Cisco VPN 3002 - Manual (Page 89)

8-11
VPN 3002 Hardware Client Reference
OL-1893-01
Chapter 8 Management Protocols
Configuration | System | Management Protocols | SSL
Figure 8-12 Configuration | System | Management Protocols | SSL Screen
Encryption Algorithms
Check the boxes for the encryption algorithms that the VPN 3002 SSL server can negotiate with a client
and use for session encryption. All are checked by default. You must check at least one algorithm to
enable SSL. Unchecking all algorithms disables SSL.
The algorithms are negotiated in the following order (you cannot change the order, but you can enable
or disable selected algorithms):
• RRC4-128/MD5 = RC4 encryption with a 128-bit key and the MD5 hash function. This option is
available in most SSL clients.
• 3DES-168/SHA = Triple-DES encryption with a 168-bit key and the SHA-1 hash function. This is
the strongest (most secure) option.
• DES-56/SHA = DES encryption with a 56-bit key and the SHA-1 hash function.
• RC4-40/MD5 Export = RC4 encryption with a 128-bit key, 40 bits of which are private, and the
MD5 hash function. This option is available in the non-U.S. versions of many SSL clients.
• DES-40/SHA Export = DES encryption with a 56-bit key, 40 bits of which are private, and the
SHA-1 hash function. This option is available in the non-U.S. versions of many SSL clients.
Client Authentication
This parameter applies to HTTPS only; it is ignored for Telnet/SSL.
Check the box to enable SSL client authentication. The box is not checked by default. In the most
common SSL connection, the client authenticates the server, not vice-versa. Client authentication
requires personal certificates installed in the browser, and trusted certificates installed in the server.
Specifically, the VPN 3002 must have a root CA certificate installed; and a certificate signed by one of
the VPN 3002 trusted CAs must be installed in the Web browser. See Administration | Certificate
Management.