Netgear UTM10EW3-100NAS Reference Manual 3.0.1-124 - Page 318

ProSecure Unified Threat Management (UTM) Appliance Table 78. IKE policy settings for a Mode Config configuration (continued) Setting IKE SA Parameters Description Note: Generally, the default settings work well for a Mode Config configuration. Encryption Algorithm To negotiate the security association (SA), from the drop-down list, select the 3DES algorithm. Authentication Algorithm From the drop-down list, select the SHA-1 algorithm to be used in the VPN header for the authentication process. Authentication Method Select Pre-shared key as the authentication method, and enter a key in the Pre-shared key field. Pre-shared key A key with a minimum length of 8 characters and no more than 49 characters. Do not use a double quote (") in the key. This example uses H8!spsf3#JYK2!. Diffie-Hellman (DH) Group The DH Group sets the strength of the algorithm in bits. From the drop-down list, select Group 2 (1024 bit). SA-Lifetime (sec) The period in seconds for which the IKE SA is valid. When the period times out, the next rekeying occurs. The default setting is 28800 seconds (8 hours). However, for a Mode Config configuration, NETGEAR recommends 3600 seconds (1 hour). Enable Dead Peer Detection Note: See also Configure Keep-Alives and Dead Peer Detection on page 328. Select a radio button to specify whether Dead Peer Detection (DPD) is enabled: • Yes. This feature is enabled. When the UTM detects an IKE connection failure, it deletes the IPSec and IKE SA and forces a reestablishment of the connection. You need to specify the detection period in the Detection Period field and the maximum number of times that the UTM attempts to reconnect in the Reconnect after failure count field. • No. This feature is disabled. This is the default setting. Detection Period The period in seconds between consecutive DPD R-U-THERE messages, which are sent only when the IPSec traffic is idle. The default setting is 10 seconds. This example uses 30 seconds. Reconnect after failure count The maximum number of DPD failures before the UTM tears down the connection and then attempts to reconnect to the peer. The default setting is 3 failures. Virtual Private Networking Using IPSec, PPTP, or L2TP Connections 318