7
IPsec VPN
128
Pre-shared keys
Pre
‐
shared
Keys
(PSK)
are
one
of
the
methods
used
to
authenticate
VPN
tunnels.
The
other
method
is
certificates.
PSKs
are
secrets
that
are
shared
by
the
communicating
parties
before
communication
takes
place.
To
communicate,
both
parties
prove
that
they
know
the
secret.
The
security
of
a
shared
secret
depends
on
how
“good”
a
passphrase
is.
Passphrases
that
are
common
words
are
extremely
vulnerable
to
dictionary
attacks.
A
PSK
can
be
specified
as
either
a
hexadecimal
or
ASCII
value.
The
longer
the
value
used
for
the
PSK,
the
better
the
security.
Example: Adding an ASCII PSK
This
example
creates
a
PSK
object
based
on
an
ASCII
string.
The
object
can
then
be
used
for
authentication
with,
for
example,
VPN
tunnels.
Device:/>
add
PSK
my_psk
Type=ASCII
PSKAscii="mypasswordstring"
Caution:
Different
encodings
on
different
platforms
can
cause
problems
with
non
‐
ASCII
characters
in
a
non
‐
hexadecimal
PSK.
For
example,
Microsoft
Windows
encodes
PSKs
containing
non
‐
ASCII
characters
in
UTF
‐
16
while
the
SEG
uses
UTF
‐
8.
Even
though
the
same
PSK
appears
to
be
used
at
either
end
of
the
tunnel,
there
can
be
a
mismatch
because
two
platforms
are
encoding
differently.
For
example,
this
can
cause
problems
when
setting
up
a
Windows
L2TP
client
that
connects
to
the
SEG.
Certificates
The
SEG
supports
digital
certificates
that
comply
with
the
ITU
‐
T
X.509
standard.
This
involves
the
use
of
an
X.509
certificate
hierarchy
with
public
‐
key
cryptography
to
accomplish
key
distribution
and
entity
authentication.
References
in
this
manual
to
a
certificate
means
a
X.509
certificate
.
A
certificate
is
a
digital
proof
of
identity.
It
links
an
identity
to
a
public
key
in
order
to
establish
whether
a
public
key
truly
belongs
to
the
supposed
owner.
By
doing
this,
it
prevents
data
transfer
interception
by
a
malicious
third
‐
party
who
might
post
a
fake
key
with
the
name
and
user
ID
of
an
intended
recipient.
The
main
usage
of
certificates
in
the
SEG
is
to
provide
VPN
tunnel
security.
Certificates and PSKs
The
simplest
and
fastest
way
to
provide
security
between
the
ends
of
a
tunnel
is
to
use
Pre
‐
shared
Keys
(PSKs).
However,
as
a
VPN
network
grows
so
does
the
complexity
of
using
PSKs.
Certificates
provide
a
means
to
better
manage
security
in
much
larger
networks.
