Sidewinder G2 6.1.2 Administration Guide - Glossary of Technical ...

Entering information
on the Advanced tab
Chapter 14: Configuring Virtual Private Networks
Configuring VPN Security Associations
The Advanced tab defines some of the more arcane points of a VPN
association. As a general rule only administrators that are highly-schooled in
the nuts and bolts of VPN should modify the information on this tab. The
information on this tab is only used with automatic key exchange (that is
Authentication Method = Password, Certificate + Certificate Authority, or Single
Certificate on the Authentication tab). The Advanced tab contains the following
fields and buttons.
Phase 1 (ISAKMP) Rekey data fields
• Hard Limits—Indicates how often the system must negotiate for new
ISAKMP keys and how much ISAKMP traffic this phase can protect. The
defaults are 3600 seconds (1 hour) and 0 (meaning no limit to the amount
of traffic).
• Soft Percentage—Indicates how far in advance of the hard limit to begin
negotiating for new keys. This makes sure you have some new keys on
hand by the time the hard limit expires.
• P1 Crypto—Specifies the crypto algorithm to use during Phase 1.
• P1 Hash: Specifies the hash algorithm to use during Phase 1.
• P1 Oakley—Indicates the Diffie-Hellman group to use for the PFS
derivation of ISAKMP keys.
• Force XAuth on Rekey—Select this option to force XAuth to be performed
each time the phase 1 session is started or renegotiated.
• Relax Strict Identity Matching—Select this option to relax the identity
matching restrictions. If you are experiencing issues associated with
identity processing with the remote VPN peer, selecting this option can
improve interoperability.
Phase 2 (IPSEC) Rekey data fields
• Hard Lifetimes—Indicates how often the system must negotiate for new
IPsec keys and how much traffic it can encrypt. The defaults are 700
seconds and 0 (meaning no traffic limit).
• Soft Percentage—Indicates how far in advance of the hard limit to begin
negotiating for new keys. This makes sure you have some new keys on
hand by the time the hard limit expires.
• Negotiate As Single Host—If this option is enabled it indicates that every
possible combination of source and destination must establish a separate
VPN association. Do not use this option unless directed to do so by Secure
Computing Corporation.
• Forced Rekey—Forces the association to rekey when the limits are
reached, even if no traffic has passed through the VPN since the last rekey.
Important: SCC strongly recommends enabling the Forced Rekey option if
you are using SafeNet SoftRemote and have XAUTH configured.
449