Digi Connect WAN Series User Manual page 66

Digi Connect WAN Family web interface
ISAKMP Phase 1 Settings:
n
General Security Settings for Phase 1
l
Connection Mode: Main|Aggressive: Set the connection mode to match that configured
on the remote VPN device. If aggressive mode is selected, then the VPN device will try
aggressive mode first, and then try main mode if aggressive mode fails.
Enable Perfect Forward Secrecy (PFS): Set this option to enable PFS. PFS guarantees that
if one key is broken by an attacker, that does not help him to break another key. PFS is
more secure, but slows down the negotiation process. Both the Digi device and the remote
VPN device must be configured the same way.
NAT-T Settings
l
Enable NAT Traversal (NAT-T): Set this option if there is a NAT firewall between the two
VPN devices.
Keep Alive Interval: The amount of time in seconds between NAT keep alive messages.
Once a connection is established through a firewall, the VPN devices have to send keep
alive messages to prevent the NAT firewall from timing out the connection. Set the interval
to a value less than the connection timeout of the NAT firewall.
ISAKMP Phase 1 Policies:
l
Keys are negotiated in two phases. The first phase negotiates the keys and authentication
method used to establish the initial ISAKMP connection. During this phase, the two VPN
devices verify each other's identity and create a security association (encrypted
connection). Phase 2 uses the encrypted connection. The encryption and authentication
settings you specify determine the level of security in the connection the two VPN devices
used to communicate with each other.
Select the policies to use during phase 1 of the ISAKMP negotiation. Ensure that the Digi
device and the remote VPN device use the same policies. If more than one policy is
specified, the VPN devices will use the most secure policy that they both have been
configured to support.
Pre-shared Key: Using DSS and RSA signatures is more secure than using a pre-shared
key.
Encryption: The encryption type and the length of the key. The longer the key the more
secure it is.
Integrity: The authentication algorithm. The SHA1 algorithm is more secure than MD5.
SA Lifetime: The maximum length of the phase 1 security association.
Diffie-Hellman: The Diffie-Hellman group to use for key generation. The larger the group
the more secure it is.
Digi Connect WAN Family User Guide
Configuration through the web interface
66