Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 611 / 861

610 Field descriptions
Policy field descriptions
Encapsulation mode Select the encapsulation mode:
■
Tunnel mode
This is the default.
■
Transport mode
You should only select transport mode when both tunnel endpoints are the same as
their gateway addresses. In that case, using transport mode saves bandwidth.
Data volume limit
(KB) Maximum number of kilobytes allowed through the tunnel before it is rekeyed.
The default is 2100000 KB. The maximum acceptable value is 4200000. The minimum
acceptable value is 1 KB.
Lifetime timeout
(minutes) Number of minutes that a tunnel is allowed to exist before it is rekeyed.
The default is 480 minutes (8 hours). The maximum acceptable value is 2,147,483,647. The
minimum acceptable value is 3 minutes.
Inactivity timeout
(minutes) Number of minutes a tunnel can remain inactive (no data passing through it) before it is re-
keyed.
The default is 0 (no timeout value). The maximum acceptable value is 2,147,483,647.
Apply firewall rules. Passes VPN traffic to firewall proxies.
Checking this check box sends the data packet up the protocol stack for authorization. The
packets are then subject to all the address transforms and rule checking performed by the
proxies. This check box is unchecked by default.
Perfect forward
secrecy To enable perfect forward secrecy, check Perfect forward secrecy.
Perfect forward secrecy lets administrators set up parameters for generating keys and
prevents attackers from guessing successive keys. This check box is checked by default.
If Perfect forward secrecy is enabled, you must also specify a Diffie-Hellman preference.
Diffie-Hellman is the standard IKE method of establishing shared secret. Group 1 and 2 are
the Diffie-Hellman group numbers available for establishing these IKE session keys. Group
1 is 768 bits long and group 2 is 1024 bits long. Using group 2 is more secure but it also uses
more CPU power. Using a combination of groups, 1 then 2 or 2 then 1, indicates that first
one group is tried; if that is unsuccessful, the next group is tried. This, however, is not a
recommended configuration.
IDS/IPS policy name Select the IDS/IPS policy to apply as part of the VPN policy.
Table D-44
IPsec IKE policy Properties—General tab (Continued)
Field Description