Symantec™ Security Gateways Reference Guide - Sawmill

Understanding VPN tunnelsVPN Policies99VPN PoliciesRather than configuring data privacy, data integrity, and data compression algorithms for every tunnel youcreate, the security gateway lets you configure standard, reusable VPN policies and then later apply themto multiple secure tunnels. VPN policies group together common characteristics for tunnels, and allow forrapid setup of additional tunnels with the same characteristics. The security gateway also includes ahandful of commonly used VPN policies, for both static and dynamic tunnels.Note: You can create more than one policy, varying the components you select for each one. Ensure thatyour naming conventions let you distinguish between policies that use the same encapsulation mode.When you are ready to create your secure tunnels, clearly defined naming conventions make selecting thecorrect VPN policy easier.Global IKE PolicyThe security gateway comes with a predefined global IKE policy that automatically applies to your IKEPhase 1 negotiations. This global IKE policy works in conjunction with the IPsec/IKE VPN policy youconfigure, providing the parameters for Phase 1 negotiations for your IKE tunnel, while the VPN policy youconfigure and select provides the parameters for Phase 2 negotiations.The configurable elements included in the global IKE policy shipped with the security gateway are asfollows:Policy NameData Privacy PreferencesData Integrity PreferencesDiffie-Hellman GroupsConnection TimeoutName for the policy.Encryption algorithm used for packet data. Assigning more than one algorithm definesthat the first one is tried, and if unsuccessful, the next algorithm is tried. Availableencryption algorithms include DES and Triple DES.Hash algorithms used for packet authentication. Assigning more than one algorithmdefines that the first one is tried, and if unsuccessful, the next algorithm is tried. Availablehash algorithms include SHA1 and MD5.Diffie-Hellman is the standard IKE method of establishing shared keys. Group 1 and group2 are the Diffie-Hellman group numbers available for establishing these IKE session keys.Group 1 is 768 bits long and group 2 is 1024 bits long. Using group 2 is more secure but italso uses more CPU power.Indicates the timeout limit (in seconds) for establishing a connection. If you are usingslower authentication or encryption methods, and your connection requests are timingout, you might want to increase this time limit.