48
address) as your remote side security gateway.
Security Level
•
Encryption Method
– It specifies the encryption mechanism
to use. Data encryption makes the data unreadable if
intercepted. There are three encryption method available;
DES/3DES and AES. The default is null.
•
Authentication
– It specifies the packets authentication
mechanism to use. Packets authentication confirms that data
comes from the source you think it comes from. There are
three authentications available. MD5, SHA1 and SHA2.
Key
Management
•
Key Type
– There are two key types (manual key and auto
key) available for the key exchange management.
•
Manual Key
– If manual key is selected, no key negotiation
is needed. Encryption Key- This field specifies a key to
encrypt and decrypt IP traffic. Authentication Key – This field
specifies a key use to authentication IP traffic.
Inbound/outbound SPI (Security Parameter Index) – is
carried on the ESP header. Each tunnel must have a unique
inbound and outbound SPI, and no two tunnels share the
same SPI. Notice that Inbound SPI must match the other
router’s outbound SPI.
•
AutoKey (IKE)
– There are two types of operation modes
can be used.
1.
Main mode
accomplishes a phase one IKE exchange
establishing a secure channel.
2.
Aggressive Mode
is another way of accomplishing a
phase one exchange. It is faster and simpler than main
mode, but does not provide identity protection for the
negotiating nodes.
•
Perfect Forward Secrecy
(PFS) – If PFS is enabled, IKE
phase 2 negotiation will generate a new key material for IP
traffic encryption & authentication. Preshared Key – This
field is to authenticate the remote IKE peer.
•
Key Lifetime
- This is specified the lifetime of the IKE
generated Key. If the time expires or data is passed over this
volume, a new key will be renegotiated. By default, 0 is for no
