McAfee SG310, Administration Manual

Page: 288 / 412

288 McAfee UTM Firewall 4.0.4 Administration Guide
VPN menu features
IPsec example
Step 2: Complete the Tunnel settings page
1
Enter a description of the tunnel in the Tunnel name field. The name must not contain spaces or start
or end with a number. In this example, enter: Branch_Office.
2
Leave the Enable this tunnel checkbox selected.
3
Select the Internet interface the IPSec tunnel is to go out on. In this example, select default gateway
interface option.
4
Select the type of keying for the tunnel to use. In this example, select the Aggressive mode (IKE)
option.
5
Select the type of IPSec endpoint this UTM Firewall appliance has. In this example, select the static IP
address option in the Local address list.
6
Select the type of IPSec endpoint the remote party has. In this example, select the dynamic IP address
option in the Remote address list.
7
Click Next to configure the Local Endpoint Settings.
Step 3: Local endpoint settings page
1
Leave the Optional Endpoint ID field blank in this example. It is optional because this UTM Firewall
appliance has a static IP address. If the remote party is a UTM Firewall appliance and an Endpoint ID is
used, it must have the form abcd@efgh. If the remote party is not a UTM Firewall appliance, refer to the
interoperability documents in the KnowledgeBase (
mysupport.mcafee.com )to determine what form it
must take.
2
Leave the Enable IP Payload Compression checkbox unselected.
3
Leave the Enable Phase 1 & 2 rekeying to be initiated from my end checkbox selected.
4
Click Next to configure the Remote Endpoint Settings.
Step 4: Remote endpoint settings page
1
Enter the Required Endpoint ID of the remote party. In this example, enter the Local Endpoint ID at
the Branch Office which was: branch@office.
2
Click Next to configure the Phase 1 Settings.
Step 5: Phase 1 settings page
1
Set the length of time before Phase 1 is renegotiated in the Key lifetime field. In this example, leave the
Key Lifetime as the default value of 3600 minutes.
2
Set the time for when the new key is negotiated before the current key expires in the Rekeymargin field.
In this example, leave the Rekeymargin as the default value of 600 seconds.
3
Set the maximum percentage by which the Rekeymargin should be randomly increased to randomize
rekeying intervals in the Rekeyfuzz field. The Key lifetimes for both Phase 1 and Phase 2 are dependent
on these values and must be greater that the value of “Rekeymargin x (100 + Rekeyfuzz) / 100.”
In this example, leave the Rekeyfuzz as the default value of 100%.
4
Enter a secret in the Preshared Secret field. This must remain confidential. In this example, enter the
Preshared Secret used at the branch office UTM Firewall appliance, which was: This secret must be
kept confidential.
5
Select a Phase 1 Proposal. In this example, select the 3DES-SHA-Diffie Hellman Group 2 (1024
bit) option (same as the Branch Office Phase 1 Proposal).
6
Click Next to configure the Phase 2 Settings.