Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Руководство администратора

Страница: 610 / 861

609 Field descriptions
Policy field descriptions
VPN Policies
Before you set up your secure tunnels, to make their configuration faster and easier, you can create
VPN policies that work on a global level. Rather than configuring the components present in these
policies for every tunnel you create, you can configure general policies and then later apply them to
your secure tunnels.
IPsec IKE policy Properties—General tab
You use IPsec with IKE policies in VPN tunnels to provide a dynamic method of authentication.
Associated tasks
The task that you can perform with this tab is:
■
“Configuring VPN policy for IPsec with IKE” on page 380
Table D-44 IPsec IKE policy Properties—General tab
Field Description
Name A unique name for the VPN policy.
The maximum length is 256 characters.
Allowed characters are a-z, A-Z, numerals, periods (.), dashes (-), and underscores (_).
Do not include spaces in the name. The characters @, !, #, $, %,
^
, &, *, <, >, and other
reserved characters are also invalid.
Caption An optional, brief description of the VPN policy.
The maximum length is 128 characters.
For longer descriptions, use the Description tab.
Filter applied Applies a filter as part of the VPN policy.
The options are;
■
Sample_Denial-of-Service_filter
■
Blank
■
Any filter you have previously configured.
The default is (none).
Data integrity
protocol Select one of the following data integrity protocols:
■
If you want to apply the algorithm to the data portion of the packet, select Apply
integrity preference to data portion of the packet (ESP).
This option (the default) provides integrity, authentication, and confidentiality to the
packet. It works between hosts, between hosts and security gateways, and between
security gateways ensuring that data has not been modified in transit. If you do not
want to use this ESP default, you can select the AH option. Note that if you select the
AH option along with a data privacy algorithm, ESP is applied to the packet as well as
AH.
■
If you want to apply the algorithm to the entity packet, select Apply integrity
preference to entity packet (AH).
With this option, the authentication header (AH) holds authentication information for its IP
packets. It accomplishes this by computing a cryptographic function for the packets using a
secret authentication key. If you select this option, but you’ve also elected to use a data
privacy algorithm (3DES, DES, or AES), ESP is applied to the packet as well as AH.