Configure Phase 2 Settings

Phase 2 settings include settings for a security association (SA), which defines how data packets are secured when they are passed between two endpoints. The SA keeps all information necessary for the XTM device to know what it should do with the traffic between the endpoints. Parameters in the SA can include:

The Phase 2 settings you can configure are the same for a BOVPN gateway or a BOVPN virtual interface.

To configure Phase 2 settings:

  1. From the Gateway page or the BOVPN Virtual Interface page, select the Phase 2 Settings tab.

Screen shot of the Tunnel Phase 2 Settings tab

  1. Select the Enable Perfect Forward Secrecy check box if you want to enable Perfect Forward Secrecy (PFS). If you enable PFS, select the Diffie-Hellman group.

Perfect Forward Secrecy gives more protection to keys that are created in a session. Keys made with PFS are not made from a previous key. If a previous key is compromised after a session, your new session keys are secure. For more information, see About Diffie-Hellman Groups.

  1. The XTM device contains one default proposal, which appears in the IPSec Proposals list. This proposal specifies the ESP data protection method, AES encryption, and SHA-1 authentication. You can either:

If you plan to use the IPSec pass-through feature, you must use a proposal with ESP (Encapsulating Security Payload) as the proposal method. IPSec pass-through supports ESP but not AH. For more information on IPSec pass-through, see About Global VPN Settings.

Give Us Feedback  •   Get Support  •   All Product Documentation  •   Knowledge Base