Cisco RVS4000 User Guide - Page 28

Chapter 5 Setting Up and Configuring the Router Remote Security Group Type Select the remote LAN user(s) behind the remote gateway who can use this VPN tunnel. This may be a single IP address or a Sub-network. Note that the Remote Security Group Type must match the other router's Local Security Group Type. IP Address Enter the IP address on the remote network. Subnet Mask If the Remote Security Group Type is set to Subnet, enter the mask to determine the IP addresses on the remote network. IPSec Setup Keying Mode The router supports both automatic and manual key management. When choosing automatic key management, IKE (Internet Key Exchange) protocols are used to negotiate key material for SA (Security Association). If manual key management is selected, no key negotiation is needed. Basically, manual key management is used in small static environments or for troubleshooting purposes. Note that both sides must use the same Key Management method. Phase 1 •• Encryption The Encryption method determines the length of the key used to encrypt/decrypt ESP packets. Only 3DES is supported. Notice that both sides must use the same Encryption method. •• Authentication Authentication determines a method to authenticate the ESP packets. Either MD5 or SHA1 may be selected. Notice that both sides (VPN endpoints) must use the same Authentication method. •• MD5 A one-way hashing algorithm that produces a 128-bit digest. •• SHA1 A one-way hashing algorithm that produces a 160-bit digest. •• Group The Diffie-Hellman (DH) group to be used for key exchange. Select the 768-bit (Group 1), 1024-bit (Group 2), or 1536-bit (Group 5) algorithm. Group 5 provides the most security, Group 1 the least. •• Key Life Time This specifies the lifetime of the IKEgenerated key. If the time expires, a new key will be renegotiated automatically. Enter a value from 300 to 100,000,000 seconds. The default is 28800 seconds. Phase 2 •• Encryption The Encryption method determines the length of the key used to encrypt/decrypt ESP packets. Only 3DES is supported. Note that both sides must use the same Encryption method. •• Authentication Authentication determines a method to authenticate the ESP packets. Either MD5 or SHA1 may be selected. Note that both sides (VPN endpoints) must use the same Authentication method. 4-Port Gigabit Security Router with VPN •• MD5 A one-way hashing algorithm that produces a 128-bit digest. •• SHA1 A one-way hashing algorithm that produces a 160-bit digest. •• Perfect Forward Secrecy If PFS is enabled, IKE Phase 2 negotiation will generate a new key material for IP traffic encryption and authentication. Note that both sides must have this selected. •• Preshared Key IKE uses the Preshared Key field to authenticate the remote IKE peer. Both character and hexadecimal values are acceptable in this field; e.g., "My_@123" or "0x4d795f40313233". Note that both sides must use the same Preshared Key. •• Group The Diffie-Hellman (DH) group to be used for key exchange. Select the 768-bit (Group 1), 1024-bit (Group 2), or 1536-bit (Group 5) algorithm. Group 5 provides the most security, Group 1 the least. •• Key Life Time This specifies the lifetime of the IKEgenerated key. If the time expires, a new key will be renegotiated automatically. Enter a value from 300 to 100,000,000 seconds. The default is 3600 seconds. Status Status Displays the connection status for the selected tunnel. The state is either connected or disconnected. Connect Click this button to establish a connection for the current VPN tunnel. If you have made any changes, click Save Settings first to apply your changes. Disconnect Click this button to break a connection for the current VPN tunnel. View Log Click this button to view the VPN log, which shows details of each tunnel established. Advanced Click this button to display the following additional settings. •• Aggressive Mode This is used to specify the type of Phase 1 exchange, Main mode or Aggressive mode. Check the box to select Aggressive Mode or leave the box unchecked (default) to select Main mode. Aggressive mode requires half of the main mode messages to be exchanged in Phase 1 of the SA exchange. If network security is preferred, select Main mode. •• NetBios Broadcasts Check the box to enable NetBIOS traffic to pass through the VPN tunnel. By default, the RVS4000 blocks these broadcasts. Click Save Settings to save the settings you have entered. Click Cancel Changes to cancel any changes you have entered. 21