User manual D-LINK VPN CLIENT NETDEFEND BROCHURE

[. . . ] . 6 . 7 . 7 . 7 . 8 . 8 . 9 . 9 . 9 10 10 11 11 11 12 12 13 14 14 15 15 15 15 16 16 17 17 17 17 18 18 18 18 19 19 19 20 21 21 21 2 Configuration Parameters . 23 24 24 25 26 27 27 27 27 28 28 29 29 29 30 30 30 30 30 31 31 32 33 33 34 34 35 35 36 36 36 36 36 37 37 37 37 38 38 38 39 39 40 40 41 3 Enable Stateful Inspection . 43 43 45 45 45 45 45 46 46 46 4 Client Monitor Once you have installed the D-Link VPN Client the graphical interface referred to as the Monitor should appear automatically on the PC's screen. To manually display the Monitor click: Start Programs D-Link VPN Client D-Link VPN Client Monitor The Client Monitor will be loaded and displayed on the screen or in the task bar. [. . . ] The same policies with their affiliated proposals should be valid for all users. This means that on the client side, as well as on the server side, the same proposals for the policies should be available. 29 automatic mode: In this case it is not necessary to configure the IKE policy in the "IPSec Configuration". Policy Name: When selecting the name of the pre-configured IKE policy the same pre-shared key must be used on both sides (see Pre-shared key, Shared secret in the parameter folder "Identities"). IPSec Policy The IPSec policy is selected from the List box. All IPSec policies that you set up in the "IPSec Configuration" after clicking the button "Policy editor" are in the list box. The policies appear in the box with the name that you specified in the configuration. automatic mode: In this case it is not necessary to configure the IPSec policy in the "IPSec Configuration". Policy Name: When selecting the name of the pre-configured IPSec policy the same policies with their affiliated proposals should be valid for all users. This means that on the client side, as well as on the server side, the same proposals for the policies should be available. Policy lifetimes The lifetime of the policies defined here are applicable to all the policies. Life Type Determines the criteria for key validation based either on duration or transferred bytes or both. Duration The number of Kbytes or the size of the time interval can be adjusted. kBytes The number of Kbytes or the size of the time interval can be adjusted. 30 Policy editor IKE Policy The parameters in this field relate to phase 1 of the Internet Key Exchange (IKE) with which the control channel for the SA negotiation was established. You determine the IKE mode (Exchange Mode), main mode or aggressive mode, in the profile settings under "IPSec General Settings". The IKE policies that you configure here will be listed for the policy selection. Every policy lists at least one proposal for authentication and encryption algorithms. The same policies with their affiliated proposals should be valid for all users. This means that on the client side, as well as on the server side, the same proposals for the policies should be available. You can extend the list of proposals or delete a proposal from the proposal list by using the buttons "Add" and "Remove". Parameters: · · · · · Policy Name [IKE Policy] Authentication [IKE Policy] Encryption [IKE Policy] Hash [IKE Policy] DH Group [IKE Policy] Policy Name [IKE Policy] Give this policy a name over which later an SPD can be allocated Authentication [IKE Policy] 31 Both sides must have been successfully authenticated in order to establish a control channel for phase 1 (IKE Security Association). You define this key in the parameter folder "Identities" (see Pre-shared key, Shared secret). Encryption [IKE Policy] Symmetrical encryption of messages 5 and 6 in the control channel occurs according to one of the optional encryption algorithms if Main Mode ("Identity Protection Mode") is used. Hash [IKE Policy] This is mode that determines how the hash value over the ID is formed, or in other words this determines which hash algorithm is used in the IKE negotiation. Choices are: MD5 (Message Digest, version 5) and SHA (Secure Hash Algorithm) DH Group [IKE Policy] The selection of one of the offered Diffie Hellman groups determines the level of security for the key exchange in the control channel. [. . . ] The addresses/telephone/fax list of the nearest Authorized D-Link Service Office is provided in the back of this manual. FAILURE TO PROPERLY COMPLETE AND TIMELY RETURN THE REGISTRATION CARD MAY AFFECT THE WARRANTY FOR THIS PRODUCT. Any claim under this limited warranty must be submitted in writing before the end of the Warranty Period to an Authorized D-Link Service Office. The claim must include a written description of the Software nonconformance in sufficient detail to allow D-Link to confirm the same. [. . . ]