NETGEAR FVS336Gv3 - Page 376

Set Up Virtual Private Networking With IPSec Connections
376
ProSAFE Dual WAN Gigabit WAN SSL VPN Firewall FVS336Gv3
Diffie-Hellman (DH)
Group
The DH Group sets the strength of the algorithm in bits. The higher the group, the
more secure the exchange. From the menu, select the strength:
• Group 1 (768 bit).
• Group 2 (1024 bit). This is the default setting.
• Group 5 (1536 bit).
Note: Ensure that the DH group is configured identically on both sides.
SA-Lifetime (sec) The period in seconds for which the IKE SA is valid. When the period times out,
the next rekeying occurs. The default is 28800 seconds (eight hours).
Enable Dead Peer
Detection
Select a radio button to specify whether Dead Peer Detection (DPD) is enabled:
• No. This feature is disabled. This is the default setting.
• Yes. This feature is enabled. When the VPN firewall detects an IKE
connection failure, it removes the IPSec and IKE SA and forces a
reestablishment of the connection. You must specify the detection period in
the Detection Period field and the maximum number of times that the VPN
firewall attempts to reconnect in the Reconnect after failure count field.
Note: For more information, see Manage Keep-Alives and Dead Peer Detection
on page 414.
Detection Period The period in seconds between consecutive DPD R-U-THERE messages, which
are sent only when the IPSec traffic is idle.
Reconnect after failure
count
The maximum number of DPD failures before the VPN firewall tears down the
connection and then attempts to reconnect to the peer. The default is 3 failures.
Extended Authentication
XAUTH Configuration Select a radio button to specify whether Extended Authentication (XAUTH) is
enabled and, if enabled, which device is used to verify user account information:
• None. XAUTH is disabled. This the default setting.
• Edge Device. The VPN firewall functions as a VPN concentrator on which
one or more gateway tunnels terminate. The authentication modes that are
available for this configuration are User Database, RADIUS PAP, or RADIUS
CHAP.
• IPSec Host. The VPN firewall functions as a VPN client of the remote
gateway. In this configuration, the VPN firewall is authenticated by a remote
gateway with a user name and password combination.
Note: For more information about XAUTH and its authentication modes, see
Enable and Configure Extended Authentication for VPN Clients on page 392.
Setting Description