communications mechanism for data and IP information that is transmitted between networks. A VPN can
also be used over an existing network, such as the Internet, to facilitate the secure transfer of sensitive data
across public networks.
VPNs can also provide flexible solutions, such as securing communications between remote telecommuters
and the organizations, regardless of where the telecommuters are located. A VPN can even be established
within a single network to protect sensitive communications from other parties on the same network.
The next sections cover the IPSec Profiles, Site-to-Site and Client-to Site.
IPSec Profiles
The IPSec profile is the central configuration in IPSec that defines most of the IPSec parameters such as the
protocol (Encapsulation Security Payload, Authentication Header), mode (tunnel, transport), algorithms
(encryption, integrity, Diffie-Hellman), perfect forward secrecy (PFS), SA lifetime, and key management
protocol (IKEv1, IKEv2).
The IPSec profiles contain information related to the algorithms such as encryption, authentication, and DH
group for Phase I and II negotiations in auto mode. These profiles also contain keys for corresponding
algorithms in case keying mode is manual.
To configure the IPSec Profiles, follow these steps:
Step 1
Select
VPN > IPSec VPN > IPSec Profiles
.
Step 2
In the IPSec Profiles table, click
Add
.
Step 3
Enter a profile name and select the keying mode.
Step 4
For auto keying mode, select the IKE Version.
Step 5
In the Phase 1 Options section, configure the following:
DH is a key exchange protocol, with two groups of different prime key lengths, 1,024
bits and 1,536 bits. Select an option from the drop-down list.
Diffie-Hellman (DH) Group
Select an encryption option (
3DES, AES-128, AES-192, or AES-256
) from the
drop-down list. This method determines the algorithm used to encrypt or decrypt
ESP/ISAKMP packets.
Encryption
The authentication method determines how the Encapsulating Security Payload Protocol
(ESP) header packets are validated. The MD5 is a one-way hashing algorithm that
produces a 128-bit digest. The SHA1 is a one-way hashing algorithm that produces a
160-bit digest. The SHA1 is recommended because it is more secure. Make sure that
both ends of the VPN tunnel use the same authentication method. Select an
authentication (
MD5, SHA1, or SHA2-256
).
Authentication
Amount of time an IKE SA is active in this phase. (Range 120 to 86400, Default 28800).
SA Lifetime
Step 6
In the Phase 2 Options section, configure the following:
Select a protocol from the drop-down list.
•
ESP
: Select ESP for data encryption and enter the encryption.
•
AH
: Select this for data integrity in situations where data is not secret but must
be authenticated.
Protocol Selection
RV260x Administration Guide
92
VPN
IPSec Profiles
Summary of Contents for RV260 series
Page 8: ...RV260x Administration Guide viii Contents ...
Page 18: ...RV260x Administration Guide 10 Getting Started User Interface ...
Page 30: ...RV260x Administration Guide 22 Status and Statistics Captive Portal Status ...
Page 38: ...RV260x Administration Guide 30 Administration Copy Save Configuration ...
Page 54: ...RV260x Administration Guide 46 System Configuration Registering Devices ...
Page 80: ...RV260x Administration Guide 72 Wireless Lobby Ambassador ...
Page 84: ...RV260x Administration Guide 76 Routing IGMP Proxy ...
Page 96: ...RV260x Administration Guide 88 Firewall DMZ Host ...
Page 122: ...RV260x Administration Guide 114 QoS Switch Queuing ...
Page 124: ...RV260x Administration Guide 116 Where To Go Where To Go From Here ...
