Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 380 / 861

379 Providing remote access using VPN tunnels
Understanding VPN policies
■
Encapsulation Security Payloads (ESP) provide confidentiality to IP datagrams as well as the ability
to authenticate data.
■
Security Parameter Indices (SPI) are part of, and defined by, the AH and ESP. The SPIs are included
in the packet header and let the receiver identify the tunnel to which the packet belongs.
The encapsulation protocol you select determines the rest of the information you must enter for your
policy. You can create more than one policy for each encapsulation protocol (referred to as the Data
Integrity Protocol in the Security Gateway Management Interface (SGMI)), varying the components
you select for each one. If you do this, be sure that your naming conventions let you distinguish
between varying policies. When you are ready to create your secure tunnels, specific naming
conventions make selecting the correct VPN policy in the VPN tunnel properties dialog box easier.
You can use the preconfigured policies for all of your VPN tunnels, or you can create several policies
using different IPsec encapsulation configurations to suit your varied needs.
Understanding tunnel negotiation
To ensure secure communication for IPsec, the IKE protocol, a combination of the Internet Security
Association Key Management Protocol (ISAKMP) and Oakley Key Determination protocol, performs a
two-phase negotiation. The two phases are Phase 1 (or Main Mode) and Phase 2 (or Quick Mode).
The Phase 1 negotiation establishes a secure channel called the security association (SA) between two
computers. The SA is used to protect the security negotiations. Phase 1 negotiation determines a
specific set of cryptographic protocols, exchanges shared secret keys, and authenticates computer IDs.
The Phase 2 negotiation establishes a secure channel between two computers to protect data. During
Phase 2 negotiation, the protocol security association for the tunnel is established. Either computer
can initiate Phase 1 or Phase 2 renegotiation at any time. Both can specify intervals after which to
negotiate.
Using pre-configured VPN policies
You can use the pre-configured VPN policies in Table 10-1 or you can create your own policies:
■
ike_default_crypto (IPsec/IKE with DES, MD5, No compression, Group 1)
■
ike_default_crypto_strong (IPsec/IKE with Triple DES, SHA1, No compression, Group 2)
■
ike_aes_crypto_strong (IPsec/IKE with AES 32-byte key, SHA1, No compression, Group 2)
■
ike_sample_crypto_interop (IPsec/IKE with DES/Triple DES, SHA1/MD5, No compression, Group
2/Group 1)
Table 10-1 Pre-configured VPN policies
Policy name Data privacy Data integrity Data compression Diffie-Hellman
ike_default_crypto DES MD5 No compression Group 1
ike_default_crypto_strong Triple DES SHA1 No compression Group 2
ike_aes_crypto_strong AES (32-byte key) SHA1 No compression Group 2
ike_sample_crypto_interop DES/Triple DES SHA1/MD5 No compression Group 2/Group 1
static_default_crypto DES MD5 N/A N/A
static_default_crypto_strong Triple DES SHA1 N/A N/A
static_aes_crypto_strong AES (32-byte key) SHA1 N/A N/A