User guide

Chapter 4
Advanced Configuration
47
10/100 8-Port VPN Router
Local Security Group Type > Subnet
IP address Enter the IP address. The default is
192.168.1.0.
Subnet Mask Enter the subnet mask. The default is
255.255.255.0.
IP Range
Specify a range of IP addresses within a subnet that will be
able to access the tunnel.
Local Security Group Type > IP Range
IP range Enter the range of IP addresses. The default is
192.168.1.0~254.
Remote Client Setup
Remote Client
Select the type you want to use: Domain Name(FQDN),
E-mail Addr.(USER FQDN), or Microsoft XP/2000 VPN
Client. Follow the instructions for the type you want to
use.
Domain Name(FQDN)
The default is Domain Name(FQDN).
Remote Client > Domain Name(FQDN)
Domain Name Enter the Fully Qualified Domain Name
(FQDN), which is the host name and domain name for
a specific computer on the Internet. When the remote
computer requests to create a tunnel with the Router, the
Router will work as a responder.
E-mail Address(UserFQDN)
Remote Client > E-mail Address(UserFQDN)
E-mail address Enter the e-mail address of the user
FQDN.
Microsoft XP/2000 VPN Client
Dynamic IP users, such as PPPoE or DHCP users, who use
the Microsoft VPN client software, can use this option.
(The Microsoft VPN client software does not support
Aggressive mode and FQDN or User FQDN ID options.)
Remote Client > Microsoft XP/2000 VPN Client
IPSec Setup
In order for any encryption to occur, the two ends of a
VPN tunnel must agree on the methods of encryption,
decryption, and authentication. This is done by sharing
a key to the encryption code. For key management, the
default mode is IKE with Preshared Key.
Keying Mode Select IKE with Preshared Key or Manual.
Both ends of a VPN tunnel must use the same mode of
key management. After you have selected the mode, the
settings available on this screen may change, depending
on the selection you have made. Follow the instructions
for the mode you want to use. (Manual mode is available
for VPN tunnels only, not group VPNs.)
IKE with Preshared Key
IKE is an Internet Key Exchange protocol used to negotiate
key material for Security Association (SA). IKE uses the
Preshared Key to authenticate the remote IKE peer.
Phase 1 DH Group Phase 1 is used to create the SA. DH
(Diffie-Hellman) is a key exchange protocol used during
Phase 1 of the authentication process to establish pre-
shared keys. There are three groups of different prime
key lengths. Group 1 is 768 bits, and Group 2 is 1,024 bits.
Group 5 is 1,536 bits. If network speed is preferred, select
Group 1. If network security is preferred, select Group 5.
Phase 1 Encryption Select a method of encryption:
DES (56-bit), 3DES (168-bit), AES-128 (128-bit), AES-192
(192-bit), or AES-256 (256-bit). The method determines
the length of the key used to encrypt or decrypt ESP
packets. AES-256 is recommended because it is more
secure. Make sure both ends of the VPN tunnel use the
same encryption method.
Phase 1 Authentication Select a method of
authentication, MD5 or SHA. The authentication method
determines how the ESP packets are validated. MD5 is
a one-way hashing algorithm that produces a 128-bit
digest. SHA is a one-way hashing algorithm that produces
a 160-bit digest. SHA is recommended because it is more
secure. Make sure both ends of the VPN tunnel use the
same authentication method.
Phase 1 SA Life Time Configure the length of time a VPN
tunnel is active in Phase 1. The default value is 28800
seconds.