114
6620-3201
ESP encryption algorithm:
This parameter speci
fi
es the cryptographic algorithm to be used when securing the packet payload.
You may select none (blank), “DES”, “3-DES” or “RIJN” (AES).
ESP encrypt key length (bits):
This parameter is only used when
ESP encryption algorithm
is set
to “AES”. The default value of 0 indicates that a key length of 128 bits is used. Other options are 192
and 256.
IPCOMP algorithm:
This parameter determines whether data compression is used. When set to
“Off”, data is not compressed. When set to “DEFLATE”, data compression is applied to the data
being carried. The effectiveness of data compression will vary with the type of data but a typical
ratio achieved for a mix of data, for instance Web pages, spread sheets, databases, text
fi
les, GIFs,
etc. would be between 2 and 3:1. This has the effect of increasing the connection throughput. If the
data is traversing a network where charges are based on the amount of data passed (such as many
GPRS networks), it may also offer signi
fi
cant cost savings. Note however that if the data is already
compressed, such as .zip or .jpg
fi
les, then the system will detect that the data cannot be compressed
further and send it un-compressed.
Note:
Data compression is an optional feature that may not appear on your product unless you have
purchased it as a separate feature pack.
IPSec MODP group:
This parameter is used to specify the DH group to use when negotiating new IPSec SA’s. When used,
the IPSec SA keys cannot be predicted from any of the previous keys generated. It can be set to No
PFS, 1, 2 or 3. Larger values result in “stronger” keys but they take longer to generate.
IP protocol:
This parameter acts as a
fi
lter. When set to “UDP” the unit will allow only UDP packets to cross the
Eroute. When set to “TCP” only TCP packets will pass and when set to “Off”, all packet types may
pass.
Duration (s):
This parameter speci
fi
es the length of time in seconds for which a phase 2 Eroute SA can remain
valid. When this period has expired the unit will initiate a new phase 2 key exchange to re-validate the
other end of the connection. A value of 0 means that the default time of 28800 seconds is used.
Duration (kb):
As an alternative to negotiating new keys based on duration of connection, the “lifetime” of a session
may be set based on the amount of data transferred. This parameter is used to specify the validity of
an SA in terms of the maximum amount of data (in kb) that may be transmitted before a new phase 2
key exchange will be initiated. A value of 0 means that the default value of 32Mb is used.
No SA action:
This parameter determines how the router will respond if it receives a request to route a packet that
matches an Eroute de
fi
nition (i.e. source address, destination address, protocol etc. match) but for
which no SA’s exist. When set to “Use IKE”, it will try to initiate an IKE session to establish SA’s.
When set to “Drop Packet” it will discard the packet. When set to “Pass Packet” it will allow the packet
through without authentication or encryption.
