ProSafe Wireless-N 8-Port Gigabit VPN Firewall FVS318N

Table 52. Add IKE Policy screen settings (continued)

Setting

Description

 

 

 

Authentication Method

Select one of the following radio buttons to specify the authentication method:

 

Pre-shared key. A secret that is shared between the wireless VPN firewall and

 

the remote endpoint.

 

RSA-Signature. Uses the active self-signed certificate that you uploaded on the

 

Certificates screen (see Manage VPN Self-Signed Certificates on page 316).

 

The pre-shared key is masked out when you select RSA-Signature.

 

 

 

 

Pre-shared key

A key with a minimum length of 8 characters and no more

 

 

than 49 characters. Do not use a double quote (''), single

 

 

quote('), or space in the key.

 

 

 

Diffie-Hellman (DH)

The DH Group sets the strength of the algorithm in bits. The higher the group, the

Group

more secure the exchange. From the drop-down list, select one of the following

 

three strengths:

 

 

Group 1 (768 bit).

 

Group 2 (1024 bit). This is the default setting.

 

Group 5 (1536 bit).

 

Note: Ensure that the DH Group is configured identically on both sides.

 

 

SA-Lifetime (sec)

The period in seconds for which the IKE SA is valid. When the period times out,

 

the next rekeying occurs. The default is 28800 seconds (8 hours).

 

 

Enable Dead Peer

Select a radio button to specify whether Dead Peer Detection (DPD) is enabled:

Detection

Yes. This feature is enabled. When the wireless VPN firewall detects an IKE

 

connection failure, it deletes the IPSec and IKE SA and forces a reestablishment

Note: See also

of the connection. You need to specify the detection period in the Detection

Period field and the maximum number of times that the wireless VPN firewall

Configure Keep-Alives

attempts to reconnect in the Reconnect after failure count field.

and Dead Peer

No. This feature is disabled. This is the default setting.

Detection on

 

 

 

 

page 259.

Detection Period

The period in seconds between consecutive

 

 

DPD R-U-THERE messages, which are sent only when the

 

 

IPSec traffic is idle.

 

 

 

 

Reconnect after

The maximum number of DPD failures before the wireless

 

failure count

VPN firewall tears down the connection and then attempts to

 

 

reconnect to the peer. The default is 3 failures.

 

 

 

Virtual Private Networking Using IPSec and L2TP Connections

228

Page 228
Image 228
NETGEAR FVS318N manual 228, Group 1 768 bit, Group 5 1536 bit, Dead Peer, Detection on