Ike Authentication - D-Link NetDefend DFL-210 User Manual

9.3.3. IKE Authentication

PFS Group
IPsec DH Group
IPsec Encryption
IPsec Authentication
IPsec Lifetime
9.3.3. IKE Authentication
Manual Keying
The "simplest" way of configuring a VPN is by using a method called "manual keying". This is a
This specifies the PFS group to use with PFS.
The PFS groups supported by NetDefendOS are:
• 1 modp 768-bit
• 2 modp 1024-bit
• 5 modp 1536-bit
Security increases as the PFS group bits grow larger, as does
the time taken for the exchanges.
This is a Diffie-Hellman group much like the one for IKE.
However, this one is used solely for PFS.
The encryption algorithm to use on the protected traffic.
This is not needed when AH is used, or when ESP is used
without encryption.
The algorithms supported by D-Link Firewall VPNs are:
• AES
• Blowfish
• Twofish
• Cast128
• 3DES
• DES
This specifies the authentication algorithm used on the
protected traffic.
This is not used when ESP is used without authentication,
although it is not recommended to use ESP without
authentication.
The algorithms supported by D-Link Firewall VPNs are:
• SHA1
• MD5
This is the lifetime of the VPN connection. It is specified in
both time (seconds) and data amount (kilobytes). Whenever
either of these values is exceeded, a re-key will be initiated,
providing new IPsec encryption and authentication session
keys. If the VPN connection has not been used during the last
re-key period, the connection will be terminated, and
re-opened from scratch when the connection is needed again.
This value must be set lower than the IKE lifetime.
245
Chapter 9. VPN