Preconfigured Settings - Colubris Networks CN3000 Administrator's Manual

Chapter 11 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Configuration parameters - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Chapter 11
Subnet
Mask
Only sends outgoing traffic that is addressed to the specified subnet or host you specify.
All other traffic is dropped. To send all outgoing traffic to the peer, specify both the
Subnet and Mask as: 0.0.0.0
Preconfigured
The Internet Key Exchange protocol is used to negotiate IPSec security associations.
The negotiation is controlled by setting a number of different IKE options. To simplify the
settings
configuration of IPSec, the CN3000 presets some of these options, while others are
automatically defined based on the needs of the peer.
The following is a summary of the most important non-configurable IKE options:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 263 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Hash algorithm
Phase 2 encryption algorithm
Oakley group or
Diffie-Hellman
ID type and ID
Security association lifetimes
Perfect forward secrecy (PFS)
Accepts the algorithm proposed by the
peer. Supports MD5 and SHA-1.
3DES
Accepts the group proposed by the peer.
Supports groups 2 and 5.
• If you enable Preshared key for
Authentication method, the CN3000
automatically sets:
ID type = IP address
ID = IP address assigned to the Internet
port.
To establish a security association the
peer must also set its IP type to IP
address.
• If you enable X.509 certificates for
Authentication method, the CN3000
automatically sets:
ID type = DER_ASN1_DN
ID = the distinguished name included in
the local certificate. The peer however
can use any of the four formats the
CN3000 supports: IP address, fully
qualified user name, fully qualified host
name, or DER_ASN1_DN.
• Phase 1: 6 hours
• Phase 2: 1 hour
New keying material will be generated for
each IPsec security association rather
than being derived from the ISAKMP SA
keying material.