LV switch IPPBX3000, Руководство пользователя

Страница: 62 / 195

LvSwitch IPPBX 3000 Manual
60
supports 128bit, 192bit, 256bit key length AES
algorithm; Default value is DES
Authentication Algorithm MD5: MD5 generates a 128bit message digest by
entering messages of any length;SHA1: the 160bit
message digest is generated by input messages with the
length less than 2 64 bits. The digest of SHA1 is longer
than MD5, so it is more secure.The default value is
"MD5".
IKE SA Lifetime Before the life cycle timeout of the set IKE SA, an SA
will be negotiated in advance to replace the old SA.
Before the new SA is completed, the old SA will still be
used. After the new SA is established, the new SA will
be used immediately.
Default value is 3600s ,the range is
(1200-86400) Seconds
Phase 2 setting description as below
Table 5-15 phase 2 setting description as below
Interface items Description
Phase 2 Configure the second stage, use the SA established in
the first stage to provide IPsec negotiation security
service, that is, negotiate specific SA for IPsec, and
establish IPsec SA for final IP data packet security
transmission.
ESP mode In tunnel mode, AH or ESP is inserted before the
original IP packet header, and a new packet header is
generated before AH or ESP. In transport mode, AH or
ESP is inserted behind the IP packet header, but before
all transport layer protocols, or before all other IPsec
protocols; Default value is “Tunnel “
Protocol types AH or ESP Default value is “ ESP”.
AH is the authentication header protocol and the
protocol number is 51. The main functions include data
source authentication, data integrity verification and
message retransmission prevention.
ESP: ESP is a packet security encapsulation protocol
with a protocol number of 50. Unlike the AH protocol,
ESP encrypts the data packets that need to be protected
and then encapsulates them in the IP packet to ensure
the confidentiality of the data.
Encryption Algorithm Optional
DES
﹑
3DES
﹑
AES128
﹑
AES192
﹑
AES256,with default “DES”
Authentication Algorithm MD5 or SHA1 ,default “ MD5”
IPSec SA Lifetime Set the lifetime for “IPsec SA” if over the lifetime,it
needs to negotiate the IPsec SA again .Default value is
28800s.