D-Link DI-1750 Reference Manual page 377

♦ MD5 (HMAC variant)—MD5 (Message Digest 5) is a hash algorithm used to authenticate packet
data. HMAC is a variant which provides an additional level of hashing.
♦ SHA (HMAC variant)—SHA (Secure Hash Algorithm) is a hash algorithm used to authenticate
packet data. HMAC is a variant which provides an additional level of hashing
3. Terms
♦ Security association
♦ Anti-replay
♦ Perfect forward secrecy (PFS)
♦ Data authentication
8.5.2 Configuration Steps
To configure IKE, perform the tasks in the following sections. The tasks in the first three sections are
required; the remaining may be optional, depending on what parameters are configured.
♦ Ensure Access Lists Are Compatible with IKE
♦ Create IKE Policies
♦ Configure Pre-Shared Keys
♦ Clear IKE Connections (optional)
♦ Troubleshoot IKE (Optional)
For IKE configuration examples, refer to the "IKE Configuration Example" section located at the end of
this chapter.
8.5.3 Ensure Access Lists Are Compatible with IKE
IKE negotiation uses UDP on port 500. Ensure that your access lists are configured so that UDP port
500 traffic is not blocked at interfaces used by IKE and IPSec. In some cases you might need to add a
statement to your access lists to explicitly permit UDP port 500 traffic.
8.5.4 Create IKE Policies
You must create IKE policies at each peer. An IKE policy defines a combination of security parameters
to be used during the IKE negotiation.
To create an IKE policy, follow the guidelines in these sections:
♦ Why Do You Need to Create These Policies
♦ What Parameters Do You Define in a Policy
♦ How Do IKE Peers Agree upon a Matching Policy
♦ Which Value Should You Select for Each Parameter
♦ Creating Policies
♦ Additional Configuration Required for IKE Policies
1. Why Do You Need to Create These Policies
IKE negotiations must be protected, so each IKE negotiation begins by each peer agreeing on a
common (shared) IKE policy. This policy states which security parameters will be used to protect
subsequent IKE negotiations.
After the two peers agree upon a policy, the security parameters of the policy are identified by a security
association established at each peer, and these security associations apply to all subsequent IKE traffic
during the negotiation.
Model Name
- 375 -