Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 385 / 861

384 Providing remote access using VPN tunnels
Understanding VPN policies
Related information
For further information related to this topic, see the following:
■
“IPsec static key policy Properties—General tab” on page 614
■
“IPsec static key policy Properties—Data Integrity Preferences tab” on page 617
■
“Configuring tunnels” on page 385
Viewing or modifying the global IKE policy
The security gateway includes a predefined global IKE policy that applies to all Internet Security
Association and Key Management Protocol (ISAKMP/Oakley) secure tunnels. This global IKE policy
works in conjunction with the IPsec/IKE VPN policy you configure, functioning as Phase 1 negotiations
for your IKE tunnel. The IPsec/IKE policy you configure in the VPN Tunnels window functions as the
Phase 2 negotiations.
You can only have one global IKE policy, but you can change the values of the default policy at any
time.
Prerequisites
None.
To view or modify the global IKE policy
1 In the SGMI, on the Tools menu, click VPN > Global IKE Policy .
2 In the Secure Tunnel IKE Policy Properties dialog box, on the General tab, in the Policy name text
box, the name of the global IKE policy is displayed. This default name cannot be changed.
3 In the Connection timeout text box, type an interval, in minutes, for connection timeout.
4 On the Data Privacy Preference tab, select the preference from the Available list box and click the
right-arrow
>> button to move it to the Selected list box.
The options are:
■
DES
■
Triple DES
If multiple selections are made in the Selected list box, they are used in the order they appear. You
can change their order by selecting an entry and clicking
Up or Down .
5 On the Data Integrity Preference tab, in the Available list box, select the preference, and then click
the right-arrow
>> button to move it to the Selected list box.
The options are:
■
MD5 (message digest)
■
SHA1 (secure hash algorithm)
6 On the Diffie-Hellman Groups tab, in the Available list box, select the group, and then click the
right-arrow >> button to move it to the Selected list box.
Diffie-Hellman is the standard IKE method of establishing shared secrets. The options are:
■
Group 1 (768-bit key)
■
Group 2 (1024-bit key)
Group 2 is more secure but uses more CPU power.
7
Click OK .
8 Optionally, do one of the following:
■
To save your configuration now and activate later, on the toolbar, click Save .
■
To activate your configuration now, on the toolbar, click Activate .
When prompted to save your changes, click Yes .