Netgear UTM25-100NAS Reference Manual - Page 258

ProSecure Unified Threat Management UTM10 or UTM25 Reference Manual Table 7-16. Add IKE Policy Settings for a Mode Config Configuration (continued) Item Description (or Subfield and Description) Remote Identifier Type From the pull-down menu, select FQDN. Note: Mode Config requires that the remote end is defined by a FQDN. Identifier Enter the FQDN for the remote end. This must be a FQDN that is not used in any other IKE policy. In this example, we are using utm25_remote.com. IKE SA Parameters Note: Generally, the default settings work well for a Mode Config configuration. Encryption Algorithm From the pull-down menu, select the 3DES algorithm to negotiate the security association (SA). Authentication Algorithm From the pull-down menu, select the SHA-1 algorithm to be used in the VPN header for the authentication process. Authentication Method Select Pre-shared key as the authentication method, and enter a key in the field below. Pre-shared key A key with a minimum length of 8 characters no more than 49 characters. Do not use a double quote (") in the key. In this example, we are using 12345678910. Diffie-Hellman (DH) Group The DH Group sets the strength of the algorithm in bits. From the pull-down menu, select Group 2 (1024 bit). SA-Lifetime (sec) The period in seconds for which the IKE SA is valid. When the period times out, the next rekeying must occur. The default is 28800 seconds (8 hours). However, for a Mode Config configuration, NETGEAR recommends 3600 seconds (1 hour). Enable Dead Peer Detection Note: See also "Configuring Keepalives and Dead Peer Detection" on page 7-54. Select a radio button to specify whether or not Dead Peer Detection (DPD) is enabled: • Yes. This feature is enabled: when the UTM25 detects an IKE connection failure, it deletes the IPsec and IKE SA and forces a reestablishment of the connection. You must enter the detection period and the maximum number of times that the UTM attempts to reconnect (see below). • No. This feature is disabled. This is the default setting. Detection Period The period in seconds between consecutive "DPD R-U-THERE" messages, which are sent only when the IPsec traffic is idle. The default setting is 10 seconds. Reconnect after failure count The maximum number of times that the UTM attempts to reconnect after a DPD situation. When the maximum number of times is exceeded, the IPsec connection is terminated. The default setting is 3 IKE connection failures. 7-48 Virtual Private Networking Using IPsec Connections v1.0, September 2009