HP 635n HP Jetdirect Print Server Administrator's Guide (Firmware V.36) - Page 120

IKEv1 Phase 2 / Quick Mode (IPsec Protocols), Advanced IKE Settings

Get HP 635n - JetDirect IPv6/IPsec Print Server PDF manuals and user guides
UPC - 882780301016
View all HP 635n manuals
Add to My Manuals
Save this manual to your list of manuals

Page 120 highlights

IKEv1 Phase 2 / Quick Mode (IPsec Protocols) Items on this page are described below. Table 5-12 IKEv1 Phase 2 / Quick Mode Settings (IPsec Protocols) page Item Description Encapsulation Type Specify how the IPsec protocols selected (ESP or AH) will be encapsulated: ● Transport (default): Only the user data in each IP packet is protected, the IP packet header is not protected. ● Tunnel: All packet fields are protected, including the IP packet header. Cryptographic Parameters Select the encryption methods and strengths, and the authentication methods to be used ● ESP: Use IPsec Encapsulating Security Payload (ESP) protocol for IP packets. ESP headers are inserted in packets to ensure privacy and integrity of packet contents. Select among the supported encryption methods/strengths and authentication methods to be used for data protection. ● AH: Use IPsec Authentication Header (AH) protocol for IP packets. AH headers are inserted in packets to protect integrity of packet contents through cryptographic checksums. Select among the supported authentication methods. CAUTION: The use of IPsec AH may not function properly in environments that use Network Address Translation (NAT). Security Association Advanced IKE Settings button NOTE: ESP authentication cannot be used if AH is enabled. If you enable ESP and AH, you must select AH authentication methods. SA Lifetime: Specify the Security Association lifetime, either in seconds, in the number of kilobytes (KB), or both. Within the limits specified, shorter lifetimes will provide improved security depending on the frequency of SA use. Use "0" to disable. Click this button to configure advanced IKE settings. Advanced IKE Settings The Advanced IKE Settings page contains the configuration settings described below. Table 5-13 Advanced IKE Settings page Item Description Replay Detection IPsec protocols support anti-replay services that prevent message interception for later use (for example, to gain access to resources). Enable or disable the IPsec anti-replay algorithm. Key Perfect Forward Secrecy (Session PFS) When secret keys are periodically replaced, Perfect Forward Secrecy (PFS) indicates that the new keys are independently derived and unrelated to the prior keys. This helps to ensure that data protected by the new keys is secure. While PFS provides additional security, it requires additional processing overhead. Enable or disable Session PFS for key protection as desired. Diffie-Hellman Groups: (For Session PFS only) Multiple well-known Diffie-Hellman groups that will be used are listed. To change the entries in the list, click Edit. 110 Chapter 5 IPsec/Firewall Configuration (V.36.xx) ENWW

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
  • 173
  • 174
  • 175
  • 176
  • 177
  • 178
  • 179
  • 180
  • 181
  • 182
  • 183
  • 184
  • 185
  • 186
  • 187
  • 188
  • 189
  • 190
  • 191
  • 192
  • 193
  • 194
  • 195
  • 196
  • 197
  • 198
  • 199
  • 200
  • 201
  • 202
IKEv1 Phase 2 / Quick Mode (IPsec Protocols)
Items on this page are described below.
Table 5-12
IKEv1 Phase 2 / Quick Mode Settings (IPsec Protocols) page
Item
Description
Encapsulation Type
Specify how the IPsec protocols selected (ESP or AH) will be encapsulated:
●
Transport
(default): Only the user data in each IP packet is protected, the IP
packet header is not protected.
●
Tunnel
: All packet fields are protected, including the IP packet header.
Cryptographic Parameters
Select the encryption methods and strengths, and the authentication methods to be
used
●
ESP
: Use IPsec Encapsulating Security Payload (ESP) protocol for IP packets.
ESP headers are inserted in packets to ensure privacy and integrity of packet
contents. Select among the supported encryption methods/strengths and
authentication methods to be used for data protection.
●
AH
: Use IPsec Authentication Header (AH) protocol for IP packets. AH headers
are inserted in packets to protect integrity of packet contents through cryptographic
checksums. Select among the supported authentication methods.
CAUTION:
The use of IPsec AH may not function properly in
environments that use Network Address Translation (NAT).
NOTE:
ESP
authentication cannot be used if
AH
is enabled. If you enable
ESP
and
AH
, you must select
AH
authentication methods.
Security Association
SA Lifetime
: Specify the Security Association lifetime, either in seconds, in the number
of kilobytes (KB), or both. Within the limits specified, shorter lifetimes will provide
improved security depending on the frequency of SA use.
Use “0” to disable.
Advanced IKE Settings
button
Click this button to configure advanced IKE settings.
Advanced IKE Settings
The
Advanced IKE Settings
page contains the configuration settings described below.
Table 5-13
Advanced IKE Settings page
Item
Description
Replay Detection
IPsec protocols support anti-replay services that prevent message interception for later
use (for example, to gain access to resources). Enable or disable the IPsec anti-replay
algorithm.
Key Perfect Forward Secrecy
(Session PFS)
When secret keys are periodically replaced, Perfect Forward Secrecy (PFS) indicates
that the new keys are independently derived and unrelated to the prior keys. This helps
to ensure that data protected by the new keys is secure. While PFS provides additional
security, it requires additional processing overhead.
Enable or disable Session PFS for key protection as desired.
Diffie-Hellman Groups
: (For Session PFS only) Multiple well-known Diffie-Hellman
groups that will be used are listed. To change the entries in the list, click
Edit
.
110
Chapter 5
IPsec/Firewall Configuration (V.36.xx)
ENWW