The PFS (Perfect Forward Secrecy) feature is performed using the Diffie-Hellman group method.
PFS increases IKE SA key exchange security. The RipEX unit load is seriously affected when
key exchange is in process. The "legacy" marked methods are recognized as unsafe. Peer
configuration must match.
The higher the Diffie-Hellman group, the higher the security but also the higher the network and
CPU load.
Reauthentication
List box: On, Off
Default = Off
This parameter is valid if IKEv2 is used. It determines the next action after IKE SA has expired.
When enabled: the new IKE SA is negotiated including new peer authentication. When disabled:
only the new keys are exchanged.
Phase 2 - IPsec
Certain parameters are shared by all subordinate CHILD SA. IPsec Security Association provides
packet encryption (user traffic encryption).
Encryption algorithm
List box: 3DES (legacy), AES128, AES192, AES256
Default = AES128
CHILD SA (user traffic) encryption algorithm. The "legacy" marked methods are recognized as
unsafe. Peer configuration must match
Integrity algorithm
List box: MD5 (legacy), SHA1 (legacy), SHA256, SHA384, SHA512
Default = SHA256
CHILD SA (user traffic) integrity algorithm. The "legacy" marked methods are recognized as
unsafe. Peer configuration must match.
The same value as selected for the Integrity algorithm, is used for the PRF (Pseudo-Random
Function).
Diffie-Hellman group (PFS)
List box: None (legacy), Group 2 (MODP1024, legacy), Group 5 (MODP1536, legacy), Group
14 (MODP2048), Group 15 (MODP3072)
Default = Group 15 (MODP3072)
The PFS (Perfect Forward Secrecy) feature is performed using the Diffie-Hellman group method.
PFS increases CHILD SA (user traffic) key exchange security. The RipEX unit load is seriously
affected when key exchange is in process. The "legacy" marked methods are recognized as
unsafe. Peer configuration must match.
The higher the Diffie-Hellman group, the higher the security but also the higher the network and
CPU load.
IPcomp compression
List box: On, Off
Default = Off
This parameter enables packet compression. This takes place before encryption. Peer configur-
ation must match
SA lifetime [s]
Default = 3600 sec (1 hour). Range [180 - 86400] sec
Time of CHILD SA validity. The new key exchange or re-authentication is triggered immediately
the key expires. The true time of expiration is randomly selected within the range of 90-110%,
to prevent collision when the key exchange is triggered from both sides simultaneously.
RipEX Radio modem & Router – © RACOM s.r.o.
170
Advanced Configuration
Содержание RipEX
Страница 2: ......
Страница 42: ... DQ Data Quality Min 180 PER Packet Error Rate Max 5 RipEX Radio modem Router RACOM s r o 42 Network planning ...
Страница 222: ...Fig 10 3 ATEX Certificate RipEX 2 3 RipEX Radio modem Router RACOM s r o 222 Safety environment licensing ...
Страница 223: ...Fig 10 4 ATEX Certificate RipEX 3 3 223 RACOM s r o RipEX Radio modem Router Safety environment licensing ...