Manual Key; Security Parameter Index (Spi) - ZyXEL Communications P-334WT User Manual

P-334WT User's Guide
Table 71 Advanced Rule Setup (continued)
LABEL
IPSec Protocol
Encryption Algorithm
Authentication
Algorithm
SA Life Time
Perfect Forward
Secrecy (PFS)
Basic...
Apply
Reset

12.13 Manual Key

Manual key management is useful if you have problems with IKE key management.

12.13.1 Security Parameter Index (SPI)

An SPI is used to distinguish different SAs terminating at the same destination and using the
same IPSec protocol. This data allows for the multiplexing of SAs to a single gateway. The
SPI (Security Parameter Index) along with a destination IP address uniquely identify a
particular Security Association (SA). The SPI is transmitted from the remote VPN gateway to
the local VPN gateway. The local VPN gateway then uses the network, encryption and key
values that the administrator associated with the SPI to establish the tunnel.
182
DESCRIPTION
Select ESP or AH from the drop-down list box. The Prestige's IPSec Protocol
should be identical to the secure remote gateway. The ESP (Encapsulation
Security Payload) protocol (RFC 2406) provides encryption as well as the
authentication offered by AH. If you select ESP here, you must select options
from the Encryption Algorithm and Authentication Algorithm fields (described
below). The AH protocol (Authentication Header Protocol) (RFC 2402) was
designed for integrity, authentication, sequence integrity (replay resistance),
and non-repudiation but not for confidentiality, for which the ESP was
designed. If you select AH here, you must select options from the
Authentication Algorithm field.
The encryption algorithm for the Prestige and the secure remote gateway
should be identical. When DES is used for data communications, both sender
and receiver must know the same secret key, which can be used to encrypt
and decrypt the message. The DES encryption algorithm uses a 56-bit key.
Triple DES (3DES) is a variation on DES that uses a 168-bit key. As a result,
3DES is more secure than DES. It also requires more processing power,
resulting in increased latency and decreased throughput.
Select SHA1 or MD5 from the drop-down list box. MD5 (Message Digest 5)
and SHA1 (Secure Hash Algorithm) are hash algorithms used to authenticate
packet data. The SHA1 algorithm is generally considered stronger than MD5,
but is slower. Select MD5 for minimal security and SHA-1 for maximum
security.
Define the length of time before an IKE SA automatically renegotiates in this
field. It may range from 60 to 3,000,000 seconds (almost 35 days). A short SA
Life Time increases security by forcing the two VPN gateways to update the
encryption and authentication keys. However, every time the VPN tunnel
renegotiates, all users accessing remote resources are temporarily
disconnected.
Perfect Forward Secrecy (PFS) is disabled (None) by default in phase 2 IPSec
SA setup. This allows faster IPSec setup, but is not so secure. Choose from
DH1 or DH2 to enable PFS. DH1 refers to Diffie-Hellman Group 1, a 768 bit
random number. DH2 refers to Diffie-Hellman Group 2, a 1024 bit (1Kb)
random number (more secure, yet slower).
Select Basic... to go to the previous VPN configuration screen.
Click Apply to save your changes.
Click Reset to begin configuring this screen afresh.
Chapter 12 VPN Screens