WSM User Guide - WatchGuard Technologies

Making a Manual Tunnel7 From the Type drop-down list, select ESP or AH as the proposal method.ESP is authentication with encryption. AH is authentication only. Also, ESP authentication does not include the IPheader, while AH does. The use of AH is rare.8 From the Authentication drop-down list, select SHA1, MD5, or None for the authenticationmethod.9 (ESP only) From the Encryption drop-down list, select the encryption method.The options are DES, 3DES, and AES 128, 192, or 256 bit which appear in the list from the most simple and leastsecure to most complex and most secure.10 You can make the key expire after a quantity of time or a quantity of traffic. To enable key expiration,select the Force Key Expiration check box.11 Enter a quantity of time and a number of bytes after which the key expires.12 Click OK to close the Phase2 Proposal dialog box.13 Select the PFS check box to enable Perfect Forward Secrecy (PFS). If you enable PFS, select theDiffie-Hellman group.Perfect Forward Secrecy gives more protection to keys that are created in a session. Keys made with PFS are notmade from a previous key. If a previous key is compromised after a session, your new session keys are secure. Diffie-Hellman Group 1 uses a 768-bit group to create the new key exchange, and Diffie-Hellman Group 2 uses a 1024-bitgroup.14 Click Advanced to configure advanced settings. Use the Phase2 Advanced Settings dialog box toconfigure the tunnel to use Any for the policy or for the address. Click OK when you are done.If “Use Any for Service” is not selected, a security association (SA) is created for each set of port/protocol pairsdefined in each policy that is used. This creates a different VPN tunnel for each policy. If “Use Any for Address” isnot selected, a security association (SA) is created based on the tunnel routes (the local-remote pairs).248 WatchGuard System Manager