ZyXEL Communications ZyWALL USG 100 Series, Руководство пользователя, Страница: 501 / 1157

Chapter 25 IPSec VPN
ZyWALL USG 100/200 Series User’s Guide
501
Negotiation
Mode
Select the negotiation mode to use to negotiate the IKE SA. Choices
are
Main - this encrypts the ZyWALL’s and remote IPSec router’s
identities but takes more time to establish the IKE SA
Aggressive - this is faster but does not encrypt the identities
The ZyWALL and the remote IPSec router must use the same
negotiation mode.
Proposal
Add
Click this to create a new entry.
Edit Select an entry and click this to be able to modify it.
Remove Select an entry and click this to delete it.
# This field is a sequential value, and it is not associated with a specific
proposal. The sequence of proposals should not affect performance
significantly.
Encryption Select which key size and encryption algorithm to use in the IKE SA.
Choices are:
DES - a 56-bit key with the DES encryption algorithm
3DES - a 168-bit key with the DES encryption algorithm
AES128 - a 128-bit key with the AES encryption algorithm
AES192 - a 192-bit key with the AES encryption algorithm
AES256 - a 256-bit key with the AES encryption algorithm
The ZyWALL and the remote IPSec router must use the same key
size and encryption algorithm. Longer keys require more processing
power, resulting in increased latency and decreased throughput.
Authentication Select which hash algorithm to use to authenticate packet data in
the IPSec SA. Choices are SHA1 and MD5 . SHA1 is generally
considered stronger than MD5 , but it is also slower.
The remote IPSec router must use the same authentication
algorithm.
Key Group Select which Diffie-Hellman key group (DH x ) you want to use for
encryption keys. Choices are:
DH1 - use a 768-bit random number
DH2 - use a 1024-bit random number
DH5 - use a 1536-bit random number
The longer the key, the more secure the encryption, but also the
longer it takes to encrypt and decrypt information. Both routers
must use the same DH key group.
Table 132 Configuration > VPN > IPSec VPN > VPN Gateway > Edit (continued)
LABEL DESCRIPTION