D-Link NetDefend SOHO DFL-160, User Manual

Page: 50 / 130

and password must be specified.
Note: Fully qualified domain names
If fully qualified DNS names (FQDN) are used, for example vpn.example.com, then
the prefix dns: must be used when these are entered. For this example:
dns:vpn.example.com (a DNS server must also be configured either manually or
automatically for resolution to an IP address to succeed).
LAN-to-LAN tunnel establishment can also optionally require a username and password pair for
authentication using XAuth. This can be optionally specified.
Advanced
The advanced options provide a way to customize some of the parameters used by IPsec. This may
be necessary in certain scenarios where the DFL-160 must communicate with an IPsec peer that
expects certain conventions to be used.
The advanced options are as follows:
A. Lifetimes
B. IKE Settings
C. Perfect Forward Secrecy
D. Dead Peer Detection
E. Keep-Alive
A. Lifetimes
Both the IKE and the IPsec connections have limited lifetimes and are described both in terms of
time (seconds). These lifetimes prevent a connection from being used too long, which is desirable
from a crypto-analysis perspective.
The IPsec lifetime must be shorter than the IKE lifetime. The difference between the two must be a
minimum of 5 minutes. This allows for the IPsec connection to be re-keyed simply by performing
4.4.1. IPsec Chapter 4. The Firewall Menu
50