UG87-LW User Guide
69
Negotiation Mode
Select from "Main" and "Aggressive".
Authentication
Algorithm
Select from "DES", "3DES", "AES128", "AES192" and "AES256".
Encryption Algorithm
Select from "MD5" and "SHA1".
DH Group
Select from "MODP768_1", "MODP1024_2" and
"MODP1536_5".
Key
Enter the preshared key.
Local ID Type
Select from "Default", "ID", "FQDN", and "User FQDN"
IKE Life Time (s)
Set the lifetime in IKE negotiation. Range: 60-86400.
SA Algorithm
Select from "DES_MD5", "DES_SHA1", "3DES_MD5",
"3DES_SHA1", "AES128_MD5", "AES128_SHA1",
"AES192_MD5", "AES192_SHA1", "AES256_MD5" and
"AES256_SHA1".
PFS Group
Select from "NULL", "MODP768_1", "MODP1024_2" and
"MODP1536-5".
Life Time (s)
Set the lifetime of IPsec SA. Range: 60-86400.
DPD Interval Time (s)
Set DPD interval time
DPD Timeout (s)
Set DPD timeout.
Cisco Secret
Cisco Nhrp key.
NHRP Holdtime (s)
The holdtime of Nhrp protocol.
Table 4-3-7-1 DMVPN Parameters
4.3.7.2 IPSec
IPsec is especially useful for implementing virtual private networks and for remote user
access through dial-up connection to private networks. A big advantage of IPsec is that
security arrangements can be handled without requiring changes to individual user
computers.
IPsec provides three choices of security service: Authentication Header (AH), Encapsulating
Security Payload (ESP), and Internet Key Exchange (IKE). AH essentially allows authentication
of the senders’ data. ESP supports both authentication of the sender and data encryption.
IKE is used for cipher code exchange. All of them can protect one and more data flows
between hosts, between host and gateway, and between gateways.
