Vpn Rule Setup (Manual) - ZyXEL Communications X550N - V3.60 User Manual

Table 65 Security > VPN > Rule Setup: IKE (Advanced) (continued)
LABEL
SA Life Time
Perfect Forward
Secrecy (PFS)
Basic...
Apply
Reset
Cancel

15.2.3 VPN Rule Setup (Manual)

Use this screen to configure VPN rules (tunnels) that use manual keys. Manual key
management is useful if you have problems with IKE key management.
Select Manual in the IPSec Keying Mode field on the Rule Setup screen to open the screen
as shown in
15.2.3.1 IPSec SA Using Manual Keys
You might set up an IPSec SA using manual keys when you want to establish a VPN tunnel
quickly, for example, for troubleshooting. You should only do this as a temporary solution,
however, because it is not as secure as a regular IPSec SA.
In IPSec SAs using manual keys, the X550N and remote IPSec router do not establish an IKE
SA. They only establish an IPSec SA. As a result, an IPSec SA using manual keys has some
characteristics of IKE SA and some characteristics of IPSec SA. There are also some
differences between IPSec SA using manual keys and other types of SA.
15.2.3.2 IPSec SA Proposal Using Manual Keys
In IPSec SA using manual keys, you can only specify one encryption algorithm and one
authentication algorithm. There is no DH key exchange, so you have to provide the encryption
key and the authentication key the X550N and remote IPSec router use.
Note: The X550N and remote IPSec router must use the same encryption key and
authentication key.
15.2.3.3 Authentication and the Security Parameter Index (SPI)
For authentication, the X550N and remote IPSec router use the SPI, instead of pre-shared
keys, ID type and content. The SPI is an identification number.
X550N Series User's Guide
DESCRIPTION
Define the length of time before an IPSec SA automatically renegotiates in this
field. The minimum value is 180 seconds.
A short SA Life Time increases security by forcing the two VPN gateways to
update the encryption and authentication keys. However, every time the VPN
tunnel renegotiates, all users accessing remote resources are temporarily
disconnected.
Select whether or not you want to enable Perfect Forward Secrecy (PFS) and, if
you do, which Diffie-Hellman key group to use for encryption. Choices are:
None - disable PFS
DH1 - enable PFS and use a 768-bit random number
DH2 - enable PFS and use a 1024-bit random number
PFS changes the root key that is used to generate encryption keys for each
IPSec SA. It is more secure but takes more time.
Click Basic... to go to the previous VPN configuration screen.
Click Apply to save the changes.
Click Reset to begin configuring this screen afresh.
Click Cancel to exit the screen without making any changes.
Figure 108 on page 180.
Chapter 15 IPSec VPN
179