Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 382 / 861

381 Providing remote access using VPN tunnels
Understanding VPN policies
3
In the IPsec IKE policy Properties dialog box, on the General tab, do the following:
4 On the Data Privacy Preference tab, in the Available list box, select a data privacy preference, and
then click the right-arrow
>> button to move it to the Selected list box. The options are:
■
DES
■
Triple DES
■
AES with 16-byte key
■
AES with 24-byte key
■
AES with 32-byte key
■
No Encryption
If multiple selections are made in the Selected list box, they are used in the order they appear. You
can change their order by selecting an entry and clicking
Up or Down .
5 On the Data Integrity Preference tab, in the Available list box, select a data integrity preference,
and then click the right-arrow
>> button to move it to the Selected list box.
This dictates the type of authentication header that is prepended to packets sent through the
tunnel. Supported types are:
■
SHA1 (slower but more secure than MD5)
■
MD5 (faster but less secure than SHA1)
■
No Checksum (specifies no authentication checksum)
If multiple selections are made in the Selected list box, they are used in the order they appear. You
can change their order by selecting an entry and clicking
Up or Down .
Name Type a unique name for the VPN policy.
Caption Type a brief description of the VPN policy.
Filter applied In the Filter applied drop-down list, select whether you want a filter applied as part of
the VPN policy.
Data integrity
protocol In the Data integrity protocol drop-down list, select one of the following data integrity
protocols:
■
To apply the algorithm to the data portion of the packet, select Apply integrity
preference to data portion of the packet (ESP).
■
To apply the algorithm to the entity packet, select Apply integrity preference to
entity packet (AH).
Encapsulation mode In the Encapsulation mode drop-down list, select either Tunnel mode or Transport
mode.
Data volume limit
(KB) Type the maximum number of kilobytes allowed through the tunnel before it is rekeyed.
Lifetime timeout
(minutes) Type the number of minutes that a tunnel is allowed to exist before it is rekeyed.
Inactivity timeout
(minutes) Type the number of minutes a tunnel can remain inactive (no data passing through it)
before it is re-keyed.
Apply firewall rules To pass tunnel traffic to the firewall proxies, check Apply firewall rules .
Perfect forward
secrecy To enable perfect forward secrecy, check Perfect forward secrecy .