HP X Unified Security Platform Series Instrukcja Użytkownika Pobierz pdf (Strona 221)

IKE Proposal

X Family LSM User’s Guide V 2.5.1 205

Delete Phase 2

SA when Phase

1 SA

terminates

Check this option to delete all Phase 2 security associations if the Phase 1

security association terminates.

If this is selected, it can improve interoperability with VPN devices that

automatically delete all the Phase 2 security associations if the Phase 1 security

association terminates.

IKE Phase 2 Setup:

Specify the parameters the device uses to negotiate phase 2 of the IKE to establishes keying material

for the VPN. Phase 2 is much quicker than Phase 1, since it can rely on the checks established during

Phase 1, without needing to reestablish a shared, secure connection. Phase 2 uses Quick Mode for

packet exchange.

Note If “Automatically connect phase 1 on system start-up” and “automatically connect

phase 2” are both checked in IKE Phase 1 Setup, then after a phase 1 connection is

established, every defined phase 2 connection is negotiated with the peer and brought up.

Traffic can flow through the tunnel without further negotiation.

Encryption &

Integrity

Encryption and Integrity work in combination to provide the degree of security

required. For a list of combinations for IKE Phase 1 and IKE Phase 2, see

“

Encryption & Integrity” on page 202.

Lifetime The duration of IKE Phase 2 (between 1 and 65535 seconds, default 28800). IKE

Phase 2 will time out after this interval expires.

Note This feature must be supported by the device by both VPN devices.

Enable Perfect

Forward

Secrecy

Check this option to enhance VPN security if the remote device also supports the

Perfect Forward Secrecy feature.

Diffe-Hellman

Group

This setting is only required if Perfect Forward Secrecy is enabled.

Diffie-Hellman is the protocol used to establish shared security, in order to

prevent unauthorized access to the key negotiation. The higher the Diffie-

Hellman Group number, the more secure the connection. For interoperability or

export restrictions, you may need to select a lower group number. Supported

groups are:

• 1 (768 bits)

• 2 (1024 bits)

• 5 (1536 bits) (High encryption device only)

Table 7–5: IKE Proposal Phase 1 and Phase 2 Configuration Parameters (Continued)

Parameter Description

1 2 ... 216 217 218 219 220 221 222 223 224 225 226 ... 332 333

Komentarze do niniejszej Instrukcji

Brak uwag

HP X Unified Security Platform Series Instrukcja Użytkownika Strona 221

Komentarze do niniejszej Instrukcji

Powiązane produkty i podręczniki dla Networking HP X Unified Security Platform Series