Phase 1 Advanced Settings - Fortinet FortiGate FortiGate-5001 Administration Manual
Fortigate 5000 series
Hide thumbs
Also See for FortiGate FortiGate-5001:
- Quick start manual (2 pages) ,
- Introduction manual (77 pages) ,
- Quick manual (37 pages)
Table of Contents
Advertisement
VPN
Phase 1 advanced settings
FortiGate-5000 series Administration Guide
Figure 128:Phase 1 advanced settings
P1 Proposal
Select the encryption and authentication algorithms that will be used to
generate keys for protecting negotiations.
Add or delete encryption and authentication algorithms as required. Select a
minimum of one and a maximum of three combinations. The remote peer
must be configured to use at least one of the proposals that you define.
You can select any of the following symmetric-key algorithms:
•
DES-Digital Encryption Standard, a 64-bit block algorithm that uses a 56-
bit key.
•
3DES-Triple-DES, in which plain text is encrypted three times by three
keys.
•
AES128-A 128-bit block algorithm that uses a 128-bit key.
•
AES192-A 128-bit block algorithm that uses a 192-bit key.
•
AES256-A 128-bit block algorithm that uses a 256-bit key.
You can select either of the following message digests to check the
authenticity of messages during phase 1 negotiations:
•
MD5-Message Digest 5, the hash algorithm developed by RSA Data
Security.
•
SHA1-Secure Hash Algorithm 1, which produces a 160-bit message
digest.
To specify a third combination, use the add button beside the fields for the
second combination.
DH Group
Select one or more Diffie-Hellman groups from DH group 1, 2, and 5.
When using aggressive mode, DH groups cannot be negotiated.
•
If both VPN peers have static IP addresses and use aggressive mode,
select a single DH group. The setting on the FortiGate unit must be
identical to the setting on the remote peer or client.
•
When the VPN peer or client has a dynamic IP address and uses
aggressive mode, select up to three DH groups on the FortiGate unit and
one DH group on the remote peer or dialup client. The setting on the
remote peer or client must be identical to one of the selections on the
FortiGate unit.
•
If the VPN peer or client employs main mode, you can select multiple DH
groups. At least one of the settings on the remote peer or client must be
identical to the selections on the FortiGate unit.
01-28008-0013-20050204
Phase 1
259
Advertisement
Table of Contents
