Linksys WAG325N - Manual (Page 21)

Chapter3
Advanced Configuration
20 Wreless-N ADSL2+ Gateway
Authentcaton Authentication acts as another level of
security. There are two types of authentication: MD5 and
SHA (SHA is recommended because it is more secure). As
with encryption, either of these may be selected, provided
that the VPN device at the other end of the tunnel is using
the same type of authentication. Or, both ends of the
tunnel may choose to Disable authentication.
Key Management
In order for any encryption to occur, the two ends of the
tunnel must agree on the type of encryption and the way
the data will be decrypted. This is done by sharing a “key”
to the encryption code. Under Key Management, you may
choose automatic or manual key management.
Auto (IKE) Key Management
Encrypton The Encryption method determines the
length of the key used to encrypt/decrypt ESP packets.
Notice that both sides must use the same method.
Authentcaton The Authentication method authen-
ticates the Encapsulating Security Payload (ESP) packets.
Select MD5 or SHA. Notice that both sides (VPN endpoints)
must use the same method.
MD5 - A one-way hashing algorithm that
produces a 128-bit digest
SHA - A one-way hashing algorithm that produces
a 160-bit digest
Perfect Forward Secrecy (PFS) If PFS is enabled, IKE
Phase 2 negotiation will generate new key material for
IP traffic encryption and authentication. Note that both
sides must have PFS enabled.
Pre-Shared Key IKE uses the Pre-Shared Key to
authenticate the remote IKE peer. Both character and
hexadecimal values are acceptable in this field, e.g., “My_
@123” or “0x4d795f40313233”. Note that both sides must
use the same Pre-Shared Key.
Key Lfetme This field specifies the lifetime of the
IKE generated key. If the time expires, a new key will be
renegotiated automatically. The Key Lifetime may range
from 300 to 100,000,000 seconds. The default lifetime is
3600 seconds.
Manual Key Management
Encrypton Algorthm The Encryption method
determines the length of the key used to encrypt/decrypt
ESP packets. Notice that both sides must use the same
method.
Encrypton Key This field specifies a key used to encrypt
and decrypt IP traffic. Both character and hexadecimal
values are acceptable in this field. Note that both sides
must use the same Encryption Key.
Authentcaton Algorthm The Authentication method
authenticates the Encapsulating Security Payload (ESP)
•
•
packets. Select MD5 or SHA. Notice that both sides (VPN
endpoints) must use the same method.
MD A one-way hashing algorithm that produces a 128-
bit digest
SHA A one-way hashing algorithm that produces a 160-
bit digest
Authentcaton Key This field specifies a key used to
authenticate IP traffic. Both character and hexadecimal
values are acceptable in this field. Note that both sides
must use the same Authentication Key.
Inbound SPI/Outbound SPI The Security Parameter
Index (SPI) is carried in the ESP header. This enables the
receiver to select the SA, under which a packet should
be processed. The SPI is a 32-bit value. Both decimal and
hexadecimal values are acceptable. e.g., “987654321” or
“0x3ade68b1”. Each tunnel must have a unique Inbound
SPI and Outbound SPI. No two tunnels share the same
SPI. Note that the Inbound SPI must match the remote
gateway’s Outbound SPI, and vice versa.
The Status field at the bottom of the screen will show
when a tunnel is active.
To connect a VPN tunnel, click the Connect button. Click
the Dsconnect button to break a connection for the
current VPN tunnel. The Vew Log button, when logging is
enabled on the Log screen of the Administration tab, will
show you VPN activity on a separate screen. The VPN Log
screen displays successful connections, transmissions and
receptions, and the types of encryption used. For more
advanced VPN options, click the Advanced Settngs
button to open the Advanced Settings screen.
Click Save Settngs to apply your changes, or click Cancel
Changes to cancel your changes.
Advanced VPN Tunnel Setup
Advanced VPN Tunnel Setup