Watchguard Firebox SOHO 6 Wireless, Руководство пользователя, Страница: 137 / 208

User Guide 115
Set Up multiple SOHO-SOHO VPN tunnels
- If you set Aggressive Mode and have a static IP address,
the Local ID must be an IP Address and the Remote ID
can be either an IP address or a domain name.
- If you set Aggressive Mode and have a dynamic IP
address, the Local ID must be a domain name and the
Remote ID can be either an IP address or a domain name.
9 In the Authentication Algorithm drop-down list, set the type
of authentication. The options are MD5-HMAC (128-bit
authentication) or SHA1-HMCA (160-bit authentication).
10 In the Encryption Algorithm drop-down list, set the type of
encryption. The options are DES-CBC or 3DES-CBC .
11 Set the number of kilobytes until negotiation expiration.
12 Set the number of hours until negotiation expiration.
13 In the Diffie-Hellman Group drop-down list, set the group
number. WatchGuard supports group 1 and group 2.
Diffie-Hellman is a mathematical technique used to securely negotiate
secret keys through a public network. Diffie-Hellman groups are
collections of parameters used to achieve this. Group 2 is more secure
than group 1, but more time is required to calculate group 2 secret keys.
14 Set the Generate IKE Keep Alive Messages check box to keep
the VPN tunnel open when there is no communication. Short
packets are sent across the VPN tunnel at regular intervals to
maintain the connection. If the tunnel connection closes, the
SOHO 6 Wireless does a rekey to open the tunnel again.
The Generate IKE Keep Alive Messages check box is set in the default
configuration.
Use the default Phase 2 settings, or change the Phase 2 settings as
shown below:
N
OTE
Make sure that the Phase 2 settings are the same an both appliances.