HP X Unified Security Platform Series User Manual download pdf (Page 223)

IKE Proposal

X Family LSM User’s Guide V 2.5.1 207

STEP 9

If you are using Pre-Shared Key with Aggressive Mode:

•From the Local ID Type drop-down list, select the identifier for the device to use for

validation purposes, either IP Address, Email Address, or Domain Name.

•From the Peer ID Type drop-down list, select the identifier for the device to use for

validation purposes, either IP Address, Email Address, or Domain Name.

You must select the same Local ID and Peer ID types that are configured on the remote

device that will connect via the VPN tunnel.

STEP 10

If you are using X.509 Certificates (with either Aggressive Mode or Main Mode):

• Select the Local Certificate you want to use from the Local Certificate drop-down list

• Select the type of information in the certificate to use for validation purposes from the Peer

ID Type drop-down list, either Distinguished Name, Email Address or Domain Name.

You must select the same type that is used on the remote device.

• To specify the CA certificate you want to use to validate access to the VPN, check Only

accept peer certificates signed by, and select the certificate from the drop-down list. This

increases security on the VPN

STEP 11

If there is a NAT device between the two VPN devices, check Enable NAT-Traversal.

STEP 12

To enable the device to check that the VPN link is still functioning, check Enable Dead Peer

Detection.

STEP 13

To initiate the VPN upon startup with IKE phase 1 proposal automatically established, check

Automatically connect phase 1 on system start-up.

Use this option if the device is using a dynamic external IP address.

If this option is checked, and you want to configure phase 2 connections to connect

automatically, check Automatically connect phase 2.

STEP 14

To delete all Phase 2 security associations if the Phase 1 security association terminates,

check Delete Phase 2 SA when Phase 1 SA terminates.

Configure Phase 2 Setup Parameters for an IKE Proposal

STEP 1

Select the required encryption and integrity combinations from the Encryption and

Integrity drop-down lists.

STEP 2

Enter the duration of IKE Phase 2 in the Lifetime field (between 1 and 65535 seconds, default

28800). IKE Phase 2 will time out after this interval.

Note If you do not specify a certificate, the device will by default use any of the

available CA certificates. CA Certificates are imported from the X.509 Certificates page

(Authentication > X.509 Certificates).

Note Some VPN devices automatically delete all the phase 2 security associations if

the phase 1 security association terminates. To improve interoperability with such

devices, check this option.

1 ... 222 223 224 ... 333

Comments to this Manuals

No comments

HP X Unified Security Platform Series User Manual Page 223

Comments to this Manuals

Related products and manuals for Networking HP X Unified Security Platform Series