RAM 6000 Informações Técnicas descarregar pdf (Página 87)

Software Manual 87

Network Tab

Use Perfect Forward Secrecy: Specifies whether or not the tunnel will use Perfect Forward Secrecy when negotiation

cryptography parameters with the remote device. Note: This parameter must be set the same on the devices on both

sides of the tunnel in order for a Security Association (SA) to be established. This is one of the first things that should

be checked when tunnel negotiation difficulties are encountered.

• Click on the NEXT button and the following Encryption Settings dialog window will appear:

Phase 1 Encryption: Select the type of encryption needed for phase 1 (IKE).

Phase 1 Authentication: Select the type of authentication needed for phase 1 (IKE).

Phase 1 DH Group: Select the DH Group needed for phase 1 (IKE) by choosing one of the values from the drop-down

list provided. This option selects the encryption level of the Diffie-Hellman keys and these are Group 1 (768 bits),

Group 2 (1024 bits), Group 5 (1536 bits) or Group 14 (2048 bits). Longer keys imply better security but at a cost of lon-

ger negotiation/set-up time during the initial connection establishment. These settings must match on both ends of

the connection. A value of None

means that no DH Group will be selected for this end of the tunnel and it will adopt

the settings of its peer during connection initiation.

Phase 1 ISAKMP Time (minutes): Select how long, in minutes, the keying channel of a connection (ISAKMP SA) should

last before being renegotiated.

Pre-Shared Key (Required): Specify the key to be exchanged for encryption negotiation during phase (IKE). Key must

not contain a double-quote character. Note: The Pre-Shared Key must match on both ends of the tunnel in order to

work.

Local Peer ID: Specify how the left participant should be identified for authentication. Can be an IP address of a fully

qualified domain name preceded by @ (which is used as a literal string and not resolved).

Remote Peer ID: Specify how the right participant should be identified for authentication. Can be an IP address of a

fully qualified domain name preceded by @ (which is used as a literal string and not resolved).

Phase 2 Auth Type: Defines whether authentication should be done as part of ESP encryption, or separately using the

AH protocol.

Phase 2 Encryption: Select the ESP encryption algorithm to be used for the connection.

Phase 2 Authentication: Select the ESP authentication algorithm to be used for the connection.

Phase 2 ISAKMP Time (minutes): Select how long, in minutes, a particular instance of a connection (a set of encryp-

tion/authentication keys for user packets) should last, from successful negotiation to expiration.

1 2 ... 82 83 84 85 86 87 88 89 90 91 92 ... 210 211

Sem comentários

RAM 6000 Informações Técnicas Página 87