Configuring VPN Tunnel Authentication

Configuring VP N Tunnel Authentication

Tunnel authentication between the VPN 5002 or 5008 concentrator and a tunnel peer, such as the VPN 5000 Client or another concentrator, uses the Internet Key Exchange (IKE) protocol.

The IKE Policy section controls how the concentrator and the tunnel peer initially identify and authenticate each other so that tunnel sessions can be established. These security parameters are global to the concentrator and are not associated with a particular interface.

This initial negotiation is referred to as Phase 1 IKE negotiation. Phase 2 IKE negotiation controls how the concentrator and client handle individual tunnel sessions. To set Phase 2 IKE negotiation parameters, see "Configuring VPN Groups," or "Configuring VPN LAN-to-LAN Tunnels."

Follow these steps to configure tunnel authentication:

Command Purpose

Step 1

configure IKE Policy
Allows you to configure the IKE Policy section.

Step 2

Protection = {MD5_DES_G1 |
MD5_3DES_G1 | MD5_DES_G2 |
MD5_3DES_G2 | SHA_DES_G1 |
SHA_3DES_G1 | SHA_DES_G2 |
SHA_3DES_G2}
Specifies a protection suite for the IKE negotiation. You can enter this command multiple times within this section, in which case the concentrator proposes all of the specified protection suites. The tunnel peer accepts one of the options for the negotiation.

The first piece of each option is the authentication algorithm to be used for the negotiation:

MD5 is the message-digest 5 hash algorithm.

SHA is the Secure Hash Algorithm, which is considered to be more secure than MD5.

The second piece is the encryption algorithm:

DES (Data Encryption Standard) uses a 56-bit key to scramble the data.

3DES (Triple DES) uses three different keys and three applications of the DES algorithm to scramble the data. 3DES is subject to restrictions by U.S. encryption export laws, and might not be available outside the U.S.

The third piece is the Diffie-Hellman group to be used for k ey exchange:

Group 1 (G1) uses a 768-bit algorithm.

Group 2 (G2) uses a 1024-bit algorithm and is more secure than Group 1.

Table of Contents