108
6620-3201
4.46 Confi gure
>
IPSec
>
IKEv2
>
IKEv2 n
When IKE Version 2 is supported, it is possible to specify whether the IKEv1 or IKEv2 protocol should
be used to negotiate IKE SA’s. By default, IKEv1 is used and units which have been upgraded from
IKEv1 to IKEv2 will not require any changes to their con
fi
guration to continue working with IKEv1.
Using the Web Page(s)
Encryption algorithm:
This parameter selects the encryption algorithm to be used for IKE exchanges over the IP connection.
You can select “DES”, “3DES”, “AES” or leave the option blank (in which case key exchanges will not
be attempted).
Encryption key length (AES only):
When the Initiator encryption algorithm is set to “AES”, this parameter may be used to select the key
length as 128 (default), 192 or 256 bits.
Authentication algorithm:
This parameter selects the algorithm used to verify that the contents of data packets have not been
changed in transit since they were sent. You may select none (i.e. blank), “MD5” or “SHA-1”. If the
parameter is left blank negotiations will not be attempted.
PRF algorithm:
This parameter selects the pseudo random function to negotiate and can be selected from “MD5” or
“SHA1”.
MODP group:
This is the DH group number to negotiate. Larger values result in “stronger” keys but take longer to
generate.
Duration (s):
This parameter determines how long (in seconds) the initial IKEv2 Security Association will stay
in force. When it expires any attempt to send packets to the remote system will result in IKEv2
attempting to establish a new SA. Enter a value between 1 and 28800 seconds (8 hours).
Re-key time (s):
When the time left until expiry for this SA reaches the value speci
fi
ed by this parameter, the IKEv2 SA
will be renegotiated, i.e. a new IKEv2 SA is negotiated and the old SA is removed. Any IPSec “child”
SA’s that were created are retained and become “children” of the new SA.
Maximum re-transmits:
This parameter speci
fi
es the maximum number of times that IKEv2 will retransmit a negotiation frame
as part of the exchange before failing.
Re-transmit interval (s):
This parameter speci
fi
es the amount of time in seconds that IKEv2 will wait for a response from the
remote system before retransmitting the negotiation frame.
Inactivity timeout (s):
This parameter speci
fi
es the period of time in seconds after which when no response to a negotiation
packet has been received from the remote IKEv2 will give up.
NAT traversal enabled:
When set to “On”, this parameter enables support for NAT traversal within IKEv2/IPSec. When one
end of an IPSec tunnel is behind a NAT box, some form of NAT traversal may be required before
the IPSec tunnel can pass packets. Turning NAT traversal on enables the IKE protocol to discover
whether or not one or both ends of a tunnel is behind a NAT box, and implements a standard NAT
traversal protocol if NAT is being performed.
The version of NAT traversal supported is that described in the IETF draft “draft-ietf-ipsec-nat-t-ike 03.
txt”.
