Wieland wienet v3, User Manual

Page: 51 / 95

Contents of Package
Wieland Electric GmbH | BA001039 (Rev. A) | 08/2016
52
Item Description
ESP Algorithm Way of algorithm selection:
•
auto – encryption and hash alg. are selected automatically
•
manual – encryption and hash alg. are defined by the user
ESP Encryption Encryption algorithm – DES, 3DES, AES128, AES192, AES256
ESP Hash Hash algorithm – MD5, SHA1, SHA256, SHA384 or SHA512
PFS Ensures that derived session keys are not compromised if one of the
private keys is compromised in the future
PFS DH Group Diffie-Hellman group number (see
IKE DH Group
)
Key Lifetime Lifetime key data part of tunnel. The minimum value of this parameter
is 60 s. The maximum value is 86400 s.
IKE Lifetime Lifetime key service part of tunnel. The minimum value of this parame-
ter is 60 s. The maximum value is 86400 s.
Rekey Margin Specifies how long before connection expiry should attempt to negoti-
ate a replacement begin. Maximum value must be less than half of IKE
and Key Lifetime parameters.
Rekey Fuzz Percentage extension of Rekay Margin time
DPD Delay Time after which the IPsec tunnel functionality is tested
DPD Timeout The period during which device waits for a response
Authenticate Mode Using this parameter can be set authentication:
•
Pre-shared key – sets the shared key for both sides of the tunnel
•
X.509 Certificate – allows X.509 authentication in multiclient mode
Pre-shared Key Shared key for both sides for Pre-shared key authentication
CA Certificate Certificate for X.509 authentication
Remote Certificate Certificate for X.509 authentication
Local Certificate Certificate for X.509 authentication
Local Private Key Private key for X.509 authentication
Local Passphrase Passphrase for X.509 authentication
Extra Options Use this parameter to define additional parameters of the IPsec tunnel,
for example secure parameters etc.
IPsec tunnel configuration
IPsec supports the following types of identifiers (ID) of both tunnel sides ( Remote ID and Local ID items):
•
IP address (e.g. 192.168.1.1)
•
DN (e.g. D=DE,W=Wieland,OU=TP,CN=A)
•
FQDN (e.g. @director.wieland.com) – in front of FQDN must always be @
•
User FQDN (e.g. director@wieland.com)
Note!
The certificates and private keys have to be in PEM format. As certificate it is possible to use
only certificate which has start and stop tag certificate.
Note!
Random time, the new keys are re-exchanged after, is defined this way:
Lifetime - (Rekey random value in range (from 0 to Rekey margin * Rekey Fuzz/100))
By default, the repeated exchange of keys held in the time range:
•
Minimal time: 1h - (9m + 9m) = 42m
•
Maximal time: 1h - (9m + 0m) = 51m
When setting the times for key exchange is recommended to leave the default setting in
which tunnel has guaranteed security. When set higher time, tunnel has smaller operating costs and
smaller the safety. Conversely, reducing the time, tunnel has higher operating costs and higher safety of
the tunnel.
NOTE
NOTE