User's Manual

Configuring Virtual Private Networks
116 WatchGuard Firebox X Edge
N OTE N OTE
The IKE Keep Alive feature is different from the VPN Keep Alive
feature described in“VPN Keep Alive,” on page 117.
Phase 2 settings
Phase 2 negotiates the data management security association for
the tunnel. The tunnel uses this phase to create IPSec tunnels
and encapsulate and decapsulate data packets.
You can use the default Phase 2 settings to simplify configuration.
N OTE N OTE
Make sure that the Phase 2 configuration is the same on both
devices.
To change the Phase 2 settings:
1 Select the authentication method from the Authentication
Algorithm drop-down list.
2 Select the encryption algorithm from the Encryption Algorithm
drop-down list.
3 If you are using Perfect Forward Secrecy, select the Enable
Perfect Forward Secrecy checkbox.
This option makes sure that each new key is derived from a new Diffie-
Hellman exchange. This option makes the negotiation more secure, but
requires more time.
4 Type the number of kilobytes and the number of hours until the
IKE negotiation expires.
5 Type the IP address of the local network and the remote
network that must use Phase 2 negotiation.
Network addresses must be entered in “slash” notation (also known as
Classless Inter Domain Routing or CIDR notation). For more information
on entering IP addresses in slash notation, see the following FAQ:
http:/
/www.watchguard.com/support/advancedfaqs/general_slash.asp.
6 Click Add.