Download Digi Cellular Family User's Guide

Configure Digi devices

ISAKMP Phase 1 Settings
–
General Security Settings for Phase 1
Connection Mode: Main|Aggressive: Set the connection mode to match that
configured on the remote VPN device. If aggressive mode is selected, then the VPN
device will try aggressive mode first, and then try main mode if aggressive mode
fails.
Enable Perfect Forward Secrecy (PFS): Set this option to enable PFS. PFS
guarantees that if one key is broken by an attacker, that does not help him to break
another key. PFS is more secure, but slows down the negotiation process. Both the
Digi unit and the remote VPN device must be configured the same way.
–
NAT-T Settings
Enable NAT Traversal (NAT-T): Set this option if there is a NAT firewall between
the two VPN devices.
Keep Alive Interval: The amount of time in seconds between NAT keep alive
messages. Once a connection is established through a firewall, the VPN devices
have to send keep alive messages to prevent the NAT firewall from timing out the
connection. Set the interval to a value less than the connection timeout of the NAT
firewall.
–
ISAKMP Phase 1 Policies:
Keys are negotiated in two phases. The first phase negotiates the keys and
authentication method to be used to establish the initial ISAKMP connection.
During this phase, the two VPN devices verify each other’s identity and create a
security association (encrypted connection) which is used during phase 2. The
encryption and authentication settings you specify determine the level of security in
the connection the two VPN devices used to communicate with each other.
Select the policies to be used during phase 1 of the ISAKMP negotiation. The most
important thing is to make sure that the Digi unit and the remote VPN device use the
same policies. If more than one policy is specified, the VPN devices will use the
most secure policy that they both have been configured to support.
Pre-shared Key: Using DSS and RSA signatures is more secure than using a preshared key.
Encryption: The encryption type and the length of the key. The longer the key the
more secure it is.
Integrity: The authentication algorithm. The SHA1 algorithm is more secure than
MD5.
SA Lifetime: The maximum length of the phase 1 security association.
Diffie-Hellman: The Diffie-Hellman group to use for key generation. The larger the
group the more secure it is.
82