Juniper NETWORK AND SECURITY MANAGER 2010.3, Руководство администратора

Страница: 475 / 1016

•
Diffie-Hellman Group 19.
•
Diffie-Hellman Group 20.
NOTE: You can create Phase 1 and Phase 2 proposals with Diffie-Hellman Group14
from VPN Manager > AutoKey IKE Parameters > Security > Phase2 Proposal > Security-Level
(User-Defined).
You can only create Custom IKE Phase 1 and 2 proposals with Diffie-Hellman Group 14
on devices running ScreenOS 6.2 or later. On other devices, an error message is
generated.
• Lifetime (Seconds)—Enter the number of seconds before the key is regenerated. The
default value is 3600 seconds (8 hours).
•
Lifesize (KB)—Enter the number of bytes permitted through the connection before the
key is regenerated. A value of 0 (the default) means no limit.
• Encryption (ESP) or Authentication (AH) Algorithm.
•
Select ESP to configure encryption and authentication, then select the desired
algorithms.
• Select AH to configure authentication only, then select the desired algorithm.
NOTE: We strongly recommend that you do not use null AH with ESP.
Click OK to add the custom IKE object to the management system.
Configuring Dial-in Objects
Netscreen devices allow users to dialin and manage the box as a console. By switching
the modem interface, you can both dial in, and dial out. You can use NSM to configure
Dial-in details. You can create and edit white lists of allowed numbers, and black lists of
blocked numbers. You can set a policy for unknown CNIDs if you wish to change the
default "denied" setting.
•
Creating a Dial-In Profile on page 425
• Linking the Dial-In Profile with the Device on page 426
• Setting the Time-out Period for the Modem Dial-In Authentication on page 426
Creating a Dial-In Profile
1.
Select
Object Manager
>
Dial-In.
2.
Select
Add Dial In Object.
The New Dial in window opens.
3.
Click
+
in the Phone Settings table for either the White List or Black List. The New
List Entry box opens.
425 Copyright © 2010, Juniper Networks, Inc.
Chapter 8: Configuring Objects