Cisco Systems OL-5490-01 manual VPN Client IPSec Attributes, IPSec Attribute Description

Chapter 1 Understanding the VPN Client

VPN Client Features

Table 1-4 IPSec Features (continued)

IPSec Feature	Description
Split tunneling	The ability to simultaneously direct packets over the Internet in
	clear text and encrypted through an IPSec tunnel. The VPN device
	supplies a list of networks to the VPN Client for tunneled traffic.
	You enable split tunneling on the VPN Client and configure the
	network list on the VPN device.
Support for Split DNS	The ability to direct DNS packets in clear text over the Internet to
	domains served through an external DNS (serving your ISP) or
	through an IPSec tunnel to domains served by the corporate DNS.
	The VPN server supplies a list of domains to the VPN Client for
	tunneling packets to destinations in the private network. For
	example, a query for a packet destined for corporate.com would go
	through the tunnel to the DNS that serves the private network, while
	a query for a packet destined for myfavoritesearch.com would be
	handled by the ISP's DNS. This feature is configured on the VPN
	server (VPN Concentrator) and enabled on the VPN Client by
	default. To use Split DNS, you must also have split tunneling
	configured.

VPN Client IPSec Attributes

The VPN Client supports the IPSec attributes listed in Table 1-5.

Table 1-5 IPSec Attributes

IPSec Attribute	Description
Main Mode and Aggressive	Ways to negotiate phase one of establishing ISAKMP Security
Mode	Associations (SAs)
Authentication algorithms	• HMAC (Hashed Message Authentication Coding) with MD5
		(Message Digest 5) hash function
	• HMAC with SHA-1 (Secure Hash Algorithm) hash function
Authentication Modes	•	Preshared Keys
	•	Mutual Group Authentication
	•	X.509 Digital Certificates
Diffie-Hellman Groups	• Group 1 = 768-bit prime modulus
	• Group 2 = 1024-bit prime modulus
	• Group 5 = 1536 prime modulus
		Note See the Cisco VPN Client Administrator Guide for more
			information about DH Group 5.
Encryption algorithms	• 56-bit DES (Data Encryption Standard)
	•	168-bit Triple-DES
	• AES 128-bit and 256-bit

VPN Client User Guide for Mac OS X

1-6 OL-5490-01