Filter
Top Products
Virtual Private Networking Using IPSec and L2TP Connections
250
ProSafe Gigabit Quad WAN SSL VPN Firewall SRX5308
IKE SA Parameters
Note: Generally, the default settings work wel
l for a Mode Config configuration.
Encryption Algorithm To negotiate the security association (SA), from the drop-down list, select the
3DES algorithm.
Authentication
Algorithm
From the drop-down list, select the SHA-1 a
lgorithm to be used in the VPN header
for the authentication process.
Authentication Method Select Pre-shared key as the authentication method, and enter a key in the
Pre-shared key field.
Pre-shared key A key with a minimum length of 8 characters and no more than
49
characters. Do not use a double quote (''), single quote('),
or space in the key. This example uses H8!spsf3#JYK2!.
Diffie-Hellman (DH)
Group
The DH Group sets the strength of the algorithm
in bits. From the drop-down list,
select Group 2 (1024 bit).
SA-Lifetime (sec) The period in seconds for which the IKE SA is valid. When the period times out, the
ne
xt rekeying occurs. The default setting is 28800 seconds (8 hours). However, for
a Mode Config configuration, NETGEAR recommends 3600 seconds (1 hour).
Enable Dead Peer
De
tection
Note: See also
Configure
Keep-Alives and
Dead Peer Detection
on page 259.
Select a radio button to specify whether Dead Peer Detection (DPD) is enabled:
• Ye
s. This feature is enabled. When the VPN firewall detects an IKE connection
failure, it deletes the IPSec and IKE SA and forces a reestablishment of the
connection. You need to specify the detection period in the Detection Period field
and the maximum number of times that the VPN firewall attempts to reconnect in
the Reconnect after failure count field.
• No. Th
is feature is disabled. This is the default setting.
Detection Period The period in seconds between consecutive
DPD R-U-THERE messages, which are sent only when the
IPSec
traffic is idle. The default setting is 10 seconds. This
example uses 30 seconds.
Reconnect after
fail
ure count
The maximum number of DPD failures before the VPN firewall
tears down the connection and then attempts to reconnect to
the peer. The default setting is 3 failures.
Table 59. Add IKE Policy screen settings for a Mode Config configuration (continued)
Setting Description