P-334U/P-335U User’s Guide

Table 53 Security > VPN > Rule Setup: IKE (Advanced) (continued)

LABEL

DESCRIPTION

IPSec Protocol

Select the security protocols used for an SA.

 

Both AH and ESP increase processing requirements and communications

 

latency (delay).

 

If you select ESP here, you must select options from the Encryption Algorithm

 

and Authentication Algorithm fields (described below).

 

 

Encryption Algorithm

Select which key size and encryption algorithm to use in the IKE SA. Choices

 

are:

 

DES - a 56-bit key with the DES encryption algorithm

 

3DES - a 168-bit key with the DES encryption algorithm

 

The ZyXEL Device and the remote IPSec router must use the same algorithms

 

and keys. Longer keys require more processing power, resulting in increased

 

latency and decreased throughput.

 

 

Authentication

Select which hash algorithm to use to authenticate packet data in the IPSec SA.

Algorithm

Choices are SHA1 and MD5. SHA1 is generally considered stronger than MD5,

 

but it is also slower.

 

 

SA Life Time

Define the length of time before an IPSec SA automatically renegotiates in this

 

field. The minimum value is 180 seconds.

 

A short SA Life Time increases security by forcing the two VPN gateways to

 

update the encryption and authentication keys. However, every time the VPN

 

tunnel renegotiates, all users accessing remote resources are temporarily

 

disconnected.

 

 

Perfect Forward

Select whether or not you want to enable Perfect Forward Secrecy (PFS) and, if

Secret (PFS)

you do, which Diffie-Hellman key group to use for encryption. Choices are:

 

None - disable PFS

 

DH1 - enable PFS and use a 768-bit random number

 

DH2 - enable PFS and use a 1024-bit random number

 

PFS changes the root key that is used to generate encryption keys for each

 

IPSec SA. It is more secure but takes more time.

 

 

Basic...

Click Basic... to go to the previous VPN configuration screen.

 

 

Apply

Click Apply to save the changes.

 

 

Reset

Click Reset to begin configuring this screen afresh.

 

 

13.6 IPSec SA Using Manual Keys

You might set up an IPSec SA using manual keys when you want to establish a VPN tunnel quickly, for example, for troubleshooting. You should only do this as a temporary solution, however, because it is not as secure as a regular IPSec SA.

In IPSec SAs using manual keys, the ZyXEL Device and remote IPSec router do not establish an IKE SA. They only establish an IPSec SA. As a result, an IPSec SA using manual keys has some characteristics of IKE SA and some characteristics of IPSec SA. There are also some differences between IPSec SA using manual keys and other types of SA.

Chapter 13 IPSec VPN

159