NETGEAR UTM10EW-100NAS manual Group 1 768 bit, Group 5 1536 bit, Configuring Keepalives, Dead Peer

ProSecure Unified Threat Management UTM10 or UTM25 Reference Manual

Table 7-10. Add IKE Policy Settings (continued)

Item	Description (or Subfield and Description)
Authentication Algorithm	From the pull-down menu, select one of the following two algorithms to use
	in the VPN header for the authentication process:
	• SHA-1. Hash algorithm that produces a 160-bit digest. This is the default
	setting.
	• MD5. Hash algorithm that produces a 128-bit digest.
Authentication Method	Select one of the following radio buttons to specify the authentication
	method:
	• Pre-shared key. A secret that is shared between the UTM and the remote
	endpoint.
	• RSA-Signature. Uses the active Self Certificate that you uploaded on the
	Certificates screen (see “Managing Self Certificates” on page 9-20). The
	Pre-shared key is masked out when you select the RSA-Signature option.
	Pre-shared key	A key with a minimum length of 8 characters no more
		than 49 characters. Do not use a double quote (“) in the
		key.
Diffie-Hellman (DH)	The DH Group sets the strength of the algorithm in bits. The higher the
Group	group, the more secure the exchange. From the pull-down menu, select one
	of the following three strengths:
	• Group 1 (768 bit).
	• Group 2 (1024 bit). This is the default setting.
	• Group 5 (1536 bit).
	Note: Ensure that the DH Group is configured identically on both sides.
SA-Lifetime (sec)	The period in seconds for which the IKE SA is valid. When the period times
	out, the next rekeying must occur. The default is 28800 seconds (8 hours).
Enable Dead Peer	Select a radio button to specify whether or not Dead Peer Detection (DPD) is
Detection	enabled:
Note: See also	• Yes. This feature is enabled: when the UTM25 detects an IKE connection
	failure, it deletes the IPsec and IKE SA and forces a reestablishment of the
“Configuring Keepalives	connection. You must enter the detection period and the maximum number
and Dead Peer	of times that the UTM attempts to reconnect (see below).
Detection” on page 7-54.	• No. This feature is disabled. This is the default setting.
	Detection Period	The period in seconds between consecutive
		“DPD R-U-THERE” messages, which are sent only when
		the IPsec traffic is idle.
	Reconnect after	The maximum number of times that the UTM attempts to
	failure count	reconnect after a DPD situation. When the maximum
		number of times is exceeded, the IPsec connection is
		terminated.

7-28 Virtual Private Networking Using IPsec Connections

v1.0, September 2009