Casio ISA550WBUN3K9 manual Vpn

VPN	8
Configuring a Site-to-Site VPN

STEP 4 In the Advanced Settings tab, enter the following information:

•PFS Enable: Click On to enable Perfect Forward Secrecy (PFS) to improve security, or click Off to disable it. If you enable PFS, a Diffie-Hellman exchange is performed for every phase-2 negotiation. PFS is desired on the keying channel of the VPN connection.

•DPD Enable: Click On to enable Dead Peer Detection (DPD), or click Off to disable it. DPD is a method of detecting a dead Internet Key Exchange (IKE) peer. This method uses IPsec traffic patterns to minimize the number of messages required to confirm the availability of a peer. DPD is used to reclaim the lost resources in case a peer is found dead and it is also used to perform IKE peer failover. If you enable DPD, enter the following information:

-Delay Time: Enter the value of delay time in seconds between consecutive DPD R-U-THERE messages. DPD R-U-THERE messages are sent only when IPsec traffic is idle. The default value is 10 seconds.

-Detection Timeout: Enter the value of detection timeout in seconds. If no response and no traffic over the timeout, declare the peer dead. The default value is 30 seconds.

-DPD Action: Choose one of the following actions over the detection timeout:

Hold: Traffic from your local network to the remote network can trigger the security appliance to re-initiate the VPN connection over the detection timeout. We recommend that you use Hold when the remote peer uses a static IP address.

Clean: Terminate the VPN connection over the detection timeout. You must manually re-initiate the VPN connection. We recommend that you use Clean when the remote peer uses dynamic IP address.

Restart: Re-initiate the VPN connection for three times over the detection timeout.

•Windows Networking (NetBIOS) Broadcast: Click On to allow access remote network resources by using its NetBIOS name, for example, browsing Windows Neighborhood. NetBIOS broadcasting can resolve a NetBIOS name to a network address. This option allows NetBIOS broadcasts to travel over the VPN tunnel.

•Access Control: When the local network is set as Any, you can control incoming traffic from the remote VPN network to the zones. Click Permit to permit access, or click Deny to deny access. By default, incoming traffic from the remote network to all zones is permitted.

Cisco ISA500 Series Integrated Security Appliances Administration Guide 345