Page 140 SonicWALL TELE3 SP Administrator’s Guide
6. Define the length of time before an IKE Security Association automatically renegotiates in
the
SA Life Time (secs)
field. The
SA Life Time
can range from 120 to 9,999,999
seconds.
Note
: A short SA Life Time increases security by forcing the two VPN gateways to update
the encryption and authentication keys. However, every time the VPN tunnel renegotiates,
users accessing remote resources are disconnected. Therefore, the default SA Life Time of
28,800 seconds (8 hours) is recommended.
7. Select
DES & SHA1
from the
Phase 1 Encryption/Authentication
menu.
8. Select the appropriate encryption algorithm from the
Phase 2
Encryption/
Authentication
menu. The SonicWALL supports the following encryption algorithms:
•
Tunnel Only (ESP NULL)
does not provide encryption or authentication, but offers
access to machines at private addresses behind NAT. It also allows unsupported services
through the SonicWALL.
•
Encrypt (ESP DES)
uses 56-bit DES to encrypt data. DES is an extremely secure
encryption method, supporting over 72 quadrillion possible encryption keys that can be
used to encrypt data.
•
Fast Encrypt (ESP ARCFour)
uses 56-bit ARCFour to encrypt data. ARCFour is a secure
encryption method, and has less impact on throughput than DES or Triple DES. This
encryption method is recommended for all but the most sensitive data.
•
Strong Encrypt (ESP 3DES)
uses 168-bit 3DES (Triple DES) to encrypt data. 3DES is
considered an almost "unbreakable" encryption method, applying three DES keys in
succession, but it significantly impacts the data throughput of the SonicWALL.
•
Strong Encrypt and Authenticate (ESP 3DES HMAC MD5)
uses 168-bit 3DES
encryption and HMAC MD5 authentication. 3DES is an extremely secure encryption
method, and HMAC MD5 authentication is used to verify integrity. This method significantly
impacts the data throughput of the SonicWALL.
•
Strong Encrypt for Checkpoint (ESP 3DES)
uses 168-bit 3DES encryption but does not
use an authentication protocol.
•
Strong Encrypt and Authenticate (ESP 3DES HMAC SHA1)
uses 168-bit 3DES
encryption and HMAC SHA1 authentication. 3DES is an extremely secure encryption
method, and HMAC SHA1 authentication is used to verify integrity. This method
significantly impacts the data throughput of the SonicWALL.
•
Encrypt for Check Point (ESP DES HMAC MD5)
uses 56-bit DES to encrypt data and
is compatible with Check Point Firewall-1. This method impacts the data throughput of the
SonicWALL.
•
Encrypt and Authenticate (ESP DES HMAC MD5)
uses 56-bit DES encryption and
HMAC MD5 authentication. This method impacts the data throughput of VPN
communications. SonicWALL VPN client software supports this method.
•
Authenticate (AH MD5)
uses AH to authenticate VPN communications and MD5 to
generate a 128-bit digest.
