NETGEAR UTM5EW-100NAS Appliance Reference Manual page 261

Table 7-16. Add IKE Policy Settings for a Mode Config Configuration (continued)
Item
Remote
Identifier Type
IKE SA Parameters
Note: Generally, the default settings work well for a Mode Config configuration.
Encryption Algorithm
Authentication
Algorithm
Authentication Method Select Pre-shared key as the authentication method, and enter a key in the
Diffie-Hellman (DH)
Group
SA-Lifetime (sec)
Enable Dead Peer
Detection
Note: See also
"Configuring
Keepalives and Dead
Peer Detection" on
page 7-55.
Virtual Private Networking Using IPsec Connections
ProSecure Unified Threat Management (UTM) Appliance Reference Manual
Description (or Subfield and Description)
From the pull-down menu, select FQDN.
Note: Mode Config requires that the remote end is defined by a FQDN.
Identifier
From the pull-down menu, select the 3DES algorithm to negotiate the security
association (SA).
From the pull-down menu, select the SHA-1 algorithm to be used in the VPN
header for the authentication process.
field below.
Pre-shared key
The DH Group sets the strength of the algorithm in bits. From the pull-down
menu, select Group 2 (1024 bit).
The period in seconds for which the IKE SA is valid. When the period times
out, the next rekeying must occur. The default is 28800 seconds (8 hours).
However, for a Mode Config configuration, NETGEAR recommends
3600 seconds (1 hour).
Select a radio button to specify whether or not Dead Peer Detection (DPD) is
enabled:
• Yes. This feature is enabled: when the UTM detects an IKE connection
failure, it deletes the IPsec and IKE SA and forces a reestablishment of the
connection. You must enter the detection period and the maximum number
of times that the UTM attempts to reconnect (see below).
• No. This feature is disabled. This is the default setting.
Detection Period
Reconnect after
failure count
v1.0, January 2010
Enter the FQDN for the remote end. This must be a FQDN
that is not used in any other IKE policy. In this example, we
are using utm25_remote.com.
A key with a minimum length of 8 characters no more than
49 characters. Do not use a double quote (") in the key. In
this example, we are using 12345678910.
The period in seconds between consecutive
"DPD R-U-THERE" messages, which are sent only when
the IPsec traffic is idle. The default setting is 10 seconds.
The maximum number of times that the UTM attempts to
reconnect after a DPD situation. When the maximum
number of times is exceeded, the IPsec connection is
terminated. The default setting is 3 IKE connection failures.
7-49