NETGEAR UTM5EW-100NAS, STM150EW-100NAS manual 298

ProSecure Unified Threat Management (UTM) Appliance

Table 72. Add IKE Policy screen settings (continued)

Setting	Description
Authentication Method	Select one of the following radio buttons to specify the authentication method:
	• Pre-shared key. A secret that is shared between the UTM and the remote
		endpoint.
	• RSA-Signature. Uses the active self-signed certificate that you uploaded on
		the Certificates screen (see Manage Self-Signed Certificates on page 422).
		The pre-shared key is masked out when you select RSA-Signature.
	Pre-shared key		A key with a minimum length of 8 characters and no more
			than 49 characters. Do not use a double quote (“) in the key.
Diffie-Hellman (DH)	The DH Group sets the strength of the algorithm in bits. The higher the group, the
Group	more secure the exchange. From the drop-down list, select one of the following
	strengths:
	• Group 1 (768 bit).
	• Group 2 (1024 bit). This is the default setting.
	• Group 5 (1536 bit).
	•	Group 14 (2048 bit).
	•	Group 15 (3072 bit).
	•	Group 16 (4096 bit).
		Note: Ensure that the DH Group is configured identically on both sides.
SA-Lifetime (sec)	The period in seconds for which the IKE SA is valid. When the period times out,
	the next rekeying occurs. The default is 28800 seconds (8 hours).
Enable Dead Peer	Select a radio button to specify whether Dead Peer Detection (DPD) is enabled:
Detection	• Yes. This feature is enabled. When the UTM detects an IKE connection
		failure, it deletes the IPSec and IKE SA and forces a reestablishment of the
Note: See also		connection. You need to specify the detection period in the Detection Period
		field and the maximum number of times that the UTM attempts to reconnect in
Configure Keep-Alives		the Reconnect after failure count field.
and Dead Peer	•	No. This feature is disabled. This is the default setting.
Detection on
page 328.	Detection Period		The period in seconds between consecutive
			DPD R-U-THERE messages, which are sent only when the
			IPSec traffic is idle.
	Reconnect after		The maximum number of DPD failures before the UTM tears
	failure count		down the connection and then attempts to reconnect to the
			peer. The default is 3 failures.

Virtual Private Networking Using IPSec, PPTP, or L2TP Connections

298