18.07.2013 Views

Sidewinder G2 6.1.1 Administration Guide - Glossary of Technical ...

Sidewinder G2 6.1.1 Administration Guide - Glossary of Technical ...

Sidewinder G2 6.1.1 Administration Guide - Glossary of Technical ...

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

Example VPN<br />

Scenarios<br />

Example VPN Scenarios<br />

Negotiate As Single Host—If this option is enabled it indicates that<br />

every possible combination <strong>of</strong> source and destination must<br />

establish a separate VPN association. Do not use this option unless<br />

directed to do so by Secure Computing Corporation.<br />

Forced Rekey—Forces the association to rekey when the limits are<br />

reached, even if no traffic has passed through the VPN since the<br />

last rekey.<br />

Important: SCC strongly recommends enabling the Forced Rekey option if you<br />

are using SafeNet S<strong>of</strong>tRemote and have XAUTH configured.<br />

Caution: Do not enable the Forced Rekey option if you have One-To-Many<br />

configured and are using static IP addresses for your VPNs. Doing so will cause all<br />

<strong>Sidewinder</strong> <strong>G2</strong>s in the cluster to attempt to instantiate the VPN at the same time,<br />

resulting in failure.<br />

PFS—(Perfect Forward Secrecy) If this option is enabled it ensures<br />

that the key material associated with each IPsec security<br />

association cannot be derived from the key material used to<br />

authenticate the remote peer during the ISAKMP negotiation. If a<br />

key is compromised by a hacker, the information available to that<br />

hacker is dependent on whether you select Identity or Key Only.<br />

— Identity: Indicates that a Phase 1 negotiation is performed for<br />

every Phase 2. This means the identity will not be revealed<br />

even if the key is compromised; only the data protected by<br />

that key will be accessible. The downside is that system<br />

performance may be hurt because <strong>of</strong> the many negotiations.<br />

— Key Only: Phase 1 negotiations are not performed for every<br />

Phase 2. This will increase performance but may allow access<br />

to the identity if the key is compromised.<br />

Oakley Group: Indicates the Diffie-Hellman group to use for the PFS<br />

derivation <strong>of</strong> IPsec keys. Available only if the PFS option is<br />

enabled.<br />

The following sections describe three typical VPN scenarios. Each<br />

scenario begins by describing a particular VPN requirement. It then<br />

explains how to implement the solution using the Admin Console.<br />

These scenarios assume the following:<br />

The VPN feature is licensed for your <strong>Sidewinder</strong> <strong>G2</strong>.<br />

The CMD server is enabled on the <strong>Sidewinder</strong> <strong>G2</strong>. (This server will<br />

be enabled by default.)<br />

Configuring Virtual Private Networks 13-65

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!