NETGEAR FVS318N Reference Manual page 205

ProSafe Wireless-N 8-Port Gigabit VPN Firewall FVS318N
Table 50. Add IKE Policy screen settings for a Mode Config configuration (continued)
Setting Description
IKE SA Parameters
Note: Generally, the default settings work well for a Mode Config configuration.
Encryption Algorithm To negotiate the security association (SA), from the drop-down list, select the
3DES algorithm.
Authentication From the drop-down list, select the SHA-1 algorithm to be used in the VPN header
Algorithm for the authentication process.
Authentication Method Select Pre-shared key as the authentication method, and enter a key in the
Pre-shared key field.
Pre-shared key
Diffie-Hellman (DH) The DH Group sets the strength of the algorithm in bits. From the drop-down list,
Group select Group 2 (1024 bit).
SA-Lifetime (sec) The period in seconds for which the IKE SA is valid. When the period times out, the
next rekeying occurs. The default setting is 28800 seconds (8 hours). However, for
a Mode Config configuration, NETGEAR recommends 3600 seconds (1 hour).
Enable Dead Peer Select a radio button to specify whether or not Dead Peer Detection (DPD) is
Detection enabled:
• Yes. This feature is enabled. When the wireless VPN firewall detects an IKE
connection failure, it deletes the IPSec and IKE SA and forces a reestablishment
Note: See also of the connection. You need to specify the detection period in the Detection
Configure Period field and the maximum number of times that the wireless VPN firewall
Keep-Alives and attempts to reconnect in the Reconnect after failure count field.
Dead Peer Detection
• No. This feature is disabled. This is the default setting.
on page 215.
Detection Period
Reconnect after
failure count
Virtual Private Networking Using IPv4 IPSec and L2TP Connections
A key with a minimum length of 8 characters and no more than
49 characters. Do not use a double quote (") in the key. This
example uses H8!spsf3#JYK2!.
The period in seconds between consecutive
DPD R-U-THERE messages, which are sent only when the
IPSec traffic is idle. The default setting is 10 seconds. This
example uses 30 seconds.
The maximum number of DPD failures before the wireless
VPN firewall tears down the connection and then attempts to
reconnect to the peer. The default setting is 3 failures.
205