Xerox WORKCENTRE 5755, Руководство системного администратора

Страница: 183 / 356

Security
Xerox WorkCentre 5735/5740/5745/5755/5765/5775/5790
System Administrator Guide
175
• X.509 Certificate (Local Certificate) - this is a public key certificate.
• Trusted Root Certificate .
• Pre-shared Key Passphrase - the use of pre-shared key authentication is not
recommended because it is a relatively weak authentication method.
b. If you select [Internet Key Exchange (IKE)] , enter the pre-shared key passphrase in the [Pre-
shared Key Passphrase] field.
Note: Only one Action may be created when selecting Internet Key Exchange (IKE) Keying
Method.
6. Click on the [Next] button to display the Step 2 of 2 screen.
If you Selected Manual Keying as the Keying Method:
1. In the Mode Selections area, select one of the [IPsec Mode] options from the drop-down menu:
• Transport Mode - this is the default Mode for IP Sec. This only encrypts the IP payload.
• Tunnel Mode - this mode encrypts the IP header and the payload. It provides protection on
an entire IP packet by treating it as an AH (Authentication Header) or ESP (Encapsulating
Secuirty Payload) payload.
When this mode is selected, you have the option of specifying a host IP Address
2. In the Security Selections area select preferred option and enter the required information.
3. Click on the [Save] button to return to the IP Sec - Action page.
If you Selected Internet Key Exchange (IKE) as the Keying Method:
IKE Phase 1 authenticates the IPSec peers and sets up a secure channel between the peers to enable
IKE exchanges.
IKE Phase 2 negotiates IP Sec System Administrator to set up the IP Sec tunnel.
1. In the IKE Phase 1 area:
a. For [Key Lifetime] enter length of time that this key will live, either in seconds, minutes or
hours.
b. Select required option from the [DH Group] drop-down menu. Choose one of following:
• DH Group 2 - which provides a 1024 bit Modular Exponential (MODP) keying strength.
• DH Group 14 - which provides a 2048 bit MODP keying strength. Diffie-Hellman (DH) is
a public-key cryptography scheme that allows two parties to establish a shared secret
over an insecure communications channel. It is also used within IKE to establish session
keys.
c. For Hash - Encryption , check the required checkboxes:
• SHA1 (Secure Hash Algorithm 1) and MD5 (Message Digest 5) are one-way hashing
algorithms used to authenticate packet data. Both produce a 128-bit hash. The SHA1
algorithm is generally considered stronger but slower than MD5. Select MD5 for better
encryption speed, and SHA1 for better security.
• 3DES (Triple-Data Encryption Standard) is a variation on DES that uses a 168-bit key. As
a result, 3DES is more secure than DES. It also requires more processing power, resulting
in increased latency and decreased throughput.
• AES (Advanced Encryption Standard) is a more secure method compared to 3DES.