Ike Authentication - D-Link NetDefendOS User Manual

As mentioned previously, Diffie-Hellman is used to establish the shared secret keys for IKE, IPsec
and PFS in NetDefendOS. The administrator configured Diffie-Hellman group number indicates to
NetDefendOS the level of security that is to be used for DH exchanges. The higher the group
number, the greater the security, but this will also increase the hardware processing resources
required.
The DH groups supported by NetDefendOS are as follows:
• DH group 1 (768-bit).
• DH group 2 (1024-bit - the default setting).
• DH group 5 (1536-bit).
• DH group 14 (2048-bit).
• DH group 15 (3072-bit).
• DH group 16 (4096-bit).
• DH group 17 (6144-bit).
• DH group 18 (8192-bit).

9.3.3. IKE Authentication

Manual Keying
The "simplest" way of configuring a VPN is by using a method called manual keying. This is a
method where IKE is not used at all; the encryption and authentication keys as well as some
other parameters are directly configured on both sides of the VPN tunnel.
Manual Keying Advantages
Since it is very straightforward it will be quite interoperable. Most interoperability problems
encountered today are in IKE. Manual keying completely bypasses IKE and sets up its own set of
IPsec SAs.
Manual Keying Disadvantages
It is an old method, which was used before IKE came into use, and is thus lacking all the
functionality of IKE. This method therefore has a number of limitations, such as having to use the
same encryption/authentication key always, no anti-replay services, and it is not very flexible.
There is also no way of assuring that the remote host/firewall really is the one it says it is.
Caution: Higher DH group numbers will consume more resources
Most hardware platforms will be able to provide sufficient processing resources for the
default DH group 2. Higher group numbers will consume progressively more resources
and this can mean that tunnel setup for the highest groups can be unacceptably long
(tens of seconds) on a slower hardware platform. It could also result in 100% processor
utilization from the tunnel setup process and a possible temporary halt of all traffic
throughput.
Note
NetDefendOS does not support manual keying.
690
Chapter 9: VPN