Digi ConnectPort X4 Guía de usuario descargar pdf (Pagina 84)

Configuration through the web interface

 ISAKMP Phase 1 Settings

– General Security Settings for Phase 1

Connection Mode: Main|Aggressive: Set the connection mode to match that

configured on the remote VPN device. If aggressive mode is selected, then the VPN

device will try aggressive mode first, and then try main mode if aggressive mode

fails.

Enable Perfect Forward Secrecy (PFS): Set this option to enable PFS. PFS

guarantees that if one key is broken by an attacker, that does not help him to break

another key. PFS is more secure, but slows down the negotiation process. Both the

Digi unit and the remote VPN device must be configured the same way.

– NAT-T Settings

Enable NAT Traversal (NAT-T): Set this option if there is a NAT firewall between

the two VPN devices.

Keep Alive Interval: The amount of time in seconds between NAT keep alive

messages. Once a connection is established through a firewall, the VPN devices

have to send keep alive messages to prevent the NAT firewall from timing out the

connection. Set the interval to a value less than the connection timeout of the NAT

firewall.

– ISAKMP Phase 1 Policies:

Keys are negotiated in two phases. The first phase negotiates the keys and

authentication method to be used to establish the initial ISAKMP connection.

During this phase, the two VPN devices verify each other’s identity and create a

security association (encrypted connection) which is used during phase 2. The

encryption and authentication settings you specify determine the level of security in

the connection the two VPN devices used to communicate with each other.

Select the policies to be used during phase 1 of the ISAKMP negotiation. The most

important thing is to make sure that the Digi unit and the remote VPN device use the

same policies. If more than one policy is specified, the VPN devices will use the

most secure policy that they both have been configured to support.

Pre-shared Key: Using DSS and RSA signatures is more secure than using a pre-

shared key.

Encryption: The encryption type and the length of the key. The longer the key the

more secure it is.

Integrity: The authentication algorithm. The SHA1 algorithm is more secure than

MD5.

SA Lifetime: The maximum length of the phase 1 security association.

Diffie-Hellman: The Diffie-Hellman group to use for key generation. The larger the

group the more secure it is.

1 2 ... 79 80 81 82 83 84 85 86 87 88 89 ... 270 271

Sin comentarios

Digi ConnectPort X4 Guía de usuario Pagina 84