Netgear SRX5308 Specifications download pdf (Page 182)

Virtual Private Networking Using IPSec Connections

182

ProSafe Gigabit Quad WAN SSL VPN Firewall SRX5308

Remote

Identifier Type From the drop-down list, select FQDN.

Note: Mode Config requires that the remote end is defined by an FQDN.

Identifier Enter the FQDN for the remote end. This needs to be an

FQDN that is not used in any other IKE policy. In this example,

we are using client.com.

IKE SA Parameters

Note: Generally, the default settings work well for a Mode Config configuration.

Encryption Algorithm From the drop-down list, select the 3DES algorithm to negotiate the security

association (SA).

Authentication

Algorithm

From the drop-down list, select the SHA-1 algorithm to be used in the VPN header

for the authentication process.

Authentication Method Select Pre-shared key as the authentication method, and enter a key in the

Pre-shared key field.

Pre-shared key A key with a minimum length of 8 characters and no more than

49 characters. Do not use a double quote (“) in the key. In this

example, we are using H8!spsf3#JYK2!.

Diffie-Hellman (DH)

Group

The DH Group sets the strength of the algorithm in bits. From the drop-down list,

select Group 2 (1024 bit).

SA-Lifetime (sec) The period in seconds for which the IKE SA is valid. When the period times out,

the next rekeying needs to occur. The default is 28800 seconds (8 hours).

However, for a Mode Config configuration, NETGEAR recommends 3600 seconds

(1 hour).

Enable Dead Peer

Detection

Note: See also

Configure

Keep-alives and

Dead Peer Detection

on page 191.

Select a radio button to specify whether or not Dead Peer Detection (DPD) is

enabled:

• Yes. This feature is enabled. When the VPN firewall detects an IKE connection

failure, it deletes the IPSec and IKE SA and forces a reestablishment of the

connection. You need to specify the detection period in the Detection Period field

and the maximum number of times that the VPN firewall attempts to reconnect in

the Reconnect after failure count field.

• No. This feature is disabled. This is the default setting.

Detection Period The period in seconds between consecutive

DPD R-U-THERE messages, which are sent only when the

IPSec traffic is idle. The default setting is 10 seconds. In this

example, we are using 30 seconds.

Reconnect after

failure count

The maximum number of DPD failures before the VPN firewall

tears down the connection and then attempts to reconnect to

the peer. The default is 3 failures.

Table 44. Add IKE Policy screen settings for a Mode Config configuration (continued)

Settings Description

1 2 ... 177 178 179 180 181 182 183 184 185 186 187 ... 356 357

Comments to this Manuals

No comments

Netgear SRX5308 Specifications Page 182

Comments to this Manuals