User's Manual

VPN
Configuring the Site-to-Site VPN
Cisco ISA500 Series Integrated Security Appliance Administrator Guide 255
8
After you click Add or Edit, the IKE Policy - Add/Edit window opens.
STEP 3 Enter the following information:
• Name: Enter an unique name for the IKE policy.
• Encryption: Choose the algorithm used to negotiate the security
association. There are four algorithms supported by the security appliance:
ESP_3DES, ESP_AES-128, ESP_AES-192, and ESP_AES-256.
• HASH: Specify the authentication algorithm for the VPN header. There are
two HASH algorithms supported by the security appliance: SHA1 and MD5.
NOTE Ensure that the authentication algorithm is configured identically on
both sides.
• Authentication: Specify the authentication method that the security
appliance uses to establish the identity of each IPsec peer.
- PRE-SHARE: Uses a simple password based key to authenticate. The
alpha-numeric key is shared with IKE peer. Pre-shared keys do not scale
well with a growing network but are easier to set up in a small network.
- RSA-SIG: Uses a digital certificate to authenticate. RSA-SIG is a digital
certificate with keys generated by the RSA signatures algorithm. In this
case, a certificate must be configured in order for the RSA-Signature to
work.
• D-H Group: Choose the Diffie-Hellman group identifier, which the two IPsec
peers use to derive a shared secret without transmitting it to eachother. The
D-H Group sets the strength of the algorithm in bits. The lower the Diffie-
Hellman group number, the less CPU time it requires to execute. The higher
the Diffie-Hellman group number, the greater the security.
- Group 2 (1024-bit)
- Group 5 (1536-bit)
- Group 14 (2048-bit)
• Lifetime: Enter the number of seconds for the IKE Security Association to
remain valid. The default is 24 hours. As a general rule, a shorter lifetime
provides more secure ISAKMP negotiations (up to a point). However, with
shorter lifetimes, the security appliance sets up future IPsec SAs more
quickly.