HP 630n HP Jetdirect Print Servers - Administrator's Guide - Page 118

Table 5-10 Kerberos Settings page (continued) Item Description A unique principal name is associated with each Kerberos account. For the HP Jetdirect print server active directory account, the principal is the user name for the print server. A Kerberos realm is similar in concept to a Windows domain and contains all the users, computers and services within a Kerberos installation. The realm is case-sensitive, and is typically the DNS domain name specified in all uppercase characters. For example, if the domain name is hp.com, the realm is HP.COM. Password Password for the HP Jetdirect account configured on active directory. Encryption Type Encryption type supported by the HP Jetdirect print server. Key Version Number Version number for the encryption keys associated with the principal and password. Clock Skew Clock skew is a measure of allowed differences between clocks during transactions. A Kerberos installation uses clocks that are reasonably synchronized. When the HP Jetdirect print server checks time stamps of incoming packets from clients, the clock skew specifies the time interval (in seconds) within which the HP Jetdirect print server accepts a packet. If the time interval is exceeded, the packet is discarded. NOTE: Timing differences between the HP Jetdirect print server and a domain controller depends on the clock skew configuration on the domain controller. Time Sync Period Time interval (in minutes) that the HP Jetdirect print server requests to synchronize its clock with an SNTP time server. SNTP Server FQDN or IP address of an SNTP time server, if required. By default, the SNTP server is the server used as the KDC. IKEv1 Phase 1 (Authentication) Use IKE to create security associations dynamically. Configure SA parameters for authentication and to securely generate IPsec session keys for encryption and authentication algorithms. Items on this page are described in the following table. Table 5-11 IKE Phase 1 (Authentication) page Item Description Negotiation Mode (Required) IKE provides two modes of negotiation during an exchange for keys and security services to be used for a Security Association: Main Uses identity protection between the hosts. This method is slower but secure. Aggressive Uses half the message exchanges. It is faster, but less secure. Cryptographic Parameters (Required) Diffie-Hellman Groups Allows a secret key and security services to be securely exchanged between two hosts over an unprotected network. A Diffie-Hellman group determines the parameters to use during a Diffie-Hellman exchange. Multiple well-known Diffie-Hellman groups are listed. To change the entries in the list, click Edit. Selecting all the groups results in a single negotiated group. Encryption and Authentication (Required) Encryption methods and strengths, and the authentication methods to use. Selecting all the methods results in a single negotiated method. Security Association (Required) IKEv1 Phase 2 / Quick Mode (IPsec Protocols) Items on this page are described in the following table. 108 Chapter 5 IPsec/Firewall configuration (V.38.xx) ENWW