110
6620-3201
4.47 Confi gure
>
IPSec
>
IKEv2
>
Responder
Using the Web Page(s)
The
Confi gure
>
IPSec
>
IKEv2
>
Responder
page lists the various Responder parameters for
IKEv2.0:
Act as initiator only:
Setting this parameter to “Yes” prevents the unit from responding to any remote IKEv2 requests.
When set to “No” the unit will both initiate an IPSec IKE exchange if required to do so and respond to
any incoming IKEv2 requests.
Acceptable encryption algorithms:
Enter in this parameter a comma separated list of acceptable encryption algorithms when responding
to an IKEv2 request. This can currently include “DES”, “3DES”, “AES” or any combination. If the
remote peer requests the use of an algorithm that is not included in this list, the negotiation will fail.
Acceptable encryption key length (AES only):
When acting as a responder and negotiating AES encryption, this parameter may be used to specify
the required key length as 128, 192 or 256 bits.
Acceptable authentication algorithms:
Enter in this parameter a comma separated list of authentication algorithms that the unit will allow
remote peers to negotiate. This can currently include “MD5”, “SHA1” or both. If the remote peer
requests the use of an algorithm that is not included in this list, the negotiation will fail.
Acceptable PRF algorithms:
Enter in this parameter a comma separated list of pseudo random function authentication algorithms
that the unit will allow remote peers to negotiate. This can currently include “MD5”, “SHA1” or both.
If the remote peer requests the use of an algorithm that is not included in this list, the negotiation will
fail.
Minimum acceptable MODP group:
This parameter speci
fi
es the minimum DH group the unit will accept when acting as a responder.
Maximum acceptable MODP group:
This parameter speci
fi
es the maximum DH group the unit will accept when acting as a responder.
This value may be decreased from the maximum value of 5 to ensure that negotiations times are not
excessive.
Duration (s):
This parameter determines how long (in seconds) the initial IKE Security Association will stay in force.
When it expires any attempt to send packets to the remote system will result in IKE attempting to
establish a new SA. Enter a value between 1 and 28800 seconds (8 hours).
Inactivity timeout (s):
This parameter speci
fi
es the period of time in seconds after which when no response to a negotiation
packet has been received from the remote IKE will give up.
NAT traversal enabled:
When set to “On”, this parameter enables support for NAT traversal within IKE/IPSec. When one
end of an IPSec tunnel is behind a NAT box, some form of NAT traversal may be required before
the IPSec tunnel can pass packets. Turning NAT traversal on enables the IKE protocol to discover
whether or not one or both ends of a tunnel is behind a NAT box, and implements a standard NAT
traversal protocol if NAT is being performed.
The version of NAT traversal supported is that described in the IETF draft “draft-ietf-ipsec-nat-t-ike 03.
txt”.
