Figure 142 Building Block > Component Bb > Add > Vpn1.0; Table 112 Building Block > Component Bb > Add > Vpn1.0 - ZyXEL Communications Vantage CNM User Manual

Figure 142 Building Block > Component BB > Add > VPN1.0
The following table describes the fields in this screen
Table 112 Building Block > Component BB > Add > VPN1.0
TYPE
Phase 1
Negotiation Mode
Pre-Shared key
Encryption Algorithm
Authentication Algorithm
SA Life Time (Seconds)
Chapter 18 Building Blocks (BBs)
DESCRIPTION
There are two phases to every IKE (Internet Key Exchange) negotiation –
phase 1 (Authentication) and phase 2 (Key Exchange). A phase 1
exchange establishes an IKE SA and the second one uses that SA to
negotiate SAs for IPSec.
Select either Main or Aggressive. Aggressive mode is quicker than Main
mode because it eliminates several steps when the communicating parties
are negotiating authentication (phase 1). However the trade-off is that
faster speed limits its negotiating power and it also does not provide
identity protection. It is useful in remote access situations where the
address of the initiator is not know by the responder and both parties want
to use pre-shared key authentication.
A pre-shared key identifies a communicating party during a phase 1 IKE
negotiation. It is called pre-shared because you have to share it with
another party before you can communicate with them over a secure
connection. ZyXEL gateways authenticate an IKE VPN session by
matching pre-shared keys. Enter from 8 up to 31 characters. Any
character may be used, including spaces, but trailing spaces are
truncated. Multiple SAs connecting through a secure gateway must have
the same pre-shared key.
Select an encryption algorithm from the pull-down menu. You can select
either DES or 3DES. 3DES is more powerful but increases latency.
The Authentication Algorithms, HMAC-MD5 (RFC 2403) and HMAC-SHA-
1 (RFC 2404, provide an authentication mechanism for the AH and ESP
protocols. Select MD5 for minimal security and SHA-1 for maximum
security. MD5 (Message Digest 5) produces a 128-bit digest to
authenticate packet data. SHA-1 (Secure Hash Algorithm) produces a
160-bit digest to authenticate packet data.
Define the length of time before an IKE Security Association automatically
renegotiates in this field. It may range from 60 to 3,000,000 seconds
(almost 35 days).
A short SA Life Time increases security by forcing the two VPN gateways
to update the encryption and authentication keys. However, every time the
VPN tunnel renegotiates, all users accessing remote resources are
temporarily disconnected.
Vantage CNM User's Guide
270