Nortel BSR252, Configuration - Basics

Page: 244 / 460

244 Chapter 13 VPN
NN47923-500
Multiple Proposal Select this check box to allow the Business Secure Router to use any
of its phase 2 encryption and authentication algorithms when
negotiating an IPSec SA.
Clear this check box to have the Business Secure Router use only the
phase 2 encryption and authentication algorithms when negotiating an
IPSec SA.
Active Protocol Select ESP or AH from the drop-down list. The Business Secure
Router's IPSec Protocol must be identical to the remote IPSec router.
The ESP (Encapsulation Security Payload) protocol (RFC 2406)
provides encryption as well as the authentication offered by AH. If you
select ESP here, you must select options from the Encryption
Algorithm and Authentication Algorithm fields. The AH protocol
(Authentication Header Protocol) (RFC 2402) was designed for
integrity, authentication, sequence integrity (replay resistance), and
nonrepudiation, but not for confidentiality, for which the ESP was
designed. If you select AH here, you must select options from the
Authentication Algorithm field.
Encryption
Algorithm
Select DES , 3DES , AES or NULL from the drop-down list.
When you use one of these encryption algorithms for data
communications, both the sending device and the receiving device
must use the same secret key, which can be used to encrypt and
decrypt the message or to generate and verify a message
authentication code. The DES encryption algorithm uses a 56-bit key.
Triple DES ( 3DES ) is a variation on DES that uses a 168-bit key. As a
result, 3DES is more secure than DES . It also requires more
processing power, resulting in increased latency and decreased
throughput. You can select a 128-bit, 192-bit, or 256-bit key with this
implementation of AES . AES is faster than 3DES .
Select NULL to set up a tunnel without encryption. When you select
NULL , you do not enter an encryption key.
Authentication
Algorithm
Select SHA1 or MD5 from the drop-down list. MD5 (Message Digest
5) and SHA1 (Secure Hash Algorithm) are hash algorithms used to
authenticate packet data. The SHA1 algorithm is generally considered
stronger than MD5, but is slower. Select MD5 for minimal security and
SHA-1 for maximum security.
SA Life Time Define the length of time before an IKE SA automatically renegotiates
in this field. It can range from 60 to 3 000 000 seconds (almost 35
days). A short SA life time increases security by forcing the two IPSec
routers to update the encryption and authentication keys. However,
every time the VPN tunnel renegotiates, all users accessing remote
resources are temporarily disconnected.
Encapsulation Select Tunnel mode or Transport mode from the drop-down list. The
Business Secure Router's encapsulation mode must be identical to
the remote IPSec router. Tunnel is compatible with NAT, Transport is
not.
Table 57 VPN Branch Office Advanced Rule Setup
Label Description