Robustel R1510 - Page 78

Robustel R1510 User Guide
RT_UG_R1510_v.1.0.1 Dec. 31, 2019 78/140
SA Settings
Item
Description
Default
Encrypt Algorithm
Select from “3DES”, “AES128”, “AES192”or “AES256” when you select “ESP”
in “Protocol”. Higher security means more complex implementation and
lower speed. DES is enough to meet general requirements. Use 3DES when
high confidentiality and security are required.
3DES
Authentication
Algorithm
Select from “MD5”, “SHA1”, “SHA2 256” or “SHA2 512” to be used in SA
negotiation.
SHA1
PFS Group
Select from “PFS (N/A)”, “DHgroup1”, “DHgroup2”, “DHgroup5”,
“DHgroup14”, “DHgroup15”, “DHgroup16”, “DHgroup17” or “DHgroup18”
to be used in SA negotiation.
DHgroup2
SA Lifetime
Set the IPsec SA lifetime. When negotiating to set up IPsec SAs, IKE uses the
smaller one between the lifetime set locally and the lifetime proposed by
the peer.
28800
DPD Interval
Set the interval after which DPD is triggered if no IPsec protected packets is
received from the peer. DPD is a Dead peer detection. DPD irregularly
detects dead IKE peers. When the local end sends an IPsec packet, DPD
checks the time the last IPsec packet was received from the peer. If the time
exceeds the DPD interval, it sends a DPD hello to the peer. If the local end
receives no DPD acknowledgment within the DPD packet retransmission
interval, it retransmits the DPD hello. If the local end still receives no DPD
acknowledgment after having made the maximum number of
retransmission attempts, it considers the peer already dead, and clears the
IKE SA and the IPsec SAs based on the IKE SA.
30
DPD Failures
Set the timeout of DPD (Dead Peer Detection) packets.
180
Advanced Settings
Enable Compression
Click the toggle button to enable/disable this option. Enable to compress
the inner headers of IP packets.
OFF
Enable Forced
Encapsulation
Click the switch button to enable/disable this option. When enabled, UDP
encapsulation of esp packets is enforced even if NAT conditions are not
OFF