Cradlepoint COR IBR350 Manual page 111

• In Main mode, IKE separates the key information from the identities, allowing for the identities of peers to be secure at the expense of extra
packet exchanges.
• In Aggressive mode, IKE tries to combine as much information into fewer packets while maintaining security. Aggressive mode is slightly
faster but less secure.
Because it has better security, Main mode is recommended for most users.
Key Lifetime: The lifetime of the generated keys of Phase 1 of the IPsec negotiation from IKE. After the time has expired, IKE will renegotiate a
new set of Phase 1 keys.
Encryption, Hash, and DH Groups Each IKE exchange uses one encryption algorithm, one hash function, and one DH group to make a secure
exchange.
Encryption: Used to encrypt messages sent and received by IPsec.
• AES 128
• AES 256
• DES
• 3DES
Hash: Used to compare, authenticate, and validate that data across the VPN arrives in its intended form and to derive keys used by IPSec.
• MD5
• SHA1
• SHA2 256
• SHA2 384
• SHA2 512
Note that some Encryption/Hash combinations (e.g., 3DES with SHA2 384/512) are computationally expensive, impacting WAN performance. AES
is as strong an encryption and performs much better than 3DES.
DH Groups: The DH (Diffie-Hellman) Group is a property of IKE and is used to determine the length of prime numbers associated with key generation.
The strength of the key generated is partially determined by the strength of the DH Group. Group 5, for instance, has greater strength than Group
2.
• Group 1: 768-bit key
• Group 2: 1024-bit key
• Group 5: 1536-bit key
In IKE Phase 1 you can only select one DH group if you are using Aggressive exchange mode.
By default, all the algorithms (encryption, hash, and DH groups) supported by the device are checked, which means they are allowed for any given
exchange. Deselect these options to limit which algorithms will be accepted. Be sure to check that the router (or similar device) at the other end
of the tunnel has matching algorithms.
The algorithms are listed in order by priority. You can reorder this priority list by clicking and dragging algorithms up or down. Any selected algorithm
may be used for IKE exchange, but the algorithms on the top of the list are more likely to be used more often.
111