RACOM M!DGE3, Руководство пользователя

Страница: 112 / 183

Phase 1 IKE
Parameters related to IKE SA (IKE Security Association) provide SA keys exchange with the peer.
Authentication method
List box {PSK}
Peer authentication method. Peer configuration must match.
The "main mode" negotiation is the only option supported. The "aggressive mode" is not sup-
ported; it is recognized as unsafe when combined with PSK type of authentication
Encryption algorithm
List box {3DES (legacy); AES128; AES192; AES256}, default = "AES128"
IKE SA encryption algorithm. The "legacy" marked methods are recognized as unsafe. Peer
configuration must match.
Hash algorithm
List box {3DES (legacy); AES128; AES192; AES256}, default = "AES128"
IKE SA encryption algorithm. The "legacy" marked methods are recognized as unsafe. Peer
configuration must match.
Diffie-Hellman group (PFS)
List box {None (legacy); Group 2 (MODP1024, legacy); Group 5 (MODP1536, legacy);
Group 14 (MODP2048); Group 15 (MODP3072); Group 25 (ECP192); Group 26 (ECP224);
Group 19 (ECP256); Group 20 (ECP384); Group 21 (ECP521); Group 27 (ECP224BP);
Group 28 (ECP256BP); Group 29 (ECP384BP); Group 30 (ECP512BP); Group 31 (X25519);
Group 32 (X448)}, default = "Group 15
(MODP3072)"
The PFS (Perfect Forward Secrecy) feature is performed using the Diffie-Hellman group
method.
PFS increases IKE SA key exchange security. The "legacy" marked methods are recognized
as unsafe. Peer configuration must match.
The higher the Diffie-Hellman group, the higher the security but also the higher the network and
CPU load.
Reauthentication
List box {On; Off}, default = "Off"
This parameter is valid if IKEv2 is used. It determines the next action after IKE SA has expired.
When enabled: the new IKE SA is negotiated including new peer authentication. When disabled:
only the new keys are exchanged.
M!DGE3 Cellular Router – © RACOM s.r.o. 112
Settings