VPN close
IKE Policies
The Internet Key Exchange protocol (IKE) is used to automatically exchange keys between two IPsec hosts.
List of IKE Policies
The List of IKE Policies table contains the following fields that define a policy:
Name: A unique name given to the policy for identification and management purposes.
Mode: IKE Exchange Mode can be "Main" or "Aggressive".
Local ID: The IKE/ISAKMP identity of this device.
Remote ID: The IKE/ISAKMP identity of the remote VPN Gateway.
Encr: Encryption Algorithm used for the IKE SA.
Auth: Authentication Algorithm used for the IKE SA.
DH: Diffie-Hellman Group.
Action/Edit: Edit the parameters of an IKE Policy.
Select All: Select all the IKE policies.
Delete: Delete selected IKE policies.
Add: Create a new IKE policy.
Note: If the IKE policy is in use by a VPN Policy, you must disable or delete the VPN policy first and then make changes to the IKE Policy.
Add IKE Policy
To setup an Auto VPN Policy, you first need to create an IKE policy. This page will assist you with creating an IKE policy.
Mode Config Record
Specify whether this IKE policy uses a Mode Config Record (Mode Config Records can be defined on the Mode Config page under the VPN menu). Select the Yes radio button if you would like IP addresses to be assigned to remote VPN Clients. Since Mode Config works only in Aggressive Mode, enabling this will set the tunnel exchange mode to Aggressive Mode and disable Main Mode. Mode Config also requires that both the local and remote ends be defined by their Internet Names (FQDN) only.
Selecting No disables Mode Config for this IKE policy. For more details refer Extended Authentication section at the bottom of the page.
General
Policy Name: A unique name given to the policy for identification and management purposes.
Direction/Type:The connection methods for this router can be one of the following:
v Initiator: The router will initiate the connection to the remote end.
v Responder: The router will wait passively and respond to remote IKE requests.
v Both: The router will work in either Initiator or Responder mode.
Exchange Mode: Main Mode negotiates the tunnel with higher security, but is slower whereas Aggressive Mode establishes a faster connection but with lowered security.
Note: If either the Local or Remote identifier type (defined below) is not an IP address, then negotiation is only possible in Aggressive Mode. If FQDN, User FQDN or DER ASN1 DN are selected, the router will disable Main Mode and set the default to Aggressive Mode.
Local
Identifier Type: The ISAKMP identifier for this router. It can be one of the following:
v IP Address – WAN IP address of this router.
v Internet Address/FQDN
v User FQDN
v DER ASN1 DN
Identifier: The value of the respective option chosen in the Identifier Type drop-list for this router.
Remote
Identifier Type: The ISAKMP identifier for the remote device. It can be one of the following:
v IP Address – WAN IP address of the remote machine
v Internet Address/FQDN
v User FQDN
v DER ASN1 DN
Identifier: The value of the respective option chosen in the Identifier Type drop-list for remote host.
IKE SA Parameters
The Security Association (SA) parameters define the strength and the mode for negotiating the SA. The fields in the SA are:
Encryption Algorithm: The algorithm used to negotiate the SA. There are four algorithms supported by this router: DES, 3DES, AES-128, AES-192, and AES-256.
Authentication Algorithm: Specify the authentication algorithm for the VPN header. There are two algorithms supported by this router: MD5 and SHA-1.
Note: Ensure that the authentication algorithm is configured identically on both sides.
Authentication Type: Select Pre-shared Key for a simple password based key. Selecting RSA-Signature will disable the Pre-shared key text box and uses the Active Self Certificate uploaded in the Certificates page. In that case, a certificate must be configured in order for RSA-Signature to work. -Please Note: Following character is not supported for Pre-shared Key: " (Double -Quote).
Diffie-Hellman (DH) Group: The Diffie-Hellman algorithm is used when exchanging keys. The DH Group sets the strength of the algorithm in bits.
Note: Ensure that the DH Group is configured identically on both sides.
Dead Peer Detection: Dead Peer Detection is used to detect whether the Peer is alive or not, If peer is detected as Dead, deletes the IPSec and IKE Security Association.
Detection Period(secs): Detection Period is the interval between consecutive DPD R-U-THERE messages. DPD R-U-THERE messages are sent only when the IPSec traffic is idle.
Reconnect after failure count: Maximum number of DPD failures allowed before tearing down the connection.
Extended Authentication (XAUTH)
Rather than configuring a unique VPN policy for each user, you can enable the VPN gateway router to authenticate users from a stored list of user accounts or with an external authentication server such as a RADIUS server. When connecting many VPN clients to a VPN gateway router, Extended Authentication (XAUTH) allows authentication of users with methods in addition to the authentication method mentioned in the IKE SA parameters. XAUTH can be configured in the following modes:
v None: This option disables XAUTH.
v Edge Device: Select this option to use this router as a VPN concentrator where one or more gateway tunnels terminate. The authentication modes are:
User Database: User accounts created in the router are used to authenticate users (under the VPN Client menu on the User Database page).
RADIUS: The router will connect to a RADIUS server and pass on the credentials it receives from the VPN Client. The connection between the router and the RADIUS server can be secured with the authentication protocol supported by the server (PAP or CHAP). RADIUS server settings are configured under the VPN Client menu on the RADIUS Client page.
Note: If RADIUS – PAP is selected, the router will first check in the User Database to see if the user credentials are available. If the user account is not present, the router will then connect to the RADIUS server.
v IPSec Host: The router is authenticated by a remote gateway with a username and password combination. In this mode, the router acts as a VPN Client of the remote gateway.
Click Apply to save the settings.
 Click Reset to discard any changes.
 

2010 © Copyright NETGEAR®

close