XiNCOM XC-DPG603 - Manual (Page 37)

Policy Setup
VPN Policy Setup (continued)
Key Management
Key - Key Type:
There are two key types (manual key and auto key) available for the key exchange management.
Manual Key: If manual key is selected, no key negotiation is needed.
Encryption Key - This field specifies a key to encrypt and decrypt IP traffic.
Authentication Key - This field specifies a key use to authentication IP traffic.
Inbound/outbound SPI (Security Parameter Index) is carried on the ESP header. Each
tunnel must have a unique inbound and outbound SPI and no two tunnels share the same
SPI. Notice that Inbound SPI must match the other router’s outbound SPI.
AutoKey (IKE) - There are two types of operation modes can be used:
Main mode accomplishes a phase one IKE exchange by establishing a secure channel.
Aggressive Mode is another way of accomplishing a phase one exchange. It is faster and
simpler than main mode, but does not provide identity protection for the negotiating nodes.
Perfect Forward
Secrecy (PFS)
If PFS is enable, IKE phase 2 negotiation will generate a new key material
for IP traffic encryption & authentication.
Preshared Key This field is to authenticate the remote IKE peer.
Key Lifetime This specifies the lifetime of the IKE generated Key. If the time expires or
data is passed over this volume, a new key will be renegotiated. By default,
0 is set for no limit.
Options
NetBIOS Broadcast This is used to forward NetBIOS broadcast across the Internet.
Keep Alive
This is to help maintain the IPSec connection tunnel. It can be re-
established immediately if a connection is dropped.
Anti Replay The Anti Replay mechanism works by keeping track of the sequence
numbers in packets as they arrive.
Passive Mode When enabled, your PC establishes the data connection.
Check ESP Pad When checked, this will enable ESP (Encapsulating Security Payload)
padding.
Allow Full ECN Enable will allow full Explicit Congestion Notification (ECN). ECN is a
standard proposed by the IETF that will minimize congestion on network
and the gateway dropping packets.
Copy DF Flag When an IP packet is encapsulated as payload inside another IP packet,
some of the outer header fields can be newly written and others are
determined by the inner header. Among these fields is the IP DF (Do not
fragment) flag. When the inner packet DF flag is clear, the outer packet
may copy it or set it. However, when the inner DF flag is set, the outer
header MUST copy it.
Set DF Flag If the DF (Do not Fragment) flag is set, it means the fragmentation of this
packet at the IP level is not permitted.
37