Support User Manuals

Enterasys Networks XSR CLI Router User Manual

Open as PDF

of 684

IPSec Commands

14-106 Configuring the VPN

Parameters Descriptions

Main Mode Exchange

Aggressive Mode Exchange

Quick Mode Exchange

IPSec Commands

ThissectiondescribescommandsthatconfiguretheIPSecprotocolwhichprovidesanti‐replay

protectionaswellasdataauthenticationand encryption.

access-list

ThiscommandcreatesanaccesslistwhichisusedtodefinewhichIPtrafficwillandwillnotbe

protectedbythecryptoprocess.ACLsassociatedwithIPSeccryptomapentrieshavethese

primaryfunctions:

•SelectoutboundtraffictobeprotectedbyIPSec:thekeywordpermitequateswithprotected

traffic.

• Indicatethe

dataflowtobeprotectedbythenewSecurityAssociations(SAs)‐sp ecifiedbya

singlepermitentry‐wheninitiatingnegotiationsforIPSecSAs.

•Processinboundtraffictofilteroutanddiscardtrafficthatshouldhavebeenprotectedby

IPSec.

• DeterminewhetherornottoacceptrequestsforIPSecSAsonbehalf

oftherequesteddata

flowswhenprocessingIKEnegotiationfromtheIPSecpeer(negotiationisdoneonlyforipsec‐

isakmpcryptomapentries.)Inordertobeaccepted,ifthepeerinitiatesIPSecnegotiation,it

mustspecifyadataflowthatis“permitted”byacryptoaccesslistassociatedwithan

ipsec‐

isakmpcryptomapentry.

MM_NO_STATE ISAKMPSAhasonlyjustbeencreatedandnostateisyetestablished.

MM_SA_SETUP PeershaveagreedonsettingsfortheISAKMPSA.

MM_KEY_EXCH PeershaveexchangedDiffie‐Hellmanpublickeysandbuiltasharedsecret.

TheISAKMPSAisnotauthenticated.

MM_KEY_AUTH ISAKMPSAisauthenticated.If

theXSRbeganthisexchange,thisstate

transitionsimmediatelytoQM_IDLEandaQuickModeexchangebegins.

AG_NO_STATE ISAKMPSAhasonlyjustbeencreatedandnostateisyetestablished.

AG_INIT_EXCH PeershavemadethefirstexchangeinAggressiveModebuttheSAis

notauthenticated.

AG_AUTH ISAKMPSAhasbeenauthenticated.IftheXSRbeganthisexchange,

thisstatetransiti onsimmediatelytoQM_IDLEandaQuickMode

exchange

begins.

QM_IDLE ISAKMPSAisquiescent.Itremainsauthenticatedwithitspeerand

maybeusedforlaterQuickModeexchanges.

previous next