IPsec protocols describe how the data will be processed.
The two protocols to choose from are AH, Authentication
Header, and ESP, Encapsulating Security Payload.
ESP provides encryption, authentication, or both. However,
we do not recommend using encryption only, since it will dra-
matically decrease security.
More on ESP in ESP (Encapsulating Security Payload).
AH only provides authentication. The difference from ESP
with authentication only is that AH also authenticates parts of
the outer IP header, for instance source and destination ad-
dresses, making certain that the packet really came from who
the IP header claims it is from.
More on AH in AH (Authentication Header).
Note
D-Link Firewalls do not support AH.
This specifies the encryption algorithm used in the IKE nego-
tiation, and depending on the algorithm, the size of the en-
cryption key used.
The algorithms supported by NetDefendOS IPsec are:
• AES
• Blowfish
• Twofish
• Cast128
• 3DES
• DES
186
Chapter 9. Virtual Private Networks