ZyXEL Communications ZyXEL Prestige 794M User Manual page 92

Table 47 VPN: L2TP: Create: LAN to LAN (continued)
LABEL
Active as default route Select this option to set this VPN connection as a default route.
IPSec
Authentication
Encryption
Encryption
Perfect Forward
Secrecy
Pre-shared Key
Chapter 7 VPN
DESCRIPTION
Select this option to enable IPSec security for your LT2P VPN connection.
Specify the method to authenticate data packet in this field. Choices are
None, MD5 and SHA1.
Select None to disable authentication.
Select MD5 (Message Digest 5) for minimal security and SHA1 (Secure Hash
Algorithm) for maximum security.
Specify the method to encrypt data packet in this field. Choices are NULL,
DES, 3DES, AES128, AES 192 and AES 256.
When DES is used for data communications, both sender and receiver must
know the same secret key, which can be used to encrypt and decrypt the
message or to generate and verify a message authentication code. The DES
encryption algorithm uses a 56-bit key.
Triple DES (3DES) is a variation on DES that uses a 168-bit key. As a result,
3DES is more secure than DES. It also requires more processing power,
resulting in increased latency and decreased throughput.
For this implementation, select AES 128, AES 192 or AES 256 that uses
different encryption key lengths. AES is faster than 3DES.
elect NULL to set up a tunnel without encryption. When you select NULL, you
do not enter an encryption key.
Select the encryption method from the pull-down menu. There are four
options, DES, 3DES, AES and NONE. NONE means it is a tunnel only with no
encryption. 3DES and AES are more powerful but increase latency.
• DES stands for Data Encryption Standard, it uses 56 bits as an encryption
method.
• 3DES stands for Triple Data Encryption Standard, it uses 168 (56*3) bits
as an encryption method.
• AES stands for Advanced Encryption Standards, it uses 128 bits as an
encryption method.
Perfect Forward Secret (PFS) is disabled (None) by default in phase 2 IPSec
SA setup. This allows faster IPSec setup, but is not so secure.
Specify an MODP (Modular Exponentiation Groups) mode from the drop-
down list box. Choices are MODP 768-bit (Group 1), MODP 1024-bit (Group
2) and MODP 1536-bit (Group 5). The larger the random number bits, the
higher the security ut slower.
Enter your pre-shared key in this field. A pre-shared key identifies a
communicating party during a phase 1 IKE negotiation. It is called "pre-
shared" because you have to share it with another party before you can
communicate with them over a secure connection.
Type from 8 to 31 case-sensitive ASCII characters or from 16 to 62
hexadecimal ("0-9", "A-F") characters. You must precede a hexadecimal key
with a "0x (zero x), which is not counted as part of the 16 to 62 character
range for the key. For example, in "0x0123456789ABCDEF", 0x denotes that
the key is hexadecimal and 0123456789ABCDEF is the key itself.
Note: Both ends of the VPN tunnel must use the same pre-
shared key.
You will receive a PYLD_MALFORMED (payload malformed) packet if the
same pre-shared key is not used on both ends.
Prestige 794M User's Guide
92