InHand InGateway501, User Manual, Page: 108 / 204

InGateway Documentation, Release 0.0.1
– Remote ID: specifies the peer ID of the specified type.
– IKE Keepalive (DPD): enables or disables dead peer detection (DPD).
* DPD Timeout: specifies the timeout period of a DPD probe. After the receiving end triggers
a DPD probe by sending a DPD request to the peer, it waits for a DPD response. If no
IPsec-encrypted packet is received from the peer, it deletes the ISAKMP profile. The valid
value range is 10-3600, and the unit is second.
* DPD Interval: specifies the IPsec neighbor detection interval. After DPD is enabled, the
receiving end can trigger a DPD probe if it does not receive any IPsec-encrypted packets
from the peer within the DPD interval. In this case, the receiving end sends a DPD request
to check whether the IKE peer is available. The valid value range is 10-3600, and the unit
is second.
– IPsec Advance (Phase 2)
* PFS: enables or disables Perfect Forward Secrecy (PFS), a feature that ensures security of
other keys when a key is encrypted, because these keys are not derived from one another.
The key used in phase-2 IPsec negotiation is derived from the key generated in phase 1. If
the phase -1 key for IKE negotiation is intercepted by an attacker, the attacker may collect
sufficient information to derive the phase-2 key for IPsec SA negotiation. The PFS feature
prevents this problem by performing an additional DH exchange, ensuring security of the
phase-2 key.
* IPsec SA Lifetime: specifies the duration in which the IPsec SA is alive. When the two ends
perform IPsec negotiation to establish an SA, the smaller value between the lifetime values
set on the local and peer devices takes effect.
Note:
• Encryption algorithms used for IPsec are AES, 3DES, and DES, listed in descending order of security.
The encryption algorithms with higher security are more complex and slower in calculation. Therefore,
the DES algorithm can be used to meet ordinary security requirements.
• When the IG902 acts as an IPsec server, set the remote address to 0.0.0.0. Generally, this setting is
used when one end uses a public IP address and the other end uses a variable address for dial-up.
• IPsec extensions are often combined with GRE to establish a DMVP or GRE over IPsec network.
4.4.2 GRE
Generic Routing Encapsulation (GRE) is a protocol that encapsulates packets of any network-layer protocol
with another network-layer protocol. GRE can be used as a Layer 3 tunneling protocol to provide a trans-
parent transmission channel for VPN data. To put it simply, GRE is a tunneling technology that provides
a channel to transmit encapsulated data packets. Data packets are encapsulated on one end of the tunnel
and decapsulated on the other end.The GRE parameters are described as follows:
104 Chapter 1. InGateway Documentation Site Navigation