To create an ISAKMP policy, click the Create button.
In the Name field, enter a unique name for the ISAKMP
policy.
If you click the Default checkbox, the Default ISAKMP
policy is selected and displayed. You can modify the attributes
of the Default ISAKMP policy.
Enter the Lifetime value in seconds. The default
value is 28800 (8 hours). The value must fall between the 600 seconds
and 12 hours (43,200 seconds).
Enter the Max Quick Modes value. The default value
is 100. For perfect forward secrecy (PFS), enter 1 in the Max Quick
Modes field.
If the value of Max Quick Modes is 1, IKE provides PFS for
the IPSec SA keys and the identities of the ISAKMP negotiating parties
(and identities of any parties for which the ISAKAMP parties are
acting as proxies). With PFS, the exposure of one key permits access
only to data protected by that key. When PFS is configured, the
IKE daemon creates a new ISAKMP SA for each IPSec SA negotiation
and performs a Diffie-Hellman exchange for each IPSec SA negotiation.
Select an Oakley Group. The default group is MODP(1).
MODP(1) uses 768 bits for an exponent, while MODP (2) uses 1024
bits.
Select the appropriate Hash algorithm from the Hash
display window.
Select the appropriate Encryption algorithm from
the Encryption display window.
Select the appropriate Authentication algorithm
from the Authentication display window.
Click OK to save the policy and return to the Create
IPSec/9000 Policy screen.
Printable version
