Nortel BSR222, Configuration, Page: 251 / 451

Chapter 13 VPN 251
Nortel Business Secure Router 222 Configuration — Basics
Encryption Select the combinations of protocol and encryption and
authentication algorithms that the Business Secure Router is to
use for the phase 2 VPN connections (VPN tunnels) with Contivity
VPN clients.
The ESP (Encapsulation Security Payload) protocol (RFC 2406)
uses encryption as well as the services offered by AH.
The AH (Authentication Header Protocol) protocol (RFC 2402)
was designed for integrity, authentication, sequence integrity
(replay resistance), and nonrepudiation but not for confidentiality,
for which the ESP was designed. It does not use encryption.
When you use one of the encryption algorithms for data
communications, both the sending device and the receiving
device must use the same secret key, which can be used to
encrypt and decrypt the message or to generate and verify a
message authentication code.
The DES encryption algorithm uses a 56-bit key.
Triple DES is a variation on DES that uses a 168-bit key. Triple
DES is more secure than DES. It also requires more processing
power, resulting in increased latency and decreased throughput.
You can select a 128-bit key implementation of AES. AES is
faster than 3DES.
SHA1 (Secure Hash Algorithm) and MD5 (Message Digest 5) are
hash algorithms used to authenticate packet data. SHA1
algorithm is generally considered stronger than MD5, but is
slower.
IKE Encryption and
Diffie-Hellman Group Select the combinations of encryption algorithm and
Diffie-Hellman key group that the Business Secure Router is to
use for phase 1 IKE setup with Contivity VPN clients.
The DES encryption algorithm uses a 56-bit key.
Triple DES is a variation on DES that uses a 168-bit key. Triple
DES is more secure than DES. It also requires more processing
power, resulting in increased latency and decreased throughput.
You can select a 128-bit key implementation of AES. AES is
faster than 3DES.
Diffie-Hellman (DH) is a public-key cryptography protocol that is
used within IKE SA setup to establish session keys. The larger
the Diffie-Hellman Group, the higher the security.
Diffie-Hellman Group 1 uses a 768-bit random number.
Diffie-Hellman Group 2 uses a 1 024-bit (1Kb) random number.
Diffie-Hellman Group 5 uses a 1 536-bit random number.
Assignment of Client
IP Select Use Static Addresses if the Contivity VPN clients are
using static IP addresses. You must specify these in the remote
user profiles.
Table 62 VPN Client Termination
Label Description