ZyXEL NBG420N Manuel d'utilisateur télécharger pdf (Page 179)

Chapter 15 IPSec VPN

NBG420N User’s Guide

179

15.2.3 VPN Rule Setup (Manual)

Use this screen to configure VPN rules (tunnels) that use manual keys. Manual key

management is useful if you have problems with IKE key management.

Select Manual in the IPSec Keying Mode field on the Rule Setup screen to open the screen

as shown in Figure 108 on page 180.

15.2.3.1 IPSec SA Using Manual Keys

You might set up an IPSec SA using manual keys when you want to establish a VPN tunnel

quickly, for example, for troubleshooting. You should only do this as a temporary solution,

however, because it is not as secure as a regular IPSec SA.

In IPSec SAs using manual keys, the NBG420N and remote IPSec router do not establish an

IKE SA. They only establish an IPSec SA. As a result, an IPSec SA using manual keys has

some characteristics of IKE SA and some characteristics of IPSec SA. There are also some

differences between IPSec SA using manual keys and other types of SA.

15.2.3.2 IPSec SA Proposal Using Manual Keys

In IPSec SA using manual keys, you can only specify one encryption algorithm and one

authentication algorithm. There is no DH key exchange, so you have to provide the encryption

key and the authentication key the NBG420N and remote IPSec router use.

Note: The NBG420N and remote IPSec router must use the same encryption key and

authentication key.

Authentication

Algorithm

Select which hash algorithm to use to authenticate packet data in the IPSec SA.

Choices are SHA1 and MD5. SHA1 is generally considered stronger than MD5,

but it is also slower.

SA Life Time Define the length of time before an IPSec SA automatically renegotiates in this

field. The minimum value is 180 seconds.

A short SA Life Time increases security by forcing the two VPN gateways to

update the encryption and authentication keys. However, every time the VPN

tunnel renegotiates, all users accessing remote resources are temporarily

disconnected.

Perfect Forward

Secrecy (PFS)

Select whether or not you want to enable Perfect Forward Secrecy (PFS) and, if

you do, which Diffie-Hellman key group to use for encryption. Choices are:

None - disable PFS

DH1 - enable PFS and use a 768-bit random number

DH2 - enable PFS and use a 1024-bit random number

PFS changes the root key that is used to generate encryption keys for each

IPSec SA. It is more secure but takes more time.

Basic... Click Basic... to go to the previous VPN configuration screen.

Apply Click Apply to save the changes.

Reset Click Reset to begin configuring this screen afresh.

Cancel Click Cancel to exit the screen without making any changes.

Table 64 Security > VPN > Rule Setup: IKE (Advanced) (continued)

LABEL DESCRIPTION

1 2 ... 174 175 176 177 178 179 180 181 182 183 184 ... 339 340

Commentaires sur ces manuels

Pas de commentaire

ZyXEL NBG420N Manuel d'utilisateur Page 179

Commentaires sur ces manuels

Produits connexes et manuels pour Routeurs ZyXEL NBG420N