Motorola SURFBOARD SVG2500 - Manual (Page 128)

10 SVG2500 VPN PAGES
113
Field Description
IPsec Settings With VPN tunnels, there are two phases of Security Association
(SA). Phase 1 is used to create an IKE SA. After Phase 1 is
completed, Phase 2 is used to create one or more IPSEC SAs,
which are then used to key IPSEC sessions.
Pre-shared key If one side of the VPN tunnel is using a unique firewall identifier (or
Pre-shared Key), the firewall identifier or Pre-shared Key should be
entered in the "Pre-shared Key" field.
Phase 1 DH group There are three Diffie-Hellman groups to choose from: 768 bits,
1024 bits, and 1536 bits.
Diffie-Hellman is a cryptographic technique that uses public and
private keys for encryption and decryption. The higher the number
of bits selected from the options list, the more secure the
encryption. Options: Group 1 (768 bits), Group 2 (1024 bits), or
Group 5 (1536 bits).
Phase 1 encryption Encryption is used to secure the VPN connection between
endpoints. Five different types of encryption are available: DES,
3DES, AES-128, AES-192, and AES-256. Any form off encryption
may be selected as long as the far endpoint matches. One of the
more common settings here is 3DES; however, AES is also a very
strong encryption method.
Phase 1 authentication Authentication acts as another level of security. The two types of
authentication available are MD5 and SHA. SHA is recommended
because it is more secure. Either authentication type may be used
as long as the other end of the VPN tunnel uses the same method.
Phase 1 SA lifetime Specifies the lifetime of individual rotating keys.
Enter the desired number of seconds for the key to last until a re-
key negotiation between each endpoint is negotiated. The default
setting is 28,800 seconds.
A smaller lifetime is generally more secure, since it would give an
attacker a smaller amount of time to try to crack the key, but key
negotiation does take up bandwidth, so network throughput will be
sacrificed with small lifetimes. Entries here are typically in the
thousands or tens of thousands of seconds.