ZyXEL NBG-460N User Guide - Page 201
VPN Rule Setup Manual
View all ZyXEL NBG-460N manuals
Add to My Manuals
Save this manual to your list of manuals |
Page 201 highlights
Chapter 15 IPSec VPN Table 66 Security > VPN > General > Rule Setup: IKE (Advanced) (continued) LABEL DESCRIPTION Perfect Forward Secrecy (PFS) Select whether or not you want to enable Perfect Forward Secrecy (PFS) and, if you do, which Diffie-Hellman key group to use for encryption. Choices are: None - disable PFS DH1 - enable PFS and use a 768-bit random number DH2 - enable PFS and use a 1024-bit random number Basic... Apply Reset Cancel PFS changes the root key that is used to generate encryption keys for each IPSec SA. It is more secure but takes more time. Click Basic... to go to the previous VPN configuration screen. Click Apply to save the changes. Click Reset to begin configuring this screen afresh. Click Cancel to exit the screen without making any changes. 15.4.3 VPN Rule Setup (Manual) Use this screen to configure VPN rules (tunnels) that use manual keys. Manual key management is useful if you have problems with IKE key management. Select Manual in the IPSec Keying Mode field on the Rule Setup screen to open the screen as shown in Figure 123 on page 202. 15.4.3.1 IPSec SA Using Manual Keys You might set up an IPSec SA using manual keys when you want to establish a VPN tunnel quickly, for example, for troubleshooting. You should only do this as a temporary solution, however, because it is not as secure as a regular IPSec SA. In IPSec SAs using manual keys, the NBG-460N and remote IPSec router do not establish an IKE SA. They only establish an IPSec SA. As a result, an IPSec SA using manual keys has some characteristics of IKE SA and some characteristics of IPSec SA. There are also some differences between IPSec SA using manual keys and other types of SA. 15.4.3.2 IPSec SA Proposal Using Manual Keys In IPSec SA using manual keys, you can only specify one encryption algorithm and one authentication algorithm. There is no DH key exchange, so you have to provide the encryption key and the authentication key the NBG-460N and remote IPSec router use. Note: The NBG-460N and remote IPSec router must use the same encryption key and authentication key. NBG-460N User's Guide 201