ZyXEL Communications Centralized Network Management Vantage CNM, Руководство пользователя

Страница: 254 / 430

Chapter 12 VPN Community
Vantage CNM User’s Guide
254
Perfect Forward
Secret (PFS) Select whether or not you want to enable Perfect Forward Secrecy (PFS)
and, if you do, which Diffie-Hellman key group to use for encryption. Choices
are:
NONE - disable PFS
DH1 - enable PFS and use a 768-bit random number
DH2 - enable PFS and use a 1024-bit random number
PFS changes the root key that is used to generate encryption keys for each
IPSec SA. It is more secure but takes more time.
Enable Replay
Detection As a VPN setup is processing intensive, the system is vulnerable to Denial of
Service (DOS) attacks. The IPSec receiver can detect and reject old or
duplicate packets to protect against replay attacks. Enable replay detection
by selecting this check box.
Enable Multiple
Proposals Select this to allow the ZyWALL to use any of its phase 2 encryption and
authentication algorithms when negotiating an IPSec SA.
When you enable multiple proposals, the ZyWALL allows the remote IPSec
router to select which phase 2 encryption and authentication algorithms to
use for the IPSec SA, even if they are less secure than the ones you
configure for the VPN rule.
Clear this to have the ZyWALL use only the configured phase 2 encryption
and authentication algorithms when negotiating an IPSec SA.
Apply Click Apply to save the changes.
Cancel Click Cancel to discard all changes and return to the previous screen.
Table 120 VPN Management > VPN Community > Add/Edit (continued)
FIELD DESCRIPTION