WSM User Guide - WatchGuard Technologies

Tunneling ProtocolsThe length of the encryption key, together with the algorithm used, set the encryption strength for theVPN. A longer key gives better encryption and more security. The level of encryption is set to give theperformance and security that is necessary for the organization. Stronger encryption usually gives ahigher level of security, but can have a negative effect on performance.Basic encryption allows sufficient security with good throughput for tunnels that do not transmit sensitivedata. For administrative connections and for connections where privacy is very important, we recommendstrong encryption.The host or the IPSec device that sends a packet through the tunnel encrypts the packet. The recipientat the other end of the tunnel decrypts the packet. The two endpoints must agree on all the tunnelparameters. This includes the encryption and authentication algorithms, the hosts or networks allowedto send data across the tunnel, the time period for calculating a new key, and other parameters.Selecting an encryption and data integrity methodThink of security and performance when you select the encryption and data integrity algorithms to use.We recommend Advanced Encryption Standard (AES), the strongest of the encryption types, for sensitivedata. Fireware® uses AES 256 as the default encryption algorithm for IPSec.Data integrity makes sure that the data a VPN endpoint receives is not changed as it is sent. We give supportto two types of data authentication. The first type is 128-bit Message Digest 5 (MD5-HMAC). Thesecond type is 160-bit Secure Hash Algorithm (SHA1-HMAC).AuthenticationAn important part of security for a VPN is to make sure that the sender and recipient are authenticated.There are two method: passphrase authentication (also called a shared secret) and digital certificates. Ashared secret is a passphrase that is the same for the two ends of the tunnel.Digital certificates use public key cryptography to identify and authenticate the end gateways. You canuse certificates for authentication for any VPN tunnel you create with your WatchGuard ManagementServer. For more information on the certificates, see the “Managing Certificates and the CertificateAuthority” chapter.Extended authenticationAuthentication for a remote user can occur through a database that is kept on the Firebox®, or throughan external authentication server. An example of an external authentication server is the RemoteAuthentication Dial-In User Service (RADIUS). An authentication server is a safe third party that authenticatesother systems on a network. With Mobile User VPN (MUVPN), which uses the IPSec tunneling protocol,the remote user must type a user name and password each time a VPN is started.Selecting an authentication methodA primary part of a VPN is its method of user authentication. When you use shared secrets safely, youmust make sure that you:• Make users select strong passwords.• Change passwords frequently.When you use Remote User VPN (RUVPN), which uses the PPTP tunneling protocol, or MUVPN, it is veryimportant to use strong passwords. When you put the security of VPN endpoints at risk, you can put theUser Guide 227