HoB HOBLink, Administration Manual

Page: 44 / 83

Configuring HOBLink VPN Gateway HOBLink VPN Gateway
44 Security Solutions by HOB
Use the arrow buttons to manage the order in which the IKE schemes appear in this
list. The entry fields for the
List of IKEv1 Schemes interface are as follows:
Name – enter the name of the scheme you are adding to your network. This is a
required field.
Description – enter a description of the scheme to help identification and
management of the scheme.
Mode – select the mode for the IKE scheme. The supported modes are
Main
(default) and
Aggressive
.
Authentication mode – select the mode for authentication. The supported modes
are
None
(default),
HYBRID
and
XAUTH
.
Initiator Identification Type – select the identification type. The supported types
are
IP address
(INETA),
Fully qualified domain name
(FQDN) and
Fully
qualified username
(USER_FQDN). Default is
IP address
.
Encryption – select the type of encryption you wish to use from the list of those
available in the list on the left by using the horizontal arrow buttons. You can then
use the vertical arrow buttons to manage the list of encryption types that have
already been selected. Supported types are
AES128
,
AES192
,
AES256
,
3DES
,
BLOWFISH448
and
CAST128
.
Hash – select the type of hash functions you wish to use from the list of those
available in the list on the left by using the horizontal arrow buttons. You can then
use the vertical arrow buttons to manage the list of hash functions types that have
already been selected. Supported functions are
SHA1
and
MD5
.
Gateway authentication – select the type of gateway authentication methods you
wish to use from the list of those available in the list on the left by using the
horizontal arrow buttons. You can then use the vertical arrow buttons to manage the
list of gateway authentication methods that have already been selected. Supported
methods are
RSA
,
DSA
and
Pre-shared key
.
Diffie-Hellmann group – select the type of Diffie-Hellmann groups you wish to use
from the list of those available in the list on the left by using the horizontal arrow
buttons. You can then use the vertical arrow buttons to manage the list of
Diffie-Hellmann groups that have already been selected. The supported groups are
MODP768
,
MODP1024
,
MODP1536
,
MODP2048
,
MODP3072v MODP4096
,
MODP6144
,
MODP8192
,
EC2NGF163
,
EC2NGF283
,
EC2NGF409 and
EC2NGF571
.
IKE SA lifetime (seconds) – enter the desired lifetime for the IKE security
association (SA). The range is between
300-2419200
seconds, the default is
604800 seconds
.
UDP timeout – enter the UDP timeout in seconds. The value should be between
1-600
,
10
is the default timeout.
UDP retries – enter the number of UDP retries permitted. The value should be
between
0-20
,
2
is the default value.
Note: when a
DSA
certificate is used as the Gateway Authentication
method, the use of
SHA1
is required.