fortigate-ipsec-40-mr3

Advanced section of New Phase 2 page
P2 Proposal
Encryption
Authentication
Enable replay
detection
Enable perfect
forward
secrecy (PFS)
DH Group
Keylife
Autokey Keep
Alive
IPsec VPN in the web-based manager
Select the encryption and authentication algorithms that will be
proposed to the remote VPN peer. You can specify up to three
proposals. To establish a VPN connection, at least one of the
proposals that you specify must match configuration on the remote
peer.
Initially there are two proposals. Add and Delete icons are next to the
second Authentication field.
It is invalid to set both Encryption and Authentication to NULL.
Select one of the following symmetric-key algorithms:
NULL — Do not use an encryption algorithm.
DES — Digital Encryption Standard, a 64-bit block algorithm that
uses a 56-bit key.
3DES — Triple-DES, in which plain text is encrypted three times by
three keys.
AES128 — a 128-bit block Cipher Block Chaining (CBC) algorithm
that uses a 128-bit key.
AES192 — a 128-bit block CBC algorithm that uses a 192-bit key.
AES256 — a 128-bit block CBC algorithm that uses a 256-bit key.
Select one of the following message digests to check the authenticity
of messages during an encrypted session:
NULL — Do not use a message digest.
MD5 — Message Digest 5, the hash algorithm developed by RSA
Data Security.
SHA1 — Secure Hash Algorithm 1, which produces a 160-bit
message digest.
SHA256 — Secure Hash Algorithm 2, which produces a 256-bit
message digest.
SHA384 — Secure Hash Algorithm 2, which produces a 384-bit
message digest.
SHA512 — Secure Hash Algorithm 2, which produces a 512-bit
message digest.
Replay attacks occur when an unauthorized party intercepts a series
of IPsec packets and replays them back into the tunnel.
Perfect forward secrecy (PFS) improves security by forcing a new
Diffie-Hellman exchange whenever keylife expires.
Select one Diffie-Hellman group (1, 2, 5 or 14). This must match the
DH Group that the remote peer or dialup client uses.
Select the method for determining when the phase 2 key expires:
Seconds, KBytes, or Both. If you select Both, the key expires when
either the time has passed or the number of KB have been processed.
Select the check box if you want the tunnel to remain active when no
data is being processed.
IPsec VPNs for FortiOS 4.0 MR3
32 01-434-112804-20120111
http://docs.fortinet.com/