InHand InGateway502, User Manual

Page: 94 / 107

90
o
IKE Advance (Phase 1)
▪
Local ID: specifies the type of the local device’s identifier for IKE negotiation.
•
IP Address: specifies the peer IP address used to establish the IPsec interface.
•
FQDN: specifies the character string used as the identifier of the local device.
•
User FQDN: specifies the fully qualified domain name used as the identifier of
the local device.
▪
Remote ID: specifies the type of the peer device’s identifier for IKE negotiation.
•
IP Address: specifies the interface IP address that the local device uses to
complete IKE negotiation and exchange identity information with the peer
device.
•
FQDN: specifies the identifier string that the peer devices used for IKE
negotiation. The value must be the same as that set on the peer device.
•
User FQDN: specifies the fully qualified domain name used as the identifier of
the peer device. The value must be the same as that set on the peer device.
▪
IKE Keepalive (DPD): enables or disables dead peer detection (DPD).
•
DPD Timeout: specifies the timeout period of a DPD probe. After the receiving
end triggers a DPD probe by sending a DPD request to the peer, it waits for a
DPD response. If no DPD response is received from the peer, it deletes the
IPsec SA. The valid value range is 10-3600, and the unit is second.
•
DPD Interval: specifies the IPsec neighbor detection interval. After DPD is
enabled, the receiving end can trigger a DPD probe if it does not receive any
IPsec-encrypted packets from the peer within the DPD interval. In this case,
the receiving end sends a DPD request to check whether the IKE peer is
available. The valid value range is 10-3600, and the unit is second.
▪
XAUTH: specifies the XAUTH user name and password.
o
IPsec Advance (Phase 2)
▪
PFS: enables or disables Perfect Forward Secrecy (PFS), a feature that
ensures security of other keys when a key is encrypted, because these keys
are not derived from one another. The key used in phase-2 IPsec negotiation is
derived from the key generated in phase 1. If the phase -1 key for IKE
negotiation is intercepted by an attacker, the attacker may collect sufficient
information to derive the phase-2 key for IPsec SA negotiation. The PFS
feature prevents this problem by performing an additional DH exchange,
ensuring security of the phase-2 key.