D-Link NetDefendOS User Manual page 725

Chapter 9: VPN
Maximum number of certificates/CRLs that can be held in the internal certificate cache. When the
certificate cache is full, entries will be removed according to an LRU (Least Recently Used)
algorithm.
Default: 1024
IPsec Gateway Name Cache Time
Length of time in milliseconds to keep an IPsec tunnel open when the remote DNS name fails to
resolve.
Default: 14400
General Settings (IKEv2 only)
Enable Accounting
When enabled, NetDefendOS will generate a RADIUS START accounting message for clients
which successfully authenticate using EAP. When the connection is taken down, a RADIUS STOP
message is sent.
Default: Disabled
Include Framed IP
When enabled, NetDefendOS will include the client's IP address within the RADIUS accounting
messages generated.
Note that when an EAP authenticating client is behind a NAT device that changes the client's
apparent IP address, it will not be possible to send the true IP address to the RADIUS server.
Default: Disabled
XCBC Fallback
When enabled, NetDefendOS will fallback to using XCBC (RFC 3664) if XCBC (RFC 4344) fails
during EAP authentication.
AES-XCBC-MAC is a method of generating the message authentication code (MAC) used in IKEv2
negotiations. RFC 3664 states that only key lengths of 128 bits are supported for AES-XCBC-MAC.
This is a problem with EAP since EAP authentication uses session keys of at least 512 bits. To
solve this, using only the first 128 bits of a 512 bits EAP key has become a de-facto standard for
RFC 3664.
RFC 4434 supersedes RFC 3664 and specifies a different method of adapting keys longer than
128 bits. Although RFC 4434 should theoretically be backward compatible with RFC 3664, these
different methods of adapting the key to 128 bits are not compatible in practice. This advanced
setting provides a way to fallback to using the older RFC 3664 method should authentication
using RFC 4434 fail.
If the setting is disabled then only the newer method of RFC 4434 is used and if that method fails
then authentication will fail. The disadvantage of having this setting enabled is the greater
amount of computing time needed to try both the RFC 4434 and RFC 3664 method.
725