Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Руководство администратора

Страница: 614 / 861

613 Field descriptions
Policy field descriptions
IPsec IKE policy Properties—Data Compression Preference tab
The data compression preference is an algorithm that you specify when you create an IPsec/IKE policy
for VPN tunnels. It identifies the kind of compression that is used on data in a tunnel that uses the
policy.
Associated tasks
The task that you can perform with this tab is:
■
“Configuring VPN policy for IPsec with IKE” on page 380
IPsec IKE policy Properties—Diffie-Hellman Preference tab
The Diffie-Hellman preference in a policy used by a VPN tunnel specifies the standard IKE method that
will be used to establish shared secrets.
Associated tasks
The task that you can perform with this tab is:
■
“Configuring VPN policy for IPsec with IKE” on page 380
Table D-47
IPsec IKE policy Properties—Data Compression Preference tab
Field Description
Available Select a data compression preference from this list box and click the right-arrow >> button
to move it to the Selected list box.
The options are:
■
LZS
Compresses data by searching for redundant strings and replacing them with special
tokens that are shorter than the original string. LZS then creates tables of these
strings and replacement tokens which consist of pointers to the previous data streams.
LZS uses these pointers to remove redundant strings from the new data streams.
■
DEFLATE
Uses a lossless compressed format that compresses data using a combination of the
LZ77 algorithm and Huffman coding. Note that LZS requires more CPU cycles to
perform compression.
Selected Lists data compression methods that are used in the policy.
The default is No Compression.
Up Moves the selected item in the Selected list up in the list.
If more than one algorithm is assigned, the first one is tried, and if unsuccessful, the next
algorithm is tried.
Down Moves the selected item in the Selected list down in the list.
Table D-48 IPsec IKE policy Properties—Diffie-Hellman Preference tab
Field Description
Available Select a group from this list box and click the right-arrow >> button to move it to the
Selected list box.
Diffie-Hellman is the standard IKE method of establishing shared secrets. Group 1 and
group 2 are the Diffie-Hellman group numbers available for establishing these IKE session
keys. Group 1 is 768 bits long and group 2 is 1024 bits long. Using group 2 is more secure
but it also uses more CPU power. Using a combination of groups, 1 then 2 or 2 then 1,
indicates that first one group is tried, if that is unsuccessful, the next group is tried.