RACOM M!DGE3, Руководство пользователя

Страница: 113 / 183

SA lifetime [s]
Number {180 – 86400}, default = 14400 s (4 hours)
Time of SA validity. The new key exchange or re-authentication is triggered immediately the
key expires. The true time of expiration is randomly selected within the range of 90-110%, to
prevent collision when the key exchange is triggered from both sides simultaneously.
Unfortunately, the more frequent the key exchange, the higher the network and CPU load.
Note
The M!DGE3 unit load is seriously affected when key exchange is in process.
Phase 2 – IPsec
Certain parameters are shared by all subordinate CHILD SA. IPsec Security Association provides
packet encryption (user traffic encryption)
Encryption algorithm
List box {3DES (legacy); AES128; AES192; AES256}, default = "AES128"
IKE CHILD SA encryption algorithm. The "legacy" marked methods are recognized as unsafe.
Peer configuration must match.
Hash algorithm
List box {MD5 (legacy); SHA1 (legacy); SHA256; SHA384; SHA512}, default = "SHA256"
IKE CHILD SA integrity algorithm. The "legacy" marked methods are recognized as unsafe.
Peer configuration must match.
The same value as selected for the Integrity algorithm, is used for the PRF (Pseudo-Random
Function).
Diffie-Hellman group (PFS)
List box {None (legacy); Group 2 (MODP1024, legacy); Group 5 (MODP1536, legacy);
Group 14 (MODP2048); Group 15 (MODP3072); Group 25 (ECP192); Group 26 (ECP224),
Group 19 (ECP256); Group 20 (ECP384); Group 21 (ECP521); Group 27 (ECP224BP);
Group 28 (ECP256BP); Group 29 (ECP384BP); Group 30 (ECP512BP); Group 31 (X25519);
Group 32 (X448)}, default = "Group 15 (MODP3072)"
The PFS (Perfect Forward Secrecy) feature is performed using the Diffie-Hellman group
method.
PFS increases IKE CHILD SA key exchange security. The "legacy" marked methods are recog-
nized as unsafe. Peer configuration must match.
The higher the Diffie-Hellman group, the higher the security but also the higher the network and
CPU load.
Payload compression
This parameter enables payload compression. This takes place before encryption. Peer config-
uration must match.
113 © RACOM s.r.o. – M!DGE3 Cellular Router
Settings