FortiGate IPSec VPN User Guide - FirewallShop.com

Auto Key phase 1 parameters
Defining IKE negotiation parameters
3 Select Advanced and include appropriate entries as follows:
P1 Proposal
DH Group
Keylife
4 Select OK.
Select the encryption and authentication algorithms that will be
used to generate keys for protecting negotiations.
Add or delete encryption and authentication algorithms as
required. Select a minimum of one and a maximum of three
combinations. The remote peer must be configured to use at least
one of the proposals that you define.
You can select any of the following symmetric-key algorithms:
• DES-Digital Encryption Standard, a 64-bit block algorithm that
uses a 56-bit key.
• 3DES-Triple-DES, in which plain text is encrypted three times
by three keys.
• AES128-A 128-bit block algorithm that uses a 128-bit key.
• AES192-A 128-bit block algorithm that uses a 192-bit key.
• AES256-A 128-bit block algorithm that uses a 256-bit key.
You can select either of the following message digests to check
the authenticity of messages during phase 1 negotiations:
• MD5-Message Digest 5, the hash algorithm developed by RSA
Data Security.
• SHA1-Secure Hash Algorithm 1, which produces a 160-bit
message digest.
To specify a third combination, use the add button beside the
fields for the second combination.
Select one or more Diffie-Hellman groups from DH group 1, 2, and
5. When using aggressive mode, DH groups cannot be
negotiated.
• If both VPN peers (or a VPN server and its client) have static
IP addresses and use aggressive mode, select a single DH
group. The setting on the FortiGate unit must be identical to
the setting on the remote peer or dialup client.
• When the remote VPN peer or client has a dynamic IP address
and uses aggressive mode, select up to three DH groups on
the FortiGate unit and one DH group on the remote peer or
dialup client. The setting on the remote peer or dialup client
must be identical to one of the selections on the FortiGate unit.
• If the VPN peer or client employs main mode, you can select
multiple DH groups. At least one of the settings on the remote
peer or dialup client must be identical to the selections on the
FortiGate unit.
Type the amount of time (in seconds) that will be allowed to pass
before the IKE encryption key expires. When the key expires, a
new key is generated without interrupting service. The keylife can
be from 120 to 172800 seconds.
Nat-traversal Enable this option if a NAT device exists between the local
FortiGate unit and the VPN peer or client. The local FortiGate unit
and the VPN peer or client must have the same NAT traversal
setting (both selected or both cleared).
Keepalive Frequency If you enabled NAT traversal, enter a keepalive frequency setting.
The value represents an interval from 0 to 900 seconds.
Dead Peer Detection Enable this option to reestablish VPN tunnels on idle connections
and clean up dead IKE peers if required.
FortiGate IPSec VPN Version 3.0 User Guide
01-30005-0065-20070716 139