ZyXEL Communications 794M 7.3.3 Perfect Forward Secrecy (PFS), 7.3.4 Pre-SharedKey, 7.3.5 IPSec VPN Summary, VPN, None, IPSec, IPSec, Create

		Prestige 794M User’s Guide
Table 43 ESP and AH (continued)
	ESP	AH
Authentication	None (default)
	No authentication
	MD5	MD5 (default)
	MD5 (Message Digest 5) produces a	MD5 (Message Digest 5) produces a
	128-bit digest to authenticate packet	128-bit digest to authenticate packet
	data.	data.
	SHA1	SHA1
	SHA1 (Secure Hash Algorithm) produces	SHA1 (Secure Hash Algorithm) produces
	a 160-bit digest to authenticate packet	a 160-bit digest to authenticate packet
	data.	data.
	Select MD5 for minimal security and SHA1 for maximum security.

7.3.3 Perfect Forward Secrecy (PFS)

Enabling PFS means that the key is transient. The key is thrown away and replaced by a brand new key using a new Diffie-Hellman exchange for each new IPSec SA setup. With PFS enabled, if one key is compromised, previous and subsequent keys are not compromised, because subsequent keys are not derived from previous keys. The (time-consuming) Diffie- Hellman exchange is the trade-off for this extra security.

This may be unnecessary for data that does not require such security, so PFS is disabled

(None) by default in the Prestige. Disabling PFS means new authentication and encryption keys are derived from the same root secret (which may have security implications in the long run) but allows faster SA setup (by bypassing the Diffie-Hellman key exchange).

7.3.4 Pre-Shared Key

A pre-shared key identifies a communicating party during a phase 1 IKE negotiation. It is called pre-shared because you have to share it with another party before you can communicate with them over a secure connection.

7.3.5 IPSec VPN Summary

To configure a IPSec VPN rule, click VPN and IPSec in the navigation panel to display the main IPSec screen. Click Create to configure a new IPSec VPN connection.

Figure 58 IPSec Summary

Chapter 7 VPN 84