ZyWALL 2 Series User’s Guide
VPN/IPSec Setup
37-13
Table 37-3
Menu 27.1.1.1: IKE Setup
FIELD DESCRIPTION
EXAMPLE
Encryption
Algorithm
When
DES
is used for data communications, both sender and receiver must
know the same secret key, which can be used to encrypt and decrypt the
message or to generate and verify a message authentication code. ZyWALL
DES
encryption algorithm uses a 56-bit key.
Triple DES (
3DES
), is a variation on DES that uses a 168-bit key. As a result,
3DES
is more secure than
DES
. It also requires more processing power,
resulting in slightly increased latency and decreased throughput.
This implementation of AES uses a 128-bit key.
AES
is faster than
3DES
.
Press [SPACE BAR] to choose from
DES
,
3DES
or
AES
and then press
[ENTER].
DES
Authentication
Algorithm
MD5
(Message Digest 5) and
SHA1
(Secure Hash Algorithm) are hash
algorithms used to authenticate packet data. The
SHA1
algorithm is generally
considered stronger than
MD5
, but is slightly slower.
Press [SPACE BAR] to choose from
SHA1
or
MD5
and then press [ENTER].
SHA1
SA Life Time
(Seconds)
Define the length of time before an IKE Security Association automatically
renegotiates in this
field. It
may range from 180 to 3,000,000 seconds (almost
35 days).
A short
SA Life Time
increases security by forcing the two VPN gateways to
update the encryption and authentication keys. However, every time the VPN
tunnel renegotiates, all users accessing remote resources are temporarily
disconnected.
28800
(default)
Key Group You must choose a key group for phase 1 IKE setup.
DH1
(default)
refers to
Diffie-Hellman Group 1 a 768 bit random number.
DH2
refers to Diffie-Hellman
Group 2 a 1024 bit (1Kb) random number.
DH1
Phase 2
Active Protocol Press [SPACE BAR] to choose from
ESP
or
AH
and then press [ENTER]. See
earlier for a discussion of these protocols.
ESP
Encryption
Algorithm
Press [SPACE BAR] to choose from
NULL
,
DES
,
3DES
or
AES
and then
press [ENTER]. Select
NULL
to set up a tunnel without encryption.
DES
Authentication
Algorithm
Press [SPACE BAR] to choose from
SHA1
or
MD5
and then press [ENTER].
MD5
SA Life Time
(Seconds)
Define the length of time before an IPSec Security Association automatically
renegotiates in this
field. It
may range from 180 to 3,000,000 seconds (almost
35 days).
28800
(default)