Amer Networks E5Web GUI - Manual (Page 587)

authentication.
The algorithms supported by Clavister Security Gateway
VPNs are:
• SHA1
• MD5
IPsec Lifetime This is the lifetime of the VPN connection. It is specified in
both time (seconds) and data amount (kilobytes). Whenever
either of these values is exceeded, a re-key will be initiated,
providing new IPsec encryption and authentication session
keys. If the VPN connection has not been used during the
last re-key period, the connection will be terminated, and
re-opened from scratch when the connection is needed
again.
This value must be set lower than the IKE lifetime.
Diffie-Hellman Groups
Diffie-Hellman (DH) is a cryptographic protocol that allows two parties that have no prior
knowledge of each other to establish a shared secret key over an insecure communications
channel through a series of plain text exchanges. Even though the exchanges between the
parties might be monitored by a third party, Diffie-Hellman makes it extremely difficult for the
third party to determine what the agreed shared secret key is and to decrypt data that is
encrypted using the key.
Diffie-Hellman is used to establish the shared secret keys for IKE, IPsec and PFS.
The Diffie-Hellman group indicates the degree of security used for DH exchanges. The higher the
group number, the greater the security but also the processing overhead. The DH groups
supported by cOS Core are as follows:
• DH group 1 (768-bit)
• DH group 2 (1024-bit)
• DH group 5 (1536-bit)
All these DH groups are available for use with IKE, IPsec and PFS.
9.3.3. IKE Authentication
Manual Keying
The "simplest" way of configuring a VPN is by using a method called manual keying. This is a
method where IKE is not used at all; the encryption and authentication keys as well as some
other parameters are directly configured on both sides of the VPN tunnel.
Note
cOS Core does not support manual keying.
Chapter 9: VPN
587