Prestige 794M User’s Guide
Chapter 7 VPN
92
Active as default route Select this option to set this VPN connection as a default route.
IPSec
Select this option to enable IPSec security for your LT2P VPN connection.
Authentication
Specify the method to authenticate data packet in this field. Choices are
None
,
MD5
and
SHA1
.
Select
None
to disable authentication.
Select
MD5
(Message Digest 5)
for minimal security and
SHA1
(Secure Hash
Algorithm) for maximum security.
Encryption
Specify the method to encrypt data packet in this field. Choices are
NULL
,
DES
,
3DES
,
AES128
,
AES 192
and
AES 256
.
When
DES
is used for data communications, both sender and receiver must
know the same secret key, which can be used to encrypt and decrypt the
message or to generate and verify a message authentication code. The DES
encryption algorithm uses a 56-bit key.
Triple DES (
3DES
) is a variation on DES that uses a 168-bit key. As a result,
3DES
is more secure than
DES
. It also requires more processing power,
resulting in increased latency and decreased throughput.
For this implementation, select
AES 128
,
AES 192
or
AES 256
that uses
different encryption key lengths.
AES
is faster than
3DES
.
elect
NULL
to set up a tunnel without encryption. When you select
NULL
, you
do not enter an encryption key.
Encryption
Select the encryption method from the pull-down menu. There are four
options,
DES
,
3DES
,
AES
and
NONE
. NONE means it is a tunnel only with no
encryption. 3DES and AES are more powerful but increase latency.
•
DES stands for Data Encryption Standard, it uses 56 bits as an encryption
method.
•
3DES
stands for Triple Data Encryption Standard, it uses 168 (56*3) bits
as an encryption method.
•
AES stands for Advanced Encryption Standards, it uses 128 bits as an
encryption method.
Perfect Forward
Secrecy
Perfect Forward Secret (PFS) is disabled (
None
) by default in phase 2 IPSec
SA setup. This allows faster IPSec setup, but is not so secure.
Specify an MODP (Modular Exponentiation Groups) mode from the drop-
down list box. Choices are
MODP 768-bit (Group 1)
,
MODP 1024-bit (Group
2)
and
MODP 1536-bit (Group 5)
. The larger the random number bits, the
higher the security ut slower.
Pre-shared Key
Enter your pre-shared key in this field. A pre-shared key identifies a
communicating party during a phase 1 IKE negotiation. It is called "pre-
shared" because you have to share it with another party before you can
communicate with them over a secure connection.
Type from 8 to 31 case-sensitive ASCII characters or from 16 to 62
hexadecimal ("0-9", "A-F") characters. You must precede a hexadecimal key
with a "0x (zero x), which is not counted as part of the 16 to 62 character
range for the key. For example, in "0x0123456789ABCDEF", 0x denotes that
the key is hexadecimal and 0123456789ABCDEF is the key itself.
Note:
Both ends of the VPN tunnel must use the same pre-
shared key.
You will receive a PYLD_MALFORMED (payload malformed) packet if the
same pre-shared key is not used on both ends.
Table 47
VPN: L2TP: Create: LAN to LAN (continued)
LABEL
DESCRIPTION
