FVS338 ProSafe VPN Firewall 50 Re ference Manual
5-28 Virtual Private Networking
v1.0, March 2008
2. Click Add to configure a new IKE Policy. The Add IKE Policy screen will display.
3. Enable Mode Config by checking the Yes radio box and selecting the Mode Config record
you just created from the pull-down menu. (You can view the parameters of the selected record
by clicking the View selected radio box.)
Mode Config works only in Aggressive Mode, and Aggressive Mode requires that both ends
of the tunnel be defined by a FQDN.
4. In the General section:
a. Enter a description name in the Policy Name Field such as “salesperson”. This name will
be used as part of the remote identifier in the VPN client configuration.
b. Set Direction/Type to Responder.
c. By default, the Exchange Mode is set to Aggressive.
5. For Local information:
d. Select Fully Qualified Domain Name for the Local Identity Type.
e. Enter an identifier in the Remote Identity Data field that is not used by any other IKE
policies. This identifier will be used as part of the local identifier in the VPN client
configuration.
6. Specify the IKE SA parameters. These settings must be matched in the configuration of the
remote VPN client. Recommended settings are:
• Encryption Algori thm: 3DES
• Authentication Algorithm: SHA-1
• Diffie-Hellman: Group 2
• SA Lifetime: 360 0 seconds
7. Enter a Pre-Shared Key that will also be configured in the VPN client.
8. XAUTH is disabled by default. To enable XAUTH, select:
•the Edge Device radio button to use this router as a VPN concentrator where one or more
gateway tunnels terminate. (If selected, you must specify the Authentication Type to be
used in verifying credentials of the remote VPN gateways.)
•the IPsec Host radio button if you want this g ateway to be authenticated by the remote
gateway. Enter a Username and Password to be associated with the IKE policy. When this
option is chosen, you will need to specify the user name and password to be used in
authenticating this gateway (by the remote gateway).