Avaya BCM 4.0 Networking Guía de configuración descargar pdf (Pagina 667)

100

101

Chapter 68 Virtual Private Networks (VPN) 667

BCM 4.0 Networking Configuration Guide

Rekey timeout (s) <0-359999> Specify the amount of time you can use a key before the tunnel is

re-negotiated.

You should limit the lifetime of a single key used to encrypt data or else

you will compromise the effectiveness of a single session key. Use the

Rekey Timeout setting to control how often new session keys are

exchanged between servers. You cannot set the Rekey Timeout setting to

less than three minutes, except to disable the timeout by entering 0.

Note: A setting of 0 disables the Rekey Timeout setting.

Default: 28800 secs

Rekey data count

(kB)

<0 -1000000> Specify the amount of data you can transmit on the tunnel before the

tunnel is re-negotiated.

A setting of 0 disables the Rekey Data Count.

Note: If you set the Rekey Data Count too low, the tunnel is re-negotiated

too often and will consume extra system resources.

Default: 0 Kbytes

Idle timeout (s) <0-359999> Specify the amount of time the tunnel can remain idle before the tunnel is

closed. You cannot set the Idle Timeout setting to less than three minutes,

except to disable the timeout by entering 0.

Note: A setting of 0 disables the Idle Timeout setting.

Default: 900 secs

Enable PFS <check box> Enable Perfect Forward Secrecy (PFS).

With PFS, keys are not derived from previous keys. This ensures that one

key being compromised cannot result in the compromise of subsequent

keys.

If you create a tunnel to a Contivity Extranet Switch, you must select

Enable PFS.

Note: Clear Enable PFS for connections to the Nortel Services Edge

Router (formerly known as Shasta 5000).

Create automatic

firewall rules

<check box> Select this check box if you want the BCM to create Firewall rules that

allow traffic for this tunnel to pass through the Firewall.

Clear this check box if you do not want BCM to create Firewall rules for

this tunnel.

If you are using the BCM Firewall, Nortel recommends that you select this

option. See Figure 206 for an example of a branch office firewall

configuration.

Highest encryption <drop-down list> Select the highest encryption level allowed on this IPSec tunnel.

When the encryption level is negotiated for this tunnel, BCM will not use

any encryption level higher than the encryption level specified in this field.

For a description of the encryption levels, refer to “Encryption” on

page 652.

Highest

Diffie-Hellman

Group

Diffie-Hellman

Group 5 (1536-bit)

Diffie-Hellman

Group 2

(1024-bit)

Diffie-Hellman

Group 1 (768-bit)

Diffie-Hellman is a public-key cryptographic protocol that allows two

parties to establish a shared secret over an insecure communications

channel. It is also used within IKE (Internet Key Exchange) to establish

session keys. IPSec uses the Diffie-Hellman algorithm to provide the

keying material for all other encryption keys.

Higher (larger bit keying material) Diffie-Hellman groups provide more

security but require more processor time.

Default: Group 2

Table 26 IPSec Branch Office Tunnel settings (Sheet 2 of 3)

Attribute Value Description

1 2 ... 662 663 664 665 666 667 668 669 670 671 672 ... 757 758

Comentarios a estos manuales

Sin comentarios

Avaya BCM 4.0 Networking Guía de configuración Pagina 667

Comentarios a estos manuales

Relacionado con productos y manuales para Redes Avaya BCM 4.0 Networking