273
14.1.2.10-B
Dynamic peer setup
Common preshared key
If there are connections to peers with a dynamic IP address, all connections
authenticated by preshared key must use the same preshared key. So it is not possible
to clearly identify the peer. Changing the preshared key requires making changes in
the configuration of all peers. Therefore we recommend that you use certificates for
authentication purpose.
To offer the expected security of a VPN connection, the preshared key should be
a rather complicated passphrase instead of a simple password. Use lowercase and
uppercase letters, digits and special characters and avoid words that can be found
in a dictionary. If these conditions are met, the recommended minimum length of the
preshared key depending on the cipher and hash algorithm are:
Encryption
Hash
Characters
3DES
MD5 / SHA1
14
AES-128
SHA2-256
22
AES-256
SHA2-512
43
IKE proposals (phase 1)
A phase 1 proposal combines a cipher with a hash algorithm and a Diffie-Hellman
group. It is used to secure the communication between two IKE servers.
If no proposals have been entered here, all proposals the SX-
GATE can deal with are accepted.
The proposals configured here are used for connections to those peers using a dynamic
IP addresses. This includes all client connections. For those peers it is not possible to
use an individual proposal, as at the beginning of a mainmode phase 1 negotiation the
peer's identity is unknown.
14.1.2.10-C
Priorities
Use this feature to determine the priority of outgoing data packets. A proportional
minimum bandwidth is assigned to each priority class. Unused bandwidth of a class
will be used by classes with lower priority.
