Cisco QuickVPN - PC Administration Manual page 68

Setting Up and Configuring the Router
VPN
Cisco RVS4000 4-Port Gigabit Security Router with VPN Administration Guide
Remote Security Group Type
gateway who can use this VPN tunnel. This may be a single IP address or a Sub-
network. Note that the Remote Security Group Type must match the other router's
Local Security Group Type.
IP Address Enter the IP address on the remote network.
Subnet Mask If the Remote Security Group Type is set to Subnet, enter the mask
to determine the IP addresses on the remote network.
IPSec Setup
Keying Mode The router supports both automatic and manual key management.
When choosing automatic key management, IKE (Internet Key Exchange)
protocols are used to negotiate key material for SA (Security Association). If
manual key management is selected, no key negotiation is needed. Basically,
manual key management is used in small static environments or for
troubleshooting purposes. Note that both sides must use the same Key
Management method.
Phase 1
•
Encryption The Encryption method determines the length of the key used
to encrypt/decrypt ESP packets. Only 3DES is supported. Notice that both
sides must use the same Encryption method.
•
Authentication
ESP packets. Either MD5 or SHA1 may be selected. Notice that both sides
(VPN endpoints) must use the same Authentication method.
•
MD5 A one-way hashing algorithm that produces a 128-bit digest.
•
SHA1 A one-way hashing algorithm that produces a 160-bit digest.
•
Group The Diffie-Hellman (DH) group to be used for key exchange. Select
the 768-bit (Group 1), 1024-bit (Group 2), or 1536-bit (Group 5) algorithm.
Group 5 provides the most security, Group 1 the least.
•
Key Life Time
time expires, a new key will be renegotiated automatically. Enter a value
from 300 to 100,000,000 seconds. The default is 28800 seconds.
Phase 2
•
Encryption The Encryption method determines the length of the key used
to encrypt/decrypt ESP packets. Only 3DES is supported. Note that both
sides must use the same Encryption method.
Select the remote LAN user(s) behind the remote
Authentication determines a method to authenticate the
This specifies the lifetime of the IKE-generated key. If the
5
61