NetModule NB3711, User Manual

Page: 102 / 214

NB3711 User Manual 4.0
Parameter IPsec Proposal Settings
Encryption algorithm The desired IKE encryption method (we recommend
AES256)
Authentication algo-
rithm
The desired IKE authentication method (we prefer SHA1
over MD5)
SA life time The lifetime of Security Associations
Perfect forward secrecy
(PFS) Specifies whether Perfect Forward Secrecy (PFS) should be
used. This feature increases security as PFS avoids pene-
tration of the key-exchange protocol and prevents compro-
misation of previous keys.
Force encapsulation Force UDP encapsulation for ESP packets even if no NAT
situation is detected.
Networks
When creating Security Associations, IPsec will keep track of routed networks within
the tunnel. Packets will be only transmitted when a valid SA with matching source and
destination network is present. Therefore, you may need to specify the networks right
and left of the endpoints by applying the following settings:
Parameter IPsec Network Settings
Local network address The address of your local area network
Local network mask The netmask of your local area network
Peer network address The address of the remote network behind the peer
Peer network mask The netmask of the remote network behind the peer
NAT address Optionally, you can apply NAT (masquerading) for packets
coming from a different local network. The NAT address
must reside in the network previously specified as local net-
work.
Client Management
Once you have successfully set up an IPsec tunnel, you can manage and enable clients
connecting to your service. It is possible to generate and download expert mode files for
enabled clients which can be used to easily populate each client.
102