UTT Technologies
Chapter 10 VPN
http://www.uttglobal.com
Page
19919919
IKE phase 1 negotiation.
A phase 1 proposal consists of an encryption algorithm, an authentication algorithm, and a
DH group; and there are five encryption algorithms, two authentication algorithms and
three DH groups to choose. Therefore, there are thirty (5 × 3 × 2 = 30) phase 1 proposals
supported. For example, the phase 1 proposal “3des-md5-group2” means that the
encryption algorithm is 3DES, the authentication algorithm is md5, and the DH group is
DH group 2.
In the Web UI, the UTT VPN gateway provides four phase 1 proposals by default;
therefore, you need not configure phase 1 proposals in some cases. In addition, it allows
you to configure phase 1 proposals as required. You can choose up to four phase 1
proposals in the Web UI, and twelve phase 1 proposals in the CLI.
A phase 2 proposal consists of one or two IPSec security protocols (either ESP or AH, or
both), and algorithms used with the selected security protocol. ESP protects data with an
encryption algorithm and/or an authentication algorithm, and AH protects data with an
authentication algorithm. Therefore, there are fifty-three (6 × 3 × 3 - 1 = 53) phase 2
proposals supported. The details are as follows:
1. There are five phase 2 proposals for using ESP encryption only.
For example, the proposal “esp-des” means ESP encryption with DES algorithm.
2. There are two phase 2 proposals for using ESP authentication only.
For example, the proposal “esp-md5” means ESP authentication with MD5 algorithm.
3. There are two phase 2 proposals for using AH authentication only.
For example, the proposal “ah-sha” means AH authentication with SHA algorithm.
4. There are ten (5 × 2 = 10) phase 2 proposals for using ESP encryption and ESP
authentication.
For example, the proposal “esp-aes128-sha” means ESP encryption with AES128
algorithm and ESP authentication with SHA algorithm.
5. There are ten (5 × 2 = 10) phase 2 proposals for using ESP encryption and AH
authentication.
For example, the proposal “esp-aes192-ah-md5” means ESP encryption with
AES192 algorithm and AH authentication with MD5 algorithm.
6. There are four (2 × 2 = 4) phase 2 proposals for using ESP authentication and AH
authentication.
For example, the proposal “esp-md5-ah-sha” means ESP authentication with MD5
algorithm and AH authentication with SHA algorithm.
7. There are twenty (5 × 2 × 2 = 20) phase 2 proposals for using ESP encryption, ESP
authentication and AH authentication.
For example, the proposal “esp-aes256-sha-ah-md5” means ESP encryption with
