D-Link NetDefendOS, User Manual

Page: 688 / 912

This specifies the authentication algorithms used in the IKE negotiation phase.
The algorithms supported by NetDefendOS IPsec are:
• MD5
• SHA1
• SHA256
• SHA512
• AES-XCBC (IKEv2 only)
• IKE DH Group
This specifies the Diffie-Hellman group to use for the IKE exchange. The available DH groups
are discussed below in the section titled
Diffie-Hellman Groups . Raising the group number
from the default should be done with caution as more computing resources will be used for
higher group numbers and could lead to unacceptable tunnel setup times on slower
hardware platforms.
• IKE Lifetime
This is the lifetime of the IKE connection.
It is specified in time (seconds) as well as data amount (kilobytes). Whenever one of these
expires, a new phase-1 exchange will be performed. If no data was transmitted in the last
"incarnation" of the IKE connection, no new connection will be made until someone wants to
use the VPN connection again. This value must be set greater than the IPsec SA lifetime.
• PFS
With Perfect Forwarding Secrecy (PFS) disabled, initial keying material is "created" during the
key exchange in phase-1 of the IKE negotiation. In phase-2 of the IKE negotiation, encryption
and authentication session keys will be extracted from this initial keying material. By using
PFS, completely new keying material will always be created upon re-key. Should one key be
compromised, no other key can be derived using that information.
PFS can be used in two modes: the first is PFS on keys, where a new key exchange will be
performed in every phase-2 negotiation. The other type is PFS on identities, where the
identities are also protected, by deleting the phase-1 SA every time a phase-2 negotiation has
been finished, making sure no more than one phase-2 negotiation is encrypted using the
same key.
PFS is generally not needed, since it is very unlikely that any encryption or authentication
keys will be compromised.
• PFS DH Group
This specifies the Diffie-Hellman group to use with PFS. The available DH groups are
discussed below in the section titled
Diffie-Hellman Groups . Raising the group number from
the default should be done with caution as more computing resources will be used for higher
group numbers and could lead to unacceptable tunnel setup times on slower hardware
platforms.
• IPsec DH Group
This specifies the Diffie-Hellman group to use for IPsec communication. The available DH
groups are discussed below in the section titled
Diffie-Hellman Groups . Raising the group
number from the default should be done with caution as more computing resources will be
Chapter 9: VPN
688