USER MANUAL
PrestoAdvancedAD101_AD301_UG_000_UK
Descriptions and non-contractual illustrations in this document are given as an indication only.
M2M Design reserves the right to make any modification
33
Enable
Check this box to enable the IPSec tunnel.
IPSec Setup
In order to establish an encrypted tunnel, the two ends of an IPSec tunnel must
agree on the methods of encryption, decryption and authentication. This is done
by sharing a key to the encryption code. For key management, the Router uses
only IKE with Preshared Key mode.
Keying Mode
IKE with Preshared Key
IKE is an Internet Key Exchange protocol used to negotiate key material for
Security Association (SA). IKE uses the Preshared Key to authenticate the remote
IKE peer. Both ends of IPSec tunnel must use the same mode of key management.
Certificates
This option will be available in future release
Phase 1 DH Group
Phase 1 is used to create the SA. DH (Diffie-Hellman) is a key exchange protocol
used during Phase 1 of the authentication process to establish pre-shared keys.
There are three groups of different prime key lengths. Group 1 is 768 bits, Group
2 is 1024 bits and Group 5 is 1536 bits long. If network speed is preferred, select
Group 1. If network security is preferred, select Group 5.
Phase 1 Encryption
Select a method of encryption: DES (56-bit), 3DES (168-bit) or AES-128 (128-bit).
The method determines the length of the key used to encrypt or decrypt ESP
packets. AES-128 is recommended because it is the most secure. Make sure both
ends of the IPSec tunnel use the same encryption method.
Phase 1 Authentication
Select a method of authentication: MD5 or SHA1. The authentication method
determines how the ESP packets are validated. MD5 is a one-way hashing
algorithm that produces a 128-bit digest. SHA1 is a one-way hashing algorithm
that produces a 160-bit digest. SHA1 is recommended because it is more secure.
Make sure both ends of the IPSec tunnel use the same authentication method.
Phase 1 SA Life Time
Configure the length of time IPSec tunnel is active in Phase 1. The default value is
28800 seconds. Both ends of the IPSec tunnel must use the same Phase 1 SA Life
Time setting.
Perfect Forward
Secrecy
If the Perfect Forward Secrecy (PFS) feature is enabled, IKE Phase 2 negotiation
will generate new key material for IP traffic encryption and authentication, so
hackers using brute force to break encryption keys will not be able to obtain
future IPSec keys. Both ends of the IPSec tunnel must enable this option in order
to use the function.
Phase 2 DH Group
If the Perfect Forward Secrecy feature is disabled, then no new keys will be
generated, so you do not need to set the Phase 2 DH Group. There are three
groups of different prime key lengths. Group 1 is 768 bits, Group 2 is 1024 bits,
and Group 5 is 1536 bits long. If network speed is preferred, select Group 1. If
network security is preferred, select Group 5. You do not have to use the same
DH Group that you used for Phase 1, but both ends of the IPSec tunnel must use
the same Phase 2 DH Group.
Phase 2 Encryption
Phase 2 is used to create one or more IPSec SAs, which are then used to key IPSec
sessions. Select a method of encryption: NULL, DES (56-bit), 3DES (168-bit) or
AES-128 (128-bit). It determines the length of the key used to encrypt or decrypt
ESP packets. AES-128 is recommended because it is the most secure. Both ends of
the IPSec tunnel must use the same Phase 2 Encryption setting.
NOTE: If you select a NULL method of encryption, the next Phase 2 Authentication
method cannot be NULL and vice versa.
Phase 2 Authentication
Select a method of authentication: NULL, MD5 or SHA1. The authentication
method determines how the ESP packets are validated. MD5 is a one-way
hashing algorithm that produces a 128-bit digest. SHA1 is a one-way hashing
algorithm that produces a 160-bit digest. SHA1 is recommended because it is
more secure. Both ends of the IPSec tunnel must use the same Phase 2
