ZyXEL Communications SBG5500-A, User Manual

Page: 170 / 274

Chapter 10 VPN
SBG5500 Series User’s Guide
170
Encryption Select which key size and encryption algorithm to use in the IKE SA. Choices are:
3DES - a 168-bit key with the DES encryption algorithm
AES128 - a 128-bit key with the AES encryption algorithm
AES192 - a 192-bit key with the AES encryption algorithm
AES256 - a 256-bit key with the AES encryption algorithm
The SBG and the remote IPsec router must use the same algorithms and keys. Longer
keys require more processing power, resulting in increased latency and decreased
throughput.
# This is the Authentication index number.
Authentication Select which hash algorithm to use to authenticate packet data in the IPsec SA.
Choices are
SHA1 , SHA256 , and SHA512 is generally considered stronger than MD5 ,
but it is also slower.
The remote IPsec router must use the same authentication algorithm.
Key Group Select which Diffie-Hellman key group (DHx) you want to use for encryption keys.
Choices are:
None - disable DHx.
DH2 - use a 1024-bit random number.
DH5 - use a 1536-bit random number.
DH14 - use a 2048-bit random number.
The longer the key, the more secure the encryption, but also the longer it takes to
encrypt and decrypt information. Both routers must use the same DH key group.
NAT Traversal Select this if any of these conditions are satisfied.
• This IKE SA might be used to negotiate IPsec SAs that use ESP as the active
protocol.
• There are one or more NAT routers between the SBG and remote IPsec router,
and these routers do not support IPsec pass-thru or a similar feature.
The remote IPsec router must also enable NAT traversal, and the NAT routers have to
forward packets with UDP port 500 and UDP 4500 headers unchanged.
This field applies for IKEv1 only. NAT Traversal is always performed when you use
IKEv2.
Dead Peer Detection
(DPD)
Select this check box if you want the SBG to make sure the remote IPsec router is
there before it transmits data through the IKE SA. The remote IPsec router must
support DPD. If there has been no traffic for at least 15 seconds, the SBG sends a
message to the remote IPsec router. If the remote IPsec router responds, the SBG
transmits the data. If the remote IPsec router does not respond, the SBG shuts down
the IKE SA.
If the remote IPsec router does not support DPD, see if you can use the VPN
connection connectivity check.
This field applies for IKEv1 only. Dead Peer Detection (DPD) is always performed
when you use IKEv2.
X Auth / Extended
Authentication Protocol This part of the screen displays X-Auth when using IKEv1 and Extended
Authentication Protocol when using IKEv2 .
X-Auth This displays when using IKEv1 . When different users use the same VPN tunnel to
connect to the SBG (telecommuters sharing a tunnel for example), use X-auth to
enforce a user name and password check. This way even though telecommuters all
know the VPN tunnel’s security settings, each still has to provide a unique user name
and password.
Table 70 VPN Gateway: Add/Edit
LABEL DESCRIPTION