103
6620-3201
4.44 Confi gure
>
IPSec
>
IKE
>
IKE n
Using the Web Page(s)
Encryption algorithm:
This parameter selects the encryption algorithm to be used for IKE exchanges over the IP connection.
You can select “DES”, “3DES” or leave the option blank (in which case key exchanges will not be
encrypted).
Authentication algorithm:
This parameter selects the algorithm used to verify that the contents of data packets have not been
changed in transit since they were sent. You may select none (i.e. blank), “MD5” or “SHA-1”.
Duration (s):
This parameter determines how long (in seconds) the initial IKE Security Association will stay in force.
When it expires any attempt to send packets to the remote system will result in IKE attempting to
establish a new SA. Enter a value between 1 and 28800 seconds (8 hours).
Aggressive mode:
Historically,
fi
xed IP addresses have been used in setting up IPSec tunnels. Today it is more common,
particularly with Internet ISP’s, to dynamically allocate the user a temporary IP address as part of the
process of connecting to the Internet. In this case, the source IP address of the party trying to initiate
the tunnel is variable and cannot be pre-con
fi
gured.
In Main mode (i.e. non-aggressive), the source IP address must be known i.e. this mode can only
be used over the Internet if the ISP provides a
fi
xed IP address to the user or you are using X.509
certi
fi
cates.
Aggressive mode was developed to allow the host to identify a remote unit (initiator) from an ID
string rather than from its IP address. This means that it can be used over the Internet via an ISP that
dynamically allocates IP addresses. It also has two other noticeable differences from main mode.
Firstly, it uses fewer messages to complete the phase 1 exchange (3 compared to 5) and so will
execute a little more quickly, particularly on networks with large turn-around delays such as GPRS.
Secondly, as more information is sent unencrypted during the exchange, it is potentially less secure
than a normal mode exchange.
This parameter is used to select Main mode (“Off”) or Aggressive mode (“On”).
Note:
Main mode can be used without knowing the remote unit’s IP address when using certi
fi
cates. This is
because the ID of the remote unit (its public key) can be retrieved from the certi
fi
cate
fi
le.
Dead Peer Detection:
This parameter enables or disables Dead Peer Detection. For more details refer to the
Confi gure
>
IPSec
>
DPD
page.
IKE MODP group:
This parameter this allows you to set the key length used in the IKE Dif
fi
e-Hellman exchange to 768
bits (group 1) or 1024 bits (group 2). Normally this option is set to group 1 and this is suf
fi
cient for
normal use. For particularly sensitive applications, you can improve security by selecting group 2 to
enable a 1024 bit key length. Note however that this will slow down the process of generating the
phase 1 session keys (typically from 1-2 seconds for group 1), to 4-5 seconds.
