Add/Edit An Ike Network Policy - ZyXEL Communications VANTAGE CNM - V3.1 User Manual

Chapter 6 Device Security Settings
Table 50 Device Operation > Device Configuration > Security > VPN > VPN Rules (IKE) >
Gateway Policy Add/Edit
LABEL
Password
IKE Proposal
Negotiation Mode
Encryption Algorithm
Authentication
Algorithm
SA Life Time
(Seconds)
Key Group
Enable Multiple
Proposals
Apply
Cancel

6.3.3 Add/Edit an IKE Network Policy

In the VPN Rule (IKE) screen, click the Add icon from a gateway policy or click Edit from
an existing network policy to display the Network Policy screen.
136
DESCRIPTION
Enter the corresponding password for the above user name. The password
can be up to 31 case-sensitive ASCII characters, but spaces are not allowed.
Select Main or Aggressive from the drop-down list box. Multiple SAs
connecting through a secure gateway must have the same negotiation mode.
Select which key size and encryption algorithm to use in the IKE SA. Choices
are:
DES - a 56-bit key with the DES encryption algorithm
3DES - a 168-bit key with the DES encryption algorithm
AES128/AES192/AES256 - a 128/192/256-bit key with the AES encryption
algorithm
The selected and the remote IPSec router must use the same algorithms and
keys. Longer keys require more processing power, resulting in increased
latency and decreased throughput.
Select SHA1 or MD5 from the drop-down list box. MD5 (Message Digest 5)
and SHA1 (Secure Hash Algorithm) are hash algorithms used to authenticate
packet data. The SHA1 algorithm is generally considered stronger than MD5,
but is slower. Select MD5 for minimal security and SHA-1 for maximum
security.
Define the length of time before an IKE SA automatically renegotiates in this
field. It may range from 180 to 3,000,000 seconds (almost 35 days).
A short SA Life Time increases security by forcing the two VPN gateways to
update the encryption and authentication keys. However, every time the VPN
tunnel renegotiates, all users accessing remote resources are temporarily
disconnected.
Select which Diffie-Hellman key group (DHx) you want to use for encryption
keys. Choices are:
DH1 - use a 768-bit random number
DH2 - use a 1024-bit random number
DH5 - use a 1536-bit random number.
The longer the key, the more secure the encryption, but also the longer it
takes to encrypt and decrypt information. Both routers must use the same DH
key group.
Select this check box to allow the device to use any of its phase 1 or phase 2
encryption and authentication algorithms when negotiating an IPSec SA.
When you enable multiple proposals, the device allows the remote IPSec
router to select which encryption and authentication algorithms to use for the
VPN tunnel, even if they are less secure than the ones you configure for the
VPN rule.
Clear this check box to have the device use only the phase 1 or phase 2
encryption and authentication algorithms configured below when negotiating
an IPSec SA.
Click this to save your changes back to the device.
Click this to exit this screen without saving.
Vantage CNM User's Guide