HP VPN Firewall Appliances VPN Configuration Guide

216
Table 19 Configuration items
Item Descri
p
tion
Source IP
Address/Wildcard
Specify the traffic to be protected by giving the source IP address and wildcard,
destination IP address and wildcard, and the protocol type.
IMPORTANT:
Based on these configurations, the wizard creates an advanced ACL that permit
packets matching these criteria and apply this ACL to the IPsec policy. The ACL number
is the smallest, available number in the range 3000 to 3999. If there is no number
available for the ACL, the wizard notifies you that the IPsec VPN policy configuration
fails.
Destination IP
Address/Wildcard
Protocol Type
Encryption Suite
Select the encryption suite for the IPsec proposal. An encryption suite specifies the IP
packet encapsulation mode, security protocol, and authentication and encryption
algorithms to be used.
Options include:
• TUNNEL-ESP-SHA1-3DES—Uses the tunnel mode for IP packet encapsulation, ESP
for packet protection, SHA1 for authentication, and 3DES for encryption.
• TUNNEL-ESP-MD5-DES—Uses the tunnel mode for IP packet encapsulation, ESP
for packet protection, MD5 for authentication, and DES for encryption.
• TUNNEL-AH-MD5-ESP-DES—Uses the tunnel mode for IP packet encapsulation,
ESP and AH for packet protection, MD5 for AH authentication, and DES for ESP
encryption.
• TUNNEL-AH-MD5-ESP-3DES—Uses the tunnel mode for IP packet encapsulation,
ESP and AH for packet protection, MD5 for AH authentication, and 3DES for ESP
encryption.
Pre-Shared Key
Select the authentication method for IKE negotiation and specify the required
argument. Options include:
• Pre-Shared Key—Uses the pre-shared key authentication method.
• PKI Domain—Uses the RSA signature authentication method. Available PKI
domains are those configured by selecting VPN > Certificate Manager > Domain
from the navigation tree.
IMPORTANT:
If you select PKI Domain, you create an IKE proposal numbered 1.
PKI Domain
Enable DPD
Select this box to enable dead peer detection (DPD).
IMPORTANT:
If you enable DPD and the name of the IPsec VPN is abc, the wizard creates a DPD
named abc_dpd and applies it to peer abc_peer.
8. Click Next.