Symantec 360R Administration Guide - Page 83

Global IKE Policy Phase 1, non-configurable, except for SA, lifetime parameter, VPN Policies Phase 2

Get Symantec 360R - Security Gateway SGS PDF manuals and user guides
UPC - 037648240185
View all Symantec 360R manuals
Add to My Manuals
Save this manual to your list of manuals

Page 83 highlights

Establishing secure VPN connections 83 Creating security policies Global IKE Policy (Phase 1, non-configurable, except for SA lifetime parameter) The security gateway includes a predefined global IKE policy that automatically applies to your IKE Phase 1 negotiations. This global IKE policy works in conjunction with the VPN policy you configure for Phase 2 negotiations. The Global IKE Policy provides the parameters that define Phase 1 negotiations of the IKE tunnel, while the VPN policy you configure and select provides the parameters for Phase 2 negotiations. The only parameter in the Global IKE Policy whose setting can be changed is the SA (security association) Lifetime, which specifies the period of time after which the tunnel rekeys (in minutes). This parameter is located in VPN > Advanced > Global IKE Settings (Phase 1 Rekey). When two security gateways are negotiating Phase 1, the first security gateway sends a list of proposals, called a transform proposal list. The security gateway to which it is connecting then selects a proposal from the list that it likes best, generally the strongest available option. You cannot change the transform proposal list on the appliance; however this information may be useful to give to the remote gateway administrator.Table 6-1 lists the order of the Symantec Gateway Security 300 IKE proposals. Table 6-1 IKE proposal order Data Privacy Data Integrity Diffie-Hellman 3DES 3DES 3DES 3DES DES DES SHA1 MD5 SHA1 MD5 SHA1 MD5 Group 5 Group 5 Group 2 Group 2 Group 1 Group 1 Some settings are configurable at a global level for Client-to-Gateway tunnels. See "Setting global policy settings for Client-to-Gateway VPN tunnels" on page 101. VPN Policies (Phase 2, configurable) The security gateway includes a set of four pre-defined, configurable VPN policies that apply to Phase 2 tunnel negotiations. Rather than configuring data privacy, data integrity, and data compression algorithms for every tunnel you create, the security gateway lets you configure standard, reusable VPN policies

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
  • 173
  • 174
  • 175
  • 176
  • 177
  • 178
  • 179
  • 180
  • 181
  • 182
  • 183
  • 184
  • 185
  • 186
  • 187
  • 188
  • 189
  • 190
  • 191
  • 192
  • 193
  • 194
  • 195
  • 196
  • 197
  • 198
  • 199
  • 200
  • 201
  • 202
  • 203
  • 204
  • 205
  • 206
  • 207
  • 208
  • 209
  • 210
  • 211
  • 212
  • 213
  • 214
  • 215
  • 216
  • 217
  • 218
83
Establishing secure VPN connections
Creating security policies
Global IKE Policy (Phase 1, non-configurable, except for SA
lifetime parameter)
The security gateway includes a predefined global IKE policy that automatically
applies to your IKE Phase 1 negotiations. This global IKE policy works in
conjunction with the VPN policy you configure for Phase 2 negotiations. The
Global IKE Policy provides the parameters that define Phase 1 negotiations of
the IKE tunnel, while the VPN policy you configure and select provides the
parameters for Phase 2 negotiations.
The only parameter in the Global IKE Policy whose setting can be changed is the
SA (security association) Lifetime, which specifies the period of time after which
the tunnel rekeys (in minutes). This parameter is located in VPN > Advanced >
Global IKE Settings (Phase 1 Rekey).
When two security gateways are negotiating Phase 1, the first security gateway
sends a list of proposals, called a transform proposal list. The security gateway
to which it is connecting then selects a proposal from the list that it likes best,
generally the strongest available option. You cannot change the transform
proposal list on the appliance; however this information may be useful to give to
the remote gateway administrator.
Table 6-1
lists the order of the Symantec
Gateway Security 300 IKE proposals.
Some settings are configurable at a global level for Client-to-Gateway tunnels.
See
“Setting global policy settings for Client-to-Gateway VPN tunnels”
on
page 101.
VPN Policies (Phase 2, configurable)
The security gateway includes a set of four pre-defined, configurable VPN
policies that apply to Phase 2 tunnel negotiations. Rather than configuring data
privacy, data integrity, and data compression algorithms for every tunnel you
create, the security gateway lets you configure standard, reusable VPN policies
Table 6-1
IKE proposal order
Data Privacy
Data Integrity
Diffie-Hellman
3DES
SHA1
Group 5
3DES
MD5
Group 5
3DES
SHA1
Group 2
3DES
MD5
Group 2
DES
SHA1
Group 1
DES
MD5
Group 1