Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 381 / 861

380 Providing remote access using VPN tunnels
Understanding VPN policies
■
static_default_crypto (IPsec/static with DES, MD5)
■
static_default_crypto_strong (IPsec/static with Triple DES, SHA1)
■
static_aes_crypto_strong (IPsec/static with AES 32-byte key, SHA1)
To use one of the pre-configured VPN policies, when running one of the VPN wizards or creating
tunnels manually, select the VPN policy from the VPN Policy drop-down list.
Creating custom VPN policies
You can create custom VPN policies for IPsec with IKE or IPsec with static key. In tunnels with static
keys, administrators at both tunnel endpoints must use the same secret keys, security parameter
indexes (SPIs), and encryption methods. In IPsec/IKE tunnels, ISAKMP dynamically negotiates keys,
establishes SPIs, negotiates transforms, and provides key expiration for greater security and
flexibility.
Configuring VPN policy for IPsec with IKE
You can configure VPN policies with IKE to support IKE VPN tunnels. In IKE tunnels, ISAKMP
dynamically negotiates with its peer ISAKMP application at the other end of the tunnel to determine
the encryption algorithm keys and authentication keys and SPIs of the IPsec protocol.
The negotiation occurs in two phases: in Phase 1, the ISAKMP application creates an ISAKMP security
association with its peer to protect Phase 2 of the negotiation which determines the protocol security
association for the tunnel.
Prerequisites
None.
To configure a VPN policy for IPsec with IKE
1 In the SGMI, in the left pane, under Policy, click VPN .
2 In the right pane, on the VPN Policies tab, click New > IPsec IKE policy .