Configuration | System | Tunneling Protocols | IPSec LAN-to-LAN | Add or Modify
7-13
VPN 3000 Concentrator Series User Guide
Digital Certificate
This parameter specifies whether to use preshared keys or a PKI (Public Key Infrastructure) digital
identity certificate to authenticate the peer during Phase 1 IKE negotiations. See the discussion under
Administration | Certificate Management.
Click the drop-down menu button and select the option. The list shows any digital certificates that have
been installed, plus:
None (Use Preshared Keys) = Use only preshared keys to authenticate the peer during Phase 1 IKE
negotiations. This is the default selection.
Preshared Key
Enter a preshared key for this connection. Use a minimum of 4, a maximum of 32 alphanumeric
characters; e.g, sZ9s14ep7. The system displays your entry in clear text. Even if you use a PKI digital
certificate, enter a key in this field.
This key becomes the password for the IPSec LAN-to-LAN group that is created, and you must enter the
same key on the peer VPN Concentrator. (This is not a manual encryption or authentication key. The
system automatically generates those session keys.)
Authentication
This parameter specifies the data, or packet, authentication algorithm. Packet authentication proves that
data comes from whom you think it comes from; it is often referred to as “data integrity” in VPN
literature. The IPSec ESP (Encapsulating Security Payload) protocol provides bot h encryption and
authentication.
Click the drop-down menu button and select the algorithm:
None = No data authentication.
ESP/MD5/HMAC-128 = ESP protocol using HMAC (Hashed Message Authentication Coding) w ith the
MD5 hash function using a 128-bit key. This is the default selection.
ESP/SHA/HMAC-160 = ESP protocol using HMAC with the SHA-1 hash function using a 160-bit key.
This selection is more secure but requires more processing overhead.
Encryption
This parameter specifies the data, or packet, encryption algorithm. Data encryption makes the data
unreadable if intercepted.
Click the drop-down menu button and select the algorithm:
Null = Use ESP without encryption; no packet encryption.
DES-56 = Use DES encryption with a 56-bit key.
3DES-168 = Use Triple-DES encryption with a 168-bit key. This selection is the most secure and it is
the default selection.