Creating VPN Profiles

Name

Enter a unique string of alphanumeric characters, colons, periods, dashes, and underscores; no spaces allowed; 255-character maximum.

Phase 1

Mode

Select a VPN mode:

• Main—The most common and secure way to establish a VPN when building site-to-site VPNs. The IKE identities are encrypted and cannot be determined by eavesdroppers.
• Aggressive—This is an alternative to main mode IPsec negotiation. This is the most common mode when building VPNs from client workstations to VPN gateways, where the IP address of the client is neither known in advance nor fixed.

IKE Id

Configure the following Internet Key Exchange (IKE) identifiers, as needed:

• Hostname—The hostname or fully qualified domain name is essentially a string that identifies the end system.
• User@hostname—A simple string that follows the same format as an e-mail address.
  • User—Enter the e-mail address of the user. We recommend that you use the valid e-mail address of the user for ease of management.
• IPAddress—This is the most common form of IKE identity for site-to-site VPNs. This can be either an IPv4 or IPv6 address. This option is available only if the VPN mode is Aggressive and the authentication type is Preshared Key.
• DN—The distinguished name used in certificates to identify a unique user in a certificate. This option is available only for RSA, DSA, and ECDSA signature authentication types.

Note:

• For the Preshared Key authentication type:
  • If you have enabled the General IKE ID option, the IKE ID option is automatically set to None and you cannot edit this option.
  • When modifying a IPsec VPN, you cannot edit the IKE ID column in the View/Edit Tunnel page, if you have chosen a VPN profile with the General IKE ID option enabled.
• For the certificate-based authentication type:
  • You can edit the IKE ID option even if you have enabled the General IKE ID option because, the local-identity CLI is used for certificate authentication.
  • When modifying a IPsec VPN, you can edit the IKE ID column in the View/Edit Tunnel page, if you have chosen a VPN profile with the General IKE ID option enabled.

Proposals

Select the type of proposal as either Predefined or Custom. For the Custom proposal, click the plus sign (+) to create a new proposal.

• Name—Enter the name of the proposal.
• DH Group—A Diffie-Hellman (DH) exchange allows the participants to produce a shared secret value. Select the appropriate DH group:
  • Group1
  • Group2
  • Group5
  • Group14
  • Group19
  • Group20
  • Group24
• Authentication–Select an algorithm. The device uses these algorithms to verify the authenticity and integrity of a packet.
  • MD5
  • SHA-1
  • SHA-256
  • SHA-384
• Encryption—Select the appropriate encryption mechanism:
  • 3DES
  • AES(128)
  • AES(192)
  • AES(256)
• Lifetime—Select a lifetime of an IKE security association (SA). Default: 3,600 seconds. Range: 180 through 86,400 seconds.

Note: For the RSA-signature and DSA-signature authentication types, you can only use the custom proposals.

Advanced Settings

DPD

Select the check box to permit the two gateways to determine if the peer gateway is up and responding to the DPD messages that are negotiated during IPsec establishment.

• Always Send DPD—Enable this option to send dead peer detection requests regardless of whether there is outgoing IPsec traffic to the peer.
• DPD Interval (secs)—Select an interval in seconds to send dead peer detection messages. The default interval is 10 seconds, with a permissible range of 10 to 60 seconds.
• DPD Threshold—Select a number from 1 to 5 to set the failure DPD threshold. This specifies the maximum number of times the DPD messages must be sent when there is no response from the peer. The default number of transmissions is 5 times.

Proposal

Select the type of proposal as either Predefined or Custom. For the Custom proposal, click the plus sign (+) to create a new proposal.

• Name—Enter the name of the custom proposal.
• Authentication—Select an algorithm. The device uses these algorithms to verify the authenticity and integrity of a packet.
  • MD5
  • SHA-1
  • SHA-256(96)
  • SHA-256(28)
• Protocol—Select the required protocol to establish the VPN.
• Encryption—Select the necessary encryption method:
  • DES
  • 3DES
  • AES(128)
  • AES(192)
  • AES(256)
  • AES-GCM(128)
  • AES-GCM(192)
  • AES-GCM(256)
• Lifetime—Select a lifetime of an IKE security association (SA). Default: 3,600 seconds. Range: 180 through 86,400 seconds.
• Life Size—The lifetime of the SA, after which it expires, expressed in kilobytes.

Perfect Forward Secrecy

Specify Perfect Forward Secrecy (PFS) as the method that the device uses to generate the encryption key. PFS generates each new encryption key independently from the previous key. The higher numbered groups provide more security, but require more processing time.

The available options are:

• Group1
• Group2
• Group5
• Group14
• Group19
• Group20
• Group24

Establish tunnel immediately

Enable this option to establish the IPsec tunnel. IKE is activated immediately after VPN configuration and configuration changes are committed.

DF bit

Enable this option to process the Don’t Fragment (DF) bit in IP messages. You can set it to copy, clear, or set the bits to the IPsec header.

Select the following options:

• None—No action.
• Clear—Clear (disable) the DF bit from the IP messages. This is the default.
• Copy—Copy the DF bit to the IP messages.
• Set—Set (enable) the DF bit in the IP messages.

Install Time

Specify the maximum number of seconds to allow for the installation of a rekeyed outbound security association (SA) on the device. Select a value from 1 to 10.