WatchGuard Firebox System 4.6 User Guide

Branch office VPN with IPSec2 Use the Authentication drop list to select an authentication method.Options include: None (no authentication), MD5-HMAC (128-bit algorithm), or SHA1-HMAC(160-bit algorithm).3 Click Key. Enter a passphrase. Click OK.The passphrase appears in the Authentication Key field. You cannot enter a key here directly.If there are Fireboxes at both ends of the tunnel, the remote administratorcan also enter the encryption and authentication passphrases. If the remotefirewall host is an IPSec-compliant device of other manufacture, the remotesystem administrator must enter the literal keys displayed in the SecurityAssociation Setup dialog box when setting up the remote IPSec-compliantdevice.Configuring a tunnel with dynamic securityA tunnel encapsulates packets between two gateways. It specifies encryption typeand/or authentication method. A tunnel also specifies endpoints. The followingdescribes how to configure a tunnel using a gateway with the isakmp (dynamic) keynegotiation type. From the IPSec configuration dialog box:1 Click Tunnels.2 To add a new tunnel, click Add.3 Click a gateway with isakmp (dynamic) key negotiation type to associate with thistunnel. Click OK.4 Type a tunnel name.Policy Manager uses the tunnel name as an identifier.5 Click the Dynamic Security tab.6 Use the Type drop list to select a Security Association Proposal (SAP) type.Options include: Encapsulated Security Payload (ESP) or Authenticated Headers (AH).7 Use the Authentication drop list to select an authentication method.Options include: None (no authentication), MD5-HMAC (128-bit algorithm), and SHA1-HMAC(160-bit authentication algorithm).8 Use the Encryption drop list to select an encryption method.Options include: None (no encryption), DES-CBC (56-bit), and 3DES-CBC (168-bit encryption).9 To have a new key generated periodically, enable the Force Key Expirationcheckbox.With this option, transparent to the user, the ISAKMP controller generates and negotiates a newkey for the session. For no key expiration, enter 0 (zero) here. If you enable the Force keyexpiration checkbox, set the number of kilobytes transferred or hours passed in the session beforea new key is generated for continuation of the VPN session.10 Click OK.The Configure Tunnels dialog box appears displaying the newly created tunnel. Repeat the tunnelcreation procedure until you have created all tunnels for this particular gateway.11 After you add all tunnels for this gateway, click OK.The Configure Gateways dialog box appears.12 To configure more tunnels for another gateway, click Tunnels. Select a newgateway and repeat the tunnel creation procedure for that gateway.13 When all the tunnels are created, click OK.Creating an IPSec policyPolicies are sets of rules, much like packet filter rules, for defining how outgoingIPSec packets are built and sent and determining whether incoming IPSec packets canUser Guide 127